Require invited login and private downloads for the company pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/delivery.md

@@ -58,3 +58,28 @@ digest and chart revision, tenant/host and login binding, database and media
 ownership, backup/restore and rollback, UI smoke and named operating owner.
 Existing production tender data is never disposable test data. A passing source
 build does not establish customer availability or the governed factory worker.
+
+
+## Invited pilot — 2026-09-11
+
+[VERGABE-WP-0019](../workplans/VERGABE-WP-0019-invited-company-pilot.md)
+advances one manually onboarded company alongside factory admission. Billing
+and a shared tenancy implementation are not pilot gates. All application routes
+and media downloads require an active Django account; health and login remain
+public. Members can change passwords; administrators create/reset/deactivate
+accounts using the existing Django administration through the admitted operator
+path. There is no public sign-up or email invitation delivery in this milestone.
+
+Use the Railiance Apps pilot contract in `docs/vergabe-teilnahme-pilot.md` and
+RAPPS-WP-0014. Record the newly tested image digest; the older published image
+has no global access gate. Persist PostgreSQL, uploads and issue-facade SQLite
+separately, and prove coherent restore before admitting customer data. Serve
+`/media/` through Django, never directly through an unauthenticated ingress or
+static file server. The image's `/app/.issue-facade` directory is operational
+state and must never be placed below MEDIA_ROOT.
+
+Application tests use the standard anonymous `client` for access tests and the
+explicit `admitted_client` fixture for company workflows. Existing end-to-end
+tests retain their explicit login. Container acceptance remains the release
+gate; native two-user workflow, restored data, support and rollout evidence
+remain open until performed on the admitted deployment.

docs/evidence/2026-09-11-invited-pilot-access.json

@@ -0,0 +1,42 @@
+{
+  "schema": "vergabe.invited-pilot-source-acceptance.v1",
+  "date": "2026-09-11",
+  "source_base_commit": "56bf193193a4db635692ddd9e534c233b13f904e",
+  "regression_baseline": {
+    "failed": 9,
+    "passed": 3,
+    "anonymous_read_and_create_demonstrated": true
+  },
+  "application_suite": {
+    "passed": 94,
+    "database": "disposable SQLite",
+    "local": true,
+    "container": true,
+    "container_image_id": "sha256:6f85d039115d5412b77a65740baa741f37e9ac2bf5f28a7a216aebf8f3c428cc",
+    "static_files_collected": 139,
+    "vite_build": "passed",
+    "migration_drift": false,
+    "warning": "One existing naive-datetime warning"
+  },
+  "ruff_new_access_modules": "passed",
+  "browser": {
+    "status": "passed",
+    "checks": [
+      "Anonymous tender page redirects to login",
+      "Password input has a visible border and usable height",
+      "Invited member logs in and reaches password-change UI",
+      "User menu submits CSRF-protected logout and returns to login",
+      "Login fits a 390-pixel viewport without horizontal overflow",
+      "No browser JavaScript errors"
+    ],
+    "synthetic_users": true,
+    "disposable_sqlite": true,
+    "local_http_only": true,
+    "native_customer_admission": false
+  },
+  "native_customer_admission": false,
+  "live_customer_data_used": false,
+  "pricing_required_for_pilot": false,
+  "factory_attempts": 0,
+  "paid_model_calls": 0
+}