{ "schema": "haltseal.public-agent-payment-evidence.v1", "reviewed_on": "2026-10-16", "summary_path": "/evidence/agent-payment-control-2026-10-16-r1/summary.json", "record_scope": "Four separate controlled qualification profiles. Integration in one source tree does not establish joint native qualification.", "external_audit": false, "financial_authority_granted": false, "verification_scope": "Source-bound release records report separate retained-evidence replay. This is not an external audit, independent host attestation or customer acceptance.", "profiles": [ { "id": "agent-handoff", "title": "Does the original survive an Agent handoff?", "label": "Agent handoff", "result": "B takes over. The original stays reserved.", "meaning": "Handing over the work does not grant another right to pay.", "environment": "One explicitly installed BILL original, signed test source mappings, a private browser projection and controlled provider replies.", "remaining": "The deployed customer login, independent key custody and native payment execution require their own joint acceptance.", "steps": [ [ "Same original", "Two explicitly signed source IDs resolve to one original USD 1.00 approval." ], [ "Lost reply", "One controlled payment request reaches the provider model. Its response is intentionally lost." ], [ "Agent B receives the work", "The original USD 1.00 remains UNKNOWN and reserved. B receives no new payment capacity." ], [ "New requests stay bounded", "A's stale request is refused. B's alternative payment route stays on HOLD." ], [ "Process restarts", "An actual forced termination and a new process retain the original, reservation and history." ] ], "record_class": "CONTROLLED", "source_commit": "02ee8208324e8f85ca8fc953e35b9c610ff1c397", "qualification": { "workflow": "Joint installed browser execution", "run_id": 38812917019, "attempt": 1, "completed_at_utc": "2026-10-15T21:55:24Z", "conclusion": "success", "artifact": { "id": 12009227946, "name": "joint-execution-02ee8208324e8f85ca8fc953e35b9c610ff1c397-38812917019-1", "sha256": "ad74367807df7676814f79a53d6e101dde5aac0a5cd33bc468619b66af45c031" } }, "native_execution": "NOT_QUALIFIED", "customer_acceptance": "NOT_PERFORMED", "production": "NO_GO" }, { "id": "current-perimeter", "title": "Is the installation still valid when payment is requested?", "label": "Current installation", "result": "Changed or expired evidence holds new effects.", "meaning": "A previously passing installation check does not become permanent permission.", "environment": "An explicitly installed controlled BILL owner, independently pinned policy and controlled credential/access observations.", "remaining": "Native IAM and provider collection, hidden-route completeness and provider-side enforcement through the payment call require separate qualification.", "record_class": "CONTROLLED", "source_commit": "411967472bfbbc0b7ad510b8f4df5d5c5260b118", "qualification": { "workflow": "Quality", "run_id": 38834881004, "attempt": 1, "completed_at_utc": "2026-10-16T02:05:21Z", "conclusion": "success", "artifact": { "id": 12020340649, "name": "qa-pipeline-38834881004-workspace-1", "sha256": "bbc3a2001643df68fed516e4d6ceeed0c6b41856addfd811be9cb4bf59724a69" } }, "native_execution": "NOT_QUALIFIED", "customer_acceptance": "NOT_PERFORMED", "production": "NO_GO" }, { "id": "authority-evolution", "title": "Does existing use survive an upgrade?", "label": "Version continuity", "result": "Compaction and adapter changes retain the original accounting.", "meaning": "Maintenance must preserve unresolved reservations and completed-payment consumption.", "environment": "A private opt-in owner profile with controlled rails, bounded version/key changes and retained independent witness history.", "remaining": "Existing BILL or identity-owner migration, joint trusted-store rollback and long-term operational reliability are outside this result.", "record_class": "CONTROLLED", "source_commit": "fbd5df6c9e64efd725bc0f4f4fa2b314b4da7ff3", "qualification": { "workflow": "Original authority evolution", "run_id": 38827543234, "attempt": 1, "completed_at_utc": "2026-10-16T00:13:45Z", "conclusion": "success", "artifact": { "id": 12015623606, "name": "authority-evolution-fbd5df6c9e64efd725bc0f4f4fa2b314b4da7ff3-38827543234-1", "sha256": "2357c5deafdb22c7e5fe87513cc61e64b7ae68ba1ea1bc4e5bcfdebe35b94c8e" } }, "native_execution": "NOT_QUALIFIED", "customer_acceptance": "NOT_PERFORMED", "production": "NO_GO" }, { "id": "company-registry", "title": "Can another installation create another right to pay?", "label": "Company ownership", "result": "One registered obligation stays bound to its first original.", "meaning": "A changed actor, route or restarted installation cannot register a second original for that obligation within this profile.", "environment": "Fresh controlled owners sharing one honestly operated company registry and explicitly signed business identity.", "remaining": "Cross-host consensus, existing-history adoption and joint composition with the evolving and perimeter profiles require separate qualification.", "record_class": "CONTROLLED", "source_commit": "8b9192056bd9493d3c6929c1335779e2e3fea551", "qualification": { "workflow": "Original owner registry", "run_id": 38842313357, "attempt": 1, "completed_at_utc": "2026-10-16T02:51:56Z", "conclusion": "success", "artifact": { "id": 12021594228, "name": "original-owner-registry-8b9192056bd9493d3c6929c1335779e2e3fea551-38842313357-runtime-1", "sha256": "ec0b42ce2241548c0e02249eb3867aa305ecce5bdd26a45af33db3be4385f99a" } }, "native_execution": "NOT_QUALIFIED", "customer_acceptance": "NOT_PERFORMED", "production": "NO_GO" } ], "customer_requirements": [ { "title": "Bind your source to the original.", "text": "Confirm the exact organization, obligation, version, amount and separate financial approval. Source access and Agent receiving proof do not approve a payment." }, { "title": "Qualify every agreed release path.", "text": "Review the installed code, funding account, credentials, final gates and known bypass paths. Customer custody and native enforcement must match the agreed scope." }, { "title": "Prove recovery on the retained original.", "text": "Verify authoritative original outcomes, unresolved reservations, restart behavior and fresh replacement approval. Reconcile the retained records with the provider." }, { "title": "Accept the operating conditions.", "text": "Agree recovery ownership, independent trust, customer acceptance and operational approval. Availability and production disaster recovery need measured evidence." } ], "open_findings": [ { "id": "normal-progress-hold", "status": "OPEN_AT_REVIEW", "source_commit": "2af16ae9338a5ea5f859180397c5147265ff63bf", "record_class": "CONTROLLED_LOOPBACK_HTTP", "observation": "A normal request expected to return ACCEPT instead returned HOLD/JOURNAL_REPAIR_REQUIRED after one controlled provider CREATE.", "follow_up": "The same-source rerun and retained replay passed. The original failure is retained and its cause is not established.", "interpretation": "A passing rerun does not resolve the first failure or establish an availability percentage.", "tracking_reference": "Retained normal-progress diagnostic" } ], "historical_records": "The October 9 Increase Sandbox reference, October 11 control profiles, SDK, RC15 and assessment records retain their own dates, amounts and counts. Counts are not combined.", "production": "NO_GO" }