diff --git a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
index a3eae18..e1cdd7b 100644
--- a/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
+++ b/harnesses/composites/spec-writing-sonnet-repo/v1/harness.yaml
@@ -8,3 +8,6 @@ layers:
   - context: anthropic-cloud-paul-oauth/v1
   - context: gitea-ssh/v1
   - context: agent-repo/v1
+  # AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which
+  # calls back POST /v1/work-items/{id}/decompose — needs a credential.
+  - context: cp-service-token/v1
diff --git a/harnesses/contexts/cp-service-token/v1/harness.yaml b/harnesses/contexts/cp-service-token/v1/harness.yaml
new file mode 100644
index 0000000..4dfc374
--- /dev/null
+++ b/harnesses/contexts/cp-service-token/v1/harness.yaml
@@ -0,0 +1,23 @@
+kind: context
+name: cp-service-token
+version: 1
+description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
+requires: []
+provides: []
+
+# AU-51b: static env pointing at the ESO-mounted secret file. No init.sh
+# needed — the mount path is fixed at harness-authoring time (unlike
+# anthropic-cloud-paul-oauth/v1, which transforms its secret into a
+# different file format and therefore needs a staging script), and
+# decompose_work_items_action reads CP_SERVICE_TOKEN_FILE directly.
+# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
+# (same account: cp-decompose-service-token, account_id
+# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
+env:
+  CP_SERVICE_TOKEN_FILE: /run/agent/secrets/cp-service-token/value
+
+secrets_required:
+  - name: cp-service-token
+    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
+    mount_path: /run/agent/secrets/cp-service-token
+    mode: "0400"