Retain verified tenant provenance and reconcile production blockers

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526

SCOPE.md

@@ -102,12 +102,13 @@ systems. Consumption follows the assented `GH-DEC-2026-003` contract.
 
 ## Current State
 
-- Status: **production-packaged spine, not yet live**. Authenticated HTTP
-  mutations, schema-v2 SQLite, outbox drain to audit-core, digest-pin-ready
-  image and single-writer StatefulSet, and a fail-closed PEP harness exist in
-  this repository. Live rollout, KeyCape audience/client proof, audit-core
-  sender registration, and a served secrets-engine consume binding remain
-  external gates on `APPROVAL-WP-0002`.
+- Status: **deployed schema-v5 service; schema-v6 source ready**. Authenticated
+  HTTP mutations, durable SQLite, transactional outbox and restart/restore
+  evidence are implemented. Source now retains verified tenant provenance;
+  promotion needs a new release and approved migration/rollout. Native issuer
+  profile acceptance, lifecycle audit reconciliation and a named served PEP
+  remain blocked in `APPROVAL-WP-0002`; current owner requirements are in
+  `docs/production-dependencies.md`.
 - Layer declaration: INTENT frontmatter + `layer.yaml`. Cadence declared in
   `cadence.yaml`. No Tooling contacts.
 - Consumption is public at `POST /v1/approvals/{id}/consume` under