Prepare custody observation adapter pending authenticated owner delivery

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

workplans/USER-WP-0037-hub-authority-lookup.md

@@ -49,10 +49,9 @@ production deployment was added. T02/T03 retain those outstanding owner gates.
 ```task
 id: USER-WP-0037-T02
 status: wait
-depends_on: [NK-WP-0045-T01, NK-WP-0045-T04]
-needs_human: true
-decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
-blocking_reason: "Mapping specified in proposed NK-ADR-0017; awaits founder acceptance (NK-WP-0045-T01) and the custody-record read surface (NK-WP-0045-T04)."
+depends_on: [NK-WP-0045-T05]
+blocked_on: repo:railiance-platform
+blocking_reason: "ADR and OpenBao design approved; awaits NK-WP-0045-T05 authenticated delivery plus consumer identity admission, durable baseline, canon policy packaging and live mapping/integration receipts."
 priority: high
 state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
 ```
@@ -85,6 +84,44 @@ accepts or amends NK-ADR-0017) and NK-WP-0045-T04 (read-surface decision), both
 routed to hub decision cef97ccd (packet D10). No code changed: the field is
 added once the read surface exists; until then no root grant is returned.
 
+2026-10-03 source-side progress (handoff `d6efcf93`): added transport-neutral
+`src/user_engine/custody.py`. Injected source binding, owner read timestamp,
+NetKingdom validation/transition/observation policy and atomic persistent baseline
+interfaces; every observation performs a fresh owner read, including writes.
+Read failures, stale/future data, rollback, same-revision mutations and persistence
+conflicts yield no grant. Empty/revoked revisions retain the monotonic baseline.
+Initial baseline establishment defaults denied and needs an approved bootstrap
+procedure. No runtime binding or AccountAuthority root field is activated.
+
+Approved OpenBao design envelope supplied by railiance-platform is
+`data.data.document` containing the complete canon document. This is compatible
+with the reader seam; the design approval does not establish an authenticated live source. This
+repo contains no Kubernetes deployment/SA identity to use as an admission receipt.
+
+Remaining owner requirements: version-pinned canon policy packaging, bounded
+authenticated reader, atomic durable baseline store with controlled rebootstrap,
+real read identity/provenance and denial/outage/recovery acceptance; then add the
+optional AccountAuthority mapping and downstream integration receipts. T02 remains
+`wait`, workplan remains `blocked`; local fixtures do not establish live delivery.
+
+Founder approval received during this session: ADR-0017 and the proposed
+OpenBao delivery design are approved; NK-WP-0045-T01/T04 no longer block T02.
+This does not authorize live provisioning/deployment or create a custody entry.
+The remaining dependency is NK-WP-0045-T05 owner delivery plus user-engine's
+runtime admission, durable baseline, policy packaging and integration receipts.
+
+Validation: `PYTHONDONTWRITEBYTECODE=1 make test` passed all 284 tests
+(eight optional skips), including seven new cross-repo canon fixture checks;
+layer conformance and `git diff --check` passed. The fixture tests optionally
+load the sibling validator and skip if it or jsonschema is absent; production
+has no dependency on a sibling checkout and no policy loader is configured.
+
+Security orientation: emergent knowledge 0.2.3/start digest
+`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`,
+withheld due to changed informed-decision source. Reviewed current local source
+README plus current NetKingdom companion and custodian build guidance; restricted
+work to offline source/tests, with no authority or live-readiness inference.
+
 ## Authenticated workload transport and private acceptance
 
 ```task