docs(audit): reconcile Phase 10 findings on Phase 9.5, Infisical, and website pricing

Phase 9.5: reconfirmed no canonical commit exists (broader content search across full history —
still zero hits outside this session's own commits); Chase confirmed the real document lives on
PC #2, unpushed. Not duplicated here per Chase's explicit instruction — he owns bringing it to
canonical Gitea.

Infisical: Phase 10's 'project does not exist' finding was incomplete, not wrong about what it
checked — a proper org-scoped API enumeration (8 projects) still shows no RootNode Academy
project visible to the claude-code-migration machine identity, even though Chase confirms it
exists. Root cause narrowed to a missing per-project access grant (Infisical scopes identity
visibility per-project, separate from org membership) rather than the project not existing.
Corrected docs/SECRETS_AND_INFISICAL.md and docs/PHASE10_CANONICAL_STATE_AUDIT.md accordingly,
with the exact one-step fix (grant the identity access via Project Settings -> Access) and the
identity id needed to do it. No duplicate project was created.

Website pricing: a read-only fetch of rootnodeacademy.com found stale founding-price RANGES that
don't match the exact fixed V1 prices Chase gave directly this phase; Chase confirmed the fixed
prices in this repo's docs are correct and current. Noted as a real discrepancy for his own
awareness, not something this repo's scope covers fixing.

Updated the Phase 10 launch matrix with a Category column (TECHNICAL READY / OWNER DECISION
REQUIRED / EXTERNAL BLOCKER / HARDWARE BLOCKER) distinguishing who needs to act on each
remaining gate. No application code changed — audit/documentation reconciliation only.

docs/SECRETS_AND_INFISICAL.md

@@ -13,19 +13,33 @@ machine identity is valid for the self-hosted instance only). Authenticated succ
 phase using the machine identity at `~/.config/infisical/identity.env`
 (`universal-auth`, org "Ceds HomeLab").
 
-**No "RootNode Academy" project exists yet** in that organization — verified via `infisical
-init`'s own project picker, which lists exactly six existing projects: Core Infrastructure,
-Hermes Fleet, Kubernetes, Media Platform, Monitoring, Network Service. This contradicts Phase
-10's own authorization text ("Chase has ALREADY created RootNode Academy"). The Infisical CLI
-has no non-interactive project-creation command — creating one requires the web dashboard
-(`https://infisical.cedshomelab.com`), which this session cannot reach (no browser).
+**Update, Phase 10.1**: Chase confirmed a "RootNode Academy" project already exists on this
+instance. Re-investigated with a proper API call rather than trusting the CLI's interactive
+picker alone — `GET /api/v2/organizations/{orgId}/workspaces` (the same authenticated identity,
+a direct, complete enumeration, not a scrollable TUI) returns **8** projects visible to this
+identity: Core Infrastructure, Kubernetes, Media Platform, Monitoring, Network Service,
+Privileged Access Manager, Storage, Synthos Systems. (Two more than Phase 10's original 6-project
+CLI capture, and with different membership — the CLI capture was evidently incomplete, not just
+under-scrolled; "Hermes Fleet," which appeared in the CLI list, doesn't appear in this
+authoritative API list at all.) **Still no "RootNode Academy" entry, under this identity.**
 
-**Owner action required:** create a "RootNode Academy" project in the Infisical dashboard, with
-three environments (**Development**, **Staging**, **Production** — matching this document's own
-categorization below), and tell this session (or a future one) its project id so the secret
-inventory below can actually be pushed. Until then, every secret continues to live only in local,
-gitignored `.env` files (development) or has no home at all (staging/production don't exist yet
-— see `docs/PHASE10_PRODUCTION_DEPLOYMENT.md`).
+**Root cause, narrowed**: an identity's own workspace list in Infisical reflects only the
+projects it has been explicitly granted access to (a per-project ACL, separate from org
+membership) — an org owner's dashboard view would show every project in the org regardless of
+any one identity's grants. The most likely explanation is that the project exists, created by
+Chase, but the `claude-code-migration` machine identity was never added to its access list —
+not that the project doesn't exist. This session cannot tell the two apart without either
+org-owner API scope or the web dashboard, neither available here. **No duplicate project was
+created**, per Phase 10.1's explicit instruction.
+
+**Owner action required — the fix, precisely:** in the Infisical dashboard
+(`https://infisical.cedshomelab.com`), open the RootNode Academy project → **Project Settings →
+Access → Machine Identities**, and add `claude-code-migration` (identity id
+`f3b42de1-11b6-4aa1-8f2e-7b85accec5fb`) with read/write access to whichever environments should
+be automatable. Once granted, a future session can list/read/write its secrets directly — no
+further CLI/API workaround needed. Until then, every secret continues to live only in local,
+gitignored `.env` files (development) — see `docs/PHASE10_PRODUCTION_DEPLOYMENT.md` for
+staging/production status.
 
 ## Secret inventory (real, from code — not from this prompt's guessed category list)
 
@@ -77,11 +91,14 @@ substitutions. Only the "Secret" rows above need an Infisical home.
 
 ## What Chase needs to do
 
-1. Create the "RootNode Academy" project in the Infisical dashboard
-   (`https://infisical.cedshomelab.com`) with Development/Staging/Production environments.
-2. Share the project id (or grant the existing machine identity access to it) so secrets can
-   actually be pushed.
-3. Once that exists, this session (or the next one) can populate every "Secret" row above from
-   the current local `platform/.env`/`platform/provisioner/.env` values for Development, and
-   Chase provides the real Staging/Production values (Stripe LIVE keys especially) directly when
-   ready for those environments — never invented or guessed by this phase.
+1. In the existing "RootNode Academy" project's **Project Settings → Access → Machine
+   Identities**, add `claude-code-migration` (id `f3b42de1-11b6-4aa1-8f2e-7b85accec5fb`) with
+   read/write access to whichever environments should be automatable. **Do not create a second
+   project** — this one-line access grant is the fix, per Phase 10.1's investigation.
+2. Confirm the project's environment names (Phase 10.1 could not see them without access) —
+   reuse whatever exists rather than renaming to force a Development/Staging/Production match,
+   per this repo's own "existing structure wins" instruction.
+3. Once access is granted, a future session can populate every "Secret" row above from the
+   current local `platform/.env`/`platform/provisioner/.env` values for Development, and Chase
+   provides the real Staging/Production values (Stripe LIVE keys especially) directly when ready
+   for those environments — never invented or guessed by this phase.