{
  "schemaVersion": 1,
  "kind": "EAOV1AcceptanceReport",
  "candidate": "fae743c2db30e19711439322a9f83c50c0c44370",
  "startedAt": "2026-10-10T03:31:04.571Z",
  "finishedAt": "2026-10-10T03:31:18.984Z",
  "durationMs": 14413,
  "accepted": true,
  "environmentPreflightIncluded": false,
  "stagingTestsIncluded": false,
  "gates": [
    {
      "id": "foundation",
      "ok": true,
      "exitCode": 0,
      "durationMs": 9255,
      "stdoutTail": "\n> @eao/platform@0.0.0 check\n> node scripts/check-runtime-syntax.mjs && node scripts/run-foundation-validation.mjs\n\nSyntax checked 330 modules\nEAO foundation valid: 516 boundaries and contract identity checked.\n",
      "stderrTail": ""
    },
    {
      "id": "tests",
      "ok": true,
      "exitCode": 0,
      "durationMs": 4773,
      "stdoutTail": "✔ passes idempotency only after validation and bounds responses (0.469956ms)\n✔ returns server-resolved workload identity without token or directory roles (2.582442ms)\n✔ workload authentication rejects human principals (0.783975ms)\n✔ workload authentication requires bearer transport and exact principal resolution (1.451378ms)\n✔ renders a deterministic digest-bound identity deployment bundle (26.634691ms)\n✔ resource tampering invalidates the rendered bundle digest (1.968198ms)\n✔ renders exact non-admin SPIRE entries from approved selectors (1.137758ms)\n✔ pod identity patches use the read-only CSI socket and hardened defaults (1.306477ms)\n✔ runtime configuration preserves accepted and outbound audience separation (1.254703ms)\n✔ unready profiles cannot produce deployment resources (0.63281ms)\n✔ rendered resources contain no secret or bearer-token fields (0.955869ms)\n✔ shared cell binds every runtime boundary to an exact SPIFFE identity (3.743942ms)\n✔ dedicated deployment uses the same identity controls without a product fork (0.505786ms)\n✔ writable direct host socket or delegated identity fails readiness (0.308265ms)\n✔ shared service accounts and SPIFFE IDs fail workload isolation (0.403121ms)\n✔ namespace and service account selectors must derive the exact SPIFFE ID (0.296295ms)\n✔ cross-domain and wildcard audiences fail closed (0.354472ms)\n✔ runtime profile identity drift and incomplete gateway audience chains are rejected (0.354529ms)\n✔ reanalysis creates a linked new Attempt and never overwrites the prior result (5.5458ms)\n✔ a new Attempt identifier must be unique (0.225728ms)\n✔ reanalysis is bounded by the Mission attempt limit (0.235621ms)\n✔ annotations append review evidence instead of changing model output (0.219921ms)\n✔ result approval requires exact human approval (0.262767ms)\n✔ matching approval authorizes a high-impact result (0.227623ms)\n✔ approval cannot be replayed for a different action fingerprint (0.209817ms)\n✔ cross-tenant workspace commands are denied (0.200142ms)\n✔ the shell cannot invoke a command without its permission (0.218471ms)\n✔ rejection requires an accountable reason (0.400498ms)\n✔ escalation requires a governed queue (0.184838ms)\n✔ unsupported commands fail closed (0.148874ms)\n✔ missing workspace command context fails closed (0.119794ms)\nℹ tests 802\nℹ suites 0\nℹ pass 797\nℹ fail 0\nℹ cancelled 0\nℹ skipped 5\nℹ todo 0\nℹ duration_ms 4626.019076\n",
      "stderrTail": ""
    },
    {
      "id": "trusted-governance",
      "ok": true,
      "exitCode": 0,
      "durationMs": 165,
      "stdoutTail": "✔ overall outcome denies if any required governance control denies (1.972698ms)\n✔ fingerprints are stable across object key order (1.397786ms)\n✔ fails before persistence when required control results are incomplete (0.698547ms)\n✔ requires the runtime governance persistence boundary (0.251361ms)\n✔ commitAuthorized derives authorization and ignores a caller-forged allow (1.234166ms)\n✔ commitAuthorized persists exact approval evidence from evaluated authorization (0.744289ms)\n✔ commitAuthorized rejects mismatched mission or identity context before persistence (0.303391ms)\n✔ records authorization evidence (1.482657ms)\n✔ fails closed when ledger writes are unavailable (0.257283ms)\n✔ duplicate governance decisions are idempotent (0.565113ms)\n✔ allows only the intersection of user and agent grants (3.032621ms)\n✔ denies cross-tenant resource access (0.334366ms)\n✔ denies cross-environment resource access (0.216131ms)\n✔ denies unverified identities (0.207254ms)\n✔ denies when the agent lacks the resource grant (0.239844ms)\n✔ denies access outside the exact granted resource (0.252595ms)\n✔ denies data above identity and agent clearance (0.20755ms)\n✔ explicit deny overrides matching grants (0.300794ms)\n✔ denies a grant scoped to another environment (0.255107ms)\n✔ denies an expired grant (0.480313ms)\n✔ denies data above the grant classification ceiling (0.220388ms)\n✔ agents are read-only by default for mutating actions (0.19527ms)\n✔ agents may mutate only with an explicit write-enabled grant (0.184323ms)\n✔ approval-gated write grants deny mutation without matching approval (0.265201ms)\n✔ approval-gated write grants allow only an exact matching approval (0.991194ms)\n✔ expired approvals cannot authorize a write (0.197754ms)\n✔ consumed approvals cannot be reused (0.177145ms)\n✔ approval cannot be replayed for a different resource (0.170455ms)\n✔ fails closed when required authorization context is missing (0.260754ms)\n✔ builds audit-ready authorization evidence without embedding grants (0.449073ms)\n✔ authorization evidence records consumed approval state (0.140402ms)\nℹ tests 32\nℹ suites 0\nℹ pass 32\nℹ fail 0\nℹ cancelled 0\nℹ skipped 0\nℹ todo 0\nℹ duration_ms 116.959557\n",
      "stderrTail": ""
    },
    {
      "id": "reference-uat",
      "ok": true,
      "exitCode": 0,
      "durationMs": 218,
      "stdoutTail": "> @eao/platform@0.0.0 uat\n> node scripts/run-reference-uat.mjs\n\n{\n  \"status\": \"passed\",\n  \"executedAt\": \"2026-08-28T14:00:00.000Z\",\n  \"proofBoundary\": \"synthetic-reference-runtime-only\",\n  \"scenarios\": [\n    {\n      \"missionId\": \"uat-l1-mission\",\n      \"expectedState\": \"RESOLVED\",\n      \"traceEvents\": 17\n    },\n    {\n      \"missionId\": \"uat-coding-mission\",\n      \"expectedState\": \"WAITING_HUMAN_REVIEW\",\n      \"traceEvents\": 15\n    },\n    {\n      \"missionId\": \"uat-admission-mission\",\n      \"expectedState\": \"COMPLETED\",\n      \"traceEvents\": 7\n    },\n    {\n      \"missionId\": \"uat-paper-mission\",\n      \"expectedState\": \"COMPLETED\",\n      \"traceEvents\": 15\n    }\n  ],\n  \"negativeTests\": [\n    \"cross-tenant-mission-read-denied\"\n  ],\n  \"traceIntegrity\": {\n    \"valid\": true,\n    \"code\": \"TRACE_INTEGRITY_VERIFIED\",\n    \"count\": 54,\n    \"head\": \"sha256:7d888092aa41902f0cb2b4c83ba57ed1ef714e82180f49ba33e2a273ed3ec5d9\"\n  }\n}\n",
      "stderrTail": ""
    }
  ],
  "caveat": "Repository acceptance only. Environment-specific preflight/deployment evidence was not supplied."
}