MAS-WP-0005-T13: live check passed (forged sender: no reply; Gmail: dkim/spf/dmarc pass, reply); T05 done

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 252470@bnt-lap001
Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241

workplans/MAS-WP-0005-spec-errata-v0-1-1.md

@@ -172,7 +172,7 @@ rather than errata.
 
 ```task
 id: MAS-WP-0005-T05
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "8d3bc09e-6f8d-5125-b10c-45b9aa5643a2"
 ```
@@ -427,7 +427,7 @@ sends auto-replies (intake confirmation, closed notice) only when
 
 ```task
 id: MAS-WP-0005-T13
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "8a1f1fc4-f300-5e60-8714-5a47c39d88a1"
 ```
@@ -437,3 +437,17 @@ Deploy. A Gmail intake (DMARC pass) gets a reply. A mail with a
 (SPF/DKIM fail, so DMARC fail) creates a ticket but gets no reply. Check
 the send counter.
 
+- 2026-10-18 done (image `mas-live:v0.2-a45f1a1`; both milters listening,
+  gateway `--trusted-authserv-id`, ticket service `--require-dmarc-pass`):
+  - **Forged:** sent from the workstation with `From: test@coulomb.social`
+    and a forged `Authentication-Results: mas.coulomb.social; dmarc=pass`.
+    The event verdict was `dmarc: fail, spf: fail`: the forgery was
+    stripped and the real verdict used. Ticket `gs-mt1hcg3tae` was created
+    and **no reply** sent (no outbox row; sends stayed at 3/300).
+  - **Gmail (founder):** the verdict was `dkim: pass, spf: pass,
+    dmarc: pass` (header.from gmail.com), the first live DKIM verification
+    by OpenDKIM. Ticket `gs-rcce2nne4k` was created and the reply sent
+    through TEM (sends 4/300).
+  - T05 is complete. The reference stack now meets all of spec §14
+    item 10.
+