ADR 0034 §2.3: the plane record carries its bearer's identity

Context

neomjs/neo-agent-institution#223 found that a packaged shell's stored plane record cannot produce a working attach. The fleet child claims a viewer identity from its environment (NEO_AGENT_IDENTITY, then gh api user), and the plane admits only when the bearer's subject is that claim. The record supplies neither half:

• A Finder launch claims nothing and is refused. This was measured on the installed app's bundled resolver.
• A shell another process launched claims that process's identity.

The fix makes the identity travel with the bearer, and that changes the seam ADR 0034 documents.

The Problem

ADR 0034 §2.3 item 8 is the authority for the plane-attach pair. It describes:

• the record as endpoint plus credential;
• the check as "one authenticated request";
• the transitional seam as NEO_FLEET_PLANE_BASE + NEO_FLEET_PLANE_BEARER, with the process environment winning.

After neomjs/neo-agent-institution#223, the record also holds the identity the plane named for its bearer. The check reads it (an authenticated initialize, then list_permissions, in one session). The seam exports it as NEO_AGENT_IDENTITY over an inherited value. Left unamended, item 8 would describe a seam the code no longer has. It would also be the first thing #17's blast-radius inventory reads.

The Architectural Reality

• NEO_INLINE_CODE_7 §2.3 item 8 (added by #19228 / #19229): the attachPlane bullet, the Custody paragraph (the record is ADR 0038 §2.1's client connection profile), and the Transitional seam paragraph.
• ADR 0038's line that identity is plane-owned, quoted in ADR 0034's amendment row, is why the identity comes from the plane and never from the launcher.

The Fix

Amend item 8 in place, with a provenance bracket in the #19228 style (amended 2026-09-25, #N — for neomjs/neo-agent-institution#223):

• attachPlane bullet: the check becomes an authenticated initialize, then list_permissions for the identity the plane names, in one session. Main stores both.
• Custody: the record is endpoint, credential, and the identity the plane named for that credential. The identity is plain data, not a secret.
• Transitional seam: the identity travels with the stored bearer as NEO_AGENT_IDENTITY, over an inherited value. The child's claim must be the bearer's subject, and a launcher's identity is neither. An environment-supplied bearer keeps the environment's identity.

Acceptance Criteria

• AC-1: ADR 0034 §2.3 item 8 names the identity in the check, the record and the seam, with its precedence and a provenance bracket citing this ticket and neomjs/neo-agent-institution#223.
• AC-2: No other sentence of item 8 changes meaning. The reply shape {ok, reason, relaunching}, custody, and the ownership boundary stand.

Out of Scope

The Institution code (neomjs/neo-agent-institution#223). ADR 0038.

Related

neomjs/neo-agent-institution#223 (the fix), #19228 / #19229 (item 8's origin), neomjs/neo-agent-institution#211, neomjs/neo-agent-institution#17.

Live latest-open sweep: latest 20 open neo issues checked at 2026-09-25T21:33:51Z; no ADR 0034 ticket. A2A: my own #223 claim only. MC sweep: shared with neomjs/neo-agent-institution#223, no prior decision. Own-assignment sweep: 5 open (#19047, #18985, #16217, #14790, #13015), none on ADR 0034.

Origin Session ID: 0f80515e-7682-4313-8101-b926da48c55c