[nomed]

Summary

Executes #84 OV-5 against pinned OpenViking 234a2d9fe778a9512fd7ebe9807198e847c647ec after the governance preflight (#85).

This slice uses the public api-key multi-tenant model and public admin/session/data APIs only.

Executable gates

• create synthetic account and users Alice/Bob through public admin APIs;
• create a real Alice memory through public session → commit → extraction;
• prove Alice can read her canonical memory URI and Bob cannot;
• remove Alice through admin_remove_user;
• prove Alice's API key is rejected immediately;
• wait for the public deletion task and confirm Alice disappears from active users;
• restart OpenViking against the same storage;
• prove Alice remains revoked and Bob remains valid.

Decision semantics

This PR intentionally expects PARTIAL, not PASS, if all executable identity/revocation gates succeed.

Reason: the pinned public semantics provide identity/key revocation plus fenced user deletion, but do not establish a standalone per-memory/team ACL revoke. Self/peer routing is not promoted to ACL evidence merely because namespaces exist.

A green run therefore means: OpenViking has strong user isolation + durable identity revocation, but OV-5 remains PARTIAL for the broader Yukh team/memory-governance requirement. That is the evidence-based trigger to evaluate a complementary memory-governance specialist rather than forcing an OPENVIKING_ALONE verdict.

Related: #84, #63, #77, #81, #83, #85.

[nomed]

PASS — READY TO MERGE

Final review of OV-5 executable governance on current head 0397d10b7550938f2c334d6e99f5e252f2b4441a.

The green executable run proves the claims the PR actually makes: Alice/Bob identity isolation through public api-key multi-tenant seams; Alice-only memory visibility; immediate Alice key revocation after admin_remove_user; completed fenced asynchronous cleanup; revocation persistence across a full same-storage server restart; and continued validity for unrelated Bob.

The decision remains correctly scoped to PARTIAL: the harness explicitly refuses to infer team ACL from self/peer namespace routing, and does not mislabel identity deletion/key revocation as standalone per-memory ACL revocation. The verifier fail-closes on both team_acl_proven=false and standalone_per_memory_acl_revoke=false.

No private API/database mutation is used, the bounded model profile remains loopback-only, and memory remains non-authoritative. No remaining blocker found.

This PARTIAL is the evidence-based trigger to evaluate a complementary memory-governance specialist; it is not an OPENVIKING_ALONE verdict.