[nomed]

Summary

Starts #84 after OV-4 PASS (#83) on pinned OpenViking 234a2d9fe778a9512fd7ebe9807198e847c647ec.

This preflight freezes the public identity/revocation semantics before executable OV-5.

Findings encoded fail-closed

The pin publicly documents:

• multi-tenant accounts/users;
• api_key mode where effective role is derived from the presented key;
• user-scoped memory namespaces;
• public admin account/user registration;
• admin_remove_user, which immediately revokes the user API key, writes a deletion fence, and starts durable asynchronous owned-data cleanup.

The qualification deliberately does not call this a generic ACL revoke. Its semantic class is identity/key revocation plus user deletion. Likewise, self/peer routing is not classified as team ACL until executable evidence proves enforcement.

Next executable slice

Use public supported seams only to create synthetic A/B identities, create memory as A, prove B cannot read A memory, remove A, prove immediate key revocation, wait for cleanup, restart same storage, and prove access does not reappear. Peer/team behavior will be reported separately and cannot inherit PASS from namespace shape alone.

A green preflight means only that the public seams are sufficient to attempt executable OV-5; it is not an OPENVIKING_ALONE verdict.

Related: #84, #63, #77, #81, #83.

[nomed]

PASS — READY TO MERGE

OV-5 governance preflight reviewed on current head b4d322f666e28cb189d22fea606640d03d99c582.

The preflight is correctly scoped: it freezes only publicly documented identity/revocation seams and does not overclaim executable ACL behavior. In particular, it explicitly classifies admin_remove_user as identity/API-key revocation plus fenced asynchronous user deletion, not as generic per-memory ACL revocation, and it refuses to treat self/peer namespace routing as team ACL without executable enforcement evidence.

CI is green, including Qualify Track C2 OpenViking OV-5 run #1. No blocker found for this preflight slice. Merge authorizes the separate executable OV-5 identity isolation/revocation gate; it does not authorize OPENVIKING_ALONE.