# DSG ONE — Production verification snapshot (6 November 2026)

**Classification:** PUBLIC SUMMARY / DATED OPERATOR-VERIFIED OBSERVATION — **NOT** an anonymous independent audit, certification, or whole-system E2E PASS.

- **Date / window:** 2026-11-06, 15:14–16:31 UTC (Asia/Bangkok: 22:14–23:31).
- **Deployment:** `dsg-spacetime-aws-prod`.
- **Private runtime Source SHA at verification:** `8c76bf60b98ed4637c649d39bc9b57e21047b1db`.
- **Immutable serving Spacetime image at host readback:** `sha256:cf93ecd639982638abeda7ca8ff879c0d515df2c2720ef919143083bb73f53e9`.
- **Configured Catalog:** 22 Nodes, 45 Routes, 45 paired Route Skills, 17 advertised MCP Tool Skills. **Configured != working.**
- **Real read-only provider checks:** 15/15 returned scoped results under composed plans, evidence indices **#807–#821**, each with an individual evidence hash in the protected owner's production playbook.
- **Evidence ledger:** `spacetime_verify_evidence({}) -> {"valid":true,"records":822}` at the observation, not a public cryptographic chain dump.
- **Production restoration:** Human Owner GitHub Action `42241162284` SUCCESS; read-only post-restore SSM `2934bef6-8b7f-4bca-9348-d5f1fff63df2` found existing Native / A2A / Workroom overlays attached, serving digest unchanged, **5/5 healthy containers** at the time. GitHub and SSM logs require authorized access.

## What actually passed

| Capability | Scope of proof | Evidence |
|---|---|---|
| Linux Native | Real `device.remote.status` provider result | #807 |
| Android 13 | Real registered bound-device status | #808 |
| Android 16 | Real registered bound-device status | #809 |
| Cinema | `browser.remote.status`, `ok=true`, `connected=true`; **not** browser clicking | #810 |
| Private/public GitHub metadata | Read-only repository metadata returned; **not** a write/deploy | #811–#812 |
| Identity auth/onboarding/scope reads | OAuth resource metadata returned | #813–#815 |
| Marketplace public catalog | Real `items` array returned; **not** a seller write/checkout | #816 |
| Native process listing | Provider result on Linux + Android 13/16; no process commands run | #817–#819 |
| DSG autonomous level + AIMO status | Provider status `COMPLETED`; **not** autonomous completion | #820–#821 |

## What is still blocked or not verified

- `route.a2a.dsg-os.browser-observe`: **BLOCK** `A2A_DELEGATION_BRIDGE_REQUIRED`.
- `route.dsg-one-v1.mcp.list-app-builder-jobs`: **FORBIDDEN** `USER_OAUTH_DELEGATION_DENIED`.
- **Cinema browser execution:** not verified merely by its connected status.
- **Workroom:** store and worker responsive but 5 historic jobs remain `BLOCKED`; human Owner decided `NOT_APPROVED` to continue those old jobs. Actual canonical cancellation `KILLED` **NOT VERIFIED**. A fresh user-owned Completion-first goal `Claim -> Checkpoint -> Resume -> useful artifact -> evidence` is **NOT VERIFIED**.
- **Whole system:** `NOT_VERIFIED`. No claim of SOC 2, ISO, independent external audit, third-party platform acceptance or universal product readiness.

## Publicly checkable artifacts vs owner-only receipts

The record identifiers and SHA digests above identify exactly what the operator checked. **Anonymous visitors cannot independently verify private GitHub Actions, AWS SSM or authenticated Spacetime evidence content from these identifiers alone.** Do not advertise them as a public independently reproducible proof.

To reproduce what your **authorized** account is permitted to inspect: open the DSG Native + Cinema E2E connection, confirm OAuth identity, use `spacetime_capability_catalog`, run the exact signed **read-only** Route in the [Tool / Route Guide](/agent-route-guide-2026-11-06.md), then check the provider result and `spacetime_verify_evidence`. Do not self-approve high-risk actions or infer any missing Route ID.

## Where to navigate

- [Start — paths for users and agents](/start)
- [Verification page](/verification/production-status-2026-11-06)
- [Capabilities](/capabilities) (older snapshot retained and labelled historical)
- [Releases](/releases)
- [Workroom (sign-in required)](/dsg/workroom)
- [Approvals (authorized Owner)](/dsg/approvals)
- [Agent Tool / Route Guide](/agent-route-guide-2026-11-06.md)

**Machine-readable companion:** `/api/public/production-status-2026-11-06.json`.

**Revision gate:** this is a snapshot at the above date, not live telemetry. If the runtime, routes, source SHA, permissions or evidence change, create a new source-bound E2E Plan Revision and dated publication. Keep historical evidence intact.