The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.
Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
Accept now extends a single-schema chain. Verify walks it; a rewritten
payload_hash is a break. Tamper evidence is that detector plus an
external chain-head attestation, not WORM.
Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.