Enforce companion-only credential delivery and refresh activation handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0

workplans/SECRETS-WP-0009-glas-claude-native-delivery.md

@@ -8,7 +8,7 @@ status: blocked
 flavor: implementation
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-21"
+updated: "2026-09-27"
 state_hub_workstream_id: "40ccc3b4-d046-5a58-8649-e7935f45c974"
 ---
 
@@ -50,7 +50,7 @@ synthetic exec-env transport proof passed; no real secret was read.
 id: SECRETS-WP-0009-T03
 status: wait
 priority: high
-blocking_reason: "Shared native chain proved by SECRETS-WP-0010-T03 (2026-09-16): Approval Engine, CCR-2026-0019 reader, requester client, Informed Decision human review, current PDP. Lane-specific residue: operator inputs (placement, spend envelope/model bounds, unrelated negative identity), private SpendPolicy/ledger and owner config (HFACT-WP-0001-T01/T04), configured exec_owner, three human approvals, attended apply/verify/exec/revoke."
+blocking_reason: "Shared native chain proved by SECRETS-WP-0010-T03. Metered owner provisioned and binding drafted (2026-09-23); Activity Core reports identity live (2026-09-24). Remaining: current recipient/pin admission, unrelated negative identity, configured exec_owner, exact per-action/per-lane approvals and attended apply/verify/exec/revoke."
 state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
 ```
 
@@ -487,3 +487,19 @@ that it answers before the attended session.
 
 Founder decision 2026-09-23, relayed to activity-core (thread `a5449d3f`): the claim-loop token is
 minted fresh with a coordinated claim-loop restart, not moved (ACTIVITY-WP-0039-T03).
+
+
+### 2026-09-27 Activity Core dependency resolved
+
+Activity Core's 2026-09-24 handoff (`a2eae5f8`, `bfef619d`; source `54ab1e4`)
+reports the metered identity live, HTTP 200 for its own no-match claim and HTTP
+403 for a claim as the loop identity. SECRETS-WP-0011 records that return and
+corrects its former wait reason. The drafted worker identity and label match.
+
+This resolves the seed/rollout prerequisite in the 2026-09-23 note. It does not
+activate the native lane. T03 still needs current recipient admission and file
+pin validation, exact approvals for each protected action/lane, and attended
+native apply, positive/negative verification, exec and session revocation.
+The production catalog remains pending. The companion-only delivery guards
+added under SECRETS-WP-0011-T05 must be included in the host checkout used for
+activation. No credential read, queue claim or paid run occurred in this review.

workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md

@@ -9,7 +9,7 @@ flavor: implementation
 owner: claude-code
 topic_slug: netkingdom
 created: "2026-09-23"
-updated: "2026-09-23"
+updated: "2026-09-27"
 related_workplans:
   - SECRETS-WP-0009
   - HFACT-WP-0001
@@ -93,7 +93,7 @@ a throwaway OpenBao dev server.
 id: SECRETS-WP-0011-T04
 status: wait
 priority: high
-blocking_reason: "Lane cataloged; token seeded (ACTIVITY-WP-0039-T03 done 2026-09-23). Waits on T04 cutover: railiance-platform store policy and founder go-ahead. Do not apply or deliver until activity-core reports the metered identity authenticates."
+blocking_reason: "Activity Core reports ACTIVITY-WP-0039 finished and metered identity authentication proved (2026-09-24). Remaining: admit the configured Glas owner, obtain exact per-lane approvals, and perform attended native apply/verify/delivery under SECRETS-WP-0009-T03."
 state_hub_task_id: "cf465065-de7a-5d9c-bc80-fee16ffef70d"
 ```
 
@@ -131,3 +131,43 @@ approval). Not applied. Suite: 467 passed.
 Founder go-ahead for ACTIVITY-WP-0039-T04 (ExternalSecret, multi-identity rollout, claim-loop restart)
 relayed 2026-09-24 on activity-core thread `7b51d9c3`. Store policy was done 2026-09-23T18:06Z
 (CCR-2026-0029/0030).
+
+
+## Enforce companion-only delivery at both entry points
+
+```task
+id: SECRETS-WP-0011-T05
+status: done
+priority: high
+```
+
+Review on 2026-09-27 found that `companion_of` consent was checked when resolving
+companions, but a caller could select that lane directly as the primary `exec`
+lane with an arbitrary child. The delivery helper also accepted a supplied
+companion list without comparing it with the pinned owner declaration.
+
+Refuse standalone companion delivery before approval/backend/read. Require the
+helper's supplied lane/field/environment list to match the owner declaration,
+and recheck companion consent and stage before any value is read. Preserve
+ordinary lanes and the configured multi-lane child. Regression tests cover both
+entry points, omissions, additions, substituted lane/field/environment, revoked
+consent and stage mismatch.
+
+Validation: 476 tests passed, including disposable OpenBao integration tests;
+layer conformance and `git diff --check` passed. No production credential was
+requested or delivered.
+
+## Activity Core handoff reviewed — 2026-09-27
+
+Owner messages `a2eae5f8-60cf-499b-8f52-dd04ac407924` and
+`bfef619d-53e0-4b4c-8b92-ef092450e4a1` report ACTIVITY-WP-0039 finished at
+activity-core `54ab1e4`. The founder-run check on 2026-09-24 returned HTTP 200
+for the metered identity on a no-match label, and HTTP 403 when that token
+claimed the loop identity. The existing loop continued to claim with its own
+fresh token. This is the owner's reported evidence, not a new live check here.
+
+The former token seeding/store-policy/identity-rollout blocker is resolved.
+T04 remains wait for native lane activation with SECRETS-WP-0009-T03: current
+owner admission/pins, exact per-lane approvals and attended apply/verify/exec.
+The draft binds `rein-aharness-metered@railiance01` and `hfact-metered`, matching
+the handoff. No production policy, role, catalog binding or credential changed.