[
  {
    "catalog": "glas-claude-agent-dev-anthropic",
    "action": "apply",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "apply",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ]
        }
      },
      "context": {
        "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "sand-boxer",
          "mount": "platform",
          "path": "workloads/glas-harness/claude-agent-dev",
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "sand-boxer-glas-agent-dev",
              "auth": "approle",
              "claim": "catalog:glas-claude-agent-dev-anthropic",
              "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
            }
          ],
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
            "role_name": "se-prod-glas-claude-agent-dev-anthropic",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "exec_owner": {
              "status": "configured",
              "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
              "command": [
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                "-I",
                "-B",
                "-m",
                "rein_aharness.cli",
                "metered-once",
                "--owner-config",
                "/home/tegwick/hfact/owner-metered/owner.json"
              ],
              "cwd": "/home/tegwick/hfact/owner-metered",
              "environment": {
                "PATH": "/usr/bin:/bin",
                "LANG": "C.UTF-8",
                "HOME": "/home/tegwick",
                "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
              },
              "files": {
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                  "private": false
                },
                "/home/tegwick/hfact/owner-metered/owner.json": {
                  "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
                  "private": true
                },
                "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                  "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
                  "private": true
                }
              },
              "companions": [
                {
                  "catalog": "activity-core-metered-worker-token",
                  "field": "token",
                  "env": "ACTIVITY_CORE_WORKER_TOKEN"
                }
              ]
            }
          },
          "auth_capability": {},
          "workload_delivery": []
        },
        "human_control": true
      }
    },
    "decision": {
      "id": "decision:055a4c72507e3216",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "fields": [],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "apply",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "fields": [],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "name": "sand-boxer-glas-agent-dev",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "exec_owner": {
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN",
                    "field": "token"
                  }
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "HOME": "/home/tegwick",
                  "LANG": "C.UTF-8",
                  "PATH": "/usr/bin:/bin"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "private": false,
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "private": true,
                    "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "private": true,
                    "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
                  }
                },
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "status": "configured"
              }
            },
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/glas-harness/claude-agent-dev",
            "repo": "sand-boxer",
            "workload_delivery": []
          },
          "human_control": true,
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
        },
        "request_digest": "sha256:ad563454ecebe247b34e7b7dd3c06dd851d686624a00f782636a688b1f9069b9",
        "submitted_request_digest": "sha256:eefcc2d73f974573d4913434b52cceac68161142935a4d59f9ae9dcf9ca4ccd7"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:01Z",
        "expires_at": "2026-09-27T18:38:01Z"
      },
      "diagnostics": {
        "action": "apply",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:973a545e0a06a3b672a0d430268e9308e59e8b7d29b955d28294cc36f3b22955"
        },
        "decision_time": "2026-09-27T18:23:01Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  },
  {
    "catalog": "glas-claude-agent-dev-anthropic",
    "action": "verify",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "verify",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ]
        }
      },
      "context": {
        "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "sand-boxer",
          "mount": "platform",
          "path": "workloads/glas-harness/claude-agent-dev",
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "sand-boxer-glas-agent-dev",
              "auth": "approle",
              "claim": "catalog:glas-claude-agent-dev-anthropic",
              "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
            }
          ],
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
            "role_name": "se-prod-glas-claude-agent-dev-anthropic",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "exec_owner": {
              "status": "configured",
              "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
              "command": [
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                "-I",
                "-B",
                "-m",
                "rein_aharness.cli",
                "metered-once",
                "--owner-config",
                "/home/tegwick/hfact/owner-metered/owner.json"
              ],
              "cwd": "/home/tegwick/hfact/owner-metered",
              "environment": {
                "PATH": "/usr/bin:/bin",
                "LANG": "C.UTF-8",
                "HOME": "/home/tegwick",
                "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
              },
              "files": {
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                  "private": false
                },
                "/home/tegwick/hfact/owner-metered/owner.json": {
                  "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
                  "private": true
                },
                "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                  "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
                  "private": true
                }
              },
              "companions": [
                {
                  "catalog": "activity-core-metered-worker-token",
                  "field": "token",
                  "env": "ACTIVITY_CORE_WORKER_TOKEN"
                }
              ]
            }
          },
          "auth_capability": {},
          "workload_delivery": []
        },
        "human_control": true
      }
    },
    "decision": {
      "id": "decision:28e6bd06c550fb5f",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "verify",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "name": "sand-boxer-glas-agent-dev",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "exec_owner": {
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN",
                    "field": "token"
                  }
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "HOME": "/home/tegwick",
                  "LANG": "C.UTF-8",
                  "PATH": "/usr/bin:/bin"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "private": false,
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "private": true,
                    "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "private": true,
                    "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
                  }
                },
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "status": "configured"
              }
            },
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/glas-harness/claude-agent-dev",
            "repo": "sand-boxer",
            "workload_delivery": []
          },
          "human_control": true,
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
        },
        "request_digest": "sha256:0e45d156c8a2b31789fa6f9431c260ee411d8546c3aeaf50d3ac56d5c4b39139",
        "submitted_request_digest": "sha256:6f4ba6f895c418cf7d251f58b3113d569c138b4a0f5c763a5535f9019088b381"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:01Z",
        "expires_at": "2026-09-27T18:38:01Z"
      },
      "diagnostics": {
        "action": "verify",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:973a545e0a06a3b672a0d430268e9308e59e8b7d29b955d28294cc36f3b22955"
        },
        "decision_time": "2026-09-27T18:23:01Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  },
  {
    "catalog": "glas-claude-agent-dev-anthropic",
    "action": "exec",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "exec",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ]
        }
      },
      "context": {
        "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "sand-boxer",
          "mount": "platform",
          "path": "workloads/glas-harness/claude-agent-dev",
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "sand-boxer-glas-agent-dev",
              "auth": "approle",
              "claim": "catalog:glas-claude-agent-dev-anthropic",
              "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
            }
          ],
          "delivery_modes": [
            "exec-env",
            "read-check"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
            "role_name": "se-prod-glas-claude-agent-dev-anthropic",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "exec_owner": {
              "status": "configured",
              "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
              "command": [
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                "-I",
                "-B",
                "-m",
                "rein_aharness.cli",
                "metered-once",
                "--owner-config",
                "/home/tegwick/hfact/owner-metered/owner.json"
              ],
              "cwd": "/home/tegwick/hfact/owner-metered",
              "environment": {
                "PATH": "/usr/bin:/bin",
                "LANG": "C.UTF-8",
                "HOME": "/home/tegwick",
                "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
              },
              "files": {
                "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                  "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                  "private": false
                },
                "/home/tegwick/hfact/owner-metered/owner.json": {
                  "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
                  "private": true
                },
                "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                  "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
                  "private": true
                }
              },
              "companions": [
                {
                  "catalog": "activity-core-metered-worker-token",
                  "field": "token",
                  "env": "ACTIVITY_CORE_WORKER_TOKEN"
                }
              ]
            }
          },
          "auth_capability": {},
          "workload_delivery": []
        },
        "human_control": true,
        "exec_owner_sha256": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f"
      }
    },
    "decision": {
      "id": "decision:a108596dd31cc3d3",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:glas-claude-agent-dev-anthropic",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "fields": [
            "ANTHROPIC_API_KEY"
          ],
          "policy_targets": [
            "se-prod-glas-claude-agent-dev-anthropic"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "exec",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "name": "sand-boxer-glas-agent-dev",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "exec_owner": {
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN",
                    "field": "token"
                  }
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "HOME": "/home/tegwick",
                  "LANG": "C.UTF-8",
                  "PATH": "/usr/bin:/bin"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "private": false,
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "private": true,
                    "sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "private": true,
                    "sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
                  }
                },
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "status": "configured"
              }
            },
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/glas-harness/claude-agent-dev",
            "repo": "sand-boxer",
            "workload_delivery": []
          },
          "exec_owner_sha256": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f",
          "human_control": true,
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
        },
        "request_digest": "sha256:62686f744536db70a48e17f416be6c32203c48d7d1bb3dbda85afb3f0e3ea0f3",
        "submitted_request_digest": "sha256:e4eaa26cdd6687a543d88492bbb3b1b9f8ef2c1f1490d19c1e8e718ef0f30d8e"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:01Z",
        "expires_at": "2026-09-27T18:38:01Z"
      },
      "diagnostics": {
        "action": "exec",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:087cf05d952a3297d1eb146679841ff2b37b9c48dd0f79caa907285dbe96d160"
        },
        "decision_time": "2026-09-27T18:23:01Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  },
  {
    "catalog": "activity-core-metered-worker-token",
    "action": "apply",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "apply",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ]
        }
      },
      "context": {
        "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "activity-core",
          "mount": "platform",
          "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
          "fields": [
            "token"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "rein-aharness-metered-railiance01",
              "auth": "approle",
              "claim": "catalog:activity-core-metered-worker-token",
              "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
            }
          ],
          "delivery_modes": [
            "exec-env"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-activity-core-metered-worker-token",
            "role_name": "se-prod-activity-core-metered-worker-token",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "companion_of": [
              "glas-claude-agent-dev-anthropic"
            ]
          },
          "auth_capability": {},
          "workload_delivery": []
        }
      }
    },
    "decision": {
      "id": "decision:3b17db5cbd13621d",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "fields": [],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "apply",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "fields": [],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "name": "rein-aharness-metered-railiance01",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "delivery_modes": [
              "exec-env"
            ],
            "fields": [
              "token"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "repo": "activity-core",
            "workload_delivery": []
          },
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
        },
        "request_digest": "sha256:f8cffb9005b5d267d14ec1a216a785716ad3d611422c94ab52d6d66d3b259d95",
        "submitted_request_digest": "sha256:95138b47056338596a689788c61f0f537011a11c5cab38c94c8e2c04f4d68dec"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:01Z",
        "expires_at": "2026-09-27T18:38:01Z"
      },
      "diagnostics": {
        "action": "apply",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
        },
        "decision_time": "2026-09-27T18:23:01Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  },
  {
    "catalog": "activity-core-metered-worker-token",
    "action": "verify",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "verify",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "token"
          ],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ]
        }
      },
      "context": {
        "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "activity-core",
          "mount": "platform",
          "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
          "fields": [
            "token"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "rein-aharness-metered-railiance01",
              "auth": "approle",
              "claim": "catalog:activity-core-metered-worker-token",
              "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
            }
          ],
          "delivery_modes": [
            "exec-env"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-activity-core-metered-worker-token",
            "role_name": "se-prod-activity-core-metered-worker-token",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "companion_of": [
              "glas-claude-agent-dev-anthropic"
            ]
          },
          "auth_capability": {},
          "workload_delivery": []
        }
      }
    },
    "decision": {
      "id": "decision:abc00a7202c11ae9",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "fields": [
            "token"
          ],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "verify",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "fields": [
              "token"
            ],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "name": "rein-aharness-metered-railiance01",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "delivery_modes": [
              "exec-env"
            ],
            "fields": [
              "token"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "repo": "activity-core",
            "workload_delivery": []
          },
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
        },
        "request_digest": "sha256:d53ce35084b40ccf92f2e0062185d721ba726323f5b6324ba5884d4fbe2c23c4",
        "submitted_request_digest": "sha256:4554023dfb52dee7a9af5aa5164b2edb5d885d07d1e01bd3a8f95a3b5087658a"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:01Z",
        "expires_at": "2026-09-27T18:38:01Z"
      },
      "diagnostics": {
        "action": "verify",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
        },
        "decision_time": "2026-09-27T18:23:01Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  },
  {
    "catalog": "activity-core-metered-worker-token",
    "action": "exec",
    "request": {
      "tenant": "tenant:platform",
      "subject": {
        "id": "secrets-engine",
        "type": "service"
      },
      "action": "exec",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "attributes": {
          "stage": "prod",
          "fields": [
            "token"
          ],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ]
        }
      },
      "context": {
        "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
        "catalog_target": {
          "kind": "kv",
          "org": "coulomb",
          "repo": "activity-core",
          "mount": "platform",
          "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
          "fields": [
            "token"
          ],
          "mount_management": "existing",
          "consumers": [
            {
              "name": "rein-aharness-metered-railiance01",
              "auth": "approle",
              "claim": "catalog:activity-core-metered-worker-token",
              "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
            }
          ],
          "delivery_modes": [
            "exec-env"
          ],
          "delivery_auth": {
            "method": "approle",
            "management": "engine",
            "policy_name": "se-prod-activity-core-metered-worker-token",
            "role_name": "se-prod-activity-core-metered-worker-token",
            "metadata_read": false,
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1,
            "token_num_uses": 8
          },
          "delivery_config": {
            "companion_of": [
              "glas-claude-agent-dev-anthropic"
            ]
          },
          "auth_capability": {},
          "workload_delivery": []
        }
      }
    },
    "decision": {
      "id": "decision:38405f0256bfacdc",
      "contract_version": "flex-auth.decision-record.v1",
      "effect": "allow",
      "reason": "catalog_lane_policy_matched",
      "matched_policy_version": "v2",
      "matched_rule": "catalog_lane_policy_matched",
      "resource": {
        "id": "catalog:activity-core-metered-worker-token",
        "type": "secret-catalog-lane",
        "system": "secrets-engine",
        "tenant": "tenant:platform",
        "attributes": {
          "auth_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "fields": [
            "token"
          ],
          "policy_targets": [
            "se-prod-activity-core-metered-worker-token"
          ],
          "stage": "prod"
        }
      },
      "subject": {
        "id": "secrets-engine",
        "type": "service",
        "tenant": "tenant:platform",
        "attributes": {
          "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
          "display_name": "secrets-engine service principal",
          "groups": [
            "group:secrets-engine-lane-operators"
          ],
          "organization_relation": "ServiceProvider",
          "roles": [
            "Operator"
          ]
        }
      },
      "binding": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service",
          "tenant": "tenant:platform",
          "attributes": {
            "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
            "display_name": "secrets-engine service principal",
            "groups": [
              "group:secrets-engine-lane-operators"
            ],
            "organization_relation": "ServiceProvider",
            "roles": [
              "Operator"
            ]
          }
        },
        "action": "exec",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "tenant": "tenant:platform",
          "attributes": {
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "fields": [
              "token"
            ],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "stage": "prod"
          }
        },
        "context": {
          "catalog_target": {
            "auth_capability": {},
            "consumers": [
              {
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "name": "rein-aharness-metered-railiance01",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_auth": {
              "management": "engine",
              "metadata_read": false,
              "method": "approle",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "secret_id_num_uses": 1,
              "secret_id_ttl": "5m",
              "token_max_ttl": "15m",
              "token_num_uses": 8,
              "token_ttl": "5m"
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "delivery_modes": [
              "exec-env"
            ],
            "fields": [
              "token"
            ],
            "kind": "kv",
            "mount": "platform",
            "mount_management": "existing",
            "org": "coulomb",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "repo": "activity-core",
            "workload_delivery": []
          },
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
        },
        "request_digest": "sha256:93b12e31b0323a21ae310fced3add0b887658e64530f2e4bc65130ebbd6d9a3d",
        "submitted_request_digest": "sha256:ad628079debc7e46937b58e68cf6784802e2865e039b98aa25d77fb40be3ed36"
      },
      "lifetime": {
        "kind": "ttl",
        "ttl": "15m",
        "not_before": "2026-09-27T18:23:02Z",
        "expires_at": "2026-09-27T18:38:02Z"
      },
      "diagnostics": {
        "action": "exec",
        "matched_relationship": "",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_status": "ready",
        "registry_overrode": [],
        "registry_resource": false,
        "registry_subject": true
      },
      "provenance": {
        "evaluator": "flex-auth/local",
        "mode": "standalone",
        "policy_package": "secrets-engine.catalog-lane.lifecycle",
        "policy_version": "v2",
        "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
        "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
        "input_claim_digests": {
          "context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
        },
        "decision_time": "2026-09-27T18:23:02Z"
      },
      "caring": {
        "profile": "caring-0.4.0-rc2",
        "conformance_findings": [
          {
            "code": "CARING-DESCRIPTOR-MISSING",
            "severity": "warning",
            "message": "no CARING descriptor matched the request",
            "fields": [
              "caring_context"
            ]
          }
        ]
      }
    }
  }
]