Add value-safe verification and audit reporting

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

workplans/SECRETS-WP-0007-production-lifecycle-hardening.md

@@ -290,11 +290,17 @@ priority: high
 Progress 2026-08-23. KV verification now checks every declared field by default,
 with one path-level negative probe, and route readiness reads once and requires
 all declared fields. Missing readiness evidence contains field names only. Tests
-prove a missing sibling makes readiness false. The real unrelated-identity
-negative contract, audit request correlation, durable evidence delivery, and
-lane audit summary remain outstanding.
+prove a missing sibling makes readiness false. Evidence delivery attempts now
+receive append-only local success/failure receipts, and `audit` produces an
+allowlisted per-lane summary of actions, results, decisions, session cleanup,
+and delivery outcomes without echoing arbitrary detail. The real
+unrelated-identity input is now enforced as a strict mode-0600 out-of-repo token
+file; absence fails closed, and throwaway OpenBao integration deliberately adds
+an overlapping unrelated read policy and proves the check fails. Production
+identity selection/ownership, audit request correlation, queued/replayed State
+Hub delivery, and complete privileged failure-path evidence remain outstanding.
 
-The complete repository suite passes with 103 tests after these changes,
+The complete repository suite passes with 111 tests after these changes,
 including throwaway OpenBao integration coverage.
 
 Make verification and routing truthful for multi-field and high-risk lanes: