Apply GH-DEC-2026-013 and GH-DEC-2026-014; close INFD-IN-0002

Two rulings landed and both corrected something.

GH-DEC-2026-013 accepted our binding-versus-awareness argument, wrote it into
the record as its §6, and did not change the outcome — it sharpened the defect.
Two different facts share one field named tenant: the act-scope, a property of
the act that our binding slice commits, and the principal's membership, a
property of the person that approval-engine exact-matches. Gate House's
correction stands: a binding slice that must commit the scope being entered
should commit that scope, not borrow a membership claim to stand in for it. Our
schema already does — binding.target IS the act-scope and is inside view_hash —
so no field was added, only a statement (PR-08) and a provenance record (PR-09),
since key-cape emits tenant as a bare string.

key-cape had already implemented registration-bound tenancy on 2026-09-09,
correct under both candidate rulings, so the fail-closed-at-first-use risk that
made us withhold the client strings was already retired. IN-0002 closed. The one
remaining input to T07 is the deployed origin.

GH-DEC-2026-014 granted commitment-only evidence and bounded it. It satisfies
non-alteration and NOT reconstructability, and must not be described otherwise
anywhere. It also corrected our wording of the gap: we wrote that it leaves us
able to erase the content, which understates it. Commitment-only moves integrity
out of our control and leaves availability entirely inside it — the party that
can withhold the content is the party the evidence is about. Limit 3's condition
reduced, not removed.

The grant carries a condition we did not propose and would not have thought of:
the path must assert that committed content exists and where custody sits, so
non-production is a finding attributable to the custodian rather than an
unremarkable blank. A commitment with no assertion that something is being
committed to is indistinguishable from a commitment to nothing. Booked as PR-53,
and marked not-a-reversal-candidate.

Recorded the meta-rule Gate House named, now in its third setting here: unknown
versus absent in the stance map, directory-asserted versus registration-supplied
in the tenant claim, erased versus never held in the evidence path. Wherever a
system reaches one appearance by two routes, the record must say which route.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568

docs/specs/ArchitectureBlueprint.md

@@ -62,12 +62,28 @@ and `scope`, and an `assurance` object.
 restating the shape, so it cannot drift. `at` is authentication time, not token
 mint time; consumers needing freshness compare `at` rather than assuming it.
 
-**Open — blocking T07.** A human access token cannot carry `tenant:platform`
-today: the tenant claim on human tokens resolves from the directory user record,
-which no adapter populates, so tokens fall back to `tenant:coulomb`.
-`approval-engine` compares by exact equality and refuses near-misses. Resolution
-is registration-bound (preferred here) or directory-sourced; it is not this
-repository's alone to decide. See §7.
+**Resolved.** `key-cape` implemented registration-bound tenancy on 2026-09-09
+(`329e48f`), deliberately correct under both candidate rulings: a declared zone
+applies where the directory places the user nowhere, agreement passes, and a
+declared zone **conflicting** with a directory assignment refuses issuance with
+`403 tenant_binding` rather than relabelling. `GH-DEC-2026-013` then ruled
+directory-sourced the terminal state and granted the registration-bound shape as
+a **declared bounded gap** — admissible precisely because its distinguishing
+case fails closed.
+
+**Build to it knowing it is transitional.** Two obligations land here:
+
+- **Do not declare a tenant the directory record does not carry** unless
+  prepared to say so in the record. Declaring one asserts a fact about a person
+  on this registration's authority, which the ruling permits only as a gap.
+- **Record the tenant claim's provenance.** `key-cape` emits `tenant` as a bare
+  string, so a consumer cannot distinguish a directory-asserted tenant from a
+  registration-supplied one. `GH-DEC-2026-013` §5 requires the claim to carry
+  provenance; until it does, this surface records which route the value arrived
+  by rather than storing an undifferentiated string.
+
+**And do not use the `tenant` claim as the act-scope.** `binding.target` is the
+act-scope and is committed in `view_hash`. See `EvidenceModel.md` §8c.
 
 ### 2.2 `access-engine` — the decision, consumed
 
@@ -235,17 +251,23 @@ gated on the tenant question in §7.
 
 ## 7. Open and blocking
 
-**O-01 — Human token tenant.** Blocks T07. Registration-bound (this
-repository's stated preference, as the tenant is then a property of the surface
-and its registration — which is exactly what the pre-sign binding slice commits)
-versus directory-sourced (which makes tenant a property of the person and
-changes it everywhere). Not ours alone; raised with `key-cape`,
-`approval-engine` and `gate-house`. If registration-bound is chosen, the
-condition that it holds *only* because registrations are static and
-deployment-owned should be written into the contract, not left as reasoning in a
-message.
+**~~O-01 — Human token tenant.~~ Closed 2026-09-10** by `GH-DEC-2026-013` and
+`key-cape` `329e48f`. Our binding-versus-awareness argument was accepted and
+written into the ruling as its §6 — and it did not change the outcome, it
+sharpened the defect: two different facts (act-scope, and the principal's
+membership) were sharing one field. The condition we asked for is now in
+`key-cape`'s `docs/tenant-claim-contract.md`, strengthened from "must be
+revisited" to **void** if the dynamic-registration exclusion is lifted, and
+enforced by a test asserting the capability and the exclusion together. See
+§2.1 for the two obligations that land on us.
 
-**O-02 — The independent evidence path.** Design and decision request written:
+**O-02 — The independent evidence path.** *Payload ruled: commitment-only
+granted for Stage 1 by `GH-DEC-2026-014`, on the condition that the record carry
+an assertion that content exists and where custody sits, so non-production is a
+finding attributable to us rather than an unremarkable blank. It satisfies
+non-alteration, not reconstructability, and must not be described otherwise. The
+registration and cadence remain with `audit-core`.* Design and decision request
+written:
 `docs/evidence-path-design.md`, filed as `INFD-IN-0003`. Read independence and
 the local transactional outbox are settled; the open question is **what
 travels**, because a presentation record carries the brief and packet material
@@ -275,3 +297,7 @@ with no obvious `approval-engine` counterpart. Stage 1 scope undecided.
 - A polling loop against `approval-engine` synthesising an inbox.
 - A fail-closed outcome recorded as an approver's decline.
 - Describing the decision path as validated while `GH-DEC-2026-010` is open.
+- Describing commitment-only evidence as reconstructability
+  (`GH-DEC-2026-014`).
+- Using the token's `tenant` claim as the act-scope, or storing it without its
+  provenance (`GH-DEC-2026-013` §5).