Isolate tenant readback cache and prepare verified runtime release

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

workplans/ADHOC-2026-10-11.md

@@ -0,0 +1,30 @@
+---
+id: USER-WP-ADHOC-2026-10-11
+type: workplan
+title: "Refresh vulnerable readback candidate runtime base"
+domain: communication
+repo: user-engine
+status: finished
+flavor: implementation
+owner: codex
+topic_slug: user-engine
+created: "2026-10-11"
+updated: "2026-10-11"
+---
+
+## Refresh immutable Python patch base and verify exact application preservation
+
+```task
+id: USER-WP-ADHOC-2026-10-11-T01
+status: done
+priority: high
+```
+
+Replace only the Containerfile base digest with the current official Python 3.12
+index; retain exact application bytes and resolved Python dependency versions.
+The bounded local candidate removes all 3 CRITICAL and44 of 88 HIGH OS findings.
+Retain remaining 44 unfixed HIGH findings in the unfiltered fresh scan. Exact
+source/image/provenance checks and 20 image / 323 source tests pass. Evidence:
+`docs/evidence/2026-10-11-runtime-base-refresh.md`. This source remediation
+finishes no deployment: USER-WP-0026-T03 and USER-WP-0028-T02 retain native
+consumer acceptance, clean source commit/publication and scoped rollout gates.

workplans/USER-WP-0026-account-recovery.md

@@ -62,8 +62,8 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
 ```task
 id: USER-WP-0026-T03
 status: wait
-blocked_on: message-from:access-engine
-blocking_reason: "Needs access-engine's per-identity decision/grant/revocation/readback contract and a readable protected-system registry (with key-cape client binding) as the workload catalogue; the membership store cannot represent the allow list."
+blocked_on: message-from:rapp-user-engine
+blocking_reason: "FLEX-WP-0035-T04 delivered the admitted readback pin on 2026-10-10. Needs rapp-user-engine readback URL, separate projected caller token and exact-pin egress, an image containing the readback client, and native consumer allow/deny/unavailable acceptance against the live pin."
 priority: high
 state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
 ```
@@ -147,3 +147,21 @@ despite its `message-from:net-kingdom` qualifier (added 2026-09-28). Sent one
 now (message `db1b7d6e`): does NetKingdom own the workload catalogue/admission
 record and the scoped access-decision contract, and if not, who does. The
 qualifier stays on net-kingdom until it answers or names another owner.
+
+2026-10-10 security consolidation review: FLEX-WP-0035-T04 is done. Its founder-run
+Helm upgrades placed lifecycle v2 and application-readback on image e8c57c18;
+Ready and anonymous 401/non-enforcement 404 checks passed. Those provider
+receipts do not establish user-engine caller acceptance. The canonical apply
+home, rapp-user-engine/manifests/runtime.yaml, currently has no readback URL
+or dedicated projected-token mount and permits flex-auth egress only to the
+enforcement pin. Remaining owner work: wire USER_ENGINE_READBACK_URL and
+USER_ENGINE_READBACK_TOKEN_FILE to a separate audience flex-auth projection,
+permit only the application-readback pod selector, promote the immutable image
+containing this client, and verify native consumer readback without disclosing
+a token. Reuse that acceptance for USER-WP-0028-T02; it is the same integration
+boundary. No grant, browser acceptance or live deployment is inferred here.
+
+The local readback cache now binds each row set to tenant as well as session,
+issuer and subject. A tenant switch within the same session therefore performs
+a fresh read instead of displaying another tenant's unexpired allow. A focused
+regression exercises an allow in tenant-a followed by a deny in tenant-b.