Inbox 2026-11-07: executor tenant tenant:platform, audit-core pin 4da952c, P6 answers recorded

- AUDIT-WP-0020-T03: exercise_audit_sender emits tenant:platform and probes
  tenant:other as the wrong tenant (row E6); contract suite 131 passed
  against audit-core 4da952c.
- Intake doc: audit-core P6 answers (tenant, correlation_origin, privacyIDEA
  option b, no backfill, 30-day recoverability).
- NK-WP-0055-T11 note; NK-WP-0035-T04 and NK-WP-0054-T04 wait reasons now
  name the founder/next step after the 2026-11-03 owner deliveries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6

bounded-executor/exercise_audit_sender.py

@@ -11,7 +11,7 @@ Checks:
     (tools/execution-attribution-receipt, schema v0.1)
   - a retry of the same event is a duplicate (200); the same id with another body is a conflict (409), which the
     client reports as a run-id-reuse defect
-  - wrong source, wrong tenant (`tenant:platform`), no token and a wrong token are refused; nothing is stored for them
+  - wrong source, wrong tenant (`tenant:other`), no token and a wrong token are refused; nothing is stored for them
   - a started event whose admission window has passed, with no receipt, becomes an opening_without_closing finding
     held to that window; the closed runs do not
 Synthetic tokens only. Writes a value-free receipt. Exit 0 when every check passes.
@@ -92,7 +92,7 @@ def run_executor(name: str, audit, fail_checks=()) -> list[dict]:
                   checks={c["id"]: fake.check for c in doc["spec"]["checks"]}, trust=lambda _s: True, audit=Tee(),
                   alert=lambda *_a: None, sleep=lambda _s: None)
     cfg = X.Config(executor_identity=doc["spec"]["executor"]["identity"],
-                   runtime_principal="system:serviceaccount:sso:nk-bind-executor", tenant="platform",
+                   runtime_principal="system:serviceaccount:sso:nk-bind-executor", tenant="tenant:platform",
                    environment="TEST", approver_subjects={"admin": "kc-sub-0f3a"},
                    approver_issuer="https://kc.coulomb.social")
     run = X.Run(doc, G.APPROVAL, cfg, deps)
@@ -218,7 +218,7 @@ def exercise(args) -> dict:
 
             refused = {
                 "wrong_source": (fresh(completed[0], source="user-engine"), "executor"),
-                "wrong_tenant": (fresh(completed[0], tenant="tenant:platform"), "executor"),
+                "wrong_tenant": (fresh(completed[0], tenant="tenant:other"), "executor"),
                 "other_sender_token": (fresh(completed[0]), "other"),
                 "no_token": (fresh(completed[0]), None),
                 "unknown_token": (fresh(completed[0]), "synthetic-unknown-token"),