docs: specify approval client workstation custody procedure

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/approval-service-auth.md

@@ -78,8 +78,60 @@ The admission must name the actual consumer/placement, bounded reader, protected
 temporary delivery and cleanup, refusal/revocation checks and lifecycle owner.
 Do not use the verifier's `sso` Secret or reseed version-1 custody.
 
-Approval Engine's operator is a separate identity and read lane. Audit receiver
-and sender custody remains AUDIT-WP-0009-T09 / APPROVAL-WP-0002-T01. The live
+### CCR-2026-0019 workstation procedure — consumer return, 2026-09-10
+
+This source review answers Platform's procedure request
+`fbf434cf-3f68-4d11-ae98-bb3798e2c5a5`. The current consumer accepts the following
+attended file lifetime. It does not confirm an operator group or admit a reader:
+CCR-2026-0019 remains in flight, its front door unresolvable, and no value was read.
+
+1. After the exact group, role and reader admission are accepted, use an
+   operator-owned runtime directory outside every Git worktree, with canonical
+   non-symlink parents and mode 0700. Prefer the workstation's private runtime
+   tmpfs; stop if it is unavailable rather than silently choosing a shared or
+   backed-up location. Set `umask 077`. Create a unique session subdirectory and
+   a new regular `client-secret` file owned by that operator, mode 0600. Check
+   ownership/mode/location without displaying file contents.
+2. Install the session wrapper's EXIT cleanup before delivery. Its INT and TERM
+   handlers must exit through that cleanup. The admitted delivery owner fills
+   only this file from `platform/workloads/secrets-engine/approval-client`, field
+   `CLIENT_SECRET`, existing version 1. Use the reviewed front door after it is
+   resolvable; do not replace its pending admission with a direct raw vault read,
+   the verifier's Kubernetes Secret, a sibling identity or an interactive paste.
+3. Supply only the absolute file path as
+   `SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE` to the intended Secrets Engine
+   CLI. Keep the file for both claim and consume exchanges in that one attended
+   operation. Unset `SECRETS_ENGINE_APPROVAL_TOKEN_FILE`; configure the existing
+   issuer/token endpoint and the admitted Approval Engine endpoint or its
+   owner-bound tunnel. Disable shell tracing and credential-bearing HTTP debug
+   logs. The file value belongs in neither argv nor an environment variable.
+4. On success, refusal, exception or interruption, cleanup unsets the path,
+   removes that exact file, then removes the now-empty session directory and
+   verifies both are absent. Record only cleanup status and non-secret request
+   IDs. Do not recursively remove a shared directory. SIGKILL, host failure or a
+   failed trap requires attended residual-file inspection/removal before reuse;
+   automatic cleanup is not provided by the current consumer. Unlink is not a
+   claim of secure erasure or token revocation. Tmpfs avoids a persistent copy
+   but does not replace host custody controls.
+
+The implemented `read_strict_token_file` rejects group/other-accessible files,
+files inside Git worktrees and empty inputs. It does not establish parent-path
+ownership, create or delete this file, or prove session cleanup. Those are the
+explicit delivery/operator responsibilities above, retained in the CCR's risk
+section. `KeyCapeServiceAuthProvider.exchange` rereads the file before each
+request and holds the resulting token in memory. Removing it prevents a later
+exchange; already-issued tokens retain their bounded lifetime. Compromise uses
+KeyCape registration disablement and the CCR's coordinated lifecycle procedure.
+
+Required live evidence remains: exact authorized identity and mode/location
+checks, one scoped exchange/claim/consume result, wrong-group and sibling-path
+denials, and cleanup after both success and refusal. Existing synthetic component
+evidence verifies the consumer behavior; it is not that live reader receipt.
+
+Real human approval follows INFD-WP-0001-T07/T08's reviewed PKCE client; a future
+service requester needs its own narrow registration. The unpresented operator
+reader CCR-2026-0020 was cancelled on owner withdrawal and is not a dependency.
+Audit receiver and sender custody remains AUDIT-WP-0009-T09 / APPROVAL-WP-0002-T01. The live
 Approval Engine deployment and native OpenBao delivery remain open. Synthetic
 acceptance grants no production access, action approval or model spending.
 

workplans/SECRETS-WP-0009-glas-claude-native-delivery.md

@@ -226,3 +226,15 @@ CCR-2026-0019 operator-group/file-delivery return, INFD-WP-0001-T07/T08 real hum
 approval, audit custody and deployed services/PDP/native delivery. CCR-2026-0020
 was cancelled on owner withdrawal; do not wait for or recreate its presenter.
 No runtime artifact rebuild is needed for this credential-engine change.
+
+### 2026-09-10 workstation procedure return
+
+`docs/approval-service-auth.md` now gives the concrete CCR-2026-0019 consumer
+procedure requested by Platform: an operator-owned 0700 runtime session directory
+outside Git, a new 0600 file, path-only CLI configuration, claim/consume lifetime,
+EXIT/INT/TERM cleanup and explicit residual-file handling after hard interruption.
+The source review distinguishes implemented permission/location/empty-file checks
+from operator-owned creation, parent custody and cleanup. No automatic cleanup
+or live reader proof is claimed. The exact group remains NetKingdom/KeyCape's
+return, followed by reviewed attended admission and positive/negative evidence.
+T03 stays wait; no identity, role, secret, runtime or route readiness changed.