the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-auth

Secrets Engine responder authentication source handoff

Apply/review implementation-r2.patch using integration-manifest.json and source-provenance.json. R1 is retained unchanged for audit; its initial fixture failures and subsequent fixes are in the retained logs. Original dirty patches are provenance only and must not be applied as implementation.

R2 makes the actual production Check/authorization path require independently admitted Ed25519 keys, exact signed evaluator/mode and policy pin/artifact digest. It processes original response bytes using unchanged pinned Access Engine Go producer types/verifier, then consumes only the authenticated typed output. Unsigned/forged/tampered/downgraded responses refuse. The default Check API is also authenticated; synthetic transport tests explicitly name their opt-out. The subprocess receives an empty environment. Existing request/claim/lifetime/CAS bindings stay enforced; native Go signing drives the migrated consumer tests.

Verification: 158 focused pass; full suite 685 pass/16 fail/1 skip. All sixteen failure ids exactly match untouched canonical baseline failures caused by the sandbox temporary-path ownership check. verification-r2.json retains the exact comparison. No source guard was weakened to make that environment pass.

Deployment must separately install the reviewed Go helper; a Python wheel alone is insufficient. Key admission/rotation and native rollout still require exact owner review and authorization. No production keys, credentials, backend rights, CCR38 scope or trust settings were changed. WP14 T02 remains progress and T03 wait. WP13 and its native acceptance are unchanged. Root performs canonical integration and consistency sync; this worker changed only isolated source and the Custodian handoff artifacts.