Mark milestone 0.5 complete in PHASE0_PLAN, POA&M, and status handoff

PHASE0_STATUS also refreshed: SSH remote, push state, 0.6 as next
milestone, new gotchas (write-only SSN, __audit_redact__, key changes).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

POAM.md

@@ -176,6 +176,7 @@ Closures retained for traceability.
 | — | Phase 0 milestone 0.2 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | OWC framework vendored (base/crud/bulk/pagination/router/version_history + audit + security/rbac + users + auth stub) with owc→ypms renames. YPMS pii_audit decorator added. Pagination bug in upstream OWC fixed here (peek-ahead cursor). 26 tests passing, 93.10% coverage. Migration 0002 creates the framework tables. |
 | — | Phase 0 milestone 0.3 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Local password auth + JWT access/refresh tokens with YPMS-specific claims (`uid`, `roles`, `iam.assurance_level`, `mfa_verified`). Endpoints: /auth/login, /auth/refresh, /auth/me, /auth/change-password. NIST AC-7 lockout at 5 attempts / 15 min (source RFP C.5.7.10). 43 tests passing, 93.47% coverage. |
 | — | Phase 0 milestone 0.4 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Data-driven RBAC seed: 8 roles + permissions matrix (30 entities × 8 actions) at `src/ypms/seed/`. Bootstrap admin auto-seeded (`chris` / DOES_SYSTEM_ADMIN). Loader idempotent + validates cell references. `python -m ypms.seed.run` chained into docker-compose. 53 tests passing, 92.20% coverage. |
+| — | Phase 0 milestone 0.5 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Registrant vertical slice: model, schemas, router, migration 0003. SSN app-layer encrypted (AES-256-GCM, column-bound AAD) and masked in the serializer (C.5.7.50 / SC-28). `pii_read` audit on every read path (C.5.6.9 #5 / AU-14). Audit + version-history snapshots redact ciphertext via `__audit_redact__`. Portal-only roles limited to own row. 98 tests passing, 94.83% coverage. Evidence trace at `docs/coverage/registrant.md`. |
 
 ---