Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

SCOPE.md

@@ -58,14 +58,17 @@ provider, credential broker, or general secrets API.
 - KV positive verification logs in through the lane AppRole and reports field
   presence without printing values. With no `--field`, it checks every declared
   field; an explicit `--field` narrows the check.
-- KV negative verification checks that a fixed invalid token cannot read the
-  path.
+- KV negative verification requires a real unrelated token supplied through a
+  mode-0600 file outside Git and checks that it cannot read the path. Missing
+  unrelated identity material fails closed without a backend probe.
 - Auth-capability verification checks the AppRole token's capabilities on exact
   allowlisted and denial-probe paths.
 
-These are bounded policy/presence probes. They do not yet prove denial for a
-real unrelated workload identity, exercise a provider operation, or produce
-OpenBao audit-request correlation.
+These are bounded policy/presence probes. A throwaway OpenBao integration test
+proves an overlapping unrelated policy is detected. Production still needs a
+reviewed owner/source for each unrelated identity; the engine does not mint or
+select that identity itself. Verification does not yet exercise a provider
+operation or produce OpenBao audit-request correlation.
 
 ### Exec-time delivery
 
@@ -104,12 +107,19 @@ cannot be recovered through that AppRole.
   status, metadata/value-presence booleans, missing declared field names,
   readiness, and a safe next command. Every declared field must be present.
 - Records scrubbed local JSONL evidence and posts a minimal State Hub progress
-  event on a best-effort basis.
+  event on a best-effort basis. Each requested State Hub delivery receives an
+  append-only local `delivered`, `failed`, or `skipped-no-topic` companion
+  record.
+- `audit` summarizes allowlisted local lane evidence: action/result counts,
+  canonical decision references, session cleanup outcomes, and State Hub
+  delivery outcomes. It never re-emits arbitrary evidence detail.
 - Keeps OpenBao audit logs as the backend source of truth.
 
-State Hub evidence delivery is not durable or transactional, and route does not
-replace authorization or unrelated-identity denial evidence. Treat route output
-as operational guidance, not complete attestation for high-risk lanes.
+State Hub evidence delivery is not queued or transactional; the local receipt
+makes failure visible but does not replay it. Route and audit do not replace
+authorization, OpenBao audit logs, or unrelated-identity denial evidence.
+Treat their output as operational guidance, not complete attestation for
+high-risk lanes.
 
 ### Revocation currently available
 
@@ -145,6 +155,7 @@ secrets-engine policy publication
 secrets-engine route
 secrets-engine revoke [--dry-run]
 secrets-engine lifecycle suspend|deactivate|destroy
+secrets-engine audit <catalog-id> [--json]
 ```
 
 The implemented exec adapters are `exec-env` and `npm-config`. `read-check` is
@@ -254,7 +265,9 @@ keywords: [openbao, approle, auth-capability, handoff, least-privilege]
 type: governance
 title: Non-secret routing and evidence pointers
 description: Reports decision/readiness metadata and records scrubbed local and best-effort State Hub
-  evidence without returning secret values. Readiness covers every declared field, but this is not a
-  durable audit store or a real-unrelated-identity denial attestation.
+  evidence without returning secret values. Append-only delivery receipts expose State Hub failures,
+  and an allowlisted audit command summarizes lane operations and cleanup. KV verification can attest a
+  supplied real unrelated identity, but the engine does not own identity selection. This is not a durable
+  remote audit store.
 keywords: [routing, evidence, state-hub, audit, secrets]
 ```