docs: record native audit sender delivery and reload

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/approval-engine-source-registration.md

@@ -71,7 +71,7 @@ The ingress rule is narrower than `user-engine`'s: namespace **and** pod label
 in a single `from` peer, so both are ANDed. A new sender should not inherit an
 older rule's breadth. `user-engine`'s sender and its policy are unchanged.
 
-## Still owed by others
+## Original owner handoff (current delivery recorded below)
 
 | Input | Owner | Note |
 | --- | --- | --- |
@@ -115,3 +115,20 @@ omission at all — T04 does. So a consumer waiting on T02 before trusting
 approval evidence would be waiting on the wrong control. Until T04 and T06
 land, Audit Core cannot detect a suppressed revocation, and no reading of the
 chain, attested or not, changes that.
+
+
+## Native delivery return — 2026-09-11
+
+The token is now independently held in OpenBao and delivered through its exact
+ESO projection. Namespace restrictions, sibling/full-registry/metadata/listing
+denials, wrong-SA/namespace refusals and the coding-agent boundary passed
+natively. Registry version 8 was compared exactly before Audit Core reloaded;
+receiver c82e0442 is Ready and operational/durable. The admitted manifests and
+sender ingress are applied. See the
+[native receipt](evidence/2026-09-11-factory-audit-delivery-live.json).
+
+Remaining admission evidence is actual producer accepted/duplicate delivery,
+receiver source/tenant/read refusal, independent readback and audit bearer
+revocation. No native producer event or operational heartbeat is claimed by
+the custody receipt. Attestation/offsite operation remains a separate evidence
+quality bound in AUDIT-WP-0009-T12.

docs/evidence/2026-09-11-factory-audit-delivery-live.json

@@ -0,0 +1,104 @@
+{
+  "schema": "platform.factory-audit-delivery.v1",
+  "status": "delivered_and_scope_verified_pending_producer_acceptance",
+  "started_at": "2026-09-11T08:27:09.975750+00:00",
+  "credential_values_emitted": false,
+  "receiver_before": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59807531",
+    "pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "lanes": [
+    {
+      "ccr": "CCR-2026-0021",
+      "name": "approval-engine",
+      "kv": "platform/data/workloads/approval-engine/audit-sender",
+      "store": "openbao-approval-engine-audit",
+      "secret": "approval-engine-audit",
+      "secret_key": "audit-token",
+      "reader_exact_path": true,
+      "registry_and_sibling_denied": true,
+      "metadata_and_listing_denied": true,
+      "reader_ttl": 900,
+      "reader_revocation_verified": true,
+      "wrong_service_account_denied": true,
+      "coding_agent_deny_wins": true,
+      "external_secret_ready": true,
+      "projection_matches": true,
+      "secret_uid": "3e0f42a6-36b0-4094-8aac-9538fcdcb46f",
+      "secret_resource_version": "59808872",
+      "wrong_namespace_denied": true,
+      "store_namespace_denied": true
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "name": "informed-decision",
+      "kv": "platform/data/workloads/informed-decision/audit-sender",
+      "store": "openbao-informed-decision-audit",
+      "secret": "informed-decision-audit",
+      "secret_key": "token",
+      "reader_exact_path": true,
+      "registry_and_sibling_denied": true,
+      "metadata_and_listing_denied": true,
+      "reader_ttl": 900,
+      "reader_revocation_verified": true,
+      "wrong_service_account_denied": true,
+      "coding_agent_deny_wins": true,
+      "external_secret_ready": true,
+      "projection_matches": true,
+      "secret_uid": "8bb040ec-e1ad-4c46-9f51-488d5db66c0c",
+      "secret_resource_version": "59808881",
+      "wrong_namespace_denied": true,
+      "store_namespace_denied": true
+    }
+  ],
+  "phase": "namespace_verification",
+  "check": "informed-decision:wrong_namespace",
+  "registry_version": 8,
+  "receiver_registry_matches": true,
+  "receiver_secret_resource_version": "59808896",
+  "receiver_after": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59808967",
+    "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "receiver_reloaded": true,
+  "temporary_namespace": {
+    "name": "factory-audit-check-731ba3bdf5",
+    "uid": "794cbc75-291b-47e8-8df0-c62c27703cc8"
+  },
+  "namespace_cleanup_requested": true,
+  "completed_at": "2026-09-11T08:27:37.299698+00:00",
+  "namespace_cleanup_verified": true,
+  "attended_wrapper_exit": 0,
+  "attended_session_self_revocation": "confirmed_by_successful_wrapper",
+  "readiness": {
+    "status": "ok",
+    "custody_class": "operational",
+    "durable": true,
+    "tamper_evidence": false,
+    "recoverable_days": 30,
+    "recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]",
+    "recoverable_basis": "measured"
+  }
+}

docs/informed-decision-source-registration.md

@@ -174,7 +174,7 @@ entry is **inert until the token exists** — asserted by test, not by reading.
 The ingress rule ANDs namespace and pod label in one `from` peer.
 `user-engine`'s and `approval-engine`'s policies are unchanged.
 
-## Still owed by others
+## Original owner handoff (current delivery recorded below)
 
 | Input | Owner | Note |
 | --- | --- | --- |
@@ -196,3 +196,20 @@ audit-core will not describe a commitment-only record as satisfying
 what was committed to it establishes nothing, except conditionally — if a
 document is later produced, whether it is the one. No conformance claim, ITC-CAP
 case, or `docs/integrity.md` statement may say otherwise.
+
+
+## Native delivery return — 2026-09-11
+
+The token is now independently held in OpenBao and delivered through its exact
+ESO projection. Namespace restrictions, sibling/full-registry/metadata/listing
+denials, wrong-SA/namespace refusals and the coding-agent boundary passed
+natively. Registry version 8 was compared exactly before Audit Core reloaded;
+receiver c82e0442 is Ready and operational/durable. The admitted manifests and
+sender ingress are applied. See the
+[native receipt](evidence/2026-09-11-factory-audit-delivery-live.json).
+
+Remaining admission evidence is actual producer accepted/duplicate delivery,
+receiver source/tenant/read refusal, independent readback and audit bearer
+revocation. No native producer event or operational heartbeat is claimed by
+the custody receipt. Attestation/offsite operation remains a separate evidence
+quality bound in AUDIT-WP-0009-T12.

workplans/AUDIT-WP-0009-evidence-role-conformance.md

@@ -528,6 +528,23 @@ The reviewed Informed Decision cadence return declares the three classes at
 86400 seconds and first heartbeat on activation; no native heartbeat is
 claimed before activation. This does not close T12's independent attestation.
 
+### Native sender delivery completed — 2026-09-11 08:27 UTC
+
+The attended retry completed delivery and all native custody/reader/namespace
+checks. Both producer Secrets are ESO-owned and match independent version-1
+custody. Registry version 8 was compared exactly before receiver reload;
+Audit Core c82e0442 is 1/1 Ready and operational/durable. Temporary reader
+sessions were revoked, the denied namespace created no Secret and was removed,
+and the attended platform session exited 0 with revocation confirmed.
+[Native delivery receipt](../docs/evidence/2026-09-11-factory-audit-delivery-live.json).
+
+This closes the delivery-login wait in RPF-WP-0035-T08. T09/T11 remain progress
+for native producer ingestion and duplicates, wrong source/tenant/read refusal,
+independent readback, and audit bearer-revocation acceptance. Native producer
+service/outbox/recovery and first-heartbeat operation remain unproved; ESO
+reader-session revocation is a separate control from audit bearer revocation.
+T12 still owns attestation/offsite operation; tamper_evidence=false is accurate.
+
 ## Operate the scheduled attestation and independent offsite return
 
 ```task