diff --git a/scripts/t03-attended-delivery.py b/scripts/t03-attended-delivery.py
new file mode 100644
index 0000000..007b00a
--- /dev/null
+++ b/scripts/t03-attended-delivery.py
@@ -0,0 +1,49 @@
+"""Scoped reader -> contained attended administration; never exports credentials."""
+import importlib.util,json,os,signal,stat,subprocess,tempfile
+from pathlib import Path
+from datetime import datetime,timezone
+from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
+ROOT=Path('/home/worsch/railiance-platform')
+spec=importlib.util.spec_from_file_location('preflight',ROOT/'scripts/approval-client-reader-preflight.py');pre=importlib.util.module_from_spec(spec);spec.loader.exec_module(pre)
+RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-attended-delivery.json'
+class NoRedirect(HTTPRedirectHandler):
+ def redirect_request(self,*args,**kwargs):return None
+
+def require(value,code):
+ if not value:raise ValueError(code)
+def private(path,directory=False):
+ st=path.lstat();require(st.st_uid==os.getuid() and stat.S_IMODE(st.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(st.st_mode) if directory else stat.S_ISREG(st.st_mode)),'private_path_required')
+def main(receipt):
+ require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_reader_required')
+ require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-14-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation')
+ identity=pre.bao('token','lookup','-format=json')['data'];pre.validate_identity(identity)
+ for path,expected in pre.EXPECTED.items():require(sorted(pre.bao('token','capabilities','-format=json',path))==expected,'reader_scope_failed')
+ runtime=Path('/run/user')/str(os.getuid());private(runtime,True)
+ fs=subprocess.run(['findmnt','-n','-o','FSTYPE','-T',str(runtime)],capture_output=True,text=True,timeout=10)
+ require(fs.returncode==0 and fs.stdout.strip()=='tmpfs','private_tmpfs_required')
+ helper=Path.home()/'.vault-token';private(helper)
+ with tempfile.TemporaryDirectory(prefix='t03-native-',dir=runtime) as name:
+  directory=Path(name);private(directory,True)
+  req=Request('https://bao.coulomb.social/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':helper.read_text().strip()})
+  with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response:
+   data=response.read(65537);require(len(data)<=65536,'response_bound_exceeded')
+  data=json.loads(data);require(data['data']['metadata']['version']==1,'custody_version_mismatch')
+  value=data['data']['data']['CLIENT_SECRET'];require(isinstance(value,str) and 0<len(value)<=16384,'credential_invalid')
+  fd=os.open(directory/'client-secret',os.O_CREAT|os.O_EXCL|os.O_WRONLY|os.O_NOFOLLOW,0o600)
+  with os.fdopen(fd,'w') as stream:stream.write(value)
+  del value,data,req
+  receipt.update(phase='scoped_reader_delivered',reader_effective_policy_verified=True,existing_kv_version=1)
+  RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
+  p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','python3','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780)
+  # Warden's output remains inside this envelope, never forwarded or stored.
+  require(p.returncode==0,'attended_admin_failed')
+  receipt.update(status='passed',phase='native_actions_completed',admin_warden_exited_0=True)
+ receipt['private_runtime_removed']=True
+
+if __name__=='__main__':
+ receipt={'observed_at':datetime.now(timezone.utc).isoformat(),'status':'failed','phase':'preflight','credential_values_emitted':False}
+ try:main(receipt)
+ except Exception as e:
+  if type(e) is ValueError and str(e).replace('_','').isalnum():receipt['failure_code']=str(e)
+  raise SystemExit(1) from None
+ finally:RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
diff --git a/scripts/t03-native-execution.py b/scripts/t03-native-execution.py
new file mode 100644
index 0000000..87dec9d
--- /dev/null
+++ b/scripts/t03-native-execution.py
@@ -0,0 +1,146 @@
+"""Single-attempt T03 owner procedure; native PEP checks precede every action."""
+import argparse,base64,copy,contextlib,io,json,os,stat,subprocess,sys,tempfile
+from pathlib import Path
+from datetime import datetime,timezone
+from dataclasses import replace
+import yaml
+ROOT=Path('/home/worsch/secrets-engine')
+sys.path.insert(0,str(ROOT/'src'))
+from secrets_engine.config import Config
+from secrets_engine.catalog import get_entry
+from secrets_engine.authorization import build_action_request,digest_material
+from secrets_engine.approval_consume import authorize_action
+from secrets_engine.cli import build_parser
+from secrets_engine.decisions import resolve_decision,require_approved
+from secrets_engine.openbao import OpenBaoClient
+from secrets_engine.exec_owner import validate_delivery_target
+from secrets_engine.plan import build_plan
+RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-native-execution.json'
+KUBE=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
+ROLE='se-prod-openrouter-llm-connect'; LANE='openrouter-llm-connect'
+IDS={'apply':'09592588-ab15-53e7-89b8-c4e9f29aaacf','verify':'9416fa31-fa9e-5603-8289-f35bc9625409','exec':'da678b61-35be-598e-8d95-a7aefa2fdc73'}
+
+def require(value,code):
+ if not value:raise ValueError(code)
+def private(p,directory=False):
+ s=p.lstat();require(s.st_uid==os.getuid() and stat.S_IMODE(s.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode)),'private_path_required')
+def run(*args):
+ p=subprocess.run(args,capture_output=True,text=True,timeout=30);require(p.returncode==0,'metadata_command_failed');return p.stdout
+def bao(*args):return json.loads(run('bao',*args))
+def save(receipt):RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
+def prepare(directory):
+ source=yaml.safe_load((ROOT/'docs/proposals/openrouter-key-check.yaml').read_text())
+ configs={};entries={}
+ for action,approval in IDS.items():
+  folder=directory/action;folder.mkdir();doc=copy.deepcopy(source);doc['approval']['authorization_id']=approval
+  (folder/(LANE+'.yaml')).write_text(yaml.safe_dump(doc,sort_keys=False))
+  cfg=replace(Config.load(),catalog_dir=folder,bao_addr='https://bao.coulomb.social',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller')
+  entry=get_entry(folder,LANE);fields=() if action=='apply' else tuple(entry.fields)
+  actual=build_action_request(entry,action,subject_id='secrets-engine',subject_type='service',purpose=entry.approval['purpose'],fields=fields,policy_targets=(entry.policy_name,),auth_targets=(entry.role_name,))
+  expected=json.loads((ROOT/f'docs/evidence/2026-09-14-openrouter-final-{action}-request.json').read_text())
+  require(digest_material(actual)==digest_material(expected),'frozen_action_request_drift')
+  configs[action]=cfg;entries[action]=entry
+ command=source['delivery_config']['exec_owner']['command']
+ validate_delivery_target(entries['exec'],entries['exec'].fields[0],command,'exec-env')
+ plan=build_plan(entries['apply'],'prod');require(plan.policy_name==ROLE and plan.role_name==ROLE,'plan_target_drift')
+ return configs,entries,command
+
+def health():
+ # Metadata only: never request Kubernetes Secret payloads.
+ result={}
+ for kind in ('deployment','externalsecret'):
+  items=json.loads(run(*KUBE,'get',kind,'-A','-o','json'))['items']
+  rows=[]
+  for obj in items:
+   if 'llm-connect' not in obj['metadata']['name']:continue
+   if kind=='deployment':
+    require(obj.get('status',{}).get('readyReplicas',0)>=1,'llm_connect_not_ready')
+    rows.append({'namespace':obj['metadata']['namespace'],'name':obj['metadata']['name'],'ready':obj['status']['readyReplicas']})
+   else:
+    require(any(c['type']=='Ready' and c['status']=='True' for c in obj.get('status',{}).get('conditions',[])),'llm_connect_eso_not_ready')
+    rows.append({'namespace':obj['metadata']['namespace'],'name':obj['metadata']['name'],'ready':True})
+  require(rows,'llm_connect_health_target_missing');result[kind]=rows
+ return result
+
+def admin(directory,negative):
+ require(not RECEIPT.exists(),'existing_execution_receipt_requires_reconciliation')
+ receipt={'status':'failed','phase':'preflight','observed_at':datetime.now(timezone.utc).isoformat(),'actions':[]}
+ forwards=[]
+ try:
+  require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_envelope_required')
+  private(directory,True);private(directory/'client-secret');private(negative)
+  identity=bao('token','lookup','-format=json')['data'];policies=set(identity['policies'])|set(identity.get('identity_policies',[]))
+  require('platform-admin' in policies and 'root' not in policies and identity.get('entity_id') and 0<identity['ttl']<=3600,'attended_operator_required')
+  require(bao('read','-format=json','sys/auth')['data'].get('approle/') is not None,'existing_approle_mount_required')
+  configs,entries,command=prepare(directory)
+  receipt['health_before']=health()
+  for ns,label,image,port in [('approval-engine','approval-engine','251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49',18281),('flex-auth','flex-auth-secrets-engine','05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd',18282)]:
+   pods=json.loads(run(*KUBE,'-n',ns,'get','pods','-l','app.kubernetes.io/name='+label,'-o','json'))['items']
+   require(len(pods)==1,'single_owner_pod_required');pod=pods[0]
+   require(any(c.get('ready') and c.get('imageID','').endswith('@sha256:'+image) for c in pod.get('status',{}).get('containerStatuses',[])),'native_image_pin_drift')
+   p=subprocess.Popen(KUBE+['-n',ns,'port-forward','pod/'+pod['metadata']['name'],str(port)+':8080','--address=127.0.0.1'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL);forwards.append(p)
+  import socket,time
+  for port in (18281,18282):
+   for attempt in range(50):
+    try:
+     with socket.create_connection(('127.0.0.1',port),timeout=.2):break
+    except OSError:time.sleep(.1)
+   else:raise ValueError('owner_forward_not_ready')
+  fd=os.open(directory/'pdp-caller',os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
+  with os.fdopen(fd,'w') as out:out.write(run(*KUBE,'-n','secrets-engine','create','token','secrets-engine','--audience=flex-auth','--duration=10m').strip())
+  # Validate real claims and exact current decisions before any consumption.
+  for action in IDS:
+   auth=authorize_action(configs[action],entries[action],action,fields=() if action=='apply' else tuple(entries[action].fields),policy_targets=(ROLE,),auth_targets=(ROLE,))
+   require(auth is not None,'native_authorization_missing')
+  receipt['phase']='all_claims_and_pdp_checks_passed';save(receipt)
+  client=OpenBaoClient.resolve('https://bao.coulomb.social')
+  existing=client.read_policy(ROLE)
+  require(existing is None and not client.approle_exists(ROLE),'existing_native_objects_require_reconciliation')
+  for action in IDS:
+   receipt['phase']=action+'_attempt_started';save(receipt)
+   if action=='apply':argv=['apply',LANE,'--stage','prod','--auth','env']
+   elif action=='verify':argv=['verify',LANE,'--auth','env','--negative-token-file',str(negative)]
+   else:argv=['exec','--catalog',LANE,'--auth','env','--mode','exec-env','--',*command]
+   args=build_parser().parse_args(argv)
+   if action=='exec':args.command=args.command[1:]
+   output=io.StringIO()
+   with contextlib.redirect_stdout(output),contextlib.redirect_stderr(io.StringIO()):rc=args.func(configs[action],args)
+   require(rc==0,'native_action_failed')
+   row={'action':action,'approval_id':IDS[action],'exit_code':rc}
+   if action=='apply':
+    role=bao('read','-format=json','auth/approle/role/'+ROLE)['data']
+    limits={'token_ttl':900,'token_max_ttl':1800,'secret_id_ttl':900,'secret_id_num_uses':1,'token_num_uses':8}
+    require(all(role.get(k)==v for k,v in limits.items()) and role.get('token_policies')==[ROLE],'role_limits_mismatch');row['limits']=limits
+   elif action=='verify':
+    with client.approle_session(ROLE) as session:
+     probes=['platform/data/workloads/secrets-engine/approval-client','platform/metadata/workloads/activity-core']
+     require(all(session.client.token_capabilities(p,token=session.client.token)==['deny'] for p in probes),'unrelated_path_authority')
+    require(session.revocation_succeeded,'session_revocation_failed')
+    require(session.client._run(['token','lookup','-format=json']).returncode!=0,'revoked_token_still_usable')
+    row.update(unrelated_path_denied=True,session_revocation_verified=True)
+   else:
+    result=json.loads(output.getvalue());require(result=={'result':'authenticated','http_status':200},'key_check_result_invalid');row['key_check']=result
+   receipt['actions'].append(row);receipt['phase']=action+'_completed';save(receipt)
+  receipt['health_after']=health();receipt['status']='passed';receipt['phase']='all_actions_completed'
+ except Exception as exc:
+  receipt['failure_type']=type(exc).__name__
+  # Only explicit local codes are eligible; no backend exception text is exported.
+  if type(exc) is ValueError and str(exc).replace('_','').isalnum():receipt['failure_code']=str(exc)
+  raise
+ finally:
+  for p in forwards:
+   p.terminate()
+   try:p.wait(timeout=5)
+   except subprocess.TimeoutExpired:p.kill();p.wait()
+  receipt['owner_forwards_closed']=True;save(receipt)
+
+if __name__=='__main__':
+ p=argparse.ArgumentParser();p.add_argument('mode',choices=['preflight','admin']);p.add_argument('--directory',type=Path);p.add_argument('--negative-token-file',type=Path);a=p.parse_args()
+ try:
+  if a.mode=='preflight':
+   with tempfile.TemporaryDirectory() as t:prepare(Path(t))
+   print('Three frozen requests and pinned recipient passed; native claims checked at execution.')
+  else:admin(a.directory,a.negative_token_file)
+ except Exception:
+  if a.mode=='preflight':raise
+  raise SystemExit(1) from None