Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

registry/capabilities/capability.audit.event-retain.md

@@ -3,40 +3,37 @@ id: capability.audit.event-retain
 name: Audit Event Retention
 summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants.
 owner: audit-core
-status: draft
-domain: helix_forge
+status: production
+domain: infotech
 tags: [audit, retention, compliance]
-
-maturity:
-  discovery:
-    current: D4
-    target: D6
-    confidence: medium
-    rationale: audit-core INTENT defines full audit fabric scope and integration boundaries.
-  availability:
-    current: A2
-    target: A5
-    confidence: low
-    rationale: Core modules exist; deployable service packaging in progress.
+joins:
+  itc_cap: operations.audit
+  provision: data/capability/audit-core-operational.json
+  provision_maturity: D4
 
 external_evidence:
   completeness:
-    level: C2
-    name: Partial
-    confidence: low
-    basis: scope_vs_intent_and_consumer_expectations
+    level: C3
+    name: Substantial
+    confidence: medium
+    basis: live_receiver_and_restore_walk
     satisfied_expectations:
-      - retention and integrity goals documented
+      - HTTP ingest through the backend contract
+      - append-only Postgres custody on platform-pg
+      - recovery cited to the live platform data.backup provision
     broken_expectations:
-      - federation with all platform runtimes not proven in registry
+      - data.archive sink not provided
+      - tamper evidence not implemented
     out_of_scope_expectations:
       - application business audit semantics ownership
+      - booked-cost origination
   reliability:
-    level: R1
-    confidence: low
-    basis: consumer_quality_signals
+    level: R2
+    confidence: medium
+    basis: failure_matrix_and_restore_walk
     known_reliability_risks:
-      - multi-tenant isolation not evidenced here
+      - single replica
+      - integrity_verification hook unmet
 
 discovery:
   intent: >
@@ -49,14 +46,19 @@ discovery:
     - tamper evidence
   excludes:
     - generating domain business events
+    - procuring or operating platform backup
+    - booked financial facts
   use_cases: []
 
 availability:
-  current_level: A2
+  current_level: A4
   target_level: A5
   current_artifacts:
-    - audit-core/
+    - audit-core/deploy/audit-core.yaml
+    - audit-core/audit_core/postgres_backend.py
+    - rapp-postgres/consumers/audit-core.yaml
   consumption_modes:
+    - http ingest
     - source module
 
 relations:
@@ -64,17 +66,25 @@ relations:
   related_to:
     - capability.activity.event-coordinate
     - capability.statehub.progress-log
+  uses_provisions:
+    - data.transactional (rapp-postgres/platform-pg)
+    - data.backup (resource:platform:audit-storage, cited)
+    - security.secrets (OpenBao / ESO)
 
 consumer_guidance:
   recommended_for:
-    - planning audit retention independent of a single product
+    - platform and application audit event delivery over POST /v1/events
   not_recommended_for:
+    - treating this store as WORM archive
     - replacing application-level logging only
   known_limitations:
-    - consumer evidence not yet collected in registry
+    - recoverable history is the 30-day platform backup window
+    - no hash-chain or export API yet
 ---
 
 # Audit Event Retention
 
-Audit Core provides the retention and integrity layer for audit events across
-the platform.
+Audit Core provides the operational custody layer for audit events.
+ITC-CAP join: `operations.audit` at provision maturity D4
+(`data/capability/audit-core-operational.json`). Maturity is not a
+property of this abstract capability.