feat: deliver approved factory audit sender custody

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/credential-lane-designs/factory-audit-senders-review.md

@@ -1,6 +1,6 @@
 # Factory audit senders: concrete custody review
 
-CCR-2026-0021 and CCR-2026-0022 are **approved** by the user on 2026-09-11,
+CCR-2026-0021 and CCR-2026-0022 were **approved** by the user on 2026-09-11,
 replying "good, go on" to the explicit question naming the platform operator,
 Audit Core owner, and each producer owner. The source review comments and the
 two existing State Hub decisions record that approval. RPF-WP-0035-T08 owns
@@ -33,7 +33,7 @@ its observed KV version. That process necessarily reads the existing registry
 in memory; it never emits its credentials or gives it to a producer. No token
 passes through Git, a Hub record, command arguments or stdout/stderr.
 
-## Blocking receiver finding
+## Historical receiver finding (resolved before custody)
 
 On 2026-09-11 the native receiver is 1/1 Ready on
 `forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6`.
@@ -52,6 +52,15 @@ server dry-run in their intended namespaces; its ExternalSecret was refused
 because that namespace does not exist. This packet creates no namespace,
 workload or network permission. Its owner must supply that prerequisite.
 
+## Current execution status
+
+The compatible receiver c82e0442de0f is live and both namespaces exist. The
+attended retry seeded both independent version-1 credentials and advanced the
+registry with CAS 7→8, preserving existing senders and fields. Both CCRs are
+**applied**; Warden exited 0 and confirmed revocation for that session. See the
+[seed receipt](../evidence/2026-09-11-factory-audit-sender-seed.json). Delivery,
+receiver reload and producer acceptance remain distinct checks.
+
 ## Executable sequence
 
 Review the source and exact policies:
@@ -102,9 +111,41 @@ exact token equality inside the protected process. Sync the existing registry
 ExternalSecret, verify its update, and reload Audit Core through its owner
 runbook. Then run each real producer's accepted/duplicate and wrong-source,
 wrong-tenant/read-refusal checks and retrieve evidence with the independent
-operator reader. The script does not yet automate these owner acceptance steps.
+operator reader. The delivery helper automates delivery, scope checks and receiver reload; it
+does not deploy producers or automate their outbox acceptance.
 Do not mark either CCR verified/active until those receipts exist.
 
+## Attended delivery helper
+
+After the seed receipt exists, run this silent command inside a fresh Warden
+attended platform-admin envelope (do not rerun seed or reuse a revoked session):
+
+```sh
+python3 scripts/factory_audit_delivery.py \
+  --kubeconfig /operator/railiance-kubeconfig \
+  --server https://127.0.0.1:16444 \
+  --expected-receiver-image forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5 \
+  --confirm 'DELIVER CCR-2026-0021 CCR-2026-0022' \
+  --receipt /operator/unique-delivery-receipt.json
+```
+
+The helper pins the reviewed manifest bytes and native cluster/image. It
+verifies exact policy, role, version-1 custody and provenance; independently
+logs in as each native ESO reader; proves sibling, full-registry, metadata,
+listing, wrong-SA and coding-agent-boundary denials; and revokes temporary
+reader tokens. It checks exact projected token equality and ESO ownership in
+captured memory, forces receiver-registry reconciliation and compares the
+complete JSON before restarting the receiver. A uniquely owned temporary
+namespace proves wrong-namespace login and explicit ESO namespace restriction
+with no Secret created. Cleanup uses the namespace UID precondition.
+
+The metadata-only receipt advances by phase. Its successful status is
+`delivered_and_scope_verified_pending_producer_acceptance`. Failures preserve
+completed phases for diagnosis; they do not rotate or delete permanent custody.
+Receiver accepted/duplicate and negative HTTP checks, real producer outbox
+recovery and bearer revocation remain owner acceptance work. Do not mistake
+short-lived ESO-reader revocation for receiver bearer revocation.
+
 ## Revocation and limits
 
 ESO login expiry does **not** expire an audit bearer. Stop the affected producer,

docs/evidence/2026-09-11-factory-audit-sender-seed.json

@@ -0,0 +1,63 @@
+{
+  "schema": "platform.factory-audit-custody.v1",
+  "status": "custody_seeded_pending_delivery_and_receiver_reload",
+  "credential_values_emitted": false,
+  "started_at": "2026-09-11T05:37:49.432171+00:00",
+  "lanes": [
+    {
+      "ccr": "CCR-2026-0021",
+      "name": "approval-engine",
+      "kv": "platform/data/workloads/approval-engine/audit-sender",
+      "store": "openbao-approval-engine-audit",
+      "secret": "approval-engine-audit",
+      "secret_key": "audit-token",
+      "source_sha256": "ba69ecc8227c5bf887c2cd0ac4c50518c019bebfdfb6d49628edee1ce570da7d"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "name": "informed-decision",
+      "kv": "platform/data/workloads/informed-decision/audit-sender",
+      "store": "openbao-informed-decision-audit",
+      "secret": "informed-decision-audit",
+      "secret_key": "token",
+      "source_sha256": "2f7f7f214d1e21fd79275197edd03ee7e154ef451d62a182017926250515a6aa"
+    }
+  ],
+  "receiver": {
+    "image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5",
+    "deployment_uid": "b85fe3d0-75c9-4e0d-8c34-c6f1df0881bb",
+    "deployment_resource_version": "59751057",
+    "pod_uid": "6642c414-a942-4b11-b048-267423e12da8",
+    "capabilities": {
+      "load_bearing": true,
+      "redact": true,
+      "write_only": true,
+      "source_exact": true,
+      "tenant_exact": true
+    },
+    "synthetic_probe_only": true,
+    "credential_reads": 0
+  },
+  "phase": "registry_cas",
+  "registry_version_before": 7,
+  "seeded": [
+    {
+      "ccr": "CCR-2026-0021",
+      "version": 1,
+      "request_id": "cf6dd167-9d37-fbcf-cc3d-6d54c0f988b9"
+    },
+    {
+      "ccr": "CCR-2026-0022",
+      "version": 1,
+      "request_id": "2f373e63-058b-7a6e-07c4-365317dffa73"
+    }
+  ],
+  "registry_write_request_id": "91fdb393-80ba-4e06-2dde-3982763d0ae5",
+  "registry_version_after": 8,
+  "unchanged_other_senders": true,
+  "unchanged_other_registry_fields": true,
+  "credentials_reused": false,
+  "attended_wrapper_exit": 0,
+  "attended_session_self_revocation": "confirmed_by_successful_wrapper",
+  "prior_failed_login": "not asserted resolved by this new session"
+}