◇ STATUS

Verified engineering milestones. Each one measured live, on the date shown.

VERIFIED_MILESTONES

2026-08-05 [VERIFIED] AUDIT_WRITE_LOCK — Per-tenant write-time lock on the audit hash-chain switched on; live gate 3/3

2026-08-01 [VERIFIED] JUDGMENT_CORPUS_PROVENANCE — Shadow judgment stops injecting fabricated attribute values; every attribute is real, curated or unknown

2026-07-24 [VERIFIED] SUBMISSION_PERIMETER — A caller that merely declares itself internal no longer skips the security classifier; declared-but-unproven identity is stripped

2026-07-23 [VERIFIED] MASTER_CREDENTIAL_REMOVED — The full-bypass admin token is dead; every admin authorization now goes through per-user RBAC (FGA). Old token → 401, session token → 200

2026-07-14 [VERIFIED] FAIL_CLOSED_CONVERSION — Six security gates converted from fail-open to fail-closed, each dated and committed (2026-07-13 → 2026-08-01)

2026-07-13 [VERIFIED] SECRET_RESOLUTION_GATED — The secret-resolution endpoint stops answering without a credential: no bearer → 401

2026-07-13 [VERIFIED] SESSION_KEY_DURABILITY — The session signing key moves to the vault; a restart no longer invalidates every live session

2026-07-10 [VERIFIED] TENANT_FROM_TOKEN — Open read surfaces now require a credential and resolve the tenant from the token, not from a query parameter

2026-07-10 [VERIFIED] FEDERATED_LOGIN — Human login federated through OIDC (Keycloak); the platform never stores a password

2026-06-11 [VERIFIED] HARNESS_AGNOSTICISM — The governance contract closed identically under Claude Code, Codex and Cursor over the real MCP wire (3/3)

EVIDENCE: each milestone is recorded in the platform's enforcement ledger with its flag, failure posture and decision record.