Source: MIZOKI audit 2026-09-06 (pinned fc8b03f9) → work-order backlog 2026-09-08 (docs/audits/AUDIT_WORK_ORDERS_2026-09-08.md). Findings are hypotheses until reproduced on current main (WO-00).

Finding: Certification evaluator exists; its enforcement scope is narrower than the promotion path [R32]. Files: services/service-action-runner/execution_adapters/portfolio.py; services/service-decision-control-plane/decision_meter.py. Fix: promotion calls the evaluator per tenant/account/action; no bypass path. Acceptance: promotion without a certification record → refused. Depends on: WO-06.