CUST-WP-0075: tenant-engine sender seed helper; re-qualify RPF-WP-0035-T02/T08

- scripts/tenant_engine_audit_core_sender_seed.py: silent attended row-7 seed
  for MASON-WP-0007-T05 (wrap-migrate technique, CAS 0, never overwrites,
  metadata-only --dry-run, documented exit codes), with offline fake-bao tests.
- Lane review doc with the exact founder sequence and the read-only ESO
  token-create can-i check for MASON-WP-0007-T06.
- RPF-WP-0035-T02: SECRETS-WP-0007-T04 is done; real blocker is live KeyCape
  registration and client custody of secrets-engine-openbao (blocked_on
  key-cape). Design stays proposed.
- RPF-WP-0035-T08: receiver rollout with evidence_kind already accepted
  2026-09-11; moved the misplaced D1 correction note here from T02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3

workplans/RPF-WP-0035-credential-lane-implementation.md

@@ -46,7 +46,8 @@ id: RPF-WP-0035-T02
 status: wait
 needs_human: true
 decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
-blocking_reason: "KEY-WP-0009 finished; remaining gate is human: attended platform provisioning of the exact JWT mount/role/policy; KeyCape issuer/JWKS and service registration under KEY-WP-0009."
+blocked_on: message-from:key-cape
+blocking_reason: "SECRETS-WP-0007-T04 done 2026-09-27, so that gate is open. Real blocker: live KeyCape registration of client secrets-engine-openbao and its protected client-credential custody (contract: separate approved custody action; no owning task id yet, asked key-cape 2026-10-03). The design requires both before any write; then a reviewed child and the attended founder apply."
 priority: high
 state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
 ```
@@ -72,7 +73,7 @@ contract, and rollback/cleanup receipts contain no secret material.
 
 2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
 
-2026-10-03 correction (CUST-WP-0075, informed-decision sitting draft `55fb078`): the D1 routing was wrong. First provision and delivery already ran on 2026-09-11, with seed and delivery receipts, and the review packet says not to repeat them. The task is not a provisioning-window act. It was taken off decision D1, and its blocking_reason now names what actually remains. railiance-platform should re-qualify it further if the receiver rollout has since happened.
+2026-10-03 (CUST-WP-0075): gate check. SECRETS-WP-0007-T04 is done (2026-09-27), so the gate named in the design is open. It is not the last one: the design says to confirm the exact live client registration and protected client-side custody before writing, and positive-login proof needs a real KeyCape service JWT. KeyCape's contract (`openbao-service-auth-contract.md`) and KEY-WP-0009 claim source registration only; the live registration of `secrets-engine-openbao` and its client-credential custody are "a separate approved custody action" that no workplan task owns yet (SECRETS-WP-0008-T06 waits on this task). Re-qualified with `blocked_on: message-from:key-cape`; key-cape was asked for the owning task id, which will replace it as `depends_on`. The design stays proposed and no child command was written. Not approvable in D1 yet.
 
 ## Implement the platform operator-write CCR contract and Fluid lane
 
@@ -439,13 +440,17 @@ into this client-identity grant.
 id: RPF-WP-0035-T08
 status: wait
 needs_human: true
-blocking_reason: "Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Remaining: native delivery/receiver-ingestion acceptance (receiver image must carry evidence_kind; Approval Engine namespace is its owner prerequisite), archive readback, and revocation of the interim audit bearer tokens."
+blocking_reason: "Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens."
 priority: high
 assignee: railiance-platform
 intervention_note: null
 state_hub_task_id: "0ef52c26-2669-5cd1-8149-b1f6fcdda6cb"
 ```
 
+2026-10-03 correction (CUST-WP-0075, informed-decision sitting draft `55fb078`): the D1 routing was wrong. First provision and delivery already ran on 2026-09-11, with seed and delivery receipts, and the review packet says not to repeat them. The task is not a provisioning-window act. It was taken off decision D1, and its blocking_reason now names what actually remains. railiance-platform should re-qualify it further if the receiver rollout has since happened.
+
+2026-10-03 (CUST-WP-0075): re-qualified. The receiver rollout already happened: Audit Core c82e0442de0f carries evidence_kind and native producer accepted/duplicate and scope/read-refusal checks passed 2026-09-11 10:42 UTC (`docs/credential-lane-designs/factory-audit-senders-review.md`, `factory-native-acceptance.md`). Remaining: independent archive readback and audit bearer-revocation acceptance. Still not a provisioning-window act.
+
 Consume AUDIT-WP-0009-T09/T11's exact declarations for approval-engine and
 informed-decision: tenant:platform, write-only, load-bearing, redact. Source
 preparation supplies two approved CCRs, independent exact-path policies/ESO