docs(operations): record v1 readiness evidence (#23)

docs/operations/capacity-and-resilience.md

@@ -81,7 +81,7 @@ concurrent build, thermal throttling, or oversubscribed CI host.
 The checked-in baseline is
 [`candidate-2cpu.json`](../evidence/capacity/v2/candidate-2cpu.json). It was
 produced on .NET 10.0.9/Linux x64 with CPU affinity restricted to two logical
-CPUs. It filled 25,000 listings and 10,000 attempts, peaked at about 162 MiB,
+CPUs. It filled 25,000 listings and 10,000 attempts, peaked at about 169 MiB,
 and cleared all active/retained state. The five-minute baseline supersedes any
 earlier local probe when its timestamp and target duration differ.
 

docs/operations/production-readiness.md

@@ -50,6 +50,32 @@ container bridge, or second process on one machine cannot prove it:
 Failure or missing evidence is blocking. It is never converted into an accepted
 risk by changing the wording of the readiness note.
 
+When an external gate passes, add a redacted repository JSON attestation and
+point that gate's `evidenceRef` to it. The checker requires this exact shape and
+binds the gate to the evaluated candidate commit. `artifactDigest` is the SHA-256
+of the protected evidence bundle or public release record, not a peer endpoint,
+listing identifier, account identifier, or credential:
+
+```json
+{
+  "schemaVersion": 1,
+  "kind": "rendezvous-external-gate-attestation",
+  "gateId": "replace-with-the-exact-gate-id",
+  "candidateCommit": "replace-with-the-40-character-candidate-commit",
+  "result": "pass",
+  "performedAtUtc": "2026-01-01T00:00:00Z",
+  "artifactDigest": "replace-with-the-64-character-sha256",
+  "evidenceLocation": "protected-operations-record",
+  "reviewerRole": "independent-operator"
+}
+```
+
+Allowed evidence locations are `protected-operations-record` and
+`public-release-record`. Allowed reviewer roles are `release-operator`,
+`network-operator`, `security-operator`, and `independent-operator`. The checker
+rejects a missing file, wrong gate, wrong candidate, malformed digest, naive
+timestamp, extra fields, or sensitive-data-shaped contents.
+
 ## Prepare one immutable canary build
 
 Use the exact release candidate on every canary machine. Verify a clean checkout,