Five owner replies worked through: one fix closed, two grades corrected, one control retired

RISK-F-0006 fixed and public — railiance-platform's restore evidence was
read, not taken: 56s restore, all 13 coulomb_social row counts matching,
plus the BestEffort QoS this register had graded on, plus a failed first
WAL attempt recorded alongside the successful one.

RISK-F-0004 high -> medium. tenant-engine corrected in both directions:
payloads are returned (worse than graded) but there is no HTTP event-read
route, so the live network-reachable read this register wrote down does
not exist. L3 was a reachability claim inherited from a summary and never
tested.

RISK-F-0002: reading (c) confirmed — nothing blocks policy.enabled, it is
off by decision. ADR-0006 retires it in favour of zone-scoped
enforcement. Ruled: the framing is superseded, the risk is not. A control
retired before its replacement exists is still an absent control. The
successor's blocker is 26 of 27 lanes having no identifiable workload,
which is RISK-N-0004 with a number on it.

RISK-F-0009: uncovered count 8 -> 6, corrected by the reporter against
themselves; the token was never expired; and the deployed policy differs
from the file, which moves 'a file is not a safe proxy for the server'
from suspicion to evidence and amends verification.md — including the
admission that fix_tracker.py reads records, and a record can be stale.

RISK-V-0001 reconciled: ops-warden reaches the pin from the node through
a tunnel, so a podSelector ingress rule does not constrain it. The
observation was right and the inference was not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/method/verification.md

@@ -66,6 +66,31 @@ worse one. If OpenBao claims need verifying, the right answer is for the owner
 to run the read and report it, which is what `ops-warden` did — the obstacle
 there was an expired token, not the arrangement.
 
+## A file is not a safe proxy for the server
+
+Established 2026-08-21, by evidence rather than by caution. `ops-warden` ran
+the live OpenBao read that `RISK-F-0009` had been graded without, and **the
+deployed policy differs from the committed file.** No lane maps to the drifted
+path, so nothing was exposed — but the general claim is now proven rather than
+suspected.
+
+Consequences this register accepts:
+
+- **Every grade made off a checkout is a grade on a document**, and says so on
+  its face. `RISK-F-0009` does.
+- A verification that reads a file is a **weaker artifact** than one that reads
+  a server, and the record must not blur them. `RISK-V-0001` reads a server;
+  the OpenBao comparison in `RISK-F-0009` reads a file.
+- Where only the owner can reach the server, the owner's probe is the evidence
+  and the register says whose it is. That is not a lesser standard — it is the
+  correct one, given `verification.md`'s own limits.
+
+The corollary is uncomfortable and worth stating: **drift between file and
+server is invisible to anyone reading files**, which is most of this estate's
+tooling, including `fix_tracker.py`. What that tool reads is what a repo
+*recorded*, and a record can be as stale as any other claim — as four
+self-reported stale blockers in twelve hours demonstrated on 2026-08-21.
+
 ## Recording a verification
 
 One file per verification in `docs/verifications/`, `RISK-V-NNNN`, stating the

docs/verifications/2026-08-20-flex-auth-networkpolicy.md

@@ -98,3 +98,53 @@ what `RISK-F-0002` exists to prevent happening blind.
   `bao policy read agent-high-risk-boundary` both return **403 permission
   denied** from this host, the same wall `ops-warden` hit. `RISK-F-0009`
   therefore still rests on file comparison.
+
+---
+
+## Reconciled — 2026-08-21: ingress does reach that pin, and both facts hold
+
+`ops-warden` answered ahead of their default date, and the answer is **no** —
+enabling the gate would not have stopped signing.
+
+**Their evidence.** `GET http://127.0.0.1:19090/healthz` returns 200 through
+the `flex-auth-ops-warden-railiance01` ops-bridge tunnel — a plain `-L` forward
+from the railiance01 node to ClusterIP `10.43.1.165:8080` — answering
+continuously since 2026-08-19, *after* the deny-all policy was created at
+12:47:18Z that day. A full authenticated `/v1/check` through it returned 200,
+`effect=allow`, `decision:f3f7c88f9585582a`.
+
+**The reconciliation, which keeps both observations true.** NetworkPolicy
+governs pod-to-pod traffic. `ops-warden` is not a pod: `warden sign` runs on the
+operator workstation and reaches the pin through an SSH tunnel terminating on
+the node, so the traffic originates from the **node**, not from a pod. A
+`podSelector`-scoped ingress rule does not constrain that path.
+
+A supporting datapoint neither they nor this register gathered: `net-kingdom`
+reported on 2026-08-20 that a `tenant-engine` pod could not reach the
+`user-engine` pin at all, `Errno 111`, attributed to NetworkPolicy. If that
+holds, pod-sourced ingress *is* enforced and node-sourced is not — the expected
+shape rather than an anomaly.
+
+**So the deny-all was deliberate and correctly scoped**, not a rollout artifact:
+`flex-auth` set `consumer.isolated: true` on that pin, isolated until there is
+an in-cluster PEP namespace to admit.
+
+### What this verification got right, and what it got wrong
+
+Right: reading the live policy, reporting the discrepancy, and routing it to
+both owners **before either flipped a switch**. The observation was accurate.
+
+Wrong: the inference. "Ingress policyTypes with no rules means nothing reaches
+this pin" is true of pod traffic and this register presented it without that
+qualifier. `docs/method/verification.md` says a verification is evidence and
+not a ruling; this one drifted toward a ruling and was corrected by the owner
+inside a day, which is the system working.
+
+### The caveat `ops-warden` refused to paper over, carried here
+
+Their evidence proves ingress reaches the pin. It does **not** prove
+NetworkPolicy is enforced everywhere it should be. **Anyone relying on a
+NetworkPolicy to isolate something reachable from a node should probe that
+assumption.** Nobody has. It is not a finding — no defect is established — and
+it is exactly the shape of thing that becomes one the first time somebody
+checks.