Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

@@ -164,6 +164,22 @@ recipient/MFA and product acceptance stay with VERGABE-WP-0019-T06; recovery
 remains T03 here. No live runtime changes were made in this continuation.
 
 
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
+
 ## Demonstrate restart, isolated restore, rollback and operating ownership
 
 ```task