Make S1 handoff read-only by default

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

docs/conformance-loop.md

@@ -10,11 +10,11 @@ conformance (that is 10c, blocked on the family declaration validator).
 
 | Piece | Where | Cadence |
 | --- | --- | --- |
-| Rendered Goss baseline | `/etc/goss/baseline.yaml` from `goss/baseline.yaml.j2` | every `make verify` |
+| Rendered Goss baseline | `/etc/goss/baseline.yaml` from `goss/baseline.yaml.j2` | reviewed converge or `make verify-refresh*` |
 | On-host timer | `railiance-goss-baseline.timer` | hourly, plus 5 minutes after boot |
 | Wrapper | `/usr/local/sbin/goss-baseline-check` | writes `/var/lib/railiance/goss/` |
 | Operator collect | `make goss-status` | on demand |
-| Operator run | `make verify` / `make verify-host HOST=…` | on demand; commits TAP to `reports/` |
+| Operator run | `make verify` / `make verify-host HOST=…` | on demand; read-only remotely, writes transient TAP locally |
 
 The firewall assertions are generated from the same inventory lists that
 converge UFW (`k3s_api_allowed_sources`, `k3s_api_revoked_sources`,
@@ -37,7 +37,9 @@ Railiance01 after T01.
    to a State Hub `/progress/` endpoint. The wrapper notifies only on a
    pass↔fail transition, so a known-fail host (CoulombCore, UFW inactive)
    does not spam.
-4. **git TAP** — `make verify` still commits `reports/goss-<host>-<ts>.tap`
+4. **controller TAP** — `make verify` writes ignored
+   `reports/goss-<host>-<ts>.tap`; reviewed durable evidence is promoted
+   deliberately under `docs/evidence/`
 
 `make goss-status` fails the play if any host still has the `FAILED` flag.