Verify exact task metadata baseline and readback

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/task-execution-mediator-seam.md

@@ -54,9 +54,10 @@ with a preceding durable CAS/confirmation sequence.
    native calls continue at2. Pending/unknown/cleanup-closed state cannot supply a
    next ordinal. Each native request retains its own durable intent and outcome.
 8. Cleanup stays under the original distinct obligations even if business work
-   fails. Returned evidence explicitly says native apply is unverified: six successful
-   native calls do not establish total approved baseline/readback normalization,
-   atomic CAS, service-login provenance or native production owner acceptance.
+   fails. Wave 5 requires exact committed before/after snapshots before reporting
+   native apply verified; six HTTP successes alone remain insufficient. This is
+   sequential fixture acceptance, without atomic CAS, service-login provenance or
+   native production owner acceptance.
 
 The owner configuration selects provider route/read credential and the existing
 Secrets configuration. These are independently installed runtime inputs, never
@@ -105,3 +106,10 @@ per-call served-time/use enforcement, audit/outbox and protected uncertain/crash
 recovery. Then obtain and execute the exact founder-scoped attended trial.
 Approval replay prevention and uncertain native-effect reconciliation remain
 separate guarantees. T12, Secrets WP13 and native adoption stay open.
+
+Wave 5 adds owner-installed exact metadata snapshots committed through the
+existing expected_before/expected_after descriptor fields, per-target baseline
+and complete role/policy readback comparison, durable readback/verified evidence,
+and a separate cleanup-confirmed transition. The sequence remains sequential,
+without native CAS or independently recoverable cleanup handles. See
+[fixture acceptance](task-execution-native-fixture.md#exact-disposable-metadata-acceptance-2026-10-16-wave-5).

docs/task-execution-native-fixture.md

@@ -33,7 +33,7 @@ metadata calls use independently recompiled source/method/path/body. A task use
 reserved for revoke; native token limits also enforce the ceiling. Business calls
 check wall and monotonic deadlines before effect, with a five-second cleanup reserve.
 No retry/remint, caller HCL/JSON/path, mount/AppRole/KV/SecretID or shell API exists.
-The adapter cannot claim complete baseline CAS or normalized readback acceptance.
+Wave 5 below adds exact sequential snapshot acceptance; native baseline CAS remains absent.
 
 Every business/grant request records durable intent and closed status evidence.
 Native cleanup has its own durable per-request intents beneath the original
@@ -89,3 +89,35 @@ native token, then performs explicit synthetic owner recovery. No blind retry oc
 No umbrella broker, general executor, new credential catalogue or standing service
 admin entitlement is introduced. Approval CAS prevents approval replay; it cannot
 make uncertain native effects exactly-once. RPF T12 and Secrets WP13 remain open.
+
+### Exact disposable metadata acceptance (2026-10-16, wave 5)
+
+The owner-installed `FixtureAdmission` now carries canonical JSON before/after
+snapshot bytes. Their SHA-256 values must equal the existing descriptor's
+`expected_before` and `expected_after`, and both snapshots must name exactly the
+two compiled metadata paths. Explicit JSON null means absence. Only the actual
+OpenBao empty-errors 404 is accepted as absence; denied/malformed reads fail.
+These inputs contain metadata, never KV values or private token handles.
+
+Policy comparison retains name, HCL, version and cas_required. Only the
+modification timestamp is excluded, after requiring an aware timestamp and the
+closed observed policy field set. Role comparison retains every returned field,
+including aliases, token defaults and unexpected additions, using canonical JSON
+bytes (therefore false cannot equal zero). The disposable Kubernetes fixture pins
+the complete OpenBao 2.5.5 response shape. Another plugin/version/default requires
+an independently reviewed owner snapshot; nothing infers new accepted defaults.
+
+Each baseline gates its corresponding write. Policy readback occurs before role
+baseline/write/readback. A role conflict can therefore leave the policy applied;
+that operation remains unknown. This sequence has no native CAS, aggregate
+baseline gate, concurrent-writer exclusion, or simultaneous final-state proof.
+After all six calls match the committed snapshots, the same-live adapter records
+readback and verified with a value-free evidence digest. The mediator reports
+native_apply verified; cleanup-confirmed requires all separate cleanup receipts.
+Readback success with unconfirmed cleanup cannot reach cleanup-confirmed.
+
+Reopening SQLite cannot dispatch, reconsume, restore token/accessor handles or
+retry cleanup. Native effects can survive process loss. Cleanup handles remain
+memory-only: no independently authorized recovery mechanism is implemented here.
+This closes disposable sequential apply acceptance only, not TSA03 or native
+production recovery/admission.