{
  "observed_at": "2026-09-08T21:17:50.880337+00:00",
  "image": {
    "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
    "source_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
    "published_tag": "main-6f33abd",
    "packaged_command_proven": true,
    "container_uid": 65534,
    "container_network": "none",
    "container_readonly": true,
    "fixture_lifetime_seconds": 1,
    "expected_exit": 1,
    "observed_exit": 1,
    "idle_receipt": {
      "downstream_credential_issued": false,
      "failure": "probe_deadline",
      "schema": "keycape.upstream-issuer-proof.v1",
      "status": "failed",
      "tokens_retained": false
    }
  },
  "validation": {
    "go_test_race_all": "passed",
    "go_vet_all": "passed",
    "probe_tests_after_cli_fixture": "passed",
    "python_renderer_and_receipt_tests": 5,
    "traefik_route": {
      "traefik": "3.6.7",
      "exact_route_cases_passed": 7,
      "ordinary_login_callbacks_preserved": true,
      "live_cluster_changed": false
    },
    "server_dry_run": {
      "accepted": true,
      "resources": [
        "Job",
        "Service",
        "IngressRoute",
        "NetworkPolicy/probe",
        "NetworkPolicy/Authelia"
      ],
      "image_digest": "sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
      "job_owner_uid": "fixture only; must bind the actual UID at execution"
    }
  },
  "deployment_metadata": {
    "deployment": {
      "name": "keycape",
      "metadata": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29"
    },
    "secret": {
      "name": "keycape-config",
      "metadata": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
    },
    "production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
    "probe_jobs_before": []
  },
  "live_upstream_issuer_proved": false,
  "production_mutated": false,
  "credential_values_extracted": false,
  "custody_activated": false,
  "required_next_return": "Deployment-owner admission for the temporary config-reading probe; attended signed issuer receipt and cleanup, then contained issuer pin and named CCR reviews"
}