Bind wrapped issuance to native metadata and preserve immutable recipient attempts

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/evidence/2026-10-12-wrapped-issuer-hardening/validation.json

@@ -0,0 +1,54 @@
+{
+  "schema": "wrapped-issuer-source-validation/v1",
+  "task": "SECRETS-WP-0013-T01",
+  "captured_at": "2026-10-11T22:07:09.996760+00:00",
+  "source_sha256": {
+    "src/secrets_engine/openbao.py": "c1d17ca30367fd2c856927e8ce4021599a992c6c22509f82a6d8d4588ea46199",
+    "src/secrets_engine/wrap.py": "a37c491a93c8803015d2f1fca6ea502b8da28a9279900404d8f9ebf06a0c0a70",
+    "tests/test_wrap.py": "40b4511f6f5c2515e8ff70095e8239a4f589a97697fa1827298ec3be89ba57d4",
+    "tests/test_wrapped_issuer_native.py": "e24d86da4e9b0c971aa39c81f34c1bced76d3def1727ee38fe69a3769c80e5c1"
+  },
+  "full_suite": {
+    "collected": 654,
+    "passed": 653,
+    "skipped": 1,
+    "exit": 0,
+    "execution": "isolated tracked-source Git checkout, real filesystem ownership, disposable local OpenBao"
+  },
+  "final_wrap_and_native_tests": {
+    "passed": 24,
+    "exit": 0
+  },
+  "native_local_semantics": {
+    "creation_path": "secret/data/d3-wrap-fixture",
+    "ttl_seconds": 60,
+    "first_unwrap_success": true,
+    "consumed_token_replay": "specific native HTTP400 wrapping-token-invalid denial"
+  },
+  "production_lane_proven": false,
+  "production_authority_enabled": false,
+  "raw_secret_values_in_receipt": false,
+  "negative_cases": [
+    "changed/missing native path",
+    "wrong/missing/noninteger TTL",
+    "missing accessor",
+    "unwrapped material alongside wrap",
+    "overwrite",
+    "symlink leaf/ancestor",
+    "shared parent",
+    "uncertain mint remint",
+    "concurrent duplicate",
+    "reservation replacement"
+  ],
+  "preparation_failures": [
+    {
+      "kind": "missing local clock module in isolated test collection",
+      "recovery": "explicit owner clock source dependency"
+    },
+    {
+      "kind": "full sandbox suite had17 unrelated custody/path failures",
+      "recovery": "created actual isolated Git worktree and reran with real filesystem ownership; no custody guard relaxed"
+    }
+  ],
+  "pending": "Independent Platform/identity/approval/PDP review, separate exact actor/path/audience delivery entitlement and estate-native proof"
+}