Implement authenticated custody observations and durable root-grant baseline

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

workplans/USER-WP-0037-hub-authority-lookup.md

@@ -51,7 +51,7 @@ id: USER-WP-0037-T02
 status: wait
 depends_on: [NK-WP-0045-T05]
 blocked_on: repo:railiance-platform
-blocking_reason: "ADR and OpenBao design approved; awaits NK-WP-0045-T05 authenticated delivery plus consumer identity admission, durable baseline, canon policy packaging and live mapping/integration receipts."
+blocking_reason: "Consumer transport, durable baseline, pinned canon and optional mapping implemented; awaits NK-WP-0045-T05 real provenance/admission plus owner image promotion, receipt-bound baseline initialization and live integration evidence."
 priority: high
 state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
 ```
@@ -122,6 +122,44 @@ withheld due to changed informed-decision source. Reviewed current local source
 README plus current NetKingdom companion and custodian build guidance; restricted
 work to offline source/tests, with no authority or live-readiness inference.
 
+2026-10-03 continued go-forward implementation: the source is now complete for
+the confirmed OpenBao/Kubernetes interface. Added dedicated projected-JWT login,
+exact-path fresh KV reader (256 KiB; bounded timeout; denied redirects/cache hits;
+safe errors), persistent PostgreSQL baseline compare-and-swap in the existing
+database, optional AccountAuthority.root_grant and disabled-by-default runtime
+configuration. Owner check time is sampled after I/O; returned observation retains
+the canon-derived expires_at. Embedded validator/schema/provenance are pinned to
+NetKingdom `db319335b27b61b855382ee5af5d690f06eeb010`, with schema lookup only
+relocated. No sibling checkout dependency in the runtime.
+
+Confirmed deployment source in `rapp-user-engine/manifests/runtime.yaml`: namespace
+and ServiceAccount user-engine; existing flex-auth audience is not reused. Platform
+agreed dedicated auth/kubernetes role user-engine-root-custody-reader, audience
+openbao, no default policy and 60-second maximum token lifetime. The packaging
+owner prepares the separate projected token and disabled overlay. No live grant,
+credential provisioning or deployment acceptance is inferred from source changes.
+
+`python -m user_engine.custody_bootstrap --expected-sha256 <publisher-digest>` is
+the concrete controlled initialization tool: fresh authenticated read, exact
+source/record binding and validated canonical JSON digest from a reviewed owner
+receipt; initialize absent baseline once, never reset. Restore/source changes
+require external producer audit/high-water reconciliation before reactivation.
+Complete procedures and configuration: `docs/root-custody-runtime.md`.
+
+Validation: full make test passed296 tests (eight optional skips), with layer
+conformance and diff checks passing; isolated disposable
+PostgreSQL16 verified bootstrap CAS, competing-writer conflict and reconnect
+persistence. Wheel build succeeded with embedded policy/schema/provenance. Offline
+integration covers nested data.data.document to serialized AccountAuthority,
+exact source/path/role mapping, post-read timing and emitted expires_at. No live
+OpenBao or production database was accessed by these checks.
+
+Founder reports no existing ceremony record; the approved initial document may
+contain entries[] and therefore no grant. T02 remains wait for authenticated
+publisher receipt (empty no-grant initialization is acceptable), platform reader admission,
+owner image promotion, reviewed baseline initialization and live acceptance.
+USER-WP-0037 stays blocked; T03 retains its independent Hub admission dependency.
+
 ## Authenticated workload transport and private acceptance
 
 ```task