[jeremi]

Summary

• BReg native dev journeys can use $localClientSubject in claims.principal and claims.directClaims.sub. Both assertions resolve from the selected client in the private captured fixture.
• The Casework guide documents the required roles and the directory bootstrap client. The canonical template includes a Staff example that claims an exact task, approves with the held revision, and reads the same reviewer's receipt after HTTP 204.
• Render documents the label-key grammar and reports a worker's observed exit status or signal and Linux's configured address-space cap to the operator. Serve returns fixed HTTP problem details and discards worker stderr.

Closes #2651

Evidence

• cargo test --locked -p registry-bregctl --lib dev:: passed 317 tests with 4 existing tests ignored. The new installed_dev_rehearses_subject_bound_rows_with_two_local_clients test in cargo test --locked -p registry-bregctl --test dev_lifecycle passed when explicitly enabled, using source-built BReg and the pinned PostgreSQL and ThunderID images. It checked that the owner saw the row, the second client received an empty list, and authored fixture bytes stayed intact.
• cargo test --locked -p registry-casework --features postgres-test --test breg_review_journey passed all four tests against disposable PostgreSQL. The canonical template and Administrator binding checks passed. A reader run of bregctl examples review with source-built CLIs executed the installed approve-task.sh and read the retained receipt. The Casework OpenAPI and product checks passed.
• cargo test --locked -p registry-render --lib worker::tests passed, covering a premature exit code, signal, bounded wait, and stderr canary. The golden, scaffold, and serve test binaries passed on macOS with Render's default log filter. The built CLI rejected exampleTitle and compiled a strict PDF with example_title. Linux CI will exercise the configured cap with a synthetic worker exit. The original Rosetta scenario remains unverified.
• Independent review found no blockers. Scoped BReg and Render Clippy, workspace formatting, ShellCheck, Bash formatting and syntax, and the disclosure scan passed.

The first Linux run passed the exit status, signal, cap, and stderr redaction regression. A separate stand-in failed at process launch. The fixture now invokes /bin/sh explicitly and includes the OS error in a failing assertion. All seven focused worker tests passed after the correction on macOS.

Every commit carries a Signed-off-by trailer.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T18:33:12.571560Z	7896032	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.