Close G10, the last of the ten assessment gaps

Every closure criterion now has evidence, taken one at a time rather than as an
impression. Custody admitted and provisioned (CCR-2026-0017/0018, both secrets
wired, receipt committed). The real callback registered, verified live by its
owner, pinned by test. The new contracts deployed and verified at the 2026-09-09
attended rollout: acceptance passed at generation 38, per-client live JWKS
verification, exact claims, excess-scope and wrong-secret denial, human consume
denied, no credential values emitted. Token types reconciled at the consumer
boundary -- ops-warden took option (a) because the proxy's OpenBao token and an
issuer JWT were never one thing to cut over between; both lanes owner-confirmed
and no route changed. Four handoff receipts retained.

The condition that named the gap -- source capability running ahead of live
custody and consumer adoption -- no longer holds.

What closing it does not claim, stated in both documents: the approver
registration is published, not deployed, so the human approval path is registered
rather than proved; the deployed image predates most of this revision; the
verifier receipt declines real predecessor rotation and observed wall-clock
expiry and so do we; and the Qonto rotation is deferred by owner decision on
evidence. Those are open items with owners and triggers, which is a different
thing from a gap between what this repository claims and what is true.

SCOPE's header lineage is consolidated so a reader can ask what changed since a
given revision and get an answer, and the test count is refreshed rather than
carried.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

history/2026-09-05-011726-scope-intent-assessment.md

@@ -487,7 +487,43 @@ login against production. `docs/operations.md` documents pinning
 `authelia.issuer`/`jwksUrl`, and the failure now reports a specific
 `id_token_issuer_mismatch` reason so it is diagnosable in seconds.
 
-The rest is owner work and stays open.
+**Status 2026-09-10: closed.** Every closure criterion now has evidence, and the
+criteria are taken one at a time rather than as an impression:
+
+1. *Named owners admit and provision exact lanes.* CCR-2026-0017/0018 approved by
+   the platform operator; both approval client secrets exist in `sso`, are wired
+   into the pod, and the registrations are in the deployed config. Receipt:
+   `docs/evidence/2026-09-09-keycape-verifier-admission.json`.
+2. *Register the real callback.* `informed-decision-approver` with
+   `https://decisions.coulomb.social/auth/callback`, submitted 2026-09-10 with the
+   origin verified live by its owner, registered verbatim and pinned by test.
+3. *Deploy and verify the new contracts.* The attended rollout of 2026-09-09
+   reached `acceptance_phase: passed` at generation 38, with per-client live JWKS
+   signature verification, exact claims, excess-scope and wrong-secret denial at a
+   900s lifetime, `human_client_consume_denied` and `existing_human_login_after`
+   both true, run verifier-side with `credential_values_emitted: false`.
+4. *Reconcile token types at consumer boundaries.* ops-warden took option (a) —
+   the proxy yields an OpenBao token and `keycape login` an issuer JWT, so they
+   were never one thing to cut over between. Both lanes are `owner-confirmed`; no
+   route was changed.
+5. *Retain handoff receipts.* Four committed receipts in `docs/evidence/`, plus
+   the outbound message receipts readable from the hub.
+
+The condition that named this gap — source capability running ahead of live
+custody and consumer adoption — no longer holds. Custody is admitted, the
+consumers have adopted, and the record is kept.
+
+**What remains unexercised, and is not claimed by closing this.** The approver
+registration is published, not deployed: no human approver has logged in through
+it, so the human approval path is registered rather than proved. The deployed
+image predates the authorization-code bindings, upstream verification, readiness,
+the tenant work and the guards, so several described behaviours are running
+nowhere yet — see `docs/operations.md`. The verifier receipt declines
+`real_predecessor_rotation_tested` and `observed_wall_clock_expiry`, and so do we.
+The Qonto rotation is deferred by owner decision on evidence, not blocked.
+
+These are open items with owners and triggers, not a gap between what this
+repository claims and what is true — which is what G10 measured.
 
 ## Deliberate exclusions are not defects