CCR-2026-0031: positive verification via verify-publisher (errors 9 -> 2, private-source reads work)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

credential-change-requests/CCR-2026-0031-core-hub-forgejo-source-read.yaml

@@ -193,6 +193,15 @@ verification:
       private probe coulomb/rapp-openbao branch and archive read passed; effective
       permission read-only; Actions-secret and instance-admin probes denied; OpenBao
       field written from stdin and read back without value output.
+  - at: '2026-10-03T08:21:20+00:00'
+    actor: the-custodian (founder-run deploy, core-hub revision 29)
+    kind: positive_verification
+    result: passed
+    details:
+    - 'make verify-publisher after core-hub rev 29 (2026-10-03): private-source 404s
+      gone; accepted 121/123 (was 114), errors 2 (was 9). Remaining 2 are repo-manager
+      registry identity mismatches (identity-canon, flex-auth rename to access-engine),
+      not credential faults. 123/0 acceptance tracked with repo-manager.'
 lifecycle:
   deactivate: Delete ExternalSecret and Secret in core-hub, unset publisher.existingSecret,
     revoke the PAT, disable the auth role, and leave private sources failing closed.