Record verified inert pre-key CLI installation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

@@ -220,3 +220,22 @@ T03 wait; TSA01/02/03 remain open, protected acceptance0/11sites across10handler
 No credential/kubeconfig/private custody read, caller mint, live action, actual
 home install or new authority occurred. Exact review/proof and concrete install
 step: Custodian `secrets-native-admission-next/` within the2026-10-16 target wave.
+
+
+2026-10-16 actual inert local preparation: coordinator installed the selected
+bundle through the unchanged owner offline installer into the exact selected
+fresh release prefix and copied all17 selected public configuration files0600
+under the exact selected pre-key revision, with new private directories0700.
+The bounded coordinator runner checked53 runtime source hashes and complete
+bundle/config hashes before writing; installed CLI help and ten catalog rows
+passed. Actual installed authorize_action with the exact selected environment
+refused missing admitted keys before caller or socket access; its audit hook
+would forbid either. Backend and Approval remain blank, no caller was created,
+no key was admitted, no effects were authorized and same-UID code isolation
+remains unestablished. Non-secret observed installation receipt SHA-256
+1ab9c271dfb236f09c4528ae18897381f5e404541708bf36f50c41c77d183ba0 is
+Custodian `secrets-native-admission-next/actual-prekey-install.json` within the
+2026-10-16 target wave. This supersedes only the preceding historical statement
+that actual local installation was not yet made. Native custody/rollout/caller/
+trust/Approval/effect gates and T02progress/T03wait remain unchanged; accepted
+protected sites remain0/11 across10handlers, TSA01/02/03 open.