observe.py compares the service-identity declarations against
railiance-platform's value-safe live metadata (b0b6c0c) with a 7-day
freshness bound; read-only, offline, 9 tests. Result: 5 conformant,
2 unknown; undeclared keycape/platform-admin alias grants platform-admin
without aal2 (non-conformant), 14 undeclared roles unknown.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 149903@bnt-lap001
Assistant-Session: 4c20a536-1452-4a85-bc09-e1987d9817d6
tegwick
4a684baabf