user-engine/docs/evidence/2026-10-11-one-app-catalogue-human-packet/execution-and-verification.md

Exact supervised sequence — prepared only

1. Validate unchanged packet/executor/transport/records and current package source boundaries. Confirm native founder accept, exact memo/version/packet binding, stale=false, actual resolver identity and native approval receipt. Refusal, stale packet, expiry or missing provenance stops. Record exact original/approved revision under the same R1 trial; no autonomy promotion or inherited R2 authority.
2. Refresh read-only target Ready pod UID/image f239 and installed owner package hashes, provider ownership/health and exact absent-or-matched catalogue preflight. Do not read Secret objects/values or export database/token configuration. Freeze current metadata and target refs. A changed package or binding requires review before mutation.
3. Create a private mode0600 grant only after independent actual founder-receipt confirmation. Grant schema is attached and authenticates nothing. The independently verified receipt holds founder ID, approved memo/version/executor/transport/records/target/deadline/packet. Grant contains only the executor's closed fields; actual approval ID/receipt hash are unknown until that disposition. Pin canonical sorted compact JSON SHA256 independently; never reuse fixture values.
4. Invoke the exact reviewed supervisor transport with mode dry-run, approved executor SHA, private grant SHA and freshly frozen expected pod UID. Source/grant travel on stdin; existing token and DB URL are read inside the workload with raw output suppressed. Stop on unavailable/uncertain deny, unexpected ordinary allow, transport failure, drift or changed source. Dry-run rolls back User Engine state but may leave genuine provider telemetry. Do not interpret exit2 as successful recovery or assert global absence of effects.
5. Recheck frozen preconditions, then invoke the same exact grant/source/UID with mode apply. Require result created or exact no-change and record actual transaction/evidence; no second mutation if response is uncertain. Independently read consumed ledger, exact two rows, genuine denial/maintenance audits and original event status/attribution before deciding reconciliation. A transport failure after commit can be ambiguous; first inspect exact native ledger/rows rather than retry blindly.
6. Verify actual three-way catalogue and account-facing native projection; labelled advisory policy-fixture allow/deny/TTL/expired/unavailable/cache checks use the existing admitted readback path only and persist no subjects/fixtures. Keep actual registered facts separate from fixture claims and real human browser/MFA acceptance. Verify unchanged ordinary enforcement deny/health. Do not target outbox delivery or replay under this grant; observe already-authorized ordinary delivery metadata/receipt if available and report gaps honestly.
7. If independently proved recovery is needed, use only the same original grant mode rollback before expiry; exact rows, no dependencies and locked unclaimed/undelivered original events are mandatory. Stop on missing/claimed/delivered event, changed fact or expired authority. Record retained dead-letter event and audit history; subsequent targeted delivery/replay requires separate owner reconciliation. Recovery failure/unknown outcome does not score success.
8. Remove private grant/local transient inputs after success, no-change, refusal or recovery; retain only hashes and actual native receipt/outcome refs. Preserve original failures and supplementary21/6 test proofs. Activate the conditional single-control checklist row only if exact founder accept/native exception occurred, and track restoration before customer production. This sequence itself executes nothing.

Prepared command shape (values in angle brackets are unresolved evidence slots, never fake authority):

python3 tools/run_approved_catalogue_bootstrap.py --executor tools/catalogue_bootstrap.py --executor-sha256 b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3 --grant-file <private-0600-file> --grant-sha256 <actual-canonical-grant-sha256> --expected-pod-uid <fresh-ready-f239-pod-uuid> --mode dry-run

After successful admitted dry-run/fresh checks use mode apply. Conditional recovery uses mode rollback with the unchanged original grant. Both source and transport SHA3e594e0e8561100ae1eeb34d7208cd5b5e387ae56c29689f155aed94219770f3 must independently match the approved packet before running this command. No native command is run by packet preparation.