Say that Phase 4 shipped, and that the environment proving it is gone (#7)

The status file and the README both still said Phase 4 was not shipped
because the environment had lost Docker and database access partway
through, and that only the audit-logging guarantees had been confirmed
against a live database. That stopped being true some time ago.
phase-4-runbook.md records the opposite in detail: Docker access came
back, a real docker-compose stack ran with real ClickHouse and Postgres
and two provisioned tenants, a local kind cluster ran the Helm chart end
to end, and both SSO protocols were verified against a real Auth0 tenant
with full browser round trips. Eight real bugs came out of that, six from
compose and two from the chart's first real install -- none of them
findable without the infrastructure.

PROJECT-SPEC.md sends readers to status.md and tells them to read it
before assuming a capability works end to end, so the one file that is
meant to be authoritative was the one understating the project by the
widest margin.

Correcting it matters more now than it would have last week, because the
evidence cannot be regenerated: proto.cairnobs.org and the VPS under it
were retired on 2026-09-04, taking the mTLS CA, the server certificate
and six enrolled agents with them. The runbooks are what is left.

Three gaps are now stated rather than implied:

The prototype is gone, so none of this can be re-run today without
building one. The DNS was kept for that; the certificates deliberately
were not.

demo.cairnobs.org is live and is not evidence for Phase 4. It runs
COMPOSE_PROFILES=single-tenant, so it exercises the OSS path and says
nothing about RBAC, tenant isolation or per-tenant ClickHouse. A healthy
demo proving multi-tenancy is exactly the wrong inference to leave
available.

SSO has been tried against one IdP and one local kind cluster, not two
IdPs and not a production-grade cluster.

The Terraform entry now names its cause instead of pointing at another
file: alerting exposes no PUT for rules or targets, and neither
rulestore.Store nor notifystore.Store has an Update method to wire one
to, so Terraform destroys and recreates -- which resets alert_state and
delivery-log continuity.

README.md

@@ -122,18 +122,25 @@ Full per-phase detail is in [`docs/status.md`](docs/status.md).
 | 1 | Windows Event Log + journald, SQL and full-text paths | Shipped |
 | 2 | Unified query language across both stores | Shipped |
 | 3 | Dashboards, alert rules, notification delivery | Shipped |
-| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | **In progress** |
+| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | Shipped |
 | 5 | Frontend redesign and design system | Shipped |
 | 6 | License compliance audit and remediation | Shipped |
 | 7 | AI-assisted query authoring | Shipped |
 
-**Phase 4 is not shipped.** The code is built and tested, but the environment
+**Phase 4 is shipped, and the environment that proved it is gone.** Every
-lost Docker and database access partway through, so only the audit-logging
+control the phase defines was verified against real infrastructure at least
-guarantees were confirmed against a live database. The rest compiles and skips
+once — a docker-compose stack with real ClickHouse and Postgres, a local `kind`
-cleanly when no live database is configured, but is otherwise unverified — see
+cluster, and both SSO protocols against a real Auth0 tenant — finding eight
-the verification-status section of
+bugs that no amount of Docker-free testing could have caught. The prototype
+VPS was retired on 2026-09-04, so that verification is a record rather than
+something you can re-run: see
 [`docs/phase-4-runbook.md`](docs/phase-4-runbook.md).
 
+Two limits worth stating plainly. SSO has been tried against one IdP, not two,
+and no production-grade cluster has run this. And `demo.cairnobs.org` is **not**
+evidence for any of it — the demo runs the single-tenant profile, so it
+exercises the OSS path and says nothing about RBAC or tenant isolation.
+
 The Windows agent code (`EvtSubscribe`, ETW, service registration) has never
 run on real Windows — no Windows toolchain existed in the build environment.
 ETW additionally sits behind a feature flag, since it needs elevated

docs/status.md

@@ -16,20 +16,41 @@ verification procedure and its results.
 | 1 | Windows Event Log + journald, SQL and full-text paths | Shipped |
 | 2 | Unified query language across both stores | Shipped |
 | 3 | Dashboards, alert rules, notification delivery | Shipped |
-| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | **In progress** |
+| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | Shipped |
 | 5 | Frontend redesign and design system | Shipped |
 | 6 | License compliance audit and remediation | Shipped |
 | 7 | AI-assisted query authoring | Shipped |
 
 **Known verification gaps**, carried forward rather than buried:
 
-- **Phase 4 is not shipped.** Built and unit-tested, but the environment
+- **The prototype environment no longer exists.** `proto.cairnobs.org` and
-  lost Docker/database access partway through; only the audit-logging
+  the VPS under it were retired on 2026-09-04; the mTLS CA, the server
-  guarantees were confirmed against a live database.
+  certificate and six enrolled field agents went with the host. Nothing
+  below is *un*-verified because of that — the verification happened while
+  the environment stood, and the per-phase runbooks are the record of it —
+  but none of it can be re-run today without building a prototype again.
+  The DNS was preserved for exactly that, in
+  [`/deploy/retired-prototype-dns.json`](../deploy/retired-prototype-dns.json);
+  the certificates deliberately were not, and a new prototype issues its own.
+- **The live demo does not cover Phase 4.** `demo.cairnobs.org` runs, and is
+  rebuilt nightly from [`/hack/demo-seed`](../hack/demo-seed), but it runs
+  `COMPOSE_PROFILES=single-tenant` — so it exercises the OSS path and says
+  nothing about RBAC, tenant isolation or per-tenant ClickHouse. Do not read
+  a healthy demo as evidence for Phase 4.
+- **Phase 4's SSO has been tried against one IdP, not two.** OIDC and SAML
+  were both verified end to end against a real Auth0 developer tenant,
+  browser round trips included. A second, independent IdP has never been
+  tried, and no production-grade cluster has run this — the Kubernetes
+  verification was against a local `kind` cluster.
 - **The Windows agent path has never run on real Windows** — no Windows
   toolchain existed in the build environment. See `/agent/README.md`.
-- **Terraform coverage is partial** — see `/terraform/README.md` for the
+- **Terraform coverage is partial**, and the cause is an API gap rather than
-  full accounting.
+  a Terraform one: `alerting` exposes no `PUT /rules/{id}` or
+  `PUT /targets/{id}`, and neither `rulestore.Store` nor `notifystore.Store`
+  has an `Update` method to wire one to. So alert rules and notification
+  targets are create/destroy only, and changing any attribute destroys and
+  recreates — which also resets `alert_state` and delivery-log continuity.
+  See `/terraform/README.md` for the full accounting.
 
 ## What "done" looks like for Phase 0 (MVP)
 
@@ -128,19 +149,30 @@ Non-goals for this phase (same discipline as every phase so far):
 
 ## What "done" looks like for Phase 4
 
-**Status: in progress, not shipped.** RBAC enforcement (`api/authz`), the
+**Status: shipped.** Every control this phase defines has been verified
+against real infrastructure at least once, and the residual gaps are named
+in the list at the top of this file rather than here. What follows is the
+build record; `/docs/phase-4-runbook.md`'s "Verification status" section is
+the authoritative account of what was run and what it found — including the
+eight real bugs that only live infrastructure could have surfaced, six from
+the docker-compose stack and two from the Helm chart's first real install.
+
+Read that runbook rather than re-running it: the environment it describes
+was retired on 2026-09-04.
+
+RBAC enforcement (`api/authz`), the
 `alerting`↔`api` service-identity credential, tenant-scoped dashboards,
 append-only audit logging, and — since the second pass on this phase —
 real per-tenant ClickHouse provisioning and query routing
 (`enterprise/internal/tenantprovision`, `enterprise/internal/chrunner`,
 wired into a new `enterprise/cmd/enterprise-api` binary alongside plain
-`api/cmd/api`) are all built and tested — real integration tests exist
+`api/cmd/api`) are all built and tested. Docker access was lost partway
-for the ClickHouse pieces, but this environment lost Docker/database
+through this phase and later came back, and the ClickHouse pieces were
-access partway through the phase, so only the audit-logging guarantees
+then run for real: a docker-compose stack with real ClickHouse and
-were actually confirmed against a live database; the rest is untested
+Postgres, real `enterprise-auth`/`enterprise-api`/`enterprise-ingest`
-beyond "compiles, and skips cleanly when no live database is
+containers and two provisioned tenants (`acme`, `globex`), which closed
-configured" (see `/docs/phase-4-runbook.md`'s verification-status
+every "written but never run" gap on that side and found six real bugs
-section). Human SSO login is now built for both protocols
+doing it (see `/docs/phase-4-runbook.md`'s verification-status section). Human SSO login is now built for both protocols
 (`enterprise/internal/loginhandler`: `GET /auth/oidc/login` +
 `GET /auth/oidc/callback`, and `GET /auth/saml/login` +
 `POST /auth/saml/acs` via `enterprise/internal/saml`'s `crewjam/saml`