docs: accept native factory audit sender delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/credential-lane-designs/factory-audit-senders-review.md

@@ -54,14 +54,21 @@ workload or network permission. Its owner must supply that prerequisite.
 
 ## Current execution status
 
-The compatible receiver c82e0442de0f is live and both namespaces exist. The
-attended retry seeded both independent version-1 credentials and advanced the
-registry with CAS 7→8, preserving existing senders and fields. Both CCRs are
-**applied**; Warden exited 0 and confirmed revocation for that session. See the
-[seed receipt](../evidence/2026-09-11-factory-audit-sender-seed.json). Delivery,
-receiver reload and producer acceptance remain distinct checks. The next attended
-delivery login failed before handoff (exit 5); no delivery mutation occurred.
-[Delivery return](../evidence/2026-09-11-factory-audit-delivery-login.json).
+Both independent version-1 credentials are provisioned and the authoritative
+registry advanced with CAS 7→8, preserving existing senders and fields. The
+fresh attended delivery retry completed at 2026-09-11 08:27 UTC: exact native
+reader/scope/namespace checks passed; both ESO projections are Ready and match
+custody; registry JSON matched before Audit Core reloaded. The temporary
+namespace is absent and Warden exited 0 with session revocation confirmed.
+The receiver is operational/durable and 1/1 Ready on c82e0442de0f.
+
+Both CCRs remain **applied**, pending actual producer accepted/duplicate and
+receiver scope/read-refusal plus audit bearer-revocation acceptance. The
+completed reader-session revocation does not expire those audit bearers.
+See the [seed](../evidence/2026-09-11-factory-audit-sender-seed.json) and
+[native delivery](../evidence/2026-09-11-factory-audit-delivery-live.json) receipts.
+Earlier failed login receipts remain historical. Do not repeat provisioning
+or delivery for this unchanged successful result; continue producer acceptance.
 
 ## Executable sequence
 

docs/evidence/2026-09-11-factory-audit-delivery-live.json

@@ -0,0 +1,104 @@
+{
+  "schema": "platform.factory-audit-delivery.v1",
+  "status": "delivered_and_scope_verified_pending_producer_acceptance",
+  "started_at": "2026-09-11T08:27:09.975750+00:00",
+  "credential_values_emitted": false,
+  "receiver_before": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59807531",
+    "pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "lanes": [
+    {
+      "ccr": "CCR-2026-0021",
+      "name": "approval-engine",
+      "kv": "platform/data/workloads/approval-engine/audit-sender",
+      "store": "openbao-approval-engine-audit",
+      "secret": "approval-engine-audit",
+      "secret_key": "audit-token",
+      "reader_exact_path": true,
+      "registry_and_sibling_denied": true,
+      "metadata_and_listing_denied": true,
+      "reader_ttl": 900,
+      "reader_revocation_verified": true,
+      "wrong_service_account_denied": true,
+      "coding_agent_deny_wins": true,
+      "external_secret_ready": true,
+      "projection_matches": true,
+      "secret_uid": "3e0f42a6-36b0-4094-8aac-9538fcdcb46f",
+      "secret_resource_version": "59808872",
+      "wrong_namespace_denied": true,
+      "store_namespace_denied": true
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "name": "informed-decision",
+      "kv": "platform/data/workloads/informed-decision/audit-sender",
+      "store": "openbao-informed-decision-audit",
+      "secret": "informed-decision-audit",
+      "secret_key": "token",
+      "reader_exact_path": true,
+      "registry_and_sibling_denied": true,
+      "metadata_and_listing_denied": true,
+      "reader_ttl": 900,
+      "reader_revocation_verified": true,
+      "wrong_service_account_denied": true,
+      "coding_agent_deny_wins": true,
+      "external_secret_ready": true,
+      "projection_matches": true,
+      "secret_uid": "8bb040ec-e1ad-4c46-9f51-488d5db66c0c",
+      "secret_resource_version": "59808881",
+      "wrong_namespace_denied": true,
+      "store_namespace_denied": true
+    }
+  ],
+  "phase": "namespace_verification",
+  "check": "informed-decision:wrong_namespace",
+  "registry_version": 8,
+  "receiver_registry_matches": true,
+  "receiver_secret_resource_version": "59808896",
+  "receiver_after": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59808967",
+    "pod_uid": "4d0ee4e5-5427-43f1-94ca-88e5470c4831",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "receiver_reloaded": true,
+  "temporary_namespace": {
+    "name": "factory-audit-check-731ba3bdf5",
+    "uid": "794cbc75-291b-47e8-8df0-c62c27703cc8"
+  },
+  "namespace_cleanup_requested": true,
+  "completed_at": "2026-09-11T08:27:37.299698+00:00",
+  "namespace_cleanup_verified": true,
+  "attended_wrapper_exit": 0,
+  "attended_session_self_revocation": "confirmed_by_successful_wrapper",
+  "readiness": {
+    "status": "ok",
+    "custody_class": "operational",
+    "durable": true,
+    "tamper_evidence": false,
+    "recoverable_days": 30,
+    "recoverable_source": "resource-control/data/capability/platform-audit-storage.json#provisions[capability=data.backup]",
+    "recoverable_basis": "measured"
+  }
+}