docs(authority): record candidate topology gap

docs/evidence/gen2-authority-001-secret-capability-gap-2026-08-31.md

@@ -1,20 +1,12 @@
-# GEN2-AUTHORITY-001 — protected service credential prerequisite
+# GEN2-AUTHORITY-001 — delegated control-plane deployment evidence
 
 Date: 2026-08-31
 
-The existing `assistant_core_secrets` volume was inspected by filename only.
-It contains the established Creator, Epistemics, Interaction, Local gateway,
-SELF and Work artifacts, but no `control_plane_service_token` artifact.
-
-No secret value was read, copied, printed or inferred. The implementation is
-fail-closed: Core and `commit-runtime` remain healthy while the delegated path
-returns unavailable/denied until the external secret control plane materializes
-the credential reference `credential://domovoy/control-plane/service-token/v1`
-at `/run/secrets/control_plane_service_token` for those two trusted runtimes.
-
-This is a `BLOCKED_BY_MISSING_CAPABILITY` for live non-interactive acceptance,
-not a reason to use a Creator session, password, browser cookie, SQL update, or
-broader service authority.
+The former missing-credential prerequisite is resolved by
+`GEN2-SECRETS-001`. A local one-shot provisioner created the dedicated
+protected artifact and verified idempotent ensure/rotation without reading or
+emitting its value. Core and Commit are wired to resolve it from the dedicated
+read-only mount, not the shared secret volume.
 
 ## Implemented and verified locally
 
@@ -35,6 +27,24 @@ values:
 - task preflight, diff scope, independent governance, and architecture checks;
 - `git diff --check`.
 
-The only missing external capability is protected materialization of
-`control_plane_service_token` for Core and Commit runtime. No deployment or
-privileged lifecycle request was attempted while it is absent.
+## Current deployment-control gap
+
+No delegated lifecycle operation has been attempted in production.
+
+On 2026-08-31 the stable Core and Commit runtimes both reported release
+revision `2ee5da81145cdad2da1c92c24a91145ad4af61a5`. The existing candidate
+slot script declares exactly four components: Creator Web, Core, Cognitive
+Worker, and Research Runtime. It has no candidate Commit runtime.
+
+The Authority endpoint is intentionally served by Commit runtime. Therefore a
+candidate Core cannot perform a real delegated Authority request against the
+required matching candidate Commit runtime without either recreating stable
+Commit (forbidden) or extending the candidate ReleaseSet/Supervisor contract
+to contain Commit as an independently healthy and rollback-aware component.
+
+This is `BLOCKED_BY_SPEC_GAP`, not a credential or implementation failure. A
+new explicit packet/revision must authorize the minimum deployment paths:
+`deploy/docker-compose.candidate-slot.yml`, `deploy/run-production-canary.sh`,
+and the Supervisor release-set contract/tests if its fixed four-component
+schema must change. The change must define Commit candidate health, revision
+consistency, traffic/promotion behavior, and whole-ReleaseSet rollback.