feat: complete Epic 1 production foundation

docs/capability-baseline/results.json

@@ -1,5 +1,5 @@
 {
-  "baseline_version": "2026.08.14.4",
+  "baseline_version": "2026.08.24.1",
   "defects": [
     {
       "contract": "Local Playwright stack starts only after the configured database exists and is stable.",
@@ -195,6 +195,15 @@
         "ui-logs-approvals"
       ],
       "next_evidence": "Repeat the bounded canary pass after DEF-UI-003 is fixed."
+    },
+    {
+      "check_id": "UI-13",
+      "evidence_mode": "manual_only",
+      "execution_verdict": "not_run",
+      "flow_ids": [
+        "ui-onboarding-first-call"
+      ],
+      "next_evidence": "Run the five-participant fresh-install protocol in docs/manual-regression-checklist.md after a clean Story 1.16 revision; record all censored non-completers and separate eligible denominator."
     }
   ],
   "runs": [
@@ -213,7 +222,7 @@
       ],
       "id": "run-ui-build-7a7f63c86e0e",
       "source_report_sha256": "7a7f63c86e0ef376bee32d4ed202a086b1f16710b1d3b0cc70a21c3475367e2d",
-      "source_revision": "b7face0e9462877e11fa3eef2da2b32c1257eaeb",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
       "summary": {
         "exit_code": 0,
         "skipped": 0,
@@ -235,7 +244,7 @@
       ],
       "id": "run-ui-playwright-60a3cd095202",
       "source_report_sha256": "60a3cd095202739e8d317cd38464d3dace4d02fadb57fbc13f2aaef25d0359cf",
-      "source_revision": "b7face0e9462877e11fa3eef2da2b32c1257eaeb",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
       "summary": {
         "failed": 0,
         "flaky": 0,
@@ -261,13 +270,6 @@
         "mcp-transport-session"
       ],
       "id": "run-authenticated-product-smoke-20a893677c88",
-      "source_report_sha256": "20a893677c8849d1e0ab7255a1ee54cd591e6b87e9678ebf64bc551f87abbd4b",
-      "source_revision": "b7face0e9462877e11fa3eef2da2b32c1257eaeb",
-      "summary": {
-        "exit_code": 0,
-        "skipped": 0,
-        "timed_out": false
-      },
       "safe_outcome": {
         "agent_id": "agent_019fffea9a327832bf3c30d0496b9426",
         "agent_revision": 1,
@@ -282,6 +284,13 @@
           "mcp_call"
         ],
         "verdict": "pass"
+      },
+      "source_report_sha256": "20a893677c8849d1e0ab7255a1ee54cd591e6b87e9678ebf64bc551f87abbd4b",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
+      "summary": {
+        "exit_code": 0,
+        "skipped": 0,
+        "timed_out": false
       }
     },
     {
@@ -311,13 +320,71 @@
       ],
       "id": "run-just-verify-4f6cd6c62692",
       "source_report_sha256": "4f6cd6c62692b95de705bf1c382a412d001f3e98470e4f1b6b4c16d96b625995",
-      "source_revision": "b7face0e9462877e11fa3eef2da2b32c1257eaeb",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
       "summary": {
         "exit_code": 0,
         "skipped": 0,
         "timed_out": false
       }
+    },
+    {
+      "accepted": true,
+      "collector": "capability-baseline-collector-v1",
+      "command_id": "rust-admin-integration",
+      "environment_class": "community-test",
+      "evidence_mode": "automated",
+      "execution_verdict": "pass",
+      "flow_ids": [
+        "api-auth-profiles-upstreams-secrets",
+        "api-operation-lifecycle",
+        "api-operation-test-run"
+      ],
+      "id": "run-credential-lifecycle-59bcb7a400b9",
+      "safe_outcome": {
+        "command": "cargo test -p admin-api --test integration integration::credential_lifecycle -- --test-threads=1",
+        "credential_lifecycle": "pass",
+        "secret_material_exposed": false,
+        "verdict": "pass"
+      },
+      "source_report_sha256": "59bcb7a400b91025fdb90fdf5a8d623dfa3f1bd54581522b640ae3d6532c554e",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
+      "summary": {
+        "exit_code": 0,
+        "failed": 0,
+        "passed": 8,
+        "skipped": 0,
+        "timed_out": false
+      }
+    },
+    {
+      "accepted": true,
+      "collector": "capability-baseline-collector-v1",
+      "command_id": "rust-admin-integration",
+      "environment_class": "community-test",
+      "evidence_mode": "automated",
+      "execution_verdict": "pass",
+      "flow_ids": [
+        "api-master-key-identity-rotation"
+      ],
+      "id": "run-master-key-rotation-94df00120348",
+      "safe_outcome": {
+        "admin_startup_mismatch": "pass",
+        "cli_preflight_resume_verify_promote": "pass",
+        "mcp_startup_mismatch": "pass",
+        "registry_rotation_abort_resume_promote": "pass",
+        "secret_material_exposed": false,
+        "verdict": "pass"
+      },
+      "source_report_sha256": "94df0012034871bc5a6c65e7fa6a5e0f9eb14e2d651916cecff2b764fba5cefa",
+      "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd",
+      "summary": {
+        "exit_code": 0,
+        "failed": 0,
+        "passed": 28,
+        "skipped": 0,
+        "timed_out": false
+      }
     }
   ],
-  "source_revision": "b7face0e9462877e11fa3eef2da2b32c1257eaeb"
+  "source_revision": "767428436d3a54e60809a727044dfcec48e1f1dd"
 }