{
  "observed_at": "2026-09-08T21:32:38.862528+00:00",
  "preparation_task": "KEY-WP-0013-T07",
  "live_owner_task": "KEY-WP-0013-T02",
  "project_task": "HFACT-WP-0001-T03",
  "published_probe": {
    "observed_at": "2026-09-08T21:17:50.880337+00:00",
    "image": {
      "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
      "source_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
      "published_tag": "main-6f33abd",
      "packaged_command_proven": true,
      "container_uid": 65534,
      "container_network": "none",
      "container_readonly": true,
      "fixture_lifetime_seconds": 1,
      "expected_exit": 1,
      "observed_exit": 1,
      "idle_receipt": {
        "downstream_credential_issued": false,
        "failure": "probe_deadline",
        "schema": "keycape.upstream-issuer-proof.v1",
        "status": "failed",
        "tokens_retained": false
      }
    },
    "validation": {
      "go_test_race_all": "passed",
      "go_vet_all": "passed",
      "probe_tests_after_cli_fixture": "passed",
      "python_renderer_and_receipt_tests": 5,
      "traefik_route": {
        "traefik": "3.6.7",
        "exact_route_cases_passed": 7,
        "ordinary_login_callbacks_preserved": true,
        "live_cluster_changed": false
      },
      "server_dry_run": {
        "accepted": true,
        "resources": [
          "Job",
          "Service",
          "IngressRoute",
          "NetworkPolicy/probe",
          "NetworkPolicy/Authelia"
        ],
        "image_digest": "sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
        "job_owner_uid": "fixture only; must bind the actual UID at execution"
      }
    },
    "deployment_metadata": {
      "deployment": {
        "name": "keycape",
        "metadata": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29"
      },
      "secret": {
        "name": "keycape-config",
        "metadata": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
      },
      "production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
      "probe_jobs_before": []
    },
    "live_upstream_issuer_proved": false,
    "production_mutated": false,
    "credential_values_extracted": false,
    "custody_activated": false,
    "required_next_return": "Deployment-owner admission for the temporary config-reading probe; attended signed issuer receipt and cleanup, then contained issuer pin and named CCR reviews"
  },
  "projection_receipts": [
    {
      "repo": "key-cape",
      "commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
      "status": "applied",
      "instance_role": "primary",
      "instance_label": "railiance01",
      "derived_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
      "outcome": "applied",
      "refused": []
    },
    {
      "repo": "prj-helixforge-factory",
      "commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
      "status": "applied",
      "instance_role": "primary",
      "instance_label": "railiance01",
      "derived_commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
      "outcome": "applied",
      "refused": []
    }
  ],
  "final_readback": {
    "task_readbacks": [
      {
        "id": "HFACT-WP-0001-T01",
        "uuid": "5cee3251-faf9-5925-8ffd-7a8bf378b0a4",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Project published and registered; both product PR receipts finalized. Exact unattended actor/project/profile, grants, operating owners and enforceable spend contract still require the G0 admission packet.",
          "needs_human": false
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T02",
        "uuid": "3a3a967d-5bec-52ee-be20-dc94524b8e85",
        "expected": {
          "status": "progress",
          "assignee": "the-custodian"
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T03",
        "uuid": "67c80db1-01ba-54f1-80ff-76398f9e7823",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Corrected verifier and bounded issuer-probe images published; exact audit scope and attended first-provision capabilities proved. Await temporary probe admission and actual upstream issuer proof, RPF-WP-0035-T05/CCR-2026-0017/0018 activation, separate client-side/audit custody and live approval/native delivery; WARDEN-WP-0039-T03 retains explicit credential-policy binding refusal.",
          "intervention_note": "Approve the prepared ten-minute issuer probe using KeyCape main-6f33abd/digest 0c85ed37...22e4: temporary config-reading Job and exact-state route; packet key-cape/docs/upstream-issuer-proof.md. Actual signed issuer proof and named custody reviews remain subsequent gates.",
          "needs_human": true
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T04",
        "uuid": "1054b135-f367-57b1-9308-72a1fbb38f62",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Local protected artifact installation and installed-path startup proved by SAND-WP-0015-T06. Await trusted owner configuration, T03 native credentials, real-model acceptance and Railiance-specific placement."
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T05",
        "uuid": "2b171ebd-75f3-5ce2-85a9-98e8ab77fd19",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Await actionable admission records, owner credential chain and accepted profile/placement from T02-T04."
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T06",
        "uuid": "4d72717a-d5c9-571d-987b-9373f01253fa",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Await the current governed Railiance worker proof in T05."
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T07",
        "uuid": "a815d9b3-b03e-5764-95c2-fa1a2940611a",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Recovery matrix and measurement ledger are prepared; final live recovery proof requires the deployed T05/T06 configuration."
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      },
      {
        "id": "HFACT-WP-0001-T08",
        "uuid": "59cfddfb-7cd6-5103-9444-8764e9d51678",
        "expected": {
          "status": "wait",
          "assignee": "the-custodian",
          "blocking_reason": "Await useful delivery and operational controls from T06/T07, then the complete fourteen-day observation window."
        },
        "repaired_fields": [],
        "verified": true,
        "verified_after_canonical_sync": true,
        "repaired_fields_after_sync": []
      }
    ],
    "repositories": [
      {
        "repo": "key-cape",
        "commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
        "remote_main_matches": true,
        "clean": true
      },
      {
        "repo": "prj-helixforge-factory",
        "commit": "ceac5eda56c2cd91952c4ae515d7fb226dfd3581",
        "remote_main_matches": true,
        "clean": true
      },
      {
        "repo": "railiance-platform",
        "commit": "a94d06dbcf0c4991d07eb69523c05a713acd59c2",
        "remote_main_matches": true,
        "clean": true
      },
      {
        "repo": "net-kingdom",
        "commit": "46455439cfbb24fc5d187403c8f9f4465fccc274",
        "remote_main_matches": true,
        "clean": true
      }
    ],
    "project_consistency": {
      "fail": 0,
      "automation_error": 0,
      "warn": 2,
      "info": 0
    },
    "live_execution_approval": "pending"
  },
  "progress": {
    "progress": [
      {
        "id": "dd3e637b-12d5-4788-9be7-c9590aad946f",
        "workplan_id": "6e815d88-b0e3-5ce0-be5d-13ab15917f7f",
        "task_id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497",
        "summary": "KEY-WP-0013-T07 done: published one-shot upstream issuer probe source 6f33abd and owner packet 1b9793f; main 7ecc78f. Immutable image sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4. Full Go race suite/vet, five Python checks, seven real Traefik 3.6.7 routing cases, packaged idle-timeout and Railiance server dry-run passed. T02 retains deployment-owner admission, attended live signed issuer receipt and contained issuer pin. No production probe or custody mutation performed."
      },
      {
        "id": "f738f145-8999-4f24-b6cc-0881a891df37",
        "workplan_id": "ed4fe524-036f-5221-8deb-00e24e944de1",
        "task_id": "67c80db1-01ba-54f1-80ff-76398f9e7823",
        "summary": "Consumed KEY-WP-0013-T07 executable issuer-probe return in HFACT-WP-0001-T03 and thirteen-source dependency view. Replaced unspecified manual upstream observation with pinned image, ten-minute bounded Job, exact-state callback route, proof and cleanup packet. Concrete deployment-owner decision requested for temporary config use; T03 remains wait. Actual signed issuer evidence, named CCR-2026-0017/0018 reviews, custody/config rollout and factory operating admission remain open."
      },
      {
        "id": "cbdb3d98-1bef-4bb2-adbf-d284cb007d97",
        "workplan_id": null,
        "task_id": null,
        "summary": "Custodian continued the factory critical path by implementing, testing and publishing the missing upstream issuer diagnostic (KEY-WP-0013-T07 done). Validation includes Go race suite/vet, five renderer/receipt checks, seven real Traefik route cases and Railiance dry-run. KEY-WP-0013-T02 and HFACT-WP-0001-T03 retain temporary deployment admission and live issuer proof; no production deployment, issuer pin, secret extraction or custody activation performed. Source and image packet are concrete for the requested operator decision."
      }
    ],
    "key_task_projection": {
      "id": "62bc6d8e-dbb2-57b6-a30b-472ffd06b497",
      "assignee": "the-custodian",
      "status": "done",
      "repaired_fields": [],
      "verified": true
    }
  },
  "keycape_consistency": {
    "fail": 0,
    "automation_error": 0,
    "warn": 15,
    "info": 1
  },
  "live_execution_approval": "pending",
  "live_upstream_issuer_proved": false,
  "production_image_unchanged": true,
  "temporary_probe_resources_absent": true,
  "custody_activated": false
}