feat(AUDIT-WP-0008): add T02 synthetic load driver

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de

docs/recovery-synthetic-load-driver.md

@@ -0,0 +1,39 @@
+# T02 synthetic-load driver
+
+`scripts/t02_synthetic_load_driver.py` implements the hash-bound
+`railiance.synthetic-load-driver` v1 contract for
+`RAILIANCE-WP-0024-T02-SYNTHETIC-01`. It is a candidate execution component,
+not authorization to revoke a database lease or create a temporary identity.
+
+The attended operator supplies these non-secret settings to the driver process:
+
+- `AUDIT_T02_BASE_URL`: the approved direct audit-core URL;
+- `AUDIT_T02_TENANT`, `AUDIT_T02_SOURCE`, and `AUDIT_T02_FIXTURE_ID`: the exact
+  approved synthetic identity scope and immutable fixture;
+- `AUDIT_T02_OCCURRED_AT`: the fixed RFC3339 event time used by every phase;
+- optionally `AUDIT_T02_MAX_ATTEMPTS` (1–30, default 6) and
+  `AUDIT_T02_RETRY_INTERVAL_SECONDS` (0–10, default 1).
+
+`AUDIT_T02_TOKEN_FILE` is different: it names the approved private mounted
+bearer file. The driver requires a regular file with no group/world permission,
+reads one bounded line inside its own process, and never returns the bearer,
+request body, response body, database credential, Secret data, or OpenBao
+output. Do not put the bearer in an environment variable or parent shell.
+
+The four invocations are:
+
+```bash
+scripts/t02_synthetic_load_driver.py baseline --contract-id RAILIANCE-WP-0024-T02-SYNTHETIC-01
+scripts/t02_synthetic_load_driver.py expect-unavailable --contract-id RAILIANCE-WP-0024-T02-SYNTHETIC-01
+scripts/t02_synthetic_load_driver.py expect-recovered --contract-id RAILIANCE-WP-0024-T02-SYNTHETIC-01
+scripts/t02_synthetic_load_driver.py cleanup --contract-id RAILIANCE-WP-0024-T02-SYNTHETIC-01
+```
+
+`baseline` commits or reconciles one immutable synthetic event.
+`expect-unavailable` accepts only HTTP 503 as the required retryable evidence
+and never retries HTTP 400, 401, 403, or 409. `expect-recovered` retries bounded
+transport/500/503 failures until the same event is accepted or reconciled as a
+duplicate. `cleanup` owns no server-side deletion: it stops no persistent
+process and reports its ephemeral driver runtime clean, while the accepted
+audit fixture remains as evidence. Temporary sender identity cleanup is a
+separate attended `railiance-platform` custody action.