{
  "schema": "thothii-task4-certification-v1",
  "generated_on": "2026-08-18",
  "started_at_utc": "2026-08-18T09:26:00Z",
  "ended_at_utc": "2026-08-18T09:48:36Z",
  "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
  "source_immutability": {
    "status": "PASS",
    "tracked_changes_after_freeze": false,
    "allowed_untracked": [".playwright-cli/", ".thothctl/"]
  },
  "source_commits": {
    "task4_candidate": "b31b27e5845ffd3adf311429367319beaba263c7",
    "task1": "d43738eeae6d14bb5e470093058b069a983f5372",
    "task2": "5f9a3ae066a060b43a11a959b60a1efadd1c2425",
    "task3": "0d8e707533fada938c99eb06f8457150e7ef2b40",
    "task3_follow_up": "b31b27e5845ffd3adf311429367319beaba263c7",
    "historical_task15_final": "74b062f1a737103524cbe706346cfd65f87cdfd1"
  },
  "versions": {
    "node_contract": "v24.16.0",
    "node_host_default": "v25.6.1",
    "go": "go1.26.5",
    "pi": "0.80.3"
  },
  "retained_report": ".superpowers/sdd/2026-08-16-thothii-authentication/task-15-report.md",
  "task4_report": ".superpowers/sdd/2026-08-18-thothii-authentication-remediation/task-4-report.md",
  "workflow": {
    "run_id": "32122302381",
    "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381",
    "event": "workflow_dispatch",
    "head_sha": "b31b27e5845ffd3adf311429367319beaba263c7",
    "status": "completed",
    "conclusion": "failure",
    "windows_job": {
      "name": "Windows clone and Compose contract",
      "job_id": "95665197885",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197885",
      "conclusion": "failure",
      "native_step": "Run native Windows retained-capability tests",
      "native_step_conclusion": "failure",
      "command": "go test ./internal/safeio ./internal/backup -count=1",
      "requested_packages": ["internal/safeio", "internal/backup"],
      "executed_packages": ["internal/safeio", "internal/backup"],
      "not_executed_packages": ["internal/authstorage"],
      "focused_tests_observed": [
        "TestRemoveCanonicalPrivateClaimRetainsParentDuringDeletion",
        "TestRemoveCanonicalPrivateClaimPreservesOrphan",
        "TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup"
      ],
      "failure_categories": [
        "safeio retained-capability tests failed with unsafe file",
        "backup retained-staging tests failed with unsafe file",
        "backup TestRestoreLifecycleLockExcludesCompetingTransactionsUntilTerminalCleanup timed out after 10m0s",
        "some backup fixture tests could not read their external-secret declarations"
      ]
    },
    "lf_compose_docs_typescript_job": {
      "name": "LF, Compose, docs, and TypeScript",
      "job_id": "95665197839",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197839",
      "conclusion": "failure",
      "failed_step": "Verify Compose and installation contracts",
      "category": "baseline_ci_contract",
      "detail": "unified Compose contract passed; test-no-deployment-coupling-scope.sh stopped on TMPDIR: unbound variable",
      "downstream_steps": "skipped"
    },
    "linux_docker_job": {
      "name": "Linux Docker deployment and rollback",
      "job_id": "95665197846",
      "url": "https://github.com/mptyl/ThothII/actions/runs/32122302381/job/95665197846",
      "conclusion": "failure",
      "failed_step": "Run unified deployment smoke",
      "category": "infrastructure_prerequisite",
      "detail": "Task 13 smoke failed before deployment because rg is required",
      "cleanup": "PASS",
      "image_manifest": "not_generated"
    }
  },
  "docker_image_evidence": {
    "authentication_smoke": {
      "status": "PASS",
      "docker_images": [],
      "reason": "no_docker_images_exercised"
    },
    "unified_docker_smoke": {
      "status": "FAIL",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "run_id": "32122302381",
      "workflow_job_id": "95665197846",
      "manifest": ".artifacts/task-15/unified-docker-images.json",
      "reason": "workflow attempt stopped before deployment because rg is required",
      "cleanup": "PASS",
      "images": 0,
      "historical": {
        "status": "PASS",
        "source_commit": "74b062f1a737103524cbe706346cfd65f87cdfd1",
        "run_id": "20260818070637-66409-30058",
        "manifest_sha256": "9c8dec4546909fd93799dbcf374bcb3a89bc46cfe0fd482472c0cbe757ddf5b6",
        "images": 5,
        "cleanup": "PASS"
      }
    }
  },
  "gates": {
    "posix_registry_ownership": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "evidence": "backend Node 24 full suite including local-registry ownership coverage"
    },
    "stagearchive_unix_retained_capability": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "evidence": "focused safeio/backup tests, Go race suite, and Unix ancestor-swap coverage"
    },
    "windows_claim_retained_capability": {
      "status": "FAIL",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "evidence": "native Windows workflow step failed"
    },
    "workflow_lf_compose_docs_typescript": {
      "status": "FAIL",
      "classification": "baseline_ci_contract",
      "reason": "TMPDIR was unset after the unified Compose contract passed"
    },
    "workflow_linux_docker": {
      "status": "FAIL",
      "classification": "infrastructure_prerequisite",
      "reason": "runner did not provide rg; cleanup proof passed and no image manifest was generated"
    },
    "go_security_build": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "focused_packages": 3,
      "race_packages": 18,
      "focused_test": "PASS",
      "race": "PASS",
      "vet": "PASS",
      "host_build": "PASS"
    },
    "windows_cross_compile": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "focused_test_packages": 2,
      "cli_build": "PASS",
      "execution": "cross_compile_only_not_native_execution"
    },
    "backend_node24": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "files": 76,
      "tests": 1092,
      "typecheck": "PASS",
      "build": "PASS",
      "note": "an initial full run had one workspace-registry timeout; focused rerun and complete rerun passed"
    },
    "frontend_node24": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "files": 61,
      "tests": 444,
      "typecheck": "PASS",
      "build": "PASS"
    },
    "authentication_and_f1_smoke": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "node": "v24.16.0",
      "filtered_e2e": "1 passed",
      "sentinel_leak_scan": "PASS"
    },
    "harness_pytest": {
      "status": "FAIL",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "passed": 951,
      "failed": 1,
      "skipped": 4,
      "subtests": 232,
      "failure": "test_column_decisions::test_f4_emits_column_types: workflow.yaml not found from harness test cwd"
    },
    "authentication_docs": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
    },
    "shell_syntax": {
      "status": "PASS",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7"
    },
    "authentication_smoke_runtime": {
      "status": "PASS",
      "node": "v24.16.0",
      "sentinel_leak_scan": "PASS"
    },
    "compose_default": {
      "status": "FAIL",
      "reason": "required THT_WORKSPACE_GIT_REMOTE was not available"
    },
    "compose_unified": {
      "status": "FAIL",
      "reason": "compose.unified.yaml is absent from the frozen source"
    },
    "unified_docker_smoke": {
      "status": "FAIL",
      "source_commit": "b31b27e5845ffd3adf311429367319beaba263c7",
      "workflow_run_id": "32122302381",
      "reason": "remote workflow attempted the smoke but stopped before deployment because rg is required",
      "cleanup": "PASS",
      "image_manifest": "not_generated"
    },
    "ruff": {
      "status": "FAIL",
      "errors": 192,
      "classification": "known_baseline"
    },
    "mkdocs_strict": {
      "status": "FAIL",
      "classification": "not_reached_after_stop",
      "historical_status": "FAIL",
      "historical_warnings": 69
    },
    "canonical_install_docs": {
      "status": "FAIL",
      "classification": "not_reached_after_stop",
      "historical_status": "FAIL"
    },
    "workspace_install_docs": {
      "status": "FAIL",
      "classification": "not_reached_after_stop",
      "historical_status": "FAIL"
    },
    "pi_user_auth_compose": {
      "status": "FAIL",
      "classification": "not_reached_after_stop",
      "historical_status": "FAIL"
    },
    "deployment_coupling": {
      "status": "FAIL",
      "classification": "not_reached_after_stop",
      "historical_status": "FAIL"
    },
    "l2": {
      "status": "PENDING",
      "reason": "configured secret layout unavailable; gate not run after stop"
    },
    "manual_psd": {
      "status": "PENDING",
      "reason": "approved real identity/access unavailable; gate not run after stop"
    },
    "provider_readiness": {
      "status": "PENDING",
      "reason": "provider prerequisite unavailable; gate not run after stop"
    }
  },
  "review": {
    "three_important_findings_closed": false,
    "verdict": "CHANGES_REQUIRED",
    "reason": "native Windows retained-capability tests failed; the frozen workflow omits internal/authstorage from its native command"
  },
  "release_complete": false,
  "authentication_implementation_complete": false,
  "release_readiness": "FAIL"
}