Identity and tenancy
Organization and tenant records; reference OIDC claim adapter; session, role, invitation and tenant-isolation controls.
Evidence ceiling E3Proof boundary
ENTERPRISE OPERATING REFERENCE
Durable seller-controlled enterprise reference environment
Implemented and seller-tested as a bounded reference environment—not customer production.
Operating plane
Core lifecycle mechanics are implemented.
The reference suite covers institutional control mechanics without manufacturing buyer identity, custody, adoption or assurance.
Durable reference state
Outcome Contracts, observations, certificates, immutable lineage, REOPEN events, append-only audit, backup/export and integrity-checked restore.
Delivery and credentials
Webhook retry and dead-letter replay; API credential lifecycle, rotation, idempotency and rate controls.
Signing lifecycle
Generate, activate, sign/verify interface, rotate, revoke and supersede. Reference local custody is implemented; external institutional KMS/HSM is an adapter and is not connected.
Security telemetry
Machine-readable auth, denial, tenant mismatch, substitution, signature, STOP, REOPEN, webhook, key and admin events.
Recovery and retention
Backup/restore integrity, recovery rehearsal, deletion-request controls and explicit retention configuration.
Seller-controlled production-readiness suite
Reference controls pass their disclosed tests.
The current release exercises tenant isolation, persistence export/restore, idempotency, race-safe append-only lineage, webhook retry/dead-letter replay, credential and key rotation, revoked-key state, audit integrity, recovery rehearsal, rate/resource controls and dependency failure.
- Reference identity / role / tenant controls
- PASS
- Contract, observation and certificate state
- PASS
- Immutable FINAL → REOPENED lineage
- PASS
- Webhook retry / dead letter / replay
- PASS
- Credential and key lifecycle
- PASS
- Security telemetry export
- PASS
- Backup / restore integrity
- PASS
- Tenant isolation and rate controls
- PASS
Custody and deployment truth
Reference readiness is not buyer production.
The public hosting project binds D1 for the durable schema. Public stateful operations remain fail-closed, R2 is not bound, and no institutional KMS/HSM, external IdP tenant, SIEM, customer webhook or customer credential estate is connected.
DURABLE APPLICATION SCHEMA
BOUND · MIGRATED
REFERENCE LOCAL KEY CUSTODY
IMPLEMENTED AND SELLER-TESTED
EXTERNAL INSTITUTIONAL KMS
ADAPTER DEFINED · NOT CONNECTED
REFERENCE IDENTITY / ROLE / TENANT CONTROLS
IMPLEMENTED AND SELLER-TESTED
EXTERNAL IDENTITY INTEGRATION
NOT PERFORMED
CUSTOMER PRODUCTION
NOT PERFORMED