Verify scoped approval client delivery through attended reader session

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-14-ccr0019-delivery-check.json

@@ -0,0 +1,26 @@
+{
+  "observed_at": "2026-09-13T23:44:04.757286+00:00",
+  "ccr_id": "CCR-2026-0019",
+  "status": "passed",
+  "approval_mutations": false,
+  "checks": {
+    "private_delivery_existing_version_1": true,
+    "approval:read": {
+      "native_claim_http_status": 404,
+      "profile_checked": true
+    },
+    "approval:consume": {
+      "native_claim_http_status": 403,
+      "profile_checked": true
+    }
+  },
+  "cleanup": true,
+  "warden_session": "exited_0_after_self_revocation_and_helper_cleanup",
+  "approval_engine_pod_uid": "7b8c05d9-f1d5-403d-abb3-2250bff9db5e",
+  "approval_engine_image": "sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49",
+  "limits": [
+    "Read request used a fresh nonexistent approval id; 404 proves authenticated routing, not a usable claim.",
+    "Consume-only token was denied the read route; no real approval was consumed.",
+    "Wrong-group human login remains untested."
+  ]
+}