Bind wrapped issuance to native metadata and preserve immutable recipient attempts

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/cli.md

@@ -235,3 +235,12 @@ secrets-engine verify whynot-design-npm-publish --field npm_token --positive --n
 # 6. publish with the token injected into the child only
 secrets-engine exec --catalog whynot-design-npm-publish -- npm publish
 ```
+
+Wrapped handoff files must be fresh and inside an owned private directory outside
+Git. Existing files, symlinks and shared directories refuse before minting. A
+failed or uncertain mint leaves its private reservation for owner reconciliation;
+never delete it merely to retry. The backend must return the exact native KV-v2
+data/AppRole creation path, requested bounded TTL and an accessor. Handoff-file
+creation verifies those native fields; a requested path alone is not evidence.
+These checks do not enable production wrapping or the separate execute-ccr
+metadata entitlement.

docs/evidence/2026-10-12-wrapped-issuer-hardening/validation.json

@@ -0,0 +1,54 @@
+{
+  "schema": "wrapped-issuer-source-validation/v1",
+  "task": "SECRETS-WP-0013-T01",
+  "captured_at": "2026-10-11T22:07:09.996760+00:00",
+  "source_sha256": {
+    "src/secrets_engine/openbao.py": "c1d17ca30367fd2c856927e8ce4021599a992c6c22509f82a6d8d4588ea46199",
+    "src/secrets_engine/wrap.py": "a37c491a93c8803015d2f1fca6ea502b8da28a9279900404d8f9ebf06a0c0a70",
+    "tests/test_wrap.py": "40b4511f6f5c2515e8ff70095e8239a4f589a97697fa1827298ec3be89ba57d4",
+    "tests/test_wrapped_issuer_native.py": "e24d86da4e9b0c971aa39c81f34c1bced76d3def1727ee38fe69a3769c80e5c1"
+  },
+  "full_suite": {
+    "collected": 654,
+    "passed": 653,
+    "skipped": 1,
+    "exit": 0,
+    "execution": "isolated tracked-source Git checkout, real filesystem ownership, disposable local OpenBao"
+  },
+  "final_wrap_and_native_tests": {
+    "passed": 24,
+    "exit": 0
+  },
+  "native_local_semantics": {
+    "creation_path": "secret/data/d3-wrap-fixture",
+    "ttl_seconds": 60,
+    "first_unwrap_success": true,
+    "consumed_token_replay": "specific native HTTP400 wrapping-token-invalid denial"
+  },
+  "production_lane_proven": false,
+  "production_authority_enabled": false,
+  "raw_secret_values_in_receipt": false,
+  "negative_cases": [
+    "changed/missing native path",
+    "wrong/missing/noninteger TTL",
+    "missing accessor",
+    "unwrapped material alongside wrap",
+    "overwrite",
+    "symlink leaf/ancestor",
+    "shared parent",
+    "uncertain mint remint",
+    "concurrent duplicate",
+    "reservation replacement"
+  ],
+  "preparation_failures": [
+    {
+      "kind": "missing local clock module in isolated test collection",
+      "recovery": "explicit owner clock source dependency"
+    },
+    {
+      "kind": "full sandbox suite had17 unrelated custody/path failures",
+      "recovery": "created actual isolated Git worktree and reran with real filesystem ownership; no custody guard relaxed"
+    }
+  ],
+  "pending": "Independent Platform/identity/approval/PDP review, separate exact actor/path/audience delivery entitlement and estate-native proof"
+}

docs/task-scoped-openbao-execution-contract.md

@@ -311,3 +311,24 @@ this change does not make them verified human representation. Existing generic
 consume receipt validation limitations remain explicitly separate. service-jwt
 readiness guard/default and ordinary actions remain unchanged. T01 stays in
 progress, T03 stays wait, WP13 stays proposed, and WP8-T06 stays open.
+
+## D3 wrapped-delivery primitive and its separate entitlement
+
+D3 P3=b chooses response-wrapped issuer delivery with one-time unwrap. The
+existing wrapped-handoff primitive now verifies native TTL/accessor/creation-path
+metadata and reserves a private immutable recipient file before minting. Native
+KV-v2 creation paths include the `data/` endpoint; caller-requested CLI paths
+cannot substitute for returned metadata. Failed mint/write or an altered
+reservation retains an uncertain attempt and never silently overwrites/remints.
+
+A disposable local OpenBao integration proves the exact source path,60-second
+TTL, successful first unwrap and specific HTTP400 consumed-token replay denial.
+This proves backend semantics, not the estate's first delivered lane, audited
+initiating principal, consumer identity, independent owner acceptance or cleanup
+under crash/revocation. Production CLI wrapping remains fail-closed. Existing
+metadata execute-ccr contracts expressly exclude wrap/KV value delivery and cannot
+be borrowed for this purpose. A separate exact owner-admitted delivery operation
+must bind actor,path,audience,deadline,authorization/consume state,destination,
+audit,replay/crash recovery and rollback before native adoption. The prepared
+D2 repository-issuer lane remains attended until its own reviewed execution and
+independent destination/adoption proofs pass.