Advance approved custody delivery and expose observation expiry

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29

docs/contracts/root-grant-read-contract_v0.1.md

@@ -25,10 +25,24 @@ transport concurrency state, not the custody revision.
 
 user-engine reads through an authenticated exact-path read-only identity;
 separate attended human custody writes publish whole-document CAS updates.
-The actual user-engine runtime identity/auth binding, writer custody binding,
-bootstrap provenance and live acceptance are still owner delivery requirements.
+The runtime owner declarations now confirm namespace and ServiceAccount
+`user-engine` (`rapp-user-engine/manifests/runtime.yaml`). The reader admission
+uses role `user-engine-root-custody-reader` on existing `auth/kubernetes`,
+with a separate projected JWT audience `openbao`. Its short-lived OpenBao token
+has no default policy and only the exact document read. The flex-auth JWT and
+ESO credentials are separate and cannot substitute for this admission.
+
+The founder subsequently approved going forward with implementation and the
+approved delivery design. Actual admission, attended custody publication,
+bootstrap provenance and live acceptance remain owner execution requirements.
 The producer packet is `railiance-platform/openbao/root-grant/README.md`.
 
+user-engine retains its source/revision baseline atomically in its existing
+PostgreSQL store. Runtime starts with initial-baseline bootstrap disabled;
+controlled initialization must bind the authenticated owner read to retained
+publisher provenance. A database or OpenBao restore requires reconciliation
+against independently retained latest publication evidence before activation.
+
 ## Producer requirements (T05)
 
 The selected owner must implement these requirements in its own repository,