The helper checks both draft archive CCRs and refuses a CAS write until the writer identity is admitted. No provider key is created. Assistant: grok Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54