Add policy-bound credential submission and native DLP audit proofs

docs/development-observability.md

@@ -139,3 +139,57 @@ and never requests the second saved destination. Trace
 `583a1d4dbc80fb2cbcb135b1622a4993` records the failed native stage at 1410.0137 ms
 and owned-tab rollback at 0.7242 ms. The delay was intentional fixture behavior;
 it is not a production performance result. Collector rejected writes were zero.
+
+
+On 2026-10-13, the protected live receiver was queried for controlled-login trace
+`aedaae84014f4d5e14c6d7b441d7e0f7`. Eight credential phases were verified to
+have the same native request ancestor: claim, parse, match, residual, headers,
+header-values, authorization and completion. The body gate took 216.4937 ms;
+local inspection took 178.5054 ms, while its inspector span took 12.283203 ms
+and YARA 11.866699 ms. Enterprise inspection took 4.8818 ms. The remaining
+local-inspection interval cannot be attributed to parsing or YARA from these
+spans alone; investigate IPC, scheduling and containment before claiming a cause.
+The receiver reported zero rejected writes and uses Windows DPAPI plus AES-GCM
+for local archive storage. These are actual local fixture measurements, not
+production latency guarantees. Credential values and form descriptors are
+excluded from debug attributes; security evidence uses its separate policy and
+audit pipeline. Trace exports remain centrally disableable.
+
+The follow-up review found credential substring HMAC checks outside the named
+matching stage. They now use `credential.match`, including checks of additional
+fields and unexpected destinations. A real OTLP receiver regression verifies
+six internal stage parents, timestamps, secret exclusion and central disable.
+The combined broker, OTLP, policy-transition and request/header deadline suite
+passes 29 tests. The earlier native trace predates this final matching refinement;
+its timings must not be presented as measurements of the refined code.
+
+
+The subsequent real native split-header test failed although the broker suite was
+green. A separate Electron 44.7 / Chromium 152 header-order probe established the
+cause: `X-Credential-One` and `X-Credential-Two` arrived with `sec-ch-ua-mobile`
+between them. Joining every header value did not reconstruct the synthetic
+credential; joining the two fragments did. Evidence retains only header names,
+indices and booleans (`artifacts/credential-header-order-proof.json`), never values.
+This native fact motivates bounded two-fragment checks independent of header
+iteration order. It does not prove coverage of arbitrary fragmentation/encoding.
+
+
+After the bounded pair fix, the fresh actual Windows native run passes both
+unregistered-credential escape cases. Trace
+`6709b228cb8ce71a88acc7584a27c5a1` contains 101 spans; credential header checking
+took 15.6353 ms (header-values child 14.4573 ms), authorization 0.9952 ms and
+terminal audit completion 24.8035 ms. Actual request ancestry and original plus
+alternate synthetic secret exclusion were verified. ICAP observed no credentials
+in 54 scans; collector rejected writes remained zero. The full suite passes
+668 tests. The failing predecessor remains separate evidence and is not counted
+as a pass. These timings are local fixture observations, not general benchmarks.
+
+
+The receiver-strengthened final native run also passes: exactly four approved
+credential POSTs, zero public POSTs, zero replays and zero credential URL/header
+leaks at the independent HTTPS receiver. It privately checks any two header
+fragments rather than relying on all-values concatenation. Current trace
+`050f7f44bc009f949c838f8a067649e4` has 101 spans with verified request ancestry;
+collector rejected writes remain zero. Evidence: `artifacts/controlled-login-native-proof.json`
+and `artifacts/controlled-login-receiver-proof-native.log`. Earlier native failures
+and the prior successful proof remain distinct local evidence.