Reconcile measured runtime and admission; fix intake and deployment recovery

.echo/certification.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "journey": ["python3", "-B", "scripts/certforge_journey.py"]
+}

.echo/sdk.json

@@ -46,9 +46,11 @@
     "echo.certforge.projects.create",
     "echo.certforge.projects.list",
     "echo.certforge.public_verification",
+    "echo.certforge.publish",
     "echo.certforge.r5.status",
     "echo.certforge.r5.submit_async",
     "echo.certforge.run",
+    "echo.certforge.runtime_environment",
     "echo.certforge.service_status",
     "echo.certforge.status",
     "echo.certforge.submit",

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.2.0] - 2026-08-30
+
+### Added
+
+- A pinned-key-signed production E2E gate required before any `PRODUCTION_READY` verdict.
+- Exact E2E bindings for source, deployment, target, environment, accounts, and clients.
+
 All notable changes to Echo Certification Forge are documented here. Versions follow Semantic
 Versioning; dates use ISO 8601.
 

artifacts/p1_acceptance_report.json

@@ -1,10 +1,10 @@
 {
-  "manifest_digest": "0ca325c3e6d39b7f22cdd3d01068c8f99dcd976c4422200b5b4d4cfe452f29f7",
+  "manifest_digest": "9e9f963377374e827ccc9c8b07ea82cc7966e25a2392838997d3c1371f5a4e5c",
   "manifest_id": "certforge.release-strict.v1",
   "passed": true,
   "phase": "P1",
-  "platform": "Windows-11-10.0.22631-SP0",
-  "python": "3.13.0 (tags/v3.13.0:60403a5, Oct  7 2024, 09:38:07) [MSC v.1941 64 bit (AMD64)]",
+  "platform": "Windows-11-10.0.26200-SP0",
+  "python": "3.12.10 (tags/v3.12.10:0cc8128, Apr  8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]",
   "scenarios": {
     "default_block": {
       "passed": true,
@@ -17,27 +17,30 @@
         "mandatory_rule_missing:environment_identity",
         "mandatory_rule_missing:evidence_integrity",
         "mandatory_rule_missing:immutable_target_identity",
+        "mandatory_rule_missing:production_e2e",
         "mandatory_rule_missing:runner_control_channel",
         "mandatory_rule_missing:signing_authority_separation",
         "mandatory_rule_missing:tenant_isolation",
+        "production_e2e_attestation_missing",
         "run_outcome_inconclusive"
       ],
       "verdict": "NOT_READY"
     },
+    "source_only_blocks": {
+      "deploy_gate_allowed": false,
+      "evidence_merkle_root": "41a4fc282a478767dc16f6c64128c93ab2535866e620a3f5b0ae922220ffb449",
+      "passed": true,
+      "payload_sha256": "a7255f5bae53fcd49b1e049b3edd1feb6c9b03f4520b0e2abb0e44f0da7138e7",
+      "signing_key_id": "ed25519:e222f1c31e85f1b8a6d8cfed30fd2300",
+      "verdict": "NOT_READY"
+    },
     "tamper_blocks": {
       "deploy_gate_allowed": false,
       "passed": true,
       "reasons": [
-        "current_evidence_invalid"
+        "current_evidence_invalid",
+        "verdict_not_production_ready"
       ]
-    },
-    "verified_ready": {
-      "deploy_gate_allowed": true,
-      "evidence_merkle_root": "438efda29a515669d0db0472f6527c201c55d0d80afebf2963123d11c77a7d73",
-      "passed": true,
-      "payload_sha256": "db3fe179c7c950a9ffaf90cfef6d475fc915af87f0d1b10a85071c7d8411b975",
-      "signing_key_id": "ed25519:4592da038060823a957506d477e49114",
-      "verdict": "PRODUCTION_READY"
     }
   },
   "schema_version": "1.0.0"

artifacts/p6_acceptance.json

@@ -1,8 +1,8 @@
 {
   "phase": "P6",
   "title": "deployment enforcement and platform integration \u2014 live local acceptance",
-  "generated_at": "2026-07-26T02:18:04.411111Z",
-  "python": "3.13.0 (tags/v3.13.0:60403a5, Oct  7 2024, 09:38:07) [MSC v.1941 64 bit (AMD64)]",
+  "generated_at": "2026-08-30T12:40:31.960114Z",
+  "python": "3.12.10 (tags/v3.12.10:0cc8128, Apr  8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]",
   "passed": true,
   "checks": [
     {
@@ -11,7 +11,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-3413cd5f5334d3b106b9ce81f7c7a26b\", \"allowed\": false, \"artifact_sha256\": \"cc9a65d96c25c8f96ba720e01628b734d6df4f5a1057238506ab6d504fb998fd\", \"chain_hash\": \"ab88eb7a583dc68353ca39d53cd4e37d9737ac4b6fa0e6c9b0ab8c659325a64d\", \"created_at\": \"2026-07-26T02:17:59.537952Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a1\", \"reasons\": [\"artifact_not_certified\", \"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-39149ed9c3643c355bbe8f4f09eec260\", \"allowed\": false, \"artifact_sha256\": \"cc9a65d96c25c8f96ba720e01628b734d6df4f5a1057238506ab6d504fb998fd\", \"chain_hash\": \"ff5f335a43355fdc85e2b64c11e7429ad3aa9070dca78655a74bf0d929da28b0\", \"created_at\": \"2026-08-30T12:40:27.987414Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a1\", \"reasons\": [\"artifact_not_certified\", \"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -29,7 +29,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-f49980b48837ae58dec6fa3ffbc216e4\", \"allowed\": false, \"artifact_sha256\": \"11d7d626a19af7cf0b64c0862b3214a15fac77e3aa1400d70e6902f1a77fdb86\", \"chain_hash\": \"40c1d83374649745ee6fcd3c42c58ce5b6257e362aa6e22954f224c7284b61f5\", \"created_at\": \"2026-07-26T02:17:59.744469Z\", \"deployment_environment\": \"staging\", \"deployment_id\": \"deploy-a2\", \"reasons\": [\"artifact_not_certified\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-de226c922ca25e4fe770043fa5cce489\", \"allowed\": false, \"artifact_sha256\": \"11d7d626a19af7cf0b64c0862b3214a15fac77e3aa1400d70e6902f1a77fdb86\", \"chain_hash\": \"1b08dbf5ba6527bbb6b743ab658e726bb487454d6ab95bd8ec1ec7889764501a\", \"created_at\": \"2026-08-30T12:40:28.129813Z\", \"deployment_environment\": \"staging\", \"deployment_id\": \"deploy-a2\", \"reasons\": [\"artifact_not_certified\"], \"rollback_candidate\": null, \"run_id\": null, \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -38,7 +38,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-8ac38cbd2ade07ff1bb5c59d63d2582c\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"5d31c6a43518753dc06259bee965f1e8fb91e4114f86c47bf61adde8a84ff4dd\", \"created_at\": \"2026-07-26T02:17:59.912909Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a4\", \"reasons\": [\"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-393b3f1c13aeaf883a659c67fe3a6062\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"4adc5c6ca6c45d5664c517904d6b86304b4ae573fa525cef6397e6a315d30422\", \"created_at\": \"2026-08-30T12:40:28.260911Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a4\", \"reasons\": [\"staging_acceptance_missing\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {
@@ -57,21 +57,21 @@
       "passed": true,
       "detail": {
         "failure_candidate": {
-          "admission_id": "dep-c3f042d865f9fcd3c85e9d0a1c91484a",
-          "admitted_at": "2026-07-26T02:18:00.438507Z",
+          "admission_id": "dep-88177f711ac3ea76d71d3f5657753a8a",
+          "admitted_at": "2026-08-30T12:40:28.640308Z",
           "artifact_sha256": "67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0",
           "deployment_id": "deploy-a3-prd",
           "run_id": "cert-p6-v1"
         },
         "rollback_target": {
           "artifact_sha256": "67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0",
           "run_id": "cert-p6-v1",
-          "admission_id": "dep-c3f042d865f9fcd3c85e9d0a1c91484a",
+          "admission_id": "dep-88177f711ac3ea76d71d3f5657753a8a",
           "deployment_id": "deploy-a3-prd",
-          "admitted_at": "2026-07-26T02:18:00.438507Z"
+          "admitted_at": "2026-08-30T12:40:28.640308Z"
         },
         "rolled_back": {
-          "admission_id": "dep-d1f547a64a4ddb086ca7a521e0d1a4ce",
+          "admission_id": "dep-368a34d3be4daeb9870a2b93e41ebf45",
           "artifact_sha256": "6cf9eb2e75fbaf4037393188b98be82a05499dcfc0c45a6eeeb840bd7f775c20",
           "deployment_environment": "production",
           "detail": "restored v1",
@@ -87,7 +87,7 @@
       "passed": true,
       "detail": {
         "exit": 2,
-        "stdout": "{\"admission_id\": \"dep-4ec864d16bf5447abf4145975d62ed0a\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"928bee7494d599c95422e4d3f6c8db2a7e80c2ec1ff5837056aead46be211115\", \"created_at\": \"2026-07-26T02:18:01.842335Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a5\", \"reasons\": [\"verdict_revoked\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
+        "stdout": "{\"admission_id\": \"dep-1d051283684978484ff174d2f3cc5b7b\", \"allowed\": false, \"artifact_sha256\": \"67b7548d601f8ca9e8689fced7d40d8f407894ac7d6a2c09d2e524ee5514e7b0\", \"chain_hash\": \"8cbb0ce94045d583aaaaa7e150f5a997759f188f1de824d89f973711ef9a5754\", \"created_at\": \"2026-08-30T12:40:29.545903Z\", \"deployment_environment\": \"production\", \"deployment_id\": \"deploy-a5\", \"reasons\": [\"verdict_revoked\"], \"rollback_candidate\": null, \"run_id\": \"cert-p6-v1\", \"tenant_id\": \"tenant-alpha\"}"
       }
     },
     {

artifacts/p6_acceptance.summary.json

@@ -3,5 +3,5 @@
   "passed": true,
   "checks_total": 12,
   "checks_passed": 12,
-  "generated_at": "2026-07-26T02:18:04.411111Z"
+  "generated_at": "2026-08-30T12:40:31.960114Z"
 }

contracts/certforge-capability-surface.v2.json

@@ -4,6 +4,7 @@
   "capabilities": {
     "GET /healthz": "echo.certforge.health",
     "GET /v1/status": "echo.certforge.service_status",
+    "POST /v1/subscriber/runtime/environment": "echo.certforge.runtime_environment",
     "GET /v1/certifications": "echo.certforge.list_runs",
     "POST /v1/certifications": "echo.certforge.submit",
     "GET /v1/certifications/{run_id}": "echo.certforge.status",

contracts/certforge-sdk-capabilities.v1.json

@@ -1412,6 +1412,33 @@
         "type": "object"
       }
     },
+    "echo.certforge.publish": {
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "command": {
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "run_id": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "command",
+          "run_id"
+        ],
+        "type": "object"
+      },
+      "operation": "POST /v1/subscriber/certifications/{run_id}/publish",
+      "output_schema": {
+        "additionalProperties": {
+          "type": "string"
+        },
+        "type": "object"
+      }
+    },
     "echo.certforge.r5.status": {
       "input_schema": {
         "additionalProperties": false,
@@ -1717,6 +1744,149 @@
         "type": "object"
       }
     },
+    "echo.certforge.runtime_environment": {
+      "input_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "command": {
+            "maxLength": 64,
+            "minLength": 1,
+            "type": "string"
+          },
+          "journey": {
+            "anyOf": [
+              {
+                "items": {
+                  "maxLength": 2048,
+                  "minLength": 1,
+                  "pattern": "^[^\\x00]*$",
+                  "type": "string"
+                },
+                "maxItems": 32,
+                "minItems": 1,
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          }
+        },
+        "required": [
+          "command"
+        ],
+        "type": "object"
+      },
+      "operation": "POST /v1/subscriber/runtime/environment",
+      "output_schema": {
+        "additionalProperties": false,
+        "properties": {
+          "environment": {
+            "additionalProperties": false,
+            "properties": {
+              "adapter_set_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "egress_policy_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "harness_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "model_route_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "os_runtime_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "policy_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "prompt_set_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "runner_image_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "test_plan_sha256": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              }
+            },
+            "required": [
+              "runner_image_sha256",
+              "adapter_set_sha256",
+              "test_plan_sha256",
+              "policy_sha256",
+              "harness_sha256",
+              "prompt_set_sha256",
+              "model_route_sha256",
+              "os_runtime_sha256",
+              "egress_policy_sha256"
+            ],
+            "type": "object"
+          },
+          "journey": {
+            "anyOf": [
+              {
+                "items": {
+                  "maxLength": 2048,
+                  "minLength": 1,
+                  "pattern": "^[^\\x00]*$",
+                  "type": "string"
+                },
+                "type": "array"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
+          "schema_version": {
+            "const": "certforge.runtime.v1",
+            "type": "string"
+          },
+          "submit_environment": {
+            "additionalProperties": false,
+            "properties": {
+              "identity_digest": {
+                "pattern": "^[0-9a-f]{64}$",
+                "type": "string"
+              },
+              "runner_image_digest": {
+                "anyOf": [
+                  {
+                    "pattern": "^sha256:[0-9a-f]{64}$",
+                    "type": "string"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            },
+            "required": [
+              "identity_digest"
+            ],
+            "type": "object"
+          }
+        },
+        "required": [
+          "journey",
+          "environment",
+          "submit_environment"
+        ],
+        "type": "object"
+      }
+    },
     "echo.certforge.service_status": {
       "input_schema": {
         "additionalProperties": false,
@@ -2295,7 +2465,7 @@
       }
     }
   },
-  "capability_count": 60,
+  "capability_count": 62,
   "policy": "Every Certification Forge SDK action has a command-bearing strict input schema and an output schema derived from its production route contract.",
   "schema_version": "1.0.0"
 }