# DSG ONE — Android 13 Native Production Evidence (3 November 2026)

**Evidence classification:** PUBLIC — sanitized, dated operational report.  
**Status:** Owner-controlled production image and Android 13 atomic host activation: **PASS**. Actual Android 13 provider execution, cross-device denial, result replay, member isolation and whole-system Agent E2E: **NOT VERIFIED**.

This document is a reproducibility guide for authorized auditors, **not** a live Production status API, security certification, or evidence that every configured route executed.

## Exact immutable release identity

- Main/source SHA: `b8347d175a96613f2f5a628900198bbed4bc6351`
- AWS ECR image digest: `sha256:3552940f2c26d657dfca634046e066ef5aa94589ee9611a346018e42122067c2`
- Evidence date: 2026-11-03 (Asia/Bangkok)

## Evidence matrix

| Gate | Result | Linked run |
| --- | --- | --- |
| Exact-main CI, event=push, exact SHA | PASS | [#41662202368](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/41662202368) |
| Image compile and push, same SHA | PASS | [#41662202353](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/41662202353) |
| ECR image tag/digest and scan COMPLETE; findings 0 | PASS at inspected timestamp | AWS ECR read-only record; access required |
| Owner-signed production image promotion; HTTPS health and anonymous MCP deny | PASS | [#41677352169](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/41677352169) |
| Additive Android 13 signed Native host activation | PASS, 5 routes in host activation contract | [#41678418832](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/41678418832) |
| Live Android 13 bound-provider command, cross-device rejection and signed result replay | NOT VERIFIED | Separate runtime test still required |
| Workroom Claim / Checkpoint / Resume / provider reply | NOT VERIFIED | Separate real-job proof still required |
| Owner MFA / human OTP end-to-end | PENDING | Explicitly pending in owner release log |

In the actual owner release run, non-secret results included `SIGNED_APPROVER_IMAGE_PREFLIGHT=PASS`, `SIGNED_APPROVER_IMAGE_ECR=PASS scan=COMPLETE findings=0`, `SIGNED_APPROVER_IMAGE_OWNER_RELEASE=PASS owner_mfa_e2e=PENDING`, and `ANONYMOUS_MCP_DENY=PASS human_otp_e2e=PENDING`.

In the actual Android 13 activation run, non-secret results included `SECOND_DEVICE_OWNER_GATE=PASS`, `SECOND_DEVICE_IMAGE_GATE=PASS scanned=true exact_source=true`, `SECOND_DEVICE_SIGNED_DELTA=PASS private_key_not_exported=true`, `SECOND_DEVICE_ATOMIC_HOST=PASS`, and **`SECOND_DEVICE_PROVIDER_E2E=NOT_VERIFIED`**. The host activation step required exact `routes_added=5`, original device preservation, unchanged immutable image and peer preservation.

## Reproduce the evidence

**Without access:** this report and its GitBook counterpart are publicly readable; a public reader can identify the bounded claim, immutable identifiers and audit references. The GitHub workflow pages are in a **private** repository and may not be accessible anonymously. Their mere URLs do not establish public independent verification.

**With specifically granted read-only GitHub and AWS access:**

1. Inspect GitHub runs #41662202368, #41662202353, #41677352169 and #41678418832. Confirm actual status `completed/success`, run types, exact SHA and owner actor.
2. Read job-step results and redacted artifacts, not only the green badge. Confirm the named nonsecret proof markers. Verify no failures/skipped required stage.
3. Resolve ECR image tag equal to the source SHA and compare digest exactly. Read the image-scan result, requiring status `COMPLETE` and no findings at the inspected time.
4. Independently test the new Android 13 bound route, a rejected wrong-device request, and the plan/principal/result/evidence replay chain. **Do not** mark these PASS on the basis of CI or host activation alone.
5. Record date, run IDs, immutable source and digest, test outputs and exceptions; issue a new receipt if source or runtime changes.

## Disclosure and limitations

No private key, enrollment binding contents, OAuth principal, device identifier, internal server address, customer data or private source history is published here.

This 3 November release verification **does not rewrite** the dated [24 October supervised pilot](https://dsg.pics/pilot-verification-2026-10-24.md). Member E2E, two-account isolation, a real Android 13 provider response, complete Workroom recovery, human MFA verification and continuous uptime are **not** established by these runs.

- [Public GitBook report](https://dsg-3.gitbook.io/dsg-docs/dsg-docs/dsg-one-canonical-7-docs/verification/android13-native-production-evidence-2026-11-03)
- [DSG ONE website](https://dsg.pics/)