informed-decision/docs/evidence/2026-10-11-purpose-image-release/execution-bundle.json

{
  "kind": "informed-decision.supervised-execution-source-bundle",
  "version": 2,
  "proposal_id": "INFD-WP-0009-T04/purpose-overlay-v1",
  "files": {
    "README.md": {
      "sha256": "51b56c8ec2f30ad62f6cd09732c0f73dd7b5ebf2081320223c85bbcbf00d15a9",
      "content": "# Version2 protected existing-snapshot rescue — prepared, unapproved\n\nOriginal approved source bc6494cd completed drill-backup, then drill-copy failed before creating a local snapshot. Original journal drill-copy remains UNCERTAIN. Metadata-only capture proves exact unchanged main19537920bytes/SHA8756..., WAL0 and privateSHM32768. Source closes SQLite connections explicitly; immutable reads are only for the frozen main snapshot with exact prior digest/size/private identity and no WAL frames. Live source and offline pre/post-admin reads remain mode=ro/query_only WAL-aware; immutable is never a live DB or schema-migration shortcut. Sidecars remain retained, never deleted/checkpointed.\n\nFresh founder acceptance of the exact memo version2 is required before any rescue or continuation. Old version1 acceptance cannot pass authority checks. Root must freshly authenticate actual confirmed person/platform-root ACCEPT at the fixed native origin before each phase; protected receipt checking is supervised bookkeeping, not an authenticated signed/autonomous grant. No new native operation has run in this preparation.\n\nFixed order: drill-copy-rescue-r1 → offline-verify → cleanup-offline → cutover-backup → cutover-copy → release → verify; rollback → rollback-verify only after recorded new release attempt. New rescue-execution-journal-r1.json and rescue-execution-r1.lock coexist with the unchanged original execution-journal.json. They hash-link its exact original approved identity, COMPLETE backup and UNCERTAIN copy attempt IDs/results. No extra original phase or release is allowed; original journal hash is checked before and after each new phase. No old drill-copy retry/overwrite or synthesized completed phase.\n\nBefore rescue, original local drill.sqlite/cutover.sqlite must be absent, restore volume must be absent, and local engine bnt-lap001/current native oldimage7f5/source7db/sealedDeployment+CM/PVC/originalPodUID must match. The old backup admin already exited after uniquely creating the private fixed snapshot path; the only later original access was WAL-aware readonly inspection, with no snapshot writer. Main hash, private identities and absent/zero WAL are checked before/after immutable inspection and copy. Original private SHM is indexing and is retained unchanged. Nonempty WAL, changed hash/metadata, missing failed journal, missing origin or any unverified outcome stops rescue. No new native backup is made for the drill. Binary snapshot bytes flow only into a new0600 localfile, never chat/log/packet. Same rescue-phase retry is refused after any attempted outcome.\n\nOffline verification explicitly consumes COMPLETE drill-copy-rescue-r1 result, not the old UNCERTAIN drill-copy. Existing exact isolated new-volume UID0/CAP_CHOWN initializer, followed by UID10001 readonly/admin/post-admin checks and retained original SHA, remains bounded networknone/readonlyroot/CPU1/128Mi with no host/nativePVC/runtimeconfig/token mounts. Only the disposable copy volume can be removed. Cutover snapshot is the distinct already-scoped new cutover.sqlite; rescue never overwrites drill.sqlite or creates another drill backup.\n\nFour committed owner render Git blobs and helper/case hashes must match exact final source HEAD. ManualApplication rejects any automated configuration including {} or source overrides. Source-pin Application.operation uses server dry-run and UID/resourceVersion/source CAS, Deployment-only/prune=false; no whole-app sync. Rollback dispatch has no failing-candidate Pod/DB dependency; separate recovery proof checks oldimage Ready1/scopedoperation/schema5 retainedlatestDB. All phases including recovery/verification must begin by2026-10-12T23:59:59Z; after expiry obtain a fresh founder decision. No expiry controller or implicit extension.\n\nImage763c/policy9d7c and known inherited fixable MEDIUM remain unchanged; owner T05 dueOct18. Ten installed checks use synthetic transport/native_provider=false and do not fulfill separate actual-provider T04 gate. Preserve original acceptance/backup/failure/history in this same trial. Twenty-six mocked/source executor regressions pass; no actual DB/admin/native command during tests/preparation.\n\nNative publication route: POST existing source /lifecycle/memos/infd-20261011-purpose-overlay-r1/revisions with expected_version1 and exact memo2/documents/summary, then publications/review-requests version2. Fresh source readback must prove currentversion1 is unbound before revision; bound/different source stops. Intake/register refuse version2 as designed and are not used. Review integration creates a NEW review-ID at its own version1; founder disposition memo_version1 belongs to that new review. Root fresh outcomes must be queried for SOURCE version2, exact newreviewID/memoSHA and confirmed nested personapproval. Receipt outcome_query pins that sourceversion2 route; it does not authenticate by itself.\n"
    },
    "actuator.py": {
      "sha256": "86b67d1abad6af2a8c49528fe125a5bab944975d3e801826c511ee88846571b2",
      "content": "\"\"\"One fixed supervised phase; never run this during source preparation.\"\"\"\nimport argparse\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport re\nimport selectors\nimport stat\nimport subprocess\nimport sys\nimport time\n\nif sys.flags.optimize:\n    raise SystemExit('optimized interpreter refused')\n\nPHASES = ('drill-copy-rescue-r1', 'offline-verify', 'cleanup-offline',\n          'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')\n\n\ndef require(value, reason):\n    if not value:\n        raise ValueError(reason)\n\n\ndef sha(path):\n    digest = hashlib.sha256()\n    with Path(path).open('rb') as stream:\n        for block in iter(lambda: stream.read(1024**2), b''):\n            digest.update(block)\n    return digest.hexdigest()\n\n\ndef private(path, directory=False):\n    info = Path(path).lstat()\n    require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))\n            and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)\n            and (directory or info.st_nlink == 1), 'private owned custody required')\n\nROOT = Path(__file__).resolve().parent\nCASE = ROOT.parent\nOWNER = Path('/home/worsch/informed-decision')\nCUSTODIAN = Path('/home/worsch/the-custodian')\nCUSTODY = CUSTODIAN / '.private-backups/20261011-infd-purpose-r1'\nSOCKET = 'unix:///var/run/docker.sock'\nIMAGE = 'forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'\nVOLUME = 'infd-purpose-r1-restore-20261011'\nMAX_BYTES = 512 * 1024**2\n\n\ndef run(argv, body=None, timeout=90):\n    return subprocess.run(argv, input=body, text=True, capture_output=True, timeout=timeout)\n\n\ndef json_result(result):\n    try:\n        value = json.loads(result.stdout)\n    except (ValueError, TypeError):\n        raise ValueError('safe phase receipt unavailable; outcome uncertain') from None\n    require(result.returncode == 0 and isinstance(value, dict) and value.get('all_checks_pass') is True,\n            'phase did not verify complete; raw output withheld; no retry')\n    permitted = {'phase', 'all_checks_pass', 'raw_output_withheld', 'native_approval_verified_by_root',\n                 'native_authenticated_grant', 'source_readonly_baseline', 'snapshot_readonly',\n                 'snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'native_parent_private',\n                 'native_uid', 'pod_name', 'pod_uid', 'live_readonly_schema_integrity_counts',\n                 'live_counts_may_include_concurrent_commits', 'operation_requested', 'source_revision',\n                 'resources', 'prune', 'rollout_verified', 'latest_live_database_retained',\n                 'client_diff_sha256', 'native_rollout_verified', 'current_schema5_database_retained',\n                 'private_copy_verified', 'installed_purpose_checks', 'policy_sha256',\n                 'policy_mode', 'policy_uid', 'health_statuses', 'native_provider_probe', 'recovery_verification'}\n    require(set(value) <= permitted, 'unexpected output fields withheld')\n    from receipt_safety import counts\n    for name in ('source_readonly_baseline', 'snapshot_readonly', 'live_readonly_schema_integrity_counts'):\n        if name in value:\n            counts(value[name])\n    for name in ('snapshot_sha256', 'client_diff_sha256'):\n        if name in value:\n            require(re.fullmatch(r'[a-f0-9]{64}', value[name]) is not None, 'invalid output digest withheld')\n    if 'snapshot_bytes' in value:\n        require(type(value['snapshot_bytes']) is int and 0 < value['snapshot_bytes'] <= MAX_BYTES,\n                'invalid output size withheld')\n    if 'snapshot_file' in value:\n        require(value['snapshot_file'] in ('drill.sqlite', 'cutover.sqlite'), 'invalid output file withheld')\n    return value\n\n\ndef docker(argv, body=None, timeout=120):\n    return run(['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET] + argv,\n               body=body, timeout=timeout)\n\n\ndef remote(phase, revision, approved, snapshot_identity=None):\n    # Fixed module imported only after main verifies every executor source hash.\n    from native_program import PROGRAM\n    payload = {'snapshot_identity': snapshot_identity, 'phase': phase, 'source_revision': revision, 'approval': approved,\n               'sealed': json.loads((CASE / 'sealed-live-deployment.json').read_text()),\n               'dependencies': json.loads((CASE / 'sealed-native-dependencies.json').read_text()),\n               'candidate': json.loads((CASE / 'candidate-deployment.json').read_text()),\n               'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),\n               'receipt_safety': (ROOT / 'receipt_safety.py').read_text(),\n               'purpose_checks': (CASE / 'check_installed.py').read_text(),\n               'readonly': (CASE / 'sqlite_readonly.py').read_text()}\n    script = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(\n        '__GUARD__', repr((CASE / 'change_guard.py').read_text()))\n    return json_result(run(['ssh', 'railiance01', 'python3 -'], script, timeout=200))\n\n\ndef copy_snapshot(phase, revision, approved, journal):\n    prior = (journal.data['identity']['recovery_anchor']['backup_result']\n             if phase == 'drill-copy-rescue-r1' else journal.data['phases']['cutover-backup']['result'])\n    metadata = remote(phase, revision, approved, snapshot_identity=prior)\n    for key in ('snapshot_sha256', 'snapshot_bytes', 'snapshot_file', 'snapshot_readonly'):\n        require(metadata[key] == prior[key], 'closed frozen snapshot changed')\n    name = metadata['snapshot_file']\n    require(name in ('drill.sqlite', 'cutover.sqlite') and 0 < metadata['snapshot_bytes'] <= MAX_BYTES,\n            'fixed bounded snapshot required')\n    pod = metadata['pod_name']\n    require(re.fullmatch(r'[a-z0-9]([-a-z0-9]*[a-z0-9])?', pod) is not None, 'fixed owner pod name required')\n    local = CUSTODY / name\n    fd = os.open(local, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)\n    # Binary snapshot stdout goes only to a private file, never tool/chat/log output.\n    # Snapshot schema/count metadata was validated before opening this destination.\n    with os.fdopen(fd, 'wb') as destination:\n        command = ('kubectl exec -n informed-decision ' + pod +\n                   ' -c informed-decision -- cat /data/private/purpose-overlay-r1/' + name)\n        transfer = subprocess.Popen(['ssh', 'railiance01', command], stdout=subprocess.PIPE,\n                                    stderr=subprocess.DEVNULL)\n        selector = selectors.DefaultSelector()\n        selector.register(transfer.stdout, selectors.EVENT_READ)\n        deadline = time.monotonic() + 150\n        received = 0\n        try:\n            while True:\n                remaining = deadline - time.monotonic()\n                require(remaining > 0 and selector.select(remaining), 'private transfer timed out')\n                block = os.read(transfer.stdout.fileno(), 1024**2)\n                if not block:\n                    break\n                received += len(block)\n                require(received <= metadata['snapshot_bytes'] and received <= MAX_BYTES,\n                        'private copy exceeds frozen snapshot size')\n                destination.write(block)\n            transfer.wait(timeout=max(1, deadline - time.monotonic()))\n        finally:\n            selector.close()\n            transfer.stdout.close()\n            if transfer.poll() is None:\n                transfer.kill()\n                transfer.wait()\n        destination.flush()\n        os.fsync(destination.fileno())\n    private(local)\n    require(transfer.returncode == 0 and local.stat().st_size == metadata['snapshot_bytes']\n            and sha(local) == metadata['snapshot_sha256'], 'private copy incomplete/uncertain; retain, no retry')\n    # Re-read identity/hash after transfer. This is verification, not a write retry.\n    after = remote(phase, revision, approved, snapshot_identity=prior)\n    require(after['pod_uid'] == metadata['pod_uid'] and after['snapshot_sha256'] == metadata['snapshot_sha256'],\n            'source identity/snapshot changed during transfer')\n    return {**metadata, 'off_cluster_private_copy_verified': True, 'snapshot_contents_output': False}\n\n\ndef offline_verify(journal):\n    from receipt_safety import counts\n    snapshot = CUSTODY / 'drill.sqlite'\n    private(snapshot)\n    previous = journal.data['phases']['drill-copy-rescue-r1']['result']\n    require(sha(snapshot) == previous['snapshot_sha256'], 'protected snapshot bytes changed')\n    identity = docker(['info', '--format', '{{json .Name}}'])\n    require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',\n            'local offline Docker engine identity changed')\n    listed = docker(['volume', 'ls', '--format', '{{.Name}}'])\n    require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),\n            'disposable volume absence not verified')\n    nonce = journal.data['phases']['offline-verify']['attempt_id']\n    labels = {'informed-decision.case': 'infd-purpose-20261011-r1',\n              'informed-decision.use': 'offline-restore-only', 'informed-decision.attempt': nonce}\n    created = docker(['volume', 'create', '--driver', 'local', '--label', 'informed-decision.case=infd-purpose-20261011-r1',\n                      '--label', 'informed-decision.attempt=' + nonce,\n                      '--label', 'informed-decision.use=offline-restore-only', VOLUME])\n    require(created.returncode == 0 and created.stdout.strip() == VOLUME, 'volume creation uncertain; no retry')\n    inspected = docker(['volume', 'inspect', VOLUME])\n    require(inspected.returncode == 0, 'new volume identity unavailable')\n    volume = json.loads(inspected.stdout)\n    require(len(volume) == 1 and volume[0]['Name'] == VOLUME and volume[0].get('Labels') == labels\n            and volume[0].get('Driver') == 'local' and not volume[0].get('Options')\n            and volume[0].get('Scope') == 'local', 'new isolated volume identity changed')\n    identity = {key: volume[0][key] for key in ('Name', 'Labels', 'Driver', 'Scope', 'CreatedAt')}\n    journal.note('offline-verify', 'created_volume_identity', identity)\n    # One-time UID0/CAP_CHOWN initialization is isolated to the NEW named volume.\n    # No host/live PVC/config/token mount exists; this detail needs packet review.\n    initializer = \"\"\"import hashlib,os,stat,sys\nif sys.flags.optimize:raise RuntimeError('optimized interpreter refused')\nfolder='/restore';expected=EXPECTED\nif os.listdir(folder):raise ValueError('new empty private volume required')\nos.chmod(folder,0o700)\nfd=os.open(folder+'/review.sqlite',os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW|os.O_WRONLY,0o600)\ndigest=hashlib.sha256();size=0\nwith os.fdopen(fd,'wb') as target:\n while True:\n  block=sys.stdin.buffer.read(1024**2)\n  if not block:break\n  size+=len(block)\n  if size>512*1024**2:raise ValueError('private restore size exceeds bound')\n  target.write(block);digest.update(block)\n target.flush();os.fsync(target.fileno())\nif digest.hexdigest()!=expected:raise ValueError('private copied snapshot differs')\nos.chown(folder+'/review.sqlite',10001,10001);os.chown(folder,10001,10001)\nprint('{\"all_checks_pass\":true,\"private_copy_verified\":true}')\n\"\"\".replace('EXPECTED', repr(previous['snapshot_sha256']))\n    with snapshot.open('rb') as source:\n        argv = ['docker', '--config', str(CUSTODY / 'empty-docker-config'), '--host', SOCKET,\n                'run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',\n                '--user', '0:0', '--cap-drop', 'ALL', '--cap-add', 'CHOWN',\n                '--security-opt', 'no-new-privileges', '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore',\n                '--entrypoint', 'python', IMAGE, '-c', initializer]\n        copied = subprocess.run(argv, stdin=source, text=True, capture_output=True, timeout=150)\n    json_result(copied)\n    options = ['run', '--rm', '-i', '--network', 'none', '--read-only', '--cpus', '1', '--memory', '128m',\n               '--user', '10001:10001', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',\n               '--mount', 'type=volume,src=' + VOLUME + ',dst=/restore']\n    readonly = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],\n                      (CASE / 'sqlite_readonly.py').read_text())\n    require(readonly.returncode == 0, 'offline pre-open schema/integrity gate refused; never open Store')\n    checked = counts(json.loads(readonly.stdout))\n    require(checked == previous['snapshot_readonly'], 'frozen snapshot/clone readonly counts differ')\n    admin = docker(options + ['--entrypoint', 'informed-decision-admin', IMAGE,\n                              'inspect', '--db', '/restore/review.sqlite'])\n    require(admin.returncode == 0, 'offline admin result uncertain')\n    admin_counts = json.loads(admin.stdout)\n    require(admin_counts == {key: checked[key] for key in ('schema_version', 'lifecycle', 'outbox', 'submissions')},\n            'offline admin changed frozen snapshot counters')\n    # Admin Store construction must not silently alter schema/integrity/counters.\n    post = docker(options + ['--entrypoint', 'python', IMAGE, '-', '--db', '/restore/review.sqlite'],\n                  (CASE / 'sqlite_readonly.py').read_text())\n    require(post.returncode == 0, 'offline post-admin readonly integrity gate refused')\n    post_checked = counts(json.loads(post.stdout))\n    require(post_checked == checked == previous['snapshot_readonly'],\n            'offline admin altered frozen snapshot proof')\n    private(snapshot)\n    require(sha(snapshot) == previous['snapshot_sha256'], 'original protected snapshot changed during drill')\n    return {'all_checks_pass': True, 'offline_volume': VOLUME, 'offline_readonly': checked,\n            'offline_post_admin_readonly': post_checked, 'original_snapshot_hash_unchanged': True,\n            'created_volume_identity': identity,\n            'admin_counts': admin_counts, 'network': 'none', 'runtime_tokens_or_config_mounted': False,\n            'service_entrypoint_started': False, 'original_snapshot_retained': True}\n\n\ndef cleanup_offline(journal):\n    inspected = docker(['volume', 'inspect', VOLUME])\n    require(inspected.returncode == 0, 'owned disposable volume identity unverified')\n    value = json.loads(inspected.stdout)\n    expected = journal.data['phases']['offline-verify']['result']['created_volume_identity']\n    require(len(value) == 1 and {key: value[0].get(key) for key in expected} == expected\n            and not value[0].get('Options'), 'volume ownership/recreation changed')\n    removed = docker(['volume', 'rm', VOLUME])\n    require(removed.returncode == 0 and removed.stdout.strip() == VOLUME\n            and docker(['volume', 'inspect', VOLUME]).returncode != 0,\n            'cleanup outcome ambiguous; do not retry')\n    return {'all_checks_pass': True, 'only_disposable_offline_volume_removed': VOLUME,\n            'native_and_offcluster_original_snapshots_retained': True}\n\n\ndef main():\n    parser = argparse.ArgumentParser(description=__doc__)\n    parser.add_argument('--phase', choices=PHASES, required=True)\n    parser.add_argument('--root-authority-receipt', type=Path, required=True)\n    parser.add_argument('--root-native-outcome', type=Path, required=True)\n    parser.add_argument('--source-revision', required=True)\n    args = parser.parse_args()\n    require(args.root_authority_receipt == Path('/tmp/security-infd-purpose-root-authority.json')\n            and args.root_native_outcome == Path('/tmp/security-infd-purpose-native-outcome-latest.json'),\n            'fixed supervised receipt paths required')\n    require(re.fullmatch(r'[0-9a-f]{40}', args.source_revision) is not None, 'exact source commit required')\n    # Verify all prepared executor/input bytes before reading authority or dispatching.\n    plan = json.loads((ROOT / 'execution-plan.json').read_text())\n    require(set(plan['executor_files']) == {'actuator.py', 'authority_journal.py', 'native_program.py', 'receipt_safety.py'},\n            'fixed executor sources required')\n    require(set(plan['owner_source_files']) == {'deploy/lifecycle/admission.candidate.json',\n                                              'deploy/lifecycle/service.candidate.json',\n                                              'deploy/lifecycle/kustomization.yaml',\n                                              'deploy/lifecycle/registries.candidate.json'},\n            'fixed owner image sources required')\n    for relative, digest in plan['executor_files'].items():\n        target = ROOT / relative\n        require(not target.is_symlink() and sha(target) == digest, 'executor source bytes changed')\n    for relative, digest in plan['case_files'].items():\n        require(not Path(relative).is_absolute() and '..' not in Path(relative).parts,\n                'case source path escaped')\n        target = CASE / relative\n        require(not target.is_symlink() and sha(target) == digest, 'case source bytes changed')\n    for relative, digest in plan['owner_source_files'].items():\n        target = OWNER / relative\n        require(not target.is_symlink() and sha(target) == digest, 'owner image-only source changed')\n        committed = subprocess.run(['git', '-C', str(OWNER), 'show', args.source_revision + ':' + relative],\n                                   capture_output=True)\n        require(committed.returncode == 0 and hashlib.sha256(committed.stdout).hexdigest() == digest,\n                'committed owner render source differs from approved inputs')\n    head = run(['git', '-C', str(OWNER), 'rev-parse', 'HEAD'])\n    require(head.returncode == 0 and head.stdout.strip() == args.source_revision, 'owner source HEAD differs')\n    from authority_journal import Journal, authority, original_anchor\n    private(args.root_authority_receipt)\n    private(args.root_native_outcome)\n    receipt = json.loads(args.root_authority_receipt.read_text())\n    require(receipt.get('native_outcome_sha256') == sha(args.root_native_outcome), 'native outcome bytes changed')\n    require(receipt.get('executor_plan_sha256') == sha(ROOT / 'execution-plan.json'),\n            'root verified executor plan differs')\n    approved = authority(receipt, json.loads(args.root_native_outcome.read_text()), sha(CASE / 'memo.json'),\n                         args.source_revision, args.phase)\n    parent = CUSTODY.parent\n    private(parent, directory=True)\n    ignored = run(['git', '-C', str(CUSTODIAN), 'check-ignore', '--no-index', str(CUSTODY / 'drill.sqlite')])\n    require(ignored.returncode == 0, 'offcluster custody is not ignored')\n    require(CUSTODY.exists(), 'original protected custody must already exist')\n    private(CUSTODY, directory=True)\n    capacity = os.statvfs(CUSTODY)\n    require(capacity.f_bavail * capacity.f_frsize >= 2 * MAX_BYTES + 16 * 1024**2,\n            'independent protected custody headroom insufficient')\n    os.makedirs(CUSTODY / 'empty-docker-config', mode=0o700, exist_ok=True)\n    private(CUSTODY / 'empty-docker-config', directory=True)\n    require(not list((CUSTODY / 'empty-docker-config').iterdir()), 'public Docker read config must stay empty')\n    anchor = original_anchor(CUSTODY, plan['recovery']['original_anchor'],\n                             json.loads((CASE / 'original-approved-drill-backup.json').read_text()),\n                             plan['recovery']['original_identity'])\n    if args.phase == 'drill-copy-rescue-r1':\n        require(not os.path.lexists(CUSTODY / 'drill.sqlite')\n                and not os.path.lexists(CUSTODY / 'cutover.sqlite'), 'rescue destination must be absent')\n        identity = docker(['info', '--format', '{{json .Name}}'])\n        require(identity.returncode == 0 and json.loads(identity.stdout) == 'bnt-lap001',\n                'local engine identity changed')\n        listed = docker(['volume', 'ls', '--format', '{{.Name}}'])\n        require(listed.returncode == 0 and VOLUME not in listed.stdout.splitlines(),\n                'existing restore volume forbids rescue')\n    journal = Journal(CUSTODY, {'proposal': plan['proposal_id'], 'source_revision': args.source_revision,\n                               'memo_sha256': sha(CASE / 'memo.json'), 'plan_sha256': sha(ROOT / 'execution-plan.json'),\n                               'recovery_anchor': anchor})\n    try:\n        journal.start(args.phase, approved) # fsynced RUNNING before any phase effect.\n        if args.phase in ('drill-copy-rescue-r1', 'cutover-copy'):\n            result = copy_snapshot(args.phase, args.source_revision, approved, journal)\n        elif args.phase == 'offline-verify':\n            result = offline_verify(journal)\n        elif args.phase == 'cleanup-offline':\n            result = cleanup_offline(journal)\n        else:\n            result = remote(args.phase, args.source_revision, approved)\n        require(original_anchor(CUSTODY, plan['recovery']['original_anchor'],\n                                json.loads((CASE / 'original-approved-drill-backup.json').read_text()),\n                                plan['recovery']['original_identity']) == anchor,\n                'original failed journal changed during new phase')\n        journal.finish(args.phase, result)\n        print(json.dumps(result)) # Only count/hash/identity receipts, never snapshot bytes.\n    except BaseException as error:\n        safe = {'all_checks_pass': False, 'phase': args.phase, 'failure_class': type(error).__name__,\n                'failure': 'fixed phase outcome uncertain; original evidence retained; no retry',\n                'raw_output_withheld': True}\n        if journal.data['phases'].get(args.phase, {}).get('state') == 'RUNNING':\n            journal.finish(args.phase, safe)\n        print(json.dumps(safe))\n        raise SystemExit(1) from None\n    finally:\n        journal.close()\n\n\nif __name__ == '__main__':\n    try:\n        main()\n    except Exception:\n        raise SystemExit('supervised execution refused before phase; raw output withheld') from None\n"
    },
    "authority_journal.py": {
      "sha256": "0535975ae631219f90fce7e52f8b54e61e8afd4ef68bb7473863478f0f519f68",
      "content": "\"\"\"Supervised receipt bookkeeping, not an authenticated approval provider.\"\"\"\nimport datetime\nimport fcntl\nimport hashlib\nimport json\nimport os\nimport re\nfrom pathlib import Path\nimport stat\nimport uuid\n\nFOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}\nMEMO_ID = 'infd-20261011-purpose-overlay-r1'\nPROPOSAL = 'INFD-WP-0009-T04/purpose-overlay-v1'\nPHASES = ('drill-copy-rescue-r1', 'offline-verify', 'cleanup-offline',\n          'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')\n\n\ndef require(value, reason):\n    if not value:\n        raise ValueError(reason)\n\n\ndef sha(path):\n    digest = hashlib.sha256()\n    with Path(path).open('rb') as stream:\n        for block in iter(lambda: stream.read(1024**2), b''):\n            digest.update(block)\n    return digest.hexdigest()\n\n\ndef private(path, directory=False):\n    info = Path(path).lstat()\n    require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))\n            and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)\n            and (directory or info.st_nlink == 1), 'private owned custody required')\n\n\ndef authority(receipt, outcome, memo_sha, source_revision, phase, now=None):\n    \"\"\"Root must freshly verify native outcome at fixed ORIGIN outside this helper.\n\n    Receipt files/flags are not signed grants. This function checks the exact\n    supervised receipt relation; existing harness/founder authority remains the\n    actual permission boundary. It never authenticates a caller as human.\n    \"\"\"\n    now = now or datetime.datetime.now(datetime.timezone.utc)\n    require(phase in PHASES, 'fixed phase required')\n    require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID\n            and receipt.get('memo_version') == 2 and receipt.get('memo_sha256') == memo_sha\n            and receipt.get('source_revision') == source_revision\n            and receipt.get('activation') == 'APPROVED'\n            and receipt.get('authority_mode') == 'ADMINISTER'\n            and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'\n            and receipt.get('verification_method') == 'root-fixed-origin-native-readback'\n            and receipt.get('runtime_authenticated_grant') is False\n            and receipt.get('outcome_query') == '/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=2',\n            'exact externally verified supervised receipt required')\n    verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))\n    require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,\n            'fresh root native readback required before every phase')\n    deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')\n    require(now < deadline, 'approved execution window expired')\n    require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False\n            and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')\n    review_id = outcome['review']['memo_id']\n    require(review_id == receipt.get('review_memo_id'), 'native review identity changed')\n    accepted = [x for x in outcome.get('dispositions', [])\n                if x.get('submission_state') == 'confirmed'\n                and x.get('disposition', {}).get('verb') == 'accept'\n                and x['disposition'].get('memo_version') == 1]\n    require(len(accepted) == 1, 'one confirmed founder acceptance required')\n    accepted = accepted[0]['disposition']\n    require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id\n            and accepted.get('approval_id') == receipt.get('approval_id')\n            and accepted.get('id') == receipt.get('disposition_id')\n            and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')\n    require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None\n            and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None\n            and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,\n            'native disposition identifiers are malformed')\n    accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))\n    require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')\n    return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}\n\n\ndef original_anchor(parent, expected, backup_result, original_identity):\n    \"\"\"Read only sanitized original journal; never rewrite/synthesize its phases.\"\"\"\n    path = Path(parent) / 'execution-journal.json'\n    private(path)\n    require(sha(path) == expected['original_journal_sha256'], 'original journal bytes changed')\n    original = json.loads(path.read_text())\n    require(original.get('identity') == original_identity, 'original approved identity changed')\n    phases = original.get('phases', {})\n    require(set(phases) == {'drill-backup', 'drill-copy'}, 'unexpected original action or rollout')\n    for name, fields in expected['phase_metadata'].items():\n        require(all(phases[name].get(key) == value for key,value in fields.items()),\n                'original failed/completed attempt identity changed')\n    require(phases['drill-backup'].get('result') == backup_result\n            and backup_result.get('all_checks_pass') is True\n            and phases['drill-copy'].get('result', {}).get('all_checks_pass') is False,\n            'original backup/copy outcome changed')\n    require(backup_result.get('snapshot_sha256') == expected['snapshot_sha256']\n            and backup_result.get('snapshot_bytes') == expected['snapshot_bytes']\n            and backup_result.get('pod_uid') == 'e8561ae0-4b09-4455-924d-64c27b625fc7',\n            'original frozen snapshot identity changed')\n    require(sha(path) == expected['original_journal_sha256'], 'original journal changed during read')\n    return {'original_journal_sha256': expected['original_journal_sha256'],\n            'original_copy_attempt_id': phases['drill-copy']['attempt_id'],\n            'original_backup_attempt_id': phases['drill-backup']['attempt_id'],\n            'backup_result': backup_result, 'old_uncertain_phase_retained': True}\n\n\nclass Journal:\n    def __init__(self, parent, identity):\n        self.parent = Path(parent)\n        private(self.parent, directory=True)\n        self.path = self.parent / 'rescue-execution-journal-r1.json'\n        self.lock = os.open(self.parent / 'rescue-execution-r1.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)\n        fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)\n        private(self.parent / 'rescue-execution-r1.lock')\n        if self.path.exists():\n            private(self.path)\n            self.data = json.loads(self.path.read_text())\n            require(self.data['identity'] == identity, 'journal case/source identity changed')\n        else:\n            self.data = {'identity': identity, 'phases': {}}\n            self.save()\n\n    def save(self):\n        temporary = self.parent / 'execution-journal.new'\n        fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)\n        try:\n            with os.fdopen(fd, 'w') as stream:\n                json.dump(self.data, stream, indent=2)\n                stream.write('\\n')\n                stream.flush()\n                os.fsync(stream.fileno())\n            os.replace(temporary, self.path)\n            directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)\n            try:\n                os.fsync(directory)\n            finally:\n                os.close(directory)\n        except BaseException:\n            # Retain evidence rather than overwriting an uncertain durable intent.\n            raise\n\n    def start(self, phase, approval):\n        require(phase not in self.data['phases'], 'already attempted phase; no retry')\n        require(phase in PHASES, 'fixed rescue or remaining phase required')\n        predecessors = dict(zip(PHASES[1:7], PHASES[:6]))\n        predecessors['rollback-verify'] = 'rollback'\n        if phase in predecessors:\n            require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',\n                    'preceding phase is not verified complete')\n        if phase == 'rollback':\n            require('release' in self.data['phases'], 'rollback requires a recorded release attempt')\n        self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,\n                                      'attempt_id': str(uuid.uuid4()),\n                                      'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}\n        self.save()\n\n    def note(self, phase, key, value):\n        require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')\n        self.data['phases'][phase][key] = value\n        self.save()\n\n    def finish(self, phase, result):\n        entry = self.data['phases'][phase]\n        require(entry['state'] == 'RUNNING', 'phase intent missing')\n        entry['result'] = result\n        entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'\n        self.save()\n\n    def close(self):\n        os.close(self.lock)\n"
    },
    "execution-plan.json": {
      "sha256": "9ce5728a561e6d38f8497201baa2b840d11444a0af8ad6234dfc37428113f258",
      "content": "{\n  \"kind\": \"informed-decision.supervised-mechanical-release-plan\",\n  \"version\": 2,\n  \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n  \"trial_id\": \"infd-purpose-20261011-r1\",\n  \"state\": \"prepared-unapproved\",\n  \"executor_files\": {\n    \"actuator.py\": \"86b67d1abad6af2a8c49528fe125a5bab944975d3e801826c511ee88846571b2\",\n    \"authority_journal.py\": \"0535975ae631219f90fce7e52f8b54e61e8afd4ef68bb7473863478f0f519f68\",\n    \"native_program.py\": \"788dc99f7edfbfd542a3bb08fc31f60caf4f8fd5d654a6a91b45e197ecff9f91\",\n    \"receipt_safety.py\": \"5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b\"\n  },\n  \"case_files\": {\n    \"change_guard.py\": \"f348e449c49f4d9e49af9e82e01764e7197837fd3df9d756f5891d9b8d9b38be\",\n    \"sqlite_readonly.py\": \"9093c64f7f0e39b249da9fefdf5aaf4e4258bc31e7a27fd888479ce329a20509\",\n    \"preflight-inputs.json\": \"03bb4b42fe1aa51b846e957a9e23926fae72f02a2cb5e297368047fb25c17e9b\",\n    \"sealed-live-deployment.json\": \"d18d27063d06f535ae884ea01f96747fe301685518ab94b1cba072a1e1519362\",\n    \"sealed-native-dependencies.json\": \"042327a036ed254cf95dbeb0c056ac25b03a6a844b95a332c992df2943691369\",\n    \"candidate-deployment.json\": \"722a8e2dc52bec217bf960e23b2fddfc7ac27d343ac8743790e3183db81a6a0e\",\n    \"rollback-deployment.json\": \"39b3f43bb84ef4921cc3a1fbcdc444610741ed8809149d8f8f17ed805f262121\",\n    \"check_installed.py\": \"a34a51be9c9f2b16a06a88173b5c6c492c9957fe021cf412a86a1737730640ad\",\n    \"published-verification.json\": \"e59ab44b1aaf28140509593aae4ab9b97ab62cc8b589e3f1552bac78618896dd\",\n    \"security-summary.json\": \"0ee56400dc703f7c9968c2a0a3ea0390d8362f8d0bbf8002a2bd7fa58f19cb44\",\n    \"original-approved-drill-backup.json\": \"025dddf1e93936f31e98b9fbfa84aa2bdaaa33573f9d3b0e32d947fd286b170e\",\n    \"original-approved-drill-copy-failure.json\": \"fb78fb2e8c3d416490cf0f559b2f5bd019406a490f8f5fa6f5932421f0b1ac56\",\n    \"original-journal-sanitized-anchor.json\": \"988fca61ad8eb9d43d93390a835323f952196bbce8cc0bde51c42a17d411f454\"\n  },\n  \"owner_source_files\": {\n    \"deploy/lifecycle/admission.candidate.json\": \"92382a56b349c3b895e5806e975082527bb99d1a001140e69d857e5b0391fa55\",\n    \"deploy/lifecycle/service.candidate.json\": \"38b78b9cbee5ade7750a58d5156ca4c5773352e947acb304ee714b59e749ceb4\",\n    \"deploy/lifecycle/kustomization.yaml\": \"1bbce81bc6758434354157f8601534320c5d0290587908fd15a6d25e3fa57f47\",\n    \"deploy/lifecycle/registries.candidate.json\": \"9bad6db5fbc2178d31b04120016a41830c3552fbb9e2517b718f9bbe87cf649e\"\n  },\n  \"candidate_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a\",\n  \"prior_image\": \"forgejo.coulomb.social/coulomb/informed-decision@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173\",\n  \"source_revision\": \"must-be-exact-final-owner-HEAD-with-approved-four-Git-blobs\",\n  \"phases\": [\n    \"drill-copy-rescue-r1\",\n    \"offline-verify\",\n    \"cleanup-offline\",\n    \"cutover-backup\",\n    \"cutover-copy\",\n    \"release\",\n    \"verify\",\n    \"rollback\",\n    \"rollback-verify\"\n  ],\n  \"authorization\": \"fresh externally authenticated root fixed-origin native readback before each phase; exact confirmed platform-root disposition and current packet SHA/source commit; receipt bookkeeping is not an autonomous signed grant\",\n  \"execute_by\": \"2026-10-12T23:59:59Z\",\n  \"raw_output_withheld\": true,\n  \"native_data_or_workload_action_executed\": false,\n  \"deadline_semantics\": \"All phases including verification/recovery must begin before execute_by. No extension or automatic emergency grant; beyond deadline stop and obtain a fresh founder decision. Complete the bounded drill and rollout early enough to allow recovery within the window.\",\n  \"recovery\": {\n    \"original_anchor\": {\n      \"original_journal_sha256\": \"d187b02d98d6e97429fe20b4fbe1d309a6c6c4b55232b4ae13ac39873039f1c1\",\n      \"phase_metadata\": {\n        \"drill-backup\": {\n          \"state\": \"COMPLETE\",\n          \"attempt_id\": \"d63182a7-e1a5-4e8e-a5f1-2bf3333cf153\",\n          \"started_at\": \"2026-10-11T02:38:45.310653+00:00\"\n        },\n        \"drill-copy\": {\n          \"state\": \"UNCERTAIN\",\n          \"attempt_id\": \"329ef190-1692-4246-b953-e6a59664abcc\",\n          \"started_at\": \"2026-10-11T02:39:50.198740+00:00\"\n        }\n      },\n      \"frozen_backup_receipt_sha256\": \"025dddf1e93936f31e98b9fbfa84aa2bdaaa33573f9d3b0e32d947fd286b170e\",\n      \"snapshot_sha256\": \"8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3\",\n      \"snapshot_bytes\": 19537920,\n      \"off_cluster_file_exists\": false,\n      \"old_uncertain_retry_authorized\": false\n    },\n    \"original_identity\": {\n      \"proposal\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n      \"source_revision\": \"bc6494cd1b290783ef3aef0763bf28d1deabf4b0\",\n      \"memo_sha256\": \"506d3956beb7c62ab2bbdfda783c05905d183452a1f67a1817f3fb8c2e522937\",\n      \"plan_sha256\": \"f5e5fa906ff19d3a45d10dcdb2810373ae21f9cf44c0472ff2bd47d3bc3328d6\"\n    },\n    \"new_journal\": \"rescue-execution-journal-r1.json\",\n    \"new_phase\": \"drill-copy-rescue-r1\",\n    \"old_uncertain_phase_overwrite_or_retry\": false,\n    \"new_snapshot_backup\": false,\n    \"snapshot_or_sidecar_mutation\": false,\n    \"mapping\": \"offline-verify consumes COMPLETE drill-copy-rescue-r1 result; all later phases ordered only in new hash-linked recovery journal\"\n  },\n  \"source_memo_version\": 2,\n  \"native_review_memo_version\": 1\n}\n"
    },
    "native_program.py": {
      "sha256": "788dc99f7edfbfd542a3bb08fc31f60caf4f8fd5d654a6a91b45e197ecff9f91",
      "content": "\"\"\"Fixed version2 recovery remote source; requires fresh exact acceptance.\"\"\"\nPROGRAM = '\\nimport copy,datetime,hashlib,json,os,re,subprocess,sys\\nif sys.flags.optimize:raise RuntimeError(\\'optimized interpreter refused\\')\\npayload=json.loads(__PAYLOAD__)\\nexec(__GUARD__)\\nphase=payload[\\'phase\\']\\nif phase not in (\\'cutover-backup\\',\\'drill-copy-rescue-r1\\',\\'cutover-copy\\',\\'release\\',\\'verify\\',\\'rollback\\',\\'rollback-verify\\'):raise ValueError(\\'fixed native phase required\\')\\ndeadline=datetime.datetime.fromisoformat(\\'2026-10-12T23:59:59+00:00\\')\\ndef require(value,reason):\\n if not value:raise ValueError(reason)\\nrequire(datetime.datetime.now(datetime.timezone.utc)<deadline,\\'execution window expired\\')\\nenv={**os.environ,\\'KUBECONFIG\\':\\'/etc/rancher/k3s/k3s.yaml\\'}\\ndef run(argv,body=None,timeout=90):\\n return subprocess.run(argv,input=body,text=True,capture_output=True,timeout=timeout,env=env)\\ndef read(kind,name,namespace):\\n result=run([\\'kubectl\\',\\'get\\',kind,name,\\'-n\\',namespace,\\'-o\\',\\'json\\'])\\n require(result.returncode==0,\\'fixed metadata read refused\\')\\n return json.loads(result.stdout)\\nsealed=payload[\\'sealed\\']; dependencies=payload[\\'dependencies\\']\\nlive=read(\\'deployment\\',\\'informed-decision\\',\\'informed-decision\\')\\ncm=read(\\'configmap\\',\\'informed-decision-runtime-6c221878d051\\',\\'informed-decision\\')\\npvc=read(\\'pvc\\',\\'informed-decision-data\\',\\'informed-decision\\')\\ncheck_dependencies(cm,pvc,dependencies)\\napp=read(\\'application\\',\\'informed-decision\\',\\'argocd\\')\\nrequire(app[\\'metadata\\'][\\'uid\\']==\\'499868f2-eabc-4df4-ae31-b89ce58d750d\\',\\'Application UID changed\\')\\nrequire(app[\\'spec\\'][\\'source\\'][\\'repoURL\\']==\\'https://forgejo.coulomb.social/coulomb/informed-decision.git\\'\\n and app[\\'spec\\'][\\'source\\'][\\'path\\']==\\'deploy/lifecycle\\'\\n and app[\\'spec\\'][\\'destination\\']=={\\'namespace\\':\\'informed-decision\\',\\'server\\':\\'https://kubernetes.default.svc\\'}\\n and app[\\'spec\\'].get(\\'syncPolicy\\',{}).get(\\'automated\\') is None\\n and set(app[\\'spec\\'][\\'source\\'])=={\\'repoURL\\',\\'path\\',\\'targetRevision\\'} and not app[\\'spec\\'].get(\\'sources\\'),\\'Application owner/scope changed\\')\\nexpected=copy.deepcopy(sealed)\\nif phase==\\'verify\\':expected[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']=CANDIDATE\\nif phase==\\'rollback\\':\\n image=live[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']\\n require(image in (BASE,CANDIDATE),\\'rollback image is outside same-schema pair\\')\\n expected[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']=image\\ncheck_current(live,expected)\\nif phase!=\\'rollback\\':\\n require(live.get(\\'status\\',{}).get(\\'readyReplicas\\')==1\\n  and live[\\'status\\'].get(\\'updatedReplicas\\')==1\\n  and live[\\'status\\'].get(\\'observedGeneration\\')==live[\\'metadata\\'][\\'generation\\'],\\'service not Ready1\\')\\ntarget=payload[\\'source_revision\\'] if phase==\\'verify\\' else \\'7db8485ffecdebfabd77a9daec085553c74bf0bf\\'\\nif phase==\\'rollback\\':require(app[\\'spec\\'][\\'source\\'][\\'targetRevision\\'] in (target,payload[\\'source_revision\\']),\\'rollback source is outside pair\\')\\nelse:require(app[\\'spec\\'][\\'source\\'][\\'targetRevision\\']==target,\\'unexpected source pin\\')\\nresult={\\'phase\\':phase,\\'all_checks_pass\\':False,\\'raw_output_withheld\\':True,\\n \\'native_approval_verified_by_root\\':payload[\\'approval\\'],\\'native_authenticated_grant\\':False}\\ntry:\\n if phase in (\\'cutover-backup\\',\\'drill-copy-rescue-r1\\',\\'cutover-copy\\',\\'release\\',\\'verify\\',\\'rollback-verify\\'):\\n  podlist=run([\\'kubectl\\',\\'get\\',\\'pods\\',\\'-n\\',\\'informed-decision\\',\\'-l\\',\\'app.kubernetes.io/name=informed-decision\\',\\'-o\\',\\'json\\'])\\n  require(podlist.returncode==0,\\'pod metadata query refused\\')\\n  pods=[p for p in json.loads(podlist.stdout)[\\'items\\'] if not p[\\'metadata\\'].get(\\'deletionTimestamp\\')]\\n  require(len(pods)==1,\\'exact single live owner pod required\\');pod=pods[0]\\n  require(pod[\\'status\\'].get(\\'phase\\')==\\'Running\\' and len(pod[\\'spec\\'][\\'containers\\'])==1\\n   and pod[\\'spec\\'][\\'containers\\'][0][\\'image\\']==expected[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']\\n   and len(pod[\\'status\\'].get(\\'containerStatuses\\',[]))==1\\n   and pod[\\'status\\'][\\'containerStatuses\\'][0].get(\\'name\\')==\\'informed-decision\\'\\n   and pod[\\'status\\'][\\'containerStatuses\\'][0].get(\\'ready\\') is True,\\'owner pod readiness/image changed\\')\\n  if phase==\\'drill-copy-rescue-r1\\':require(pod[\\'metadata\\'][\\'uid\\']==\\'e8561ae0-4b09-4455-924d-64c27b625fc7\\',\\'original backup Pod identity changed\\')\\n  template=expected[\\'spec\\'][\\'template\\'][\\'spec\\']\\n  controlled=set(template)|{\\'initContainers\\',\\'hostNetwork\\',\\'hostPID\\',\\'hostIPC\\',\\'runtimeClassName\\',\\'shareProcessNamespace\\'}\\n  require(all(pod[\\'spec\\'].get(key)==template.get(key) for key in controlled),\\'actual owner Pod configuration drifted\\')\\n  owners=pod[\\'metadata\\'].get(\\'ownerReferences\\',[]);require(len(owners)==1 and owners[0][\\'kind\\']==\\'ReplicaSet\\',\\'pod owner chain changed\\')\\n  rs=read(\\'replicaset\\',owners[0][\\'name\\'],\\'informed-decision\\')\\n  require(rs[\\'metadata\\'][\\'uid\\']==owners[0][\\'uid\\'] and any(o.get(\\'uid\\')==sealed[\\'metadata\\'][\\'uid\\']\\n   and o.get(\\'kind\\')==\\'Deployment\\' for o in rs[\\'metadata\\'].get(\\'ownerReferences\\',[])),\\'ReplicaSet ownership changed\\')\\n  inner=r\"\"\"\\nimport hashlib,json,os,stat,subprocess,sys\\nif sys.flags.optimize:raise RuntimeError(\\'optimized interpreter refused\\')\\nexec(__READONLY__)\\nexec(__SAFETY__)\\naction=__ACTION__;db=\\'/data/private/review.sqlite\\';folder=\\'/data/private/purpose-overlay-r1\\'\\ndef require(v,r):\\n if not v:raise ValueError(r)\\nrequire(os.getuid()==10001 and os.getgid()==10001,\\'native owner UID/GID required\\')\\ndef private(p,directory=False):\\n s=os.lstat(p);require((stat.S_ISDIR(s.st_mode) if directory else stat.S_ISREG(s.st_mode))\\n  and s.st_uid==10001 and stat.S_IMODE(s.st_mode)==(0o700 if directory else 0o600)\\n  and (directory or s.st_nlink==1),\\'private native custody required\\')\\nprivate(\\'/data/private\\',True);private(db)\\nbaseline=counts(inspect_readonly(db)) # MUST precede any Store/admin open.\\nif action in (\\'cutover-backup\\'):\\n size=os.stat(db).st_size\\n if os.path.exists(db+\\'-wal\\'):size+=os.stat(db+\\'-wal\\').st_size\\n v=os.statvfs(\\'/data/private\\');free=v.f_bavail*v.f_frsize\\n require(size>0 and size<=512*1024**2 and free>=size*(2 if action==\\'drill-backup\\' else 1)+16*1024**2,\\'bounded native snapshot capacity required\\')\\n if action==\\'drill-backup\\':\\n  require(not os.path.lexists(folder),\\'native case directory must be unique\\')\\n  os.mkdir(folder,0o700);os.chmod(folder,0o700)\\n private(folder,True)\\n filename=\\'drill.sqlite\\' if action==\\'drill-backup\\' else \\'cutover.sqlite\\';output=folder+\\'/\\'+filename\\n require(not os.path.lexists(output),\\'snapshot output must be unique\\')\\n admin=subprocess.run([\\'informed-decision-admin\\',\\'backup\\',\\'--db\\',db,\\'--output\\',output],capture_output=True,text=True,timeout=120)\\n require(admin.returncode==0 and json.loads(admin.stdout)=={\\'status\\':\\'backed_up\\',\\'consistent_snapshot\\':True},\\'backup completion not verified; do not retry\\')\\n private(output)\\n for suffix in (\\'-wal\\',):\\n  require(not os.path.exists(output+suffix) or os.stat(output+suffix).st_size==0,\\'snapshot has WAL frames; immutable read refused\\')\\n digest=hashlib.sha256()\\n with open(output,\\'rb\\') as stream:\\n  for block in iter(lambda:stream.read(1024**2),b\\'\\'):digest.update(block)\\n frozen_digest=digest.hexdigest()\\n snapshot=counts(inspect_closed_snapshot(output,frozen_digest))\\n size=os.stat(output).st_size;require(0<size<=512*1024**2,\\'snapshot outside bounded copy size\\')\\n digest=hashlib.sha256()\\n with open(output,\\'rb\\') as stream:\\n  for block in iter(lambda:stream.read(1024**2),b\\'\\'):digest.update(block)\\n print(json.dumps({\\'all_checks_pass\\':True,\\'source_readonly_baseline\\':baseline,\\'snapshot_readonly\\':snapshot,\\'snapshot_sha256\\':digest.hexdigest(),\\'snapshot_bytes\\':size,\\'snapshot_file\\':filename,\\'native_parent_private\\':True,\\'native_uid\\':os.getuid()}))\\nelif action in (\\'verify\\',\\'release\\',\\'rollback-verify\\'):\\n proof={\\'all_checks_pass\\':True,\\'live_readonly_schema_integrity_counts\\':baseline,\\'live_counts_may_include_concurrent_commits\\':True}\\n if action==\\'verify\\':\\n  import urllib.request\\n  module=\\'/opt/venv/lib/python3.12/site-packages/informed_decision/policy.py\\';info=os.lstat(module)\\n  require(stat.S_ISREG(info.st_mode) and info.st_uid==0 and stat.S_IMODE(info.st_mode)==0o644,\\'installed policy metadata differs\\')\\n  with open(module,\\'rb\\') as source:module_digest=hashlib.sha256(source.read()).hexdigest()\\n  require(module_digest==\\'9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62\\',\\'installed source module differs\\')\\n  purpose=subprocess.run([sys.executable,\\'-\\'],input=__PURPOSE__,text=True,capture_output=True,timeout=30)\\n  require(purpose.returncode==0,\\'installed native-placement purpose checks failed\\')\\n  tested=json.loads(purpose.stdout)\\n  require(tested=={\\'installed_image_purpose_variants\\':10,\\'binding_forms_allowed\\':2,\\'advisory_or_malformed_refused\\':8,\\'synthetic_only\\':True,\\'native_provider\\':False},\\'purpose result differs\\')\\n  class NoRedirect(urllib.request.HTTPRedirectHandler):\\n   def redirect_request(self,*args,**kwargs):raise ValueError(\\'health redirect refused\\')\\n  opener=urllib.request.build_opener(NoRedirect());statuses={}\\n  for route in (\\'/healthz\\',\\'/readyz\\'):\\n   with opener.open(\\'http://127.0.0.1:8080\\'+route,timeout=10) as response:\\n    require(response.status==200 and len(response.read(8193))<=8192,\\'bounded health check refused\\');statuses[route]=200\\n  proof.update(installed_purpose_checks=tested,policy_sha256=module_digest,policy_mode=\\'0644\\',policy_uid=0,health_statuses=statuses,native_provider_probe=False)\\n print(json.dumps(proof))\\nelif action in (\\'drill-copy\\',\\'cutover-copy\\'):\\n private(folder,True);filename=\\'drill.sqlite\\' if action==\\'drill-copy\\' else \\'cutover.sqlite\\';output=folder+\\'/\\'+filename;private(output)\\n identity=__SNAPSHOT__;require(isinstance(identity,dict) and identity.get(\\'snapshot_file\\')==filename,\\'recorded original frozen snapshot identity required\\')\\n snapshot=counts(inspect_closed_snapshot(output,identity[\\'snapshot_sha256\\']));size=os.stat(output).st_size;require(size==identity[\\'snapshot_bytes\\'] and 0<size<=512*1024**2,\\'snapshot size outside frozen bound\\')\\n require(snapshot==identity[\\'snapshot_readonly\\'],\\'frozen snapshot proof differs\\')\\n digest=hashlib.sha256()\\n with open(output,\\'rb\\') as stream:\\n  for block in iter(lambda:stream.read(1024**2),b\\'\\'):digest.update(block)\\n print(json.dumps({\\'all_checks_pass\\':True,\\'snapshot_file\\':filename,\\'snapshot_bytes\\':size,\\'snapshot_sha256\\':digest.hexdigest(),\\'snapshot_readonly\\':snapshot}))\\nelse:raise ValueError(\\'fixed native backup/verify phase required\\')\\n\"\"\"\\n  # Strip the CLI branch: exec only the verified stdlib function, never Store.\\n  readonly=payload[\\'readonly\\'].split(\"if __name__ == \\'__main__\\':\",1)[0]\\n  inner=inner.replace(\\'__READONLY__\\',repr(readonly)).replace(\\'__SAFETY__\\',repr(payload[\\'receipt_safety\\'])).replace(\\'__ACTION__\\',repr(\\'drill-copy\\' if phase==\\'drill-copy-rescue-r1\\' else phase)).replace(\\'__PURPOSE__\\',repr(payload[\\'purpose_checks\\'])).replace(\\'__SNAPSHOT__\\',repr(payload.get(\\'snapshot_identity\\')))\\n  p=run([\\'kubectl\\',\\'exec\\',\\'-i\\',\\'-n\\',\\'informed-decision\\',pod[\\'metadata\\'][\\'name\\'],\\'-c\\',\\'informed-decision\\',\\'--\\',\\'python\\',\\'-\\'],inner,150)\\n  require(p.returncode==0,\\'native phase outcome unverified; raw output withheld, do not retry\\')\\n  outcome=json.loads(p.stdout);require(outcome.get(\\'all_checks_pass\\') is True,\\'native phase gate refused\\')\\n  result.update(outcome,pod_name=pod[\\'metadata\\'][\\'name\\'],pod_uid=pod[\\'metadata\\'][\\'uid\\'])\\n if phase in (\\'release\\',\\'rollback\\'):\\n  node_read=run([\\'kubectl\\',\\'get\\',\\'nodes\\',\\'-o\\',\\'json\\']);require(node_read.returncode==0,\\'node metadata unavailable\\')\\n  nodes=json.loads(node_read.stdout)[\\'items\\'];require(len(nodes)==1,\\'one target node required\\');node=nodes[0]\\n  require(any(a.get(\\'address\\')==\\'92.205.62.239\\' for a in node[\\'status\\'][\\'addresses\\']),\\'target node address changed\\')\\n  conditions={c[\\'type\\']:c[\\'status\\'] for c in node[\\'status\\'][\\'conditions\\']}\\n  require(conditions.get(\\'Ready\\')==\\'True\\' and all(conditions.get(k)==\\'False\\' for k in (\\'MemoryPressure\\',\\'DiskPressure\\',\\'PIDPressure\\')),\\'node unhealthy or pressured\\')\\n  description=run([\\'kubectl\\',\\'describe\\',\\'node\\',node[\\'metadata\\'][\\'name\\']]);require(description.returncode==0,\\'headroom capture unavailable\\')\\n  table=description.stdout.split(\\'Allocated resources:\\',1)[1];requested=int(re.search(r\\'cpu\\\\s+(\\\\d+)m\\',table).group(1));alloc=node[\\'status\\'][\\'allocatable\\'][\\'cpu\\'];capacity=int(alloc[:-1]) if alloc.endswith(\\'m\\') else int(alloc)*1000\\n  require(requested<=capacity,\\'Recreate requested CPU exceeds capacity\\')\\n  require(not app.get(\\'operation\\') and app.get(\\'status\\',{}).get(\\'operationState\\',{}).get(\\'phase\\') not in (\\'Running\\',\\'Terminating\\'),\\'existing Argo operation must be settled\\')\\n  destination=payload[\\'source_revision\\'] if phase==\\'release\\' else \\'7db8485ffecdebfabd77a9daec085553c74bf0bf\\'\\n  body=copy.deepcopy(payload[\\'candidate\\'] if phase==\\'release\\' else payload[\\'rollback\\'])\\n  dry=run([\\'kubectl\\',\\'apply\\',\\'--dry-run=server\\',\\'-f\\',\\'-\\',\\'-o\\',\\'json\\'],json.dumps(body))\\n  require(dry.returncode==0,\\'fresh owner server admission refused\\')\\n  admitted=json.loads(dry.stdout);wanted=copy.deepcopy(sealed)\\n  wanted[\\'spec\\'][\\'template\\'][\\'spec\\'][\\'containers\\'][0][\\'image\\']=CANDIDATE if phase==\\'release\\' else BASE\\n  require(projection(admitted)==wanted,\\'dry-run changed anything beyond exact image\\')\\n  diff=run([\\'kubectl\\',\\'diff\\',\\'-f\\',\\'-\\'],json.dumps(body));require(diff.returncode in (0,1),\\'client diff unavailable\\')\\n  operation={\\'initiatedBy\\':{\\'username\\':\\'custodian-codex\\'},\\'sync\\':{\\'revision\\':destination,\\'prune\\':False,\\n   \\'resources\\':[{\\'group\\':\\'apps\\',\\'kind\\':\\'Deployment\\',\\'name\\':\\'informed-decision\\',\\'namespace\\':\\'informed-decision\\'}]}}\\n  patch=[{\\'op\\':\\'test\\',\\'path\\':\\'/metadata/uid\\',\\'value\\':app[\\'metadata\\'][\\'uid\\']},\\n   {\\'op\\':\\'test\\',\\'path\\':\\'/metadata/resourceVersion\\',\\'value\\':app[\\'metadata\\'][\\'resourceVersion\\']},\\n   {\\'op\\':\\'test\\',\\'path\\':\\'/spec/source/targetRevision\\',\\'value\\':app[\\'spec\\'][\\'source\\'][\\'targetRevision\\']},\\n   {\\'op\\':\\'replace\\',\\'path\\':\\'/spec/source/targetRevision\\',\\'value\\':destination},\\n   {\\'op\\':\\'add\\',\\'path\\':\\'/operation\\',\\'value\\':operation}]\\n  argv=[\\'kubectl\\',\\'patch\\',\\'application\\',\\'informed-decision\\',\\'-n\\',\\'argocd\\',\\'--type=json\\',\\'--patch-file=/dev/stdin\\',\\'-o\\',\\'name\\']\\n  patchdry=run(argv+[\\'--dry-run=server\\'],json.dumps(patch));require(patchdry.returncode==0,\\'Application operation dry-run refused\\')\\n  change=run(argv,json.dumps(patch))\\n  require(change.returncode==0,\\'Application patch outcome ambiguous; do not retry\\')\\n  result.update(all_checks_pass=True,operation_requested=True,source_revision=destination,\\n   resources=operation[\\'sync\\'][\\'resources\\'],prune=False,rollout_verified=False,\\n   latest_live_database_retained=True,client_diff_sha256=hashlib.sha256(diff.stdout.encode()).hexdigest())\\n if phase in (\\'verify\\',\\'rollback-verify\\'):\\n  op=app.get(\\'status\\',{}).get(\\'operationState\\',{});sync=op.get(\\'operation\\',{}).get(\\'sync\\',{})\\n  require(op.get(\\'phase\\')==\\'Succeeded\\' and sync.get(\\'revision\\')==target and sync.get(\\'prune\\') is False\\n   and sync.get(\\'resources\\')==[{\\'group\\':\\'apps\\',\\'kind\\':\\'Deployment\\',\\'name\\':\\'informed-decision\\',\\'namespace\\':\\'informed-decision\\'}],\\'exact native Argo operation completion unverified\\')\\n  require(live[\\'status\\'].get(\\'observedGeneration\\')==live[\\'metadata\\'][\\'generation\\'],\\'controller generation not settled\\')\\n  result.update(native_rollout_verified=True,current_schema5_database_retained=True,recovery_verification=phase==\\'rollback-verify\\')\\nexcept BaseException as error:\\n result.update(all_checks_pass=False,failure_class=type(error).__name__,\\n  failure=\\'fixed phase outcome refused or ambiguous; raw output withheld; no retry\\')\\nprint(json.dumps(result));sys.exit(0 if result.get(\\'all_checks_pass\\') is True else 1)\\n'\n"
    },
    "packet-refinement.json": {
      "sha256": "31b718a49ed475865edea1b2f6d749a50a3e66f56dbc4fa9b5ff1158acaef563",
      "content": "{\n  \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n  \"trial_id\": \"infd-purpose-20261011-r1\",\n  \"memo_version\": 2,\n  \"original_approved_source\": \"bc6494cd1b290783ef3aef0763bf28d1deabf4b0\",\n  \"original_packet_archive\": \"initial-approved-bc6494cd\",\n  \"original_approved_submission_digest\": \"sha256:fd78d486174670e12efb2f812bac02e68f294e7791b9302d0d458c053240f5a9\",\n  \"original_failed_journal_sha256\": \"d187b02d98d6e97429fe20b4fbe1d309a6c6c4b55232b4ae13ac39873039f1c1\",\n  \"original_old_uncertain_retry\": false,\n  \"rescue_phase\": \"drill-copy-rescue-r1\",\n  \"refinements\": [\n    \"explicitclose live WAL-aware inspector\",\n    \"immutable fixed hash-bound frozen snapshot allowing retained staleSHM only with zeroWAL\",\n    \"new separately linked journal and distinct named rescue-copy attempt\",\n    \"remaining phase input explicitly rescued result\"\n  ],\n  \"new_native_actions\": false,\n  \"new_founder_approval\": false\n}\n"
    },
    "receipt_safety.py": {
      "sha256": "5c54373f2dc4b064008225c186efb1d5afdeec36d15350bda0a12ded97602d1b",
      "content": "\"\"\"Only structural count/hash receipts can leave the private execution phase.\"\"\"\ndef counts(value):\n    if (set(value) != {'schema_version', 'lifecycle', 'outbox', 'submissions', 'integrity',\n                       'read_only_pre_open', 'store_constructed'}\n            or value['schema_version'] != 5 or value['integrity'] != 'ok'\n            or value['read_only_pre_open'] is not True or value['store_constructed'] is not False\n            or set(value['lifecycle']) != {'records', 'events', 'pending'}\n            or not set(value['outbox']) <= {'pending', 'delivered', 'blocked'}\n            or not set(value['submissions']) <= {'prepared', 'in_flight', 'confirmed', 'unresolved'}):\n        raise ValueError('count-only receipt shape/state refused; values withheld')\n    for group in ('lifecycle', 'outbox', 'submissions'):\n        if any(type(number) is not int or number < 0 or number > 10**12\n               for number in value[group].values()):\n            raise ValueError('count-only receipt values refused')\n    return value\n"
    },
    "root-authority-receipt-template.json": {
      "sha256": "db28d03e3c46b4de52dc404c912054483f4a2aaa6c4f476b7892cab2a5f408d4",
      "content": "{\n  \"proposal_id\": \"INFD-WP-0009-T04/purpose-overlay-v1\",\n  \"memo_id\": \"infd-20261011-purpose-overlay-r1\",\n  \"memo_version\": 2,\n  \"memo_sha256\": null,\n  \"source_revision\": null,\n  \"activation\": \"PENDING\",\n  \"authority_mode\": \"ADMINISTER\",\n  \"target\": \"realm:kubernetes/railiance01/informed-decision\",\n  \"verification_method\": \"root-fixed-origin-native-readback\",\n  \"runtime_authenticated_grant\": false,\n  \"verified_at\": null,\n  \"accepted_at\": null,\n  \"review_memo_id\": null,\n  \"approval_id\": null,\n  \"disposition_id\": null,\n  \"native_outcome_sha256\": null,\n  \"executor_plan_sha256\": \"4d5530e7418f638b10ccff0e0d9a0727adc64a7f3a45907f6deb5739ad2adc85\",\n  \"outcome_query\": \"/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=2\",\n  \"review_memo_version\": 1\n}\n"
    },
    "test_execution.py": {
      "sha256": "b250441282513862eeb990b18d01bb1eafe787b934d670a75a2bfaa9f5cfb89c",
      "content": "\"\"\"Synthetic custody/transport tests. No native data, Docker or cluster action.\"\"\"\nimport copy\nimport datetime\nimport io\nimport json\nimport os\nfrom pathlib import Path\nimport subprocess\nimport sys\nimport tempfile\nimport unittest\nfrom unittest.mock import patch\nfrom contextlib import redirect_stdout\n\nimport actuator\nfrom authority_journal import Journal, authority\nfrom native_program import PROGRAM\nfrom receipt_safety import counts\n\nCASE = Path('/home/worsch/informed-decision/docs/evidence/2026-10-11-purpose-image-release')\nNOW = datetime.datetime(2026, 10, 11, 2, 0, tzinfo=datetime.timezone.utc)\nREVISION = 'e' * 40\nCOUNT = {'schema_version': 5, 'integrity': 'ok', 'read_only_pre_open': True, 'store_constructed': False,\n         'lifecycle': {'records': 3, 'events': 8, 'pending': 1},\n         'outbox': {'pending': 2, 'delivered': 10}, 'submissions': {'confirmed': 1, 'unresolved': 1}}\n\n\ndef accepted():\n    approval = '11111111-1111-4111-8111-111111111111'\n    review = 'review-22222222-2222-4222-8222-222222222222'\n    disposition = 'disp-33333333-3333-4333-8333-333333333333'\n    receipt = {'proposal_id': 'INFD-WP-0009-T04/purpose-overlay-v1',\n               'memo_id': 'infd-20261011-purpose-overlay-r1', 'memo_version': 2,\n               'memo_sha256': 'a' * 64, 'source_revision': REVISION, 'activation': 'APPROVED',\n               'authority_mode': 'ADMINISTER', 'target': 'realm:kubernetes/railiance01/informed-decision',\n               'verification_method': 'root-fixed-origin-native-readback', 'runtime_authenticated_grant': False, 'outcome_query': '/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=2',\n               'verified_at': '2026-10-11T02:00:00Z', 'accepted_at': '2026-10-11T01:59:00Z',\n               'review_memo_id': review, 'approval_id': approval, 'disposition_id': disposition}\n    outcome = {'memo_id': receipt['memo_id'], 'review': {'memo_id': review, 'stale': False, 'intake_state': 'ready'},\n               'dispositions': [{'approval_id': None, 'submission_state': 'confirmed',\n                                 'disposition': {'verb': 'accept', 'memo_version': 1, 'memo_id': review,\n                                                 'approval_id': approval, 'id': disposition,\n                                                 'actor': {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'},\n                                                 'at': receipt['accepted_at']}}]}\n    return receipt, outcome\n\n\nclass AuthorityAndCustody(unittest.TestCase):\n    def test_exact_nested_founder_receipt_not_top_level_approval(self):\n        receipt, outcome = accepted()\n        result = authority(receipt, outcome, 'a' * 64, REVISION, 'drill-copy-rescue-r1', NOW)\n        self.assertEqual(result['approval_id'], receipt['approval_id'])\n\n    def test_pending_stale_wrong_actor_version_and_binding_refuse(self):\n        mutations = [lambda r, o: r.update(activation='PENDING'),\n                     lambda r, o: r.update(memo_sha256='changed'),\n                     lambda r, o: r.update(source_revision='changed'),\n                     lambda r, o: r.update(target='other'),\n                     lambda r, o: r.update(verified_at='2026-10-11T01:00:00Z'),\n                     lambda r, o: r.update(verification_method='caller-asserted'),\n                     lambda r, o: r.update(runtime_authenticated_grant=True),\n                     lambda r, o: o['review'].update(stale=True),\n                     lambda r, o: o['review'].update(intake_state='pending'),\n                     lambda r, o: o['dispositions'][0].update(submission_state='unresolved'),\n                     lambda r, o: o['dispositions'][0]['disposition'].update(memo_version=3),\n                     lambda r, o: o['dispositions'][0]['disposition'].update(actor={'kind': 'agent', 'sub': 'platform-root'}),\n                     lambda r, o: o['dispositions'].append(copy.deepcopy(o['dispositions'][0]))]\n        for mutate in mutations:\n            with self.subTest(mutate=mutate):\n                r, o = accepted()\n                mutate(r, o)\n                with self.assertRaises(ValueError):\n                    authority(r, o, 'a' * 64, REVISION, 'release', NOW)\n\n    def test_expired_window_and_unknown_phase_refuse(self):\n        r, o = accepted()\n        with self.assertRaises(ValueError):\n            authority(r, o, 'a' * 64, REVISION, 'arbitrary', NOW)\n        late = datetime.datetime(2026, 10, 13, tzinfo=datetime.timezone.utc)\n        r['verified_at'] = late.isoformat()\n        with self.assertRaises(ValueError):\n            authority(r, o, 'a' * 64, REVISION, 'rollback', late)\n\n    def test_durable_intent_precedes_dispatch_and_never_retries(self):\n        with tempfile.TemporaryDirectory() as directory:\n            parent = Path(directory)\n            os.chmod(parent, 0o700)\n            journal = Journal(parent, {'case': 'fixture'})\n            journal.start('drill-copy-rescue-r1', {'approval_id': 'fixture'})\n            self.assertEqual(json.loads(journal.path.read_text())['phases']['drill-copy-rescue-r1']['state'], 'RUNNING')\n            journal.close()  # simulated crash before result\n            recovered = Journal(parent, {'case': 'fixture'})\n            with self.assertRaises(ValueError):\n                recovered.start('drill-copy-rescue-r1', {})\n            with self.assertRaises(ValueError):\n                recovered.start('drill-copy-rescue-r1', {})\n            recovered.close()\n\n    def test_phase_order_and_uncertain_release_allows_only_distinct_recovery(self):\n        with tempfile.TemporaryDirectory() as directory:\n            os.chmod(directory, 0o700)\n            j = Journal(directory, {'case': 'fixture'})\n            with self.assertRaises(ValueError):\n                j.start('release', {})\n            for phase in actuator.PHASES[:5]:\n                j.start(phase, {})\n                j.finish(phase, {'all_checks_pass': True})\n            j.start('release', {})\n            j.finish('release', {'all_checks_pass': False})\n            with self.assertRaises(ValueError):\n                j.start('release', {})\n            with self.assertRaises(ValueError):\n                j.start('verify', {})\n            j.start('rollback', {})\n            j.finish('rollback', {'all_checks_pass': True})\n            j.close()\n\n    def test_secret_or_unknown_child_output_is_withheld(self):\n        for body in ('not-json', '{\"all_checks_pass\":true,\"token\":\"private-value\"}',\n                     '{\"all_checks_pass\":true,\"snapshot_readonly\":{\"schema_version\":5}}'):\n            with self.assertRaises(ValueError):\n                actuator.json_result(subprocess.CompletedProcess([], 0, body, ''))\n        wrong = copy.deepcopy(COUNT)\n        wrong['outbox'] = {'private-row-value': 1}\n        with self.assertRaises(ValueError):\n            counts(wrong)\n        counts(COUNT)  # blocked/unresolved counts are not required to be zero.\n\n    def test_binary_copy_is_bounded_private_and_never_echoed(self):\n        blob = b'synthetic private fixture bytes'\n        digest = __import__('hashlib').sha256(blob).hexdigest()\n        metadata = {'all_checks_pass': True, 'snapshot_file': 'drill.sqlite', 'snapshot_bytes': len(blob),\n                    'snapshot_sha256': digest, 'snapshot_readonly': COUNT,\n                    'pod_name': 'fixture-pod', 'pod_uid': 'fixture-uid'}\n        journal = type('FixtureJournal', (), {'data': {'identity': {'recovery_anchor': {'backup_result': metadata}}}})()\n        real_popen = subprocess.Popen\n        for extra in (b'', b'oversized'):\n            with self.subTest(extra=extra), tempfile.TemporaryDirectory() as folder:\n                os.chmod(folder, 0o700)\n                output = io.StringIO()\n\n                def child(*args, **kwargs):\n                    return real_popen([sys.executable, '-c', 'import sys;sys.stdout.buffer.write(' + repr(blob + extra) + ')'],\n                                      stdout=subprocess.PIPE, stderr=subprocess.DEVNULL)\n\n                with patch.object(actuator, 'CUSTODY', Path(folder)), patch.object(actuator, 'remote', return_value=metadata), \\\n                        patch('subprocess.Popen', side_effect=child), redirect_stdout(output):\n                    if extra:\n                        with self.assertRaises(ValueError):\n                            actuator.copy_snapshot('drill-copy-rescue-r1', REVISION, {}, journal)\n                    else:\n                        result = actuator.copy_snapshot('drill-copy-rescue-r1', REVISION, {}, journal)\n                        self.assertTrue(result['off_cluster_private_copy_verified'])\n                        self.assertEqual((Path(folder) / 'drill.sqlite').read_bytes(), blob)\n                self.assertEqual(output.getvalue(), '')\n                self.assertEqual((Path(folder) / 'drill.sqlite').stat().st_mode & 0o777, 0o600)\n\n    def test_recreated_offline_volume_cannot_be_deleted(self):\n        identity = {'Name': actuator.VOLUME, 'Labels': {'nonce': 'old'}, 'CreatedAt': 'old'}\n        journal = type('FixtureJournal', (), {'data': {'phases': {\n            'offline-verify': {'result': {'created_volume_identity': identity}}}}})()\n        inspected = [{**identity, 'CreatedAt': 'recreated'}]\n        with patch.object(actuator, 'docker', return_value=subprocess.CompletedProcess([], 0, json.dumps(inspected), '')) as mocked:\n            with self.assertRaises(ValueError):\n                actuator.cleanup_offline(journal)\n            self.assertEqual(mocked.call_count, 1)\n\n    def test_offline_post_admin_integrity_and_original_hash_are_rechecked(self):\n        for defect in ('none', 'post-integrity', 'original-hash'):\n            with self.subTest(defect=defect), tempfile.TemporaryDirectory() as directory:\n                folder=Path(directory);os.chmod(folder,0o700)\n                snapshot=folder/'drill.sqlite';snapshot.write_bytes(b'private synthetic snapshot');os.chmod(snapshot,0o600)\n                digest=actuator.sha(snapshot)\n                prior={'snapshot_sha256':digest,'snapshot_readonly':COUNT}\n                journal=type('FixtureJournal',(),{'data':{'phases':{'drill-copy-rescue-r1':{'result':prior},'offline-verify':{'attempt_id':'nonce'}}},'note':lambda *args:None})()\n                reads=[]\n                volume={'Name':actuator.VOLUME,'Labels':{'informed-decision.case':'infd-purpose-20261011-r1','informed-decision.use':'offline-restore-only','informed-decision.attempt':'nonce'},'Driver':'local','Scope':'local','CreatedAt':'fixture','Options':None}\n                def docker(argv, body=None, **kwargs):\n                    if argv[0]=='info':body=json.dumps('bnt-lap001')\n                    elif argv[:2]==['volume','ls']:body=''\n                    elif argv[:2]==['volume','create']:body=actuator.VOLUME\n                    elif argv[:2]==['volume','inspect']:body=json.dumps([volume])\n                    elif 'informed-decision-admin' in argv:\n                        body=json.dumps({key:COUNT[key] for key in ('schema_version','lifecycle','outbox','submissions')})\n                        if defect=='original-hash':snapshot.write_bytes(b'changed synthetic original')\n                    elif '--entrypoint' in argv and 'python' in argv:\n                        reads.append(argv);proof=copy.deepcopy(COUNT)\n                        if len(reads)==2 and defect=='post-integrity':proof['integrity']='corrupt'\n                        body=json.dumps(proof)\n                    else:raise AssertionError('unexpected offline command')\n                    return subprocess.CompletedProcess(argv,0,body,'')\n                with patch.object(actuator,'CUSTODY',folder),patch.object(actuator,'CASE',CASE),patch.object(actuator,'docker',side_effect=docker),patch('subprocess.run',return_value=subprocess.CompletedProcess([],0,'{\"all_checks_pass\":true,\"private_copy_verified\":true}','')):\n                    if defect=='none':\n                        result=actuator.offline_verify(journal)\n                        self.assertEqual(result['offline_post_admin_readonly'],COUNT)\n                        self.assertTrue(result['original_snapshot_hash_unchanged'])\n                    else:\n                        with self.assertRaises(ValueError):actuator.offline_verify(journal)\n                self.assertEqual(len(reads),2)\n\n\nclass FixedNativeProgram(unittest.TestCase):\n    def fixture(self):\n        sealed = json.loads((CASE / 'sealed-live-deployment.json').read_text())\n        live = copy.deepcopy(sealed)\n        live['metadata'].update(generation=42)\n        live['status'] = {'readyReplicas': 1, 'updatedReplicas': 1, 'observedGeneration': 42}\n        dependencies = json.loads((CASE / 'sealed-native-dependencies.json').read_text())\n        cm = copy.deepcopy(dependencies['configmap'])\n        cm.pop('canonical_data_sha256')\n        service = json.loads((CASE / 'candidate-deployment.json').read_text())\n        source_service = json.loads((CASE.parents[2] / 'deploy/lifecycle/service.candidate.json').read_text())\n        cm['data'] = next(x for x in source_service['items'] if x['kind'] == 'ConfigMap')['data']\n        pvc = copy.deepcopy(dependencies['pvc'])\n        pvc['status'] = {'phase': 'Bound'}\n        app = {'metadata': {'uid': '499868f2-eabc-4df4-ae31-b89ce58d750d', 'resourceVersion': '17'},\n               'spec': {'source': {'repoURL': 'https://forgejo.coulomb.social/coulomb/informed-decision.git',\n                                   'path': 'deploy/lifecycle', 'targetRevision': '7db8485ffecdebfabd77a9daec085553c74bf0bf'},\n                        'destination': {'namespace': 'informed-decision', 'server': 'https://kubernetes.default.svc'}}}\n        objects = {'deployment': live, 'configmap': cm, 'pvc': pvc, 'application': app}\n        payload = {'phase': 'release', 'source_revision': REVISION, 'approval': {}, 'sealed': sealed,\n                   'dependencies': dependencies, 'candidate': service,\n                   'rollback': json.loads((CASE / 'rollback-deployment.json').read_text()),\n                   'readonly': (CASE / 'sqlite_readonly.py').read_text(),'purpose_checks':(CASE/'check_installed.py').read_text(),\n                   'receipt_safety': (Path(__file__).parent / 'receipt_safety.py').read_text()}\n        return objects, payload\n\n    def execute_fake(self, objects, payload, ambiguous=False, schema_refused=False):\n        writes = []\n        calls = []\n\n        def fake(argv, input=None, **kwargs):\n            calls.append(argv)\n            if argv[:2] == ['kubectl', 'get']:\n                kind = argv[2]\n                if kind in objects:\n                    body = objects[kind]\n                elif kind == 'pods':\n                    body = {'items': [{'metadata': {'name': 'fixture-pod', 'uid': 'pod-uid',\n                                                   'ownerReferences': [{'kind': 'ReplicaSet', 'name': 'fixture-rs', 'uid': 'rs-uid'}]},\n                                      'spec': objects['deployment']['spec']['template']['spec'],\n                                      'status': {'phase': 'Running', 'containerStatuses': [{'name':'informed-decision','ready': True}]}}]}\n                elif kind == 'replicaset':\n                    body = {'metadata': {'uid': 'rs-uid', 'ownerReferences': [\n                        {'kind': 'Deployment', 'uid': payload['sealed']['metadata']['uid']}]}}\n                elif kind == 'nodes':\n                    body = {'items': [{'metadata': {'name': 'fixture-node'}, 'status': {\n                        'addresses': [{'address': '92.205.62.239'}], 'allocatable': {'cpu': '4'},\n                        'conditions': [{'type': key, 'status': 'True' if key == 'Ready' else 'False'}\n                                       for key in ('Ready', 'MemoryPressure', 'DiskPressure', 'PIDPressure')]}}]}\n                else:\n                    raise AssertionError('unexpected fixed metadata route')\n                return subprocess.CompletedProcess(argv, 0, json.dumps(body), '')\n            if argv[:2] == ['kubectl', 'exec']:\n                if schema_refused:\n                    return subprocess.CompletedProcess(argv, 1, '', 'withheld')\n                return subprocess.CompletedProcess(argv, 0, json.dumps({\n                    'all_checks_pass': True, 'live_readonly_schema_integrity_counts': COUNT}), '')\n            if argv[:2] == ['kubectl', 'apply']:\n                admitted = copy.deepcopy(payload['sealed'])\n                admitted['spec']['template']['spec']['containers'][0]['image'] = (actuator.IMAGE if payload['phase']=='release' else payload['sealed']['spec']['template']['spec']['containers'][0]['image'])\n                return subprocess.CompletedProcess(argv, 0, json.dumps(admitted), '')\n            if argv[:2] == ['kubectl', 'describe']:\n                return subprocess.CompletedProcess(argv, 0, 'Allocated resources:\\n cpu 3460m (86%)\\n', '')\n            if argv[:2] == ['kubectl', 'diff']:\n                return subprocess.CompletedProcess(argv, 1, '-image: base\\n+image: candidate\\n', '')\n            if argv[:2] == ['kubectl', 'patch']:\n                if '--dry-run=server' not in argv:\n                    writes.append(json.loads(input))\n                    if ambiguous:\n                        return subprocess.CompletedProcess(argv, 1, '', 'withheld')\n                return subprocess.CompletedProcess(argv, 0, 'application.argoproj.io/informed-decision\\n', '')\n            raise AssertionError('unexpected command')\n\n        source = PROGRAM.replace('__PAYLOAD__', repr(json.dumps(payload))).replace(\n            '__GUARD__', repr((CASE / 'change_guard.py').read_text()))\n        output = io.StringIO()\n        with patch('subprocess.run', side_effect=fake), redirect_stdout(output):\n            try:\n                exec(compile(source, 'fixed-native-fixture', 'exec'), {'__name__': '__fixture__'})\n            except (ValueError, SystemExit):\n                pass\n        receipt = json.loads(output.getvalue()) if output.getvalue() else {'all_checks_pass': False}\n        return receipt, writes, calls\n\n    def test_only_existing_application_operation_and_deployment_are_requested(self):\n        objects, payload = self.fixture()\n        receipt, writes, calls = self.execute_fake(objects, payload)\n        self.assertTrue(receipt['all_checks_pass'])\n        self.assertFalse(receipt['rollout_verified'])\n        self.assertEqual(len(writes), 1)\n        operation = writes[0][-1]['value']\n        self.assertFalse(operation['sync']['prune'])\n        self.assertEqual(operation['sync']['resources'], [\n            {'group': 'apps', 'kind': 'Deployment', 'name': 'informed-decision', 'namespace': 'informed-decision'}])\n        self.assertTrue(any('--dry-run=server' in argv and argv[:2] == ['kubectl', 'patch'] for argv in calls))\n        self.assertEqual(writes[0][0]['path'], '/metadata/uid')\n\n    def test_source_overrides_automation_and_custody_drift_stop_before_write(self):\n        mutations = [lambda o: o['application']['metadata'].update(uid='recreated'),\n                     lambda o: o['application']['spec'].update(syncPolicy={'automated': {}}),\n                     lambda o: o['application']['spec']['source'].update(kustomize={'images': ['other']}),\n                     lambda o: o['application']['spec'].update(sources=[{}]),\n                     lambda o: o['configmap']['metadata'].update(uid='recreated'),\n                     lambda o: o['pvc']['spec'].update(volumeName='replaced'),\n                     lambda o: o['deployment']['status'].update(readyReplicas=0)]\n        for mutate in mutations:\n            with self.subTest(mutate=mutate):\n                objects, payload = self.fixture()\n                mutate(objects)\n                receipt, writes, calls = self.execute_fake(objects, payload)\n                self.assertFalse(receipt['all_checks_pass'])\n                self.assertEqual(writes, [])\n\n    def test_preopen_schema_refusal_prevents_image_operation(self):\n        objects, payload = self.fixture()\n        receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)\n        self.assertFalse(receipt['all_checks_pass'])\n        self.assertEqual(writes, [])\n\n\n    def test_rollback_unready_candidate_never_reads_pod_or_database(self):\n        objects, payload = self.fixture()\n        payload['phase'] = 'rollback'\n        objects['deployment']['status'].update(readyReplicas=0, updatedReplicas=0)\n        objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = actuator.IMAGE\n        objects['application']['spec']['source']['targetRevision'] = REVISION\n        receipt, writes, calls = self.execute_fake(objects, payload, schema_refused=True)\n        self.assertTrue(receipt['all_checks_pass'])\n        self.assertFalse(receipt['rollout_verified'])\n        self.assertEqual(len(writes), 1)\n        self.assertFalse(any(argv[:2] == ['kubectl', 'exec'] or argv[:3] == ['kubectl', 'get', 'pods'] for argv in calls))\n        self.assertEqual(writes[0][-1]['value']['sync']['revision'], '7db8485ffecdebfabd77a9daec085553c74bf0bf')\n\n    def test_rollback_still_refuses_custody_or_nonpair_image_drift(self):\n        for defect in ('cm', 'pvc', 'image'):\n            with self.subTest(defect=defect):\n                objects, payload = self.fixture();payload['phase'] = 'rollback'\n                objects['deployment']['status']['readyReplicas'] = 0\n                if defect == 'cm':objects['configmap']['metadata']['uid'] = 'recreated'\n                elif defect == 'pvc':objects['pvc']['spec']['volumeName'] = 'replaced'\n                else:objects['deployment']['spec']['template']['spec']['containers'][0]['image'] = 'foreign-image'\n                receipt, writes, calls = self.execute_fake(objects, payload)\n                self.assertFalse(receipt['all_checks_pass']);self.assertEqual(writes, [])\n\n    def test_recovery_verification_is_separate_ready_old_image_schema_proof(self):\n        objects, payload = self.fixture();payload['phase'] = 'rollback-verify'\n        objects['application']['status'] = {'operationState': {'phase': 'Succeeded', 'operation': {'sync': {\n            'revision': '7db8485ffecdebfabd77a9daec085553c74bf0bf', 'prune': False,\n            'resources': [{'group':'apps','kind':'Deployment','name':'informed-decision','namespace':'informed-decision'}]}}}}\n        receipt, writes, calls = self.execute_fake(objects, payload)\n        self.assertTrue(receipt['all_checks_pass']);self.assertTrue(receipt['recovery_verification'])\n        self.assertEqual(writes, [])\n        self.assertTrue(any(argv[:2]==['kubectl','exec'] for argv in calls))\n        objects['deployment']['status']['readyReplicas'] = 0\n        receipt, writes, calls = self.execute_fake(objects,payload)\n        self.assertFalse(receipt['all_checks_pass'])\n\n    def test_ambiguous_patch_is_never_retried(self):\n        objects, payload = self.fixture()\n        receipt, writes, calls = self.execute_fake(objects, payload, ambiguous=True)\n        self.assertFalse(receipt['all_checks_pass'])\n        self.assertEqual(len(writes), 1)\n\n\nif __name__ == '__main__':\n    unittest.main()\n"
    },
    "test_rescue_execution.py": {
      "sha256": "8ecbb0260a87a7a12bd5c4c9678fb2a9d43a4ea7322129734bc21f8ee383cd70",
      "content": "\"\"\"Synthetic recovery guards; no actual private journal/DB/native command.\"\"\"\nimport copy\nimport datetime\nimport hashlib\nimport json\nimport os\nfrom pathlib import Path\nimport tempfile\nimport unittest\nfrom authority_journal import Journal, authority, original_anchor\nfrom test_execution import accepted, NOW, REVISION\n\nROOT=Path(__file__).parent\nPLAN=json.loads((ROOT/'execution-plan.json').read_text())\nCASE=ROOT.parent\nBACKUP=json.loads((CASE/'original-approved-drill-backup.json').read_text())\n\nclass RescueGuards(unittest.TestCase):\n    def original(self,parent):\n        original={'identity':PLAN['recovery']['original_identity'],'phases':{}}\n        for name,metadata in PLAN['recovery']['original_anchor']['phase_metadata'].items():\n            original['phases'][name]={**metadata,'result':BACKUP if name=='drill-backup' else {'all_checks_pass':False}}\n        p=parent/'execution-journal.json';p.write_text(json.dumps(original));os.chmod(p,0o600)\n        anchor=copy.deepcopy(PLAN['recovery']['original_anchor']);anchor['original_journal_sha256']=hashlib.sha256(p.read_bytes()).hexdigest()\n        return p,original,anchor\n\n    def test_exact_original_failed_journal_is_linked_without_mutation(self):\n        with tempfile.TemporaryDirectory() as directory:\n            parent=Path(directory);os.chmod(parent,0o700);p,original,expected=self.original(parent);before=p.read_bytes()\n            anchor=original_anchor(parent,expected,BACKUP,original['identity'])\n            j=Journal(parent,{'fixture':True,'recovery_anchor':anchor});j.start('drill-copy-rescue-r1',{})\n            self.assertEqual(p.read_bytes(),before);self.assertEqual(j.path.name,'rescue-execution-journal-r1.json')\n            j.finish('drill-copy-rescue-r1',{'all_checks_pass':True});j.start('offline-verify',{})\n            self.assertEqual(p.read_bytes(),before);j.close()\n\n    def test_original_missing_uncertain_recreated_attempt_or_rollout_refuse(self):\n        for defect in ('missing','complete','attempt','rollout','hash'):\n            with self.subTest(defect=defect),tempfile.TemporaryDirectory() as directory:\n                parent=Path(directory);os.chmod(parent,0o700);p,o,e=self.original(parent)\n                if defect=='missing':o['phases'].pop('drill-copy')\n                elif defect=='complete':o['phases']['drill-copy']['state']='COMPLETE'\n                elif defect=='attempt':o['phases']['drill-copy']['attempt_id']='different'\n                elif defect=='rollout':o['phases']['release']={'state':'RUNNING'}\n                if defect!='hash':\n                    p.write_text(json.dumps(o));e['original_journal_sha256']=hashlib.sha256(p.read_bytes()).hexdigest()\n                else:e['original_journal_sha256']='0'*64\n                with self.assertRaises((ValueError,KeyError)):original_anchor(parent,e,BACKUP,PLAN['recovery']['original_identity'])\n\n    def test_rescue_replay_refused_and_old_phase_never_admitted(self):\n        with tempfile.TemporaryDirectory() as directory:\n            os.chmod(directory,0o700);j=Journal(directory,{'fixture':True})\n            with self.assertRaises(ValueError):j.start('drill-copy',{})\n            with self.assertRaises(ValueError):j.start('drill-backup',{})\n            with self.assertRaises(ValueError):j.start('offline-verify',{})\n            j.start('drill-copy-rescue-r1',{});j.finish('drill-copy-rescue-r1',{'all_checks_pass':False})\n            with self.assertRaises(ValueError):j.start('drill-copy-rescue-r1',{})\n            with self.assertRaises(ValueError):j.start('offline-verify',{})\n            j.close()\n\n    def test_new_authority_requires_version2_old_approval_refuses(self):\n        receipt,outcome=accepted();receipt['memo_version']=2;outcome['dispositions'][0]['disposition']['memo_version']=1\n        authority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\n        receipt['memo_version']=1\n        with self.assertRaises(ValueError):authority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\n        with self.assertRaises(ValueError):authority(receipt,outcome,'a'*64,REVISION,'drill-copy',NOW)\n        receipt['memo_version']=2;receipt['outcome_query']='/lifecycle/memos/infd-20261011-purpose-overlay-r1/outcomes?version=1'\n        with self.assertRaises(ValueError):authority(receipt,outcome,'a'*64,REVISION,'drill-copy-rescue-r1',NOW)\n\n    def test_explicit_offline_input_mapping_and_absence_guards(self):\n        source=(ROOT/'actuator.py').read_text()\n        self.assertIn(\"previous = journal.data['phases']['drill-copy-rescue-r1']['result']\",source)\n        self.assertIn(\"not os.path.lexists(CUSTODY / 'drill.sqlite')\",source)\n        self.assertIn(\"VOLUME not in listed.stdout.splitlines()\",source)\n        self.assertNotIn(\"os.mkdir(CUSTODY\",source)\n        import ast\n        program=ast.literal_eval(next(n.value for n in ast.parse((ROOT/'native_program.py').read_text()).body if isinstance(n,ast.Assign)))\n        compile(program,'native-rescue-fixture','exec')\n        self.assertIn(\"phase=='drill-copy-rescue-r1':require(pod['metadata']['uid']=='e8561ae0-4b09-4455-924d-64c27b625fc7'\",program)\n\nif __name__=='__main__':unittest.main()\n"
    },
    "validation.json": {
      "sha256": "6f3379f63968e9a0294aba7b5b57ea4662adda6b1fa1b37eff11c2f72a58931f",
      "content": "{\n  \"state\": \"prepared-unapproved-version2\",\n  \"executor_tests\": 21,\n  \"snapshot_mock_tests\": 5,\n  \"native_actions\": false,\n  \"database_admin_commands_in_preparation\": false,\n  \"old_journal_modified\": false,\n  \"old_failed_phase_retried\": false,\n  \"owner_head_unchanged\": \"bc6494cd1b290783ef3aef0763bf28d1deabf4b0\"\n}\n"
    }
  },
  "native_execution": false,
  "case_evidence": {
    "original-approved-drill-backup.json": {
      "sha256": "025dddf1e93936f31e98b9fbfa84aa2bdaaa33573f9d3b0e32d947fd286b170e",
      "content": "{\"phase\": \"drill-backup\", \"all_checks_pass\": true, \"raw_output_withheld\": true, \"native_approval_verified_by_root\": {\"approval_id\": \"ec92806a-9aa6-494f-a76b-0385f39ba609\", \"disposition_id\": \"disp-0968373d-294d-42bf-8979-36a7c5dd38cf\", \"accepted_at\": \"2026-10-11T02:34:20Z\", \"verified_at\": \"2026-10-11T02:38:41.777949+00:00\"}, \"native_authenticated_grant\": false, \"source_readonly_baseline\": {\"schema_version\": 5, \"lifecycle\": {\"records\": 15, \"events\": 50, \"pending\": 0}, \"outbox\": {\"delivered\": 320}, \"submissions\": {\"confirmed\": 41}, \"integrity\": \"ok\", \"read_only_pre_open\": true, \"store_constructed\": false}, \"snapshot_readonly\": {\"schema_version\": 5, \"lifecycle\": {\"records\": 15, \"events\": 50, \"pending\": 0}, \"outbox\": {\"delivered\": 320}, \"submissions\": {\"confirmed\": 41}, \"integrity\": \"ok\", \"read_only_pre_open\": true, \"store_constructed\": false}, \"snapshot_sha256\": \"8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3\", \"snapshot_bytes\": 19537920, \"snapshot_file\": \"drill.sqlite\", \"native_parent_private\": true, \"native_uid\": 10001, \"pod_name\": \"informed-decision-f557556df-mwpz7\", \"pod_uid\": \"e8561ae0-4b09-4455-924d-64c27b625fc7\"}\n"
    },
    "original-approved-drill-copy-failure.json": {
      "sha256": "fb78fb2e8c3d416490cf0f559b2f5bd019406a490f8f5fa6f5932421f0b1ac56",
      "content": "{\"all_checks_pass\": false, \"phase\": \"drill-copy\", \"failure_class\": \"ValueError\", \"failure\": \"fixed phase outcome uncertain; original evidence retained; no retry\", \"raw_output_withheld\": true}\n"
    },
    "original-journal-sanitized-anchor.json": {
      "sha256": "988fca61ad8eb9d43d93390a835323f952196bbce8cc0bde51c42a17d411f454",
      "content": "{\n  \"original_journal_sha256\": \"d187b02d98d6e97429fe20b4fbe1d309a6c6c4b55232b4ae13ac39873039f1c1\",\n  \"phase_metadata\": {\n    \"drill-backup\": {\n      \"state\": \"COMPLETE\",\n      \"attempt_id\": \"d63182a7-e1a5-4e8e-a5f1-2bf3333cf153\",\n      \"started_at\": \"2026-10-11T02:38:45.310653+00:00\"\n    },\n    \"drill-copy\": {\n      \"state\": \"UNCERTAIN\",\n      \"attempt_id\": \"329ef190-1692-4246-b953-e6a59664abcc\",\n      \"started_at\": \"2026-10-11T02:39:50.198740+00:00\"\n    }\n  },\n  \"frozen_backup_receipt_sha256\": \"025dddf1e93936f31e98b9fbfa84aa2bdaaa33573f9d3b0e32d947fd286b170e\",\n  \"snapshot_sha256\": \"8756cf825df9e7b5b74bb4a0106a5027f5cff2c59ff45d7b48eed8522a7d33f3\",\n  \"snapshot_bytes\": 19537920,\n  \"off_cluster_file_exists\": false,\n  \"old_uncertain_retry_authorized\": false\n}\n"
    }
  }
}