Finish companion catalog work and reconcile completed approval tasks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0

docs/2026-09-27-loose-end-closeout.md

@@ -0,0 +1,52 @@
+# Existing-work closeout — 2026-09-27
+
+No new task or workplan was opened. Three tasks and one intake can close from
+existing evidence plus the local completion below. One workplan finishes.
+
+| Existing record | Result | Basis |
+| --- | --- | --- |
+| SECRETS-WP-0007-T04 | done | Shared exact-action claim/PDP/consume implementation, regression refusals and real separate apply/verify/exec consumes in the September 16 native receipt |
+| SECRETS-WP-0008-T02 | done | The same native receipt resolves its outstanding served-decision/consume dependency; current regression coverage retains fail-closed replay and lifetime checks |
+| SECRETS-WP-0011-T04 | done | Activity Core custody/identity handoff received; configured owner and companion now cataloged; current owner/path/hash checks passed on railiance01 without backend access |
+| SECRETS-WP-0011 | finished | All five tasks complete; native Glas activation remains in the existing SECRETS-WP-0009-T03 |
+| SECRETS-IN-0003 | closed | Published signing/custody/bootstrap/rotation/revocation and bounded-time consumer review, with limits and existing owner acceptance work named |
+
+Implementation includes the private spend-policy pin and the estate reference
+layer-version detector under SECRETS-WP-0008. The latter closes the stale
+conformance-record question without inventing a durable-record requirement.
+
+Evidence:
+
+- [Native approval and delivery receipt](evidence/2026-09-16-t03-completion.json)
+  is historical acceptance for one exact OpenRouter key-check recipient. Its
+  consumed approvals grant no future action.
+- [Companion catalog receipt](evidence/2026-09-27-companion-catalog-readiness.json)
+  records current backend-free owner validation, installed file pins and owner
+  digest. Configuration is not production approval or delivery readiness.
+- [Clock consumer review](railiance-clock-consumer-review.md) closes a review
+  request, without enabling a new trust binding or claiming operational rotation.
+
+## Work that must remain open
+
+| Existing record | Remaining completion requirement |
+| --- | --- |
+| SECRETS-WP-0006-T05 | Approved native verification for the other catalog lanes; the OpenRouter key-check receipt covers one exact recipient only |
+| SECRETS-WP-0006-T06 | Owner-agreed routing/proxy retirement per verified lane, plus custody disposition of the legacy npm pointer; no unilateral proxy retirement |
+| SECRETS-WP-0007-T07 | Its acceptance includes native cutover and routing/proxy retirement under 0006-T05/T06; engine hardening alone does not satisfy it |
+| SECRETS-WP-0008-T06 | Platform/KeyCape exact service claims and tenant, custody, provisioned scoped JWT role and native login/negative/revocation acceptance (RPF-WP-0035-T02); the recorded env-auth run does not prove this |
+| SECRETS-WP-0009-T03 | Fresh exact per-action/per-lane approvals, unrelated negative identity, attended apply/verify, bounded real Glas delivery and revocation; recheck pins and spend validity in that window |
+| SECRETS-IN-0002 | Confirmed flex-auth repository rename before changing checkout coordinates; FLEX-WP-0020 still holds the live rename |
+
+Workplans 0006, 0007, 0008 and 0009 therefore remain unfinished. Their remaining
+requirements stay in those records, with no replacement or successor task.
+
+
+Scope reconciliation is recorded as State Hub decision
+`7a756027-2041-4732-bcbc-3bb6a5380838`; it grants no credential action.
+
+
+Validation: 487 repository tests passed, including disposable OpenBao integration.
+The layer-conformance checker and `git diff --check` passed. The configured
+recipient's local-only owner check and exact engine path/pin checks passed on
+railiance01; no backend credential was requested, no queue row was claimed and
+no provider request was made.