Record founder requester design approval and retain execution gates

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042

credential-change-requests/CCR-2026-0032.yaml

@@ -15,7 +15,17 @@ review:
   required_approvers:
   - platform-owner
   - informed-decision-owner
-  comments: []
+  comments:
+  - at: '2026-10-04'
+    reviewer: Bernd Worsch
+    decision: design_boundary_approved
+    comment: 'Founder answered "I approve" to the prepared requester-delivery design
+      for owner integration. Approves the exact existing-path reader, dedicated ESO
+      identity, informed-decision namespace boundary, 15-minute reader tokens and
+      read-only credential projection; namespace writer exposure and persistence
+      beyond reader-token lifetime were disclosed. Owner runtime/binding acceptance
+      and separate live deployment go remain; status stays proposed until those
+      gates are satisfied. This does not resolve the broader intake rollout decision.'
 target:
   domain: financials
   tenant: platform

docs/credential-lane-designs/informed-decision-requester-workload.md

@@ -1,9 +1,17 @@
 # Informed-decision requester workload delivery
 
-Status: proposed source, CCR-2026-0032, RPF-WP-0051. Demand: INFD-WP-0005-T05,
+Status: founder-approved design for owner integration; execution pending,
+CCR-2026-0032, RPF-WP-0051. Demand: INFD-WP-0005-T05,
 message cd811073-d6db-41cf-8a57-10df0b360eab. Source preparation is authorized by
 the founder's RPF-WP-0050 scope selection and continuation instruction.
 
+2026-10-04: Bernd answered "I approve" to the prepared design boundary, including
+namespace-level ESO trust and credential persistence beyond the reader token's
+lifetime. This supplies the design judgment. Owner binding/runtime acceptance
+and the separately reviewed live deployment remain; no repeated design decision
+is needed unless the boundary materially changes. CCR status remains proposed
+and auth claims unconfirmed while the implementation gates are open.
+
 ## Exact proposed boundary
 
 The existing KV-v2 path `platform/workloads/informed-decision/sitting-requester`

docs/evidence/2026-10-04-requester-design-approval.json

@@ -0,0 +1,18 @@
+{
+  "schema": "railiance-platform.requester-design-approval.v1",
+  "date": "2026-10-04",
+  "founder": "Bernd Worsch",
+  "answer": "I approve",
+  "scope": "design boundary for owner integration",
+  "decision_id": "2037f8e0-df40-49cd-bca0-4406abcdfa64",
+  "ccr": "CCR-2026-0032",
+  "ccr_status": "proposed",
+  "binding_confirmed": false,
+  "live_execution_authorized": false,
+  "broader_owner_decision_resolved": false,
+  "source_sha256": {
+    "credential-change-requests/CCR-2026-0032.yaml": "ab4cd7c15192ebe98e17b0c40a188ae67616c63cc796d9b807adba7c39f2edb3",
+    "docs/credential-lane-designs/informed-decision-requester-workload.md": "a220717376f249a3160c29a904983d26705eecf2bef3ef2dccbb759accdca7eb",
+    "scripts/informed_decision_requester_metadata.py": "ddad76dc6bcd3de62158a4225eb481dda87a044d88a3c21e8344a0aa379d8fc5"
+  }
+}

docs/provisioning-windows/2026-10-04-1000/README.md

@@ -19,6 +19,12 @@ contracts: `docs/credential-lane-designs/secrets-engine-service-jwt.md`,
 the named authoritative owner workplans. The informed-decision item has separate
 decision `0d6792b6-59e4-4fa0-887a-c4e51ea8e131`; it is not joined to D1.
 
+2026-10-04 founder review: the exact informed-decision requester-delivery design
+is approved for owner integration, including its namespace boundary. Its CCR
+remains proposed while exact owner binding/runtime acceptance and the separate
+live go are outstanding. This design judgment does not activate the private
+intake listener or resolve the broader owner decision.
+
 ## Receipt boundaries
 
 For secrets-engine, return public issuer/claim/registration and protected-custody
@@ -50,9 +56,12 @@ this packet or its receipts.
 
 ## Separate decision and exclusions
 
-RPF-WP-0035-T06 is a human acceptance of the passed approval-reader delivery proof
-(informed-decision memo `infd-20261003-p01`), requiring no provisioning session.
-Do not repeat its applied reader custody to obtain that answer.
+The human acceptance of approval-reader delivery proof (informed-decision memo
+`infd-20261003-p01`) already occurred on 2026-10-03 at 18:45:15 UTC. The retained
+owner receipt `informed-decision/docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`
+records confirmed native human acceptance and delivered audit evidence. Its scope
+explicitly leaves RPF-WP-0035-T06 and D1 open for remaining owner checks. Do not
+ask the founder to repeat that proof acceptance or replay applied reader custody.
 
 CCR-2026-0031 Core Hub private-source custody and MASON-WP-0007-T05 tenant-engine
 sender seed were completed on 3 October. RPF-WP-0035-T08 factory sender custody

workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md

@@ -73,7 +73,7 @@ priority: high
 depends_on: [RPF-WP-0051-T02]
 needs_human: true
 decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
-blocking_reason: "Founder approval of exact CCR and binding plus attended metadata apply and separately approved ESO/runtime promotion are required after owner acceptance."
+blocking_reason: "Founder approved the design boundary for owner integration on 2026-10-04. Exact owner runtime/binding acceptance, final execution packet and separate founder live go remain before attended metadata apply and ESO/runtime promotion."
 state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
 ```
 
@@ -84,3 +84,11 @@ their actual owner deployment paths after diff/server dry-run and resource
 checks. Accept delivery, exact token-policy/identity/TTL, sibling/list denial,
 create-only exchange and cleanup/revocation receipts. Revoke this reader on
 abort without touching the issuer or historical verifier/attended-reader lanes.
+
+2026-10-04 founder design decision: Bernd answered "I approve" after review of
+the exact new delivery boundary, namespace-level trust and credential persistence
+beyond reader-token lifetime. Design approval for owner integration is recorded
+in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the
+separate concrete live go remain; no repeated design decision is required unless
+scope materially changes. The broader INFD-WP-0005-T05 decision remains open for
+runtime/listener acceptance and deployment. No credential action occurred.