Record round 12: audit-core release pin reviewed by all five owners.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 236506@bnt-lap001
Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4

workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md

@@ -567,3 +567,17 @@ owner-scoped sub-agent reviews. The founder posts the hash-bound receipts with
 `wp0024-owner-review.py approve` under `AUDIT_KUBECONFIG`, because `approve`
 runs the live preflights. Open non-blocking residuals: `created_at` ordering
 is a string comparison, and hub `from_agent` is self-declared.
+
+Round 12 (contract `a5e2b55d`, base `86eb456`). The founder's first live
+`approve` refused: every preflight failed `image_matches_reviewed_digest`.
+audit-core `1269a0e` (2026-10-15) had deployed `sha256:b479801b…`, and the
+founder confirmed it on the deployment and pod; the attest-chain CronJob stays
+on `ec15f63d`. The preflight now pins `b479801b`. All other automated checks
+passed: OpenBao unsealed, platform-pg, ESO, health 200 and readiness 200.
+
+Five owner reviews approve. audit-core diffed `audit_core/` from `bc3d80f`
+(`ec15f63d`) to `5227fb1` (`b479801b`). Health and readiness are unchanged.
+accepted→duplicate still holds: the only change is the chain-head selection,
+which is the same on a healthy chain. The `senders.json` registry is
+compatible (optional `emission_cadence`), and lease/readiness behaviour is
+unchanged.