docs: consume factory sender custody and retain delivery gate

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/evidence/2026-09-11-factory-audit-delivery-login.json

@@ -0,0 +1,20 @@
+{
+  "schema": "platform.factory-audit-delivery-attempt.v1",
+  "observed_at": "2026-09-11T08:06:20.638931+00:00",
+  "status": "login_failed_before_delivery_handoff",
+  "wrapper_exit": 5,
+  "delivery_receipt_created": false,
+  "delivery_command_executed": false,
+  "credential_values_emitted": false,
+  "remote_session_revocation": "unconfirmed_for_this_failed_login",
+  "permanent_custody": "preserved_version_1_registry_version_8",
+  "next_step": "Fresh attended delivery after browser/login feedback; do not seed or rotate again",
+  "validation": {
+    "delivery_contract_tests": 7,
+    "custody_tests": 18,
+    "custody_tests_using_real_local_openbao": 11
+  },
+  "platform_delivery_source": "44314cad3704bda40683383f898b55b1f41491bc",
+  "factory_attempts": 0,
+  "paid_calls": 0
+}

docs/evidence/2026-09-11-factory-audit-sender-seed.json

@@ -0,0 +1,63 @@
+{
+  "schema": "platform.factory-audit-custody.v1",
+  "status": "custody_seeded_pending_delivery_and_receiver_reload",
+  "credential_values_emitted": false,
+  "started_at": "2026-09-11T05:37:49.432171+00:00",
+  "lanes": [
+    {
+      "ccr": "CCR-2026-0021",
+      "name": "approval-engine",
+      "kv": "platform/data/workloads/approval-engine/audit-sender",
+      "store": "openbao-approval-engine-audit",
+      "secret": "approval-engine-audit",
+      "secret_key": "audit-token",
+      "source_sha256": "ba69ecc8227c5bf887c2cd0ac4c50518c019bebfdfb6d49628edee1ce570da7d"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "name": "informed-decision",
+      "kv": "platform/data/workloads/informed-decision/audit-sender",
+      "store": "openbao-informed-decision-audit",
+      "secret": "informed-decision-audit",
+      "secret_key": "token",
+      "source_sha256": "2f7f7f214d1e21fd79275197edd03ee7e154ef451d62a182017926250515a6aa"
+    }
+  ],
+  "receiver": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59751057",
+    "pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "phase": "registry_cas",
+  "registry_version_before": 7,
+  "seeded": [
+    {
+      "ccr": "CCR-2026-0021",
+      "version": 1,
+      "request_id": "cf6dd167-9d37-fbcf-cc3d-6d54c0f988b9"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "version": 1,
+      "request_id": "2f373e63-058b-7a6e-07c4-365317dffa73"
+    }
+  ],
+  "registry_write_request_id": "91fdb393-80ba-4e06-2dde-3982763d0ae5",
+  "registry_version_after": 8,
+  "unchanged_other_senders": true,
+  "unchanged_other_registry_fields": true,
+  "credentials_reused": false,
+  "attended_wrapper_exit": 0,
+  "attended_session_self_revocation": "confirmed_by_successful_wrapper",
+  "prior_failed_login": "not asserted resolved by this new session"
+}

workplans/AUDIT-WP-0009-evidence-role-conformance.md

@@ -508,6 +508,26 @@ No sender custody receipt exists. T09/T11 remain progress for the attended
 retry, delivery and owner acceptance.
 [Native release receipt](../docs/evidence/2026-09-11-factory-receiver-live.json).
 
+### Sender custody retry succeeded; delivery login remains — 2026-09-11
+
+The successful attended platform retry created both independent version-1
+audit senders and updated the authoritative registry with CAS 7→8 while
+preserving existing senders/fields. CCR-2026-0021/0022 are applied. The seed
+session exited 0 and self-revoked. A separate attended delivery login exited 5
+before command handoff, with remote-session revocation unconfirmed; no ESO
+delivery or receiver reload occurred. Receiver c82e0442 remains 1/1 Ready.
+The old no-custody state above is superseded by the
+[seed receipt](../docs/evidence/2026-09-11-factory-audit-sender-seed.json) and
+[delivery return](../docs/evidence/2026-09-11-factory-audit-delivery-login.json).
+
+RPF-WP-0035-T08 owns fresh attended delivery and native reader/namespace
+checks. T09/T11 retain real producer ingestion, duplicates, source/tenant/read
+refusals, independent readback and bearer-revocation/operating acceptance.
+Stored registry changes have not been claimed as a loaded receiver identity.
+The reviewed Informed Decision cadence return declares the three classes at
+86400 seconds and first heartbeat on activation; no native heartbeat is
+claimed before activation. This does not close T12's independent attestation.
+
 ## Operate the scheduled attestation and independent offsite return
 
 ```task