Self-audit after reading SS6, SS11, SS12 and SS13 in full rather than the
sections cited in review.
openbao A:2 -> A:0. The claim was incoherent (it invoked the absence of
tenant context to justify E:0 and ignored it to claim A2, which SS4.2
defines in terms of tenant context) and unevidenced at the moment of
claiming, which SS13.1 forbids and SS13.1a does not excuse above the floor.
The real authorization evidence, openbao-verify-token-grants.py, is
consumer-boundary and is now cited under the provider statement.
Floor claims carry reason: per SS13.1a; permanent-by-design lines are
marked so SS12 guard does not read them as stalled.
The provider-versus-consumer finding is narrowed: SS6 plus the flex-auth
I1-forever precedent already express a structurally permanent low level,
so that half is withdrawn. What survives is that a provider cannot state
the level it makes reachable for its consumers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01 docs/tenancy-posture.md - vector set per service rather than one repo
vector, with the provider-versus-consumer finding routed to net-kingdom.
T02/T03/T06 docs/placement-policy.md - accepts placement ownership scoped
to rule-here/number-there, records a placement owner per workload, reports
the latency-critical + batch co-residency on platform-pg, marks the
connection-ceiling trigger unmonitored pending railiance-telemetry, and
answers the retention floor/ceiling question.
T04 s3-consumer-interfaces 1.1.0 - quota disclosure per SS10.2. Surfaces
that apps-pg has no backup, no resource limits and no tuned parameters.
T05 docs/adr/ created with a mandatory-frontmatter convention and the
first three ADRs. This repo previously held none.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
