PASS · Owner-observed
Exact-main CI
Push event, exact source SHA
Inspect run #41662202368 (authorized access)Public evidence · Dated 3 November 2026 · Asia/Bangkok
Android 13 Native: Production Evidence
Verified: exact-source image Build, zero-finding ECR scan, owner-protected image promotion and additive Android 13 host activation. This is a dated operational report, not live telemetry or a whole-system Agent E2E claim.
PASS · Controlled production activation
Owner workflow #41678418832 completed successfully; host activation required exactly five additive Native routes and original-device preservation.
NOT VERIFIED · Provider E2E
The workflow explicitly reported SECOND_DEVICE_PROVIDER_E2E=NOT_VERIFIED. A real signed provider reply and result replay still require separate testing.
Immutable release identity
- Exact Git main/source SHA
- b8347d175a96613f2f5a628900198bbed4bc6351
- ECR image digest (scan COMPLETE, zero findings at inspection)
- sha256:3552940f2c26d657dfca634046e066ef5aa94589ee9611a346018e42122067c2
Evidence by gate
Run links point to a private production repository and may require specifically granted read-only access.
PASS · Owner-observed
Immutable Image Build
Runtime, agents, integrations and ECR push
Inspect run #41662202353 (authorized access)PASS · Owner-observed
Owner image promotion
Protected owner workflow; HTTPS health; anonymous MCP denied
Inspect run #41677352169 (authorized access)PASS · Owner-observed
Android 13 atomic activation
Owner-signed host update; 5 routes; existing device and peers preserved
Inspect run #41678418832 (authorized access)How an independent reviewer checks the evidence
- Confirm the four GitHub run IDs, success states and identical source SHA. CI and Image Build are push events; protected release and Native activation are owner workflow_dispatch events.
- Inspect non-secret job logs and redacted artifacts for exact preflight, ECR and host activation proof markers. A green badge alone is not complete proof.
- With authorized AWS read-only access, resolve the ECR SHA tag to the displayed digest and verify scan COMPLETE and zero findings at that time.
- Separately exercise the bound Android 13 route, cross-device rejection and result/evidence replay. Until that completes, record NOT VERIFIED.
Public readers can review this report without login, but cannot independently validate private GitHub logs or AWS ECR without access. No public private keys, customer identifiers or raw enrollment binding are published.
Remaining verification gates
Android 13 live provider result/replay, cross-device isolation, Workroom Claim → Checkpoint → Resume → reply, external member isolation and human MFA/OTP E2E have not been demonstrated by these release runs. No claim of independent certification or continuous production uptime is made.