Authorize the stored TypeSafe key for the trading lane's research and Jev harness - #985

PR #985 corrected docs/secret-storage.md:20 so the typesafe row agrees with
adoption/credential-inventory.json (owner decision 2026-10-10: the trading
lane's research work and Jev harness may also use the stored key, each in its
own process started through credential_run.py). No test caught the stale
sentence "A trading-lane use needs its own, separately authorized key", and
the GPT range-diff read of 8e9e56c asked for a committed regression.

The new test in tests/test_credential_status.py,
test_typesafe_row_keeps_the_research_and_jev_grant_without_a_separate_key,
asserts that the inventory row keeps the runner loader and the grant, that
the one docs row keeps the runner command and the grant, and that neither
carries a separate-key requirement.

tests/test_credential_status.py is re-registered in manifests/evidence.json
with host_receipts.register_file (docs/lanes.md:107); only its sha256 and
bytes change. scripts/evidence_manifest.py only sorts and checks the order
of files[] and has no hash-update mode.

Verdict: ~/.cache/ns2604-gpt-reads/fix1b-pr985-8e9e56cdc/VERDICT.md
(sha256 b057e6eedb496ae228d1a54805e3814da690e77494b53c53c961092950fccc03).

Fail before, with docs/secret-storage.md checked out from 2a33680 and
restored afterwards (adoption/credential-inventory.json is identical at both):
  git checkout 2a33680 -- docs/secret-storage.md
  python3 -B -m unittest tests.test_credential_status.CredentialStatusTests.test_typesafe_row_keeps_the_research_and_jev_grant_without_a_separate_key
    rc 1, 1 test, failures=1: 'separately authorized' unexpectedly found
    (place='docs/secret-storage.md row')
  python3 -B -m unittest tests.test_credential_status
    rc 1, 49 tests, failures=1 (only this test)

Pass after, at this commit:
  the same single-test command: rc 0, 1 test
  python3 -B -m unittest tests.test_credential_status: rc 0, 49 tests (48 before)
  python3 scripts/validate.py: rc 0 (11421 hashed files)
  python3 scripts/evidence_manifest.py --check: rc 0

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…heir approved text

The regression added for PR #985 (c9155c3) checked that the docs row and the
inventory entry name the research and Jev uses and the runner, and rejected the
fragments "separately authorized", "needs its own" and "separate key". The GPT
review of c9155c3 (CHANGES_REQUESTED, one P2 at
tests/test_credential_status.py:294, :295 and :299-301) measured three
contradictions of the owner's 2026-10-10 grant that all passed it, rc 0:
  - docs/secret-storage.md:20, the dated grant clause replaced by
    ", excluding the trading lane's research work and Jev harness"
  - "A trading-lane use requires its own independently authorized key."
    appended to the docs row
  - the same sentence appended to the inventory notes
    (adoption/credential-inventory.json:140)

test_typesafe_row_keeps_the_research_and_jev_grant_without_a_separate_key keeps
its name: it still says what it enforces. In both real files it now requires
the dated affirmative grant and the complete approved text after whitespace
normalisation (the docs row and the inventory notes), and loaders equal to
exactly the runner command. The phrase blacklist is gone. The same check runs
on planted contradictions that must fail it with the expected message: the
grant revoked, and each of two key-requirement sentences appended (the one
8e9e56c removed and the reworded one), in both places. A whitespace-only
reflow must still pass, and the docs row is found after whitespace
normalisation so a reformatted table does not hide it.

tests/test_credential_status.py is re-registered in manifests/evidence.json
with host_receipts.register_file (docs/lanes.md:107); only its sha256 and
bytes change.

Corrections audit (#151)
  Source: the GPT verdict for PR #985 at c9155c3, ~/.cache/ns2604-gpt-reads/
  fix2-pr985-c9155c3d8/VERDICT.md (sha256
  ccd7bffc9115c3770a481e2eef1b4b663f34ff2e6efe4257f0f7b7c60cb52ba6) with its
  REVIEW-EVIDENCE.md; the repo's own docs/secret-storage.md:20 and
  adoption/credential-inventory.json:140 at c9155c3. Mechanism, Python
  3.13.16 standard library as installed: unittest/case.py:1324-1338
  (assertRaisesRegex), :746-765 (_formatMessage appends the explicit message to
  the standard one after " : ", which the planted-case regexes rely on) and
  :537-566 (subTest).
  Fail before: the c9155c3 test returns rc 0 on each of the three
  contradictions above.
  Fail after: this test returns rc 1 on each (docs revocation: "docs/secret-
  storage.md row lost the dated grant"; the two appended sentences: "departs
  from the approved text"), and on the exact 2a33680 docs file (194,754
  bytes, sha256 028f69a6...), the dropped grant and runner in either file, and
  a revoked inventory grant. Each run is the single-test command with one real
  input file changed in an isolated archive copy of c9155c3.
  Pass after: the single-test command rc 0, 1 test; tests.test_credential_status
  rc 0, 49 tests; scripts/validate.py rc 0 (11421 hashed files);
  scripts/evidence_manifest.py --check rc 0. Whitespace-only changes to the
  docs row and the notes also pass, rc 0.
  Untested boundary: text outside the pinned docs row, notes and loaders, such
  as the inventory rotation field, is not bound (a sentence appended there
  still passes, rc 0).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>