Verify normalized task approval facts and preserve signed source types

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md

@@ -124,3 +124,19 @@ coercion/idempotence, expiry, signer removal and replay refusal. No service bind
 propagation, policy gate flip, identity mapping admission or production trust/key
 change was made. Independent source integration/review and actual whole-provider
 proof remain required. T01/T03 and WP8-T06 retain their open native obligations.
+
+2026-10-16 retained-registry successor source preparation adds only the existing
+signed Check/DENY preapproval flow. The original typed service proposal is sent
+unchanged; normalized native act and evaluated approval-free digest from the
+admitted producer record are used for normal Approval issuance. The original
+proposal then receives only the original issued claim. Final Check re-normalizes
+against retained owner registry/source facts, so authoritative drift refuses
+before CAS. No local registry algorithm, new endpoint, empty-registry workaround
+or consumer digest waiver is used. Signed DENY preparation has no independent
+permission/freshness window and cannot consume or execute; current caller and
+operation bounds are checked, and final signed ALLOW/source checks remain
+mandatory. Exact original JSON kinds and requested-target subsets refuse
+bool/int/float substitution while allowing extra authoritative registry facts.
+Actual provider proof preparation is separately waiting on frozen Access source
+and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+actual task admission remain open. T01/T03 and WP8-T06 are not closed.

workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

@@ -114,3 +114,64 @@ producer candidate OCI and actual runtime/config placement remain missing. The
 empty-key trust template deliberately refuses. No install, key read, caller mint,
 protected effect, policy switch or trust admission occurred. T02 remains progress,
 T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
+
+2026-10-16 trusted successor source preparation: refreshed exact API/sign source
+from frozen Access B2/B3 R1 proposal (patch SHA-256
+6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
+reauthenticates original producer JSON. Existing request/claim/native/caller joins
+remain mandatory; signed source observation additionally binds the native digest
+and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures,
+tamper/unknown provenance and source deadline refusals are locally checked.
+Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper;
+actual source revocation refuses. Actual builder-to-v2 strict positive execution
+is separately blocked on missing owner-reviewed service_actor_binding mapping;
+no caller context injection or equality relaxation hides that gap.
+Artifacts: Custodian `decision-trusted-successor/`. T02 remains progress, T03
+wait; no package/key/policy/native admission or runtime installation occurred.
+
+2026-10-16 successor R2 source preparation resolves the preceding builder gap:
+only typed prod/platform execute-ccr with exact secrets-engine service subject
+emits Access's fixed five-field public service_actor_binding before approval
+issue. Subject/resource platform tenants are explicit before issue, matching the
+producer's existing normalization and native act; lifecycle requests are unchanged.
+Original carried context is still immutable. Actual builder -> Approval App ->
+Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation
+GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/
+native changes, stale original claim, signature tamper and replay refuse. The
+operation deadline is explicit whole seconds within v2's 15-second allow TTL;
+no deadline is extended or waived. This resolves source correspondence only;
+T02 remains progress/T03 wait, with no native trust/grant/policy admission.
+
+2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier
+15s lifetime with the exact immutable operation deadline, bounded by its 120s
+hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s
+fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets
+runtime and strict entire-operation deadline checks are unchanged. Contract prose
+now states the actual fixed backend TTL and conservative fit rather than dynamic
+TTL recomputation, and permits native token expiry earlier than operation deadline.
+The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/
+operationdeadline60, without a consumer timing waiver or native admission.
+
+Temporal proof precision observation: Approval consumption receipts use whole
+seconds while Access R2 not_before preserves subsecond precision. Fast CAS can
+therefore refuse receipt-before-start even though live calls are correctly
+ordered. The positive proof explicitly waits real time until the next whole
+second before CAS, without injected clocks or relaxed checks. Fast-CAS failure
+is retained for owner resolution; no Secrets runtime change conceals the seam.
+
+2026-10-16 retained-registry successor source preparation adds only the existing
+signed Check/DENY preapproval flow. The original typed service proposal is sent
+unchanged; normalized native act and evaluated approval-free digest from the
+admitted producer record are used for normal Approval issuance. The original
+proposal then receives only the original issued claim. Final Check re-normalizes
+against retained owner registry/source facts, so authoritative drift refuses
+before CAS. No local registry algorithm, new endpoint, empty-registry workaround
+or consumer digest waiver is used. Signed DENY preparation has no independent
+permission/freshness window and cannot consume or execute; current caller and
+operation bounds are checked, and final signed ALLOW/source checks remain
+mandatory. Exact original JSON kinds and requested-target subsets refuse
+bool/int/float substitution while allowing extra authoritative registry facts.
+Actual provider proof preparation is separately waiting on frozen Access source
+and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.