{
  "schema": "thothii-task4-certification-v1",
  "generated_on": "2026-08-18",
  "started_at_utc": "2026-08-18T14:16:40Z",
  "ended_at_utc": "2026-08-18T14:20:10Z",
  "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
  "source_immutability": {
    "status": "PASS",
    "tracked_changes_after_freeze": false,
    "allowed_untracked": [".playwright-cli/", ".thothctl/"]
  },
  "source_commits": {
    "task4_candidate": "b31b27e5845ffd3adf311429367319beaba263c7",
    "task1": "d43738eeae6d14bb5e470093058b069a983f5372",
    "task2": "5f9a3ae066a060b43a11a959b60a1efadd1c2425",
    "task3": "0d8e707533fada938c99eb06f8457150e7ef2b40",
    "task3_follow_up": "b31b27e5845ffd3adf311429367319beaba263c7",
    "fix_round_1_source": "10cd66fe6a5b484a4dc569326a228c1c5484a5d4",
    "fix_round_2_source": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
    "historical_task15_final": "74b062f1a737103524cbe706346cfd65f87cdfd1"
  },
  "versions": {
    "node_contract": "v24.16.0",
    "node_host_default": "v25.6.1",
    "go": "go1.26.5",
    "pi": "0.80.3"
  },
  "retained_report": ".superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md",
  "task4_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md",
  "fix_round_2_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/fix-round-2-report.md",
  "workflow": {
    "run_id": "32147345625",
    "url": "https://github.com/mptyl/ThothII/actions/runs/32147345625",
    "event": "workflow_dispatch",
    "head_sha": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
    "status": "completed",
    "conclusion": "failure",
    "windows_job": {
      "name": "Windows clone and Compose contract",
      "job_id": "95744249248",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32147345625/job/95744249248",
      "conclusion": "failure",
      "native_step": "Run native Windows retained-capability tests",
      "native_step_conclusion": "success",
      "command": "go test ./internal/safeio ./internal/backup ./internal/authstorage -count=1",
      "requested_packages": ["internal/safeio", "internal/backup", "internal/authstorage"],
      "executed_packages": ["internal/safeio", "internal/backup", "internal/authstorage"],
      "not_executed_packages": [],
      "package_results": {
        "internal/safeio": "PASS (22.058s)",
        "internal/backup": "PASS (7.161s)",
        "internal/authstorage": "PASS (16.088s)"
      },
      "failed_step": "Verify Windows clone contract",
      "failure_category": "baseline_powershell_parser",
      "failure_detail": "scripts/test-windows-clone-contract.ps1:208 parses $remoteYaml: as an invalid variable reference"
    },
    "lf_compose_docs_typescript_job": {
      "name": "LF, Compose, docs, and TypeScript",
      "job_id": "95744249458",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32147345625/job/95744249458",
      "conclusion": "failure",
      "failed_step": "Verify Compose and installation contracts",
      "category": "baseline_ci_contract",
      "detail": "unified Compose contract passed; test-no-deployment-coupling-scope.sh stopped on TMPDIR: unbound variable",
      "downstream_steps": "skipped"
    },
    "linux_docker_job": {
      "name": "Linux Docker deployment and rollback",
      "job_id": "95744249354",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32147345625/job/95744249354",
      "conclusion": "failure",
      "failed_step": "Run unified deployment smoke",
      "category": "infrastructure_prerequisite",
      "detail": "Task 13 smoke failed before deployment because rg is required",
      "cleanup": "PASS",
      "image_manifest": "not_generated"
    },
    "windows_docker_startup_job": {
      "name": "Native Windows Docker Desktop/WSL2 startup",
      "job_id": "95744250450",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32147345625/job/95744250450",
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "workflow_conclusion": "skipped",
      "reason": "workflow conditions skipped the job; no Windows Docker Desktop/WSL2 command executed"
    }
  },
  "docker_image_evidence": {
    "authentication_smoke": {
      "status": "PASS",
      "docker_images": [],
      "reason": "no_docker_images_exercised"
    },
    "unified_docker_smoke": {
      "status": "FAIL",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "run_id": "32147345625",
      "workflow_job_id": "95744249354",
      "manifest": ".artifacts/task-15/unified-docker-images.json",
      "reason": "workflow attempt stopped before deployment because rg is required",
      "cleanup": "PASS",
      "images": 0,
      "historical": {
        "status": "PASS",
        "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1",
        "run_id": "20260818070637-66409-30058",
        "manifest_sha256": "9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6",
        "images": 5,
        "cleanup": "PASS"
      }
    }
  },
  "gates": {
    "posix_registry_ownership": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "evidence": "backend Node 24 full suite including local-registry ownership coverage"
    },
    "stagearchive_unix_retained_capability": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "evidence": "focused safeio/backup tests, Go race suite, and Unix ancestor-swap coverage"
    },
    "windows_stagearchive_retained_capability": {
      "status": "PASS",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "evidence": "native Windows backup package passed, including the two-file shared retained-root staging test"
    },
    "windows_claim_retained_capability": {
      "status": "PASS",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "evidence": "native Windows safeio and authstorage packages passed concurrent claim/consume coverage"
    },
    "workflow_lf_compose_docs_typescript": {
      "status": "FAIL",
      "classification": "baseline_ci_contract",
      "reason": "TMPDIR was unset after the unified Compose contract passed"
    },
    "workflow_linux_docker": {
      "status": "FAIL",
      "classification": "infrastructure_prerequisite",
      "reason": "runner did not provide rg; cleanup proof passed and no image manifest was generated"
    },
    "go_security_build": {
      "status": "PASS",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "focused_packages": 3,
      "race_packages": 18,
      "focused_test": "PASS",
      "race": "PASS",
      "vet": "PASS",
      "host_build": "PASS"
    },
    "windows_cross_compile": {
      "status": "PASS",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "focused_test_packages": 3,
      "cli_build": "PASS",
      "execution": "cross_compile_only_not_native_execution"
    },
    "backend_node24": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "files": 76,
      "tests": 1092,
      "typecheck": "PASS",
      "build": "PASS",
      "note": "an initial full run had one workspace-registry timeout; focused rerun and complete rerun passed"
    },
    "frontend_node24": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "files": 61,
      "tests": 444,
      "typecheck": "PASS",
      "build": "PASS"
    },
    "authentication_and_f1_smoke": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "filtered_e2e": "1 passed",
      "sentinel_leak_scan": "PASS"
    },
    "harness_pytest": {
      "status": "FAIL",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "passed": 951,
      "failed": 1,
      "skipped": 4,
      "subtests": 232,
      "failure": "test_column_decisions::test_f4_emits_column_types: workflow.yaml not found from harness test cwd"
    },
    "authentication_docs": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
    },
    "shell_syntax": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
    },
    "authentication_smoke_runtime": {
      "status": "PASS",
      "node": "v24.16.0",
      "sentinel_leak_scan": "PASS"
    },
    "compose_default": {
      "status": "FAIL",
      "reason": "required THT_WORKSPACE_GIT_REMOTE was not available"
    },
    "compose_unified": {
      "status": "FAIL",
      "reason": "compose.unified.yaml is absent from the frozen source"
    },
    "unified_docker_smoke": {
      "status": "FAIL",
      "source_commit": "2a9359071257f9b8a71d36ec2bbb25b161003f81",
      "workflow_run_id": "32147345625",
      "reason": "remote workflow attempted the smoke but stopped before deployment because rg is required",
      "cleanup": "PASS",
      "image_manifest": "not_generated"
    },
    "ruff": {
      "status": "FAIL",
      "errors": 192,
      "classification": "known_baseline"
    },
    "mkdocs_strict": {
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "historical_status": "FAIL",
      "historical_warnings": 69
    },
    "canonical_install_docs": {
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "historical_status": "FAIL"
    },
    "workspace_install_docs": {
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "historical_status": "FAIL"
    },
    "pi_user_auth_compose": {
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "historical_status": "FAIL"
    },
    "deployment_coupling": {
      "status": "NOT_RUN",
      "classification": "BLOCKED",
      "historical_status": "FAIL"
    },
    "l2": {
      "status": "PENDING",
      "reason": "configured secret layout unavailable; gate not run after stop"
    },
    "manual_psd": {
      "status": "PENDING",
      "reason": "approved real identity/access unavailable; gate not run after stop"
    },
    "provider_readiness": {
      "status": "PENDING",
      "reason": "provider prerequisite unavailable; gate not run after stop"
    }
  },
  "review": {
    "original_important_findings_resolved": 3,
    "fix_round_2_important_lifecycle": "ADDRESSED",
    "fix_round_2_minor_windows_diagnostics": "ADDRESSED",
    "verdict": "PASS",
    "reason": "the lifecycle controller is bounded and cancellation-aware with cancel, bounded join, and lock-release proof; the temporary Windows diagnostic matrix is removed; exact-source native safeio, backup, and authstorage all pass"
  },
  "remediation_status": "PASS",
  "release_complete": false,
  "authentication_implementation_complete": true,
  "release_readiness": "FAIL",
  "release_readiness_pending_external_gates": true
}