Retain verified tenant provenance and reconcile production blockers

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046e-fdbf-7b93-a267-5f72b9b24526

workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md

@@ -9,7 +9,7 @@ flavor: residual
 owner: codex
 topic_slug: netkingdom
 created: "2026-09-01"
-updated: "2026-10-03"
+updated: "2026-10-04"
 reviewed_at: "2026-09-01"
 reviewed_against_commit: "ebce5abb276c01ab29ce2526f3b8abb332dc9e90"
 reviewed_note: >-
@@ -30,8 +30,9 @@ Move the completed first-cut engine spine into an authenticated, durable,
 observable production service and prove one PEP integration end to end. This is
 the residual production scope deliberately excluded from APPROVAL-WP-0001.
 
-The workplan is proposed pending review against the deployment estate and the
-current key-cape, access-engine, audit-core, and secrets-engine contracts.
+Current status: blocked after the 2026-10-04 dependency review. T02, T03 and
+T06 are complete. T01, T04 and T05 use `wait` for blocked task status; their
+remaining owner receipts are specified in `docs/production-dependencies.md`.
 
 Review completed 2026-09-01. The plan is active. Production mode will verify
 KeyCape JWT signatures and exact issuer/audience/scopes; local caller-supplied
@@ -50,7 +51,10 @@ id: APPROVAL-WP-0002-T01
 status: wait
 flavor: residual
 priority: high
-blocking_reason: "Await key-cape's exact requester/human client registrations and native issuer proof with a real human flow; repository implementation is complete."
+blocked_on: message-from:key-cape
+needs_human: true
+blocking_reason: "Source records verified tenant provenance in schema v6. Existing native requester/human review evidence is delivered; await revision-pinned issuer/profile receipt from key-cape/informed-decision and founder-approved v6 release/migration with native entry/outbox readback."
+intervention_note: "Founder per-change approval is required before promoting the schema-v6 image and migrating production; no live change is authorized by this review."
 state_hub_task_id: "dc4523f5-e0af-5734-a0ef-07aa7f2b2a27"
 ```
 
@@ -546,7 +550,8 @@ id: APPROVAL-WP-0002-T04
 status: wait
 flavor: residual
 priority: high
-blocking_reason: "Source declaration migrated and emitter mapping verified; sender/native custody delivered 2026-09-11; await canonical receiver declaration and heartbeat class admission, service admission and actual lifecycle outbox/cadence proof plus bearer revocation (synthetic accepted/duplicate/read-refusal/readback already verified 2026-09-11), exact-window reconciliation and observed per-class heartbeat/lag findings. Existing AUDIT-WP-0009 observer implementation is reused."
+blocked_on: message-from:audit-core
+blocking_reason: "Sender custody, native synthetic delivery/readback and service deployment are delivered. Await audit-core acceptance of current cadence/class inventory, actual lifecycle drain and same-window reconciliation, class-silence/lag findings and scoped bearer-revocation receipt. Existing AUDIT-WP-0009 implementation is complete and reused."
 state_hub_task_id: "777a5cf5-c1db-5e07-8de6-ab109db5ccdc"
 ```
 
@@ -610,6 +615,8 @@ id: APPROVAL-WP-0002-T05
 status: wait
 flavor: residual
 priority: high
+blocked_on: message-from:secrets-engine
+blocking_reason: "Engine deployment and consumer read/consume credential delivery are delivered. Await secrets-engine named served PEP revision/route/identities and native exact-binding consume-before-side-effect/failure proof; requester/reviewer admission must match that act. Live T-06 additionally requires a complete engagement and plane admission with window/technique."
 state_hub_task_id: "3196fb77-3df0-5358-ae12-2d07bac12041"
 ```
 
@@ -805,3 +812,36 @@ approval.heartbeat alias while preserving the 86400s emission and requested
 explicitly pending. See docs/emission-cadence.md for the bounded owner acceptance
 requirements; T04 stays wait, and this workplan stays blocked. Source validation
 does not admit a workload or close its real delivery proof.
+
+
+## Dependency review and tenant provenance — 2026-10-04
+
+Reviewed all tasks in all three workplans; only T01/T04/T05 in this workplan
+remain open. The 2026-09-27 assertion that no repository work was reachable is
+superseded: KEY-WP-0031 publishes `tenant_source`, and this engine had promised
+to retain it but discarded it. Implemented schema v6: signature-verified
+provenance survives entries and issuance/use threshold evidence; absent and
+legacy provenance remains null, malformed explicit claims fail before mutation,
+and HTTP body spoofing cannot supply it. Migration preserves bindings,
+human-control declarations and historical outbox bytes.
+
+Existing receipts remove old dependencies: T03 is done with deployed schema v5;
+secrets-engine SECRETS-WP-0010 documents native consumer credential delivery;
+informed-decision INFD-WP-0001-T08 is done and its 2026-09-27 requester/create
+and human acceptance receipts are real. KEY-WP-0013 publishes the exact
+`informed-decision-approver` registration and KEY-WP-0031 implements tenant
+provenance. AUDIT-WP-0009 is finished; its implementation is reused, rather
+than described as an unfinished predecessor. None of these supplies a named
+served T-06 PEP or an engagement/admission. Whitehat reply
+`4ebf1784-36a5-43c0-8685-1a8cccf49006` retains that blocking gap.
+
+Current requirements, owner records and the evidence needed to clear each wait
+are in `docs/production-dependencies.md`. No other repo was edited and no
+production change or packet was performed. Deployed v5 remains pinned and the
+runbook acknowledges that it predates v6. T03's historical deployment acceptance
+is retained; promotion of the new evidence field is part of T01 acceptance.
+
+Validation: 181 tests pass, including 12 new signed-HTTP, malformed-claim,
+persistent migration/restart and transactional rollback cases. Repository
+implementation is complete for these open tasks; native owner acceptance and
+the per-change release/rollout gate remain. Workplan stays blocked.