docs(runner): authorize phase 4 work

packages/paperclip-runner/spec/paperclip-native-runner-implementation-plan.md

@@ -223,6 +223,18 @@ to the package index and cumulative end-to-end tutorial.
 
 **Human checkpoint:** run a small Codex task, inspect the exact model envelope, steer or interrupt it, and verify the structured result and replay.
 
+**Authorization and execution state (2026-08-08):** the human checkpoint for
+Phase 3 is accepted, and the board has authorized Phase 4. Create one Phase 4
+checkpoint issue with ordered implementation, security review, CTO contract
+review, and QA tutorial children. Implementation remains entirely inside
+`packages/paperclip-runner/` and uses the mock core; it must not modify or
+import `server/`, `ui/`, `packages/db/`, or production control-plane behavior.
+Security and CTO review start only after the runnable driver tracer is complete.
+QA starts only after implementation and both reviews pass. Keep Phase 5 tasks
+uncreated until the Phase 4 runnable demo, tests, package-local documentation,
+tutorial, OKF journal entry, review gates, QA evidence, and human checkpoint are
+complete.
+
 ## Phase 5 — Browser reference console and reusable SDK surface
 
 **Purpose:** turn the proven protocol into a reference implementation that package users can adopt without the Paperclip app.

packages/paperclip-runner/spec/paperclip-native-runner-spike-spec.md

@@ -6575,7 +6575,7 @@ Never change an active run from native to legacy mid-session.
 
 The implementation phases, dependency policy, package-local documentation layout, human checkpoints, and retained future backlog now live in [`paperclip-native-runner-implementation-plan.md`](./paperclip-native-runner-implementation-plan.md).
 
-The spike specification remains the normative contract. Keep it updated when implementation evidence changes architecture, protocol, security, persistence, API, UI, performance, or exit criteria. Keep sequencing and task-creation details in the implementation plan. Phase 0, Phase 1, and Phase 2 are complete. The Phase 3 tracer now implements package-local outbound WebSocket authentication, private durable state, cumulative acknowledgement replay, command deduplication, bounded P0-preserving storage, drain, revoke, and redacted CLI/browser diagnostics. Security, UX, QA, and human acceptance remain open. Keep Phase 4 and later tasks deferred until the Phase 3 human checkpoint is complete.
+The spike specification remains the normative contract. Keep it updated when implementation evidence changes architecture, protocol, security, persistence, API, UI, performance, or exit criteria. Keep sequencing and task-creation details in the implementation plan. Phase 0, Phase 1, Phase 2, and Phase 3 are complete, including the Phase 3 implementation, security, UX, QA, documentation, tutorial, journal, and human checkpoint gates. On 2026-08-08, the board authorized Phase 4. Phase 4 must implement the skillless Codex reference driver entirely inside `packages/paperclip-runner/` against the mock core, with no changes or imports from `server/`, `ui/`, `packages/db/`, or production control-plane behavior. Keep Phase 5 and later tasks deferred until the Phase 4 implementation, security review, CTO contract review, QA tutorial evidence, package-local documentation, OKF journal entry, and human checkpoint are complete.
 
 ## 30. Dependency sequencing