Protected operations

A clear, accountable view of OLUK.

Clerk supplies signed operator identity, MFA state, and live session validity. OLUK applies store roles and records audit attribution.