feat: verify native factory sender delivery and outbox replay

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/credential-lane-designs/factory-native-acceptance.md

@@ -0,0 +1,64 @@
+# Bounded native factory sender acceptance
+
+RPF-WP-0035-T08 and AUDIT-WP-0009-T09/T11 retain this acceptance under approved
+CCR-2026-0021/0022. Custody and delivery are already complete. This operation
+creates no credential, registry entry, approval, disposition or UI service.
+
+The six exclusive resources are one immutable ConfigMap, one probe-only
+NetworkPolicy and one Job in each producer namespace. Jobs mount only their
+own delivered audit field, have no API token, run as UID 10001 with read-only
+root and no capabilities, and use disposable private SQLite state. Egress is
+restricted to Audit Core's receiver and cluster DNS; existing namespace
+NetworkPolicies refuse preparation for native execution because grants add.
+Jobs have a 150-second deadline and no retry. Cleanup is UID guarded and waits
+for each Job and its pods to disappear before removing its isolation policy.
+
+The runtime image is the already published Approval Engine 251941a5 digest.
+The immutable ZIP contains 31 actual producer Python files from Approval
+Engine a0a60297 and Informed Decision bda9381f. Both sources and the full packet
+are hash pinned. This proves source adapter/outbox integration on Railiance;
+it does not publish or admit Informed Decision's full service image.
+
+Each job seeds exactly one explicitly synthetic outbox record in its disposable
+store. It sends through the real audit adapter, loses the successful 202 receipt,
+starts a fresh Python process, and drains the preserved outbox with a 200 duplicate.
+It checks exact source/tenant refusals, seven evidence-read refusals, invalid
+bearer refusal, one own-source reconciliation count and sibling-count refusal.
+No domain approval/disposition API is called, and no production heartbeat is
+emitted. Domain-transaction atomicity is not retested by synthetic outbox seeding.
+
+The attended parent reads the authoritative registry only in memory, verifies
+the two exact sender scopes, selects an unambiguous existing independent
+read-only full-tenant operator, and retrieves only the two named synthetic
+events and chain-integrity metadata through a private loopback port-forward.
+Credentials never appear in arguments, stdout, logs or receipts. This uses the
+reviewed platform-admin envelope; no producer receives the operator registry.
+
+Prepare and inspect before opening the attended window:
+
+```sh
+python3 scripts/native_factory_acceptance.py prepare \
+  --source-root /home/worsch --packet /operator/unique-packet.json
+```
+
+The result names the packet digest. Under `scripts/openbao-attended-exec.py`:
+
+```sh
+python3 scripts/native_factory_acceptance.py run \
+  --packet /operator/unique-packet.json --packet-sha256 REVIEWED_SHA256 \
+  --kubeconfig /operator/railiance-kubeconfig --server https://127.0.0.1:16444 \
+  --receipt /operator/unique-native-receipt.json \
+  --confirm 'VERIFY CCR-2026-0021 CCR-2026-0022 PRODUCERS'
+```
+
+Four preparation/guard/integration tests pass. The integration test runs both
+real source outboxes in the pinned image against actual local Audit Core and
+preserves exactly two events with an intact chain. All six native objects pass
+server dry-run. Neither rehearsal result is claimed as native evidence.
+
+Success remains `native_producer_delivery_verified_pending_bearer_revocation_and_service_admission`.
+Invalid bearer refusal does not prove revocation of a previously admitted audit
+bearer. CCRs stay applied until their remaining lifecycle acceptance exists;
+rotation/revocation must use its separately reviewed owner procedure. Service
+startup, human binding, native policy/caller admission, attestation/offsite
+operation and factory execution remain in their existing owner records.