[gael-obin]

A native workload currently receives only its host-audience credential. A second verifier cannot authenticate that workload under its own audience, even though Core already supports issuing and attesting such credentials. This adds explicit native projection/verifier declarations to the existing environment and launcher.

Draft prerequisite, not a completed consumer rollout. The intended Accounts-to-policy-log consumer is not implemented or qualified by this PR. The new declaration/carrier needs owner contract review and independent first-use/integration evidence before readiness.

Change and ownership

• native-identity selects composed workloads and audiences through the existing resolved inventory. Only declared verifier recipients receive the native run anchor; each workload receives only its audience-to-file mapping. The existing host carrier/path remains compatible.
• Core still owns issuance, signature, attestation, lifetime and atomic private file writes. CLI caches and refreshes projections by workload/audience, using those existing APIs. No Core wire change, issuer implementation or application grant is added.
• Explicit recipients refuse incompatible deployed, container or remote execution. Invalid/unknown declarations and conflicting carriers fail visibly.
• Stop/withdrawal/shutdown retire all audience registrations, retain failed file removals for retry, and preserve host manifest withdrawal independently of cleanup errors. Confirmed process stops are distinguished from failed stop RPCs so reconciliation gets every stopped workload.

File removal prevents further refresh; copied tokens remain usable until their existing expiry. Native mode retains the existing same-user laptop trust boundary and does not claim hostile-process isolation.

Current owner work

Based on main ba55a971, including per-key secret stores; those tests pass on the combined tree. Main subsequently advanced to 8ba93fff solely for v0.1.198 metadata in pkg/cli/info.yaml; it changes no reviewed behavior and does not supersede this fix. Work Context key-set serving supplies a different capability and remains unmerged: its authority.Close must be preserved alongside credential cleanup when integrated, followed by combined lifecycle verification. Neither change replaces this projection gap.

Verification

• GOWORK=off go test -race ./pkg/run/identity ./pkg/environments ./cmd/run ./pkg/orchestration ./pkg/gitops passed.
• GOWORK=off go vet for the same five packages and go build ./cmd/codefly passed.
• Independent platform/elegance follow-up verified tree 7e139393c1ce26af5832f09d57187b83ef2cea60. The integrated Flow→Manager→Runner withdrawal regression fails against the previous implementation and passes here. Other focused regressions cover wrong audiences, refresh, recipient isolation, graceful shutdown, cleanup retry, stop/restart through a local gRPC peer and remote refusal.
• No installed binary, product service restart, cloud resource, database, grant or live witness change. No full repository lint/test run or actual Accounts/witness integration is claimed. The 26 files include 12 test files and three documentation files; implementation stays in existing CLI owners.

Classification: owner fix, extending the existing native projection and lifecycle machinery. This PR does not replace the host witness client, evidence store, signing custody or permission resolver.

[antoinetoussaint-byte]

Superseded: native workload audiences for module calls predate the authority hop's signed single-use admission (codefly-dev/authority#28/#32) and the hop routing in #1188/#1189. Closed in the 2026-10-27 clean-up on the owner's instruction.