Catalog activity-core metered worker-token companion lane (SECRETS-WP-0011-T04)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 226514@bnt-lap001
Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6

catalog/activity-core-metered-worker-token.yaml

@@ -0,0 +1,63 @@
+id: activity-core-metered-worker-token
+kind: kv
+org: coulomb
+repo: activity-core
+stage: prod
+description: Activity Core queue token for rein-aharness-metered@railiance01,
+  delivered only as a companion of the Glas metered owner. Custody and issuance
+  are activity-core's (ACTIVITY-WP-0039); secrets-engine only reads.
+mount: platform
+path: workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01
+mount_management: existing
+fields:
+- token
+consumers:
+- name: rein-aharness-metered-railiance01
+  auth: approle
+  claim: catalog:activity-core-metered-worker-token
+  purpose: Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01
+    inside the catalog-bound Glas metered owner
+workload_delivery: []
+delivery_config:
+  companion_of:
+  - glas-claude-agent-dev-anthropic
+delivery_modes:
+- exec-env
+delivery_auth:
+  method: approle
+  management: engine
+  policy_name: se-prod-activity-core-metered-worker-token
+  role_name: se-prod-activity-core-metered-worker-token
+  metadata_read: false
+  token_ttl: 5m
+  token_max_ttl: 15m
+  secret_id_ttl: 5m
+  secret_id_num_uses: 1
+  token_num_uses: 8
+approval:
+  model: decision
+  decision_ref: ACTIVITY-WP-0039
+  notes: Ordinary lane approval, no human control (operator decision 2026-09-23,
+    SECRETS-WP-0011). Native apply and exec still need per-lane claim, PDP decision
+    and consume. This entry is not authorization.
+verification:
+  positive: Exact scoped AppRole reads only token, delivered as ACTIVITY_CORE_WORKER_TOKEN
+    into the bound Glas metered owner.
+  negative: The claim-loop worker path, sibling KV, metadata, listing and writes denied;
+    the Glas lane AppRole cannot read this path.
+risk:
+  classification: standard
+  notes: Lets the holder claim, heartbeat and close ops_runs as the metered identity
+    only. No provider spend by itself.
+rotation:
+  owner: activity-core
+  expectation: Mint a new value at the same path via ACTIVITY-WP-0039 procedure; ESO
+    resyncs actcore-runtime-secret; next exec reads the new value.
+  ttl: owner-defined
+deactivation:
+  owner: activity-core
+  expectation: Remove the identity from ACTIVITY_CORE_WORKERS and the path; revoke
+    the se-prod AppRole and policy.
+audit:
+  evidence: Lane id, companion primary, actor, exact path, field name, timestamps,
+    and pass/fail only

workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md

@@ -93,7 +93,7 @@ a throwaway OpenBao dev server.
 id: SECRETS-WP-0011-T04
 status: wait
 priority: high
-blocking_reason: "Needs activity-core owner assent to source ACTIVITY_CORE_WORKER_TOKEN from OpenBao (ESO) instead of a hand-generated Kubernetes Secret."
+blocking_reason: "Lane cataloged. Waits on ACTIVITY-WP-0039 T02-T04: railiance-platform store policy, founder-attended seeding of the metered token, and activity-core rollout."
 state_hub_task_id: "cf465065-de7a-5d9c-bc80-fee16ffef70d"
 ```
 
@@ -115,3 +115,15 @@ redacts every value. Suite: 465 passed. Integration on a throwaway OpenBao: 2
 passed (two lanes to one owner; the primary AppRole is denied the companion
 path). Contract: `docs/exec-owner-binding.md` § Companion lanes. T04 waits on
 activity-core (hub message `6e694682`).
+
+## activity-core return — 2026-09-23
+
+Accepted under ACTIVITY-WP-0039 (hub `053ef7c6`). activity-core `b4a7a84` adds
+`ACTIVITY_CORE_WORKERS`: one token per identity, no shared token, no fallback.
+The dedicated identity is `rein-aharness-metered@railiance01`, with its token at
+`platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01`
+(field `token`), seeded fresh. Not deployed yet.
+
+Cataloged as `activity-core-metered-worker-token` (prod, standard risk,
+`companion_of: [glas-claude-agent-dev-anthropic]`, ordinary `decision`
+approval). Not applied. Suite: 467 passed.