Package protected review runtime and prepare deployment admission

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

SCOPE.md

@@ -10,8 +10,9 @@
 durable evidence store and scheduled Audit Core delivery are implemented.
 The approval surface is not deployed.**
 
-What exists and is tested (344 tests and 12 Chromium checks, including actual
-Flex Auth, Approval Engine and Audit Core with synthetic identity/custody):
+What exists and is tested (371 automated tests and 11 container checks; the
+previous browser milestone passed 12 Chromium checks). Component tests use
+actual Flex Auth, Approval Engine and Audit Core with synthetic identity/custody:
 
 - layer and stance declarations — `layer.yaml`, `pep-stance.yaml`,
   `informed_decision/stance.py`, with published-equals-shipped asserted;
@@ -39,10 +40,15 @@ Flex Auth, Approval Engine and Audit Core with synthetic identity/custody):
   accept/return/discuss/decline and visible original/unresolved entry state;
 - `runtime.py` — explicit owner configuration, rotating credential-file readers,
   30-second audit draining, heartbeat/reconciliation and delivery readiness.
+- `Containerfile`, `container.py`, `requirements.lock` and deployment renderer —
+  a locally built/scanned image, private projected-config handoff, one serving
+  writer, backup/inspection commands and eight review-only Kubernetes objects.
+  Network-isolated container restart/restore preserves unresolved submissions.
 
 Remaining: native policy package/caller/assignment admission, registered human
-login and deployed binding, independent production audit custody, packaging,
-backup/restore and operator recovery admission. The legacy `evidence.Outbox` remains an
+login and deployed binding, independent production audit custody, image
+publication/cutover, platform backup/restore and operator recovery admission.
+The legacy `evidence.Outbox` remains an
 in-memory test double; the new `Store` supplies durable atomicity. Browser
 sessions are ephemeral, with no approval state.
 Without owner runtime configuration `/readyz` returns 503. With it, readiness
@@ -51,6 +57,8 @@ The origin's last observed deployment was an nginx placeholder on 2026-09-10.
 See [browser-authentication.md](docs/browser-authentication.md) and
 [durable-review-evidence.md](docs/durable-review-evidence.md) and
 [protected-browser-review.md](docs/protected-browser-review.md).
+The [deployment packet](deploy/README.md) records native wiring observations,
+the missing Approval Engine namespace and remaining owner admission.
 
 `INFD-WP-0001-T08` remains open for the live end-to-end proof, which is gated on
 `APPROVAL-WP-0002-T01` and a deployed `approval-engine`.