[patch] Reconcile Google DNS release status

infrastructure/current-release-status.mdx

@@ -13,11 +13,11 @@ No customer-facing managed capability is generally available in this candidate.
 
 | Capability | Status | Gate that remains |
 | --- | --- | --- |
-| First-customer onboarding and organization/site provisioning | Recovery in progress | Complete the canonical deployment, prove one durable first-customer flow from payment through an operations-ready Site, and retain rollback evidence. Closing the browser must not cancel the durable operation. |
+| First-customer onboarding and organization/site provisioning | Internal recovery validated; release blocked | The canonical foundation, organization Terraform, Vault configuration, and Rigger rollout completed. Prove one durable first-customer flow from payment through an operations-ready Site and retain rollback evidence. Closing the browser must not cancel the durable operation. |
 | GitHub App connection and repository discovery | Blocked | The source fixes for the install URL, repository discovery, and fail-closed permission/event validation are on API `main`. The production App registration still needs the required organization-member read permission and pull-request event, followed by a selected-repository install and webhook canary against the exact deployed API revision. |
-| Slack workspace connection | Blocked | The authenticated install/callback source fix is on API `main`, but the exact revision must be deployed before a Slack Workspace Owner installs the app. Login, resource discovery, task admission, and a threaded completion reply must then pass end to end. |
-| Customer organization Vault | Blocked | Complete the organization deployment and Vault workload routes, then retain initialization, secret round-trip, restart, and recovery evidence for the exact three-image runtime. KMS and GCS supply the recovery material; synthetic custodian keys are not part of this design. |
-| Managed and custom-domain edge routing | Blocked | Supply scoped Cloudflare authority for the active `libops.io` zone, finish the canonical rollout, and pass DNS, certificate, route, authorization-preservation, rollback, and teardown canaries. |
+| Slack workspace connection | Source deployed; owner consent blocked | The authenticated install/callback path is deployed with exactly `commands`, `chat:write`, `app_mentions:read`, and `im:history`, with no user scopes. A Slack Workspace Owner must install the app before login, resource discovery, task admission, threaded completion, revoke, and uninstall can pass end to end. |
+| Customer organization Vault | Internal recovery validated; release blocked | The organization deployment, signed `vault-init`, Vault workload routes, and a no-op successor configuration run completed with clean serialized state. Retain customer secret round-trip, restart, isolated backup/restore, and recovery evidence for the exact three-image runtime. KMS and GCS supply root-token-free recovery material; synthetic custodian keys are not part of this design. |
+| Managed and custom-domain edge routing | Internal Google DNS route validated; release blocked | Google Cloud DNS authoritatively serves `libops.site`, and the canonical `rigger.libops.site` route passed its public health canary. Complete customer-domain DNS, certificate, route, authorization-preservation, rollback, teardown, and failure-alert canaries before release qualification. |
 | Operational reconciliation | Blocked | Restore required hosted API CI for the exact candidate, complete deployment canaries, and prove the worker/fencing and MariaDB recovery gates. Source validation alone is insufficient. |
 | LibOps Task Agent | Blocked | Publish and verify the hardened sandbox and embedded skills artifacts, deploy the complete GitHub/Slack/runtime path, and pass one task-to-reviewable-pull-request canary. |
 | Managed application families | Compatibility candidates only | Promote exact immutable tuples and hosted evidence for Drupal, Islandora, WordPress, Open Journal Systems, Omeka Classic, Omeka S, and ArchivesSpace. A released template does not prove aggregate managed availability. |