Planning stays off the store client. The process binds one stage credential at start, serve runs the same lifecycle library, and a local allow flag does not authorize a protected call.
Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42
