docs(plans): C4 exit record — stranger run reached; a grant binds only a seat with no ambient credentials (TASK-053)

[lilyshen0722]

What

The C4 stranger run of 2026-09-18 reached its exit. This PR is the record, read on main at 0011545c.

• docs/plans/production-readiness-and-selling-2026-09-11.md — the C4 row's exit record goes from NOT REACHED (09-16) to REACHED (09-18) with the UTC timeline: admin mint 11:32:51Z, seat confined 12:00:04Z, list 12:03:58Z → ok, create 12:07:02Z → parked → approved 12:10:10Z → issue C4 run 2026-09-18 12:06Z #1745 12:10:11Z, close 12:11:39Z → parked → approved 12:16:28Z → closed 12:16:29Z, trail read as the stranger 12:20Z (five rows, 0 refused). 38m11s from Tools open to the first approved write, ~28 of them the seat (host-gh answer with no trail row, then the fix(cli): a public-sandboxed claude seat survives an HTTP MCP server in its environment #1743 spawn crash). The thirteen stumbles filed from the recording are listed by task with their PRs.
• Same row — docs(plans): C4 exit record — NOT REACHED on not_configured; exit criterion is admin installs once, stranger grants + approves #1714's exit criterion is corrected. It said the stranger grants and approves. The run showed the stranger can do neither: the mint takes grantedBy from the Connection owner and 403s anyone else, and approval carries the granter's authority. The criterion now reads: the admin installs once, grants and approves each write; the stranger in the room mentions the seat and reads the trail.
• docs/plans/tools-catalogue-room-grants.md — §4 item 2 and the §8 table said "no daemon or adapter change is needed" for a seat to reach the broker. That did not survive the run: feat(daemon): project active room grants into MCP env #1721 projects grants into environment.mcp via GET /api/agent-binding/assigned, which only daemon-supervisor.js reads, so a launchd commonly agent run seat off a token file never receives it (TASK-039); the claude adapter needed fix(cli): a public-sandboxed claude seat survives an HTTP MCP server in its environment #1743; pi has no HTTP MCP transport (cli: the pi adapter keeps only stdio MCP servers, so a pi seat holding a room grant never sees the broker tools #1740, TASK-054); codex cannot consume a URL transport. New §4 statement (TASK-053): a grant binds a seat, not an agent, and only a seat with no other path to the provider — the trail is evidence about the grant, never about the seat — so the public sandbox default is the seat half of the confirmation floor (piece 2b), not an option (TASK-052; fix(registry): changing an installed agent requires its installer or an instance admin (TASK-055) #1746 installer-or-admin PATCH; fix(cli): the daemon refuses a declared environment that would run a foreign command or ship the seat token off-instance #1744 declared-server guard). §8 gains the matching row.
• docs/design/evidence/c4-run-2026-09-18-*.png — eight stranger-view captures at 1200 (T0 not granted, T1 granted + empty trail, T2 reply + one-call trail, T3 create card + approved, T4 close card + five-row trail). No UI changed here, so no 390 pair.

Why

TASK-053 (C4-7). Sam 69556: post the stranger-side T0→T3 record and the stumbles.

Checks

• git merge-tree --write-tree origin/main 8e8352d0 exits 0 at origin/main = 0011545c; three-dot diff is these ten files only.
• Docs and PNGs only; no code, no tests to run.

🤖 Generated with Claude Code