Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

workplans/AUDIT-WP-0006-honest-custody-and-canon-join.md

@@ -4,16 +4,17 @@ type: workplan
 title: "Honest operational custody against ITC-CAP and the live platform backup"
 domain: infotech
 repo: audit-core
-status: ready
+status: finished
 owner: grok
 topic_slug: railiance
 created: "2026-08-15"
-updated: "2026-08-15"
+updated: "2026-08-16"
 depends_on:
   - AUDIT-WP-0005
   - RESOURCE-WP-0002
   - ITC-WP-0014
   - ITC-WP-0015
+state_hub_workstream_id: "8d775ffb-3c83-4c33-9ffa-05ce52c5ff91"
 ---
 
 # AUDIT-WP-0006 — Honest operational custody against ITC-CAP and the live platform backup
@@ -122,8 +123,9 @@ not build the sink here.
 
 ```task
 id: AUDIT-WP-0006-T01
-status: todo
+status: done
 priority: high
+state_hub_task_id: "bbf476eb-7bc3-4cb6-bd1c-9b2c75903906"
 ```
 
 `CustodyClass` is currently `development | archive | hot_search`. The
@@ -164,12 +166,21 @@ Done when: unit tests cover the new class and the alias; production
 manifest requires the honest class; contract and `/readyz` no longer
 call Postgres `data.archive`.
 
+Done 2026-08-16: `CustodyClass` includes `operational`; Postgres reports
+it with a 30-day cited recoverable window (`measured`).
+`AUDIT_CORE_REQUIRE_CUSTODY_CLASS=operational` in the manifest; `archive`
+is a one-deploy alias. `/readyz` publishes recovery fields. Contract
+replaced "Production archive policy (planned)" with the live operational
+policy. Suite 84 passed. **Do not apply the Deployment until a new image
+is pinned** — the live image still reports `archive` and has no alias.
+
 ## T02 — Bind the recovery promise to the live platform backup
 
 ```task
 id: AUDIT-WP-0006-T02
-status: todo
+status: done
 priority: high
+state_hub_task_id: "06907b2c-a822-48f0-8edc-50dd8914342b"
 ```
 
 `docs/operator-runbook.md` still says production Barman is fail-closed
@@ -198,12 +209,17 @@ RESOURCE-WP-0002-T05 (30 events, 65 s full / 65 s PITR).
 Done when the runbook and the T06 evidence note no longer contradict
 the live backup provision.
 
+Done 2026-08-16: Restore section cites `resource:platform:audit-storage`,
+D5 requirement / D4 provision, and supersedes the 2026-08-13 fail-closed
+sentence with RESOURCE-WP-0002-T05. Evidence JSON updated in place.
+
 ## T03 — Publish an ITC-CAP case for the live provision
 
 ```task
 id: AUDIT-WP-0006-T03
-status: todo
+status: done
 priority: high
+state_hub_task_id: "eba29df0-36b9-4f43-add6-760285c56bde"
 ```
 
 Neighbours already restate real provisions against the live catalog
@@ -265,12 +281,18 @@ catalog. Gaps are allowed when they name owner and disposition.
 Done when the record validates and the reuse-surface card no longer
 contradicts the live receiver.
 
+Done 2026-08-16: `data/capability/audit-core-operational.json` reviews
+`ok` against ITC-CAP 0.4.0 (`operations.audit` met at D4; `data.archive`
+unprovided). Reuse-surface card joins that provision, domain `infotech`,
+status `production`.
+
 ## T04 — Publish a Canon Interface Card
 
 ```task
 id: AUDIT-WP-0006-T04
-status: todo
+status: done
 priority: medium
+state_hub_task_id: "c5f5a883-834f-42eb-8f05-de2857d3904f"
 ```
 
 ITC-GOV / ITC-SEC / ITC-DATA say subsystems that produce Evidence
@@ -297,12 +319,17 @@ Declare at least:
 Done when the card exists in-repo and validates against
 `interface-card.schema.yaml`.
 
+Done 2026-08-16: `docs/interface-card.yaml` validates. Schema wants
+`consumer` as a string and `canon_surfaces` as a string array; richer
+template fields live under `consumer_profile` / `surfaces`.
+
 ## T05 — Persist sender tenant scope and refresh SCOPE
 
 ```task
 id: AUDIT-WP-0006-T05
-status: todo
+status: done
 priority: medium
+state_hub_task_id: "c629d894-2fe6-4b46-9909-7267d9170c84"
 ```
 
 Inbox 2026-08-13 from net-kingdom (NK-WP-0024): live user-engine sender
@@ -327,6 +354,12 @@ Done when the live sender document cannot revert to a single-tenant
 list on refresh, SCOPE matches the repo, and the net-kingdom message
 is answered.
 
+Done 2026-08-16: Live Secret already has user-engine `tenants: ["*"]`.
+`deploy/senders-scope.json` + ConfigMap `audit-core-senders-scope`
+applied on railiance01. The process overlays that file over the Secret
+so a later KV refresh cannot shrink tenants. Tokens stay out of Git.
+SCOPE current state updated.
+
 ## Acceptance
 
 - Production fail-closed gate no longer keys off the word `archive`.