# Must-Not-Ship Gate Evidence Ledger

Current ledger update: 2026-07-22. Overall release posture: **blocked**. Older
rows retain their exact run dates and remain historical evidence. This ledger
separates checked-in historical release evidence from an explicitly labeled
uncommitted worktree candidate, records only commands actually run for the stated
update, and preserves explicitly absent external (`E`) or accountable-owner (`O`)
evidence. A local
mock, deterministic harness run, reviewed upstream defect, safe default, skip,
or disabled feature is never promoted into evidence it does not provide.

## Evidence/status vocabulary

Evidence tiers:

| Tier | Meaning |
|---|---|
| `H` | Hermetic unit, contract, property, vector, or fault-injection evidence. |
| `L` | Local multi-process or real local service integration. |
| `P` | Privileged exact host/OS/kernel/process-boundary evidence. |
| `E` | Real harness semantics, external peer/SDK/IdP/partner, multi-node failure-domain, model, or production-like lab evidence. |
| `O` | Signed accountable policy/ceremony/root decision. |

Gate statuses used here:

- `PARTIAL`: cited H/L evidence passes, but a required tier or case is absent.
- `FAILED`: a required official suite or stop-ship invariant is non-green.
- `BLOCKED_EXTERNAL`: required P/E infrastructure or independent system is absent.
- `BLOCKED_OWNER`: required O evidence is unsigned/unresolved.
- `IMPLEMENTATION_GAP`: required executable behavior is absent; an interface is not completion.
- `PASSED`: every required tier/case is current and reviewed. No gate is `PASSED` in this snapshot.

## Commands and immutable/current results

| Scope | Command or record | Observed result | Boundary |
|---|---|---|---|
| Complete authorized repository run | `AGENTNET_TEST_POSTGRES_URL='postgresql:///agentnet_test_final?host=/tmp/agentnet-pgsocket-20260713-final&port=55432' AGENTNET_TEST_POSTGRES_ALLOW_MUTATION=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src .venv/bin/pytest -q -p no:cacheprovider` | 983 passed, 0 failed, 0 skipped, 0 xfailed | Includes seven real-PostgreSQL cases, real Unix binding sockets, host-level Bubblewrap network denial, signed backup/restore and archive validation, and current release-manifest verification. Local H/L/P evidence only. |
| Release input, package, and clean install | `.venv/bin/python scripts/verify_release.py`; `SOURCE_DATE_EPOCH=1580601600 PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache UV_LINK_MODE=copy uv build --offline --no-build-isolation --out-dir /tmp/agentnet-final-build-20260713`; clean-wheel install/init/status/backup/restore/demos in `evidence/local/2026-07-13-final/manifest.json` | Verifier PASS; locked build backend produced retained, content-validated sdist/wheel evidence; new-environment install and clean schema-v1 status passed | Local package evidence only; it is not an independent signature, SBOM/provenance publication, root ceremony, maintained KMS, or cross-platform qualification. |
| npm `0.1.3` packaging patch | `SOURCE_DATE_EPOCH=1580601600 PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache UV_LINK_MODE=copy uv build --offline --no-build-isolation --out-dir /tmp/agentnet-build-0.1.3-a`; repeated in an independent output directory | Byte-identical retained wheel and sdist; current package tests and release verifier pass | Marketing, discoverability metadata, preview image, and version-only runtime edits; prior PostgreSQL/security evidence remains historical and is not promoted. |
| npm `0.1.4` installer repair | Retained build evidence plus clean public npm-tarball retest from an unrelated cwd | Python artifacts were byte-identical and bounded cwd/version checks passed, but full packed verification later reproduced `894 passed, 16 failed, 7 expected PostgreSQL skips`; activation blocked | The public package omitted six verifier inputs and allowed host-dependent Python minor selection. This row preserves the failed packed-artifact outcome; no production evidence is promoted. |
| npm `0.1.5` packed-artifact correction | Exact CPython `3.13.13`; `uv>=0.11.28`; two independent reproducible Python builds; source release suite; clean installed npm tarball full `agentnet verify` from unrelated cwd | Byte-identical wheel/sdist; source `911 passed, 7 expected PostgreSQL skips`; packed `911 passed, 7 expected PostgreSQL skips`; release verifier PASS | Exact evidence-file inclusion, portable artifact-retention evidence, interpreter/toolchain selection, explicit old-uv rejection without host mutation, and full packed-tarball prepublication gate only; no identity, authorization, protocol, storage, delivery, A2A, or production-gate semantics change. |
| npm `0.1.6` P1–P5 candidate | Exact CPython `3.13.13`; `uv>=0.11.28`; two independent reproducible Python builds; `npm run check`; clean installed npm tarball from unrelated cwd | Byte-identical wheel/sdist; source package gate `999 passed, 7 expected PostgreSQL skips`; packed `999 passed, 7 expected PostgreSQL skips`; release verifier PASS on 2026-07-15 | Local candidate evidence for validated-address OIDC, activation, mailbox acknowledgement, bounded artifact client/CLI, protected TaskGrant payload release, and standalone WebAuthn-UV component. No real authenticator/independent host, IdP, harness, PostgreSQL HA, scanner, A2A, owner, production, deployment, or cutover evidence is promoted. |
| Published npm `0.1.6` full PostgreSQL verification | Clean public npm install on the ordinary Hub host; dedicated mutation-authorized loopback PostgreSQL; `/root/.nvm/versions/node/v22.23.0/bin/agentnet verify` | `1004 passed, 2 failed` on 2026-07-15: one stale fresh-schema test expected only migration 1 although current schema is 2; one federation security-revocation HTTP test intermittently returned non-enumerating 404 because its frozen service clock could precede the live policy-decision clock. Isolated federation replay passed. | Synthetic package evaluation remains allowed, but `0.1.6` must not construct the AgentNet company network, carry real company data, or replace existing A2A. AgentNet stayed inactive and existing A2A stayed unchanged. |
| npm `0.1.7` verification-hotfix candidate | Exact 1.1-second clock-boundary reproduction; focused federation/service tests; 30 repeated security-revocation HTTP runs; `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q --ignore=tests/adapters/test_installed_live_inference.py --ignore=tests/conformance/test_release_manifest.py` | Exact published 404 reproduced before the test-clock fix; `14 passed` focused; `30/30` repeated target passes after the fix; code-regression corpus `1049 passed, 7 expected PostgreSQL skips` on 2026-07-15. Dedicated PostgreSQL rerun remains required before publication approval. | Test-only repair: production authorization remains fail-closed and unchanged; clean PostgreSQL tests now require the complete current migration catalog. Use test data only. No network construction, real company data, activation, or cutover. |
| npm `0.1.8` confidential-OIDC correction candidate | Pre-edit writer/critic and constitution review; focused OIDC/config/deployment/invitation/HTTP suite; actual-implementation writer/critic repair pass; broad code-regression corpus; `npm run check` source and clean packed-package gates | Pre-edit reviews PASS; focused `71 passed`; broad `1060 passed, 7 expected PostgreSQL skips`; source package `1010 passed, 7 expected PostgreSQL skips`; packed package `1010 passed, 7 expected PostgreSQL skips`; release verifier PASS on 2026-07-16. Local real-PostgreSQL rerun was not executed because no PostgreSQL client/server is installed; independent Hub verification remains required after publication. | H-only confidential-client mechanism evidence: explicit public/POST/Basic methods, runtime-only secret resolution, discovery advertisement, Google three-origin callback profile, rotation/redaction/migration, and invitation verifier binding. No live Google ceremony, real secret, independent approval deployment, owner decision, production activation, network construction, real company data, or cutover evidence is promoted. |
| npm `0.1.9` guided identity-only enrollment candidate | Focused approval/OIDC/CLI/config suites; code-regression corpus; release/package conformance; source `npm run check` lane; clean `npm run check:packed` lane; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds | Focused guided lane `80 passed` with one expected PostgreSQL skip plus targeted hardening subsets; code-regression corpus `1079 passed, 7 expected PostgreSQL skips`; release/package conformance `29 passed`; source and clean packed package each `1029 passed, 7 expected PostgreSQL skips`; package check, packed check, and release verifier PASS; byte-identical wheel and sdist retained under `evidence/local/2026-07-16-v0.1.9/` on 2026-07-16 | H/L candidate evidence only: versioned approval-store migration, hash-only continuation, Core-only receipt retrieval, PoP-before-retrieval, exact response-loss recovery, owner-only resumable CLI state, and zero implicit entitlements. No current mutation-authorized PostgreSQL run, live Google ceremony, release-bound real passkey, independently administered production approval boundary, blank-laptop cross-host test, signed first message/reply, owner decision, real company data, activation, or cutover evidence is promoted. |
| npm `0.1.10` recursive-package repair candidate | Pre-edit package-lifecycle and clock-edge inventory with model-diverse adversarial review; root-ignore negative tests; relay rotation clock fixture; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds; explicit source → pack/install generation 1 → repack/install generation 2 verification from isolated state and unrelated cwd | Relay rotation `25/25` repeated target passes; focused package and relay suites `35 passed`; code-regression corpus `1079 passed, 7 expected PostgreSQL skips`; both installed npm generations independently reported `1030 passed, 7 expected PostgreSQL skips`; package check, two-generation packed check, release verifier, compile, and reproducible-build comparisons PASS on 2026-07-16 | Release/test-only repair: npm package roots require neither `.gitignore` nor `.npmignore`; exact retained sdist validation models Hatchling 1.28.0's unavoidable VCS metadata without requiring that file in installed npm roots; production relay freshness remains unchanged. No current mutation-authorized PostgreSQL, live enrollment, real passkey, first signed message/reply, activation, company data, publication, or cutover evidence is promoted. |
| Published npm `0.1.10` independent Hub verification | Fresh public npm artifact identity check; package check; source → installed generation 1 → repacked generation 2 verification; release verifier; dedicated disposable PostgreSQL 18.4 corpus and migration catalog | Public identity and package check passed; generation 1 `1030 passed, 7 expected PostgreSQL skips`; generation 2 failed with `1028 passed, 2 failed, 7 expected PostgreSQL skips`; dedicated PostgreSQL `1037 passed, 0 failed, 0 skipped`; migration catalog 1–3 and schema version 3 verified on 2026-07-17 | Required recursive package gate failed. Exact failures were conversation task idempotency across a clock boundary and a relay test policy decision recorded on wall time while the relay used an injected clock. `0.1.10` remains immutable and is not package-green; no enrollment, activation, company data, or cutover was allowed. |
| npm `0.1.11` recursive-generation repair candidate | Deterministic one-second conversation retry reproducer; exact relay and internal-invitation repeated-run reproductions; explicit-deadline negative test; coherent relay/invitation test clocks; stable approval-purpose config serialization; model-diverse critic and constitution review plus bounded `claude -p` clock analysis; broad and repeated regression runs; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds; explicit source → pack/install generation 1 → repack/install generation 2 verification | Conversation/relay/assignment focused suites `56 passed`; relay target `100/100` repeats; activation serialization `100/100` repeats; internal-invitation HTTP target `100/100` repeats; code-regression corpus `1079 passed, 7 expected PostgreSQL skips`; unfiltered local run `1106 passed, 2 preserved G01 failures, 7 expected PostgreSQL skips`; complete `npm run check` PASS with source and both installed npm generations each reporting `1030 passed, 7 expected PostgreSQL skips`; package check, release verifier, compile, and reproducible-build comparisons PASS on 2026-07-17 | Minimal production change reuses the stored encrypted canonical conversation deadline only for exact omitted-deadline proposal retries; explicit caller deadline changes still conflict. Relay and invitation production freshness remain unchanged at 300 seconds; only test fixtures now use coherent clocks. Config change only sorts an unordered approval-purpose set during serialization. No current mutation-authorized PostgreSQL, live enrollment, real passkey, first signed message/reply, activation, company data, publication, or cutover evidence is promoted. |
| `0.1.12` cross-platform implementation, pre-version real-host gate | GitHub Actions run `29610467753` at commit `6d7834e`; pinned Node `24.18.0`, uv `0.11.28`, CPython `3.13.13`; platform contracts; package check; npm pack/install; direct launcher execution from unrelated cwd | Ubuntu `13 passed, 8 skipped`; macOS `15 passed, 6 skipped`; Windows `17 passed, 4 skipped`; package check and packed install/launch passed on all three hosts on 2026-07-17 | P-shaped exact-host evidence for package launch, canonical state, portable SQLite, macOS peer/read-only-pipe/link denial, Windows SID/DACL/reparse/named-pipe/replay/capability-theft/Job cleanup, and host-gated imports. This is not signed installer/update/uninstall/rollback, privileged hostile same-account/path replacement, semantic harness, clean-worker, production, enrollment, activation, company-data, first-message, or cutover evidence. Package metadata at this pre-version commit still read `0.1.11`; final `0.1.12` evidence binds the frozen release source separately below. |
| npm `0.1.12` cross-platform candidate | Real-host gate above; DeepSeek security and GLM constitution review with repairs; local unfiltered suite; exact installed-harness probe; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds; explicit source → pack/install generation 1 → repack/install generation 2 verification | Unfiltered local `1122 passed, 15 expected host/PostgreSQL skips`; installed deterministic harness `8 passed`; source, generation 1, and generation 2 each `1043 passed, 15 expected skips`; package check, release verifier, recursive package gate, and reproducible Python builds PASS on 2026-07-17 | H/L and bounded ordinary-runner P-shaped evidence only. Cross-platform installation creates no identity or authority. No current mutation-authorized PostgreSQL, signed native installer/update/uninstall, privileged hostile-host campaign, semantic clean-worker inference, live enrollment/passkey, independent production host, first signed message/reply, activation, company data, publication, or cutover evidence is promoted. |
| npm `0.1.13` canonical onboarding prompt candidate | Canonical-template commit `2dc177c`; pre-release critic and constitution review; focused npm/release conformance; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds; complete `npm run check` source → pack/install generation 1 → repack/install generation 2 verification | Reviews PASS; focused release/package conformance `30 passed`; source, generation 1, and generation 2 each `1043 passed, 15 expected host/PostgreSQL skips`; package check, release verifier, recursive package gate, canonical prompt markers, and byte-identical Python builds PASS on 2026-07-18 | Documentation/skill and regression correction only: one canonical public fresh-laptop prompt is required and unresolved public metadata blocks issuance. The template itself grants no enrollment, approval, authority, messaging, activation, deployment, restart, production, or cutover permission. No mutation-authorized PostgreSQL, live blank-laptop ceremony, passkey, first signed message/reply, company data, npm publication, or production evidence is promoted. |
| npm `0.1.14` fresh-laptop single-paste and cross-host entitlement candidate | Claude Opus onboarding inspection; DeepSeek and GLM adversarial plan and final-diff reviews; constitution-watcher; deterministic CLI/policy/package regressions; Pi skill loader; release verifier; two independent `SOURCE_DATE_EPOCH=1580601600` builds; complete source → installed generation 1 → repacked generation 2 package verification | Reviews and constitution PASS with no blocker; focused release/onboarding/security `58 passed`; source, generation 1, and generation 2 each `1048 passed, 15 expected host/PostgreSQL skips`; package check, release verifier, recursive package gate, skill loader, prompt/CLI conformance, and byte-identical Python builds PASS on 2026-07-19 | H/L candidate evidence only: canonical prompt moved to `references/examples/`; claim-code and reporting channels remain owner-gated under PD-002/PD-001; principal-ID issuance removes beneficiary-private-key transfer while preserving signed/current/same-domain server checks. No mutation-authorized PostgreSQL, deployed Core, live Google ceremony, independent real passkey host, approved claim-code relay, blank-laptop enrollment, first signed message/reply, company data, activation, publication, production, or cutover evidence is promoted. |
| npm `0.1.15` ordinary-onboarding simplification candidate | Explicit authenticated owner instruction; full Claude onboarding-policy review; Codex implementation scout; DeepSeek adversarial review; GLM constitution review; focused approval/onboarding/installed-harness tests; unfiltered local suite; release verifier; two deterministic builds; source → installed generation 1 → repacked generation 2 package verification; GitHub Actions run `29705571577` at commit `1abd4aad0c30f4cf026c050d628da44a83e65b4e` | Final reviewers PASS/converge; focused `23 passed`; unfiltered `1128 passed, 15 expected host/PostgreSQL skips`; source and both installed npm generations each `1049 passed, 15 expected skips`; package check, release verifier, recursive package gate, byte-identical Python builds, and Ubuntu/macOS/Windows package-host jobs PASS on 2026-07-19 | H/L candidate evidence only. Ordinary onboarding may colocate Core/PostgreSQL/approval under distinct OS identities, uses owner-controlled WebAuthn outside the enrolling harness, and reports `independent_boundary_proven=false`; separate approval hosting remains optional high assurance. The 128-bit five-minute five-attempt claim code, candidate PoP, no implicit authority, and three individually signed/audited C0 grants remain. The owner instruction is not independent signed O-tier evidence. No live deployment, mutation-authorized PostgreSQL, Google/passkey ceremony, fresh-laptop round trip, company data, activation, publication, production, A2A cutover, or gate promotion is claimed. |
| npm `0.1.16` headless enrollment handoff repair candidate | Headless-flow edge inventory; current OAuth/device-flow source research; Codex scout; writer/DeepSeek critic convergence; DeepSeek constitution review; control-byte/no-TTY/partial-write/resume/default-browser regressions; focused approval/OIDC/CLI suite; unfiltered local suite; release verifier; two deterministic builds; source → installed generation 1 → repacked generation 2 package verification | Reviews PASS/converge; focused `64 passed`; unfiltered `1142 passed, 15 expected host/PostgreSQL skips`; source and both installed npm generations each `1063 passed, 15 expected skips`; package check, release verifier, recursive package gate, and byte-identical Python builds PASS on 2026-07-20 | H/L candidate evidence only. Explicit `--browser terminal` reuses existing OIDC/PKCE/WebAuthn/claim-code semantics, writes validated printable-ASCII HTTPS URLs only to verified POSIX `/dev/tty`, and fails closed without fallback on control bytes, no TTY, unsupported platform, or partial write. Default fresh-laptop system-browser behavior, identity-only enrollment, candidate PoP, replay/expiry/idempotency, existing A2A, and zero implicit authority remain unchanged. No completed live cross-device ceremony, server binding, C0 message round trip, mutation-authorized PostgreSQL, company data, publication, production, A2A cutover, or gate promotion is claimed. |
| npm `0.1.17` model-broker request-replay repair candidate | Broker nonce edge inventory; canonical source scout; GPT-5.5 patch plan; DeepSeek security and constitution reviews; required/malformed/duplicate/concurrent/cross-capability nonce regressions; unfiltered local suite; release verifier; two deterministic builds; source → installed generation 1 → repacked generation 2 package verification | Reviews PASS/converge; focused broker suite `10 passed`; unfiltered `1147 passed, 15 expected host/PostgreSQL skips`; source and both installed npm generations each `1068 passed, 15 expected skips`; package check, release verifier, recursive package gate, and byte-identical Python builds PASS on 2026-07-20 | H/L candidate evidence only. The capability remains reusable within exact worker/grant/model/expiry/request/token budgets, while every inference requires a persistent per-capability one-use request nonce before transport. Duplicate and concurrent replay fails closed without a second transport call or extra budget spend. No live semantic worker, mutation-authorized PostgreSQL, real-host cross-platform `0.1.17`, publication, enrollment, company data, production, A2A cutover, or gate promotion is claimed. |
| npm `0.1.18` Core→Approval signed-broker replay repair candidate | Broker edge inventory; Core/Approval wire-contract reconciliation; Codex implementation plan; DeepSeek security critic; constitution review; exact proof binding/tamper/time/canonicalization/duplicate-header/query and sequential/concurrent/reopen replay regressions; focused approval suite; unfiltered local suite; `agentnet verify`; release verifier; two deterministic builds; source → installed generation 1 → repacked generation 2 package verification | Reviews PASS/converge with no blocker; focused approval suite `46 passed`; unfiltered `1166 passed, 15 expected host/PostgreSQL skips`; `agentnet verify`, source, and both installed npm generations each `1087 passed, 15 expected skips`; package check, release verifier, recursive package gate, and byte-identical Python builds PASS on 2026-07-20 | H/L candidate evidence only. Every Core→Approval create/status/retrieve request retains Bearer authentication and adds an exact method/path/body/audience/purpose/key/time/nonce HMAC proof; Approval schema v3 persistently and atomically consumes the verified nonce hash before business action, while response-loss retries use fresh broker nonces and preserve separate business idempotency. No mutation-authorized PostgreSQL v3 run, atomic live Core/Approval deployment, live enrollment/passkey, C0 round trip, company data, publication, production, A2A cutover, or gate promotion is claimed. |
| Published npm `0.1.19` zero-state C0 release and blocked deployment preflight | Exact public registry identity/integrity; clean install/launcher/package/Pi-skill checks; source → generation 1 → generation 2 verification; peer-reported remote public-artifact preflight against reportedly live Core schema v3 | Public package checks passed; the remote deployment peer reported that pre-migration `require_exact_postgres_catalog` failed deterministically with `psycopg.ProgrammingError` because PostgreSQL `format('%I.%I', ...)` appeared in a parameterized psycopg query, and reported stopping before mutation on 2026-07-22 | H/L package evidence plus peer-reported negative deployment evidence only. The peer reported no migration, restart, runtime switch, enrollment, authority, message, company-data action, live C0, or A2A mutation and reported live Core/Approval still on `0.1.18`, schema v3; this candidate's retained local evidence does not independently verify that remote runtime report. `0.1.19` is immutable and must not be deployed. |
| Current uncommitted `0.1.20` PostgreSQL catalog-verifier correction candidate | Exact psycopg failure regression; server-side `quote_ident()` composition; full PostgreSQL production-test file; full source suite; release/package conformance; `agentnet verify`; recursive installed-package proof; deterministic builds; package/lock/import/diff checks | Failing regression reproduced exact `%I` error before repair; fixed PostgreSQL lane `47 passed, 7 expected dedicated-database skips`; full source `1346 passed, 15 expected host/PostgreSQL skips`; release/package conformance `32 passed`; `agentnet verify` and both recursive npm generations each `1267 passed, 15 expected skips`; release verifier, recursive package gate, and package/lock/import/diff checks PASS; byte-identical wheel/sdist on 2026-07-22 | Minimal verifier-only correction. Migration SQL/checksums, exact catalog comparisons, identity, authority, C0, messaging, cleanup, and A2A semantics remain unchanged. Final review/commit/tag/push/CI/publication/public verification/deployment remain pending. |
| OIDC validated-address transport repair | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/identity/test_oidc_enrollment.py tests/operations/test_fail_closed_config.py tests/production/test_deployment_config.py` | 53 passed, 0 failed on 2026-07-15 | H only: includes the real `_PinnedHTTPSConnection` socket path under a validation-to-connect DNS-answer change, exact TCP address/SNI/Host assertions, proxy/tunnel and redirect denial, response bounds, unsafe address-class rejection, invalid resolver type handling, private IPv4/IPv6 pins, configuration, and deployment wiring. No real IdP/TLS service or independent approval boundary is claimed. |
| Independent WebAuthn-UV approval component | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/approval`; approval-consumer lane; non-gate full regression below | 12 focused passed; 144 approval/consumer passed; included in 1049-pass broad lane on 2026-07-15 | H only: strict owner-only config/key custody, exact SQLite catalog/tamper rejection, UV-required maintained-library call contract, exact display/digest, bounded duplicate-rejecting HTTP, one-receipt response-loss retry, committed denial/expiry audits, rejection, credential revocation, loopback serving, and non-authorizing provisioning. WebAuthn verification is seam-controlled in hermetic tests; no real authenticator, independent host/device/operator, TLS proxy, rotation/recovery drill, or owner decision is claimed. |
| Prior `0.1.8` candidate, unfiltered local run | `UV_CACHE_DIR=/tmp/uv-cache uv run --extra test pytest -q` | `1087 passed, 2 failed, 7 expected PostgreSQL skips` on 2026-07-16 | Both failures were preserved environmental G01 gates. This was not a passing unfiltered release run and is not current `0.1.9` evidence. |
| Prior `0.1.9` candidate, unfiltered local run | `UV_CACHE_DIR=/tmp/uv-cache uv run --extra test pytest -q` | `1106 passed, 2 failed, 7 expected PostgreSQL skips` on 2026-07-16 | Both failures were preserved environmental G01 gates. This was not a passing unfiltered release run and is not current `0.1.10` evidence. |
| Prior `0.1.10` candidate, unfiltered local run | `UV_CACHE_DIR=/tmp/uv-cache uv run --extra test pytest -q` | `1107 passed, 2 failed, 7 expected PostgreSQL skips` on 2026-07-16 | Both failures were preserved environmental G01 gates. Independent public recursive verification later failed as recorded above; this is not current `0.1.11` evidence. |
| Prior `0.1.11` candidate, unfiltered local run | `UV_CACHE_DIR=/tmp/uv-cache uv run --extra test pytest -q` | `1106 passed, 2 failed, 7 expected PostgreSQL skips` on 2026-07-17, plus one expected release-manifest drift failure before release metadata refresh | Both substantive failures are preserved G01 gates: installed Claude, Codex, Pi, and Antigravity versions differ from immutable release pins, and the dependent deterministic lifecycle fails closed. Release-manifest drift was expected during the pre-manifest repair stage and is not presented as a passing unfiltered run. |
| Prior unreleased `0.1.11` branch, code-regression corpus | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q --ignore=tests/adapters/test_installed_live_inference.py --ignore=tests/conformance/test_release_manifest.py` | `1079 passed, 7 expected PostgreSQL skips` on 2026-07-17 | Excludes only the explicit installed-version and current release-manifest gates. It is local regression evidence, not current real-PostgreSQL, real-harness, live Google/passkey, independent-deployment, first-message, or production evidence. |
| PostgreSQL/storage corpus | `AGENTNET_TEST_POSTGRES_URL='postgresql:///agentnet_test_final?host=/tmp/agentnet-pgsocket-20260713-final&port=55432' AGENTNET_TEST_POSTGRES_ALLOW_MUTATION=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src .venv/bin/pytest -q -p no:cacheprovider tests/production/test_postgres_runtime.py` | 44 passed, 0 skipped | Seven cases use a real local UTF-8 PostgreSQL 18.4 database for pre-release rejection, clean schema-v1 creation/checksum/DDL tamper fencing, mailbox visibility, reconnect fencing, quota admission, breaker CAS, and conflict/adjudication serialization; 37 are hermetic connection/SQLite contracts. No multi-node HA/failover/PITR or PostgreSQL restore-execution claim. |
| Four installed deterministic harnesses | `PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q -p no:cacheprovider tests/adapters/test_installed_live_inference.py` | 8 passed in 1.94s | Exact installed version probes and deterministic private lifecycles only; no inference or semantic conformance. |
| Native A2A local regression | `.venv/bin/pytest -q tests/a2a` | Included in the broad run; all checked-in A2A tests passed | H/L SDK, mapping, security, callback, persistence, and gateway evidence only. |
| Official A2A TCK | `evidence/gates/G04/2026-07-13-alpha2-http-json/manifest.json` | 235 selected: 46 passed, 12 failed, 177 skipped, 0 errors | Official `1.0.0.alpha2` HTTP+JSON gate is non-green. All 12 failures and all 177 skips are exhaustively classified without waiver; original reports are retained and hash-bound in the gate directory. |

The checked-in A2A classification is
`evidence/gates/G04/2026-07-13-alpha2-http-json/REVIEW.md`. It explains the
security/fixture conflicts behind the 12 remaining failures and categorizes all
177 disabled-binding/feature and fixture skips without waiving any outcome.
That review does not turn G04 green.

## Current gate ledger

| Gate | Required tiers | Actual executable evidence | Current status | Explicit absent evidence |
|---|---|---|---|---|
| G01 — foreground isolation | H,L,E | Manifest/no-foreground contracts: `tests/adapters/test_all_harnesses.py`; private installed deterministic lifecycle: `tests/adapters/test_installed_live_inference.py`; background dispatch: `tests/adapters/test_offline_queue_integration.py` | `BLOCKED_EXTERNAL` | E: semantic traffic with exact focus/input/context/turn instrumentation for Claude, Codex, Pi, and Antigravity is absent. |
| G02 — worker recovery | H,L,E | Queue crash recovery: `tests/supervisor/test_background_queue.py`; native process kill/restart/timeout: `tests/adapters/test_subprocess_lifecycle.py`; result-upload retry: `tests/adapters/test_supervisor_core_composition.py` | `BLOCKED_EXTERNAL` | E: real semantic worker kill/compaction/restart at every state edge for all four harnesses is absent. |
| G03 — harness isolation and model egress | H,P,E | Clean-worker admission/environment/broker negatives: `tests/adapters/test_clean_worker_boundaries.py`; subprocess sandbox contracts: `tests/adapters/test_subprocess_lifecycle.py`; broker grant/budget plus persistent per-capability one-use request-nonce replay/race rejection: `tests/supervisor/test_clean_workers_and_model_broker.py`; requested live gate fails closed in `tests/adapters/test_installed_live_inference.py` | `BLOCKED_EXTERNAL` | P/E: privileged escape/canary trials and signed clean-worker inference evidence are absent. Deterministic runs do not satisfy them. |
| G04 — native A2A | H,L,E | Mapping/security/version/grants: `tests/a2a/test_mapping.py`; `tests/a2a/test_gateway_profile.py`; `tests/a2a/test_security_requirements.py`; signed/persistent/callback/recovery: `tests/a2a/test_signed_native_gateway.py`; `tests/a2a/test_persistent_service_mount.py`; `tests/a2a/test_native_client_and_callbacks.py`; durable official evidence: `evidence/gates/G04/2026-07-13-alpha2-http-json/manifest.json` | `FAILED` | Official alpha2 recorded 46 passed, 12 failed, and 177 exhaustively classified but non-passing skips. E: cross-SDK, public peer, certificate, real callback receiver, cancellation/resubscription, and enabled streaming/push/artifact matrix is absent. |
| G05 — MCP/local API parity and direct IPC | H,L,P,E | Canonical dispatcher across direct/MCP/Pi IPC; Linux `SO_PEERCRED`; macOS `LOCAL_PEERPID`/`getpeereid`; Windows protected named pipes with server-derived client PID; exact account/PID/start/executable/parent/module binding; generation/TTL/epoch/revocation/replay checks; sealed memfd/read-only pipe/one-time Windows capability delivery; Job cleanup: `src/agentnet/bindings/mcp.py`; `src/agentnet/bindings/ipc.py`; `src/agentnet/bindings/windows_mcp_bootstrap.py`; `src/agentnet/supervisor/windows_binding_delivery.py`; `tests/platform/test_host_support.py`; `tests/bindings/test_local_binding_composition.py`; `tests/security/test_ipc_capability.py` | `BLOCKED_EXTERNAL` | Real-host package/local cases pass, but E and stronger P remain absent: exact installed-harness semantic interoperability, privileged hostile same-account/PID-reuse/path-substitution trials, and a stronger off-Linux loaded-executable measurement. No bearer or caller-supplied identity is accepted locally. |
| G06 — identity/enrollment | H,L,E,O | Enrollment/PoP/replay/races: `tests/identity/test_enrollment.py`; OIDC/PKCE/JWKS/origin/approval attacks and direct validated-address TLS transport: `tests/identity/test_oidc_enrollment.py`; standalone WebAuthn-UV config/store/ceremony/HTTP/CLI, stable receipt retry, expiry, denial audit, and credential revocation: `tests/approval/test_webauthn_service.py`; `tests/approval/test_approval_http.py`; `tests/approval/test_approval_cli.py`; fail-closed config/deployment: `tests/operations/test_fail_closed_config.py`; `tests/production/test_deployment_config.py`; recovery/rotation/revocation: `tests/identity/test_recovery.py`; `tests/identity/test_credential_rotation.py`; `tests/identity/test_revocation.py`; HTTP: `tests/integration/test_enrollment_http.py`. | `BLOCKED_OWNER` | The ordinary self-hosted PD-001/PD-002 defaults were recorded from explicit owner instruction on 2026-07-19, but that record is not independent signed O-tier evidence. L/E also remains absent: live workforce IdP/certificate integration, real passkey/authenticator ceremony, target-device key custody, colocated distinct-OS-identity process/receipt/trust-anchor attack trials, and signer/authenticator recovery drills. Separately administered approval-host evidence is required only for the optional high-assurance/`independent_boundary_proven=true` tier. PD-003/005/009 and production certification remain open. |
| G07 — local IPC/signing oracle | H,P,E | Purpose/target-bound signatures: `tests/security/test_signatures_and_replay.py`; composed current-epoch actor, real child process, durable nonce/process/session/root fencing; real-host peer/DACL/reparse/replay/capability-theft negatives: `tests/bindings/test_local_binding_composition.py`; `tests/security/test_ipc_capability.py`; `tests/platform/test_host_support.py`; registered workload proof: `tests/identity/test_workload_identity.py` | `BLOCKED_EXTERNAL` | Current CI supplies bounded ordinary-runner P-shaped evidence, not the required privileged hostile tier. Same-account PID-reuse/path/socket substitution, flood trials, and exact installed Pi semantic direct-binding evidence remain absent. |
| G08 — authorization and intent | H,L,O | Human-only policy/coherent revision: `tests/authorization/test_policy.py`; exact grants/races: `tests/authorization/test_grants.py`; zero-authority relationship proposal, verifier-derived exact owner consent, replay/drift/renew/revoke races, signed human/guest exception, exact completed local activation intent, authenticated renewal HTTP, server-derived bounded deadlines, typed arrival-order-independent multi-administrator task conflicts, opposite-adjudication and overlapping-release races, terminal propagation/revision fencing, exact subordinate-owner partition, permanent task/task-linked-control generic-read redaction, and recipient-owned TaskGrant authorize→local-custody→payload-release with audit-before-disclosure, current-state retries, no second grant use, result-release linkage, wrong recipient/dimension/epoch/conflict/expiry/tamper/revocation/missing-intent denials: `tests/organization/test_relationships.py`; `tests/property/test_relationship_lifecycle.py`; `tests/organization/test_assignment.py`; `tests/organization/test_task_custody.py`; `tests/adapters/test_supervisor_core_composition.py`; `tests/messaging/test_conversation_semantics.py`; `tests/integration/test_product_http_api.py`; `tests/production/test_postgres_runtime.py`; fail-closed runtime policy: `tests/operations/test_runtime_policy_enforcement.py` | `BLOCKED_OWNER` | Local authorization, ORG-005 mechanics, and exact payload/semantic release are implemented. Generic reads remain redacted and tool/effect authority remains false. The relationship activation intent remains local provenance, not an independent witness. O is absent: signed principal/attenuation policy; eligible relationship proposers/proposal entitlements; exception/override/appeal authorities and thresholds; and break-glass policy. |
| G09 — durability | H,L,E,O | Mailbox duplicate/offline/fact ownership: `tests/delivery/test_mailbox.py`; artifact release/quota recovery: `tests/artifacts/test_staged_artifact.py`; ordinary-agent relay crash/reconnect: `tests/relay/test_server_agent_relay.py`; seven real-PostgreSQL plus 37 hermetic storage cases: `tests/production/test_postgres_runtime.py` | `BLOCKED_EXTERNAL` | E/O synchronous HA topology, separate failure domains, standby failover, WAL archive/PITR/restore, replicated artifact backend, load/pressure, and approved RPO/RTO remain absent. |
| G10 — delivery, effects, expiry | H,L,E | Declared delivery graph properties: `tests/property/test_delivery_state_machine_properties.py`; actor-owned mailbox expiry/cancel/effect negatives: `tests/delivery/test_mailbox.py`; assignment custody derives and persists an exact whole-second effect/delivery deadline bounded by scope/relationship; payload release rechecks delivery/effect/retention boundaries and result upload requires committed release: `tests/organization/test_task_custody.py`; `tests/adapters/test_supervisor_core_composition.py`; effect reservation/terminal evidence/crash/reconciliation: `tests/effects/test_effect_reservation.py` | `PARTIAL` | E: real connector-specific effect reconciliation and long-running expiry/cancel/commit race evidence is absent. Payload release itself grants no effect authority. |
| G11 — revocation | H,L,E,O | Harness/sibling revocation: `tests/identity/test_revocation.py`; exact relationship subject exit/admin override, automatic expiry, credential/policy drift, lineage-fenced renew/revoke races, grant/task drift: `tests/organization/test_relationships.py`; `tests/property/test_relationship_lifecycle.py`; `tests/organization/test_task_custody.py`; relay and bilateral guest/home revoke: `tests/relay/test_server_agent_relay.py`; `tests/federation/test_bilateral_guest.py` | `BLOCKED_OWNER` | E/O: complete cross-resource matrix on real devices/partners, cross-domain signal SLO, continuity window, compromise adjudication, and PD-005/009 signatures are absent. |
| G12 — room authority | H,L,E,O | Membership/speaker/epoch/state/guest/transfer/tombstone/model gates: `tests/rooms/test_room_authority.py`; signed HTTP governance: `tests/integration/test_product_http_api.py` | `BLOCKED_OWNER` | E/O: maintained MLS lifecycle, two independently administered domains, formal model artifact, and signed PD-006/007 governance/history/retention policy are absent. |
| G13 — files and audit | H,L,E,O | Artifact quarantine/release/deletion crash recovery, exact legal hold, retention/event gates, scanner staleness/substitution, dedup non-disclosure, and guarded unlink: `tests/artifacts/test_staged_artifact.py`; audit chain/checkpoint: `tests/audit/test_audit_chain.py`; attachment/lifecycle HTTP and relay holding: `tests/integration/test_product_http_api.py`; `tests/relay/test_server_agent_relay.py` | `BLOCKED_OWNER` | E/O: maintained hostile-file scanner/corpus, replicated object host-loss restore, independent audit witness, and signed retention/deletion/legal policy are absent. |
| G14 — signed-peer abuse and semantic intent | H,L,E | Source/sink/grant bounds: `tests/authorization/test_grants.py`; task custody alternate-ingress checks plus exact action/resource/source/sink/classification drift denial during protected release: `tests/organization/test_task_custody.py`; `tests/adapters/test_supervisor_core_composition.py`; A2A/relay abuse containment: `tests/a2a/test_signed_native_gateway.py`; `tests/relay/test_server_agent_relay.py`; broker budgets: `tests/supervisor/test_clean_workers_and_model_broker.py` | `BLOCKED_EXTERNAL` | E: 1,000 adaptive hostile trials for every exact supported model/config, semantic-to-typed fuzzing, flood safety capacity, and exfiltration canaries are absent. Tool/network/budget/effect authority is not yet modeled by the release path. |
| G15 — supply chain | H,P,E,O | Threshold update verification plus atomic signed lifecycle contracts, durable anti-rollback, residual recovery, pinned executable health, owner-protected canonical state, immutable image digest, recursive package evidence, and Linux/macOS/Windows source-to-packed-launch CI: `tests/security/test_update_verifier.py`; `tests/security/test_distribution_lifecycle.py`; `tests/platform/test_host_support.py`; `tests/production/test_deployment_config.py`; `tests/conformance/test_release_manifest.py` | `BLOCKED_EXTERNAL` | Real-host package/local qualification does not satisfy E/O independent signing/root ceremony, published SBOM/provenance, or signed native installer/update/uninstall/rollback and recovery drills on macOS/Windows. |
| G16 — operations, failure, and adoption | L,E,O | Fail-closed component registry/config: `tests/operations/test_fail_closed_config.py`; deployment topology: `tests/production/test_deployment_config.py`; health/readiness/recovery: `tests/production/test_postgres_runtime.py`; signed actual SQLite backup/restore and forged-seal/path-race negatives: `tests/operations/test_backup_restore.py`; CLI flow: `tests/integration/test_cli_product_journey.py`; relay failure paths: `tests/relay/test_server_agent_relay.py` | `BLOCKED_OWNER` | E/O: locked authenticated PostgreSQL restore execution, off-host/KMS backup custody, full dependency outage matrix, kill-switch SLO under load, physical/admin topology, staffing/stop rules, and reviewed component adoption/replacement records are absent. |
| G17 — owner policy | O | Executable conservative floors: `src/agentnet/operations/policy_defaults.py`; floor/runtime tests: `tests/operations/test_secure_policy_defaults.py`; `tests/operations/test_runtime_policy_enforcement.py`; OIDC purpose coverage: `tests/operations/test_fail_closed_config.py` | `BLOCKED_OWNER` | O: no signed current PD-001 through PD-011 records exist. Defaults prevent unsafe enablement but are not owner consent. |
| G18 — discovery, version, and config | H,L,E | Non-enumerating discovery; negotiation/critical-extension rejection; immutable unsupported-event quarantine/replay; expand-migrate-verify-contract rollout; N/N-1 window; one-use versioned config migration/rollback; immutable first-release migration-1 checksum plus contiguous Core migrations 2–4; exact SQLite v3 catalog/checksum verification, one-transaction v3→v4 N/N-1 upgrade, Approval v1/v2/v3→v4 atomic migration, injected rollback with no partial schema, four-migration PostgreSQL catalog generation, and rejection of unilateral/prototype/tampered/future/unsupported-old state: `tests/discovery/test_non_enumerating_directory.py`; `tests/protocol/test_version_negotiation.py`; `tests/operations/test_versioning_runtime.py`; `tests/production/test_postgres_runtime.py` | `BLOCKED_EXTERNAL` | E: independently deployed mixed-version peers and production deprecation/rollback drills remain external. Prototype databases are rejected rather than treated as consent; production mixed-version upgrade evidence is absent. |
| G19 — freshness, crypto, and audit roots | H,L,E,O | Canonical signatures/freshness/replay: `tests/security/test_signatures_and_replay.py`; IPC restart/root fencing: `tests/security/test_ipc_capability.py`; key rotation/recovery: `tests/identity/test_credential_rotation.py`; `tests/identity/test_recovery.py`; audit checkpoint: `tests/audit/test_audit_chain.py` | `BLOCKED_OWNER` | E/O: cross-language vectors, cache-partition trials, independent KMS/audit roots, backup/key restore, witness outage/backlog, and catastrophic-root rebuild are absent. |

## Stop-ship aggregation

The release verdict remains blocked while any gate is not `PASSED`. In this
snapshot G04 has a concrete non-green result, and every required external or
accountable-owner tier listed above is still absent. There is no remaining
locally identified implementation-gap row in the 85-requirement ledger.
Disabling a high-risk optional feature does not waive requirements for the
ordinary self-hosted communication product that remains enabled.

Promotion requires an immutable evidence record identifying the exact source,
command, selected tests, environment, versions, seeds/corpus, artifacts,
operator, and independent reviewer where applicable. Skips, xfails, missing
fixtures, unavailable services, mock ceremonies, deterministic no-inference
runs, or reviewed upstream defects remain non-passing evidence.