PUBLIC VERIFICATION / FIXED SCENARIOS
Same policy. Fresh evidence.
Execute trusted packaged checks, inspect the evidence, and preserve independent human authority.
TRUSTED PACKAGED SOURCE / REAL SERVER EXECUTION
Fresh verification. Inspectable evidence.
Connecting to the verification service. No result is assumed.
Production disabled · Human Gate unexecuted · execution_authorized=false
ACTUAL SERVER EXECUTION
—
NEXT GATE—Production execution stays disabled.
- Scenario
- Candidate
- Run ID
- Started UTC
- Evidence SHA256
Fixed DEMO scenarios run on the server. History and quota counters are ephemeral and may reset after scale-to-zero. No production execution authority. Historical GitLab CI and Duo records below remain historical.
Historical reference evidence · recorded CI, fixtures and Duo reviews
OBSERVED DECISION
ALLOW
Complete evidence
CHECKS_PASSED
execution_authorizedfalse
What the evidence says
- Tests passed
- 139 / 139
- Mandatory identities
- 139 / 139
- Next gate
- HUMAN_APPROVAL
- Evidence source
- LOCAL_TESTED
Fixture candidate (historical, separate from the qualified CI checkpoint)
81aadcf643f3375046c79c4ff611096923cd93a0Scanner findings
| Severity | Rule | Source |
|---|---|---|
| LOW | B404 | src\releasegate\evidence.pyline 7 |
| LOW | B603 | src\releasegate\evidence.pyline 239 |
Bandit 1.8.6 · 7 scanned files. Unsafe negative fixture is scanned only; never executed.
OBSERVED DECISION
DENY
High-severity security finding
SECURITY_HIGH
execution_authorizedfalse
What the evidence says
- Tests passed
- 139 / 139
- Mandatory identities
- 139 / 139
- Next gate
- None · resolve denial
- Evidence source
- LOCAL_TESTED
Fixture candidate (historical, separate from the qualified CI checkpoint)
81aadcf643f3375046c79c4ff611096923cd93a0Scanner findings
| Severity | Rule | Source |
|---|---|---|
| LOW | B404 | src\releasegate\evidence.pyline 7 |
| LOW | B603 | src\releasegate\evidence.pyline 239 |
| LOW | B404 | src\unsafe_scanner_fixture.pyline 1 |
| HIGH | B602 | src\unsafe_scanner_fixture.pyline 4 |
Bandit 1.8.6 · 8 scanned files. Unsafe negative fixture is scanned only; never executed.