Env-only layer exporting CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token. The per-step wfcw_ token is delivered by the dispatcher into the script container only (AU-55b), so the layer has no secrets_required, init script or files. Not referenced by any composite yet; safe to merge at any time. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF