Renew T03 requests using Railiance time and bind native execution

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/credential-lane-designs/t03-renewed-execution.md

@@ -0,0 +1,25 @@
+# T03 continuation after Railiance Clock deployment
+
+The original requests expired unconsumed. Replacement request IDs and immutable
+memo version 2 are recorded in the creation receipt and Secrets Engine workplan.
+The exact apply/verify/exec action requests and checker pins are unchanged.
+
+Run the requester and execution worker with
+`/home/worsch/secrets-engine/.venv/bin/python`; this environment includes Clock,
+JSON Schema, JWT, and YAML dependencies. The requester requires
+`--clock-trust-file` and validates full token validity against that interval.
+The native execution worker requires `SECRETS_ENGINE_CLOCK_TRUST_FILE`.
+Refresh the boot-bound admission via the independently verified Clock public key
+and SSH owner epoch readback immediately before attended execution. An expired
+trust file fails closed; never extend it or use workstation wall-time fallback.
+
+Use `http://127.0.0.1:18200` for the admitted OpenBao relay and the existing
+`operator-browser` PATH helper on WSL when no browser launcher is installed.
+The outer lane remains secrets-engine-approval-client-login; its reviewed
+`t03-attended-delivery.py` invokes the separate contained platform-admin lane.
+Both retain their own self-revocation and private runtime cleanup.
+
+Human review: https://decisions.coulomb.social/review?memo_id=SECRETS-WP-0010-T03-apply
+(and identifiers ending -verify and -exec). Version 2 is required. The requester
+has no approval or consume scope; no human entries are copied from version 1.
+No execution may begin before the new approvals pass native claim/PDP checks.