Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

tests/test_interface.py

@@ -8,6 +8,7 @@ from audit_core.interface import (
     EventValidationError,
     RetentionPolicy,
     SCHEMA_VERSION_V1ALPHA1,
+    custody_class_satisfies,
     validate_event,
 )
 from audit_core.mock_file_backend import MockFileAuditBackend
@@ -79,6 +80,29 @@ def test_mock_backend_retention_policy_none_when_cleanup_disabled():
     assert backend.retention_policy.retention_days is None
 
 
+def test_custody_class_satisfies_aliases_operational_and_archive():
+    assert custody_class_satisfies("operational", "archive") is True
+    assert custody_class_satisfies("archive", "operational") is True
+    assert custody_class_satisfies("operational", "development") is False
+
+
+def test_readiness_payload_includes_recovery_when_declared():
+    policy = RetentionPolicy(
+        custody_class="operational",
+        retention_days=None,
+        immutable=True,
+        tamper_evidence=False,
+        durable=True,
+        recoverable_days=30,
+        recoverable_source="cited",
+        recoverable_basis="measured",
+    )
+    body = policy.as_readiness()
+    assert body["status"] == "ok"
+    assert body["custody_class"] == "operational"
+    assert body["recoverable_days"] == 30
+
+
 def test_audit_event_record_uses_v1alpha1_schema():
     event = AuditEvent(
         source="audit-core",