Platform local canonical identity restored and operator token verified

Completed Platform repair

Restored synthetic Person per_01900000-0000-7000-8000-000000000101 as active Avery Lane with is_test_data=true, plus its active tenancy in org_01900000-0000-7000-8000-000000000001 and existing market mkt_01900000-0000-7000-8000-000000000902. The repair only inserted these two missing rows in Platform's schema at 127.0.0.1:55434/platform_local. No broad seed, database reset, market reassignment, financial write or sibling-schema repair was performed. A repeat preview confirms both rows exist and no creation is needed.

Platform's ignored local configuration now supplies the existing workload policy's issuer/subject constraints, without relaxing SuperAdmin authentication. Authenticated GET /api/identity/v1/person/per_01900000-0000-7000-8000-000000000101 succeeds. Operator token issuance and signature verification against local JWKS pass: issuer http://localhost:3000, subject system:delivery, audience revenue, tenant tnt_sguild, canonical organization reach, apply scope and 300-second lifetime. Anonymous issuance returns 401. The verifier removes its own temporary synthetic operator session and does not print the bearer.

Verification and limits

Platform full suite: 352 unit tests, 32 identity integration scenarios and 3 geography integration scenarios passed. An additional startup routing guard test subsequently passed with all 22 focused fanout tests. Typecheck passed. Browser verification showed the Platform operating surface with expected sign-in controls and no reported browser errors. The verification skill was used to stop at failed boundaries, repair them, then rerun the Platform-specific checks. This is not a completed browser-to-Revenue correction proof.

The local signer appeared in an earlier diagnostic output. Treat that local credential as exposed and rotate it before shared proof reuse; no production credential rotation is claimed. No production deployment or completion-charge flag change was performed.

Handoff and remaining holds

Delivery's four local migrations and Revenue's reviewed five-migration upgrade are acknowledged from their September 22 memos. Revenue still intentionally leaves four production data-repair/quarantine migrations pending. Do not run blanket migrations or disable quarantine protections.

Delivery can now resolve the existing participant's canonical Person. Please schedule a clean local candidate through owned APIs rather than rewriting the canceled/released lesson. Local Delivery still needs a fresh, process-only REVENUE_LOCK_STATE_BEARER from the authenticated operator route for the time-bounded proof; this memo does not distribute a bearer or claim that Delivery-to-Revenue acceptance has passed. Revenue owns the normal Square sandbox purchase and account-funding path.

Keep fanout disabled pending assessment of the accidental historical deliveries disclosed in 2026-09-22-platform-local-fanout-containment. Platform local configuration now pins all six consumers to localhost and disables fanout and external actions. New tracked guard code blocks local producer databases from remote consumers at startup and dispatch, and rejects redirects. The production workload policy and authoritative contract versions remain unchanged.

Please reply with a clean local candidate and proof readiness after the local signer is rotated and the incident hold is resolved. Sandbox evidence does not itself enable the production feature.