docs: preserve reviewed NetKingdom session artifacts

2026-11-01 22:58:57 +01:00 · 2026-11-01 22:58:57 +01:00 · a856698b03
commit a856698b03
parent 014bbd2893
50 changed files with 3800 additions and 0 deletions
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/manifest.json
@ -0,0 +1,40 @@
+{
+  "schema": "secrets-engine.consumer-admission-preparation.v1",
+  "proposal_id": "SECRETS14-CONSUMER-ADMISSION-20261016-R1",
+  "consumer_trust_sha256_proposal": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b",
+  "public_only": true,
+  "native_install_or_key_admission": false,
+  "source_runtime_revision": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "source_documentation_revision": "3718e60d7385db091d3423352f44e922863087de",
+  "files_sha256": {
+    "README.md": "sha256:9f73fa8b8cbda513ba4ade67ace79c00afee515b536382907742c35d234c1c7b",
+    "configuration/catalog/activity-core-metered-worker-token.yaml": "sha256:67d6235bbf6e28b7d1392ff26fd13ce4933843d11407a8fe2b1c793b3748a1f5",
+    "configuration/catalog/email-connect-transactional.yaml": "sha256:7869e96a7fca4c508f8a2a11a9b614db8c8a4100c2402597bde48a06aef77f97",
+    "configuration/catalog/example-build-test-token.yaml": "sha256:6e2396af8c711c10a5af83edb3925227c251e82d16a5d5a7b7a87948e2229f54",
+    "configuration/catalog/forgejo-admin-api-token.yaml": "sha256:193e231c5dbc175e82614fe35092ab649cf4152878f2679332b37888f176a991",
+    "configuration/catalog/glas-claude-agent-dev-anthropic.yaml": "sha256:61f40b124d937516b18b77b3ae3253079f024f4522191e22a81fae3d859abb63",
+    "configuration/catalog/issue-core-ingestion-api-key.yaml": "sha256:401b8c7a57d3e9a54e98711387577ecc6fc0674f2e32759a5c675e1d4adf176f",
+    "configuration/catalog/openrouter-llm-connect.yaml": "sha256:3d46e4896aa3b2a9838f72d4f2e3b1afc9deb2c7b1be0c62ae1900eb9cb1713b",
+    "configuration/catalog/reuse-surface-hub-write-token.yaml": "sha256:6f2ab0e31ba71bffb5d48b8ac787dee52b73f865af1c9f155d5046067a841111",
+    "configuration/catalog/warden-sign.yaml": "sha256:54a9ec01bf87fa3cc6ab75fa6c818c4977f2f70800a16890a836a509ad5c73c9",
+    "configuration/catalog/whynot-design-npm-publish.yaml": "sha256:18ada66f109a5532462b70b4d213bb73c7ab2e0ef9a4a2a149b7f9fcd77b034f",
+    "configuration/environment.proposed.json": "sha256:78a19a1a33f1faf61353ce674048826c89c45e84f15467992fca347679c4908d",
+    "configuration/pep-stance.yaml": "sha256:969ffd12506e2954c273e19ed6505692c1bacbe97a262a85862793254263e737",
+    "configuration/policies/netkingdom-publication-scope.yaml": "sha256:018000cb29edf7707f3885bec2f54285adef1e5a71c749b6b7ab6044203de89b",
+    "configuration/policies/secrets-engine-build.hcl": "sha256:ec5ce1987fbf2818f1ecd612d280cc419990dce12f85d7f5f38b621f4f9dbf69",
+    "configuration/policies/secrets-engine-prod.hcl": "sha256:1d12ca47e4f3ab234370ddfadad2aca8ae0943d95833798be5af0ea09860c6ce",
+    "configuration/policies/secrets-engine-test.hcl": "sha256:53c1d4146116784ba0024cc2c9f318e6443471ee97b7b1d2056ea840eb4ff6f6",
+    "configuration/trust/lifecycle-pre-key.json": "sha256:5f01b418cccef03326c424a1de649a4bde42811aa1e2041a6d0417c8d65a3f6a",
+    "consumer-baseline.json": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b",
+    "disposable-baseline-refusal.txt": "sha256:e4e4e516baeae294717382386667e2ded21314bb1956d8dce93f5040944c8d9a",
+    "platform-packet-consumer-review.json": "sha256:80e4751e97a991fdb321b018e203e0156e73ae9fc3a6706eb17c49a7c0c8c7c0",
+    "transport-proposal.json": "sha256:3181dc3da2a8e3c2e72bffdbaa9dc680b49d709d69dc9a9d907846737f59ebb3",
+    "validation.json": "sha256:dbbd66e4d71825c2cc685fd51a0926c2100afe7afe2afd4c0bf9bd02a87659f3",
+    "scanner-proof.json": "sha256:9936fd3294106c964b405922074fee28757a5c13121e1704da3a9c3ab3b5bbc4"
+  },
+  "existing_bundle_manifest": {
+    "path": "decision-native-preparation/r2/canonical-bundle-manifest.json",
+    "sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+    "unchanged": true
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/platform-packet-consumer-review.json
@ -0,0 +1,56 @@
+{
+  "schema": "secrets-engine.native-packet-consumer-source-review.v1",
+  "reviewer_role": "secrets-engine-owner",
+  "scope": "WP14 T02/T03 consumer/public provenance and source configuration proposal only",
+  "packet_pins": {
+    "README.md": "sha256:6238f96bfd19da1731f8b73d267e20013dc141d50d749e87c08b4d7042711fb1",
+    "evidence-pins.json": "sha256:22aa4e4dacea99dd9e77d2e7eae2a5916adcb6b75904001312254133e2b4b583",
+    "admission-scope.incomplete.json": "sha256:d5b1ec3b28d75995e96fb87785dceef773ded780ccf478ea08d96f41fe4926b3",
+    "manifest.json": "sha256:3064c06ac9ba0b02fb95caa5176ba349d589775f5cbc5314e5075197018bad35",
+    "assembler-r2-revision.json": "sha256:a91e5ceb261a84ac2f3591d9973782660235ae49ad7cdff0d2fd40a22c2ccaff",
+    "finalize.py": "sha256:085e179b76abdbb43b61d3e94a0b2efda23d8c943e9e49fbf5d78a7acbbd0385"
+  },
+  "disposition": "consumer_preparation_recommendation; actual native admission withheld",
+  "consumer_baseline_proposal_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b",
+  "recommended_native_packet_fields_after_independent_owner_selection": {
+    "consumer_trust_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b",
+    "bindings.trust_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b"
+  },
+  "meaning": "Exact public pre-key baseline manifest, including bundle integrity/configuration and empty-key trust. Not a claim newly generated public key is already trusted; installing/reviewing these bytes does not authenticate an owner or admit a key. Final public trust successor requires separate independent review and digest.",
+  "platform_packet_findings": [
+    {
+      "id": "CONSUMER-P1-01",
+      "state": "acceptable_source_separation",
+      "detail": "P1 explicitly distinguishes pre-key baseline from independently authenticated post-custody receipt/key admission and holds consumer restart. Fingerprint convention matches existing consumer representation. No responder endpoint or private KV discovery is proposed."
+    },
+    {
+      "id": "CONSUMER-P1-02",
+      "state": "required_before_exact_native_packet_review",
+      "detail": "P1 image pins preserve observed candidate0a and failed CI400. Root is preparing successful ordinary-CI successor. Replace image/release/projection bindings in a separately pinned packet revision; this consumer baseline excludes image deliberately. Do not copy exact five-owner approvals across changed packet bytes or claim P1 is executable."
+    },
+    {
+      "id": "CONSUMER-P1-03",
+      "state": "required_independent_authenticated_public_return",
+      "detail": "Platform/founder must return closed public receipt through an independently authenticated owner channel, binding original action/admission/executed source/CCR/cluster/backend/image/deployment/lifecycle policy/purpose/sharing, actual kid/public key/fingerprint and version1 exact correspondence or exact recovery lineage. A hash, actor/native_custody flag or approval reference alone supplies no authentication. Reject absent/metadata-only/unstored-key recovery as key admission."
+    }
+  ],
+  "public_key_admission_sequence": [
+    "Retain exact approved native packet/source and original receipt lineage independently before execution; do not read private receipt directory as agent intake.",
+    "Authenticate Platform public return independently; check proposed kid exact, canonical public key raw32/base64url43 and SHA256 of43ASCII, actual executed source/target/purpose/policy and pending-independent-admission outcome.",
+    "Prepare separate post-custody configuration revision with same reviewed baseline metadata and public key only in existing trust schema; independently retain final trust/config bytes/digests and owner disposition. No fixture substitution, automatic discovery or silent baseline overwrite.",
+    "Only under separately reviewed consumer/caller/rollout scope verify actual named-pod source/image/startup projection and capture actual signed allow/deny/source records. Run the one reviewed Access offline tool against fixed installed helper and final admitted trust.",
+    "Prove local negative cases, admitted-key removal and outage failclosed. Real rotation needs independently admitted overlap keys and owner lifecycle; no invented survivor key, unsigned rollback or removed-key restoration. Effects remain separate acceptance."
+  ],
+  "authority_granted": false,
+  "native_consumer_trust_admitted": false,
+  "may_populate_native_admission_owner_reviews": false,
+  "scope_digest_or_approval_reference_supplied": false,
+  "native_effects_accepted": 0,
+  "native_effect_denominator": 11,
+  "handlers": 10,
+  "prior_reviews_preserved": {
+    "platform-public-trust-review-r1.json": "sha256:30525ed0ac6b3e44affdac1ab23b80ef8dc7353c559d199db7cb689d1d0bf09d",
+    "platform-public-trust-review-r2.json": "sha256:867268d7f3fee8bac82f4b7730ae36bd20324253674e6f1b97ec5eb703d02436"
+  },
+  "no_key_read_login_caller_mint_install_live_action": true
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/scanner-proof.json
@ -0,0 +1 @@
+{"blocked_blob_ids": [], "scanned_blobs": 24, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/transport-proposal.json
@ -0,0 +1,64 @@
+{
+  "schema": "secrets-engine.consumer-transport-proposal.v1",
+  "baseline_sha256": "sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b",
+  "scope": "future separately approved signer receipt capture; no token mint or tunnel performed",
+  "execution_user": "worsch",
+  "uid": 1000,
+  "cluster_context": "primary",
+  "expected_cluster": "railiance01",
+  "expected_kube_system_namespace_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+  "producer_namespace": "flex-auth",
+  "producer_deployment": "flex-auth-secrets-engine",
+  "pod_name": null,
+  "pod_selection": "after independently admitted rollout, Access/cluster owner returns exact ready pod name, UID, immutable image, signer projection/source and startup evidence; bind named pod only, no service/label-first discovery at invocation",
+  "loopback": {
+    "host": "127.0.0.1",
+    "local_port": 18081,
+    "pod_port": 8080,
+    "argv_shape": [
+      "kubectl",
+      "--context",
+      "primary",
+      "-n",
+      "flex-auth",
+      "port-forward",
+      "pod/<owner-returned-exact-name>",
+      "18081:8080",
+      "--address",
+      "127.0.0.1"
+    ],
+    "lifetime": "single attended receipt-capture session; record owned PID; stop exact forward at end; no auto-port substitution"
+  },
+  "caller": {
+    "principal": "system:serviceaccount:secrets-engine:secrets-engine",
+    "subject_id": "secrets-engine",
+    "subject_type": "service",
+    "audience": "flex-auth",
+    "delivery_contract": "existing docs/pdp-access-path.md historical bounded TokenRequest recipe, requires distinct cluster-owner approval and actor permission; local UID is not SA identity",
+    "proposed_duration_seconds": 600,
+    "path": "/run/user/1000/secrets-engine/lifecycle-20261016-r1/pdp-caller.token",
+    "mode": "0600",
+    "parent_mode": "0700",
+    "no_existing_credential_value_or_file_inspected": true,
+    "delivery_action_authorized": false,
+    "delivery_actor": null,
+    "receipt_required": "non-secret actor/custody/creation/expiry/audience/path/mode receipt; never token bytes",
+    "end_of_session": "custody owner removes bounded file and ends session; expiry remains authoritative, no standing refresh"
+  },
+  "capture": "actual admitted signed allow+deny response and original decision records through existing /v1/check only; no Approval consume/backend call; source record export remains Access-owned",
+  "native_missing_exact_values": [
+    "selected future admitted producer pod name/UID and accepted image/projection/startup receipt",
+    "independently admitted post-custody key-bearing trust revision",
+    "authorized TokenRequest delivery actor/session disposition",
+    "separately owner-reviewed exact signer-only allow/deny request pair and source-record capture/export"
+  ],
+  "offline_verifier": {
+    "source_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "source_path": "tools/verify_native_signer_receipt.py",
+    "sha256": "sha256:33d3c50aba51b85cf85d2e234268e903004894299efc9b3745e0980c55578280",
+    "runtime": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03/venv/bin/python",
+    "helper": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03/libexec/secrets-engine-pdp-verify",
+    "canonicalization": "existing Secrets functions and pinned producer verifier only"
+  },
+  "native_effect_acceptance": "0/11 sites across10 handlers; offline receipt success does not change this"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-admission-r1/validation.json
@ -0,0 +1,17 @@
+{
+  "result": "pass",
+  "actual_installed_source_revision": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "test": "actual installed authorize_action with pre-key baseline, minimal environment, no openers/injected authorizer",
+  "disposable_mapping": "only trust/helper path mapped to artifact and previously installed disposable bundle; proposed future configuration/prefix not created",
+  "expected_exception": "DecisionError: access-engine responder trust is missing or invalid; cause ValueError: missing admitted keys",
+  "prior_harness_attempt": "Production correctly refused; first harness assertion wrongly expected key in sanitized outer error. Corrected assertion checks exact public outer error and local cause. No runtime change.",
+  "credential_or_network_or_backend_access": false,
+  "native_install_or_admission": false,
+  "scanner_initial_pass": {
+    "status": "blocked",
+    "scanned_blobs": 25,
+    "blocked_blob_id": "48a16ffb32697e7b62e4b1f5449a3f05b42179b7",
+    "file": "reviewed-bundle-manifest.json",
+    "disposition": "Redundant copy of existing immutable programmatic bundle manifest removed from this proposal; original r2/canonical-bundle-manifest.json and release manifest remain byte-identical. This proposal references exact independently retained manifest digest, does not alter programmatic format, scanner or exclusions."
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/consumer-metadata-r1.json
@ -0,0 +1,32 @@
+{
+  "source_commit": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "scope": "current invoking shell and installed entrypoint metadata only; no credential/private-config/process-environment inspection",
+  "shell_configuration_presence": {
+    "SECRETS_ENGINE_PDP_URL": false,
+    "SECRETS_ENGINE_PDP_TOKEN_FILE": false,
+    "SECRETS_ENGINE_PDP_TRUST_FILE": false,
+    "SECRETS_ENGINE_PDP_VERIFIER": false,
+    "SECRETS_ENGINE_APPROVAL_URL": false,
+    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": false,
+    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": false,
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": false,
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": false,
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": false,
+    "SECRETS_ENGINE_CATALOG": false,
+    "SECRETS_ENGINE_POLICIES": false,
+    "SECRETS_ENGINE_PEP_STANCE": false,
+    "SECRETS_ENGINE_EVIDENCE": false,
+    "SECRETS_ENGINE_OPENBAO_JWT_LOGIN": false
+  },
+  "repo_venv_entrypoint_exists": true,
+  "global_entrypoint_exists": false,
+  "uv_managed_secrets_tool": false,
+  "uv_inventory_evidence": "successful uv tool list output showed no secrets-engine; unrelated tool inventory omitted",
+  "repo_venv_distribution": {
+    "version": "0.1.0",
+    "editable": true,
+    "source_path": "/home/worsch/secrets-engine",
+    "entrypoint_target": "secrets_engine.cli:main"
+  },
+  "observed_at": "2026-10-16T07:41:40.394089+00:00"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/implementation-r1.patch
@ -0,0 +1,461 @@
+diff --git a/docs/pdp-access-path.md b/docs/pdp-access-path.md
+index 88eac9d..0cc31d4 100644
+--- a/docs/pdp-access-path.md
+++ b/docs/pdp-access-path.md
+@@ -23,20 +23,20 @@ $ getent hosts this-service-does-not-exist.flex-auth.svc.cluster.local
+ `*.svc.cluster.local` name answers with one unrelated public address. Sending
+ there ships the CheckRequest body and our bearer token to a third party.
+ 
+-`flex-auth.decision-record.v1` supports a detached Ed25519 signature on the
+-producer side (FLEX-WP-0024), but this consumer does not yet verify it against
+-independently admitted keys. Without that verification, every binding digest
+-is either sent by us or published in flex-auth's repo, so a forger can
+-reproduce those digests. Digests establish integrity of the binding, never
+-authenticity of the source. As flex-auth put it in `FLEX-DEC-2026-010`:
+-
+-> Fail-closed protects against a PDP that is ABSENT, not against one that LIES.
+-
+-The literal loopback address restriction limits the destination; it does not
+-prove responder identity. The operator must verify the cluster and named pod
+-behind the port-forward. Signed consumer enforcement, independently admitted
+-verification keys, rotation and downgrade tests remain open in SECRETS-WP-0014
+-and Custodian G13. Producer support alone does not close that gap.
+As of source `ff1a13d` (2026-10-16), this consumer requires the producer's
+detached Ed25519 signature using independently admitted local keys and exact
+signed evaluator/mode/policy pin. The complete CLI wheel-plus-helper bundle and
+strict task handoff are implemented in source. Native signer custody, key/pin
+admission, installed placement and actual consumer receipts remain unaccepted;
+source enforcement does not establish those facts. See
+[the scoped native preparation](proposals/native-cli-admission/README.md).
+
+Historical 2026-10-12 finding: prior consumer source did not verify producer
+signatures, so a forger could reproduce public request digests. The literal
+loopback address restriction limited the destination and did not prove responder
+identity. That source defect is repaired; FLEX-DEC-2026-010's historical warning that an absent
+PDP and a lying responder require different controls remains relevant. The
+independently admitted native trust and rollout obligations in SECRETS-WP-0014 T02/T03 remain open.
+ 
+ The Check client disables automatic redirects, environment/system proxies and
+ the process-global urllib opener. A 3xx response fails closed without contacting
+@@ -51,9 +51,12 @@ apply when the approval flow invokes the PDP client.
+ Regression tests use disposable local HTTP servers and synthetic credentials;
+ they do not demonstrate identity or signature verification on the native pin.
+ 
+-## The supported path
+## Historical transport procedure and current admission gate
+ 
+-Use literal loopback `kubectl port-forward` to the admitted named pod after
+The following transport example records the earlier supported access shape; it
+is incomplete for current native use without independently admitted signing trust,
+the reviewed CLI bundle and exact owner configuration. It grants no token mint,
+installation or live action. Use literal loopback `kubectl port-forward` to the admitted named pod after
+ verifying the cluster identity and pod identity. That path rides the Kubernetes
+ API server's TLS with the operator's cluster credentials; the client cannot infer
+ that binding from its local URL. Note this
+@@ -92,8 +95,10 @@ false` and no role bindings — it exists to be a caller identity and nothing el
+ 
+ v1 shipped and was deployed with no `input.tenant` rule at all; a `rotate` under
+ `tenant:coulomb` returned **allow**. v2 supersedes rather than amends it so the
+-change is visible in the version string, and this engine refuses a v1 decision
+-outright. See `docs/tenant-alignment.md`.
+change is visible in the version string. Current consumer configuration and signed
+trust must explicitly pin the admitted v2 artifact; the validator does not impose
+a universal hard-coded package/version default. A v1 configuration is not admitted
+by this proposal. See `docs/tenant-alignment.md`.
+ 
+ ## The digest join, and why it is not a digest comparison
+ 
+@@ -114,19 +119,18 @@ and the fix follows it rather than inventing one:
+ > statement of what it hashed. To recompute independently, hash the same
+ > normalized tuple the binding carries.
+ 
+-`validate_decision_envelope` now does exactly that:
+-
+-- **Structured correspondence.** Everything we proposed — tenant, action,
+-  context, `subject.id`/`type`, `resource.id`/`type`/`system` and every
+-  attribute we sent — must survive unchanged in the binding.
+-- **Enrichment only where the contract permits it.** A ref may gain `type`,
+-  `tenant` and `attributes`; any other added field is refused. An enriched
+-  `tenant` must be the request's tenant, so a cross-tenant binding cannot arrive
+-  wearing our request's clothes.
+-- **Digest self-consistency.** `request_digest` is recomputed over the
+-  normalized tuple the binding carries, per the contract's own instruction. It
+-  is still checked — just for coherence of the binding rather than against
+-  material we never sent.
+The bullets in earlier revisions described the September structured-enrichment
+check. Current source has since moved to the producer's submitted-request replay
+contract: `validate_decision_envelope` validates the exact submitted digest,
+opaque enriched digest shape, approval-free correspondence, policy pin and
+lifetime on an authenticated envelope. It does not independently reconstruct the
+full enriched tuple or native five-field claim in the generic CLI path.
+
+The separate strict `task_execution_handoff` additionally recomputes the evaluated
+and approval-free digests, verifies exact descriptor/context/native claim joins
+(including the served native digest), and binds signed enforced caller provenance.
+That source seam is not an `execute-ccr` CLI command and does not admit the proposed
+service caller mapping or enable either task policy's runtime false gate.
+ 
+ The lesson worth keeping: the replay fixtures could not catch this, because
+ `_request_from()` rebuilds the request from the binding, so the tests hashed the
+diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md
+new file mode 100644
+index 0000000..3729cf6
+--- /dev/null
+++ b/docs/proposals/native-cli-admission/README.md
+@@ -0,0 +1,158 @@
+# Native CLI signer and consumer admission preparation
+
+This proposal covers the existing lifecycle CLI authentication path under
+SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
+consume, OpenBao effect or task-policy activation. All native acceptance counts
+below are zero. Exact missing owner inputs are in `proposal.json`.
+
+## Current consumer and initial scope
+
+At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI
+entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing
+`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv
+managed Secrets tool. Presence-only inspection of this session found none of the
+PDP/trust/approval/policy/configuration variables set. This says nothing about
+other sessions, private owner configuration or a remote installation. No credential
+file, private configuration or process environment was inspected.
+
+Use a separately reviewed immutable wheel-plus-verifier bundle for proposed
+adoption. The canonical source for the candidate build is **ff1a13d**, containing
+both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are
+intermediate source evidence. Custodian `decision-native-preparation/` retains the
+exact canonical bundle manifest and hashes. Nothing was installed by this step.
+
+Initial stage is signer-only existing lifecycle-pin admission plus offline
+verification of captured native signed allow and deny records. Capturing those
+records later needs its own admitted caller and exact source operation; this
+proposal does not grant that capture. Use Access's one receipt verifier,
+`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather
+than creating another consumer verifier or canonicalization implementation.
+That tool is separate Access source preparation; its exact integrated revision
+and reviewed admission file remain owner inputs, not part of this CLI install.
+
+The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2,
+`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`,
+evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the
+live image's source or policy. Access's live metadata records the current pin has
+no signer arguments/mounts; no production kid/public key/fingerprint/custody
+receipt or candidate signed-runtime OCI digest is admitted. The proposed signer
+custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or
+from the same responder's keys endpoint. The independent receipt must bind signer
+purpose/custody to this exact consumer pin and declare any sharing. A shared key
+plus the generic evaluator name cannot prove an individual pod's identity; the
+owner-bound tunnel and rollout identity still require separate verification.
+
+`lifecycle-trust.template.json` uses the existing runtime trust schema and the
+producer-owned source pin, but deliberately has an empty key map. It **must
+refuse** before caller credential access. It is not a deployable trust file. A
+future owner-admitted copy must contain the independently authenticated actual
+kid/key and exact pin, with its public-key fingerprint/custody provenance retained
+outside this unadmitted template. The task-policy coordinate is not admitted here.
+
+## Exact PEP denominator
+
+The initial shared authentication implementation is one Check client reached
+through `authorize_action` and `_require_lane_approval`. Native protected-effect
+coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one
+PEP per catalog row. The current lifecycle policy's action vocabulary has twelve
+values; that is a separate count from handler/call-site coverage.
+
+| CLI path | Handler / delegated authorization site | PDP action |
+| --- | --- | --- |
+| apply, live only | `cmd_apply` | apply |
+| provision | `cmd_provision` | provision |
+| rotate, live only | `cmd_rotate` | rotate |
+| verify | `cmd_verify` | verify |
+| handoff | `cmd_handoff` | handoff |
+| wrap | `cmd_wrap` | wrap |
+| exec primary | `cmd_exec`, primary gate | exec |
+| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site |
+| revoke, live only | `cmd_revoke` | deactivate |
+| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation |
+| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation |
+
+`session revoke` is a separate stance/readiness-controlled backend path without
+this served Check/CAS chain; it is excluded from this signer acceptance and still
+refuses production under its stance. `service-auth probe-openbao` is an explicit
+identity/login-self probe, not protected task adoption. `route` performs existing
+backend readiness metadata probes through its ambient backend resolver; it is not
+closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands
+are not protected-effect proof. These exclusions must remain visible in any claim
+about the whole repository's PEP coverage.
+
+The existing CLI handlers still use the generic `require_production_consume`
+response contract. Strict R2 task consumption is a separate owner API, not a
+retrofit of all eleven CLI sites. Native effect acceptance must review the actual
+selected handler/consume contract and caller scope rather than borrow the task
+fixture proof.
+
+No production effect is authorized merely because a handler shares the signed
+client. In particular, configured `service-jwt` still refuses protected CLI work
+before approval/CAS/backend because CCR38 is identity-only. Do not select
+bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance.
+
+## Owner-controlled placement and minimum configuration
+
+The deploying owner must select the runtime UID, fresh release prefix, configuration
+parent and exact runtime paths; none is agreed by this proposal. The future
+admitted executable is `<prefix>/bin/secrets-engine`, whose wrapper fixes the
+bundle helper and checks its digest before CLI import. The helper's source/binary
+hash is artifact integrity, not independent package or key admission. Do not use
+the editable checkout, a rolling alias, a synthetic test prefix or an internal
+venv entrypoint as if it were that admission.
+
+Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`,
+trust and evidence/outbox locations are needed. Installed-package defaults fall
+back to working-directory metadata and are not an admitted native configuration.
+The total existing stance remains prod fail_closed. Config needs the exact
+producer policy/version, service subject, loopback owner-bound PDP tunnel and
+separately admitted bounded audience `flex-auth` caller-file lifetime. Approval
+endpoint and its existing separately scoped credential delivery must be admitted
+independently. Both approval credential providers may not be configured together.
+The bundle helper is not selected by an ambient override. Runtime credentials and
+keys are not placed in this proposal or release bundle.
+
+Acceptance order is: admit exact package/source/install/config; obtain independent
+signer/key/pin custody return and exact signed producer rollout candidate; under
+that separately reviewed rollout capture bounded native records; run Access's
+single offline receipt verifier against the fixed installed helper and admitted
+trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact
+old/new-key overlap then removed-key refusal. Also close the producer's missing
+native durable log/outbox/audit path under its owner. No install or rollout is
+performed here, and shared-source tests do not fill native effect coverage.
+
+Rollback retains the reviewed signed producer and admitted overlap or stops the
+consumer. Rolling back to an unsigned image is an outage, not permission to turn
+off verification. Removing keys, changing policy pins or restoring removed keys
+needs exact owner review; no discovery/cached-key fallback or blind consume retry.
+
+## Separate task-execution gap
+
+Strict `task_execution_handoff` exists and Platform's independently confirmed
+journal/native fixture path has actual source-server proof. Neither creates an
+existing `execute-ccr` CLI command: the current parser has none. Proposed task
+caller mapping/request join, policy admission, production source/Plan/grant and
+installation/journal/cleanup placement remain separate owner decisions. Both
+Access task-policy runtime false gates remain unchanged; lifecycle apply is not
+a substitute for execute-ccr. Platform has selected no fresh approved real
+CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets
+catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native
+inputs. Actual before/after bytes for the exact metadata targets and independent
+readback/cleanup receipts must come from Platform's eventual owner-selected plan.
+
+For future server-owned Approval facts, strict R2 deliberately requires the
+returned binding context to equal the originally submitted context. B1 caller
+join remains signed-DENY and must preserve that context. Replacing the carried
+claim with a freshly observed blob would refuse because its freshness fields
+change; no generic equality relaxation is proposed. Access's current review
+preference is to validate fresh authoritative facts out of band while retaining
+the submitted context, with reviewed producer-owned signed source/receipt evidence.
+Exact stable fact/freshness and provenance correspondence requires Approval and
+Access review before B2/B3; no new fields or behavior are implemented here.
+
+The Approval owner's pending `approval-fact-contract/consumer-contract.md` and
+`golden-vectors.json` in the Custodian target evidence name this correspondence.
+They require both original/fresh windows and exact nonfreshness authority facts.
+Their Python native numeric canonical vectors still need producer conformance;
+no silent digest translation or new target numeric restriction is admitted.
+The proposal pins those owner artifacts for review, not as B2 implementation.
+diff --git a/docs/proposals/native-cli-admission/lifecycle-trust.template.json b/docs/proposals/native-cli-admission/lifecycle-trust.template.json
+new file mode 100644
+index 0000000..22fc99a
+--- /dev/null
+++ b/docs/proposals/native-cli-admission/lifecycle-trust.template.json
+@@ -0,0 +1,9 @@
+{
+  "schema": "secrets-engine.pdp-trust.v1",
+  "evaluator": "flex-auth/local",
+  "mode": "standalone",
+  "policy_package": "secrets-engine.catalog-lane.lifecycle",
+  "policy_version": "v2",
+  "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
+  "keys": {}
+}
+diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json
+new file mode 100644
+index 0000000..d5c50c2
+--- /dev/null
+++ b/docs/proposals/native-cli-admission/proposal.json
+@@ -0,0 +1,133 @@
+{
+  "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
+  "status": "preparation only; not installable or executable authorization",
+  "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "workplans": [
+    "SECRETS-WP-0014-T02",
+    "SECRETS-WP-0014-T03",
+    "SECRETS-WP-0013-T01",
+    "SECRETS-WP-0013-T03"
+  ],
+  "initial_scope": {
+    "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin",
+    "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only",
+    "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects",
+    "native_effects_admitted": 0,
+    "task_execution_enabled": false
+  },
+  "owner_returns": {
+    "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json",
+    "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs."
+  },
+  "producer_pin": {
+    "evaluator": "flex-auth/local",
+    "mode": "standalone",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_version": "v2",
+    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
+  },
+  "independent_admission": {
+    "production_kid": null,
+    "public_key": null,
+    "public_key_sha256": null,
+    "custody_receipt": null,
+    "candidate_producer_oci_digest": null,
+    "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
+    "receipt_verifier_integrated_revision": null,
+    "signer_purpose_pin_and_sharing_receipt": null
+  },
+  "placement": {
+    "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
+    "cli_release_prefix": null,
+    "cli_entrypoint": "<admitted-prefix>/bin/secrets-engine",
+    "fixed_verifier": "<admitted-prefix>/libexec/secrets-engine-pdp-verify",
+    "config_parent": null,
+    "trust_file": null,
+    "catalog_directory": null,
+    "policy_directory": null,
+    "pep_stance_file": null,
+    "evidence_directory": null,
+    "constraints": [
+      "new owner-controlled immutable release prefix; no overwrite or rolling source alias",
+      "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
+      "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
+      "owner retains manifest/admission/installation receipts and same-UID control boundary"
+    ]
+  },
+  "configuration_contract": {
+    "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
+    "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here",
+    "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses",
+    "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2",
+    "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session",
+    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here",
+    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers",
+    "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected",
+    "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory",
+    "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed",
+    "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery",
+    "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception",
+    "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround"
+  },
+  "rotation": {
+    "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin",
+    "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys",
+    "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal",
+    "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation"
+  },
+  "task_mapping_gap": {
+    "existing_cli_execute_ccr_command": false,
+    "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution",
+    "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
+    "unadmitted_inputs": [
+      "real service caller-to-subject server mapping and request/service binding join",
+      "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged",
+      "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
+      "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
+      "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
+      "load-bearing audit/outbox cadence and durable receipt correlation",
+      "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged"
+    ],
+    "approval_fact_interface_review": {
+      "status": "review preference only; no implementation/admission",
+      "preserve": "strict binding.context equality and original submitted/approval-free/native joins",
+      "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence",
+      "required_review": [
+        "Approval fact/freshness semantic correspondence",
+        "Access source receipt/provenance binding and exact request digests"
+      ],
+      "b1": "signed-DENY caller join only; no context replacement",
+      "b2_b3": "not enabled or implemented here"
+    },
+    "approval_fact_contract": {
+      "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
+      "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+      "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
+      "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+      "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
+      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
+    }
+  },
+  "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
+  "denominator": {
+    "shared_check_implementation": 1,
+    "serving_cli_call_sites": 11,
+    "serving_cli_handlers": 10,
+    "lifecycle_pdp_action_values": 12,
+    "native_effect_call_sites_accepted": 0,
+    "excluded": [
+      "session revoke stance-only backend path",
+      "service-auth explicit identity probes",
+      "route ambient-backend readiness probes",
+      "dry-run/non-effect reporting"
+    ],
+    "task_cli_command_count": 0,
+    "platform_source_mediator_native_acceptance": false,
+    "generic_cli_consume_is_strict_task_handoff": false,
+    "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  }
+}
+diff --git a/src/secrets_engine/cli.py b/src/secrets_engine/cli.py
+index d60988d..af65388 100644
+--- a/src/secrets_engine/cli.py
+++ b/src/secrets_engine/cli.py
+@@ -119,13 +119,12 @@ def _require_lane_approval(
+ ):
+     """Apply published PEP stance, resolve lane approval, then CAS-consume.
+ 
+-    Production ``fail_closed`` is read from ``pep-stance.yaml``. The durable
+-    access-engine decision record is not served yet, so that row refuses live
+-    production work. If that residue is ever bypassed, GH-DEC-2026-003 still
+-    requires a successful approval-engine consume before any OpenBao call.
+-    The three-factor unsafe-demo exception is not a stance row and is not a
+-    consume path. Build/test ``fail_open`` still requires the existing
+-    lane-approval check — a tracked gap until SECRETS-WP-0008-T02.
+    Production ``fail_closed`` is read from ``pep-stance.yaml``. A configured
+    serving path requires a fresh approval claim and independently authenticated
+    signed PDP envelope, then successful CAS before the backend. Missing runtime
+    trust/configuration still refuses production; source support is not native
+    admission. Build/test engine-unreachable residue retains the explicit legacy
+    lane check. The three-factor unsafe-demo exception grants no native adoption.
+     """
+     # Steps 1 and 2 first: a validated claim and decision are what make the
+     # unreachable-engine residue inapplicable. Absent configuration returns
+diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+index 886a0f6..28102cf 100644
+--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+@@ -102,3 +102,15 @@ admitted signer, reject forgery/downgrade, rotate without accepting removed keys
+ and preserve request/approval binding, lifetime and single-use consumption.
+ Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these
+ native receipts; do not equate passing transport tests with closure.
+
+
+2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/`
+now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator,
+independent key/policy admission, owner-controlled bundle/config placement and
+rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was
+rebuilt in an isolated clean checkout; artifact receipts are in Custodian
+`decision-native-preparation/`. Production kid/public fingerprint/custody receipt,
+producer candidate OCI and actual runtime/config placement remain missing. The
+empty-key trust template deliberately refuses. No install, key read, caller mint,
+protected effect, policy switch or trust admission occurred. T02 remains progress,
+T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/normal-sync.json
@ -0,0 +1,7 @@
+{
+  "chunk_id": "83f71f",
+  "wall_time_seconds": 0.000013382,
+  "exit_code": 0,
+  "original_token_count": 639,
+  "output": "{\n  \"repo_slug\": \"secrets-engine\",\n  \"repo_path\": \"/home/worsch/secrets-engine\",\n  \"source_revision\": \"5a2099f400fb0c97fed2d991832c0e31513bbdfb\",\n  \"source_revision_reason\": null,\n  \"issues\": [\n    {\n      \"severity\": \"WARN\",\n      \"check_id\": \"C-23\",\n      \"message\": \"Lifecycle drift in 'secrets-wp-0013': workplan status 'proposed' has an active task \\u2014 report only (ADR-007: do not auto-promote proposed)\",\n      \"file_path\": \"workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md\",\n      \"db_id\": \"5e38aecc-85ca-5f55-94c6-9fbb08604819\",\n      \"file_value\": \"proposed\",\n      \"db_value\": \"active\",\n      \"fixable\": false\n    },\n    {\n      \"severity\": \"WARN\",\n      \"check_id\": \"C-22\",\n      \"message\": \"Task description drift 'SECRETS-WP-0014-T03': file content differs from DB (file wins)\",\n      \"file_path\": \"workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md#SECRETS-WP-0014-T03\",\n      \"db_id\": \"85aa4c78-b66d-5201-8e31-0ed50e7eaeec\",\n      \"file_value\": \"Under an exact reviewed rollout, prove the real pin and consumer accept the\\nadmitted signer, reject forgery/downgrade, r\",\n      \"db_value\": \"Under an exact reviewed rollout, prove the real pin and consumer accept the\\nadmitted signer, reject forgery/downgrade, r\",\n      \"fixable\": true\n    },\n    {\n      \"severity\": \"INFO\",\n      \"check_id\": \"C-08\",\n      \"message\": \"Closed DB workstream 'secrets-wp-0002' (id=7929a2d1\\u2026, status=finished) has no backing workplan file\",\n      \"file_path\": \"\",\n      \"db_id\": \"7929a2d1-3006-5d4b-85e4-c62da055ee9b\",\n      \"file_value\": \"\",\n      \"db_value\": \"\",\n      \"fixable\": false\n    },\n    {\n      \"severity\": \"WARN\",\n      \"check_id\": \"C-28\",\n      \"message\": \"3 unread inbox message(s) older than 3 day(s): railiance-platform:0490edcb, the-custodian:23172cb2, the-custodian:51e9eace\",\n      \"file_path\": \"\",\n      \"db_id\": \"\",\n      \"file_value\": \"\",\n      \"db_value\": \"\",\n      \"fixable\": false\n    },\n    {\n      \"severity\": \"WARN\",\n      \"check_id\": \"C-28\",\n      \"message\": \"2 unread message(s) lack thread_id for supersession tracking: the-custodian:23172cb2, the-custodian:51e9eace\",\n      \"file_path\": \"\",\n      \"db_id\": \"\",\n      \"file_value\": \"\",\n      \"db_value\": \"\",\n      \"fixable\": false\n    }\n  ],\n  \"fixes_applied\": [\n    \"bindings: synced 16/16\",\n    \"C-17 cleared: pushed 1 backlogged commit(s)\",\n    \"C-22 fixed: task 85aa4c78\\u2026 description updated\",\n    \"push: pushed\"\n  ],\n  \"summary\": {\n    \"fail\": 0,\n    \"automation_error\": 0,\n    \"warn\": 4,\n    \"info\": 1\n  },\n  \"result\": \"warn\"\n}\n"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/original-owner-dirty.patch
@ -0,0 +1,96 @@
+diff --git a/.custodian-brief.md b/.custodian-brief.md
+index 0cb912a..ba794c8 100644
+--- a/.custodian-brief.md
+++ b/.custodian-brief.md
+@@ -2,7 +2,7 @@
+ # Custodian Brief — secrets-engine
+ 
+ **Domain:** infotech  
+-**Last synced:** 2026-10-11 17:52 UTC  
+**Last synced:** 2026-10-16 05:55 UTC  
+ **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+ 
+ ## Active Workstreams
+@@ -11,8 +11,24 @@
+ Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
+ 
+ **Open tasks:**
+- ! Define the exact mediated execution contract  `b2f0d462`
+  *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
+ - ! Implement and prove one native metadata action  `5f8f7c41`
+-- ► Define the exact mediated execution contract  `b2f0d462`
+
+### Constrain PDP transport and authenticate decision responses
+Progress: 1/3 done  |  workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
+
+**Open tasks:**
+- ! Verify the admitted native consumer and rotation path  `85aa4c78`
+  *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
+- ► Implement independently anchored responder authentication  `877782e5`
+
+### Production-safe provisioning, authorization, and lifecycle hardening
+Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+
+**Open tasks:**
+- ! Resume native production lane adoption  `a0a1dd92`
+  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+ 
+ ### Activate native Claude credential delivery for Glas
+ Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
+@@ -26,27 +42,20 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
+ 
+ **Open tasks:**
+ - ! Stage live apply and verification  `fb103f1e`
+-  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
+  *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
+ - ! Reconcile routing ownership and retire interim proxies  `1431edae`
+   *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
+ 
+-### Production-safe provisioning, authorization, and lifecycle hardening
+-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+-
+-**Open tasks:**
+-- ! Resume native production lane adoption  `a0a1dd92`
+-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+-
+ ### Evolve the Lifecycle engine to the accepted security layer model
+ Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+ 
+ **Open tasks:**
+ - ! No standing engine credential  `d7bc8bdc`
+-  *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
+  *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
+ 
+ ## Inbox Hygiene
+ 
+-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
+ **Missing thread_id:** 2 unread message(s) lack supersession chains.
+ 
+ ---
+diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
+index 70e5831..4d1cfb6 100644
+--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
+@@ -22,6 +22,7 @@
+ | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+ | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
+ | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+ | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
+@@ -83,9 +84,12 @@
+ | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r1.json
@ -0,0 +1,65 @@
+{
+  "reviewer_role": "secrets-engine-owner",
+  "review_basis": [
+    "Secrets AGENTS.md",
+    "Secrets INTENT.md Engine/Lifecycle and PEP consumer boundary",
+    "SECRETS-WP-0014-T02 independently anchored responder keys/pin",
+    "SECRETS-WP-0014-T03 native consumer/rotation acceptance"
+  ],
+  "scope": "independent Secrets consumer/public-trust provenance review only; no Platform custody, Access, founder, cluster/GitOps, credential-read or native action approval",
+  "reviewed_exact_patches": {
+    "native_preparation_R1": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f",
+    "native_adapter_R1": "sha256:f316a53b604f4333414b832691968ede8056d49a61635f0f25831084b1d75f19"
+  },
+  "disposition": "changes_requested",
+  "authority_granted": false,
+  "native_consumer_trust_admitted": false,
+  "may_populate_native_admission_owner_reviews": false,
+  "source_review_does_not_approve_exact_future_admission_digest": true,
+  "findings": [
+    {
+      "id": "SECRETS-PUBLIC-TRUST-R1-F01",
+      "priority": "medium",
+      "owner": "Platform source/proposal owner",
+      "finding": "Native plan bootstrap.source_primitive_sha256 is sha256:8ed281a49c1f1cdb23772efe3593e75c62572a12b8d7a6a4c574f27b38722e75, while adapter R1 executes refactored custody module sha256:f169ad12f90d729b647085c3bed2c0d8d005db23a2341b6d3d5f1793bcfd110c. Source_bundle/writer receipt pin the latter, but checked_sources does not join the plan primitive field; the plan does not mark the former historical.",
+      "consumer_impact": "Independent public admission must identify an unambiguous actual custody primitive/executed source lineage. A stale current-looking source pin must not stand in for the executed revision.",
+      "requested_change": "In a frozen successor, make the plan current primitive reference agree with the exact executed source, or explicitly label the old pin historical and define/enforce the current source-bundle relationship. Preserve R1 and all failed observations.",
+      "independently_checked": true
+    },
+    {
+      "id": "SECRETS-PUBLIC-TRUST-R1-F02",
+      "priority": "high",
+      "owner": "Platform recovery owner; coordinator implementation review",
+      "finding": "Coordinator actual fork counterexample after metadata POST leaves durable metadata-setup/write-intent-unknown, public_key null, metadata current_version0 and data404. Current recover rejects before target read.",
+      "consumer_impact": "No verified key or successful public receipt exists; this unknown stage cannot become admitted trust or an inferred absence/retry. Consumers/signers remain fenced pending an independently reviewed phase-appropriate result.",
+      "requested_change": "Address the coordinator requested phase-aware read-only metadata-only reconciliation. Preserve original unknown and require a separate exact reviewed action for any subsequent generation/write; no remint or implicit bootstrap replay.",
+      "evidence": "platform-signer-custody/native-adapter-r1/coordinator-review.json",
+      "evidence_sha256": "sha256:6e5b58d0c1fcb4f8bcb1dccb5b0e97cc99e2ba908f81a8750572e6e6b762162a",
+      "independently_reproduced_by": "coordinator; Secrets read/attributed the retained exact-digest evidence and did not execute custody code"
+    }
+  ],
+  "acceptable_source_interface_facts": [
+    "Canonical public key is unpadded base64url43 encoding of32 raw Ed25519 public bytes; fingerprint explicitly sha256 over those43 ASCII bytes. This is a reproducible representation agreement only, not key/custody admission.",
+    "Receipt/source/admission/policy/image/deployment hashes can bind public facts to exact independently reviewed artifacts when those actual artifacts and authenticated owner return are supplied. A JSON shape, digest, actor/native_custody flag or review string authenticates no owner by itself.",
+    "Docs explicitly define consumer_trust_sha256 as pre-generation verifier/policy/trust baseline, not a claim that the newly generated key is already online. Final independently admitted post-generation trust file requires its own exact bytes/digest, kid and public-key correspondence.",
+    "Declared scope is retained lifecycle pin only: evaluator flex-auth/local, mode standalone, policy secrets-engine.catalog-lane.lifecycle versionv2, artifact sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4. No taskpilot or caller-policy activation follows.",
+    "Public siblings in the document do not become consumer discovery trust; dedicated document-reader ESO scope is not field-level authorization. Secrets needs no KV/Secret/private seed lookup."
+  ],
+  "independent_returns_required_before_any_native_consumer_admission": [
+    "Authenticated Platform/founder public return through a specifically reviewed owner channel/export, binding operation/native admission/executed revision, exact kid/public key/fingerprint, KV version/readback/recovery outcome, target cluster/backend, lifecycle purpose and allowed key sharing. Do not read the private custody directory as an agent intake or use the responder keys endpoint.",
+    "Exact actual post-generation consumer trust file and digest, independently validated against that public return, exact evaluator/mode/package/version/artifact pin and explicit removal/rotation policy. The baseline digest does not attest the new key.",
+    "Independent owner-selected signer runtime image/source and projection plus cluster/pod/tunnel identity and retained enforced caller provenance. A shared key/generic evaluator name does not identify an individual pod or prove current startup loading/ESO version.",
+    "Separate Access/cluster/founder returns for hardened durable log/outbox/storage, exclusive stop/restart/controller fence, read CCR0050 approved/binding-confirmed scope and corrected attended Warden routing. This review supplies none of those dispositions.",
+    "Independent admitted CLI package/prefix/config/caller/Approval delivery and current native captured allow+deny source records verified by existing Access receipt tool with exact installed Secrets helper. Genuine old/new key overlap and removed-key refusal need independently admitted real public keys; never invent a survivor key or restore unsigned/removed trust.",
+    "Each actual privileged CLI handler/backend/effect still needs its own exact scope and readback/cleanup acceptance; signer-only offline verification leaves native effect acceptance0of11sites/10handlers. Task-native Plan/grant/runtime remains separate."
+  ],
+  "native_plan_assessment": "Concrete enough to review targets/kid/CAS0/methods/metadata/fence/receipt directory/forward-only intent, but not executable/admitted: two requested source-lineage/recovery corrections and explicitly missing exact public/owner/native inputs remain. Scope-limited source review cannot be reused as a native admission approval.",
+  "validation": {
+    "both_patch_hashes_verified": true,
+    "all_frozen_manifest_after_source_hashes_verified": true,
+    "custody_or_private_read_tests_run_by_Secrets": false,
+    "coordinator_existing_tests_report": "44passed; implementation review remains coordinator-owned",
+    "own_frozen_native_R3_and_all_runtime_source_unchanged": true,
+    "no_key_read_login_or_live_action": true
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/platform-public-trust-review-r2.json
@ -0,0 +1,73 @@
+{
+  "schema": "secrets-engine.public-trust-source-review.v1",
+  "reviewer_role": "secrets-engine-owner",
+  "review_basis": [
+    "Secrets AGENTS.md",
+    "Secrets INTENT.md Engine/Lifecycle and PEP consumer boundary",
+    "SECRETS-WP-0014-T02 independently anchored responder keys/pin",
+    "SECRETS-WP-0014-T03 native consumer/rotation acceptance"
+  ],
+  "scope": "independent Secrets consumer/public-trust provenance review only; no Platform custody, Access, founder, cluster/GitOps, credential-read or native action approval",
+  "supersedes_source_findings_only": {
+    "review": "decision-native-preparation/platform-public-trust-review-r1.json",
+    "sha256": "sha256:30525ed0ac6b3e44affdac1ab23b80ef8dc7353c559d199db7cb689d1d0bf09d",
+    "preserved_unchanged": true
+  },
+  "reviewed_exact_patches": {
+    "native_preparation_R1": "sha256:a9d4631d3320ac3fa56f5a61965005c546eae241d2004cc1e6385e04668b7f7f",
+    "native_adapter_R2_full": "sha256:c5b8f0d10650f13eb5939874bda1fb457b3dc5835e63e043af9824e43edb9f80",
+    "native_adapter_R2_over_R1": "sha256:81f4c2867d09accc33a22f7537526c0bcf86c4e45803639af0c602b6446c9ab1"
+  },
+  "reviewed_manifest_sha256": "sha256:697a3d23cde5cd96c09c2edfb4187a0a42965d65932543b82bd4ac0ec3f617d9",
+  "disposition": "no_remaining_F01_F02_source_interface_objections",
+  "authority_granted": false,
+  "native_consumer_trust_admitted": false,
+  "may_populate_native_admission_owner_reviews": false,
+  "source_review_does_not_approve_exact_future_admission_digest": true,
+  "finding_dispositions": [
+    {
+      "id": "SECRETS-PUBLIC-TRUST-R1-F01",
+      "status": "addressed_in_exact_R2_source",
+      "evidence": "Plan source_primitive_sha256 now matches actual shared custody module sha256:f169ad12f90d729b647085c3bed2c0d8d005db23a2341b6d3d5f1793bcfd110c. Prior pin explicitly historical; checked_sources joins current plan primitive to independently admitted source_bundle. The external bundle pins executor source without a self-hash cycle. Recovery original_execution separately binds original receipt bindings/writer/CCR; current source checks remain enforced. Image/deployment/policy/trust cannot change through recovery."
+    },
+    {
+      "id": "SECRETS-PUBLIC-TRUST-R1-F02",
+      "status": "addressed_for_consumer_public_provenance_in_exact_R2_source",
+      "evidence": "Recovery accepts exact metadata-setup null-public original and reserves independent recovery intent before target reads. Exact current metadata absence plus data absence yields current-custody-absent; exact configured metadata current_version0 plus data absence yields metadata-only-confirmed. Both have null public key/fingerprint/version, key_custody_verified false, historical_effect unresolved and explicit fresh independently reviewed next-action requirement. Original receipt remains untouched. Denied, misleading, malformed, timeout and unexpected-version cases remain unconfirmed; version1 after no-public metadata phase refuses. Generated but unstored public key is not admitted. Successful seed-cas version1 reconciliation separately verifies private/public/receipt correspondence and remains pending independent public admission. No recovery write/remint path added.",
+      "validation_attribution": "Secrets inspected exact implementation/delta and regression assertions. Platform reports 56 passing tests including actual fork metadata process-loss cases. Coordinator independently tests implementation; Secrets did not execute custody/private-read code."
+    }
+  ],
+  "acceptable_source_interface_facts": [
+    "Canonical public key is unpadded base64url43 encoding of32 raw Ed25519 public bytes; fingerprint explicitly sha256 over those43 ASCII bytes. This is a reproducible representation agreement only, not key/custody admission.",
+    "Receipt/source/admission/policy/image/deployment hashes can bind public facts to exact independently reviewed artifacts when those actual artifacts and authenticated owner return are supplied. A JSON shape, digest, actor/native_custody flag or review string authenticates no owner by itself.",
+    "Docs explicitly define consumer_trust_sha256 as pre-generation verifier/policy/trust baseline, not a claim that the newly generated key is already online. Final independently admitted post-generation trust file requires its own exact bytes/digest, kid and public-key correspondence.",
+    "Declared scope is retained lifecycle pin only: evaluator flex-auth/local, mode standalone, policy secrets-engine.catalog-lane.lifecycle versionv2, artifact sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4. No taskpilot or caller-policy activation follows.",
+    "Public siblings in the document do not become consumer discovery trust; dedicated document-reader ESO scope is not field-level authorization. Secrets needs no KV/Secret/private seed lookup."
+  ],
+  "independent_returns_required_before_any_native_consumer_admission": [
+    "Authenticated Platform/founder public return through a specifically reviewed owner channel/export, binding operation/native admission/executed revision, exact kid/public key/fingerprint, KV version/readback/recovery outcome, target cluster/backend, lifecycle purpose and allowed key sharing. Do not read the private custody directory as an agent intake or use the responder keys endpoint.",
+    "Exact actual post-generation consumer trust file and digest, independently validated against that public return, exact evaluator/mode/package/version/artifact pin and explicit removal/rotation policy. The baseline digest does not attest the new key.",
+    "Independent owner-selected signer runtime image/source and projection plus cluster/pod/tunnel identity and retained enforced caller provenance. A shared key/generic evaluator name does not identify an individual pod or prove current startup loading/ESO version.",
+    "Separate Access/cluster/founder returns for hardened durable log/outbox/storage, exclusive stop/restart/controller fence, read CCR0050 approved/binding-confirmed scope and corrected attended Warden routing. This review supplies none of those dispositions.",
+    "Independent admitted CLI package/prefix/config/caller/Approval delivery and current native captured allow+deny source records verified by existing Access receipt tool with exact installed Secrets helper. Genuine old/new key overlap and removed-key refusal need independently admitted real public keys; never invent a survivor key or restore unsigned/removed trust.",
+    "Each actual privileged CLI handler/backend/effect still needs its own exact scope and readback/cleanup acceptance; signer-only offline verification leaves native effect acceptance0of11sites/10handlers. Task-native Plan/grant/runtime remains separate."
+  ],
+  "native_plan_assessment": "Source targets and public receipt lineage are concrete enough for the scoped consumer interface review after F01/F02 corrections. Native admission remains unapproved: exact public key/kid/custody export, authenticated owner return, final independently admitted consumer trust file, hardened runtime image/storage/outbox/caller provenance, founder/exclusive fences and approved bound CCR remain separate required inputs. The fixed 120-second expiry is unchanged; pre-reviewed exact scheduling is a documented proposal, not demonstrated human timing acceptance. No source review fills native owner_reviews or authorizes key access, generation, installation, grants, writes or effects.",
+  "native_effect_acceptance": {
+    "accepted_authorization_sites": 0,
+    "denominator_authorization_sites": 11,
+    "handlers": 10,
+    "offline_lifecycle_verification_is_separate": true
+  },
+  "validation": {
+    "full_and_delta_patch_hashes_verified": true,
+    "all_full_manifest_after_file_hashes_verified": true,
+    "prior_review_hash_unchanged": true,
+    "source_and_test_assertions_reviewed": true,
+    "platform_reported_validation": "56 passed in 39.87s",
+    "platform_validation_sha256": "sha256:143e784727f3daecbb3162cbbc2ac6363b1b895dd010703b22f8196988672140",
+    "custody_or_private_read_tests_run_by_Secrets": false,
+    "own_frozen_R3_and_runtime_source_unchanged": true,
+    "no_key_read_login_or_live_action": true
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/allow-request.proposed.json
@ -0,0 +1,22 @@
+{
+  "tenant": "tenant:platform",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "apply",
+  "resource": {
+    "id": "catalog:whynot-design-npm-publish",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [],
+      "policy_targets": [],
+      "auth_targets": []
+    }
+  },
+  "context": {
+    "purpose": "native signer receipt only; no Approval consume or backend operation"
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-one.txt
@ -0,0 +1,4 @@
+producer source and fixture hashes match the admitted source snapshot
+Building wheel...
+Successfully built /tmp/secrets-native-cli-4dd004a-one/wheels/secrets_engine-0.1.0-py3-none-any.whl
+{"bundle": "/tmp/secrets-native-cli-4dd004a-one", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-build-two.txt
@ -0,0 +1,4 @@
+producer source and fixture hashes match the admitted source snapshot
+Building wheel...
+Successfully built /tmp/secrets-native-cli-4dd004a-two/wheels/secrets_engine-0.1.0-py3-none-any.whl
+{"bundle": "/tmp/secrets-native-cli-4dd004a-two", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-owner-metadata.diff
@ -0,0 +1,96 @@
+diff --git a/.custodian-brief.md b/.custodian-brief.md
+index 0cb912a..ba794c8 100644
+--- a/.custodian-brief.md
+++ b/.custodian-brief.md
+@@ -2,7 +2,7 @@
+ # Custodian Brief — secrets-engine
+ 
+ **Domain:** infotech  
+-**Last synced:** 2026-10-11 17:52 UTC  
+**Last synced:** 2026-10-16 05:55 UTC  
+ **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+ 
+ ## Active Workstreams
+@@ -11,8 +11,24 @@
+ Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
+ 
+ **Open tasks:**
+- ! Define the exact mediated execution contract  `b2f0d462`
+  *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
+ - ! Implement and prove one native metadata action  `5f8f7c41`
+-- ► Define the exact mediated execution contract  `b2f0d462`
+
+### Constrain PDP transport and authenticate decision responses
+Progress: 1/3 done  |  workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
+
+**Open tasks:**
+- ! Verify the admitted native consumer and rotation path  `85aa4c78`
+  *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
+- ► Implement independently anchored responder authentication  `877782e5`
+
+### Production-safe provisioning, authorization, and lifecycle hardening
+Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+
+**Open tasks:**
+- ! Resume native production lane adoption  `a0a1dd92`
+  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+ 
+ ### Activate native Claude credential delivery for Glas
+ Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
+@@ -26,27 +42,20 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
+ 
+ **Open tasks:**
+ - ! Stage live apply and verification  `fb103f1e`
+-  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
+  *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
+ - ! Reconcile routing ownership and retire interim proxies  `1431edae`
+   *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
+ 
+-### Production-safe provisioning, authorization, and lifecycle hardening
+-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+-
+-**Open tasks:**
+-- ! Resume native production lane adoption  `a0a1dd92`
+-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+-
+ ### Evolve the Lifecycle engine to the accepted security layer model
+ Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+ 
+ **Open tasks:**
+ - ! No standing engine credential  `d7bc8bdc`
+-  *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
+  *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
+ 
+ ## Inbox Hygiene
+ 
+-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
+ **Missing thread_id:** 2 unread message(s) lack supersession chains.
+ 
+ ---
+diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
+index 70e5831..4d1cfb6 100644
+--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
+@@ -22,6 +22,7 @@
+ | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+ | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
+ | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+ | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
+@@ -83,9 +84,12 @@
+ | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/canonical-seven-packaging-tests.txt
@ -0,0 +1,2 @@
+.......                                                                  [100%]
+7 passed in 3.99s
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/deny-request.proposed.json
@ -0,0 +1,22 @@
+{
+  "tenant": "tenant:platform",
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service"
+  },
+  "action": "destroy",
+  "resource": {
+    "id": "catalog:whynot-design-npm-publish",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "attributes": {
+      "stage": "prod",
+      "fields": [],
+      "policy_targets": [],
+      "auth_targets": []
+    }
+  },
+  "context": {
+    "purpose": "native signer receipt only; no Approval consume or backend operation"
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-cli-help.txt
@ -0,0 +1,35 @@
+usage: secrets-engine [-h] [--version]
+                      {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth}
+                      ...
+
+secrets-engine command-line interface.
+
+positional arguments:
+  {catalog,decision,plan,apply,provision,rotate,verify,handoff,wrap,exec,policy,route,revoke,session,lifecycle,state,secret-use,audit,evidence,service-auth}
+    catalog             catalog operations
+    decision            decision operations
+    plan                render a guarded plan (no mutation)
+    apply               apply approved metadata to OpenBao
+    provision           provision a value without printing it
+    rotate              replace a declared KV field without printing it
+    verify              positive/negative verification (no value printed)
+    handoff             write AppRole role_id/secret_id handoff files
+    wrap                write a single-use OpenBao wrap token to a file (never
+                        printed)
+    exec                run a command with the secret injected for the child
+                        only
+    policy              inspect secrets-engine policies
+    route               ops-warden routing pointer for a lane
+    revoke              deactivate native policy/AppRole access (preserves KV
+                        custody)
+    session             issued-session operator commands
+    lifecycle           explicit lane lifecycle operations
+    state               show persistent non-secret lane lifecycle state
+    secret-use          read-only secret-use evidence surface
+    audit               summarize non-secret local lane evidence
+    evidence            load-bearing evidence heartbeat and outbox
+    service-auth        KeyCape service-auth consumer checks
+
+options:
+  -h, --help            show this help message and exit
+  --version             show program's version number and exit
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-output.txt
@ -0,0 +1,9 @@
+{"admission": "artifact integrity only; trust and keys not admitted", "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e", "launcher_sha256": "8f366784b0ff6e1809826afe4c619007234a9f2427e9a0e5afa90c064694923e", "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e", "prefix": "/tmp/secrets-native-cli-4dd004a-installed", "schema": "secrets-engine.cli-install.v1"}
+Using CPython 3.12.3 interpreter at: /home/worsch/secrets-engine/.venv/bin/python
+Creating virtual environment at: /tmp/secrets-native-cli-4dd004a-installed/venv
+Using Python 3.12.3 environment at: /tmp/secrets-native-cli-4dd004a-installed/venv
+Resolved 2 packages in 6ms
+Prepared 2 packages in 21ms
+Installed 2 packages in 7ms
+ + pyyaml==6.0.3
+ + secrets-engine==0.1.0 (from file:///tmp/secrets-native-cli-4dd004a-one/wheels/secrets_engine-0.1.0-py3-none-any.whl)
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/disposable-install-receipt.json
@ -0,0 +1,8 @@
+{
+  "admission": "artifact integrity only; trust and keys not admitted",
+  "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
+  "launcher_sha256": "8f366784b0ff6e1809826afe4c619007234a9f2427e9a0e5afa90c064694923e",
+  "manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+  "prefix": "/tmp/secrets-native-cli-4dd004a-installed",
+  "schema": "secrets-engine.cli-install.v1"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/installed-empty-trust-refusal.txt
@ -0,0 +1 @@
+empty unadmitted trust refuses before caller read/network
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/local-entrypoint-observation.json
@ -0,0 +1,39 @@
+{
+  "source_observed": "5a2099f400fb0c97fed2d991832c0e31513bbdfb",
+  "PATH_cli": null,
+  "editable_cli": {
+    "path": "/home/worsch/secrets-engine/.venv/bin/secrets-engine",
+    "exists": true,
+    "admitted_bundle_entrypoint": false
+  },
+  "global_cli_exists": false,
+  "relevant_env_presence_only": {
+    "SECRETS_ENGINE_PDP_URL": false,
+    "SECRETS_ENGINE_PDP_TOKEN_FILE": false,
+    "SECRETS_ENGINE_PDP_TRUST_FILE": false,
+    "SECRETS_ENGINE_PDP_VERIFIER": false,
+    "SECRETS_ENGINE_APPROVAL_URL": false,
+    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": false,
+    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": false,
+    "SECRETS_ENGINE_PEP_STANCE": false,
+    "SECRETS_ENGINE_CATALOG": false,
+    "SECRETS_ENGINE_POLICIES": false,
+    "SECRETS_ENGINE_EVIDENCE": false,
+    "SECRETS_ENGINE_CLOCK_TRUST_FILE": false
+  },
+  "no_private_config_credential_file_or_process_environment_read": true,
+  "declared_config_defaults_source_sha256": "228f548822620d538ad0c025eb68d88091be542819ed571be06c9e69c5e912c6",
+  "source_PATH_invocations": [
+    "scripts/demo-e2e.sh",
+    "scripts/npm-publish-demo.sh"
+  ],
+  "source_preflight_fallback": "scripts/whynot-real-publish-preflight.sh activates .venv/PATH, otherwise python -m secrets_engine.cli; not admitted release invocation",
+  "canonical_followup": {
+    "source": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+    "PATH_cli": null,
+    "global_cli_exists": false,
+    "disposable_prefix_only": "/tmp/secrets-native-cli-4dd004a-installed",
+    "native_installed_prefix_selected": false,
+    "no_private_config_or_credential_read": true
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-admission-proposal-r2.json
@ -0,0 +1,127 @@
+{
+  "proposal_id": "SECRETS-WP-0014-native-cli-20261016-r2",
+  "status": "preparation; no installation, key/trust admission, credential read, live capture or protected effect authorized",
+  "work_records": [
+    "SECRETS-WP-0014-T02",
+    "SECRETS-WP-0014-T03"
+  ],
+  "canonical_source_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "canonical_bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+  "initial_scope": {
+    "producer": "retained flex-auth/flex-auth-secrets-engine lifecycle pin only",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_version": "v2",
+    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
+    "evaluator": "flex-auth/local",
+    "mode": "standalone",
+    "consumer": "exact reviewed PREFIX/bin/secrets-engine and fixed bundled helper",
+    "source_serving_sites": 11,
+    "source_handlers": 10,
+    "native_protected_effects_accepted": 0,
+    "offline_lifecycle_signer_receipt_verification_is_not_privileged_handler_acceptance": true,
+    "task_policy_or_native_task_enablement": false
+  },
+  "independent_public_trust": {
+    "kid": null,
+    "canonical_public_key_base64url43": null,
+    "public_fingerprint": null,
+    "fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); exact owner public receipt required",
+    "owner_custody_receipt": null,
+    "scope_and_key_sharing_receipt": null,
+    "signed_candidate_oci_digest": null,
+    "native_durable_log_outbox_receipt": null,
+    "source": "Access owner confirms no native key/kid/public fingerprint/custody admitted; Platform signer lane proposed only",
+    "prohibited_substitutes": [
+      "fixture seed/key",
+      "same-responder keys endpoint",
+      "image metadata without independent public custody receipt",
+      "arbitrary additional trusted key"
+    ]
+  },
+  "placement_owner_inputs": {
+    "runtime_uid": null,
+    "fresh_release_prefix": null,
+    "admitted_cli_absolute_path": null,
+    "config_parent": null,
+    "trust_file_absolute": null,
+    "catalog_directory_absolute": null,
+    "policy_directory_absolute": null,
+    "stance_file_absolute": null,
+    "evidence_directory_absolute": null,
+    "evidence_outbox_cadence_owner": null,
+    "bounded_PDP_caller_delivery_path": null,
+    "owner_bound_literal_loopback_PDP_origin": null,
+    "approval_endpoint_and_separate_credential_delivery": null,
+    "clock_basis_and_optional_clock_dependency_admission": null,
+    "backend_entitlement_for_each_actual_handler": null
+  },
+  "delivery_contract": {
+    "install": "existing bundle install.py only, fresh prefix and independently retained manifest digest; no overwrite/global uv tool/symlink/second wrapper",
+    "invocation": "exact absolute PREFIX/bin/secrets-engine; internal venv console entrypoint, editable checkout, ambient PATH demo and python -m fallbacks are not admitted effect entrypoints",
+    "helper": "PREFIX/libexec/secrets-engine-pdp-verify, fixed by wrapper and digest-checked before import; no runtime compilation/ambient helper override",
+    "config": "existing environment variables only, delivered by owner-selected invocation context; explicit absolute metadata/trust/evidence paths, no working-directory defaults",
+    "credentials": "existing scoped file/provider delivery outside release/Git; no credential bytes in config proposal; never configure both Approval token and client-secret providers",
+    "evidence": "SECRETS_ENGINE_EVIDENCE plus its outbox child, owner-private parent and exact replay/cadence owner; source evidence is not audit custody",
+    "stance": "published prod fail_closed unchanged; unsafe-demo unset; no service-jwt/backend readiness bypass",
+    "clock": "base release excludes optional clock extras; no clock-trust selection implies independent trusted-time acceptance"
+  },
+  "offline_native_receipt_verifier": {
+    "owner": "Access",
+    "canonical_source_observed": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "path": "tools/verify_native_signer_receipt.py",
+    "uses": "installed Secrets authenticate_response/load_trust/validate_decision_envelope; no second crypto implementation",
+    "admission_file_schema": "access-engine.signer-receipt-check.v1",
+    "inputs": "exact captured native allow/deny requests, original signed envelopes and corresponding durable source records, admitted trust and independently pinned installed helper",
+    "not_authority_for": "Approval consume, OpenBao effect or native task",
+    "source_sha256": "33d3c50aba51b85cf85d2e234268e903004894299efc9b3745e0980c55578280"
+  },
+  "next_gates": [
+    "completed source preparation: published4dd004a, two exact clean-source builds, disposable installation/help/empty-native-trust refusal; no native prefix admitted",
+    "independent package/prefix/config admission with exact source/manifest/artifact hashes",
+    "Access/Platform independent real public signer/kid/fingerprint/custody and candidate immutable image/log/storage returns",
+    "owner-approved bounded literal-loopback transport/caller delivery and exact proposed capture vectors",
+    "capture native allow/deny records, verify offline with existing Access tool and installed helper, then forgery/downgrade/key-removal/outage cases",
+    "separate exact handler/backend/Approval/effect acceptance before changing0of11"
+  ],
+  "remaining_task_work_records": [
+    "SECRETS-WP-0013-T01",
+    "SECRETS-WP-0013-T03",
+    "SECRETS-WP-0008-T06"
+  ],
+  "proposed_workstation_placement_for_owner_review": {
+    "status": "concrete proposal only; no path selected/admitted/created",
+    "runtime_uid_candidate": 1000,
+    "release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
+    "entrypoint": "<exact-release-prefix>/bin/secrets-engine",
+    "config_parent": "/home/worsch/.config/secrets-engine/native-lifecycle/<owner-reviewed-config-revision>",
+    "trust_file": "<exact-config-parent>/pdp-trust.json",
+    "catalog_directory": "<exact-config-parent>/catalog",
+    "policy_directory": "<exact-config-parent>/policies",
+    "stance_file": "<exact-config-parent>/pep-stance.yaml",
+    "evidence_directory": "/home/worsch/.local/state/secrets-engine/native-lifecycle/evidence",
+    "temporary_caller_file_candidate": "/run/user/1000/secrets-engine/native-lifecycle/pdp-caller.token",
+    "constraints": [
+      "no writes performed or native UID/host selection inferred",
+      "owner must select exact config revision and metadata hashes/Approval provider before any install",
+      "fresh release prefix only; no replacement/global PATH alias/editable checkout",
+      "config/evidence/credential parents owner-private; trust regular nonsymlink/non-group/world-writable",
+      "credentials remain separate reviewed scoped delivery; template file names are not routing/admission",
+      "existing same-UID controls do not establish credential isolation or agent autopilot"
+    ],
+    "pdp_origin_candidate": "http://127.0.0.1:18081; only after owner verifies free port and exact admitted namedpod/cluster; not a created tunnel"
+  },
+  "caller_public_source_provenance": {
+    "Secrets_source": "docs/pdp-access-path.md; historical transport procedure and current admission gate",
+    "Access_source": "docs/operator-caller-access-path.md; final2026-09-06 live execution update supersedes earlier warn/missing-SA observations",
+    "historical_serving_receipt": "SECRETS-WP-0008 dated2026-09-07 real Check decision:0f9c98f14545c42d",
+    "issuer": "Kubernetes TokenRequest/TokenReview, not OpenBao or signer private-key custody",
+    "identity": "system:serviceaccount:secrets-engine:secrets-engine",
+    "audience": "flex-auth",
+    "documented_session_duration": "10m; any concrete new capture needs exact owner-approved bounded lifetime",
+    "documented_delivery": "per-session owner-private regular file outsideGit, mode0600; shred/end only own transport at session close",
+    "current_admitted_file_path": null,
+    "local_cli_is_not_automatically_that_ServiceAccount": true,
+    "operator_TokenRequest_authority_or_pod_workload_identity_not_inferred": true
+  },
+  "canonical_fixed_helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-cli-admission-docs-r2.patch
@ -0,0 +1,177 @@
+diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md
+index 3729cf6..08a7e74 100644
+--- a/docs/proposals/native-cli-admission/README.md
+++ b/docs/proposals/native-cli-admission/README.md
+@@ -1,5 +1,52 @@
+ # Native CLI signer and consumer admission preparation
+ 
+## Current release preparation — 2026-10-16 R2
+
+Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was
+built twice from an isolated clean checkout. Artifacts and deterministic bundle
+manifest match exactly: manifest SHA256
+`105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`,
+fixed helper SHA256
+`ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`.
+Disposable installation/help and empty native trust refusal pass; no native
+prefix, trust/key, caller credential, protected effect or rollout was admitted.
+Artifact integrity is not independent package admission. Full receipts and a
+concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`.
+
+Initial native scope remains the existing lifecycle pin and **0/11 protected
+sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence
+and scoped caller/Approval delivery paths remain owner-unselected. A concrete
+workstation candidate uses a new release prefix ending
+`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path.
+Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint.
+The current repo editable invocation and ambient demo/preflight fallbacks do not
+constitute release admission. A local CLI does not automatically hold the named
+ServiceAccount identity: existing docs describe separately authorized per-session
+TokenRequest delivery, not a standing credential or pod identity grant.
+
+Access's single offline signer-receipt tool is published at
+`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this
+consumer. Native producer rollout still awaits independent public kid/key/custody
+and immutable candidate image/log/storage returns, including the Access owner's
+separate durable-log hardening review. Published source alone is not that image.
+The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin.
+
+Source task correspondence is now implemented and cross-owner source-server
+proved: fixed typed service mapping before issue, retained-registry signed-DENY
+preapproval, original claim/context preservation, independent fresh source facts,
+precise Approval CAS and independent confirmation/journal/native disposable proof.
+This supersedes the historical source gaps below; it neither adds an execute-ccr
+CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime.
+All native effect, caller/key/config and task-entitlement gates remain open under
+existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work.
+
+## Historical ff1a13d preparation (preserved)
+
+The following draft records the earlier source/admission observations. References
+to absent B2/B3/request/source-fact implementation are superseded by R2 above;
+missing native keys, runtime placement and actual task inputs remain unresolved.
+
+
+ This proposal covers the existing lifecycle CLI authentication path under
+ SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
+ consume, OpenBao effect or task-policy activation. All native acceptance counts
+diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json
+index d5c50c2..d953ada 100644
+--- a/docs/proposals/native-cli-admission/proposal.json
+++ b/docs/proposals/native-cli-admission/proposal.json
+@@ -1,7 +1,7 @@
+ {
+   "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
+   "status": "preparation only; not installable or executable authorization",
+-  "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+   "workplans": [
+     "SECRETS-WP-0014-T02",
+     "SECRETS-WP-0014-T03",
+@@ -33,8 +33,10 @@
+     "custody_receipt": null,
+     "candidate_producer_oci_digest": null,
+     "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
+-    "receipt_verifier_integrated_revision": null,
+-    "signer_purpose_pin_and_sharing_receipt": null
+    "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "signer_purpose_pin_and_sharing_receipt": null,
+    "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
+    "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
+   },
+   "placement": {
+     "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
+@@ -52,7 +54,9 @@
+       "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
+       "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
+       "owner retains manifest/admission/installation receipts and same-UID control boundary"
+-    ]
+    ],
+    "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
+    "candidate_status": "proposal only; no path selected/created/admitted"
+   },
+   "configuration_contract": {
+     "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
+@@ -81,27 +85,20 @@
+   },
+   "task_mapping_gap": {
+     "existing_cli_execute_ccr_command": false,
+-    "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution",
+    "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
+     "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
+     "unadmitted_inputs": [
+-      "real service caller-to-subject server mapping and request/service binding join",
+-      "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged",
+      "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
+       "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
+       "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
+       "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
+       "load-bearing audit/outbox cadence and durable receipt correlation",
+-      "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged"
+      "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
+     ],
+     "approval_fact_interface_review": {
+-      "status": "review preference only; no implementation/admission",
+-      "preserve": "strict binding.context equality and original submitted/approval-free/native joins",
+-      "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence",
+-      "required_review": [
+-        "Approval fact/freshness semantic correspondence",
+-        "Access source receipt/provenance binding and exact request digests"
+-      ],
+-      "b1": "signed-DENY caller join only; no context replacement",
+-      "b2_b3": "not enabled or implemented here"
+      "status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
+      "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
+      "receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
+     },
+     "approval_fact_contract": {
+       "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
+@@ -110,7 +107,8 @@
+       "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+       "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
+       "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
+-    }
+    },
+    "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
+   },
+   "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
+   "denominator": {
+@@ -129,5 +127,15 @@
+     "platform_source_mediator_native_acceptance": false,
+     "generic_cli_consume_is_strict_task_handoff": false,
+     "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  },
+  "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "release_candidate": {
+    "bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+    "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
+    "two_clean_builds_equal": true,
+    "disposable_install_passed": true,
+    "native_install_admitted": false,
+    "artifact_integrity_is_not_package_admission": true,
+    "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
+   }
+ }
+diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+index f65ac96..08e3e01 100644
+--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+@@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts.
+ Actual provider proof preparation is separately waiting on frozen Access source
+ and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+ actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
+
+2026-10-16 canonical native CLI release preparation: published4dd004a was built
+twice offline from a clean isolated checkout, with identical artifacts/manifest
+105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e.
+Disposable installation uses its fixed helper and empty native trust refuses
+before caller access. Exact invocation/config/delivery candidates, public signer
+provenance requirements, native lifecycle allow/deny capture, rotation/removal and
+isolated-transport outage probes are reviewable in Custodian
+`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed
+producer/log/storage, native UID/prefix/config/caller/Approval delivery and each
+actual handler/backend entitlement remain missing. No seed/token read, mint,
+production installation/trust/policy change or effect occurred. Native effect
+coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
+WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
+source APIs do not substitute for the separately reviewed hardened native image.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/native-probe-plan.md
@ -0,0 +1,98 @@
+# Existing CLI/native signer admission plan
+
+This prepares SECRETS-WP-0014-T02/T03. Nothing below runs against the estate here.
+Protected-effect acceptance remains **0/11 authorization sites across10 handlers**.
+The separately proved task API is not an existing execute-ccr CLI command and does
+not admit any of these lifecycle effects. Each privileged handler still needs its
+exact metadata lane, Approval consume contract, backend entitlement and evidence.
+
+The current authoritative development invocation is the repository editable
+`.venv/bin/secrets-engine`; this shell has no PATH/global installed Secrets CLI.
+Demo scripts invoke ambient PATH; the publish preflight activates `.venv` or falls
+back to `python -m`. They are not admitted release invocations. The proposed native
+entrypoint is exactly the new owner-selected release's `bin/secrets-engine`.
+Its existing wrapper pins `libexec/secrets-engine-pdp-verify` before import and
+ignores ambient helper selection. The internal venv script is not a second effect
+entrypoint. No new launcher, service, credential broker or retired rapp is added.
+
+## Admission inputs before execution
+
+`native-admission-proposal-r2.json` separates known configuration from missing
+owner inputs and supplies concrete workstation placement candidates for review.
+No proposed path is created/selected/admitted. The owner must bind runtime UID,
+fresh prefix, source+bundle manifest, metadata/catalog/policy/stance hashes,
+config revision, evidence/outbox cadence and exact scoped credential delivery.
+Existing Config environment variables remain the interface; no config framework
+is introduced. Installed-package cwd defaults are inadequate native placement.
+Neither this source package nor artifact SHA integrity independently admits a
+package, signer, config or prefix. Base bundles omit optional clock dependencies;
+any required clock source/extras need an exact separate owner return.
+
+Access must return the actual immutable signed image, retained lifecycle pin,
+owner-bound pod/cluster/tunnel, durable decision record/log/outbox custody, and
+independent public signer receipt. Platform's draft seed mount/public fingerprint
+proposal is not custody/key admission. No private key/seed is read. Public kid/key/
+fingerprint and exact key purpose/sharing remain missing. Synthetic fixture trust,
+responder-discovered keys and new arbitrary trusted keys cannot fill these fields.
+
+## Concrete capture and verification sequence
+
+1. After independently admitted package/config/signer rollout, retain original
+   native request bytes, signed HTTP response bytes and corresponding durable
+   producer record for each proposed vector. `allow-request.proposed.json` uses
+   lifecycle `apply`; `deny-request.proposed.json` uses `destroy` without a claim.
+   The retained v2 policy allows well-formed non-dual-control apply and denies
+   destroy without Approval. The public catalog reference is a proposal requiring
+   exact owner assent, not a selected real effect lane. These are PDP-only capture
+   requests: no Approval consume, OpenBao call, token mint or metadata mutation.
+   The exact enforced consumer principal is
+   `system:serviceaccount:secrets-engine:secrets-engine`, audience `flex-auth`.
+2. Access owns the single existing offline verifier
+   `tools/verify_native_signer_receipt.py` (published canonical source2b064eee510640224274ccdc7cefceb1ae13162e).
+   Run it with the reviewed bundle Python environment and its existing
+   `access-engine.signer-receipt-check.v1` admission file: absolute captured
+   allow/deny request/envelope/record paths, admitted public trust, exact fixed
+   installed-helper path+SHA, and expected caller. No token/network input is used
+   by this verifier. This establishes native signer/record/client verification,
+   not generic CLI CAS correctness or any protected-effect handler acceptance.
+3. Retain the verifier's exact current allow+deny result, input/source/artifact
+   hashes and checked lifetime/caller deadline. Native record/response mismatch,
+   altered payload/signature, unsigned mode, wrong issuer/pin, unknown kid and
+   expired allow must refuse. Negative mutations are marked derived cases, not
+   presented as genuine native producer records. Never turn a failed request into
+   an allow by replacing original context, identity, digest or clock.
+4. Rotation requires independently admitted old/new public keys and exact bounded
+   overlap/producer candidate receipts. Accept genuine native records under both
+   during admitted overlap, then remove old kid and reject an original old-signed
+   record with a valid surviving admitted key set. With only one admitted key,
+   removing it yields invalid empty trust and config refusal; that is fail-closed
+   evidence, not a cryptographic multi-key rotation proof. Do not invent a second
+   key to make the test run. Never restore a removed key/unsigned producer or relax
+   a pin as rollback. Retain the signed admitted producer/overlap or stop.
+5. Outage probe requires the owner's exact separately controlled consumer tunnel
+   PID/origin/target and restart recipe. Interrupt only that dedicated transport,
+   never scale a shared deployment, interrupt a shared tunnel or alter backend
+   policy. Exercise the installed shared `check_decision` against the same exact
+   request and owner-delivered caller file; expect transport DecisionError, zero
+   CAS/backend calls and no fabricated decision. Missing/tampered helper and absent
+   trust separately refuse before credential access. A closed arbitrary local
+   port is a disposable transport test, not evidence of a native producer outage.
+   The installed library diagnostic is not another privileged CLI entrypoint.
+6. Privileged handler tests follow only under a separate exact owner action and
+   backend entitlement. `service-jwt` currently refuses protected CLI before
+   PIP/PDP/CAS because CCR38 is identity-only. Do not switch to bootstrap/env or
+   unsafe-demo to get past that boundary. Such readiness refusal proves no effect,
+   not reachability of the signed authorization site. For each selected actual
+   handler, retain exact request/claim/consume/effect/readback/cleanup evidence;
+   leave remaining sites unaccepted. Generic CLI consume remains distinct from
+   strict task handoff+independent confirmation/journal. Session revoke, route
+   readiness and identity probes remain visible exclusions.
+
+## Gates and rollback
+
+Missing current native inputs block this sequence before installation/capture.
+Record them under existing WP14-T02/T03, with task-native/entitlement gates still
+in WP13-T01/T03 and WP8-T06. Keep artifact build time separate from deterministic
+manifest fields. No production native counts change from source or disposable
+proofs. An unavailable or unsigned producer remains refusal/outage, never a reason
+to bypass verification or retry a potentially consumed operation.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/observed-build-receipt.json
@ -0,0 +1,5 @@
+{
+  "receipt_recorded_at_utc": "2026-10-16 15:37:49 UTC",
+  "note": "observed receipt timestamp kept separately; deterministic bundle manifest has only commit-derived SOURCE_DATE_EPOCH",
+  "no_production_install_or_trust_admission": true
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/pep-denominator.json
@ -0,0 +1,87 @@
+{
+  "source_observed": "5a2099f400fb0c97fed2d991832c0e31513bbdfb",
+  "cli_sha256": "b7f74330732fd991f080adb6d1c4ef576c81884809103812612652cafe3ee4d0",
+  "shared_production_check_client": "secrets_engine.decision_check.check_decision via approval_consume.authorize_action",
+  "serving_authorization_sites": 11,
+  "handlers": 10,
+  "native_effect_acceptance": 0,
+  "sites": [
+    {
+      "handler": "cmd_apply",
+      "line": 312,
+      "action_expression": "'apply'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_provision",
+      "line": 339,
+      "action_expression": "'provision'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_rotate",
+      "line": 377,
+      "action_expression": "'rotate'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_verify",
+      "line": 420,
+      "action_expression": "'verify'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_handoff",
+      "line": 494,
+      "action_expression": "'handoff'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_wrap",
+      "line": 534,
+      "action_expression": "'wrap'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_exec",
+      "line": 587,
+      "action_expression": "'exec'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_exec",
+      "line": 610,
+      "action_expression": "'exec'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_revoke",
+      "line": 741,
+      "action_expression": "'deactivate'",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "_cmd_lifecycle_state",
+      "line": 778,
+      "action_expression": "args.operation",
+      "native_effect_accepted": false
+    },
+    {
+      "handler": "cmd_lifecycle",
+      "line": 846,
+      "action_expression": "args.operation",
+      "native_effect_accepted": false
+    }
+  ],
+  "not_denominator": [
+    "catalog row count",
+    "12 lifecycle policy action values",
+    "strict task execution API/source fixture",
+    "session revoke",
+    "service-auth identity probe",
+    "route metadata readiness",
+    "dry-run/report commands"
+  ],
+  "canonical_followup_source": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "canonical_cli_byte_identical_to_observed": true
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/README.md
@ -0,0 +1,158 @@
+# Native CLI signer and consumer admission preparation
+
+This proposal covers the existing lifecycle CLI authentication path under
+SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
+consume, OpenBao effect or task-policy activation. All native acceptance counts
+below are zero. Exact missing owner inputs are in `proposal.json`.
+
+## Current consumer and initial scope
+
+At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI
+entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing
+`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv
+managed Secrets tool. Presence-only inspection of this session found none of the
+PDP/trust/approval/policy/configuration variables set. This says nothing about
+other sessions, private owner configuration or a remote installation. No credential
+file, private configuration or process environment was inspected.
+
+Use a separately reviewed immutable wheel-plus-verifier bundle for proposed
+adoption. The canonical source for the candidate build is **ff1a13d**, containing
+both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are
+intermediate source evidence. Custodian `decision-native-preparation/` retains the
+exact canonical bundle manifest and hashes. Nothing was installed by this step.
+
+Initial stage is signer-only existing lifecycle-pin admission plus offline
+verification of captured native signed allow and deny records. Capturing those
+records later needs its own admitted caller and exact source operation; this
+proposal does not grant that capture. Use Access's one receipt verifier,
+`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather
+than creating another consumer verifier or canonicalization implementation.
+That tool is separate Access source preparation; its exact integrated revision
+and reviewed admission file remain owner inputs, not part of this CLI install.
+
+The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2,
+`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`,
+evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the
+live image's source or policy. Access's live metadata records the current pin has
+no signer arguments/mounts; no production kid/public key/fingerprint/custody
+receipt or candidate signed-runtime OCI digest is admitted. The proposed signer
+custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or
+from the same responder's keys endpoint. The independent receipt must bind signer
+purpose/custody to this exact consumer pin and declare any sharing. A shared key
+plus the generic evaluator name cannot prove an individual pod's identity; the
+owner-bound tunnel and rollout identity still require separate verification.
+
+`lifecycle-trust.template.json` uses the existing runtime trust schema and the
+producer-owned source pin, but deliberately has an empty key map. It **must
+refuse** before caller credential access. It is not a deployable trust file. A
+future owner-admitted copy must contain the independently authenticated actual
+kid/key and exact pin, with its public-key fingerprint/custody provenance retained
+outside this unadmitted template. The task-policy coordinate is not admitted here.
+
+## Exact PEP denominator
+
+The initial shared authentication implementation is one Check client reached
+through `authorize_action` and `_require_lane_approval`. Native protected-effect
+coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one
+PEP per catalog row. The current lifecycle policy's action vocabulary has twelve
+values; that is a separate count from handler/call-site coverage.
+
+| CLI path | Handler / delegated authorization site | PDP action |
+| --- | --- | --- |
+| apply, live only | `cmd_apply` | apply |
+| provision | `cmd_provision` | provision |
+| rotate, live only | `cmd_rotate` | rotate |
+| verify | `cmd_verify` | verify |
+| handoff | `cmd_handoff` | handoff |
+| wrap | `cmd_wrap` | wrap |
+| exec primary | `cmd_exec`, primary gate | exec |
+| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site |
+| revoke, live only | `cmd_revoke` | deactivate |
+| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation |
+| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation |
+
+`session revoke` is a separate stance/readiness-controlled backend path without
+this served Check/CAS chain; it is excluded from this signer acceptance and still
+refuses production under its stance. `service-auth probe-openbao` is an explicit
+identity/login-self probe, not protected task adoption. `route` performs existing
+backend readiness metadata probes through its ambient backend resolver; it is not
+closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands
+are not protected-effect proof. These exclusions must remain visible in any claim
+about the whole repository's PEP coverage.
+
+The existing CLI handlers still use the generic `require_production_consume`
+response contract. Strict R2 task consumption is a separate owner API, not a
+retrofit of all eleven CLI sites. Native effect acceptance must review the actual
+selected handler/consume contract and caller scope rather than borrow the task
+fixture proof.
+
+No production effect is authorized merely because a handler shares the signed
+client. In particular, configured `service-jwt` still refuses protected CLI work
+before approval/CAS/backend because CCR38 is identity-only. Do not select
+bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance.
+
+## Owner-controlled placement and minimum configuration
+
+The deploying owner must select the runtime UID, fresh release prefix, configuration
+parent and exact runtime paths; none is agreed by this proposal. The future
+admitted executable is `<prefix>/bin/secrets-engine`, whose wrapper fixes the
+bundle helper and checks its digest before CLI import. The helper's source/binary
+hash is artifact integrity, not independent package or key admission. Do not use
+the editable checkout, a rolling alias, a synthetic test prefix or an internal
+venv entrypoint as if it were that admission.
+
+Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`,
+trust and evidence/outbox locations are needed. Installed-package defaults fall
+back to working-directory metadata and are not an admitted native configuration.
+The total existing stance remains prod fail_closed. Config needs the exact
+producer policy/version, service subject, loopback owner-bound PDP tunnel and
+separately admitted bounded audience `flex-auth` caller-file lifetime. Approval
+endpoint and its existing separately scoped credential delivery must be admitted
+independently. Both approval credential providers may not be configured together.
+The bundle helper is not selected by an ambient override. Runtime credentials and
+keys are not placed in this proposal or release bundle.
+
+Acceptance order is: admit exact package/source/install/config; obtain independent
+signer/key/pin custody return and exact signed producer rollout candidate; under
+that separately reviewed rollout capture bounded native records; run Access's
+single offline receipt verifier against the fixed installed helper and admitted
+trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact
+old/new-key overlap then removed-key refusal. Also close the producer's missing
+native durable log/outbox/audit path under its owner. No install or rollout is
+performed here, and shared-source tests do not fill native effect coverage.
+
+Rollback retains the reviewed signed producer and admitted overlap or stops the
+consumer. Rolling back to an unsigned image is an outage, not permission to turn
+off verification. Removing keys, changing policy pins or restoring removed keys
+needs exact owner review; no discovery/cached-key fallback or blind consume retry.
+
+## Separate task-execution gap
+
+Strict `task_execution_handoff` exists and Platform's independently confirmed
+journal/native fixture path has actual source-server proof. Neither creates an
+existing `execute-ccr` CLI command: the current parser has none. Proposed task
+caller mapping/request join, policy admission, production source/Plan/grant and
+installation/journal/cleanup placement remain separate owner decisions. Both
+Access task-policy runtime false gates remain unchanged; lifecycle apply is not
+a substitute for execute-ccr. Platform has selected no fresh approved real
+CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets
+catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native
+inputs. Actual before/after bytes for the exact metadata targets and independent
+readback/cleanup receipts must come from Platform's eventual owner-selected plan.
+
+For future server-owned Approval facts, strict R2 deliberately requires the
+returned binding context to equal the originally submitted context. B1 caller
+join remains signed-DENY and must preserve that context. Replacing the carried
+claim with a freshly observed blob would refuse because its freshness fields
+change; no generic equality relaxation is proposed. Access's current review
+preference is to validate fresh authoritative facts out of band while retaining
+the submitted context, with reviewed producer-owned signed source/receipt evidence.
+Exact stable fact/freshness and provenance correspondence requires Approval and
+Access review before B2/B3; no new fields or behavior are implemented here.
+
+The Approval owner's pending `approval-fact-contract/consumer-contract.md` and
+`golden-vectors.json` in the Custodian target evidence name this correspondence.
+They require both original/fresh windows and exact nonfreshness authority facts.
+Their Python native numeric canonical vectors still need producer conformance;
+no silent digest translation or new target numeric restriction is admitted.
+The proposal pins those owner artifacts for review, not as B2 implementation.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/docs/proposals/native-cli-admission/proposal.json
@ -0,0 +1,133 @@
+{
+  "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
+  "status": "preparation only; not installable or executable authorization",
+  "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "workplans": [
+    "SECRETS-WP-0014-T02",
+    "SECRETS-WP-0014-T03",
+    "SECRETS-WP-0013-T01",
+    "SECRETS-WP-0013-T03"
+  ],
+  "initial_scope": {
+    "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin",
+    "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only",
+    "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects",
+    "native_effects_admitted": 0,
+    "task_execution_enabled": false
+  },
+  "owner_returns": {
+    "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json",
+    "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs."
+  },
+  "producer_pin": {
+    "evaluator": "flex-auth/local",
+    "mode": "standalone",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_version": "v2",
+    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
+  },
+  "independent_admission": {
+    "production_kid": null,
+    "public_key": null,
+    "public_key_sha256": null,
+    "custody_receipt": null,
+    "candidate_producer_oci_digest": null,
+    "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
+    "receipt_verifier_integrated_revision": null,
+    "signer_purpose_pin_and_sharing_receipt": null
+  },
+  "placement": {
+    "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
+    "cli_release_prefix": null,
+    "cli_entrypoint": "<admitted-prefix>/bin/secrets-engine",
+    "fixed_verifier": "<admitted-prefix>/libexec/secrets-engine-pdp-verify",
+    "config_parent": null,
+    "trust_file": null,
+    "catalog_directory": null,
+    "policy_directory": null,
+    "pep_stance_file": null,
+    "evidence_directory": null,
+    "constraints": [
+      "new owner-controlled immutable release prefix; no overwrite or rolling source alias",
+      "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
+      "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
+      "owner retains manifest/admission/installation receipts and same-UID control boundary"
+    ]
+  },
+  "configuration_contract": {
+    "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
+    "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here",
+    "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses",
+    "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2",
+    "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session",
+    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here",
+    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers",
+    "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected",
+    "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory",
+    "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed",
+    "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery",
+    "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception",
+    "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround"
+  },
+  "rotation": {
+    "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin",
+    "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys",
+    "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal",
+    "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation"
+  },
+  "task_mapping_gap": {
+    "existing_cli_execute_ccr_command": false,
+    "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution",
+    "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
+    "unadmitted_inputs": [
+      "real service caller-to-subject server mapping and request/service binding join",
+      "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged",
+      "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
+      "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
+      "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
+      "load-bearing audit/outbox cadence and durable receipt correlation",
+      "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged"
+    ],
+    "approval_fact_interface_review": {
+      "status": "review preference only; no implementation/admission",
+      "preserve": "strict binding.context equality and original submitted/approval-free/native joins",
+      "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence",
+      "required_review": [
+        "Approval fact/freshness semantic correspondence",
+        "Access source receipt/provenance binding and exact request digests"
+      ],
+      "b1": "signed-DENY caller join only; no context replacement",
+      "b2_b3": "not enabled or implemented here"
+    },
+    "approval_fact_contract": {
+      "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
+      "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+      "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
+      "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+      "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
+      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
+    }
+  },
+  "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
+  "denominator": {
+    "shared_check_implementation": 1,
+    "serving_cli_call_sites": 11,
+    "serving_cli_handlers": 10,
+    "lifecycle_pdp_action_values": 12,
+    "native_effect_call_sites_accepted": 0,
+    "excluded": [
+      "session revoke stance-only backend path",
+      "service-auth explicit identity probes",
+      "route ambient-backend readiness probes",
+      "dry-run/non-effect reporting"
+    ],
+    "task_cli_command_count": 0,
+    "platform_source_mediator_native_acceptance": false,
+    "generic_cli_consume_is_strict_task_handoff": false,
+    "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r2/preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
@ -0,0 +1,177 @@
+---
+id: SECRETS-WP-0014
+type: workplan
+title: "Constrain PDP transport and authenticate decision responses"
+domain: infotech
+repo: secrets-engine
+status: active
+owner: codex
+topic_slug: secrets-engine
+created: "2026-10-12"
+updated: "2026-10-16"
+flavor: implementation
+depends_on: []
+state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736"
+---
+
+Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and
+FLEX-WP-0024 producer signature surface; does not create another PDP or grant
+any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped
+protected execution. Transport review is complete; key admission and native
+rollout remain separate gates below.
+
+## Prevent the Check credential from leaving the admitted local transport
+
+```task
+id: SECRETS-WP-0014-T01
+status: done
+priority: high
+state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173"
+```
+
+Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL
+handling, oversized-body truncation and invalid UTF-8 against the prior source.
+The bounded fix disables redirects and ambient proxies/global openers, requires
+a literal loopback bare origin before credential access, caps the complete
+response body and rejects invalid UTF-8 as a DecisionError. The approval consumer
+no longer overrides this safe default with urlopen. Synthetic local-server tests
+cover both entry points, all five redirect status codes and proxy forwarding.
+No real credentials or protected backend were touched. Source verification is
+recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json.
+This closes the source transport defects only; T02/T03 remain mandatory.
+
+## Implement independently anchored responder authentication
+
+```task
+id: SECRETS-WP-0014-T02
+status: progress
+priority: high
+state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"
+```
+
+Review producer canonical signature bytes and the native pin's unsigned/signed
+mode. Establish independently admitted verification keys and exact issuer/pin
+binding with AccessEngine and Platform; an unauthenticated keys endpoint on the
+same responder is not a trust anchor. Reuse the native producer fixtures rather
+than inventing a Python canonicalization. Require valid signed envelopes on the
+production consumer path; prove forged allow, altered payload, unknown key,
+wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases.
+Track any temporary exception using all required SEC-DSM-EXC fields and actual
+approval; neither source support nor a loopback URL is that approval.
+
+2026-10-16 source preparation: production `authorize_action` now requires an
+independently admitted local trust file and installed verifier before approval/PDP
+credential reads. The Go helper vendors exact producer API/signature sources,
+checks source hashes, authenticates the original response and returns only its
+verified typed interpretation. Signed evaluator/mode and exact package/version/
+artifact digest are bound to admitted public keys. Unknown/unsigned/altered
+responses refuse; existing request/approval/lifetime/CAS checks remain required.
+Native replay, real producer signing and consumer-boundary tests cover downgrade,
+issuer/pin, request joins, and distinct-key overlap/removal. Build/install and
+source update procedures are documented in `verifier/README.md`.
+
+This is an isolated source implementation awaiting integration/independent review.
+No production verification keys, native pin signed-mode change, trust admission,
+owner assent or rollout has occurred. T02 stays progress because independent
+key admission remains part of its scope; T03 stays wait. WP13 execution and
+identity-only CCR38 are unchanged. Custodian source/verification handoff:
+`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo.
+
+2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its
+separate offline installer deliver the existing wheel plus the reviewed producer
+verifier together into a new owner-controlled prefix. Source/hash drift checks,
+artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent
+wheel-only deployment gap. Disposable build/install tests prove deterministic
+artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do
+not admit packages, keys or a production prefix. T02 remains progress and T03
+wait; no native installation, trust change or protected entitlement is claimed.
+
+## Verify the admitted native consumer and rotation path
+
+```task
+id: SECRETS-WP-0014-T03
+status: wait
+priority: high
+depends_on: [SECRETS-WP-0014-T02]
+blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet."
+state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec"
+```
+
+Under an exact reviewed rollout, prove the real pin and consumer accept the
+admitted signer, reject forgery/downgrade, rotate without accepting removed keys,
+and preserve request/approval binding, lifetime and single-use consumption.
+Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these
+native receipts; do not equate passing transport tests with closure.
+
+
+2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/`
+now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator,
+independent key/policy admission, owner-controlled bundle/config placement and
+rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was
+rebuilt in an isolated clean checkout; artifact receipts are in Custodian
+`decision-native-preparation/`. Production kid/public fingerprint/custody receipt,
+producer candidate OCI and actual runtime/config placement remain missing. The
+empty-key trust template deliberately refuses. No install, key read, caller mint,
+protected effect, policy switch or trust admission occurred. T02 remains progress,
+T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
+
+2026-10-16 trusted successor source preparation: refreshed exact API/sign source
+from frozen Access B2/B3 R1 proposal (patch SHA-256
+6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
+reauthenticates original producer JSON. Existing request/claim/native/caller joins
+remain mandatory; signed source observation additionally binds the native digest
+and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures,
+tamper/unknown provenance and source deadline refusals are locally checked.
+Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper;
+actual source revocation refuses. Actual builder-to-v2 strict positive execution
+is separately blocked on missing owner-reviewed service_actor_binding mapping;
+no caller context injection or equality relaxation hides that gap.
+Artifacts: Custodian `decision-trusted-successor/`. T02 remains progress, T03
+wait; no package/key/policy/native admission or runtime installation occurred.
+
+2026-10-16 successor R2 source preparation resolves the preceding builder gap:
+only typed prod/platform execute-ccr with exact secrets-engine service subject
+emits Access's fixed five-field public service_actor_binding before approval
+issue. Subject/resource platform tenants are explicit before issue, matching the
+producer's existing normalization and native act; lifecycle requests are unchanged.
+Original carried context is still immutable. Actual builder -> Approval App ->
+Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation
+GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/
+native changes, stale original claim, signature tamper and replay refuse. The
+operation deadline is explicit whole seconds within v2's 15-second allow TTL;
+no deadline is extended or waived. This resolves source correspondence only;
+T02 remains progress/T03 wait, with no native trust/grant/policy admission.
+
+2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier
+15s lifetime with the exact immutable operation deadline, bounded by its 120s
+hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s
+fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets
+runtime and strict entire-operation deadline checks are unchanged. Contract prose
+now states the actual fixed backend TTL and conservative fit rather than dynamic
+TTL recomputation, and permits native token expiry earlier than operation deadline.
+The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/
+operationdeadline60, without a consumer timing waiver or native admission.
+
+Temporal proof precision observation: Approval consumption receipts use whole
+seconds while Access R2 not_before preserves subsecond precision. Fast CAS can
+therefore refuse receipt-before-start even though live calls are correctly
+ordered. The positive proof explicitly waits real time until the next whole
+second before CAS, without injected clocks or relaxed checks. Fast-CAS failure
+is retained for owner resolution; no Secrets runtime change conceals the seam.
+
+2026-10-16 retained-registry successor source preparation adds only the existing
+signed Check/DENY preapproval flow. The original typed service proposal is sent
+unchanged; normalized native act and evaluated approval-free digest from the
+admitted producer record are used for normal Approval issuance. The original
+proposal then receives only the original issued claim. Final Check re-normalizes
+against retained owner registry/source facts, so authoritative drift refuses
+before CAS. No local registry algorithm, new endpoint, empty-registry workaround
+or consumer digest waiver is used. Signed DENY preparation has no independent
+permission/freshness window and cannot consume or execute; current caller and
+operation bounds are checked, and final signed ALLOW/source checks remain
+mandatory. Exact original JSON kinds and requested-target subsets refuse
+bool/int/float substitution while allowing extra authoritative registry facts.
+Actual provider proof preparation is separately waiting on frozen Access source
+and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/coordinator-bundle-review.json
@ -0,0 +1,18 @@
+{
+  "source_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+  "independent_checks": {
+    "artifacts": 7,
+    "source_files": 53,
+    "producer_files": 5,
+    "two_existing_builds_byte_equal": true,
+    "fresh_disposable_install": true,
+    "installed_cli_help": true,
+    "installed_import_own_venv": true,
+    "missing_trust_refuses_before_caller_and_network": true
+  },
+  "retained_failure": "Initial installation sandbox denied uv cache; incomplete prefix retained. Approved retry used fresh r2 prefix and passed.",
+  "prefix": "/tmp/netkingdom-root-secrets-native-4dd004a-r2",
+  "native_install": false,
+  "native_effects_accepted": 0
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/README.md
@ -0,0 +1,205 @@
+# Native CLI signer and consumer admission preparation
+
+## Current release preparation — 2026-10-16 R2
+
+Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was
+built twice from an isolated clean checkout. Artifacts and deterministic bundle
+manifest match exactly: manifest SHA256
+`105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`,
+fixed helper SHA256
+`ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`.
+Disposable installation/help and empty native trust refusal pass; no native
+prefix, trust/key, caller credential, protected effect or rollout was admitted.
+Artifact integrity is not independent package admission. Full receipts and a
+concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`.
+
+Initial native scope remains the existing lifecycle pin and **0/11 protected
+sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence
+and scoped caller/Approval delivery paths remain owner-unselected. A concrete
+workstation candidate uses a new release prefix ending
+`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path.
+Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint.
+The current repo editable invocation and ambient demo/preflight fallbacks do not
+constitute release admission. A local CLI does not automatically hold the named
+ServiceAccount identity: existing docs describe separately authorized per-session
+TokenRequest delivery, not a standing credential or pod identity grant.
+
+Access's single offline signer-receipt tool is published at
+`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this
+consumer. Native producer rollout still awaits independent public kid/key/custody
+and immutable candidate image/log/storage returns, including the Access owner's
+separate durable-log hardening review. Published source alone is not that image.
+The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin.
+
+Source task correspondence is now implemented and cross-owner source-server
+proved: fixed typed service mapping before issue, retained-registry signed-DENY
+preapproval, original claim/context preservation, independent fresh source facts,
+precise Approval CAS and independent confirmation/journal/native disposable proof.
+This supersedes the historical source gaps below; it neither adds an execute-ccr
+CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime.
+All native effect, caller/key/config and task-entitlement gates remain open under
+existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work.
+
+## Historical ff1a13d preparation (preserved)
+
+The following draft records the earlier source/admission observations. References
+to absent B2/B3/request/source-fact implementation are superseded by R2 above;
+missing native keys, runtime placement and actual task inputs remain unresolved.
+
+
+This proposal covers the existing lifecycle CLI authentication path under
+SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
+consume, OpenBao effect or task-policy activation. All native acceptance counts
+below are zero. Exact missing owner inputs are in `proposal.json`.
+
+## Current consumer and initial scope
+
+At source `ff1a13d`, the workstation has the repository's editable v0.1.0 CLI
+entrypoint at `/home/worsch/secrets-engine/.venv/bin/secrets-engine`, importing
+`secrets_engine.cli:main`. There is no global `~/.local/bin/secrets-engine` or uv
+managed Secrets tool. Presence-only inspection of this session found none of the
+PDP/trust/approval/policy/configuration variables set. This says nothing about
+other sessions, private owner configuration or a remote installation. No credential
+file, private configuration or process environment was inspected.
+
+Use a separately reviewed immutable wheel-plus-verifier bundle for proposed
+adoption. The canonical source for the candidate build is **ff1a13d**, containing
+both CLI packaging and strict R2 handoff; earlier c80-based proof bundles are
+intermediate source evidence. Custodian `decision-native-preparation/` retains the
+exact canonical bundle manifest and hashes. Nothing was installed by this step.
+
+Initial stage is signer-only existing lifecycle-pin admission plus offline
+verification of captured native signed allow and deny records. Capturing those
+records later needs its own admitted caller and exact source operation; this
+proposal does not grant that capture. Use Access's one receipt verifier,
+`tools/verify_native_signer_receipt.py`, with its reviewed admission file rather
+than creating another consumer verifier or canonicalization implementation.
+That tool is separate Access source preparation; its exact integrated revision
+and reviewed admission file remain owner inputs, not part of this CLI install.
+
+The producer-owned offline pin is `secrets-engine.catalog-lane.lifecycle` v2,
+`sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4`,
+evaluator `flex-auth/local`, mode `standalone`. A source digest is not proof of the
+live image's source or policy. Access's live metadata records the current pin has
+no signer arguments/mounts; no production kid/public key/fingerprint/custody
+receipt or candidate signed-runtime OCI digest is admitted. The proposed signer
+custody route is draft/nonresolvable. Do not fill those gaps from fixture keys or
+from the same responder's keys endpoint. The independent receipt must bind signer
+purpose/custody to this exact consumer pin and declare any sharing. A shared key
+plus the generic evaluator name cannot prove an individual pod's identity; the
+owner-bound tunnel and rollout identity still require separate verification.
+
+`lifecycle-trust.template.json` uses the existing runtime trust schema and the
+producer-owned source pin, but deliberately has an empty key map. It **must
+refuse** before caller credential access. It is not a deployable trust file. A
+future owner-admitted copy must contain the independently authenticated actual
+kid/key and exact pin, with its public-key fingerprint/custody provenance retained
+outside this unadmitted template. The task-policy coordinate is not admitted here.
+
+## Exact PEP denominator
+
+The initial shared authentication implementation is one Check client reached
+through `authorize_action` and `_require_lane_approval`. Native protected-effect
+coverage remains **0 of 11 serving CLI call sites across 10 handlers**, not one
+PEP per catalog row. The current lifecycle policy's action vocabulary has twelve
+values; that is a separate count from handler/call-site coverage.
+
+| CLI path | Handler / delegated authorization site | PDP action |
+| --- | --- | --- |
+| apply, live only | `cmd_apply` | apply |
+| provision | `cmd_provision` | provision |
+| rotate, live only | `cmd_rotate` | rotate |
+| verify | `cmd_verify` | verify |
+| handoff | `cmd_handoff` | handoff |
+| wrap | `cmd_wrap` | wrap |
+| exec primary | `cmd_exec`, primary gate | exec |
+| exec companion | `cmd_exec`, delegated companion gate | exec for each companion; separate claim/CAS, same call site |
+| revoke, live only | `cmd_revoke` | deactivate |
+| lifecycle compromise/reactivate, live only | `_cmd_lifecycle_state` | selected compromise/reactivate; local state mutation |
+| lifecycle suspend/deactivate/destroy, live only | `cmd_lifecycle` | selected operation |
+
+`session revoke` is a separate stance/readiness-controlled backend path without
+this served Check/CAS chain; it is excluded from this signer acceptance and still
+refuses production under its stance. `service-auth probe-openbao` is an explicit
+identity/login-self probe, not protected task adoption. `route` performs existing
+backend readiness metadata probes through its ambient backend resolver; it is not
+closed by this signer proposal. Dry-run/plan/catalog/audit/source evidence commands
+are not protected-effect proof. These exclusions must remain visible in any claim
+about the whole repository's PEP coverage.
+
+The existing CLI handlers still use the generic `require_production_consume`
+response contract. Strict R2 task consumption is a separate owner API, not a
+retrofit of all eleven CLI sites. Native effect acceptance must review the actual
+selected handler/consume contract and caller scope rather than borrow the task
+fixture proof.
+
+No production effect is authorized merely because a handler shares the signed
+client. In particular, configured `service-jwt` still refuses protected CLI work
+before approval/CAS/backend because CCR38 is identity-only. Do not select
+bootstrap/env, alter the stance or enable unsafe-demo to manufacture acceptance.
+
+## Owner-controlled placement and minimum configuration
+
+The deploying owner must select the runtime UID, fresh release prefix, configuration
+parent and exact runtime paths; none is agreed by this proposal. The future
+admitted executable is `<prefix>/bin/secrets-engine`, whose wrapper fixes the
+bundle helper and checks its digest before CLI import. The helper's source/binary
+hash is artifact integrity, not independent package or key admission. Do not use
+the editable checkout, a rolling alias, a synthetic test prefix or an internal
+venv entrypoint as if it were that admission.
+
+Explicit absolute owner-admitted catalog, policy, `SECRETS_ENGINE_PEP_STANCE`,
+trust and evidence/outbox locations are needed. Installed-package defaults fall
+back to working-directory metadata and are not an admitted native configuration.
+The total existing stance remains prod fail_closed. Config needs the exact
+producer policy/version, service subject, loopback owner-bound PDP tunnel and
+separately admitted bounded audience `flex-auth` caller-file lifetime. Approval
+endpoint and its existing separately scoped credential delivery must be admitted
+independently. Both approval credential providers may not be configured together.
+The bundle helper is not selected by an ambient override. Runtime credentials and
+keys are not placed in this proposal or release bundle.
+
+Acceptance order is: admit exact package/source/install/config; obtain independent
+signer/key/pin custody return and exact signed producer rollout candidate; under
+that separately reviewed rollout capture bounded native records; run Access's
+single offline receipt verifier against the fixed installed helper and admitted
+trust; prove forged/altered/unknown/unsigned/wrong-pin/expired refusal and exact
+old/new-key overlap then removed-key refusal. Also close the producer's missing
+native durable log/outbox/audit path under its owner. No install or rollout is
+performed here, and shared-source tests do not fill native effect coverage.
+
+Rollback retains the reviewed signed producer and admitted overlap or stops the
+consumer. Rolling back to an unsigned image is an outage, not permission to turn
+off verification. Removing keys, changing policy pins or restoring removed keys
+needs exact owner review; no discovery/cached-key fallback or blind consume retry.
+
+## Separate task-execution gap
+
+Strict `task_execution_handoff` exists and Platform's independently confirmed
+journal/native fixture path has actual source-server proof. Neither creates an
+existing `execute-ccr` CLI command: the current parser has none. Proposed task
+caller mapping/request join, policy admission, production source/Plan/grant and
+installation/journal/cleanup placement remain separate owner decisions. Both
+Access task-policy runtime false gates remain unchanged; lifecycle apply is not
+a substitute for execute-ccr. Platform has selected no fresh approved real
+CCR/catalogue/descriptor/grant. CCR42 is in_flight and lacks a matching Secrets
+catalog; synthetic CCR2/issue-core fixture bytes and temporary paths are not native
+inputs. Actual before/after bytes for the exact metadata targets and independent
+readback/cleanup receipts must come from Platform's eventual owner-selected plan.
+
+For future server-owned Approval facts, strict R2 deliberately requires the
+returned binding context to equal the originally submitted context. B1 caller
+join remains signed-DENY and must preserve that context. Replacing the carried
+claim with a freshly observed blob would refuse because its freshness fields
+change; no generic equality relaxation is proposed. Access's current review
+preference is to validate fresh authoritative facts out of band while retaining
+the submitted context, with reviewed producer-owned signed source/receipt evidence.
+Exact stable fact/freshness and provenance correspondence requires Approval and
+Access review before B2/B3; no new fields or behavior are implemented here.
+
+The Approval owner's pending `approval-fact-contract/consumer-contract.md` and
+`golden-vectors.json` in the Custodian target evidence name this correspondence.
+They require both original/fresh windows and exact nonfreshness authority facts.
+Their Python native numeric canonical vectors still need producer conformance;
+no silent digest translation or new target numeric restriction is admitted.
+The proposal pins those owner artifacts for review, not as B2 implementation.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/docs/proposals/native-cli-admission/proposal.json
@ -0,0 +1,141 @@
+{
+  "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
+  "status": "preparation only; not installable or executable authorization",
+  "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "workplans": [
+    "SECRETS-WP-0014-T02",
+    "SECRETS-WP-0014-T03",
+    "SECRETS-WP-0013-T01",
+    "SECRETS-WP-0013-T03"
+  ],
+  "initial_scope": {
+    "producer": "existing flex-auth/flex-auth-secrets-engine lifecycle pin",
+    "consumer": "existing Secrets CLI serving authorization workflow, prospective reviewed release-bundle entrypoint only",
+    "stage1": "independent signer/package/trust admission and offline captured native allow+deny verification; zero protected effects",
+    "native_effects_admitted": 0,
+    "task_execution_enabled": false
+  },
+  "owner_returns": {
+    "access": "Custodian docs/changes/netkingdom-target-2026-10-16/access-native-preparation/native-admission-proposal-r1.json and source-policy-pins.json",
+    "platform": "No selected actual approved CCR/catalog/Plan/descriptor/grant/install placement; CCR-2026-0042 remains in_flight without matching catalog. Disposable source proofs are not production inputs."
+  },
+  "producer_pin": {
+    "evaluator": "flex-auth/local",
+    "mode": "standalone",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_version": "v2",
+    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
+  },
+  "independent_admission": {
+    "production_kid": null,
+    "public_key": null,
+    "public_key_sha256": null,
+    "custody_receipt": null,
+    "candidate_producer_oci_digest": null,
+    "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
+    "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "signer_purpose_pin_and_sharing_receipt": null,
+    "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
+    "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
+  },
+  "placement": {
+    "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
+    "cli_release_prefix": null,
+    "cli_entrypoint": "<admitted-prefix>/bin/secrets-engine",
+    "fixed_verifier": "<admitted-prefix>/libexec/secrets-engine-pdp-verify",
+    "config_parent": null,
+    "trust_file": null,
+    "catalog_directory": null,
+    "policy_directory": null,
+    "pep_stance_file": null,
+    "evidence_directory": null,
+    "constraints": [
+      "new owner-controlled immutable release prefix; no overwrite or rolling source alias",
+      "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
+      "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
+      "owner retains manifest/admission/installation receipts and same-UID control boundary"
+    ],
+    "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
+    "candidate_status": "proposal only; no path selected/created/admitted"
+  },
+  "configuration_contract": {
+    "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
+    "SECRETS_ENGINE_PDP_TOKEN_FILE": "admitted bounded Secrets ServiceAccount caller file outside Git; no mint/read here",
+    "SECRETS_ENGINE_PDP_TRUST_FILE": "absolute independently admitted lifecycle trust path; empty-key template deliberately refuses",
+    "SECRETS_ENGINE_PDP_VERIFIER": "bundle wrapper fixes installed helper; no ambient override or source-checkout helper",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_ID": "secrets-engine",
+    "SECRETS_ENGINE_AUTHORIZATION_SUBJECT_TYPE": "service",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_PACKAGE": "secrets-engine.catalog-lane.lifecycle",
+    "SECRETS_ENGINE_AUTHORIZATION_POLICY_VERSION": "v2",
+    "SECRETS_ENGINE_APPROVAL_URL": "independently admitted Approval endpoint/owner-bound tunnel; not yet supplied for this session",
+    "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": "separately admitted attended provider lifetime from existing custody contract; no read here",
+    "SECRETS_ENGINE_APPROVAL_TOKEN_FILE": "unset when client-secret provider selected; no simultaneous providers",
+    "SECRETS_ENGINE_CATALOG": "absolute owner-admitted metadata directory; initial actual lane unselected",
+    "SECRETS_ENGINE_POLICIES": "absolute owner-admitted metadata/policy directory",
+    "SECRETS_ENGINE_PEP_STANCE": "absolute hash-pinned existing total stance map; prod remains fail_closed",
+    "SECRETS_ENGINE_EVIDENCE": "absolute owner-private evidence/outbox path with declared custody/delivery",
+    "SECRETS_ENGINE_UNSAFE_DEMO": "unset; no native exception",
+    "backend_provider": "no new selection/entitlement; configured service-jwt protected handlers remain blocked; do not switch to bootstrap/env as workaround"
+  },
+  "rotation": {
+    "admit": "owner reviews independent new kid/public key/custody receipt and bounded overlap, preserving exact issuer/policy artifact pin",
+    "roll": "separate exact producer candidate digest/seed projection rollout with native signed receipts; never fetch discovery keys",
+    "remove": "after new-key native receipt/consumer acceptance, remove old kid and prove old-key refusal",
+    "rollback": "retain reviewed signed producer/key overlap or stop/refuse. An unsigned old deployment is an outage; never disable consumer verification, restore removed key without review, relax pin, widen backend grants or blind retry consumed operation"
+  },
+  "task_mapping_gap": {
+    "existing_cli_execute_ccr_command": false,
+    "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
+    "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
+    "unadmitted_inputs": [
+      "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
+      "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
+      "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
+      "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
+      "load-bearing audit/outbox cadence and durable receipt correlation",
+      "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
+    ],
+    "approval_fact_interface_review": {
+      "status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
+      "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
+      "receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
+    },
+    "approval_fact_contract": {
+      "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
+      "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+      "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
+      "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+      "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
+      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
+    },
+    "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
+  },
+  "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
+  "denominator": {
+    "shared_check_implementation": 1,
+    "serving_cli_call_sites": 11,
+    "serving_cli_handlers": 10,
+    "lifecycle_pdp_action_values": 12,
+    "native_effect_call_sites_accepted": 0,
+    "excluded": [
+      "session revoke stance-only backend path",
+      "service-auth explicit identity probes",
+      "route ambient-backend readiness probes",
+      "dry-run/non-effect reporting"
+    ],
+    "task_cli_command_count": 0,
+    "platform_source_mediator_native_acceptance": false,
+    "generic_cli_consume_is_strict_task_handoff": false,
+    "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  },
+  "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "release_candidate": {
+    "bundle_manifest_sha256": "105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+    "helper_sha256": "ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
+    "two_clean_builds_equal": true,
+    "disposable_install_passed": true,
+    "native_install_admitted": false,
+    "artifact_integrity_is_not_package_admission": true,
+    "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/r2-preimages/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
@ -0,0 +1,192 @@
+---
+id: SECRETS-WP-0014
+type: workplan
+title: "Constrain PDP transport and authenticate decision responses"
+domain: infotech
+repo: secrets-engine
+status: active
+owner: codex
+topic_slug: secrets-engine
+created: "2026-10-12"
+updated: "2026-10-16"
+flavor: implementation
+depends_on: []
+state_hub_workstream_id: "7252469d-d7a5-5c18-8911-b511b8c6a736"
+---
+
+Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and
+FLEX-WP-0024 producer signature surface; does not create another PDP or grant
+any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped
+protected execution. Transport review is complete; key admission and native
+rollout remain separate gates below.
+
+## Prevent the Check credential from leaving the admitted local transport
+
+```task
+id: SECRETS-WP-0014-T01
+status: done
+priority: high
+state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173"
+```
+
+Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL
+handling, oversized-body truncation and invalid UTF-8 against the prior source.
+The bounded fix disables redirects and ambient proxies/global openers, requires
+a literal loopback bare origin before credential access, caps the complete
+response body and rejects invalid UTF-8 as a DecisionError. The approval consumer
+no longer overrides this safe default with urlopen. Synthetic local-server tests
+cover both entry points, all five redirect status codes and proxy forwarding.
+No real credentials or protected backend were touched. Source verification is
+recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json.
+This closes the source transport defects only; T02/T03 remain mandatory.
+
+## Implement independently anchored responder authentication
+
+```task
+id: SECRETS-WP-0014-T02
+status: progress
+priority: high
+state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"
+```
+
+Review producer canonical signature bytes and the native pin's unsigned/signed
+mode. Establish independently admitted verification keys and exact issuer/pin
+binding with AccessEngine and Platform; an unauthenticated keys endpoint on the
+same responder is not a trust anchor. Reuse the native producer fixtures rather
+than inventing a Python canonicalization. Require valid signed envelopes on the
+production consumer path; prove forged allow, altered payload, unknown key,
+wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases.
+Track any temporary exception using all required SEC-DSM-EXC fields and actual
+approval; neither source support nor a loopback URL is that approval.
+
+2026-10-16 source preparation: production `authorize_action` now requires an
+independently admitted local trust file and installed verifier before approval/PDP
+credential reads. The Go helper vendors exact producer API/signature sources,
+checks source hashes, authenticates the original response and returns only its
+verified typed interpretation. Signed evaluator/mode and exact package/version/
+artifact digest are bound to admitted public keys. Unknown/unsigned/altered
+responses refuse; existing request/approval/lifetime/CAS checks remain required.
+Native replay, real producer signing and consumer-boundary tests cover downgrade,
+issuer/pin, request joins, and distinct-key overlap/removal. Build/install and
+source update procedures are documented in `verifier/README.md`.
+
+This is an isolated source implementation awaiting integration/independent review.
+No production verification keys, native pin signed-mode change, trust admission,
+owner assent or rollout has occurred. T02 stays progress because independent
+key admission remains part of its scope; T03 stays wait. WP13 execution and
+identity-only CCR38 are unchanged. Custodian source/verification handoff:
+`docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo.
+
+2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its
+separate offline installer deliver the existing wheel plus the reviewed producer
+verifier together into a new owner-controlled prefix. Source/hash drift checks,
+artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent
+wheel-only deployment gap. Disposable build/install tests prove deterministic
+artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do
+not admit packages, keys or a production prefix. T02 remains progress and T03
+wait; no native installation, trust change or protected entitlement is claimed.
+
+## Verify the admitted native consumer and rotation path
+
+```task
+id: SECRETS-WP-0014-T03
+status: wait
+priority: high
+depends_on: [SECRETS-WP-0014-T02]
+blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet."
+state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec"
+```
+
+Under an exact reviewed rollout, prove the real pin and consumer accept the
+admitted signer, reject forgery/downgrade, rotate without accepting removed keys,
+and preserve request/approval binding, lifetime and single-use consumption.
+Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these
+native receipts; do not equate passing transport tests with closure.
+
+
+2026-10-16 native preparation (no rollout): `docs/proposals/native-cli-admission/`
+now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator,
+independent key/policy admission, owner-controlled bundle/config placement and
+rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was
+rebuilt in an isolated clean checkout; artifact receipts are in Custodian
+`decision-native-preparation/`. Production kid/public fingerprint/custody receipt,
+producer candidate OCI and actual runtime/config placement remain missing. The
+empty-key trust template deliberately refuses. No install, key read, caller mint,
+protected effect, policy switch or trust admission occurred. T02 remains progress,
+T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
+
+2026-10-16 trusted successor source preparation: refreshed exact API/sign source
+from frozen Access B2/B3 R1 proposal (patch SHA-256
+6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
+reauthenticates original producer JSON. Existing request/claim/native/caller joins
+remain mandatory; signed source observation additionally binds the native digest
+and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures,
+tamper/unknown provenance and source deadline refusals are locally checked.
+Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper;
+actual source revocation refuses. Actual builder-to-v2 strict positive execution
+is separately blocked on missing owner-reviewed service_actor_binding mapping;
+no caller context injection or equality relaxation hides that gap.
+Artifacts: Custodian `decision-trusted-successor/`. T02 remains progress, T03
+wait; no package/key/policy/native admission or runtime installation occurred.
+
+2026-10-16 successor R2 source preparation resolves the preceding builder gap:
+only typed prod/platform execute-ccr with exact secrets-engine service subject
+emits Access's fixed five-field public service_actor_binding before approval
+issue. Subject/resource platform tenants are explicit before issue, matching the
+producer's existing normalization and native act; lifecycle requests are unchanged.
+Original carried context is still immutable. Actual builder -> Approval App ->
+Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation
+GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/
+native changes, stale original claim, signature tamper and replay refuse. The
+operation deadline is explicit whole seconds within v2's 15-second allow TTL;
+no deadline is extended or waived. This resolves source correspondence only;
+T02 remains progress/T03 wait, with no native trust/grant/policy admission.
+
+2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier
+15s lifetime with the exact immutable operation deadline, bounded by its 120s
+hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s
+fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets
+runtime and strict entire-operation deadline checks are unchanged. Contract prose
+now states the actual fixed backend TTL and conservative fit rather than dynamic
+TTL recomputation, and permits native token expiry earlier than operation deadline.
+The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/
+operationdeadline60, without a consumer timing waiver or native admission.
+
+Temporal proof precision observation: Approval consumption receipts use whole
+seconds while Access R2 not_before preserves subsecond precision. Fast CAS can
+therefore refuse receipt-before-start even though live calls are correctly
+ordered. The positive proof explicitly waits real time until the next whole
+second before CAS, without injected clocks or relaxed checks. Fast-CAS failure
+is retained for owner resolution; no Secrets runtime change conceals the seam.
+
+2026-10-16 retained-registry successor source preparation adds only the existing
+signed Check/DENY preapproval flow. The original typed service proposal is sent
+unchanged; normalized native act and evaluated approval-free digest from the
+admitted producer record are used for normal Approval issuance. The original
+proposal then receives only the original issued claim. Final Check re-normalizes
+against retained owner registry/source facts, so authoritative drift refuses
+before CAS. No local registry algorithm, new endpoint, empty-registry workaround
+or consumer digest waiver is used. Signed DENY preparation has no independent
+permission/freshness window and cannot consume or execute; current caller and
+operation bounds are checked, and final signed ALLOW/source checks remain
+mandatory. Exact original JSON kinds and requested-target subsets refuse
+bool/int/float substitution while allowing extra authoritative registry facts.
+Actual provider proof preparation is separately waiting on frozen Access source
+and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
+
+2026-10-16 canonical native CLI release preparation: published4dd004a was built
+twice offline from a clean isolated checkout, with identical artifacts/manifest
+105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e.
+Disposable installation uses its fixed helper and empty native trust refuses
+before caller access. Exact invocation/config/delivery candidates, public signer
+provenance requirements, native lifecycle allow/deny capture, rotation/removal and
+isolated-transport outage probes are reviewable in Custodian
+`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed
+producer/log/storage, native UID/prefix/config/caller/Approval delivery and each
+actual handler/backend entitlement remain missing. No seed/token read, mint,
+production installation/trust/policy change or effect occurred. Native effect
+coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
+WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
+source APIs do not substitute for the separately reviewed hardened native image.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r3/verification.json
@ -0,0 +1,10 @@
+{
+  "JSON_valid": true,
+  "current_nested_contract_source_status_consistent": true,
+  "initial_prehelper_provenance_preserved": true,
+  "all_public_SHA256_references_explicit_algorithm": true,
+  "git_commit_ids_unchanged": true,
+  "programmatic_bundle_manifest_and_installer_runtime_untouched": true,
+  "runtime_files_untouched": true,
+  "effect_acceptance_unchanged": "0/11sites10handlers"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/manifest.json
@ -0,0 +1,26 @@
+{
+  "base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+  "predecessor_r3_full_patch_sha256": "87dbdf5498a4d2950a83db0cfd13e03cadfb4b9450271cc1aa4f24e14a7613f6",
+  "over_r3_patch_sha256": "4deb45d649221b2f303ba12e634d1213845410848af0f2919bee47a365b856c0",
+  "full_patch_sha256": "18867bfa44bd8e59f5a4b77cf5a243c0640f9d68b06d0fc512f7400795de2d18",
+  "old_blob": "8fbf62ad8693a70f1e814b453c1a7a8efbb77224",
+  "new_blob": "01766313945cf521ffbb342ee773eae47a26ca87",
+  "changed_file_sha256": "6a76c1156a5f142e247a42abe435b092eebbc09391948d78fcb6367f7fc34b9a",
+  "normal_scanner_result_sha256": "9b42633aa2cf99e44d89a4093dd4f4cf817e28f667bc85c83f61815e64c9cbc2",
+  "diagnosis": "generic-api-key lines116/117 were public Git commit IDs under ambiguous Access/Secrets labels, not remaining SHA256 values",
+  "correction": "rename only metadata labels to producer_git_commit/consumer_git_commit; original commit bytes/values and all other metadata preserved",
+  "scanner": {
+    "blocked_blob_ids": [],
+    "scanned_blobs": 3,
+    "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+    "scanner_version": "8.30.1",
+    "scope": "changed-staged-blobs",
+    "status": "clean"
+  },
+  "checks": {
+    "inverse_key_rename_restores_exact_original_JSON_semantics": true,
+    "runtime_and_programmatic_bundle_formats_unchanged": true,
+    "frozen_R3_and_owner_review_unchanged": true,
+    "canonical_checkout_untouched": true
+  }
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/native-cli-admission-r4-full.patch
@ -0,0 +1,202 @@
+diff --git a/docs/proposals/native-cli-admission/README.md b/docs/proposals/native-cli-admission/README.md
+index 3729cf6..63c48f5 100644
+--- a/docs/proposals/native-cli-admission/README.md
+++ b/docs/proposals/native-cli-admission/README.md
+@@ -1,5 +1,52 @@
+ # Native CLI signer and consumer admission preparation
+ 
+## Current release preparation — 2026-10-16 R2
+
+Published canonical Secrets `4dd004a2250104ba56293b2d7b0d96f4e076ea99` was
+built twice from an isolated clean checkout. Artifacts and deterministic bundle
+manifest match exactly: manifest SHA256
+`sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e`,
+fixed helper SHA256
+`sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e`.
+Disposable installation/help and empty native trust refusal pass; no native
+prefix, trust/key, caller credential, protected effect or rollout was admitted.
+Artifact integrity is not independent package admission. Full receipts and a
+concrete probe/placement proposal are in Custodian `decision-native-preparation/r2/`.
+
+Initial native scope remains the existing lifecycle pin and **0/11 protected
+sites across10 handlers**. Runtime UID/release/config/catalog/stance/trust/evidence
+and scoped caller/Approval delivery paths remain owner-unselected. A concrete
+workstation candidate uses a new release prefix ending
+`4dd004a22501-105dcebe6f03`; it is a proposal, not an installed/admitted path.
+Only its exact future `bin/secrets-engine` wrapper is the effect entrypoint.
+The current repo editable invocation and ambient demo/preflight fallbacks do not
+constitute release admission. A local CLI does not automatically hold the named
+ServiceAccount identity: existing docs describe separately authorized per-session
+TokenRequest delivery, not a standing credential or pod identity grant.
+
+Access's single offline signer-receipt tool is published at
+`2b064eee510640224274ccdc7cefceb1ae13162e`; verified API/sign source matches this
+consumer. Native producer rollout still awaits independent public kid/key/custody
+and immutable candidate image/log/storage returns, including the Access owner's
+separate durable-log hardening review. Published source alone is not that image.
+The lifecycle pin stays v2/bd11c5fe...; task v2 is a separate unadmitted pin.
+
+Source task correspondence is now implemented and cross-owner source-server
+proved: fixed typed service mapping before issue, retained-registry signed-DENY
+preapproval, original claim/context preservation, independent fresh source facts,
+precise Approval CAS and independent confirmation/journal/native disposable proof.
+This supersedes the historical source gaps below; it neither adds an execute-ccr
+CLI command nor selects a real CCR/catalogue/Plan/grant/backend/journal runtime.
+All native effect, caller/key/config and task-entitlement gates remain open under
+existing WP14/WP13/WP8 records. `service-jwt` still refuses protected CLI work.
+
+## Historical ff1a13d preparation (preserved)
+
+The following draft records the earlier source/admission observations. References
+to absent B2/B3/request/source-fact implementation are superseded by R2 above;
+missing native keys, runtime placement and actual task inputs remain unresolved.
+
+
+ This proposal covers the existing lifecycle CLI authentication path under
+ SECRETS-WP-0014. It grants no installation, key retrieval, caller mint, approval
+ consume, OpenBao effect or task-policy activation. All native acceptance counts
+diff --git a/docs/proposals/native-cli-admission/proposal.json b/docs/proposals/native-cli-admission/proposal.json
+index d5c50c2..0176631 100644
+--- a/docs/proposals/native-cli-admission/proposal.json
+++ b/docs/proposals/native-cli-admission/proposal.json
+@@ -1,7 +1,7 @@
+ {
+   "proposal_id": "SECRETS-WP-0014-native-cli-20261016",
+   "status": "preparation only; not installable or executable authorization",
+-  "source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "source_base": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+   "workplans": [
+     "SECRETS-WP-0014-T02",
+     "SECRETS-WP-0014-T03",
+@@ -33,8 +33,10 @@
+     "custody_receipt": null,
+     "candidate_producer_oci_digest": null,
+     "rule": "No responder keys endpoint, synthetic fixture key or deployment metadata substitutes for independent owner admission",
+-    "receipt_verifier_integrated_revision": null,
+-    "signer_purpose_pin_and_sharing_receipt": null
+    "receipt_verifier_integrated_revision": "2b064eee510640224274ccdc7cefceb1ae13162e",
+    "signer_purpose_pin_and_sharing_receipt": null,
+    "public_fingerprint_convention": "Platform proposal: sha256(canonical unpadded base64url43 public-key ASCII); independent owner receipt required",
+    "candidate_producer_prerequisite": "Access durable-log hardening source and immutable image/storage/custody awaiting separate root/Platform review; published2b064ee alone is not native candidate admission"
+   },
+   "placement": {
+     "owner": "Secrets consumer/deploying owner; exact runtime UID and paths not yet agreed",
+@@ -52,7 +54,9 @@
+       "absolute independently reviewed config/catalog/policy/stance/trust paths; no working-directory defaults for native use",
+       "trust regular non-symlink, not group/world writable; key admission not file-presence inference",
+       "owner retains manifest/admission/installation receipts and same-UID control boundary"
+-    ]
+    ],
+    "candidate_cli_release_prefix": "/home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03",
+    "candidate_status": "proposal only; no path selected/created/admitted"
+   },
+   "configuration_contract": {
+     "SECRETS_ENGINE_PDP_URL": "literal loopback bare origin bound to independently verified cluster and named producer pod; exact native port awaiting owner placement",
+@@ -81,36 +85,41 @@
+   },
+   "task_mapping_gap": {
+     "existing_cli_execute_ccr_command": false,
+-    "source_handoff": "secrets_engine.task_execution_handoff authorize_task_execution/consume_task_execution",
+    "source_handoff": "secrets_engine.task_execution_handoff prepare_task_approval/authorize_task_execution/consume_task_execution",
+     "platform_source_mediator": "railiance-platform/scripts/task_execution_mediator.py run_native_fixture_task; source proof only",
+     "unadmitted_inputs": [
+-      "real service caller-to-subject server mapping and request/service binding join",
+-      "actual task policy candidate and independently reviewed source/runtime admission; both false gates unchanged",
+      "native admission of the existing exact service-caller-to-subject request mapping and immutable original-claim/source join",
+       "owner-selected fresh approved CCR/catalog/execution-grant, compiled Plan/whole descriptor and operation UUID",
+       "independent expected-before/after bytes for exact two metadata targets and actual estate/backend origin",
+       "actual source/Plan/install/journal/cleanup placement and trusted provider endpoints/credentials/custody",
+       "load-bearing audit/outbox cadence and durable receipt correlation",
+-      "Approval/Access reviewed out-of-band fresh-fact versus original carried-claim correspondence and signed provenance; strict context equality remains unchanged"
+      "exact native task v2 policy/caller/source/config/placement/key/runtime admission; v1 hard DENY retained"
+     ],
+     "approval_fact_interface_review": {
+-      "status": "review preference only; no implementation/admission",
+-      "preserve": "strict binding.context equality and original submitted/approval-free/native joins",
+-      "direction": "Access prefers out-of-band server-fetched authoritative fact checking while retaining original carried context, then reviewed producer-owned signed provenance/audit evidence",
+-      "required_review": [
+-        "Approval fact/freshness semantic correspondence",
+-        "Access source receipt/provenance binding and exact request digests"
+-      ],
+-      "b1": "signed-DENY caller join only; no context replacement",
+-      "b2_b3": "not enabled or implemented here"
+      "status": "implemented/source-proved; native source/config/identity/trust admission remains missing",
+      "preserve": "type-sensitive original context/native/request/descriptor correspondence; original and independently fresh fact deadlines; no numeric translation",
+      "receipt": "Custodian decision-trusted-successor/verification-final-r4.json"
+     },
+     "approval_fact_contract": {
+       "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/consumer-contract.md",
+-      "sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+      "sha256": "sha256:3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
+       "vectors_artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-fact-contract/golden-vectors.json",
+-      "vectors_sha256": "dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+-      "status": "owner source contract pending integration; no Go conformance or B2 behavior admitted",
+-      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions"
+-    }
+      "vectors_sha256": "sha256:dfb0a8810cd91847d7af6a7af6a51607a67a66fad7b86fc57365308c36bd9323",
+      "status": "owner contract/helper source implemented and integrated; Go conformance and actual source-server B2 behavior proved; native identity/config/trust/custody/effect admission remains unaccepted",
+      "required": "preserve original fact/context/freshness, independently validate fresh fact window and exact nonfreshness authority; do not translate native numeric digests or invent target restrictions",
+      "historical_attribution": "artifact and golden vectors below identify the initial prehelper contract; their former pending status was historical source preparation, not current implementation",
+      "current_helper_package": {
+        "artifact": "the-custodian/docs/changes/netkingdom-target-2026-10-16/approval-go-fact/manifest.json",
+        "sha256": "sha256:6d67f0005d4642bc60ed3a5f8901442f10c7bbf3f6b5d9fb8dba621298ed3851"
+      },
+      "integrated_source": {
+        "producer_git_commit": "2b064eee510640224274ccdc7cefceb1ae13162e",
+        "consumer_git_commit": "4dd004a2250104ba56293b2d7b0d96f4e076ea99",
+        "receipt": "the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/verification-final-r4.json",
+        "receipt_sha256": "sha256:9ed4d80a7d1aa7353d7b57954b7924a146329d1bd18a3f9152c6055bd51b92b5"
+      }
+    },
+    "source_status": "implemented and cross-owner source-server proved, including retained registry and precise CAS; no native adoption"
+   },
+   "approval_state": "no owner assent, key admission, install, caller token, operation grant or live change requested/executed by this preparation",
+   "denominator": {
+@@ -129,5 +138,15 @@
+     "platform_source_mediator_native_acceptance": false,
+     "generic_cli_consume_is_strict_task_handoff": false,
+     "effect_acceptance_required": "Review actual selected handler/generic consume response and caller scope separately; strict Platform fixture proof does not close existing CLI effects"
+  },
+  "historical_source_base": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "release_candidate": {
+    "bundle_manifest_sha256": "sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e",
+    "helper_sha256": "sha256:ed922b62533e4d33ae2d5f11175111f6f28e684a19e63ac704d43b63f0e0e12e",
+    "two_clean_builds_equal": true,
+    "disposable_install_passed": true,
+    "native_install_admitted": false,
+    "artifact_integrity_is_not_package_admission": true,
+    "receipt": "Custodian decision-native-preparation/r2/canonical-build-install-receipt.json"
+   }
+ }
+diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+index f65ac96..20f3b17 100644
+--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+@@ -117,7 +117,7 @@ T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.
+ 
+ 2026-10-16 trusted successor source preparation: refreshed exact API/sign source
+ from frozen Access B2/B3 R1 proposal (patch SHA-256
+-6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1).
+ Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and
+ reauthenticates original producer JSON. Existing request/claim/native/caller joins
+ remain mandatory; signed source observation additionally binds the native digest
+@@ -175,3 +175,18 @@ bool/int/float substitution while allowing extra authoritative registry facts.
+ Actual provider proof preparation is separately waiting on frozen Access source
+ and Approval's timestamp/transaction-clock repair; source native/trust/custody and
+ actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.
+
+2026-10-16 canonical native CLI release preparation: published4dd004a was built
+twice offline from a clean isolated checkout, with identical artifacts/manifest
+sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e.
+Disposable installation uses its fixed helper and empty native trust refuses
+before caller access. Exact invocation/config/delivery candidates, public signer
+provenance requirements, native lifecycle allow/deny capture, rotation/removal and
+isolated-transport outage probes are reviewable in Custodian
+`decision-native-preparation/r2/`. Real public kid/key/custody, candidate signed
+producer/log/storage, native UID/prefix/config/caller/Approval delivery and each
+actual handler/backend entitlement remain missing. No seed/token read, mint,
+production installation/trust/policy change or effect occurred. Native effect
+coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native
+WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified
+source APIs do not substitute for the separately reviewed hardened native image.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/normal-scanner.json
@ -0,0 +1 @@
+{"blocked_blob_ids": [], "scanned_blobs": 3, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/r4/redacted-finding-metadata.json
@ -0,0 +1,24 @@
+{
+  "blob": "8fbf62ad8693a70f1e814b453c1a7a8efbb77224",
+  "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+  "scanner_version": "8.30.1",
+  "findings": [
+    {
+      "RuleID": "generic-api-key",
+      "StartLine": 116,
+      "EndLine": 116,
+      "StartColumn": 11,
+      "EndColumn": 61,
+      "Fingerprint": ":generic-api-key:116"
+    },
+    {
+      "RuleID": "generic-api-key",
+      "StartLine": 117,
+      "EndLine": 117,
+      "StartColumn": 11,
+      "EndColumn": 62,
+      "Fingerprint": ":generic-api-key:117"
+    }
+  ],
+  "secret_match_and_line_contents_omitted": true
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/scanner-r1.json
@ -0,0 +1 @@
+{"blocked_blob_ids": [], "scanned_blobs": 6, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-native-preparation/verification-r1.json
@ -0,0 +1,94 @@
+{
+  "source_commit": "ff1a13dabd44ba02ddd6bc26ad75568f6d2e6225",
+  "canonical_build_checkout_clean": true,
+  "all_manifest_source_and_artifact_hashes_verified": true,
+  "bundle": {
+    "bundle": "/tmp/secrets-cli-ff1-native-proof",
+    "helper_sha256": "a6e4eeb5361c61a2db5526ba5648ef5e48143c1a453e158d2f62991ba7ba3a33",
+    "manifest_sha256": "ee07c0b8755788ad0894c679ee2ca125a1c24df3a895013755d4a965a879a1ec"
+  },
+  "installed": false,
+  "public_signer_inputs_missing": {
+    "kid": null,
+    "public_key": null,
+    "fingerprint": null,
+    "custody_receipt": null
+  },
+  "cli_runtime_ast_unchanged_except_docstring": true,
+  "denominator": {
+    "shared_check_client": 1,
+    "cli_call_sites": 11,
+    "cli_handlers": 10,
+    "native_effects_accepted": 0,
+    "call_sites": [
+      {
+        "handler": "cmd_apply",
+        "line_at_ff1": 313,
+        "action": "'apply'"
+      },
+      {
+        "handler": "cmd_provision",
+        "line_at_ff1": 340,
+        "action": "'provision'"
+      },
+      {
+        "handler": "cmd_rotate",
+        "line_at_ff1": 378,
+        "action": "'rotate'"
+      },
+      {
+        "handler": "cmd_verify",
+        "line_at_ff1": 421,
+        "action": "'verify'"
+      },
+      {
+        "handler": "cmd_handoff",
+        "line_at_ff1": 495,
+        "action": "'handoff'"
+      },
+      {
+        "handler": "cmd_wrap",
+        "line_at_ff1": 535,
+        "action": "'wrap'"
+      },
+      {
+        "handler": "cmd_exec",
+        "line_at_ff1": 588,
+        "action": "'exec'"
+      },
+      {
+        "handler": "cmd_exec",
+        "line_at_ff1": 611,
+        "action": "'exec'"
+      },
+      {
+        "handler": "cmd_revoke",
+        "line_at_ff1": 742,
+        "action": "'deactivate'"
+      },
+      {
+        "handler": "_cmd_lifecycle_state",
+        "line_at_ff1": 779,
+        "action": "args.operation"
+      },
+      {
+        "handler": "cmd_lifecycle",
+        "line_at_ff1": 847,
+        "action": "args.operation"
+      }
+    ]
+  },
+  "observed_at": "2026-10-16T07:39:19.779929+00:00",
+  "empty_key_template_refuses_before_credential_access": true,
+  "synthetic_key_substitution": false,
+  "network_called_by_template_test": false,
+  "scanner": {
+    "blocked_blob_ids": [],
+    "scanned_blobs": 6,
+    "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+    "scanner_version": "8.30.1",
+    "scope": "changed-staged-blobs",
+    "status": "clean"
+  },
+  "whitespace": "pass"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/README.md
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/README.md
@ -0,0 +1,17 @@
+# Secrets CLI packaging source handoff
+
+Review/apply `implementation-r1.patch` on c80a944. Source/source hashes, exact
+changed paths, scanner and build receipts are in `integration-manifest-r1.json`.
+The implementation delivers the existing wheel and exact producer verifier
+through an explicit reproducible bundle and offline new-prefix installer.
+
+Seven disposable tests pass: two byte-identical builds; clean offline install and
+installed signature boundary; unsigned/missing/tampered refusals; exact reviewed
+manifest, existing-prefix and producer-source-drift refusals. Scanner is clean.
+No test signer is installed. The launcher fixes the bundle helper and validates
+its checksum before CLI import; no runtime compilation or service is added.
+
+Proof bundle is retained under `/tmp/secrets-cli-package-proof`; its exact manifest
+is copied here. Artifact integrity is not independent package admission. No
+production tool, key/trust configuration or backend privilege was changed. Root
+owns canonical integration/consistency; the next strict task handoff is separate.
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/implementation-r1.patch
@ -0,0 +1,502 @@
+diff --git a/README.md b/README.md
+index 922f840..52e3f1e 100644
+--- a/README.md
+++ b/README.md
+@@ -86,3 +86,5 @@ speaks in lanes and guarded plans.
+   not write.
+ - Temporary bootstrap OpenBao credentials must live outside repos, use mode
+   0600, be revocable, and be removed after narrower auth is working.
+
+Packaged CLI deployment uses the reviewed [wheel + verifier bundle](docs/cli-release-bundle.md). A Python wheel alone omits the mandatory signature helper.
+diff --git a/docs/cli-release-bundle.md b/docs/cli-release-bundle.md
+new file mode 100644
+index 0000000..8634eda
+--- /dev/null
+++ b/docs/cli-release-bundle.md
+@@ -0,0 +1,82 @@
+# CLI release bundle with authenticated decision verifier
+
+The supported packaged CLI path is an explicit wheel-plus-verifier bundle. The
+existing editable `uv` workflow remains for development. Installing the Python
+wheel alone omits the Go helper and is incomplete for production authorization;
+it continues to fail closed. This is a CLI package, not a service or the retired
+`rapp-secrets-engine` deployment.
+
+The bundle contains the Secrets wheel, the existing PyYAML runtime wheel pinned
+by `uv.lock`, the verifier executable, producer license attribution, a narrow CLI
+entry point and an offline installer. It never contains the test signer, signing
+seed, caller credential, runtime trust/key config or backend entitlement. Optional
+`clock` extras are outside this base bundle; configuring clock trust without the
+separately reviewed extra continues to refuse, rather than fall back.
+
+## Build
+
+Use Python >=3.11, uv and the Go toolchain required by `verifier/go.mod` on the
+intended Linux architecture. Supply a local compatible PyYAML wheel whose exact
+filename and SHA-256 appear in `uv.lock`. The builder never discovers/downloads a
+runtime dependency. The existing Hatchling build backend is now version-pinned.
+
+```bash
+python3 scripts/build_release_bundle.py \
+  --output /tmp/secrets-cli-reviewed-build \
+  --dependency-wheel /path/to/locked-compatible-pyyaml.whl
+```
+
+Builds are offline by default. In a reviewed build environment, the explicit
+`--allow-build-downloads` flag permits uv to fetch the existing pinned build
+backend and its build dependencies. It does not change the runtime dependency
+contract. Set writable uv/Go caches as required by that build environment.
+
+The builder first verifies the exact producer API/signature source and native
+fixture hashes, builds only the verifier root package with CGO disabled, explicit
+host architecture, trimmed paths, disabled VCS stamping and an empty build ID,
+then builds the wheel with commit-derived `SOURCE_DATE_EPOCH`. Two builds using
+the same source snapshot/toolchain/dependency wheel produce matching artifacts
+and manifest. The manifest records exact source-file and artifact SHA-256s, base
+commit, producer snapshot, platform and tool versions. It contains no observed
+build timestamp; retain observed execution time in a separate receipt.
+
+## Review and offline install
+
+**Checksums prove artifact integrity, not independent package admission.** The
+owner must review/admit the source, toolchain, complete bundle and manifest hash,
+and control the bundle/install prefix. A manifest obtained from an untrusted
+bundle does not establish that admission. Key/trust admission remains a distinct
+WP14 gate. None of these steps authorizes protected OpenBao work.
+
+Execute the reviewed installer with the independently retained manifest digest:
+
+```bash
+python3 /path/to/reviewed-bundle/install.py \
+  --prefix /path/to/new-owner-controlled-prefix \
+  --manifest-sha256 REVIEWED_MANIFEST_SHA256
+/path/to/new-owner-controlled-prefix/bin/secrets-engine --help
+```
+
+The parent directory must already be owner controlled. The installer validates
+platform, manifest and the entire artifact set before creating a private new
+prefix, creates its venv through the existing uv convention, and installs entirely
+offline from bundled wheels. It never replaces an existing prefix or installs
+into standard user/system tools. A failed partial prefix is retained and marked;
+retry with a new prefix after diagnosis. Removing a failed/disposable prefix is
+an explicit owner operation, not an automatic cleanup of an existing path.
+
+Use `PREFIX/bin/secrets-engine` as the admitted CLI entry point. It checks the
+bundled helper's SHA-256 before CLI import or credential access and fixes
+`SECRETS_ENGINE_PDP_VERIFIER` to that helper; ambient executable overrides do not
+select another verifier. Missing or changed helpers refuse. There is no runtime
+compilation or unsigned fallback. The internal venv scripts/programmatic API are
+not a second admitted entry point and do not create package/trust admission.
+Catalog/policy and independently reviewed responder trust configuration still
+belong to the deploying owner. Neither is silently copied from a developer repo.
+
+For source verification, supply `SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL` and run
+`pytest tests/test_release_bundle.py`. The disposable proof compares two builds,
+installs offline, invokes the installed wheel's signed HTTP boundary with public
+synthetic fixtures, rejects unsigned decisions, checks helper/bundle tampering,
+source drift and existing-prefix refusal. No native credentials or protected
+backend are involved.
+diff --git a/pyproject.toml b/pyproject.toml
+index fd25de6..aa74fda 100644
+--- a/pyproject.toml
+++ b/pyproject.toml
+@@ -20,7 +20,7 @@ dev = [
+ secrets-engine = "secrets_engine.cli:main"
+ 
+ [build-system]
+-requires = ["hatchling"]
+requires = ["hatchling==1.27.0"]
+ build-backend = "hatchling.build"
+ 
+ [tool.hatch.build.targets.wheel]
+diff --git a/scripts/build_release_bundle.py b/scripts/build_release_bundle.py
+new file mode 100644
+index 0000000..7f8f0df
+--- /dev/null
+++ b/scripts/build_release_bundle.py
+@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Build wheel + pinned producer verifier; install is a separate reviewed step."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+import tomllib
+
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def run(command, **kwargs):
+    return subprocess.check_output(command,text=True,**kwargs).strip()
+
+
+def build(root, output, dependency_wheel, uv, allow_build_downloads=False):
+    if platform.system() != 'Linux':
+        raise ValueError('this bundle supports Linux CLI only')
+    # No discovered keys, source rewriting, or runtime compilation.
+    subprocess.run([sys.executable,str(root/'scripts/check_pdp_producer_source.py')],check=True,stdout=sys.stderr)
+    locked=next(p for p in tomllib.loads((root/'uv.lock').read_text())['package'] if p['name']=='pyyaml')
+    admitted={Path(item['url']).name:item['hash'].removeprefix('sha256:') for item in locked['wheels']}
+    if dependency_wheel.name not in admitted or digest(dependency_wheel)!=admitted[dependency_wheel.name]:
+        raise ValueError('supplied PyYAML wheel does not match uv.lock')
+    output.mkdir(mode=0o700,parents=False,exist_ok=False)
+    epoch=run(['git','log','-1','--format=%ct'],cwd=root)
+    commit=run(['git','rev-parse','HEAD'],cwd=root)
+    architecture={'x86_64':'amd64','aarch64':'arm64'}.get(platform.machine())
+    if architecture is None:
+        raise ValueError('unsupported Linux architecture')
+    env={**os.environ,'CGO_ENABLED':'0','GOOS':'linux','GOARCH':architecture,
+         'GOFLAGS':'','GOWORK':'off','SOURCE_DATE_EPOCH':epoch}
+    (output/'bin').mkdir();(output/'wheels').mkdir()
+    subprocess.run(['go','build','-trimpath','-buildvcs=false','-ldflags=-buildid=',
+                    '-o',str(output/'bin/secrets-engine-pdp-verify'),'.'],cwd=root/'verifier',env=env,check=True)
+    command=[uv,'--no-config','build','--wheel','--out-dir',str(output/'wheels'),str(root)]
+    if not allow_build_downloads:command.append('--offline')
+    subprocess.run(command,env=env,check=True)
+    wheel,=list((output/'wheels').glob('secrets_engine-*.whl'))
+    shutil.copyfile(dependency_wheel,output/'wheels'/dependency_wheel.name)
+    helper_hash=digest(output/'bin/secrets-engine-pdp-verify')
+    launcher=(root/'scripts/release_cli.py').read_text().replace('@HELPER_SHA256@',helper_hash)
+    (output/'release_cli.py').write_text(launcher)
+    shutil.copyfile(root/'scripts/install_release_bundle.py',output/'install.py')
+    shutil.copyfile(root/'verifier/LICENSE.access-engine',output/'LICENSE.access-engine')
+    sources=[root/'pyproject.toml',root/'uv.lock',root/'verifier/producer-source.json']
+    sources+=list((root/'src/secrets_engine').glob('*.py'))
+    sources+=list((root/'verifier/pkg/api').glob('*.go'))+list((root/'verifier/internal/sign').glob('*.go'))
+    sources+=[root/'verifier/main.go',root/'scripts/check_pdp_producer_source.py',
+              root/'scripts/build_release_bundle.py',root/'scripts/install_release_bundle.py',root/'scripts/release_cli.py']
+    source_hashes={str(path.relative_to(root)):digest(path) for path in sorted(sources)}
+    manifest={"schema":"secrets-engine.cli-bundle.v1","source_commit":commit,"source_files":source_hashes,
+              "source_date_epoch":int(epoch),"system":platform.system(),"machine":platform.machine(),
+              "python":platform.python_version(),"go":run(['go','version']),"uv":run([uv,'--version']),
+              "build_backend":"hatchling==1.27.0","wheel":str(wheel.relative_to(output)),
+              "producer":json.loads((root/'verifier/producer-source.json').read_text()),
+              "artifacts":{str(path.relative_to(output)):digest(path) for path in sorted(output.rglob('*')) if path.is_file()},
+              "admission":"checksums are integrity evidence; owner must admit the bundle/prefix independently"}
+    (output/'manifest.json').write_text(json.dumps(manifest,sort_keys=True,indent=2)+'\n')
+    return {'bundle':str(output),'manifest_sha256':digest(output/'manifest.json'),'helper_sha256':helper_hash}
+
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output',type=Path,required=True)
+    parser.add_argument('--dependency-wheel',type=Path,required=True)
+    parser.add_argument('--uv',default='uv')
+    parser.add_argument('--allow-build-downloads',action='store_true',help='permit uv to fetch existing build-system dependencies')
+    args=parser.parse_args()
+    try:
+        print(json.dumps(build(Path(__file__).resolve().parents[1],args.output.resolve(),args.dependency_wheel.resolve(),
+                               args.uv,args.allow_build_downloads),sort_keys=True))
+    except (OSError,ValueError,KeyError,subprocess.SubprocessError) as exc:
+        print('bundle build refused: '+str(exc),file=sys.stderr);return 1
+    return 0
+
+
+if __name__=='__main__':
+    raise SystemExit(main())
+diff --git a/scripts/install_release_bundle.py b/scripts/install_release_bundle.py
+new file mode 100644
+index 0000000..9d718fc
+--- /dev/null
+++ b/scripts/install_release_bundle.py
+@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Install one reviewed CLI bundle offline into a new owner-controlled prefix."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def install(bundle, prefix, expected_manifest, python, uv):
+    manifest_path = bundle / "manifest.json"
+    if digest(manifest_path) != expected_manifest:
+        raise ValueError("bundle manifest differs from reviewed digest")
+    manifest = json.loads(manifest_path.read_text())
+    if manifest["schema"] != "secrets-engine.cli-bundle.v1":
+        raise ValueError("unsupported bundle")
+    if manifest['system'] != platform.system() or manifest['machine'] != platform.machine():
+        raise ValueError("bundle platform differs from installer host")
+    expected_files = set(manifest['artifacts']) | {'manifest.json'}
+    actual_files = {str(p.relative_to(bundle)) for p in bundle.rglob('*') if p.is_file()}
+    if actual_files != expected_files:
+        raise ValueError("bundle file set differs")
+    for name, expected in manifest['artifacts'].items():
+        relative = Path(name)
+        if relative.is_absolute() or '..' in relative.parts:
+            raise ValueError("invalid artifact path")
+        artifact = bundle / relative
+        if any(parent.is_symlink() for parent in (artifact,*artifact.parents)) or digest(artifact) != expected:
+            raise ValueError("bundle artifact missing or changed")
+    # Reserve once; never replace an installed prefix or follow an existing link.
+    prefix.mkdir(mode=0o700, parents=False, exist_ok=False)
+    try:
+        subprocess.run([uv,'--no-config','venv','--python',python,'--no-python-downloads',str(prefix/'venv')],check=True)
+        subprocess.run([uv,'--no-config','pip','install','--python',str(prefix/'venv/bin/python'),
+                        '--no-index','--find-links',str(bundle/'wheels'),str(bundle/manifest['wheel'])],check=True)
+        (prefix/'libexec').mkdir(mode=0o700)
+        helper=prefix/'libexec/secrets-engine-pdp-verify'
+        shutil.copyfile(bundle/'bin/secrets-engine-pdp-verify',helper);helper.chmod(0o700)
+        (prefix/'bin').mkdir(mode=0o700)
+        launcher=prefix/'bin/secrets-engine'
+        # An absolute venv interpreter fixes the installed dependency environment.
+        launcher.write_text('#!'+str(prefix/'venv/bin/python')+'\n'+(bundle/'release_cli.py').read_text())
+        launcher.chmod(0o700)
+        receipt={"schema":"secrets-engine.cli-install.v1","manifest_sha256":expected_manifest,
+                 "helper_sha256":digest(helper),"launcher_sha256":digest(launcher),"prefix":str(prefix),
+                 "admission":"artifact integrity only; trust and keys not admitted"}
+        (prefix/'install-receipt.json').write_text(json.dumps(receipt,sort_keys=True,indent=2)+'\n')
+        return receipt
+    except BaseException:
+        # Preserve a failed prefix as evidence; never retry into a partial install.
+        (prefix/'INSTALL-FAILED').write_text('Incomplete installation; use a new prefix.\n')
+        raise
+
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--bundle',type=Path,default=Path(__file__).resolve().parent)
+    parser.add_argument('--prefix',type=Path,required=True)
+    parser.add_argument('--manifest-sha256',required=True)
+    parser.add_argument('--python',default=sys.executable)
+    parser.add_argument('--uv',default='uv')
+    args=parser.parse_args()
+    try:
+        if not args.prefix.is_absolute() or args.prefix.parent.is_symlink():
+            raise ValueError('prefix must be absolute with an admitted parent')
+        receipt=install(args.bundle.resolve(),args.prefix,args.manifest_sha256,args.python,args.uv)
+        print(json.dumps(receipt,sort_keys=True))
+    except (OSError,ValueError,KeyError,subprocess.SubprocessError) as exc:
+        print('bundle install refused: '+str(exc),file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__=='__main__':
+    raise SystemExit(main())
+diff --git a/scripts/release_cli.py b/scripts/release_cli.py
+new file mode 100644
+index 0000000..c7a2d08
+--- /dev/null
+++ b/scripts/release_cli.py
+@@ -0,0 +1,29 @@
+"""Narrow installed CLI entry point; rendered by build_release_bundle.py."""
+import hashlib
+import os
+from pathlib import Path
+import sys
+
+EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@"
+
+
+def main():
+    prefix = Path(__file__).resolve().parent.parent
+    helper = prefix / "libexec" / "secrets-engine-pdp-verify"
+    try:
+        if helper.is_symlink() or not helper.is_file():
+            raise ValueError("missing helper")
+        if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256:
+            raise ValueError("changed helper")
+    except (OSError, ValueError):
+        print("secrets-engine: installed verifier missing or changed", file=sys.stderr)
+        return 1
+    # The bundle always uses its reviewed helper; ambient overrides do not select
+    # another executable. The owner admits runtime trust separately.
+    os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper)
+    from secrets_engine.cli import main as cli_main
+    return cli_main()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+diff --git a/tests/test_release_bundle.py b/tests/test_release_bundle.py
+new file mode 100644
+index 0000000..c481cd5
+--- /dev/null
+++ b/tests/test_release_bundle.py
+@@ -0,0 +1,137 @@
+"""Actual offline installation proof; only supplied locked public dependency wheel.
+
+Set SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL to a local PyYAML wheel from uv.lock.
+No production install, trust admission, backend or credential is used.
+"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+
+import pytest
+
+from tests.test_decision_signature import FIXTURE, PUBLIC
+from tests.test_decision_transport import server
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def run(command, **kwargs):
+    return subprocess.run(command, text=True, capture_output=True, timeout=120, **kwargs)
+
+
+@pytest.fixture(scope='module')
+def bundles(tmp_path_factory):
+    dependency=os.environ.get('SECRETS_ENGINE_TEST_DEPENDENCY_WHEEL')
+    if not dependency:
+        pytest.skip('provide the locked public PyYAML wheel for actual bundle build/install tests')
+    directory=tmp_path_factory.mktemp('cli-bundles')
+    result=[]
+    for name in ['one','two']:
+        bundle=directory/name
+        built=run([sys.executable,str(ROOT/'scripts/build_release_bundle.py'),'--output',str(bundle),
+                   '--dependency-wheel',dependency])
+        assert built.returncode==0,built.stderr
+        result.append(bundle)
+    return result
+
+
+def manifest_hash(bundle):
+    return hashlib.sha256((bundle/'manifest.json').read_bytes()).hexdigest()
+
+
+def install(bundle,prefix):
+    return run([sys.executable,str(bundle/'install.py'),'--bundle',str(bundle),'--prefix',str(prefix),
+                '--manifest-sha256',manifest_hash(bundle)])
+
+
+@pytest.fixture
+def installed(bundles,tmp_path):
+    prefix=tmp_path/'installed'
+    result=install(bundles[0],prefix)
+    assert result.returncode==0,result.stderr
+    return prefix
+
+
+def test_two_builds_match_and_contain_no_signer(bundles):
+    one,two=bundles
+    names={str(path.relative_to(one)) for path in one.rglob('*') if path.is_file()}
+    assert names=={str(path.relative_to(two)) for path in two.rglob('*') if path.is_file()}
+    for name in names:
+        assert (one/name).read_bytes()==(two/name).read_bytes(),name
+    assert not any('signer' in name or 'testsupport' in name for name in names)
+    assert (one/'bin/secrets-engine-pdp-verify').is_file()
+    assert len(list((one/'wheels').glob('secrets_engine-*.whl')))==1
+
+
+def test_clean_install_uses_installed_wheel_and_signed_boundary(installed,tmp_path):
+    env={**os.environ,'SECRETS_ENGINE_PDP_VERIFIER':'/must-not-use-ambient-override'}
+    help_result=run([str(installed/'bin/secrets-engine'),'--help'],env=env,cwd='/tmp')
+    assert help_result.returncode==0,help_result.stderr
+    envelope=json.loads(FIXTURE.read_bytes())
+    trust={name:envelope['provenance'][name] for name in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
+    trust.update(schema='secrets-engine.pdp-trust.v1',keys={'testdata-ed25519':PUBLIC})
+    trust_file=tmp_path/'synthetic-trust.json';trust_file.write_text(json.dumps(trust))
+    token=tmp_path/'synthetic.token';token.write_text('synthetic-pdp-credential');token.chmod(0o600)
+    script='''import pathlib,sys
+import secrets_engine.decision_check as installed
+from secrets_engine.errors import DecisionError
+assert str(pathlib.Path(installed.__file__).resolve()).startswith(sys.argv[1]+'/venv/')
+try:
+ result=installed.check_decision(base_url=sys.argv[2],token_file=pathlib.Path(sys.argv[3]),request={},trust_file=pathlib.Path(sys.argv[4]),verifier=pathlib.Path(sys.argv[1]+'/libexec/secrets-engine-pdp-verify'))
+except DecisionError:
+ if sys.argv[5]=='refuse':sys.exit(0)
+ raise
+assert sys.argv[5]=='accept' and result['effect']=='allow'
+'''
+    clean_env={key:value for key,value in os.environ.items() if key not in ('PYTHONPATH','PYTHONHOME')}
+    for body,expect in [(FIXTURE.read_bytes(),'accept'),(b'{"effect":"allow"}','refuse')]:
+        with server(body=body) as (origin,seen):
+            result=run([str(installed/'venv/bin/python'),'-c',script,str(installed),origin,str(token),str(trust_file),expect],env=clean_env,cwd='/tmp')
+            assert result.returncode==0,result.stderr
+            assert seen==[True]
+
+
+@pytest.mark.parametrize('change',['missing','tampered'])
+def test_installed_cli_refuses_missing_or_tampered_helper(installed,change):
+    helper=installed/'libexec/secrets-engine-pdp-verify'
+    if change=='missing':helper.rename(helper.with_suffix('.held'))
+    else:helper.write_bytes(helper.read_bytes()+b'tampered')
+    result=run([str(installed/'bin/secrets-engine'),'--help'],cwd='/tmp')
+    assert result.returncode==1
+    assert 'verifier missing or changed' in result.stderr
+    assert not result.stdout
+
+
+def test_installer_refuses_changed_artifact_and_existing_prefix(bundles,tmp_path):
+    altered=tmp_path/'altered';shutil.copytree(bundles[0],altered)
+    helper=altered/'bin/secrets-engine-pdp-verify';helper.write_bytes(helper.read_bytes()+b'tampered')
+    prefix=tmp_path/'must-not-create'
+    result=install(altered,prefix)
+    assert result.returncode==1 and not prefix.exists()
+    existing=tmp_path/'existing';existing.mkdir();marker=existing/'keep';marker.write_text('unchanged')
+    result=install(bundles[0],existing)
+    assert result.returncode==1 and marker.read_text()=='unchanged'
+    assert sorted(path.name for path in existing.iterdir())==['keep']
+
+
+def test_installer_requires_exact_reviewed_manifest(bundles,tmp_path):
+    prefix=tmp_path/'must-not-create'
+    result=run([sys.executable,str(bundles[0]/'install.py'),'--prefix',str(prefix),'--manifest-sha256','0'*64])
+    assert result.returncode==1 and not prefix.exists()
+
+
+def test_changed_producer_source_stops_before_build(tmp_path):
+    root=tmp_path/'source';(root/'scripts').mkdir(parents=True)
+    for name in ['build_release_bundle.py','check_pdp_producer_source.py']:
+        shutil.copyfile(ROOT/'scripts'/name,root/'scripts'/name)
+    shutil.copytree(ROOT/'verifier',root/'verifier')
+    shutil.copytree(ROOT/'tests/fixtures/pdp-signature',root/'tests/fixtures/pdp-signature')
+    source=root/'verifier/internal/sign/sign.go';source.write_bytes(source.read_bytes()+b'// drift\n')
+    output=tmp_path/'must-not-build'
+    result=run([sys.executable,str(root/'scripts/build_release_bundle.py'),'--output',str(output),
+                '--dependency-wheel',str(tmp_path/'not-reached.whl')])
+    assert result.returncode==1 and not output.exists()
+diff --git a/verifier/README.md b/verifier/README.md
+index 073cace..a63b2a0 100644
+--- a/verifier/README.md
+++ b/verifier/README.md
+@@ -28,3 +28,8 @@ The Check API defaults to mandatory authentication. Its deliberately named
+ `allow_unsigned_test_fixture` argument is used only by synthetic transport tests;
+ production `authorize_action` never passes it. The helper runs with an empty
+ environment, so ambient backend and identity credentials cannot reach it.
+
+For the complete reproducible CLI build and offline fresh-prefix installation,
+use [the release bundle contract](../docs/cli-release-bundle.md). This replaces
+manual helper copying for packaged deployments; package and key admission remain
+separate owner decisions.
+diff --git a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+index a3e55a9..886a0f6 100644
+--- a/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+++ b/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md
+@@ -77,6 +77,15 @@ key admission remains part of its scope; T03 stays wait. WP13 execution and
+ identity-only CCR38 are unchanged. Custodian source/verification handoff:
+ `docs/changes/netkingdom-target-2026-10-16/decision-auth/` in the Custodian repo.
+ 
+2026-10-16 packaging preparation: `scripts/build_release_bundle.py` and its
+separate offline installer deliver the existing wheel plus the reviewed producer
+verifier together into a new owner-controlled prefix. Source/hash drift checks,
+artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent
+wheel-only deployment gap. Disposable build/install tests prove deterministic
+artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do
+not admit packages, keys or a production prefix. T02 remains progress and T03
+wait; no native installation, trust change or protected entitlement is claimed.
+
+ ## Verify the admitted native consumer and rotation path
+ 
+ ```task
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/original-owner-dirty.patch
@ -0,0 +1,96 @@
+diff --git a/.custodian-brief.md b/.custodian-brief.md
+index 0cb912a..ba794c8 100644
+--- a/.custodian-brief.md
+++ b/.custodian-brief.md
+@@ -2,7 +2,7 @@
+ # Custodian Brief — secrets-engine
+ 
+ **Domain:** infotech  
+-**Last synced:** 2026-10-11 17:52 UTC  
+**Last synced:** 2026-10-16 05:55 UTC  
+ **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+ 
+ ## Active Workstreams
+@@ -11,8 +11,24 @@
+ Progress: 1/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
+ 
+ **Open tasks:**
+- ! Define the exact mediated execution contract  `b2f0d462`
+  *(wait: Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred.)*
+ - ! Implement and prove one native metadata action  `5f8f7c41`
+-- ► Define the exact mediated execution contract  `b2f0d462`
+
+### Constrain PDP transport and authenticate decision responses
+Progress: 1/3 done  |  workplan_id: `7252469d-d7a5-5c18-8911-b511b8c6a736`
+
+**Open tasks:**
+- ! Verify the admitted native consumer and rotation path  `85aa4c78`
+  *(wait: Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet.)*
+- ► Implement independently anchored responder authentication  `877782e5`
+
+### Production-safe provisioning, authorization, and lifecycle hardening
+Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+
+**Open tasks:**
+- ! Resume native production lane adoption  `a0a1dd92`
+  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+ 
+ ### Activate native Claude credential delivery for Glas
+ Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
+@@ -26,27 +42,20 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
+ 
+ **Open tasks:**
+ - ! Stage live apply and verification  `fb103f1e`
+-  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
+  *(wait: Owner work first: publish a reviewed scoped-apply command per lane. Per-lane approvals are no longer needed (D1 standing rule); each lane with a command enters the attended window.)*
+ - ! Reconcile routing ownership and retire interim proxies  `1431edae`
+   *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
+ 
+-### Production-safe provisioning, authorization, and lifecycle hardening
+-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+-
+-**Open tasks:**
+-- ! Resume native production lane adoption  `a0a1dd92`
+-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+-
+ ### Evolve the Lifecycle engine to the accepted security layer model
+ Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+ 
+ **Open tasks:**
+ - ! No standing engine credential  `d7bc8bdc`
+-  *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)*
+  *(wait: Published JWT contract and positive login/revocation are delivered. Native KEY-WP-0039-T02 claim negatives, CCR-2026-0038 effective-policy/capability/expiry/use checks and MASON-WP-0009-T05 remain. Login-self-only grants no protected-operation authority: agree and implement separately reviewed task-scoped backend execution entitlement, then prove functional steady-state service-identity adoption without bootstrap/env fallback.)*
+ 
+ ## Inbox Hygiene
+ 
+-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
+**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
+ **Missing thread_id:** 2 unread message(s) lack supersession chains.
+ 
+ ---
+diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
+index 70e5831..4d1cfb6 100644
+--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
+@@ -22,6 +22,7 @@
+ | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md |
+ | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md |
+ | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
+ | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md |
+@@ -83,9 +84,12 @@
+ | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+ | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md |
+-| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+ | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md |
+| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md |
+ | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md |
+ | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/proof-build-r1.json
@ -0,0 +1 @@
+{"bundle": "/tmp/secrets-cli-package-proof", "helper_sha256": "a6e4eeb5361c61a2db5526ba5648ef5e48143c1a453e158d2f62991ba7ba3a33", "manifest_sha256": "aa8e54a3c6ee903e2a9048c4d186b08f37a006fe6f74926a9ea4a1e6bda8bc3d"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/scanner-r1.json
@ -0,0 +1 @@
+{"blocked_blob_ids": [], "scanned_blobs": 9, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-package/source-provenance.json
@ -0,0 +1,8 @@
+{
+  "owner": "secrets-engine",
+  "base_commit": "c80a944105a00220cd3c1a007709e72d830dd08d",
+  "dirty_metadata_sha256": "a5ef64f28f7c30e7b71a8f26160e820dfa809407d8cc21336032c61fed70c4c5",
+  "status": "M  .custodian-brief.md\n M WORK-RECORDS.md\n",
+  "isolated_source": "/tmp/netkingdom-secrets-decision-package",
+  "original_metadata_not_overlaid": "No relevant dirty source; only existing generated brief/work-record metadata. Canonical checkout not modified."
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-drift-test-r4.txt
@ -0,0 +1,9 @@
+Traceback (most recent call last):
+  File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-registry-smoke-r4.py", line 168, in <module>
+    consumption=consume_task_execution(cfg,authorization)
+                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+  File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 277, in consume_task_execution
+    _refuse()
+  File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 35, in _refuse
+    raise DecisionError('strict task execution handoff correspondence refused')
+secrets_engine.errors.DecisionError: strict task execution handoff correspondence refused
--- a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/claimfree-request.json
@ -0,0 +1,130 @@
+{
+  "action": "execute-ccr",
+  "context": {
+    "catalog_target": {
+      "auth_capability": {},
+      "consumers": [
+        {
+          "auth": "approle",
+          "claim": "role:c",
+          "name": "c"
+        }
+      ],
+      "delivery_auth": {
+        "management": "engine",
+        "method": "approle"
+      },
+      "delivery_config": {},
+      "delivery_modes": [
+        "exec-env"
+      ],
+      "fields": [
+        "api_token"
+      ],
+      "kind": "kv",
+      "mount": "secret",
+      "mount_management": "engine",
+      "org": "coulomb",
+      "path": "test/team/thing",
+      "repo": "team-repo",
+      "workload_delivery": []
+    },
+    "execution_contract": {
+      "backend_budget": {
+        "ttl_seconds": 30,
+        "uses": 12
+      },
+      "backend_origin": "http://127.0.0.1:18200",
+      "catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
+      "ccr_id": "CCR-2099-0001",
+      "ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "cluster_uid": "test-estate-not-live",
+      "contract_version": "SECRETS-EXEC-20261011-v1",
+      "execution_actor": "service:secrets-engine",
+      "execution_grant_ccr_id": "CCR-2099-0002",
+      "expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "operation": "metadata-apply-ccr",
+      "operation_deadline": "2026-10-16T15:06:43+00:00",
+      "operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
+      "operations": [
+        {
+          "method": "GET",
+          "path": "sys/policies/acl/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "method": "PUT",
+          "path": "sys/policies/acl/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "method": "GET",
+          "path": "sys/policies/acl/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "method": "GET",
+          "path": "auth/synthetic/role/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "method": "PUT",
+          "path": "auth/synthetic/role/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        {
+          "method": "GET",
+          "path": "auth/synthetic/role/synthetic",
+          "payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        }
+      ],
+      "source_bundle": {
+        "engine_dispatcher": {
+          "path": "/owner/engine_dispatcher.py",
+          "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        "platform_mediator": {
+          "path": "/owner/platform_mediator.py",
+          "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        "policy_auth": {
+          "path": "/owner/policy_auth.py",
+          "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        "typed_ccr": {
+          "path": "/owner/typed_ccr.py",
+          "sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        }
+      }
+    },
+    "human_control": true,
+    "purpose": "metadata-test",
+    "service_actor_binding": {
+      "subject_id": "secrets-engine",
+      "subject_type": "service",
+      "tenant": "tenant:platform",
+      "transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
+      "version": "proposed-service-task-caller/v1"
+    }
+  },
+  "resource": {
+    "attributes": {
+      "auth_targets": [],
+      "fields": [],
+      "policy_targets": [],
+      "stage": "prod"
+    },
+    "id": "catalog:test-lane",
+    "system": "secrets-engine",
+    "tenant": "tenant:platform",
+    "type": "secret-catalog-lane"
+  },
+  "subject": {
+    "id": "secrets-engine",
+    "tenant": "tenant:platform",
+    "type": "service"
+  },
+  "tenant": "tenant:platform"
+}
--- a/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json
+++ b/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-retained-final-r4/consumption-confirmation.json
@ -0,0 +1,6 @@
+{
+  "approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
+  "request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645",
+  "decision_id": "decision:9da2b8442a192d6d",
+  "consumed_at": "2026-10-16T15:05:44.235319+00:00"
+}
				`@ -0,0 +1 @@`
				`{"blocked_blob_ids": [], "scanned_blobs": 24, "scanner_sha256": "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509", "scanner_version": "8.30.1", "scope": "changed-staged-blobs", "status": "clean"}`
				`@ -0,0 +1 @@`
				`empty unadmitted trust refuses before caller read/network`
				`@ -0,0 +1 @@`
				`{"bundle": "/tmp/secrets-cli-package-proof", "helper_sha256": "a6e4eeb5361c61a2db5526ba5648ef5e48143c1a453e158d2f62991ba7ba3a33", "manifest_sha256": "aa8e54a3c6ee903e2a9048c4d186b08f37a006fe6f74926a9ea4a1e6bda8bc3d"}`