docs(factory): record installed runtime and attended custody preflight

docs/assessments/2026-09-08-helixforge-factory-critical-path.md

@@ -1,7 +1,8 @@
 # Factory critical-path execution — 2026-09-08
 
 Implemented and published prerequisite corrections in ops-warden, key-cape,
-approval-engine and audit-core. The canonical integration workplan and next
+approval-engine and audit-core, followed by local runtime installation and an
+attended OpenBao capability preflight. The canonical integration workplan and next
 admission sequence remain in
 [prj-helixforge-factory](/home/worsch/prj-helixforge-factory/operations/identity-admission.md).
 
@@ -44,3 +45,50 @@ handoffs and unreliable checks. Time saved and autonomous throughput are not
 measured. No secrets were provisioned, no new policy binding granted and no
 paid model run admitted; G0–G5 remain open and the fourteen-day window has not
 started.
+
+## Runtime installation and custody authority follow-through
+
+SAND-WP-0015-T06 is done. The existing pinned runtime is installed on
+`bnt-lap001` in its owner's mode-0700 content-addressed store. The installer
+checks the expected digest before writing, verifies the copied artifact,
+rejects unsafe ownership/permissions and changed destinations, and publishes
+atomically. Reusing an intact installation is idempotent. It is protected by
+the local owner boundary; it is not root-owned or a Railiance installation.
+
+Sand-boxer source `df5e941` passed the complete check: **188 tests and Ruff**.
+The installed-path namespace smoke started Claude 2.1.263, rein and the adapter;
+proved read-only runtime, private persistent HOME, isolated networking, clean
+worktree and teardown. It used no model credentials or provider request.
+Sand-boxer published main `3e49a98` and Glas `4499160` carry the receipt. T04 and
+GLAS-WP-0012-T02 still own execution configuration, real-model acceptance and
+Railiance placement. No repeat of the unchanged candidate build is needed.
+
+RPF-WP-0035-T05 now has a successful first-provision **capability** proof.
+Through the native founder-attended `openbao-platform-admin-login` envelope,
+the platform diagnostic checked create/update capability on all six exact
+policy, Kubernetes-role and KV data paths for CCR-2026-0017/0018. The successful
+session self-revoked and removed its helper. Source `a94d06d` preserves the
+metadata-only diagnostic and receipt. No secret value was read, custody seeded,
+policy/role changed or production workload deployed.
+
+The receipt preserves all attempts: the first direct launcher failed before
+the child command and left revocation unconfirmed; the second native-wrapper
+session revoked successfully but its query used unsupported multi-path syntax;
+the final six single-path queries passed and that session revoked successfully.
+The later success does not establish revocation for the first failed attempt.
+
+The project consumes both returns in its thirteen-record dependency view.
+Factory T03 and T04 remain waiting for their outstanding acceptance evidence;
+installation and authority discovery no longer appear as unresolved inputs.
+Source, Forgejo and the primary State Hub are reconciled at published revisions.
+
+This removes two concrete setup uncertainties and makes installation and the
+custody preflight reproducible. Throughput, hours saved and autonomous delivery
+remain unmeasured. The next sequence is actual upstream signed-token issuer
+proof, named CCR reviews, attended custody activation and compatible KeyCape
+rollout. Separate client/audit/native credential admission, the exact factory
+grant and enforceable spend limits still precede a real model run. G0–G5 and the
+fourteen-day observation window remain open.
+
+[Runtime and custody continuation receipt](2026-09-08-helixforge-factory/runtime-custody-continuation.json)
+retains source revisions, validations, projection readbacks and progress IDs.