docs(oath): mark S3 enforced now that branch protection requires var-go/oath (closes #8)

docs/INCEPTION-OATH.md

@@ -3,10 +3,10 @@
 The acceptance contract for standing up cad-atlas. The sprint is finalized only when this
 Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath.md`.
 
-> **Status of enforcement:** this Oath is currently **advisory** (human-verified). `var-go/oath`
+> **Status of enforcement:** `var-go/oath` gates a real candidate (`oathcandidate/`, #8 — parses
-> gates a real candidate now (`oathcandidate/`, #8 — parses the committed CI workflow, TDD'd
+> the committed CI workflow, TDD'd pass/fail-closed) and is now **required by branch protection**
-> pass/fail-closed) but isn't yet required by branch protection pending a real-PR confirmation.
+> on `main` (verified green on a real PR). Direct pushes remain allowlisted for `mathias` per this
-> See the honesty rule below.
+> repo's TBD convention.
 
 ## General clauses (any inception sprint)
 
@@ -26,7 +26,7 @@ Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath
 |---|--------|--------|----------|
 | S1 | Atlas served at `/`, renders all 9 stages signal→pod | ✅ | `internal/web/handler.go` + `static/cad-atlas.html` |
 | S2 | Oath covered in the viz (stages 03 + 06) | ✅ | var-go Oath nodes in the atlas |
-| S3 | `var-go/oath` enforces cad-atlas's own PRs | ⏸ **real candidate wired, not enforcing → #8** | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Not yet branch-protection-required — awaiting confirmation on a real PR. See honesty rule. |
+| S3 | `var-go/oath` enforces cad-atlas's own PRs | ✅ | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Branch protection on `main` now requires `var-go/oath`, confirmed holding on a real PR (#8). |
 
 ## Deployment
 
@@ -38,10 +38,10 @@ namespace `cad-atlas`, 1 replica, `cad-atlas:80 → :8080` (manifests in `mathia
 ## The honesty rule
 
 A clause blocked by an external dependency is **descoped and tracked, never marked satisfied** —
-a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3's real
+a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3 is now fully
-candidate is wired (#8) but branch-protection enforcement waits on a real-PR confirmation, tracked
+enforced: real candidate wired and branch-protection-required (#8), confirmed on a real PR. The
-there, not claimed here. The `DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and
+`DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and #8 both landed without a
-#8 both landed without a secret-write.
+secret-write.
 
 Also surfaced by #8: this file's own "Oath (advisory form)" below predates the discovery that
 var-go's parser requires single-line, period-separated sentences with no `Given`/`Then`/`And`