From 16837a26fb2cdc8a654b352159bfa749ff6fbb58 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sun, 11 Oct 2026 03:38:24 +0200
Subject: [PATCH] Record verified approved guardrail publication and remaining
 owner gates

---
 .../agents/custodian-codex/supervision.json   |   49 +
 ...-hosting-preparation-progress-receipt.json |   37 +
 .../policy-hosting-approved-execution.json    |   29 +
 ...policy-hosting-approved-owner-execution.py |  121 ++
 ...licy-hosting-approved-source-manifest.json |  212 ++++
 .../policy-hosting-hub-decision.json          |   18 +
 .../policy-hosting-native-acceptance.json     |    1 +
 .../policy-hosting-native-outcome.json        |    1 +
 .../policy-hosting-native-submission.json     |    1 +
 .../policy-hosting-pre-actuation-failed.json  |   24 +
 ...licy-hosting-public-byte-verification.json | 1114 +++++++++++++++++
 .../policy-hosting-public-runtime-checks.json |   48 +
 ...cy-hosting-read-only-render-diagnosis.json |   72 ++
 ...cy-native-completion-progress-receipt.json |   27 +
 .../source-current-2026-10-11.json            |   22 +-
 ...ecurity-collaboration-review-2026-10-10.md |   72 ++
 16 files changed, 1833 insertions(+), 15 deletions(-)
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/native-and-hosting-preparation-progress-receipt.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-owner-execution.py
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-source-manifest.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-hub-decision.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-acceptance.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-outcome.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-submission.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-byte-verification.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-runtime-checks.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-hosting-read-only-render-diagnosis.json
 create mode 100644 docs/evidence/2026-10-10-security-consolidation/policy-native-completion-progress-receipt.json

diff --git a/.kaizen/agents/custodian-codex/supervision.json b/.kaizen/agents/custodian-codex/supervision.json
index 768121fd..c05ef0ff 100644
--- a/.kaizen/agents/custodian-codex/supervision.json
+++ b/.kaizen/agents/custodian-codex/supervision.json
@@ -141,6 +141,55 @@
       "execution_ref": "docs/evidence/2026-10-10-security-consolidation/user-readback-approved-execution.json",
       "verified_outcome": "Exact approved two-object rollout Ready1 gen73/observed73, readyz200; actual admitted readback registry/allow-deny/TTL/unavailable checks passed. Existing enforcement health200/unknown-action200deny; oldnativepurpose200deny is preexisting protocolgap, no allow claimed. Canonical full28objectrender changes exactly2objects. Native catalogue empty: USER26/28 consumer acceptance stillopen, no realhumanlogin/MFA or token-isolation proof. Scope execution succeeded; overall consolidation remains active.",
       "refinement_or_rescue": false
+    },
+    {
+      "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
+      "disposition": "accepted_unchanged",
+      "outcome": "succeeded",
+      "proposal_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
+      "original_revision": "R1-refined-a70fb22f",
+      "original_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
+      "packet_manifest_sha256": "a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8",
+      "target": "realm:kubernetes/railiance01/policy-nexus",
+      "expected_result": "Ready1 exact published Policy Nexus image and paired provenance; accepted v0.8 served,73 current documents and72 existing immutable paths independently match.",
+      "verification_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-native-hosting",
+      "rollback_ref": "rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json; Helm revision8",
+      "cost_estimate_eur": 0,
+      "risk_estimate": "Stateless public availability/pull/scheduling/runtime incompatibility. Rollback restores72 existing paths but temporarily removes newly introduced v0.8/current revision URLs. Loss bound unpriced, supervised exact human approval required.",
+      "execution_deadline": "2026-10-12T23:59:59Z",
+      "memo_id": "infd-20261011-policy-nexus-hosting-r1",
+      "memo_version": 1,
+      "internal_pre_submission_refinements": "Original27pathd402 packet retained; independent owner review required UID/full defaulted configuration and ServiceAccount reference drift refusal, HTTPS origin/redirect refusal and bounded reads. Refined30patha70 packet prepared before first human submission; one trial, no earlier approval or success.",
+      "promotion_evidence": false,
+      "approved_revision": "R1-refined-a70fb22f",
+      "approved_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
+      "approval_ref": "informed-decision:infd-20261011-policy-nexus-hosting-r1@1; approval:52a3c479-2cb1-4074-abec-6a88117ad596",
+      "approved_at": "2026-10-11T01:14:23+00:00",
+      "human_disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011",
+      "pre_actuation_attempts": [
+        {
+          "at": "2026-10-11T01:19:18Z",
+          "actuator_sha256": "41837e66e8d775f0ecfab42e2d3d3f5063489a3d2f14ae8e86f595ade25e5643",
+          "result": "failed render comparison before Helm upgrade; node,capacity,sealed baseline and server dryrun/diff passed",
+          "attempted_helm_upgrade": false,
+          "receipt_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json"
+        },
+        {
+          "result": "local premature read of pending outcome writer failed JSON parsing before any remote execution",
+          "attempted_helm_upgrade": false,
+          "effect": "none",
+          "refinement": "wait for receipt-producing command completion before dependent actuator"
+        }
+      ],
+      "operational_actuator_refinement": "Readonly diagnosis proved existing Helm chart omits metadata.namespace; fixed command namespace policy-nexus supplies it. Refined comparison adds only missing namespace, refuses explicit wrong namespace, preserving full9object exact comparison. Approved packet/source/image/effect scope unchanged. Initialfailed pre-actuation preserved.",
+      "refinement_or_rescue": true,
+      "executed_revision": "R1-refined-a70fb22f",
+      "executed_digest": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e",
+      "executed_actuator_sha256": "e23fb931f253c8df79fffb922f23a1f476c2167014b06e245a22148fce25dccf",
+      "execution_started_at": "2026-10-11T01:23:27.564865+00:00",
+      "execution_completed_at": "2026-10-11T01:23:42.112194+00:00",
+      "execution_ref": "docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json",
+      "verified_outcome": "Helm9 deployed/Ready1 generation9 observed9; exact approved image/paired provenance/all9 UID-defaulted configurations pass.158publicHTTPS byte checks match73currentdocuments+72oldimmutablepaths; CertificateReady,health/index200/legacy308/404. NoArgo adoption/data/credential writes; sourcebindingreconciled. Initialpre-actuation namespace comparison failure retained and refined; no rollback used, no unchanged-success promotion credit. Wholeconsolidation remains active."
     }
   ]
 }
diff --git a/docs/evidence/2026-10-10-security-consolidation/native-and-hosting-preparation-progress-receipt.json b/docs/evidence/2026-10-10-security-consolidation/native-and-hosting-preparation-progress-receipt.json
new file mode 100644
index 00000000..4c7d7211
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/native-and-hosting-preparation-progress-receipt.json
@@ -0,0 +1,37 @@
+{
+  "workplan_id": null,
+  "id": "74553c13-a1bf-47ad-bdc2-bc662743a087",
+  "topic_id": null,
+  "task_id": null,
+  "decision_id": null,
+  "event_type": "note",
+  "summary": "Confirmed User Engine R2 approval executed: Ready1 exact f239 image, native advisory readback checks pass; real catalogue empty and USER26/28 remain open. Accepted security model/source conformance and publisher artifact prepared; Policy Nexus exact hosting R1 memo now intake-ready, no approval/deployment inferred. Forgejo shared default SA blocks CCR42, attached to ORGREF-WP-0002.",
+  "detail": {
+    "handoff_ids": [
+      "PNEX-WP-0005",
+      "USER-WP-0026",
+      "USER-WP-0028",
+      "INFD-WP-0009-T04",
+      "KEY-WP-0039-T02",
+      "MASON-WP-0010-T03",
+      "WARDEN-WP-0044-T03",
+      "ORGREF-WP-0002",
+      "CCR-2026-0042"
+    ],
+    "policy_memo_id": "infd-20261011-policy-nexus-hosting-r1",
+    "policy_review_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7",
+    "user_approval_id": "0dd18a5a-5555-461e-8470-931d530435cf",
+    "user_hub_decision_id": "b9ece441-f7a4-5f44-8cf2-243a24166ce6",
+    "whole_goal_completed": false,
+    "baseline_owner_source_count": {
+      "open": 48,
+      "residual": 2,
+      "nonresidual": 46,
+      "unfinished_tasks": 102
+    }
+  },
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-11T01:13:35.298178Z",
+  "workstream_id": null
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json
new file mode 100644
index 00000000..d6846366
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-execution.json
@@ -0,0 +1,29 @@
+{
+  "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
+  "approval": {
+    "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
+    "disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
+  },
+  "started_at": "2026-10-11T01:23:27.564865+00:00",
+  "raw_output_withheld": true,
+  "secret_values_observed": false,
+  "attempted_helm_upgrade": true,
+  "all_checks_pass": true,
+  "headroom": {
+    "node_ip": "92.205.62.239",
+    "free_cpu_m": 540,
+    "free_memory_mi": 6521,
+    "surge_cpu_m": 10,
+    "surge_memory_mi": 32,
+    "pressure_checks_pass": true
+  },
+  "fresh_sealed_preflight_pass": true,
+  "helm_exit_code": 0,
+  "helm_revision": 9,
+  "image": "forgejo.coulomb.social/coulomb/policy-nexus@sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
+  "generation": 9,
+  "observed_generation": 9,
+  "ready_replicas": 1,
+  "completed_at": "2026-10-11T01:23:42.112194+00:00",
+  "decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-owner-execution.py b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-owner-execution.py
new file mode 100644
index 00000000..6e5cd03f
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-owner-execution.py
@@ -0,0 +1,121 @@
+"""Exact supervised owner Helm operation; credentials never leave the node."""
+import base64, datetime, hashlib, json, subprocess, sys
+if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
+from pathlib import Path
+here=Path('/home/worsch/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal')
+manifest=Path('/tmp/policy-native-hosting-stage/manifest.json')
+assert hashlib.sha256(manifest.read_bytes()).hexdigest()=='a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8'
+for entry in json.loads(manifest.read_text()):
+    current=Path('/home/worsch')/entry['repo']/entry['path']
+    assert not current.is_symlink() and hashlib.sha256(current.read_bytes()).hexdigest()==entry['staged_sha256']
+assert hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()=='076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e'
+proposal=json.loads((here/'proposal.json').read_text())
+receipt=json.loads(Path('/tmp/security-policy-hosting-native-outcome-latest.json').read_text())
+assert receipt['memo_id']=='infd-20261011-policy-nexus-hosting-r1'
+assert receipt['review']['memo_id']=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
+assert receipt['review']['stale'] is False and receipt['review']['intake_state']=='ready'
+accepted=[x for x in receipt['dispositions'] if x.get('submission_state')=='confirmed' and x.get('disposition',{}).get('verb')=='accept' and x['disposition'].get('memo_version')==1]
+assert len(accepted)==1,'Exact confirmed founder acceptance required'
+a=accepted[0]['disposition']
+assert a.get('approval_id')=='52a3c479-2cb1-4074-abec-6a88117ad596'
+assert a.get('id')=='disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011'
+assert a.get('memo_id')=='review-28d16691-3277-461e-aec6-53ad7a0538c7'
+assert a.get('actor')=={'kind':'person','sub':'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
+assert a.get('at')=='2026-10-11T01:14:23Z'
+assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(proposal['execution_deadline'].replace('Z','+00:00'))
+for name,digest in proposal['preflight_source_hashes'].items():assert hashlib.sha256((here/name).read_bytes()).hexdigest()==digest
+chart=Path('/home/worsch/rapp-policy-nexus')
+files={}
+for item in proposal['chart_source_files']:
+ p=chart/item['path'];data=p.read_bytes();assert hashlib.sha256(data).hexdigest()==item['sha256'];files[item['path']]=base64.b64encode(data).decode()
+values=(here/'candidate-values.yaml').read_bytes();assert hashlib.sha256(values).hexdigest()==proposal['candidate_values_sha256']
+binding=json.loads((here/'candidate-binding.json').read_text());assert binding==proposal['candidate']
+payload={'proposal':proposal,'approval':{'approval_id':a['approval_id'],'disposition_id':a['id']},'chart_files':files,'values':base64.b64encode(values).decode(),'candidate':(here/'candidate-rendered.yaml').read_text(),'baseline':(here/'rollback-rendered.yaml').read_text(),'sealed':json.loads((here/'sealed-live-config.json').read_text())['objects']}
+remote=r'''
+import base64,copy,datetime,hashlib,json,os,re,subprocess,sys,tempfile
+from pathlib import Path
+if sys.flags.optimize: raise RuntimeError("Optimized interpreter refuses supervised execution")
+import yaml
+exec(__GUARD__)
+p=json.loads(__PAYLOAD__); q=p['proposal']; env={**os.environ,'KUBECONFIG':'/etc/rancher/k3s/k3s.yaml'}
+r={'proposal_id':q['proposal_id'],'approval':p['approval'],'started_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'raw_output_withheld':True,'secret_values_observed':False,'attempted_helm_upgrade':False,'all_checks_pass':False}
+def run(args,body=None,timeout=90):
+ return subprocess.run(args,input=body,text=True,capture_output=True,timeout=timeout,env=env)
+def get(args):
+ x=run(['kubectl']+args+['-o','json']);assert x.returncode==0,'fixed metadata query failed';return json.loads(x.stdout)
+def quantity(value):
+ m=re.fullmatch(r'([0-9]+)(m|Ki|Mi|Gi|Ti)?',str(value));assert m,'unsupported resource quantity'
+ n=int(m[1]);unit=m[2];return n*{'m':0.001,'Ki':1024,'Mi':1024**2,'Gi':1024**3,'Ti':1024**4,None:1}[unit]
+try:
+ assert datetime.datetime.now(datetime.timezone.utc)<datetime.datetime.fromisoformat(q['execution_deadline'].replace('Z','+00:00'))
+ nodes=get(['get','nodes'])['items'];assert len(nodes)==1
+ node=nodes[0];assert any(x['address']=='92.205.62.239' for x in node['status']['addresses'])
+ conditions={x['type']:x['status'] for x in node['status']['conditions']};assert conditions.get('Ready')=='True'
+ assert all(conditions.get(k)=='False' for k in ['MemoryPressure','DiskPressure','PIDPressure'])
+ description=run(['kubectl','describe','node',node['metadata']['name']]);assert description.returncode==0
+ table=description.stdout.split('Allocated resources:',1)[1]
+ cpu=re.search(r'^\s*cpu\s+(\S+)\s+\(',table,re.M);mem=re.search(r'^\s*memory\s+(\S+)\s+\(',table,re.M);assert cpu and mem
+ free_cpu=quantity(node['status']['allocatable']['cpu'])-quantity(cpu[1]);free_mem=quantity(node['status']['allocatable']['memory'])-quantity(mem[1])
+ assert free_cpu>=0.010 and free_mem>=32*1024**2
+ r['headroom']={'node_ip':'92.205.62.239','free_cpu_m':round(free_cpu*1000),'free_memory_mi':int(free_mem/1024**2),'surge_cpu_m':10,'surge_memory_mi':32,'pressure_checks_pass':True}
+ apps=get(['get','applications.argoproj.io','-n','argocd'])['items']
+ for app in apps:
+  spec=app.get('spec',{});assert spec.get('destination',{}).get('namespace')!='policy-nexus'
+  assert 'policy-nexus' not in app['metadata']['name']
+  assert all('policy-nexus' not in str(src.get('path','')) for src in [spec.get('source',{})]+spec.get('sources',[]))
+ status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
+ h=json.loads(status.stdout);assert h['version']==8 and h['info']['status']=='deployed' and h['namespace']=='policy-nexus'
+ candidate=list(yaml.safe_load_all(p['candidate']));baseline=list(yaml.safe_load_all(p['baseline']));strict_source(baseline,candidate)
+ live=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
+ strict_baseline(baseline,live,p['sealed'])
+ for x in live:
+  md=x['metadata'];ann=md.get('annotations',{});assert md.get('labels',{}).get('app.kubernetes.io/managed-by')=='Helm'
+  assert ann.get('meta.helm.sh/release-name')=='policy-nexus' and ann.get('meta.helm.sh/release-namespace')=='policy-nexus' and not ann.get('argocd.argoproj.io/tracking-id')
+ body=json.dumps({'apiVersion':'v1','kind':'List','items':candidate})
+ dry=run(['kubectl','apply','--dry-run=server','-n','policy-nexus','-f','-','-o','json'],body);assert dry.returncode==0
+ admitted=json.loads(dry.stdout);strict_admitted(live,candidate,admitted.get('items',[admitted]))
+ diff=run(['kubectl','diff','-n','policy-nexus','-f','-'],body);assert diff.returncode in [0,1]
+ r['fresh_sealed_preflight_pass']=True
+ with tempfile.TemporaryDirectory(prefix='policy-nexus-approved-') as directory:
+  root=Path(directory);os.chmod(root,0o700)
+  for name,data in p['chart_files'].items():
+   relative=Path(name);assert relative.parts[:2]==('helm','policy-nexus') and '..' not in relative.parts
+   target=root/relative;target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(base64.b64decode(data))
+  valuefile=root/'candidate-values.yaml';valuefile.write_bytes(base64.b64decode(p['values']))
+  chart=root/'helm/policy-nexus'
+  rendered=run(['helm','template','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile)])
+  assert rendered.returncode==0
+  exact=list(yaml.safe_load_all(rendered.stdout))
+  for obj in exact:
+   # Helm binds omitted namespaced metadata to its fixed --namespace target.
+   md=obj['metadata']
+   if 'namespace' not in md:md['namespace']='policy-nexus'
+   assert md['namespace']=='policy-nexus'
+  assert normalize(objects(exact))==normalize(objects(candidate))
+  r['attempted_helm_upgrade']=True
+  upgrade=run(['helm','upgrade','policy-nexus',str(chart),'--namespace','policy-nexus','--values',str(valuefile),'--atomic','--wait','--timeout','5m'],timeout=330)
+  r['helm_exit_code']=upgrade.returncode
+  assert upgrade.returncode==0,'owner atomic upgrade failed'
+ after=[get(['get',x['kind'],x['metadata']['name'],'-n','policy-nexus']) for x in baseline]
+ expected,_=planned(live,candidate)
+ for key,x in objects(after).items():
+  wanted=copy.deepcopy(expected[key]);actual=copy.deepcopy(x)
+  if key==('Deployment','policy-nexus'):
+   # Deployment controller's rollout counter is bookkeeping, not a source change.
+   for doc in [wanted,actual]:doc['metadata'].get('annotations',{}).pop('deployment.kubernetes.io/revision',None)
+  assert configuration(wanted)==configuration(actual),'post-release configuration differs'
+ deployment=objects(after)[('Deployment','policy-nexus')];st=deployment['status']
+ assert st.get('observedGeneration')==deployment['metadata']['generation'] and st.get('readyReplicas')==1 and st.get('updatedReplicas')==1
+ status=run(['helm','status','policy-nexus','--namespace','policy-nexus','--output','json']);assert status.returncode==0
+ h=json.loads(status.stdout);assert h['version']==9 and h['info']['status']=='deployed'
+ r.update(all_checks_pass=True,helm_revision=h['version'],image=deployment['spec']['template']['spec']['containers'][0]['image'],generation=deployment['metadata']['generation'],observed_generation=st['observedGeneration'],ready_replicas=st['readyReplicas'],completed_at=datetime.datetime.now(datetime.timezone.utc).isoformat())
+except Exception as error:
+ r['failure_class']=type(error).__name__;r['failure']='fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld'
+print(json.dumps(r));sys.exit(0 if r['all_checks_pass'] else 1)
+'''.replace('__GUARD__',repr((here/'change_guard.py').read_text())).replace('__PAYLOAD__',repr(json.dumps(payload)))
+result=subprocess.run(['ssh','railiance01','python3 -'],input=remote,text=True,capture_output=True,timeout=450)
+try:out=json.loads(result.stdout)
+except (ValueError,TypeError):out={'all_checks_pass':False,'failure':'SSH safe receipt unavailable','raw_output_withheld':True}
+out['decision_packet_sha256']=hashlib.sha256((here/'decision-packet.md').read_bytes()).hexdigest()
+Path('/tmp/security-policy-approved-owner-execution.json').write_text(json.dumps(out,indent=2)+'\n')
+print(json.dumps(out));raise SystemExit(0 if result.returncode==0 and out.get('all_checks_pass') is True else 1)
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-source-manifest.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-source-manifest.json
new file mode 100644
index 00000000..d184afc9
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-approved-source-manifest.json
@@ -0,0 +1,212 @@
+[
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-binding.json",
+    "original_sha256": null,
+    "staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-rendered.yaml",
+    "original_sha256": null,
+    "staged_sha256": "6ea659a33cadd9ee871eda744d737cf4b477b56aeb2e1033f4354987c3125b00"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/candidate-values.yaml",
+    "original_sha256": null,
+    "staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/change_guard.py",
+    "original_sha256": null,
+    "staged_sha256": "f82b95f11ac17a747468ea5e8afd41cb741383c5d4af7609eee1903e1c33acec"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/content-review.json",
+    "original_sha256": null,
+    "staged_sha256": "0e286ce72f63df75c181131722addaf5b26d4f63dc1aa8fc9ef90e09704feb6e"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/decision-packet.md",
+    "original_sha256": null,
+    "staged_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/intake.json",
+    "original_sha256": null,
+    "staged_sha256": "eee7248c1e23a05d525c5efd541374f491754c5dad6513801d331ea468e55efa"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/lifecycle-commands.json",
+    "original_sha256": null,
+    "staged_sha256": "bd40a9b02b2a5f17686921dca7c12e8a84be2698d2e127bb10a66bfae4020764"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/live-baseline.json",
+    "original_sha256": null,
+    "staged_sha256": "c118d19b760990800ce5f2028e94b9259463722afcdb3743ac95cbeff6b8aac9"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/memo.json",
+    "original_sha256": null,
+    "staged_sha256": "fa50ea46953863ec449e827ae73bcdd06f0567f767378746b82b36e8f075a406"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/native-preflight.json",
+    "original_sha256": null,
+    "staged_sha256": "19df63011efdf8c9453d4e18d320df4895051d3a681318a09c470befc055744e"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/preflight.py",
+    "original_sha256": null,
+    "staged_sha256": "3191a97c8dbc8d79cfab8b028f5bf1e24fb765d7e72db3d327affac2bb631851"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/proposal.json",
+    "original_sha256": null,
+    "staged_sha256": "f8aff82fc7cd8b7443803351abf08b5e0590fa6daa1622d33f53429be63a2e7f"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/public-verification-plan.json",
+    "original_sha256": null,
+    "staged_sha256": "94c919b8e17f27b34aeab8dcad2d9ee8d5c45492057a3adeeb68b531da4b4ca8"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/publication-manifest.json",
+    "original_sha256": null,
+    "staged_sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/published-verification.json",
+    "original_sha256": null,
+    "staged_sha256": "7c8c4cf74ce642e31f294fadba601c3504c481e0ae34f3a59dc831c6a0496af9"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/review-refinement.json",
+    "original_sha256": null,
+    "staged_sha256": "526f5f95e3ae1be10f0ac549b9f021606b8fb522d4de5fc7a564d2435775c413"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/reviewed-publication-scope.json",
+    "original_sha256": null,
+    "staged_sha256": "007ffdffe2ea1c3984a0eadfa7726019ac742995df43a346cf447b7a9cc8038c"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-binding.json",
+    "original_sha256": null,
+    "staged_sha256": "e55fbdbc46ff7d71049742ff649d351ff326475d1355b3985b126c0e03ed7160"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/rollback-rendered.yaml",
+    "original_sha256": null,
+    "staged_sha256": "b031a6581a2107c73b12bcdfcf7cf0dd8b216b16b580e8cf8c99899a7c6c80b2"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/sealed-live-config.json",
+    "original_sha256": null,
+    "staged_sha256": "4a698751505b1bd39e05fc8095c65d28cbd811a5fed5b9076d05156c10c87d3f"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/security-summary.json",
+    "original_sha256": null,
+    "staged_sha256": "afbc38bc3792946d8c204bedbcc2c3fa25e07d918e2026a65dd7e1be07c288a2"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-inventory.json",
+    "original_sha256": null,
+    "staged_sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/source-lock.json",
+    "original_sha256": null,
+    "staged_sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_change_guard.py",
+    "original_sha256": null,
+    "staged_sha256": "3869bf841ced791679795d9fffe5161b585defa92597c5c76b76a8b8a2cbab11"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/test_verify_public.py",
+    "original_sha256": null,
+    "staged_sha256": "89cfababd5f0c1b0fcdd22c67aa236c034279d7504772603001d375cf81bc6f5"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/validation.json",
+    "original_sha256": null,
+    "staged_sha256": "1283644818fc54e6838bf98f531cf785cecaedb3e148b4f265d96fbeff4c3733"
+  },
+  {
+    "repo": "rapp-policy-nexus",
+    "path": "docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
+    "staged_path": "/tmp/policy-native-hosting-stage/rapp-policy-nexus/docs/evidence/2026-10-11-security-layer-v08-hosting-proposal/verify_public.py",
+    "original_sha256": null,
+    "staged_sha256": "c3130c9dfb47172ec6b5928f2600b924b8f1b4c0c7ff6bc1322533c3d8bcf867"
+  },
+  {
+    "repo": "railiance-apps",
+    "path": "bindings/policy-nexus-production-candidate.json",
+    "staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/bindings/policy-nexus-production-candidate.json",
+    "original_sha256": null,
+    "staged_sha256": "d6d34636e289949d1fd3debb5e2a002b9c9de485e1b462660f0818a7d1d73d22"
+  },
+  {
+    "repo": "railiance-apps",
+    "path": "values/policy-nexus-production-candidate.yaml",
+    "staged_path": "/tmp/policy-native-hosting-stage/railiance-apps/values/policy-nexus-production-candidate.yaml",
+    "original_sha256": null,
+    "staged_sha256": "6e0f5a529b450f6b8f00f6fc59c50a7e5b652520f0a370b199a49cb416fac062"
+  }
+]
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-hub-decision.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-hub-decision.json
new file mode 100644
index 00000000..c4a28e02
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-hub-decision.json
@@ -0,0 +1,18 @@
+{
+  "workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
+  "id": "99dc9648-2098-4388-89b3-9da27c02af0b",
+  "topic_id": "cee7bedf-2b48-46ef-8601-006474f2ad7a",
+  "title": "Confirmed exact Policy Nexus guardrail hosting disposition",
+  "description": "Authenticated native ACCEPT of infd-20261011-policy-nexus-hosting-r1@1, review28d16691..., approval52a3c479-2cb1-4074-abec-6a88117ad596, dispb8bfa6c0-e879-4de2-8243-f4abb9bcd011 at01:14:23Z. Exact approved packet digest076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e, image4e0db6 and three paired evidence pins; Helm transition only, no Argo adoption. Fresh sealed preflight/context/capacity and actual serving verification required; deployment not yet executed at this receipt.",
+  "decision_type": "made",
+  "status": "resolved",
+  "rationale": null,
+  "decided_by": "native authenticated human approver (confirmed informed-decision receipt)",
+  "decided_at": "2026-10-11T01:14:23Z",
+  "deadline": "2026-10-12T23:59:59Z",
+  "escalation_note": null,
+  "superseded_by": null,
+  "created_at": "2026-10-11T01:18:45.925752Z",
+  "updated_at": "2026-10-11T01:18:45.925752Z",
+  "workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-acceptance.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-acceptance.json
new file mode 100644
index 00000000..54d28ad5
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-acceptance.json
@@ -0,0 +1 @@
+{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 1, "dispositions": [{"id": null, "approval_id": null, "submission_state": "confirmed", "disposition": {"actor": {"kind": "person", "sub": "uid=platform-root,ou=people,dc=netkingdom,dc=local"}, "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596", "at": "2026-10-11T01:14:23Z", "id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "memo_version": 1, "note": null, "presentation_id": "pres-b25f8b48-396b-4052-ae9c-501d7f19ca26", "reasons": [], "verb": "accept"}, "approved_at": "2026-10-11T01:14:23+00:00", "decided_at": null}]}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-outcome.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-outcome.json
new file mode 100644
index 00000000..d00d6254
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-outcome.json
@@ -0,0 +1 @@
+{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "review": {"intake_state": "ready", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "path": "/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "disposition_count": 0, "dispositions": []}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-submission.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-submission.json
new file mode 100644
index 00000000..e77474bd
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-native-submission.json
@@ -0,0 +1 @@
+{"memo_id": "infd-20261011-policy-nexus-hosting-r1", "version": 1, "register_event_id": "b462404c-b44a-43cd-8b22-c188812b8a4e", "revision_event_id": null, "publication_event_id": "162897da-3ce3-4107-94ce-38456ce0bd87", "review_event_id": "7554fd17-b1ee-4c69-aba3-c12b171a1256", "review_memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "queue_status": "pending", "queue_detail": "queued", "workspace_url": "https://decisions.coulomb.social/decisions/infd-20261011-policy-nexus-hosting-r1?version=1", "outcome_review": {"intake_state": "not_submitted", "memo_id": "review-28d16691-3277-461e-aec6-53ad7a0538c7", "stale": false}, "human_dispositions": 0}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json
new file mode 100644
index 00000000..c0f5fe23
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-pre-actuation-failed.json
@@ -0,0 +1,24 @@
+{
+  "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
+  "approval": {
+    "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
+    "disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
+  },
+  "started_at": "2026-10-11T01:19:18.103362+00:00",
+  "raw_output_withheld": true,
+  "secret_values_observed": false,
+  "attempted_helm_upgrade": false,
+  "all_checks_pass": false,
+  "headroom": {
+    "node_ip": "92.205.62.239",
+    "free_cpu_m": 540,
+    "free_memory_mi": 6521,
+    "surge_cpu_m": 10,
+    "surge_memory_mi": 32,
+    "pressure_checks_pass": true
+  },
+  "fresh_sealed_preflight_pass": true,
+  "failure_class": "ValueError",
+  "failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
+  "decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-byte-verification.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-byte-verification.json
new file mode 100644
index 00000000..149c3217
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-byte-verification.json
@@ -0,0 +1,1114 @@
+{
+  "checks": [
+    {
+      "path": "adr/activity-core-bounded-operations/v1/index.html",
+      "expected_sha256": "ab43dc9fc3e57da6f21ebb271ba1f5190fecb396724f51c55b492502dd2f4ec2",
+      "http_status": 200,
+      "sha256": "ab43dc9fc3e57da6f21ebb271ba1f5190fecb396724f51c55b492502dd2f4ec2",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-bounded-operations/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "2c41e74508a38ba0ab9e711c7fd4052d3cbb837a15b10f1e43ca11329d10058a",
+      "http_status": 200,
+      "sha256": "2c41e74508a38ba0ab9e711c7fd4052d3cbb837a15b10f1e43ca11329d10058a",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-definition-format/v1/index.html",
+      "expected_sha256": "4724343520b13411034fdcb440c433ad916685488fc9d2595935fdd2bc26371f",
+      "http_status": 200,
+      "sha256": "4724343520b13411034fdcb440c433ad916685488fc9d2595935fdd2bc26371f",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-definition-format/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "4f77070a5ceacc7463d6e570d650649149d934b865b069cf303a829e8823fb2c",
+      "http_status": 200,
+      "sha256": "4f77070a5ceacc7463d6e570d650649149d934b865b069cf303a829e8823fb2c",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-event-bridge/v1/index.html",
+      "expected_sha256": "351f848c282870a3dd750ba2021ca593d13999880518b4347de11481a6ea833f",
+      "http_status": 200,
+      "sha256": "351f848c282870a3dd750ba2021ca593d13999880518b4347de11481a6ea833f",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-event-bridge/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "ebbe7111cc8fe75943cac3b8df625eed6675c268fb2d78de90de7766427ba032",
+      "http_status": 200,
+      "sha256": "ebbe7111cc8fe75943cac3b8df625eed6675c268fb2d78de90de7766427ba032",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-glas-profile-execution/v1/index.html",
+      "expected_sha256": "d4fda9ccae399c8c9fe5c263aa0266ea13e3da6d43e59c00c6dbf84853168942",
+      "http_status": 200,
+      "sha256": "d4fda9ccae399c8c9fe5c263aa0266ea13e3da6d43e59c00c6dbf84853168942",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-glas-profile-execution/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "fd7e88b98f1da488e38e52cdbf6fc08cd3e2e5862c9ad7a00f56fcee1da77daf",
+      "http_status": 200,
+      "sha256": "fd7e88b98f1da488e38e52cdbf6fc08cd3e2e5862c9ad7a00f56fcee1da77daf",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-ops-runs-vs-work-records/v1/index.html",
+      "expected_sha256": "2ee5c97ecd32e5c2a34521610fac51b871796a8380f648f9e06efc3caea37519",
+      "http_status": 200,
+      "sha256": "2ee5c97ecd32e5c2a34521610fac51b871796a8380f648f9e06efc3caea37519",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-ops-runs-vs-work-records/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "fb1afdaa34eed2c923d451a0ab119079abfaf3924c452bcd8bb9ab84b0b047bf",
+      "http_status": 200,
+      "sha256": "fb1afdaa34eed2c923d451a0ab119079abfaf3924c452bcd8bb9ab84b0b047bf",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-producer-trust-boundary/v1/index.html",
+      "expected_sha256": "eb29d356b52eefc6117d43aa3d23c85ca23947a84890f5f2d37c100e91f8eb93",
+      "http_status": 200,
+      "sha256": "eb29d356b52eefc6117d43aa3d23c85ca23947a84890f5f2d37c100e91f8eb93",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-producer-trust-boundary/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "da014cb4991ecb8f03458016b69595a7ef82cece8a2a1f301b9a65140c6db5fe",
+      "http_status": 200,
+      "sha256": "da014cb4991ecb8f03458016b69595a7ef82cece8a2a1f301b9a65140c6db5fe",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-rule-instruction-model/v1/index.html",
+      "expected_sha256": "d71ec09ce482561ae38e1a01ba910340e4abf687fe1850ccf2a8f2262ab66fe8",
+      "http_status": 200,
+      "sha256": "d71ec09ce482561ae38e1a01ba910340e4abf687fe1850ccf2a8f2262ab66fe8",
+      "passed": true
+    },
+    {
+      "path": "adr/activity-core-rule-instruction-model/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "99ff7ee81f42d460105a4dadc69ddd369094bde64617cb07bf850458ff0f2400",
+      "http_status": 200,
+      "sha256": "99ff7ee81f42d460105a4dadc69ddd369094bde64617cb07bf850458ff0f2400",
+      "passed": true
+    },
+    {
+      "path": "adr/addressing-and-permanence/v1/index.html",
+      "expected_sha256": "f9ffe90e425fef9c7c5f5cd5dbec263d9b09d2f03d5837981dc27d8376f4d932",
+      "http_status": 200,
+      "sha256": "f9ffe90e425fef9c7c5f5cd5dbec263d9b09d2f03d5837981dc27d8376f4d932",
+      "passed": true
+    },
+    {
+      "path": "adr/addressing-and-permanence/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "883a91470d4dcf5d1eb0f02e769081c97c2be060379235757e27a7f59c9eb824",
+      "http_status": 200,
+      "sha256": "883a91470d4dcf5d1eb0f02e769081c97c2be060379235757e27a7f59c9eb824",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-agent-runtime/v1/index.html",
+      "expected_sha256": "3e7938cae69d787c32a2f9a3375e4ebccc8be9b408d1d076808d5b8aa96fde30",
+      "http_status": 200,
+      "sha256": "3e7938cae69d787c32a2f9a3375e4ebccc8be9b408d1d076808d5b8aa96fde30",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-agent-runtime/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "ea4eae05b62d50cd8204a47c1a4f3e3e0beda571880ed1de93ccbb17987d84aa",
+      "http_status": 200,
+      "sha256": "ea4eae05b62d50cd8204a47c1a4f3e3e0beda571880ed1de93ccbb17987d84aa",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-agent-runtime/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "3e7938cae69d787c32a2f9a3375e4ebccc8be9b408d1d076808d5b8aa96fde30",
+      "http_status": 200,
+      "sha256": "3e7938cae69d787c32a2f9a3375e4ebccc8be9b408d1d076808d5b8aa96fde30",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-canon-federation/v1/index.html",
+      "expected_sha256": "992cebe70a9bfdc7e6c7e55c5d5c68d9a7ddef85784b9c0e70cbe66abf084b99",
+      "http_status": 200,
+      "sha256": "992cebe70a9bfdc7e6c7e55c5d5c68d9a7ddef85784b9c0e70cbe66abf084b99",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-canon-federation/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "e10fdd888936a997cb91d6e5df8b801f2e7be1bbd170e82087faf1d37bf6d15b",
+      "http_status": 200,
+      "sha256": "e10fdd888936a997cb91d6e5df8b801f2e7be1bbd170e82087faf1d37bf6d15b",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-connectivity-first/v1/index.html",
+      "expected_sha256": "e3619be4ade6855629a8181f8fe8fe8157f7ee7a2676070805547373894180dd",
+      "http_status": 200,
+      "sha256": "e3619be4ade6855629a8181f8fe8fe8157f7ee7a2676070805547373894180dd",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-connectivity-first/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "3db1b0f5c50543ff0fb022ea67f1d85b30f8ff691eaa1a2443220b7474b54de7",
+      "http_status": 200,
+      "sha256": "3db1b0f5c50543ff0fb022ea67f1d85b30f8ff691eaa1a2443220b7474b54de7",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-connectivity-first/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "e3619be4ade6855629a8181f8fe8fe8157f7ee7a2676070805547373894180dd",
+      "http_status": 200,
+      "sha256": "e3619be4ade6855629a8181f8fe8fe8157f7ee7a2676070805547373894180dd",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-cross-repo-workplans/v1/index.html",
+      "expected_sha256": "3b648cc46f33ec1078e42011bb4530833a5e4cbed7010fc2f4e5d34efb292958",
+      "http_status": 200,
+      "sha256": "3b648cc46f33ec1078e42011bb4530833a5e4cbed7010fc2f4e5d34efb292958",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-cross-repo-workplans/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "61804eedae4fbc82ddf86bd17a994f1e2291290d39af3d8a212b503eab0f359d",
+      "http_status": 200,
+      "sha256": "61804eedae4fbc82ddf86bd17a994f1e2291290d39af3d8a212b503eab0f359d",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-federated-namespaces/v1/index.html",
+      "expected_sha256": "45b931e7ff0611c34dc011383446450e76108fee8a69818262e4f2f98d3972ed",
+      "http_status": 200,
+      "sha256": "45b931e7ff0611c34dc011383446450e76108fee8a69818262e4f2f98d3972ed",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-federated-namespaces/v1/revisions/draft-2/index.html",
+      "expected_sha256": "b4b023c51266d152adc41d126566c55fdb6bf303047ca93d0585a4f60f8194c8",
+      "http_status": 200,
+      "sha256": "b4b023c51266d152adc41d126566c55fdb6bf303047ca93d0585a4f60f8194c8",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-hub-authority/v1/index.html",
+      "expected_sha256": "412a30d486f3941df2a67367ee5facbfa4bef1884a932ab0565b566800e9154b",
+      "http_status": 200,
+      "sha256": "412a30d486f3941df2a67367ee5facbfa4bef1884a932ab0565b566800e9154b",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-hub-authority/v1/revisions/draft-2/index.html",
+      "expected_sha256": "83eeac4536266033882082332ffa150a8df69ad7b5f6bd8bd02d1ce587844ddd",
+      "http_status": 200,
+      "sha256": "83eeac4536266033882082332ffa150a8df69ad7b5f6bd8bd02d1ce587844ddd",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-materialized-derived-state/v1/index.html",
+      "expected_sha256": "4ce241adbfdcff1e15ea51746a4cc6660287b4a9429b805da96bfa0aecb8001f",
+      "http_status": 200,
+      "sha256": "4ce241adbfdcff1e15ea51746a4cc6660287b4a9429b805da96bfa0aecb8001f",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-materialized-derived-state/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "bca06c973dcf18494b7b57071b00af5f37b2eac231f30cfac771ad49698d09d0",
+      "http_status": 200,
+      "sha256": "bca06c973dcf18494b7b57071b00af5f37b2eac231f30cfac771ad49698d09d0",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-projection-source-overlay/v1/index.html",
+      "expected_sha256": "00bd1b554e41605c361759e3bea8c74ddd336c54a3ecadbc127dac86620d88ef",
+      "http_status": 200,
+      "sha256": "00bd1b554e41605c361759e3bea8c74ddd336c54a3ecadbc127dac86620d88ef",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-projection-source-overlay/v1/revisions/1.0/index.html",
+      "expected_sha256": "63488f677010582fcbdd157fd6c10b2fa6e765db3c605605d1177e57e231f4ff",
+      "http_status": 200,
+      "sha256": "63488f677010582fcbdd157fd6c10b2fa6e765db3c605605d1177e57e231f4ff",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-workplan-identity/v1/index.html",
+      "expected_sha256": "89de424e7e1f5e845e0d403a2fbdcde8857785168403e3ac1e2e91d612b24f6f",
+      "http_status": 200,
+      "sha256": "89de424e7e1f5e845e0d403a2fbdcde8857785168403e3ac1e2e91d612b24f6f",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-workplan-identity/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "bdf9f9522a48278f36cb86cd1f79765c97ab23b7abef94b5de2dada77dfc9e84",
+      "http_status": 200,
+      "sha256": "bdf9f9522a48278f36cb86cd1f79765c97ab23b7abef94b5de2dada77dfc9e84",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-workplans-as-repo-artefacts/v1/index.html",
+      "expected_sha256": "c1d30034131f2fa0ed9c7335530ee442fdd7fc7a4e4c5bcdae31aae11f4fdc4f",
+      "http_status": 200,
+      "sha256": "c1d30034131f2fa0ed9c7335530ee442fdd7fc7a4e4c5bcdae31aae11f4fdc4f",
+      "passed": true
+    },
+    {
+      "path": "adr/custodian-workplans-as-repo-artefacts/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "c8f76626fcdaf5d777b966082620071c7b005ebe85c8dcef2f9c899521edf28e",
+      "http_status": 200,
+      "sha256": "c8f76626fcdaf5d777b966082620071c7b005ebe85c8dcef2f9c899521edf28e",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-iam-profile-governance/v1/index.html",
+      "expected_sha256": "daf979bd830c883181e4c4f97f80e600356e20eaa4a5badfbf0ce25b0f441346",
+      "http_status": 200,
+      "sha256": "daf979bd830c883181e4c4f97f80e600356e20eaa4a5badfbf0ce25b0f441346",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-iam-profile-governance/v1/revisions/1/index.html",
+      "expected_sha256": "3d75a914645d4c7bd2aaea7c9ebb3d1d22d491e1ebdd3cc84a8a3c7ad44ede1b",
+      "http_status": 200,
+      "sha256": "3d75a914645d4c7bd2aaea7c9ebb3d1d22d491e1ebdd3cc84a8a3c7ad44ede1b",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-object-storage-sts-credential-vending/v1/index.html",
+      "expected_sha256": "5c4cfad5787e352912916b11bcb8b32ec3d7930c88e6e9ff72c63b4c22f6d9e0",
+      "http_status": 200,
+      "sha256": "5c4cfad5787e352912916b11bcb8b32ec3d7930c88e6e9ff72c63b4c22f6d9e0",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-object-storage-sts-credential-vending/v1/revisions/1/index.html",
+      "expected_sha256": "6a9a2b2249de33ff1342e027829f6cf2ce55dd067758c1cb63c8d2cd8e528f9b",
+      "http_status": 200,
+      "sha256": "6a9a2b2249de33ff1342e027829f6cf2ce55dd067758c1cb63c8d2cd8e528f9b",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-orchestration-dependency-intent/v1/index.html",
+      "expected_sha256": "bb07bff54c2d933e0e580d7f194fc60c19443c9639f0f7cbaf8855a094baa199",
+      "http_status": 200,
+      "sha256": "bb07bff54c2d933e0e580d7f194fc60c19443c9639f0f7cbaf8855a094baa199",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-orchestration-dependency-intent/v1/revisions/1/index.html",
+      "expected_sha256": "be883fd0ad350fd0bb7991304fa29056485e1a9f95a61f8472e6b335261c4922",
+      "http_status": 200,
+      "sha256": "be883fd0ad350fd0bb7991304fa29056485e1a9f95a61f8472e6b335261c4922",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-playbook-capability-ownership/v1/index.html",
+      "expected_sha256": "a0a8d5723faed0d6fbab4fd72f95707dc0440a6a1dda49b44e613cc4d4e2755b",
+      "http_status": 200,
+      "sha256": "a0a8d5723faed0d6fbab4fd72f95707dc0440a6a1dda49b44e613cc4d4e2755b",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-playbook-capability-ownership/v1/revisions/1/index.html",
+      "expected_sha256": "f64f93bcc0d527e5a782a599bf4e61374fcac9ded2c1a1e9003176de374a03fa",
+      "http_status": 200,
+      "sha256": "f64f93bcc0d527e5a782a599bf4e61374fcac9ded2c1a1e9003176de374a03fa",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-railiance-workload-packaging/v1/index.html",
+      "expected_sha256": "ad82f3083f8ffbc2d5af488f474300a7d1d48abbffdd583d8d898c7b468b4b5f",
+      "http_status": 200,
+      "sha256": "ad82f3083f8ffbc2d5af488f474300a7d1d48abbffdd583d8d898c7b468b4b5f",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-railiance-workload-packaging/v1/revisions/1/index.html",
+      "expected_sha256": "826db77b95bccd3bbb169808aebab17f6a511405b03d4d05c04c79be2e49f3aa",
+      "http_status": 200,
+      "sha256": "826db77b95bccd3bbb169808aebab17f6a511405b03d4d05c04c79be2e49f3aa",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-recursive-multi-tenant-identity-authorization/v1/index.html",
+      "expected_sha256": "d0312ac36af5dba1d708cc34ad312c5799c5254906c8c530835c1a920620c338",
+      "http_status": 200,
+      "sha256": "d0312ac36af5dba1d708cc34ad312c5799c5254906c8c530835c1a920620c338",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-recursive-multi-tenant-identity-authorization/v1/revisions/1/index.html",
+      "expected_sha256": "97070487ddd5d14bd85e68ae2e02f2512a3ad997352b384c0df344be48b3394c",
+      "http_status": 200,
+      "sha256": "97070487ddd5d14bd85e68ae2e02f2512a3ad997352b384c0df344be48b3394c",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-security-orchestration-boundary/v1/index.html",
+      "expected_sha256": "1cda50180a150bb26b35766b43f1e586d5d360580af78bb7c574f6b64fa8dcbd",
+      "http_status": 200,
+      "sha256": "1cda50180a150bb26b35766b43f1e586d5d360580af78bb7c574f6b64fa8dcbd",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-security-orchestration-boundary/v1/revisions/1/index.html",
+      "expected_sha256": "15056fedbd58e65e7c2b16cb5ea6d1c5f23cd23b1162c59e3e29500f8075ff3c",
+      "http_status": 200,
+      "sha256": "15056fedbd58e65e7c2b16cb5ea6d1c5f23cd23b1162c59e3e29500f8075ff3c",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-tenant-capability-ownership/v1/index.html",
+      "expected_sha256": "a3fdcdf5966a1545fd587158ef746edd4792ae879c799e571760355947314f7e",
+      "http_status": 200,
+      "sha256": "a3fdcdf5966a1545fd587158ef746edd4792ae879c799e571760355947314f7e",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-tenant-capability-ownership/v1/revisions/1/index.html",
+      "expected_sha256": "6d2c05eb1fd48b27d2236ca7006e593bf8747df47e72952c947cbcda9ea0456f",
+      "http_status": 200,
+      "sha256": "6d2c05eb1fd48b27d2236ca7006e593bf8747df47e72952c947cbcda9ea0456f",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-tenant-onboarding-taxonomy/v1/index.html",
+      "expected_sha256": "24451e053340a000ddb53f756573e29635c9bd4670538a44cb39c650dc97465f",
+      "http_status": 200,
+      "sha256": "24451e053340a000ddb53f756573e29635c9bd4670538a44cb39c650dc97465f",
+      "passed": true
+    },
+    {
+      "path": "adr/netkingdom-tenant-onboarding-taxonomy/v1/revisions/2/index.html",
+      "expected_sha256": "c0b6997e551dba96b07eea3e78fca10f1760104494143606847fa74ccfdde53a",
+      "http_status": 200,
+      "sha256": "c0b6997e551dba96b07eea3e78fca10f1760104494143606847fa74ccfdde53a",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-build-stage-credential-disclosure/v1/index.html",
+      "expected_sha256": "1ebbadef38f1f931adc7196a778511410a873490f2bdc2004cb2929cec897aa7",
+      "http_status": 200,
+      "sha256": "1ebbadef38f1f931adc7196a778511410a873490f2bdc2004cb2929cec897aa7",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-build-stage-credential-disclosure/v1/revisions/1/index.html",
+      "expected_sha256": "a6ad7d6fb4fadc21e6e6755225745733780b13755b28d4d706c614b9269003aa",
+      "http_status": 200,
+      "sha256": "a6ad7d6fb4fadc21e6e6755225745733780b13755b28d4d706c614b9269003aa",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-catalog-pointer-layer/v1/index.html",
+      "expected_sha256": "2d2a7516e360a778c1ee8cd1ef80c0b03f0011f7f3884c54234cf7ae70c056e8",
+      "http_status": 200,
+      "sha256": "2d2a7516e360a778c1ee8cd1ef80c0b03f0011f7f3884c54234cf7ae70c056e8",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-catalog-pointer-layer/v1/revisions/1/index.html",
+      "expected_sha256": "1c0fb4914894de9aae6fa9549d5b6e0ae2dcb401cb50e70febb481a93cf5acdf",
+      "http_status": 200,
+      "sha256": "1c0fb4914894de9aae6fa9549d5b6e0ae2dcb401cb50e70febb481a93cf5acdf",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-conduit-not-broker/v1/index.html",
+      "expected_sha256": "1fd85de08037d0dde443d9742dbb57e865ee5c04e1bd7187f897a6a036523c3b",
+      "http_status": 200,
+      "sha256": "1fd85de08037d0dde443d9742dbb57e865ee5c04e1bd7187f897a6a036523c3b",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-conduit-not-broker/v1/revisions/1/index.html",
+      "expected_sha256": "3484b554239c617d438325ab8e87a744ac24797f6e665cb2da9562060841b352",
+      "http_status": 200,
+      "sha256": "3484b554239c617d438325ab8e87a744ac24797f6e665cb2da9562060841b352",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-cover-gaps/v1/index.html",
+      "expected_sha256": "a5bcd9987b1f9cbcae814fd74fa506cbd56c7055cef0b39899680f4fbfe8231d",
+      "http_status": 200,
+      "sha256": "a5bcd9987b1f9cbcae814fd74fa506cbd56c7055cef0b39899680f4fbfe8231d",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-cover-gaps/v1/revisions/1/index.html",
+      "expected_sha256": "6deb88e23100298841f7022f1ab81376862073293ab1edefe9e4b6ad32e45163",
+      "http_status": 200,
+      "sha256": "6deb88e23100298841f7022f1ab81376862073293ab1edefe9e4b6ad32e45163",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-grade-disclosure-path/v1/index.html",
+      "expected_sha256": "19f8d1ce6d59210775ae8f86d7e323fe7d793e4376dada80cbc08aed3ee6862c",
+      "http_status": 200,
+      "sha256": "19f8d1ce6d59210775ae8f86d7e323fe7d793e4376dada80cbc08aed3ee6862c",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-grade-disclosure-path/v1/revisions/1/index.html",
+      "expected_sha256": "b0129596a06884b2d34a74adfac4b08e3bd2e1af6ab8856d5bd4d50b4496a66c",
+      "http_status": 200,
+      "sha256": "b0129596a06884b2d34a74adfac4b08e3bd2e1af6ab8856d5bd4d50b4496a66c",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-high-risk-read-boundary/v1/index.html",
+      "expected_sha256": "f9e60e6092f6ebd42827e75c55502cc53e5a49edf6a91d6251fdfb35543b61ea",
+      "http_status": 200,
+      "sha256": "f9e60e6092f6ebd42827e75c55502cc53e5a49edf6a91d6251fdfb35543b61ea",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-high-risk-read-boundary/v1/revisions/1/index.html",
+      "expected_sha256": "830b886a57017d5e5feb1e39289bc13eec389dacc2f0072812ff45e76f735590",
+      "http_status": 200,
+      "sha256": "830b886a57017d5e5feb1e39289bc13eec389dacc2f0072812ff45e76f735590",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-high-risk-read-boundary/v1/revisions/2/index.html",
+      "expected_sha256": "f9e60e6092f6ebd42827e75c55502cc53e5a49edf6a91d6251fdfb35543b61ea",
+      "http_status": 200,
+      "sha256": "f9e60e6092f6ebd42827e75c55502cc53e5a49edf6a91d6251fdfb35543b61ea",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-implement-narrowly/v1/index.html",
+      "expected_sha256": "e5dc2f0096c2839002c2411a320f4c2ae009c870e768ce82f34eaeeabfa0c53f",
+      "http_status": 200,
+      "sha256": "e5dc2f0096c2839002c2411a320f4c2ae009c870e768ce82f34eaeeabfa0c53f",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-implement-narrowly/v1/revisions/1/index.html",
+      "expected_sha256": "4ea223b2f0105372a3d6868486480ce549926808658aaa1606dbde510f7ddb78",
+      "http_status": 200,
+      "sha256": "4ea223b2f0105372a3d6868486480ce549926808658aaa1606dbde510f7ddb78",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-security-zones-consumer/v1/index.html",
+      "expected_sha256": "46579d5aac4da286b95484b9429f19e96e0f96541126cc8137ff536c42052b7c",
+      "http_status": 200,
+      "sha256": "46579d5aac4da286b95484b9429f19e96e0f96541126cc8137ff536c42052b7c",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-security-zones-consumer/v1/revisions/1/index.html",
+      "expected_sha256": "533a14b26081a1d88fa9c2fb0c7ea9bfde542e452cc989a68b5da33b0e024510",
+      "http_status": 200,
+      "sha256": "533a14b26081a1d88fa9c2fb0c7ea9bfde542e452cc989a68b5da33b0e024510",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-staff-layer/v1/index.html",
+      "expected_sha256": "4f85780ebf7ab5e61fc1d2d15992333c933de666704337c1283a7a8d4293c882",
+      "http_status": 200,
+      "sha256": "4f85780ebf7ab5e61fc1d2d15992333c933de666704337c1283a7a8d4293c882",
+      "passed": true
+    },
+    {
+      "path": "adr/ops-warden-staff-layer/v1/revisions/1/index.html",
+      "expected_sha256": "91727be45934f64eb5f98cb995fcea9f76bb219e1c6bec197e8937f8ea82f6b1",
+      "http_status": 200,
+      "sha256": "91727be45934f64eb5f98cb995fcea9f76bb219e1c6bec197e8937f8ea82f6b1",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-decisions-live-in-the-repo/v1/index.html",
+      "expected_sha256": "41a11ad7c4450ced6831e7565daf6879263bed7b588cd1ef4fec75a2ef15e68c",
+      "http_status": 200,
+      "sha256": "41a11ad7c4450ced6831e7565daf6879263bed7b588cd1ef4fec75a2ef15e68c",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-decisions-live-in-the-repo/v1/revisions/1.0/index.html",
+      "expected_sha256": "ac49cddc344d6937dfdb0ba89f15bcad96bca1c6c360b0cc1c1e5632c69560e5",
+      "http_status": 200,
+      "sha256": "ac49cddc344d6937dfdb0ba89f15bcad96bca1c6c360b0cc1c1e5632c69560e5",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-derived-rail-composition/v1/index.html",
+      "expected_sha256": "67f14e707247d126d22f906b8d3342549b9fe69ad15aa8d02f3bf6d42f7f412b",
+      "http_status": 200,
+      "sha256": "67f14e707247d126d22f906b8d3342549b9fe69ad15aa8d02f3bf6d42f7f412b",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-derived-rail-composition/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "9bc8dea9ae3fdc3a97ca78f388ef992d9966040e253fb7cc983b5efca78c4728",
+      "http_status": 200,
+      "sha256": "9bc8dea9ae3fdc3a97ca78f388ef992d9966040e253fb7cc983b5efca78c4728",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-first-wave-reef-rollout/v1/index.html",
+      "expected_sha256": "5e4f6f82d2bbc18c1a6347d371649026f4d199745c685695b752a3a869b8e8a1",
+      "http_status": 200,
+      "sha256": "5e4f6f82d2bbc18c1a6347d371649026f4d199745c685695b752a3a869b8e8a1",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-first-wave-reef-rollout/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "39274457b44e6ce0f4f5493272ad0022821ce86c190d42a0ed02d6d0131e637e",
+      "http_status": 200,
+      "sha256": "39274457b44e6ce0f4f5493272ad0022821ce86c190d42a0ed02d6d0131e637e",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-k3s-api-tunnel-only/v1/index.html",
+      "expected_sha256": "c9c7bd1061a2c2a8f37bcb126f19fcbc4bd8892bb64acef638b96efec0dc2a75",
+      "http_status": 200,
+      "sha256": "c9c7bd1061a2c2a8f37bcb126f19fcbc4bd8892bb64acef638b96efec0dc2a75",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-k3s-api-tunnel-only/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "ce55375217dd70e253f422ad6ed29006d99a64fec64ea16b2d6544ddd812654e",
+      "http_status": 200,
+      "sha256": "ce55375217dd70e253f422ad6ed29006d99a64fec64ea16b2d6544ddd812654e",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-netkingdom-security-layer-interaction/v1/index.html",
+      "expected_sha256": "243ce8e88610ef88056d47c2bd5ee92b535b743a30ec1590a9aead13895ff11b",
+      "http_status": 200,
+      "sha256": "243ce8e88610ef88056d47c2bd5ee92b535b743a30ec1590a9aead13895ff11b",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-netkingdom-security-layer-interaction/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "0a91e1d4fac1ebda5dc383c9f750d307dc29ef81789ac26d3c2659d58666b897",
+      "http_status": 200,
+      "sha256": "0a91e1d4fac1ebda5dc383c9f750d307dc29ef81789ac26d3c2659d58666b897",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-placement-policy-ownership/v1/index.html",
+      "expected_sha256": "a236962f1493b7bbd0679b0897c80e4a3db0e1ae85958c074065e2771985a820",
+      "http_status": 200,
+      "sha256": "a236962f1493b7bbd0679b0897c80e4a3db0e1ae85958c074065e2771985a820",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-placement-policy-ownership/v1/revisions/1.0/index.html",
+      "expected_sha256": "6abef6687e89a35352aa283d930c2dfdfd566cd4881a1859fdc7597214431be8",
+      "http_status": 200,
+      "sha256": "6abef6687e89a35352aa283d930c2dfdfd566cd4881a1859fdc7597214431be8",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-private-by-default-exposure/v1/index.html",
+      "expected_sha256": "0a62d8368b0e4216985987b689faa5651ae14332664ecfbf54425845f07adf6d",
+      "http_status": 200,
+      "sha256": "0a62d8368b0e4216985987b689faa5651ae14332664ecfbf54425845f07adf6d",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-private-by-default-exposure/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "5c913da6b1e0c223bbe197d50f0f71dbf2e9c283ab7193758cf4567e059047ba",
+      "http_status": 200,
+      "sha256": "5c913da6b1e0c223bbe197d50f0f71dbf2e9c283ab7193758cf4567e059047ba",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rail-kubernetes-wave-1-boundary/v1/index.html",
+      "expected_sha256": "8f606d840935de029139c75de4e504cd006cb5e06074abfd45a0e2992dca69b7",
+      "http_status": 200,
+      "sha256": "8f606d840935de029139c75de4e504cd006cb5e06074abfd45a0e2992dca69b7",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rail-kubernetes-wave-1-boundary/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "bf60c98f5cb2e2e01e4c03bc8adb0059f041cfc894f2d1e5e086f2b7e1912c64",
+      "http_status": 200,
+      "sha256": "bf60c98f5cb2e2e01e4c03bc8adb0059f041cfc894f2d1e5e086f2b7e1912c64",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rapp-declaration-contract/v1/index.html",
+      "expected_sha256": "a5bb562cf37626deae56120acdde9d5c0c33fe76e8357746353cdf738c674f16",
+      "http_status": 200,
+      "sha256": "a5bb562cf37626deae56120acdde9d5c0c33fe76e8357746353cdf738c674f16",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rapp-declaration-contract/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "fdb4bedcc9120932e8c2792956c603f9fa45a6b06ebe30c92b7661c62cd0a0e6",
+      "http_status": 200,
+      "sha256": "fdb4bedcc9120932e8c2792956c603f9fa45a6b06ebe30c92b7661c62cd0a0e6",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rapp-first-wave-selection/v1/index.html",
+      "expected_sha256": "56c97200598f98f1d8813ff1eb633586839a2c5a79d023a98b7899cd3d04caef",
+      "http_status": 200,
+      "sha256": "56c97200598f98f1d8813ff1eb633586839a2c5a79d023a98b7899cd3d04caef",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-rapp-first-wave-selection/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "baab701edeb557dd1c971a802952b9f038ddeb8b88c92324b338988e6261ec7a",
+      "http_status": 200,
+      "sha256": "baab701edeb557dd1c971a802952b9f038ddeb8b88c92324b338988e6261ec7a",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-reef-production-admission/v1/index.html",
+      "expected_sha256": "1ed3afee0dcfb892cf67258f5b9d25389022ab306b71f695f9c5b72a4eb7f478",
+      "http_status": 200,
+      "sha256": "1ed3afee0dcfb892cf67258f5b9d25389022ab306b71f695f9c5b72a4eb7f478",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-reef-production-admission/v1/revisions/accepted-2/index.html",
+      "expected_sha256": "051b11d1f82a21775aa4328b39385d43649ddf7a267cb12d691c17feff07161b",
+      "http_status": 200,
+      "sha256": "051b11d1f82a21775aa4328b39385d43649ddf7a267cb12d691c17feff07161b",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-reef-production-admission/v1/revisions/accepted-3/index.html",
+      "expected_sha256": "1ed3afee0dcfb892cf67258f5b9d25389022ab306b71f695f9c5b72a4eb7f478",
+      "http_status": 200,
+      "sha256": "1ed3afee0dcfb892cf67258f5b9d25389022ab306b71f695f9c5b72a4eb7f478",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-repository-prefix/v1/index.html",
+      "expected_sha256": "4e21ca2c5969caa7b5d6a3884ef08fa7ef095d8a135e54196ba4bacc21582c2d",
+      "http_status": 200,
+      "sha256": "4e21ca2c5969caa7b5d6a3884ef08fa7ef095d8a135e54196ba4bacc21582c2d",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-repository-prefix/v1/revisions/accepted-1/index.html",
+      "expected_sha256": "f005c4645fd09709ea4fb6ed24e080e6dc8dd6975e3a87ccc495b6516195ac18",
+      "http_status": 200,
+      "sha256": "f005c4645fd09709ea4fb6ed24e080e6dc8dd6975e3a87ccc495b6516195ac18",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-s3-platform-service-boundary/v1/index.html",
+      "expected_sha256": "8d9b19fb364f46edb78024170d5fa7334c1f8874e40badcf0ecf514ab560ee9f",
+      "http_status": 200,
+      "sha256": "8d9b19fb364f46edb78024170d5fa7334c1f8874e40badcf0ecf514ab560ee9f",
+      "passed": true
+    },
+    {
+      "path": "adr/railiance-s3-platform-service-boundary/v1/revisions/1.0/index.html",
+      "expected_sha256": "1fd07544a0a0f59087c5cbae908a2b883455e40b81bdb062305c33c646812708",
+      "http_status": 200,
+      "sha256": "1fd07544a0a0f59087c5cbae908a2b883455e40b81bdb062305c33c646812708",
+      "passed": true
+    },
+    {
+      "path": "architecture/coulomb-estate/v0.1/index.html",
+      "expected_sha256": "97ddf92ff7a0815f3ed27287f094eaf49013247e1d62cdcd01c1856a761ec7c0",
+      "http_status": 200,
+      "sha256": "97ddf92ff7a0815f3ed27287f094eaf49013247e1d62cdcd01c1856a761ec7c0",
+      "passed": true
+    },
+    {
+      "path": "architecture/coulomb-estate/v0.1/revisions/draft-3/index.html",
+      "expected_sha256": "bac4d0ac08eaf5a64d8e0b3363e091e2426de99a2e5054b6812c650084dd3dd8",
+      "http_status": 200,
+      "sha256": "bac4d0ac08eaf5a64d8e0b3363e091e2426de99a2e5054b6812c650084dd3dd8",
+      "passed": true
+    },
+    {
+      "path": "architecture/net-kingdom/v0.1/index.html",
+      "expected_sha256": "d8b42663ff91a0e344ec0111849c2b31b890a85bf5a84bb57a89f747587c6df6",
+      "http_status": 200,
+      "sha256": "d8b42663ff91a0e344ec0111849c2b31b890a85bf5a84bb57a89f747587c6df6",
+      "passed": true
+    },
+    {
+      "path": "architecture/net-kingdom/v0.1/revisions/draft-3/index.html",
+      "expected_sha256": "827f197303b1074e022dd60af8e9e0245d01b6785bc039e21cb7c527805f7010",
+      "http_status": 200,
+      "sha256": "827f197303b1074e022dd60af8e9e0245d01b6785bc039e21cb7c527805f7010",
+      "passed": true
+    },
+    {
+      "path": "architecture/net-kingdom/v0.1/revisions/draft-4/index.html",
+      "expected_sha256": "d8b42663ff91a0e344ec0111849c2b31b890a85bf5a84bb57a89f747587c6df6",
+      "http_status": 200,
+      "sha256": "d8b42663ff91a0e344ec0111849c2b31b890a85bf5a84bb57a89f747587c6df6",
+      "passed": true
+    },
+    {
+      "path": "architecture/policy-nexus/v0.1/index.html",
+      "expected_sha256": "a485497737eba24661193222394979ef2338e071d040e4d034a09a314ad98746",
+      "http_status": 200,
+      "sha256": "a485497737eba24661193222394979ef2338e071d040e4d034a09a314ad98746",
+      "passed": true
+    },
+    {
+      "path": "architecture/policy-nexus/v0.1/revisions/draft-1/index.html",
+      "expected_sha256": "1fe8e9ddfee222c1d3604f5a37a3b34b1274344dfb5233b1d9f52c98aaa944e6",
+      "http_status": 200,
+      "sha256": "1fe8e9ddfee222c1d3604f5a37a3b34b1274344dfb5233b1d9f52c98aaa944e6",
+      "passed": true
+    },
+    {
+      "path": "architecture/railiance/v0.1/index.html",
+      "expected_sha256": "4a05fb79c324aeee1e7056f9da5ad78e18c4bfdaabd777d311e767d9f8b64b7e",
+      "http_status": 200,
+      "sha256": "4a05fb79c324aeee1e7056f9da5ad78e18c4bfdaabd777d311e767d9f8b64b7e",
+      "passed": true
+    },
+    {
+      "path": "architecture/railiance/v0.1/revisions/draft-3/index.html",
+      "expected_sha256": "4bfde5ce9935572f1b0c38368877605d35a30b8d822ad7735697462aa4e5318e",
+      "http_status": 200,
+      "sha256": "4bfde5ce9935572f1b0c38368877605d35a30b8d822ad7735697462aa4e5318e",
+      "passed": true
+    },
+    {
+      "path": "architecture/state-hub/v0.1/index.html",
+      "expected_sha256": "1281c6c65e37a6fd62051f9c36ccc528119bf4eb2c32b69bdd3e3d3c4b6904a6",
+      "http_status": 200,
+      "sha256": "1281c6c65e37a6fd62051f9c36ccc528119bf4eb2c32b69bdd3e3d3c4b6904a6",
+      "passed": true
+    },
+    {
+      "path": "architecture/state-hub/v0.1/revisions/draft-3/index.html",
+      "expected_sha256": "0430e83028f33b966e72f637f7b12acbcfa58a60810c0f6aaa2cfe3afc253c41",
+      "http_status": 200,
+      "sha256": "0430e83028f33b966e72f637f7b12acbcfa58a60810c0f6aaa2cfe3afc253c41",
+      "passed": true
+    },
+    {
+      "path": "findings/audit-retention-legal-basis/v1/index.html",
+      "expected_sha256": "c28612bb362b9158907e6cecb05edc85c391b124847718d94bad8bd4187cbc3b",
+      "http_status": 200,
+      "sha256": "c28612bb362b9158907e6cecb05edc85c391b124847718d94bad8bd4187cbc3b",
+      "passed": true
+    },
+    {
+      "path": "findings/audit-retention-legal-basis/v1/revisions/published-1/index.html",
+      "expected_sha256": "c6aee9543f8ef21964b8fe0cd966dfc4ac49b17958d258bef6b580210be08656",
+      "http_status": 200,
+      "sha256": "c6aee9543f8ef21964b8fe0cd966dfc4ac49b17958d258bef6b580210be08656",
+      "passed": true
+    },
+    {
+      "path": "findings/audit-retention-legal-basis/v1/revisions/published-2/index.html",
+      "expected_sha256": "c28612bb362b9158907e6cecb05edc85c391b124847718d94bad8bd4187cbc3b",
+      "http_status": 200,
+      "sha256": "c28612bb362b9158907e6cecb05edc85c391b124847718d94bad8bd4187cbc3b",
+      "passed": true
+    },
+    {
+      "path": "findings/flex-auth-unauthenticated-check/v1/index.html",
+      "expected_sha256": "ccef2242ccbee6c56efe79c791798340b779950d96bf5acd0db454d9fe26e294",
+      "http_status": 200,
+      "sha256": "ccef2242ccbee6c56efe79c791798340b779950d96bf5acd0db454d9fe26e294",
+      "passed": true
+    },
+    {
+      "path": "findings/flex-auth-unauthenticated-check/v1/revisions/published-1/index.html",
+      "expected_sha256": "adfc18f51f4defb529c5529669eb33bf283a4d9c6da78f26bc8cd73cddad85b7",
+      "http_status": 200,
+      "sha256": "adfc18f51f4defb529c5529669eb33bf283a4d9c6da78f26bc8cd73cddad85b7",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-dependencies/v1/index.html",
+      "expected_sha256": "1f34914b721d184ab58a45ae8c3ea766ed492efc551b2cfffa1e51522c47f49c",
+      "http_status": 200,
+      "sha256": "1f34914b721d184ab58a45ae8c3ea766ed492efc551b2cfffa1e51522c47f49c",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-dependencies/v1/revisions/adopted-1/index.html",
+      "expected_sha256": "24f29c04622f13156a1c6d69c0f98843e00d2d12cdbf506bf6a260d67b00d4e4",
+      "http_status": 200,
+      "sha256": "24f29c04622f13156a1c6d69c0f98843e00d2d12cdbf506bf6a260d67b00d4e4",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-disclosure/v1/index.html",
+      "expected_sha256": "1acaa63359d190d6ba6b00611d8773dd9be994ff91aec71cb83accdb965c6577",
+      "http_status": 200,
+      "sha256": "1acaa63359d190d6ba6b00611d8773dd9be994ff91aec71cb83accdb965c6577",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-disclosure/v1/revisions/adopted-1/index.html",
+      "expected_sha256": "f0e2eaabe65543725f54b4701ea3a1efdbc936006ee9d309650feb21cbc593ca",
+      "http_status": 200,
+      "sha256": "f0e2eaabe65543725f54b4701ea3a1efdbc936006ee9d309650feb21cbc593ca",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-review/v1/index.html",
+      "expected_sha256": "af2e11326623c0e282d138f27357f329ba1746efe914e966e9d790b954608b32",
+      "http_status": 200,
+      "sha256": "af2e11326623c0e282d138f27357f329ba1746efe914e966e9d790b954608b32",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-review/v1/revisions/adopted-1/index.html",
+      "expected_sha256": "64e707283c19bc46bf41b03c266ee6b625824696dcfc35dc83333b43e1662f8e",
+      "http_status": 200,
+      "sha256": "64e707283c19bc46bf41b03c266ee6b625824696dcfc35dc83333b43e1662f8e",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-severity/v1/index.html",
+      "expected_sha256": "2f63cfe9b88b903132fb8b96013546291ef8ddae91c0033c298a76c1fcd54de0",
+      "http_status": 200,
+      "sha256": "2f63cfe9b88b903132fb8b96013546291ef8ddae91c0033c298a76c1fcd54de0",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-severity/v1/revisions/adopted-1/index.html",
+      "expected_sha256": "8073cd40f67197fe093ce1173bcc0a9ce1e7170c157dd88726997fff1cb791e6",
+      "http_status": 200,
+      "sha256": "8073cd40f67197fe093ce1173bcc0a9ce1e7170c157dd88726997fff1cb791e6",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-verification/v1/index.html",
+      "expected_sha256": "f04e996e56df90dd8d7317fd710a1770b242e41e52bf79551039764a9e8317bc",
+      "http_status": 200,
+      "sha256": "f04e996e56df90dd8d7317fd710a1770b242e41e52bf79551039764a9e8317bc",
+      "passed": true
+    },
+    {
+      "path": "methods/risk-verification/v1/revisions/adopted-1/index.html",
+      "expected_sha256": "e6219a88daef48fd715d7c8092d2db6e5eda8f4d44dcbf9a0b7d975227237b92",
+      "http_status": 200,
+      "sha256": "e6219a88daef48fd715d7c8092d2db6e5eda8f4d44dcbf9a0b7d975227237b92",
+      "passed": true
+    },
+    {
+      "path": "publication-manifest.json",
+      "expected_sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
+      "http_status": 200,
+      "sha256": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
+      "passed": true
+    },
+    {
+      "path": "source-inventory.json",
+      "expected_sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
+      "http_status": 200,
+      "sha256": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
+      "passed": true
+    },
+    {
+      "path": "source-lock.json",
+      "expected_sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40",
+      "http_status": 200,
+      "sha256": "99c695f46a54ead4cfe8f560f3648bf4db19404fe198b156c740115c97d3ed40",
+      "passed": true
+    },
+    {
+      "path": "standards/autonomy-lanes/v0.1/index.html",
+      "expected_sha256": "5a9ccc831d60225e76a8ff3053034360d6672f6891cd5f6aaaa5bb0e66e160af",
+      "http_status": 200,
+      "sha256": "5a9ccc831d60225e76a8ff3053034360d6672f6891cd5f6aaaa5bb0e66e160af",
+      "passed": true
+    },
+    {
+      "path": "standards/autonomy-lanes/v0.1/revisions/accepted-1/index.html",
+      "expected_sha256": "aec0623d3e2a81d6141120906e97efbae941f7b2b5704ad42634484702932b13",
+      "http_status": 200,
+      "sha256": "aec0623d3e2a81d6141120906e97efbae941f7b2b5704ad42634484702932b13",
+      "passed": true
+    },
+    {
+      "path": "standards/contribution-convention/v0.1/index.html",
+      "expected_sha256": "aeb3e5fd208fb245d29c116a5d194bdb71eeb69a335829c292e9be85951ee1ee",
+      "http_status": 200,
+      "sha256": "aeb3e5fd208fb245d29c116a5d194bdb71eeb69a335829c292e9be85951ee1ee",
+      "passed": true
+    },
+    {
+      "path": "standards/contribution-convention/v0.1/revisions/accepted-1/index.html",
+      "expected_sha256": "0b8aa643a908ba780ce231cd5628d10035697004d2ac512b9d60c32077cd936e",
+      "http_status": 200,
+      "sha256": "0b8aa643a908ba780ce231cd5628d10035697004d2ac512b9d60c32077cd936e",
+      "passed": true
+    },
+    {
+      "path": "standards/iam-profile/v0.3/index.html",
+      "expected_sha256": "7712d495851593ee86bd979d314e887a1a4cf38bfbac44e1a444c007adda4e2b",
+      "http_status": 200,
+      "sha256": "7712d495851593ee86bd979d314e887a1a4cf38bfbac44e1a444c007adda4e2b",
+      "passed": true
+    },
+    {
+      "path": "standards/iam-profile/v0.3/revisions/accepted-1/index.html",
+      "expected_sha256": "b020f882093fbb0fa8290d4c09be665c3ed3b157522ec2f7231652e525019875",
+      "http_status": 200,
+      "sha256": "b020f882093fbb0fa8290d4c09be665c3ed3b157522ec2f7231652e525019875",
+      "passed": true
+    },
+    {
+      "path": "standards/posture-feedback/v0.1/index.html",
+      "expected_sha256": "4237cd01da82f0243bcc7561082bf19e535cac771b9b7f6f41415f229a1fd0ce",
+      "http_status": 200,
+      "sha256": "4237cd01da82f0243bcc7561082bf19e535cac771b9b7f6f41415f229a1fd0ce",
+      "passed": true
+    },
+    {
+      "path": "standards/posture-feedback/v0.1/revisions/0.1/index.html",
+      "expected_sha256": "54c14e25e018593d83df5f4b69a8316c0f1082460f94e5a0fbc80ecf61089d3b",
+      "http_status": 200,
+      "sha256": "54c14e25e018593d83df5f4b69a8316c0f1082460f94e5a0fbc80ecf61089d3b",
+      "passed": true
+    },
+    {
+      "path": "standards/project-repository-flavor/v0.1/index.html",
+      "expected_sha256": "dffddd9b2bdb30756593c493b31b5a888adedf3c3758e7edd8f62d9a33b46e5c",
+      "http_status": 200,
+      "sha256": "dffddd9b2bdb30756593c493b31b5a888adedf3c3758e7edd8f62d9a33b46e5c",
+      "passed": true
+    },
+    {
+      "path": "standards/project-repository-flavor/v0.1/revisions/accepted-1/index.html",
+      "expected_sha256": "cc5cdbaa875338b08a7ffed743121df16f002ada0b5a70268d32448ead57b2eb",
+      "http_status": 200,
+      "sha256": "cc5cdbaa875338b08a7ffed743121df16f002ada0b5a70268d32448ead57b2eb",
+      "passed": true
+    },
+    {
+      "path": "standards/security-layer-model/v0.7/index.html",
+      "expected_sha256": "6e95787451ebf6b4812ea18fa10b65432da665007db1310f0a383c51173ca8d9",
+      "http_status": 200,
+      "sha256": "6e95787451ebf6b4812ea18fa10b65432da665007db1310f0a383c51173ca8d9",
+      "passed": true
+    },
+    {
+      "path": "standards/security-layer-model/v0.7/revisions/0.7/index.html",
+      "expected_sha256": "7d7a38a8c3b9fff65b46280fcd5723eff77dc9d0784f871bb35f718bc4e8c0e7",
+      "http_status": 200,
+      "sha256": "7d7a38a8c3b9fff65b46280fcd5723eff77dc9d0784f871bb35f718bc4e8c0e7",
+      "passed": true
+    },
+    {
+      "path": "standards/security-layer-model/v0.8/index.html",
+      "expected_sha256": "ed6c33d1ba42388527dce3642e03fe1bde6ad90138e6e0062161c9dc7860e971",
+      "http_status": 200,
+      "sha256": "ed6c33d1ba42388527dce3642e03fe1bde6ad90138e6e0062161c9dc7860e971",
+      "passed": true
+    },
+    {
+      "path": "standards/security-layer-model/v0.8/revisions/accepted-1/index.html",
+      "expected_sha256": "ed6c33d1ba42388527dce3642e03fe1bde6ad90138e6e0062161c9dc7860e971",
+      "http_status": 200,
+      "sha256": "ed6c33d1ba42388527dce3642e03fe1bde6ad90138e6e0062161c9dc7860e971",
+      "passed": true
+    },
+    {
+      "path": "standards/security-scenario-composition/v0.1/index.html",
+      "expected_sha256": "25e314a16d56c6831391e9a3ce4e914eb551e30adc3ea449788231220e7fe64c",
+      "http_status": 200,
+      "sha256": "25e314a16d56c6831391e9a3ce4e914eb551e30adc3ea449788231220e7fe64c",
+      "passed": true
+    },
+    {
+      "path": "standards/security-scenario-composition/v0.1/revisions/0.1/index.html",
+      "expected_sha256": "2e401b2c8948ca983e7cd364faeea28b1d0bb6963a156e9b8e0e0a04961bf1c9",
+      "http_status": 200,
+      "sha256": "2e401b2c8948ca983e7cd364faeea28b1d0bb6963a156e9b8e0e0a04961bf1c9",
+      "passed": true
+    },
+    {
+      "path": "standards/security-zones/v0.1/index.html",
+      "expected_sha256": "dc063249941b56f9b5beba71d573540c3df773447d60430bf083cb3c087a551e",
+      "http_status": 200,
+      "sha256": "dc063249941b56f9b5beba71d573540c3df773447d60430bf083cb3c087a551e",
+      "passed": true
+    },
+    {
+      "path": "standards/security-zones/v0.1/revisions/0.1/index.html",
+      "expected_sha256": "b8c7ce8198edbb637657ed4194356453aa3c3794c5592ebcee4c157a68a9a2b1",
+      "http_status": 200,
+      "sha256": "b8c7ce8198edbb637657ed4194356453aa3c3794c5592ebcee4c157a68a9a2b1",
+      "passed": true
+    },
+    {
+      "path": "standards/tenancy-posture/v0.1/index.html",
+      "expected_sha256": "6d3991f38b7a6e514aba052d2775c1c57fa507c3512d88a1a5e4e70796bf0619",
+      "http_status": 200,
+      "sha256": "6d3991f38b7a6e514aba052d2775c1c57fa507c3512d88a1a5e4e70796bf0619",
+      "passed": true
+    },
+    {
+      "path": "standards/tenancy-posture/v0.1/revisions/draft-14/index.html",
+      "expected_sha256": "404f0bc2699040d0a065d557dc02232c025b1e340a77c64d645464bca2745b01",
+      "http_status": 200,
+      "sha256": "404f0bc2699040d0a065d557dc02232c025b1e340a77c64d645464bca2745b01",
+      "passed": true
+    },
+    {
+      "path": "standards/tenancy-posture/v0.1/revisions/draft-15/index.html",
+      "expected_sha256": "6d3991f38b7a6e514aba052d2775c1c57fa507c3512d88a1a5e4e70796bf0619",
+      "http_status": 200,
+      "sha256": "6d3991f38b7a6e514aba052d2775c1c57fa507c3512d88a1a5e4e70796bf0619",
+      "passed": true
+    },
+    {
+      "path": "standards/work-record-types/v0.1/index.html",
+      "expected_sha256": "1cdf65c1f49b1552d8eff12d8889ed9ea62c2df7c463aad5e99ab3fbddcc14e7",
+      "http_status": 200,
+      "sha256": "1cdf65c1f49b1552d8eff12d8889ed9ea62c2df7c463aad5e99ab3fbddcc14e7",
+      "passed": true
+    },
+    {
+      "path": "standards/work-record-types/v0.1/revisions/accepted-1/index.html",
+      "expected_sha256": "43cf02d4b768194c482fc09a0eda11c62bfd3d4250da0175a9f0012f68b1fec4",
+      "http_status": 200,
+      "sha256": "43cf02d4b768194c482fc09a0eda11c62bfd3d4250da0175a9f0012f68b1fec4",
+      "passed": true
+    },
+    {
+      "path": "standards/work-record-types/v0.1/revisions/accepted-2/index.html",
+      "expected_sha256": "1cdf65c1f49b1552d8eff12d8889ed9ea62c2df7c463aad5e99ab3fbddcc14e7",
+      "http_status": 200,
+      "sha256": "1cdf65c1f49b1552d8eff12d8889ed9ea62c2df7c463aad5e99ab3fbddcc14e7",
+      "passed": true
+    },
+    {
+      "path": "standards/workplan-terminology/v0.1/index.html",
+      "expected_sha256": "c6c28410c452b96f33082810743c763dd35714fade186dea0bdc928d31c3fbfd",
+      "http_status": 200,
+      "sha256": "c6c28410c452b96f33082810743c763dd35714fade186dea0bdc928d31c3fbfd",
+      "passed": true
+    },
+    {
+      "path": "standards/workplan-terminology/v0.1/revisions/accepted-1/index.html",
+      "expected_sha256": "3fffb8c59107797e97db55bf8ee23280ddc2ca0ef1ea1edc1547c3b2c3bef3c0",
+      "http_status": 200,
+      "sha256": "3fffb8c59107797e97db55bf8ee23280ddc2ca0ef1ea1edc1547c3b2c3bef3c0",
+      "passed": true
+    },
+    {
+      "path": "standards/workplan-terminology/v0.1/revisions/accepted-2/index.html",
+      "expected_sha256": "c6c28410c452b96f33082810743c763dd35714fade186dea0bdc928d31c3fbfd",
+      "http_status": 200,
+      "sha256": "c6c28410c452b96f33082810743c763dd35714fade186dea0bdc928d31c3fbfd",
+      "passed": true
+    }
+  ],
+  "all_public_candidate_bytes_match": true,
+  "current_documents": 73,
+  "prior_immutable_paths": 72,
+  "public_reads_only": true
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-runtime-checks.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-runtime-checks.json
new file mode 100644
index 00000000..4dc52a00
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-public-runtime-checks.json
@@ -0,0 +1,48 @@
+{
+  "captured_at": "2026-10-11T01:25:22.146567+00:00",
+  "https": true,
+  "redirect_following": false,
+  "checks": [
+    {
+      "path": "/",
+      "status": 200,
+      "expected_status": 200,
+      "location": null,
+      "content_security_policy_present": true,
+      "nosniff": true,
+      "hsts_present": false,
+      "passed": true
+    },
+    {
+      "path": "/healthz",
+      "status": 200,
+      "expected_status": 200,
+      "location": null,
+      "content_security_policy_present": true,
+      "nosniff": true,
+      "hsts_present": false,
+      "passed": true
+    },
+    {
+      "path": "/tenancy-posture.html",
+      "status": 308,
+      "expected_status": 308,
+      "location": "/standards/tenancy-posture/v0.1/index.html",
+      "content_security_policy_present": true,
+      "nosniff": true,
+      "hsts_present": false,
+      "passed": true
+    },
+    {
+      "path": "/security-layer-probe-unexpected-path",
+      "status": 404,
+      "expected_status": 404,
+      "location": null,
+      "content_security_policy_present": true,
+      "nosniff": true,
+      "hsts_present": false,
+      "passed": true
+    }
+  ],
+  "all_pass": true
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-hosting-read-only-render-diagnosis.json b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-read-only-render-diagnosis.json
new file mode 100644
index 00000000..3335915f
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-hosting-read-only-render-diagnosis.json
@@ -0,0 +1,72 @@
+{
+  "proposal_id": "POLICY-PUB-20261011-SECURITY-LAYER-V08-R1",
+  "approval": {
+    "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
+    "disposition_id": "disp-b8bfa6c0-e879-4de2-8243-f4abb9bcd011"
+  },
+  "started_at": "2026-10-11T01:20:45.684658+00:00",
+  "raw_output_withheld": true,
+  "secret_values_observed": false,
+  "attempted_helm_upgrade": false,
+  "all_checks_pass": false,
+  "headroom": {
+    "node_ip": "92.205.62.239",
+    "free_cpu_m": 540,
+    "free_memory_mi": 6521,
+    "surge_cpu_m": 10,
+    "surge_memory_mi": 32,
+    "pressure_checks_pass": true
+  },
+  "fresh_sealed_preflight_pass": true,
+  "rendered_identities": [
+    {
+      "kind": "NetworkPolicy",
+      "name": "policy-nexus-default-deny",
+      "namespace": null
+    },
+    {
+      "kind": "NetworkPolicy",
+      "name": "policy-nexus-traefik",
+      "namespace": null
+    },
+    {
+      "kind": "NetworkPolicy",
+      "name": "policy-nexus-acme-solver",
+      "namespace": null
+    },
+    {
+      "kind": "ServiceAccount",
+      "name": "policy-nexus",
+      "namespace": null
+    },
+    {
+      "kind": "Service",
+      "name": "policy-nexus",
+      "namespace": null
+    },
+    {
+      "kind": "Deployment",
+      "name": "policy-nexus",
+      "namespace": null
+    },
+    {
+      "kind": "Ingress",
+      "name": "policy-nexus-http",
+      "namespace": null
+    },
+    {
+      "kind": "Ingress",
+      "name": "policy-nexus-https",
+      "namespace": null
+    },
+    {
+      "kind": "Middleware",
+      "name": "policy-nexus-https-redirect",
+      "namespace": null
+    }
+  ],
+  "read_only_render_diagnosis": true,
+  "failure_class": "RuntimeError",
+  "failure": "fixed supervised preflight/owner upgrade/post-release verification failed; raw outputs withheld",
+  "decision_packet_sha256": "076c7c9abd8ae6b1fb0779816c61a8e05f906e0df2782ec6029424d92a35656e"
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/policy-native-completion-progress-receipt.json b/docs/evidence/2026-10-10-security-consolidation/policy-native-completion-progress-receipt.json
new file mode 100644
index 00000000..5c068bf0
--- /dev/null
+++ b/docs/evidence/2026-10-10-security-consolidation/policy-native-completion-progress-receipt.json
@@ -0,0 +1,27 @@
+{
+  "workplan_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8",
+  "id": "f43c5864-6bf0-4c74-9659-679a231ce47b",
+  "topic_id": null,
+  "task_id": null,
+  "decision_id": null,
+  "event_type": "note",
+  "summary": "PNEX-WP-0005 actual native publication complete: exact human R1 approval52a3c479; Helm9 deployed/Ready1, approved4e0db6 image and provenance/all9UID-defaultedconfigs pass.158publicHTTPS bytes match73currentdocuments+72oldimmutablepaths, TLSReady/health/legacy308/404. Sourcebinding reconciled and publisherplanfinished. Prior failedpre-actuation +namespace refinement preserved same trial; no rollback. Argo adoption separate.",
+  "detail": {
+    "approval_id": "52a3c479-2cb1-4074-abec-6a88117ad596",
+    "source_count": {
+      "open": 47,
+      "residual": 2,
+      "nonresidual": 45,
+      "unfinished_tasks": 101
+    },
+    "hub_decision_id": "99dc9648-2098-4388-89b3-9da27c02af0b",
+    "native_owner_commit": "67329ab",
+    "whole_goal_completed": false,
+    "workplan_completion_commit": "601724b",
+    "production_selection_commit": "c435979"
+  },
+  "author": "codex",
+  "session_id": null,
+  "created_at": "2026-10-11T01:30:35.613391Z",
+  "workstream_id": "20adecb1-98b5-5a8e-9550-9aa0bc5087b8"
+}
diff --git a/docs/evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json b/docs/evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json
index 1d22c9f3..b9930bf4 100644
--- a/docs/evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json
+++ b/docs/evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json
@@ -392,18 +392,10 @@
     "unfinished": 1
   },
   "policy-nexus": {
-    "plans": [
-      {
-        "id": "PNEX-WP-0005",
-        "file": "/home/worsch/policy-nexus/workplans/PNEX-WP-0005-security-layer-v08-publication.md",
-        "status": "active",
-        "flavor": "implementation",
-        "unfinished_tasks": 1
-      }
-    ],
-    "open": 1,
-    "nonresidual": 1,
-    "unfinished": 1
+    "plans": [],
+    "open": 0,
+    "nonresidual": 0,
+    "unfinished": 0
   },
   "informed-decision": {
     "plans": [
@@ -427,8 +419,8 @@
     "unfinished": 5
   },
   "_total": {
-    "open": 48,
-    "nonresidual": 46,
-    "unfinished": 102
+    "open": 47,
+    "nonresidual": 45,
+    "unfinished": 101
   }
 }
diff --git a/docs/security-collaboration-review-2026-10-10.md b/docs/security-collaboration-review-2026-10-10.md
index 2b5dfa9b..f14bcb64 100644
--- a/docs/security-collaboration-review-2026-10-10.md
+++ b/docs/security-collaboration-review-2026-10-10.md
@@ -344,3 +344,75 @@ the changed full execution render requires exact rereview. The existing
 ORGREF-WP-0002 project driver owns the cross-owner follow-through; no duplicate
 plan or foreign task list was created. Native structural receipts, adapters,
 contained execution and real login/MFA remain open.
+
+
+## Exact Policy Nexus hosting proposal ready for human disposition
+
+Owner package commit `28b60d2` and RailianceApps candidate commit `6953a23`
+retain the independently agreed exact R1 hosting packet (manifest SHA256
+`a70fb22f75871a08358f1cdee2410797cb0a2f01c2001f0012d16866b20e28a8`).
+The original review gaps and failed probes remain separate from the final
+agreement. Actual package checks pass: nine packaging tests and Helm lint; ten
+new guard/public verification tests and independent negative probes pass.
+No production selection or live hosting changed.
+
+Native memo `infd-20261011-policy-nexus-hosting-r1@1` is registered, published
+and intake-ready, review
+[review-28d16691-3277-461e-aec6-53ad7a0538c7](https://decisions.coulomb.social/review?memo_id=review-28d16691-3277-461e-aec6-53ad7a0538c7).
+The user elected to review there; that response itself is no deployment approval.
+The supervised record retains the exact packet before human submission.
+Fresh sealed UID/defaulted configuration, admission/diff, capacity, context and
+management-owner checks remain mandatory before any confirmed approved rollout.
+
+
+Gate House's actual T06 doctrine preparation is now source commit `f5e9365`.
+It proposes carrying the deterministic Staff/evidence tension explicitly and
+adding the requested Informed Decision catalogue row, while reporting the
+remaining emission guarantees as owed. This is an unsigned source proposal,
+not an accepted standard revision or a ruling. T06 is in progress; accepted
+v0.8 remains byte-identical.
+
+Informed Decision purpose-hardening publication preparation uses only the
+existing admitted owner CI registry lane, exact immutable base7f5 and one
+policy module. Source workflow `f66de50` reached CI but failed on its copied
+module mode: private build umask made the file unreadable by inherited UID10001.
+The narrowly proven `COPY --chmod=0644` repair is commit `acecad8`; the failure
+is retained and registry/native release acceptance is still separate. Protected
+actual-data backup/restore, manual image-only Argo rollout and same-schema
+rollback are prepared protocol, not performed actions.
+
+
+## Accepted guardrails now served; publisher workplan finished
+
+The exact Policy Nexus R1 disposition is confirmed: approval
+`52a3c479-2cb1-4074-abec-6a88117ad596` at01:14:23Z. Existing owner Helm
+upgrade completed01:23:42Z at revision9/deployed, Ready1/generation9. Fresh
+sealed preflight and all nine post-release UID/defaulted configurations match
+the approved change. All158 public HTTPS file hashes match the actual image,
+including73current documents and72original immutable paths. CertificateReady,
+index/health200, legacy308 and unknownpath404 pass. The original failed
+pre-actuation and namespace correction remain the same supervised trial; no
+rollback was needed or extra permission inferred.
+
+Native owner proof is `rapp-policy-nexus` commit `67329ab`; canonical approved
+production selection is `railiance-apps` commit `c435979`. Publisher source
+plan PNEX-WP-0005 is finished in `601724b`. Argo onboarding remains
+RPF-WP-0043/RAPP-POLICY-NEXUS-WP-0002.
+
+
+After native publisher completion the same13-owner source count is **47 open
+plans:45nonresidual and2residual,101unfinished task blocks**. Initial49/48/105
+baseline and every prior checkpoint remain retained; current snapshot is
+[source-current-2026-10-11.json](evidence/2026-10-10-security-consolidation/source-current-2026-10-11.json).
+These are source workplan counts, not runtime safety scores. New RAPP-USER-ENGINE
+work and risk findings outside the original13owner baseline remain live records
+and are not hidden by this count.
+
+The one-app catalogue executor is source commit `c89614e`, with a fresh
+dedicated User Engine owner agreement and21actual isolatedPostgreSQL checks
+on corrected b0dbbb97 source. Honest maintenance attribution, persistedoneuse,
+nativeDBclockexpiry, exactcreated-only recovery and ordinarydenial audit are
+verified mechanism evidence. Automatic drain excludes dead-lettered events;
+privileged later replay can revive them and needs separate owner reconciliation.
+NetKingdom exception review and exact founder decision remain pending; no
+application/binding row was inserted.