Record personal account blocker and reviewed live release proposal

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

SCOPE.md

@@ -61,8 +61,13 @@ The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until
 an explicit cutover. Historical identity/app-shell evidence is in
 [identity smoke](docs/identity/smoke.md). Public registration was evidenced on
 2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration,
-persistent CONTENT_ROOT and live smoke. No fresh live deployment verification
+persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm
-was performed in this review. All six original numbered workplans are finished;
+an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence.
+Personal sign-in is broken: the user reports unknown client_id, and guarded
+inspection confirms the public coulomb-social OIDC client is absent. The latest
+88-test app image and persistent chart upgrade are prepared, not deployed;
+[release assessment](docs/release/personal-account-2026-10-06.md) documents the
+exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished;
 their residual intakes remain the source of unfinished work.
 
 ## Ownership boundaries

WORK-RECORDS.md

@@ -53,7 +53,7 @@
 | task | CSOC-WP-0007-T02 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
 | task | CSOC-WP-0007-T03 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
 | task | CSOC-WP-0007-T04 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
-| task | CSOC-WP-0008-T01 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
+| task | CSOC-WP-0008-T01 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0008-T02 | todo | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0008-T03 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0008-T04 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
@@ -63,6 +63,7 @@
 | task | CSOC-WP-0008-T08 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0008-T09 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0008-T10 | done | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
+| task | CSOC-WP-0008-T11 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
 | task | CSOC-WP-0009-T01 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |
 | task | CSOC-WP-0009-T02 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |
 | task | CSOC-WP-0009-T03 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |

docs/dev.md

@@ -51,13 +51,16 @@ See `.env.example`. Summary:
 
 ### Platform OIDC (KeyCape)
 
-Client is registered on railiance01 KeyCape. Re-apply if redirect URIs change:
+Historical client registration has drifted: guarded inspection on 2026-10-06
+finds it absent. Inspect through the safe owner wrapper (read-only default):
 
 ```bash
 ./scripts/register-keycape-client.sh
 ```
 
-Then:
+Live repair requires exact founder approval; see docs/release/personal-account-2026-10-06.md.
+
+App configuration:
 
 ```bash
 export OIDC_ENABLED=true

docs/identity/oidc-client.md

@@ -11,7 +11,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
 | client_type | **public** (no client secret; PKCE only) |
 | redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` · `http://localhost:8008/auth/callback/` |
 | redirect_uri (public app) | `https://app.coulomb.social/auth/callback/` (**live** host while Bubble keeps apex) |
-| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (registered; cutover deferred) |
+| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (historical descriptor; cutover deferred) |
 | scopes | `openid profile email groups` |
 | grant | authorization_code |
 | wildcard redirects | **forbidden** |
@@ -21,10 +21,10 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
 | Environment | Issuer mode | Registered |
 |-------------|-------------|------------|
 | local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
-| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **yes** (2026-08-09) |
+| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 |
 | key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
 
-### Live verification (2026-08-09)
+### Historical verification (2026-08-09)
 
 - Registered via `scripts/register-keycape-client.sh` →
   `net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh` (patches
@@ -43,8 +43,21 @@ export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
 make run
 ```
 
-Re-register after redirect URI changes:
+Inspect current registration (read-only default):
 
 ```bash
 ./scripts/register-keycape-client.sh
 ```
+
+### Current repair — 2026-10-06
+
+User tegwick reports invalid_profile_usage / unknown client_id. Guarded live
+inspection confirms the missing client; server dry-run passes. The wrapper now
+uses NetKingdom's byte-preserving CAS helper and executes Kubernetes operations
+on railiance01 through SSH, suppressing Secret output/errors. It refuses differing
+registrations. Explicit `dry-run` / `apply` modes require the fresh inspection's
+`--expected-uid` and `--expected-resource-version`. Apply and issuer restart need
+founder approval; the wrapper never restarts the issuer automatically.
+
+See [release review](../release/personal-account-2026-10-06.md) and
+[ordinary-session assurance close-down](../security-close-down-checklist.md).

docs/release/personal-account-2026-10-06.md

@@ -0,0 +1,116 @@
+# Personal Coulomb account release — 2026-10-06
+
+CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
+No live mutation has been performed. Prepared code, image and review branch are
+ready; the personal account is not yet usable through this app.
+
+## What is running
+
+There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9,
+image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old
+August shell; it has no content PVC and lacks the latest tested workspace flows.
+The user-selected tegwick Member already exists in tenant:coulomb, bound to
+issuer https://kc.coulomb.social and directory subject
+uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required.
+One demo space has no membership grants; a stored Member alone grants no access.
+
+The user's actual login returns invalid_profile_usage / unknown client_id.
+Guarded read-only inspection confirms the coulomb-social client is absent from
+KeyCape. Discovery health and stored identity did not establish working login.
+
+## Exact proposed change
+
+1. Restore NetKingdom's historical public coulomb-social client. Authorization
+   code + PKCE; scopes openid/profile/email/groups; exact callbacks:
+   http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/,
+   https://app.coulomb.social/auth/callback/ and
+   https://coulomb.social/auth/callback/. No wildcards or client secret.
+   Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains
+   available), as recorded in docs/security-close-down-checklist.md.
+2. Restart only sso/keycape to load that registration. This shared issuer restart
+   can interrupt in-flight sign-ins. Issued tokens remain valid. No other client
+   registrations or credentials are changed.
+3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily
+   Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that
+   establishes an existing DB recovery point, not paired application recovery.
+4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic.
+   Source image ac7bac1852c9 is published and pinned to immutable digest
+   sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
+   Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content;
+   CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app
+   interruption; no rolling surge. Existing PostgreSQL and env Secret references
+   remain. Entrypoint runs Django migrations; Helm rollback does not undo them.
+
+Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before
+execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.
+
+## Verification completed
+
+- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy,
+  rich HTML/plain text payloads, reader-write denial and outsider privacy.
+- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal
+  checks pass; owner helper preserves unrelated config bytes and other Secret data.
+- Live safe inspect and server dry-run through SSH pass, with no Secret values or
+  raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3,
+  resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
+- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes,
+  with ClipboardItem code. Static assets are collected into the release image.
+- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount,
+  CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas,
+  RollingUpdate and content-root mismatch.
+
+## Execution and recovery after approval
+
+Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED. Freeze the reviewed owner branch before moving its changes
+into main; re-render and repeat diff/dry-run if the live state has changed.
+
+Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh
+--expected-uid/--expected-resource-version; apply with the same receipt. The
+wrapper executes Kubernetes operations on railiance01 through SSH and suppresses
+Secret output/errors. It does not restart anything. Only after readback succeeds,
+restart sso/keycape from the node and wait for rollout readiness. Check discovery
+and authorization handoff; ask the user to complete their own interactive login.
+If issuer readiness fails, stop: never replay a stale Secret or reset other
+clients. Any inverse repair needs fresh revision checks and owner review.
+
+Before the app upgrade, create a scoped CNPG Backup in databases with
+spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status.
+Use a timestamped csoc-preupgrade name and record non-secret completion metadata.
+Copy the reviewed chart/production values to a private node staging directory.
+From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade
+coulomb-social in namespace coulomb-social with the reviewed values, --atomic,
+--wait and a bounded timeout. No env Secret reconstruction or legacy registration
+apply script. Verify readiness, image digest, static asset, mounted content write
+ownership and database migrations before exposing productive content.
+
+Application rollout failure: Helm atomic rollback returns to the previous release
+(revision 9 baseline). Retain the content PVC; never delete it for a retry.
+Investigate migrations separately; restore the private pre-upgrade DB backup only
+through the owning PostgreSQL lane and a separately confirmed destructive restore.
+
+## User milestone and remaining acceptance
+
+The immediate milestone is: tegwick signs in at app.coulomb.social and can use a
+personal private workspace on the new infrastructure. Then demonstrate the first
+ReichelAg journey: retain the original full protocol, duplicate it for the next
+call, edit agenda/protocol by hand, and copy rich/plain content for manual email.
+
+Successful rollout does not finish WP0008. Prove content restart durability and
+paired DB/content restore (T02); privately reconcile the real nominated latest
+ReichelAg protocol (T03); complete user review and actual email-client paste
+(T09). Sharing/export/delete and content fidelity remain tracked tasks. No
+Bubble exit/apex cutover or real-data import is included in this live approval.
+
+## Review artifacts
+
+Application source is committed to coulomb-social main. Deployment changes are on
+railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
+https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
+
+Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
+certificate access. No secrets were fetched into chat, logs, Git or State Hub.
+Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61;
+portal-client-rollout.py SHA256
+158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f.
+Changes to the owner helper require fresh review/dry-run before live execution.

docs/security-close-down-checklist.md

@@ -0,0 +1,17 @@
+# Coulomb sign-in close-down record
+
+2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
+and coulomb-social (product assurance). Proposed repair, not yet activated.
+
+The historical public authorization-code/PKCE client descriptor has
+`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
+Restoration would retain that historical policy, with no changes to other clients.
+Before production approval, the owners must decide and verify whether ordinary
+personal sessions may remain AAL1, which actions require step-up, and that PKCE,
+exact callbacks and tenant checks are enforced by the running issuer/application.
+Do not treat successful discovery, synthetic tests or a registered Member as
+proof of interactive authentication. The live restoration requires founder go.
+
+Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
+CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
+preparing this descriptor. No issuer policy has been loosened in this session.

history/20261006T144400Z-personal-account-release-assessment.md

@@ -0,0 +1,116 @@
+# Personal Coulomb account release — 2026-10-06
+
+CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
+No live mutation has been performed. Prepared code, image and review branch are
+ready; the personal account is not yet usable through this app.
+
+## What is running
+
+There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9,
+image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old
+August shell; it has no content PVC and lacks the latest tested workspace flows.
+The user-selected tegwick Member already exists in tenant:coulomb, bound to
+issuer https://kc.coulomb.social and directory subject
+uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required.
+One demo space has no membership grants; a stored Member alone grants no access.
+
+The user's actual login returns invalid_profile_usage / unknown client_id.
+Guarded read-only inspection confirms the coulomb-social client is absent from
+KeyCape. Discovery health and stored identity did not establish working login.
+
+## Exact proposed change
+
+1. Restore NetKingdom's historical public coulomb-social client. Authorization
+   code + PKCE; scopes openid/profile/email/groups; exact callbacks:
+   http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/,
+   https://app.coulomb.social/auth/callback/ and
+   https://coulomb.social/auth/callback/. No wildcards or client secret.
+   Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains
+   available), as recorded in docs/security-close-down-checklist.md.
+2. Restart only sso/keycape to load that registration. This shared issuer restart
+   can interrupt in-flight sign-ins. Issued tokens remain valid. No other client
+   registrations or credentials are changed.
+3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily
+   Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that
+   establishes an existing DB recovery point, not paired application recovery.
+4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic.
+   Source image ac7bac1852c9 is published and pinned to immutable digest
+   sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
+   Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content;
+   CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app
+   interruption; no rolling surge. Existing PostgreSQL and env Secret references
+   remain. Entrypoint runs Django migrations; Helm rollback does not undo them.
+
+Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before
+execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.
+
+## Verification completed
+
+- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy,
+  rich HTML/plain text payloads, reader-write denial and outsider privacy.
+- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal
+  checks pass; owner helper preserves unrelated config bytes and other Secret data.
+- Live safe inspect and server dry-run through SSH pass, with no Secret values or
+  raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3,
+  resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
+- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes,
+  with ClipboardItem code. Static assets are collected into the release image.
+- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount,
+  CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas,
+  RollingUpdate and content-root mismatch.
+
+## Execution and recovery after approval
+
+Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01,
+activation=APPROVED. Freeze the reviewed owner branch before moving its changes
+into main; re-render and repeat diff/dry-run if the live state has changed.
+
+Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh
+--expected-uid/--expected-resource-version; apply with the same receipt. The
+wrapper executes Kubernetes operations on railiance01 through SSH and suppresses
+Secret output/errors. It does not restart anything. Only after readback succeeds,
+restart sso/keycape from the node and wait for rollout readiness. Check discovery
+and authorization handoff; ask the user to complete their own interactive login.
+If issuer readiness fails, stop: never replay a stale Secret or reset other
+clients. Any inverse repair needs fresh revision checks and owner review.
+
+Before the app upgrade, create a scoped CNPG Backup in databases with
+spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status.
+Use a timestamped csoc-preupgrade name and record non-secret completion metadata.
+Copy the reviewed chart/production values to a private node staging directory.
+From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade
+coulomb-social in namespace coulomb-social with the reviewed values, --atomic,
+--wait and a bounded timeout. No env Secret reconstruction or legacy registration
+apply script. Verify readiness, image digest, static asset, mounted content write
+ownership and database migrations before exposing productive content.
+
+Application rollout failure: Helm atomic rollback returns to the previous release
+(revision 9 baseline). Retain the content PVC; never delete it for a retry.
+Investigate migrations separately; restore the private pre-upgrade DB backup only
+through the owning PostgreSQL lane and a separately confirmed destructive restore.
+
+## User milestone and remaining acceptance
+
+The immediate milestone is: tegwick signs in at app.coulomb.social and can use a
+personal private workspace on the new infrastructure. Then demonstrate the first
+ReichelAg journey: retain the original full protocol, duplicate it for the next
+call, edit agenda/protocol by hand, and copy rich/plain content for manual email.
+
+Successful rollout does not finish WP0008. Prove content restart durability and
+paired DB/content restore (T02); privately reconcile the real nominated latest
+ReichelAg protocol (T03); complete user review and actual email-client paste
+(T09). Sharing/export/delete and content fidelity remain tracked tasks. No
+Bubble exit/apex cutover or real-data import is included in this live approval.
+
+## Review artifacts
+
+Application source is committed to coulomb-social main. Deployment changes are on
+railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
+https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
+
+Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
+certificate access. No secrets were fetched into chat, logs, Git or State Hub.
+Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61;
+portal-client-rollout.py SHA256
+158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f.
+Changes to the owner helper require fresh review/dry-run before live execution.

scripts/keycape-client-repair.py

@@ -5,7 +5,10 @@ Inspection is read-only. Apply requires exact founder approval and a fresh
 UID/resource-version receipt. Secret values stay inside the owner helper.
 """
 import importlib.util
+import json
 import os
+import shlex
+import subprocess
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -31,6 +34,22 @@ def configure(owner_root):
         return original(secret)
 
     rollout.replacement = replacement
+
+    def kubectl(arguments, payload=None):
+        # Estate production changes execute on the node, never through a
+        # workstation context. Capture both streams: kubectl errors may include
+        # a Secret; only the owner's fixed reason code may leave this function.
+        result = subprocess.run(
+            ["ssh", "railiance01", shlex.join([
+                "kubectl", "--request-timeout=20s", *arguments,
+            ])],
+            input=None if payload is None else json.dumps(payload),
+            text=True, capture_output=True, timeout=40,
+        )
+        rollout.require(result.returncode == 0, "kubernetes_operation_failed")
+        return json.loads(result.stdout)
+
+    rollout.kubectl = kubectl
     return rollout
 
 

scripts/test_keycape_client_repair.py

@@ -1,14 +1,17 @@
 """Synthetic owner-lane checks; run with python3 scripts/test_keycape_client_repair.py."""
 import base64
+import importlib.util
 import json
-from pathlib import Path
 import unittest
+from pathlib import Path
 
 import yaml
 
-from importlib.machinery import SourceFileLoader
+spec = importlib.util.spec_from_file_location(
-
+    "csoc_repair", Path(__file__).with_name("keycape-client-repair.py"),
-adapter = SourceFileLoader("csoc_repair", str(Path(__file__).with_name("keycape-client-repair.py"))).load_module()
+)
+adapter = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(adapter)
 
 
 class RepairTests(unittest.TestCase):
@@ -18,7 +21,8 @@ class RepairTests(unittest.TestCase):
     def fixture(self, clients):
         raw = ("# keep comment\nauthelia:\n  issuer: https://auth.example.invalid\n"
                "  clientSecret: synthetic-marker\nclients:\n" +
-               yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) + "tokenLifetime: 15m\n")
+               yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) +
+               "tokenLifetime: 15m\n")
         return {"data": {"config.yaml": base64.b64encode(raw.encode()).decode(),
                          "key.pem": "synthetic-key"}}, raw
 

workplans/CSOC-WP-0008-production-transfer-acceptance.md

@@ -289,8 +289,9 @@ No deployment or credential change was made by these read-only checks.
 
 ```task
 id: CSOC-WP-0008-T11
-status: progress
+status: wait
 priority: high
+state_hub_task_id: "3a6bdbfb-975e-5c3e-b34f-6eeede402521"
 ```
 
 Restore the historical NetKingdom public coulomb-social authorization-code/PKCE
@@ -304,3 +305,8 @@ this task done on an HTTP redirect or discovery-only check.
 
 Knowledge receipt: emergent-security 0.2.6 identity, verified-files,
 orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02.
+
+Prepared review: docs/release/personal-account-2026-10-06.md.
+Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27.
+Published image and owning chart prep complete; live approval and user acceptance
+remain pending. No productive data transferred.