ADHOC-2026-11-03-T06: repair the last five drifted tests; suite green.

factory_audit_delivery re-pins the reviewed manifest after the CUST-WP-0073
metadata-only template fix and accepts only that exact template (data, type
and dataFrom still refused). Flex-auth signer tests assert the reviewed
state of CCR-2026-0050 and its pinned native plan instead of the
pre-review snapshot. Full suite: 1547 passed, 18 skipped, 0 failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 509845@bnt-lap001
Assistant-Session: ed7a7d95-d8eb-455c-b594-963fb1830f76

WORK-RECORDS.md

@@ -11,7 +11,7 @@
 | workplan | RPF-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
 | workplan | RPF-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
 | workplan | RPF-WP-ADHOC-2026-10-19 | finished | — | workplans/ADHOC-2026-10-19.md |
-| workplan | RPF-WP-ADHOC-2026-11-03 | active | — | workplans/ADHOC-2026-11-03.md |
+| workplan | RPF-WP-ADHOC-2026-11-03 | finished | — | workplans/ADHOC-2026-11-03.md |
 | workplan | RPF-WP-0015 | finished | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | workplan | RPF-WP-0025 | finished | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
 | workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
@@ -65,6 +65,7 @@
 | task | RPF-WP-ADHOC-2026-11-03-T03 | done | — | workplans/ADHOC-2026-11-03.md |
 | task | RPF-WP-ADHOC-2026-11-03-T04 | done | — | workplans/ADHOC-2026-11-03.md |
 | task | RPF-WP-ADHOC-2026-11-03-T05 | done | — | workplans/ADHOC-2026-11-03.md |
+| task | RPF-WP-ADHOC-2026-11-03-T06 | done | — | workplans/ADHOC-2026-11-03.md |
 | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
 | task | RPF-WP-0015-T03 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |

scripts/factory_audit_delivery.py

@@ -20,7 +20,8 @@ from keycape_approval_custody import require_denied, read_optional, role_matches
 from state_hub_preflight_lane import ROOT, LaneError, command, bao, data, revoke
 
 CONFIRM='DELIVER CCR-2026-0021 CCR-2026-0022'
-MANIFEST_SHA256='bca0f6b318baf6bccebf7faec48dd5a69d686cfc7ba9f4c769c7a60b9dc72cc9'
+# Re-pinned 2026-11-04 after reviewing 80e0539 (CUST-WP-0073): metadata-only target templates.
+MANIFEST_SHA256='a28aecfeb4afa5821b67bd555b45dfd590d1ecb481e673b6eb005365ca1d0cfe'
 
 
 def custody_value(lane, raw):
@@ -92,7 +93,11 @@ def preflight_projection(kube, objects):
         live=data(result)
         # Ignore API default fields, but never redirect an existing delivery lane.
         require(all(live['spec'].get(k)==v for k,v in obj['spec'].items()),'existing_projection_drift')
-        require(not live['spec'].get('dataFrom') and not live['spec'].get('target',{}).get('template'),'unexpected_projection_template')
+        # A target template may only carry the reviewed Secret metadata (CUST-WP-0073);
+        # anything that could transform or inject data is refused.
+        template=live['spec'].get('target',{}).get('template')
+        expected=obj['spec'].get('target',{}).get('template')
+        require(not live['spec'].get('dataFrom') and (template is None or (set(template)<={'metadata'} and template==expected)),'unexpected_projection_template')
 
 
 def deliver(kube, lanes, values, receipt, save):

tests/test_factory_audit_delivery.py

@@ -50,6 +50,19 @@ class DeliveryContracts(unittest.TestCase):
             with self.assertRaisesRegex(delivery.LaneError,'existing_projection_drift'):delivery.preflight_projection(['kubectl'],[expected])
             self.assertTrue(all('apply' not in call.args[0] for call in command.call_args_list))
 
+    def test_only_the_reviewed_metadata_template_is_accepted(self):
+        _,objects=delivery.guarded_manifest();expected=objects[1]
+        self.assertEqual(set(expected['spec']['target']['template']),{'metadata'})
+        def preflight(live,obj):
+            def result(argv, **kwargs):return subprocess.CompletedProcess(argv,0,json.dumps(live).encode(),b'')
+            with patch.object(delivery,'command',side_effect=result):delivery.preflight_projection(['kubectl'],[obj])
+        preflight(copy.deepcopy(expected),expected)
+        for change in ({'data':{'x':'{{ .AUDIT_TOKEN }}'}},{'type':'Opaque'}):
+            obj=copy.deepcopy(expected);obj['spec']['target']['template'].update(change)
+            with self.assertRaisesRegex(delivery.LaneError,'unexpected_projection_template'):preflight(copy.deepcopy(obj),obj)
+        live=copy.deepcopy(expected);live['spec']['dataFrom']=[{'extract':{'key':'x'}}]
+        with self.assertRaisesRegex(delivery.LaneError,'unexpected_projection_template'):preflight(live,expected)
+
     def test_presence_errors_are_not_treated_as_absence(self):
         _,objects=delivery.guarded_manifest()
         with patch.object(delivery,'command',return_value=subprocess.CompletedProcess([],1,b'',b'Forbidden')):

tests/test_flex_auth_signer_native_preparation.py

@@ -1,3 +1,4 @@
+import hashlib
 """Real CCR schema/applier contract, no credentials or backend invocation."""
 from copy import deepcopy
 import importlib.util
@@ -18,7 +19,13 @@ def test_real_schema_and_apply_refusal():
     assert len(blockers)==2
     assert any('status, got proposed' in x for x in blockers)
     assert any('confirmed OpenBao auth binding' in x for x in blockers)
-    assert ccr['review']['comments']==[] and ccr['access_frontdoor']['resolvable'] is False
+    assert ccr['access_frontdoor']['resolvable'] is False
+    # 2026-10-21: scoped owner reviews are recorded (RPF-WP-0035-T14), but the founder and
+    # cluster-runtime-storage-owner have not approved, so the CCR stays proposed.
+    approvers=set(ccr['review']['required_approvers'])
+    for comment in ccr['review']['comments']:
+        role=comment['reviewer'].split(' (')[0]
+        assert role in approvers and role not in {'founder','cluster-runtime-storage-owner'}
     # Pure synthetic candidate only: ensure admitted-pattern scope has no latent
     # schema/applier role/field failures once the real owners eventually approve.
     admitted=deepcopy(ccr);admitted['status']='approved';admitted['openbao']['auth']['bound_claims_confirmed']=True
@@ -43,7 +50,14 @@ def test_native_scope_separates_read_grant_and_unadmitted_execution():
     assert plan['authority_granted'] is False and plan['status']=='prepared-unapproved'
     assert plan['bootstrap']['expected_version']==0
     assert all(x['disposition'].startswith('pending ') for x in plan['reviews_required'])
-    assert 'implementation/independent tests still required' in plan['protected_adapter']['state']
+    # The plan is the exact artifact the owners reviewed (native plan sha256 in CCR-2026-0050).
+    assert hashlib.sha256((ROOT/'docs/credential-lane-designs/flex-auth-envelope-signing-native-plan.json').read_bytes()).hexdigest().startswith('22306d50e082fc35')
+    state=plan['protected_adapter']['state']
+    assert 'implemented and tested' in state and 'not a native execution approval' in state
+    assert 'remain mandatory' in state and 'dev-process gate remains preserved' in state
     assert plan['receipts']['maximum_bytes']==65536
     assert all('platform/' in x['path'] for x in plan['bootstrap']['allowed_native_methods'])
-    assert 'zero flex-auth PVCs' in plan['requested_scope']['new_resources']
+    # 84c529f: Platform creates no storage; the outbox PVC is Access's separate proposal and
+    # its provisioning stays with cluster-runtime-storage review.
+    resources=plan['requested_scope']['new_resources']
+    assert 'Platform creates no storage resources' in resources and 'remain open' in resources

workplans/ADHOC-2026-11-03.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Ad hoc tasks 2026-11-03: MAS backup alerting, test-suite, admission-check and credential-test repair"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 flavor: implementation
 owner: claude-code
 topic_slug: coulomb-social
@@ -131,6 +131,7 @@ were all equal. Only three rapp-postgres source digests had drifted from the
 id: RPF-WP-ADHOC-2026-11-03-T04
 status: done
 priority: medium
+state_hub_task_id: "aabbe169-82bf-55e7-a172-d12870b1c5e8"
 ```
 
 Three of the T02 drift failures were in `tests/test_credential_change.py`. For
@@ -170,6 +171,7 @@ was on the T02 list and fails the same way without this change.
 id: RPF-WP-ADHOC-2026-11-03-T05
 status: done
 priority: medium
+state_hub_task_id: "c584e656-5aa1-5fe0-a3e7-f18bc6cfc01a"
 ```
 
 `test_eso_auth_recovery` expected exactly three paths in each recovery lane's
@@ -189,3 +191,44 @@ The policy comment still says "CCR-2026-0046 proposed" and was deliberately
 left alone. `repair_eso_kubernetes_auth.py` requires the live policy to equal
 this file byte for byte (`policy_drift`), so editing the comment would make the
 next attended recovery refuse.
+
+## Repair the last five drifted tests
+
+```task
+id: RPF-WP-ADHOC-2026-11-03-T06
+status: done
+priority: medium
+```
+
+These are the last five of the nine T02 drift failures. In each case the
+source was right, and two were more than test drift.
+
+- **`test_factory_audit_delivery` (3).** The attended delivery tool itself
+  was stale, not just the tests. `80e0539` (CUST-WP-0073, a security fix)
+  added a metadata-only `target.template` to `manifests/factory-audit-senders.yaml`.
+  `scripts/factory_audit_delivery.py` still pinned the old manifest digest
+  and refused any template, so it would have refused a re-delivery. I
+  reviewed the diff: it adds only Secret annotations. The manifest is
+  re-pinned to `a28aecfe…0cfe`. The template rule is narrowed rather than
+  dropped: `dataFrom` is still refused, and a template may only contain
+  `metadata`, exactly as the reviewed manifest declares. A new test proves
+  that data, type and `dataFrom` changes are still refused.
+- **`test_flex_auth_signer_native_preparation` (2).** These tests froze the
+  2026-10-16 "prepared" state. Since then CCR-2026-0050 has recorded scoped
+  owner reviews (RPF-WP-0035-T14). The founder and
+  cluster-runtime-storage-owner have not approved, so the CCR stays
+  `proposed`. The native plan's adapter state and storage scope changed in
+  reviewed commits (`a3e8eb6`, `84c529f`). The tests now check:
+  - that no founder or storage-owner approval is recorded;
+  - that the plan bytes still equal the reviewed digest `22306d50…`;
+  - the invariants that still hold: no native execution approval, mandatory
+    gates remain, and Platform creates no storage.
+  The plan still lists every review as "pending". I left that alone,
+  because the plan is a pinned, reviewed artifact.
+
+Result 2026-11-04: the full suite runs green, with 1547 passed, 18 skipped
+and 0 failed in 17m35s.
+
+T04 and T05 were registered by reopening this plan briefly; C-11 does not
+create tasks in a finished workplan. RPF-WP-0064-T05's 422 needed an
+`intervention_note`, because `needs_human` requires one.