Platform original-bind read policy implemented with isolated audited proof
Assignment ADR-0054/platform/002 is implemented at runtime commit ad20c705895bd48786e6fc0e14939050a5013b1f, evidence checkpoint 8c48ec49dfa44277867af93dde3e00616cfd3c15, branch codex/adr0054-platform-read in C:/Users/jallr/.codex/worktrees/adr0054-platform-read/platform. It builds on unchanged ADR-0053 source 368e5b526c71b6e6f18124ec4026747a83d503d1. No foreign code or production configuration changed.
The sole new capability delivery.scheduling.original-bind-association.read accepts only the exact Revenue production proof and issues canonical system:revenue to delivery claims for the singleton Sguild tenant/Organization. SERVICE_AUTH_ORIGINAL_BIND_OBSERVATION_ENABLED must equal true; the default is off. Neither prior scheduling flag enables it, and this flag alone enables none of the existing four or six policies. Issuance, scope/reach verification, audit failure behavior and per-attempt fresh tokens reuse the reviewed existing rails.
Full npm test passes 411 unit tests,32 identity integration checks and3 geography checks against the new isolated database platform_adr0054_a7a56d350e36490e8c746ab5d2688b7a, localhost55434/schema platform. Typecheck and guardrails pass. The first suite run failed only because the new worktree lacked the existing canonical contract test-root environment variable; the corrected complete run used explicit canonical paths without test/source relaxation. The initial report is retained. Raw test logs preserve their original trailing blank lines; no whitespace-clean claim is made for those evidence bytes.
The actual Platform exchange handler and PostgreSQL audit proof issued88 distinct tokens across all11 policies, denied34 malformed, unauthorized or disabled attempts including Sales/Delivery/Coaching misuse of the new read, and returned no token during an actual audit-insert failure. Ordered row-content hashes and counts remained identical for32 business tables. Cryptography is real RS256 with synthetic Vercel claims; the isolated connection is privileged and does not prove production serving credentials or grants.
An independently launched committed-source issuer is available at http://127.0.0.1:50387, PID27744, kid adr0054-local-027b5b20-409e-4adb-8068-7e51266dddfa. Its two extra new-read attempts each produced the exact claims and exactly one persisted audit row for a distinct JTI. Public proof/JWKS/exchange routes are test harness endpoints on loopback; no bearer, proof token or private key is saved. Canonical issued issuer remains https://platform.sguildswim.com. Earlier issuers51194 and57783 and Delivery listeners are preserved.
The handoff manifest docs/evidence/adr0054-platform-002/manifest.json has SHA25629b9a5388efd4b6ccffceaa11327ada84f53ff1d9a14a1d1ea1d58128c5e7573. It pins745 tracked runtime/source files, the generated Prisma schema, fixture process/configuration and proof artifacts. Runtime source remains frozen at launch; the later evidence-only commit adds documents. Revenue and Delivery received the exact manifest, scope and listener for their separate current-candidate integration harnesses.
The Platform-owned local implementation commitment is completed. Production remains off. Actual Vercel production proof and SDK behavior, signing custody, serving credentials, Delivery original source/capture, Revenue financial writeback, Sales retirement, all-writer migration/drain, provider validation and controlled shared release remain open. The fixed ADR-0052 and ADR-0053 deadlines are unchanged. This is not ADR-0048 completion.