{
  "status": "passed",
  "qualification": "Published xcsh 23.5.2 follow-up with fresh live Wingman unseal; unchanged-provider evidence inherited explicitly",
  "qualified_at": "2026-10-16T15:38:50.664993+00:00",
  "issue": "https://github.com/f5-sales-demo/certificate-management/issues/76",
  "source_commit": "54e16856ee995738b4514d303c6fc5ff0b2ca21a",
  "endpoint": "https://certificate-management-terraform.f5-sales-demo.com/wingman/get",
  "artifacts": {
    "terraform": {
      "version": "1.16.6",
      "source_commit": "7b8f1669b95119ac6021e05c9d10eae7cf75f60b"
    },
    "provider": {
      "version": "15.9.0",
      "source_commit": "35cce9b33b3037b3ef4b4883dd9ced22542f20e3"
    },
    "xcsh": {
      "version": "23.5.2",
      "source_commit": "efc7dad0b376a2cb71bf58c2977ce2e0432fa59e"
    },
    "builder": {
      "image": "ghcr.io/f5-sales-demo/docs-builder@sha256:8fcc5e4171f6b4cb44133e44619aaca352d168b5a34e0c95a5715041d721bcda",
      "version": "1.11.1",
      "source_commit": "687218da176e2e86cea4583a2809541f0065ecd7",
      "publication_run": "https://github.com/f5-sales-demo/docs-builder/actions/runs/38903282596"
    },
    "kubernetes_provider": {
      "version": "3.3.0",
      "source_commit": "a612b9cfce0fd1321cf2d25084b07b8fccd79737"
    },
    "application": {
      "image": "ghcr.io/f5-sales-demo/certificate-management-wingman@sha256:841b968fd5e8fc5076ef806605932f16f412e52a42080ab01958626ac5b880d0",
      "source_commit": "7557a4d93e23e0ad32eb97e5de79d82f6aef2beb",
      "publication_run": "https://github.com/f5-sales-demo/certificate-management/actions/runs/38892143890"
    }
  },
  "installed_xcsh": {
    "ubuntu": {
      "platform": "linux_amd64",
      "version": "23.5.2",
      "source_commit": "efc7dad0b376a2cb71bf58c2977ce2e0432fa59e",
      "archive_sha256": "sha256:91e2dd18d331d1193df4da630b02d1ecfec73848dbc58cba33c206cb696a1bfa",
      "binary_sha256": "sha256:91e2dd18d331d1193df4da630b02d1ecfec73848dbc58cba33c206cb696a1bfa",
      "actual_version": "xcsh/23.5.2",
      "published_positional_encrypt_command": "passed; private output used for live probes"
    },
    "macos": {
      "platform": "darwin_arm64",
      "version": "23.5.2",
      "source_commit": "efc7dad0b376a2cb71bf58c2977ce2e0432fa59e",
      "binary_sha256": "sha256:86594bcdd66df859be91f08eaefa4e5562918174000365b8a690b1e7025e0165",
      "actual_version": "xcsh/23.5.2",
      "encryption_command_schema": "passed",
      "live_unseal": "not repeated on macOS"
    }
  },
  "checks": {
    "copied_command": "The unchanged published positional-input command produced the ciphertext used by live qualification.",
    "runtime_update_scope": [
      "kubernetes_config_map_v1.material: update",
      "kubernetes_deployment_v1.application: update from material hash"
    ],
    "runtime": {
      "running_image_id": "ghcr.io/f5-sales-demo/certificate-management-wingman@sha256:46bea98edd39d98415049cd03ba01b25fde4d1854466616d22658e997dda7148",
      "application_image": "ghcr.io/f5-sales-demo/certificate-management-wingman@sha256:841b968fd5e8fc5076ef806605932f16f412e52a42080ab01958626ac5b880d0",
      "status": "passed",
      "platform_identities": {
        "client_identity_sha256": "8cfb51929fcd1ce75ddd9d0b44ce0b1c1deb6784362aac6898402c15083e43ef",
        "server_identity_sha256": "1fdec9b9581df5f28cee12025433b6a76083cbdaa3066ca4dfbe12dd62991a40"
      },
      "certificate_sha256": "77b47f393961eae63922631d0dc399411240c42e96cb6465c00da8389d264cde",
      "backend_tls": {
        "verified": true,
        "hostname": "certificate-management-terraform.f5-sales-demo.com",
        "protocol": "TLSv1.3",
        "marker": "wingman-certificate",
        "readiness": "READY"
      },
      "sidecar_injected": true,
      "container_restart_counts": {
        "application": 0,
        "wingman": 0
      },
      "restart_fresh_identity": true
    },
    "fresh_probe_run": {
      "qualification": "fresh live Wingman unseal",
      "probes": [
        {
          "mode": "probe-authorized",
          "source": "encrypted-location",
          "evidence": {
            "certificate_sha256": "77b47f393961eae63922631d0dc399411240c42e96cb6465c00da8389d264cde",
            "identities": {
              "client_identity_sha256": "29d85f3b9a7fd1a361fde68a66006242c50ba8a75a92097ec74713e7d9a0bf43",
              "server_identity_sha256": "7c9dadd77a65680fb2045ca3bc55ed6163269c478ae271b5da7ed5505c72aa7d"
            }
          },
          "sidecar_injected": true
        },
        {
          "mode": "probe-authorized",
          "source": "encrypted-location-xcsh",
          "evidence": {
            "certificate_sha256": "77b47f393961eae63922631d0dc399411240c42e96cb6465c00da8389d264cde",
            "identities": {
              "client_identity_sha256": "83720f5c11f423965681c6a057041f9dce6e3f44f7ac1b30d288859b0785c59a",
              "server_identity_sha256": "c364744ede62d45b8fa8acd1adcec06393f911374859c82c591bed7f56d0adde"
            }
          },
          "sidecar_injected": true
        },
        {
          "mode": "probe-denied",
          "source": "encrypted-location",
          "evidence": {
            "denied": true,
            "http_status": 403,
            "identities": {
              "client_identity_sha256": "e9ce723eb5e9a586c3b14eabc1349693144b52a36b04075ab218a882256f28cf",
              "server_identity_sha256": "c7a6636275397ff512147aae41f6d9e869b02b4797879f705235373ed64ec42f"
            }
          },
          "sidecar_injected": true
        }
      ],
      "cleanup_pass_1": "typed absence",
      "cleanup_pass_2": "typed absence",
      "status": "passed"
    },
    "followup_plans": {
      "bootstrap": {
        "status": "passed",
        "exit": 0,
        "published_provider_binary_verified": true
      },
      "runtime": {
        "status": "passed",
        "exit": 0,
        "published_provider_binary_verified": true
      },
      "owner": {
        "status": "passed",
        "exit": 0,
        "published_provider_binary_verified": true
      }
    },
    "public_health": {
      "qualification": "credential-free published endpoints and source/download consistency",
      "endpoints": {
        "certificate-management.f5-sales-demo.com": {
          "trusted_hostname": true,
          "served_sha256": "b793d1480b1db276d25143b0f48824d62a7c5aaba7d317e79279ea0111cd23ac",
          "expected_response": true,
          "http_redirect": 301
        },
        "certificate-management-terraform.f5-sales-demo.com": {
          "trusted_hostname": true,
          "served_sha256": "b793d1480b1db276d25143b0f48824d62a7c5aaba7d317e79279ea0111cd23ac",
          "expected_response": true,
          "http_redirect": 301
        }
      },
      "wingman": {
        "qualification": "public TLS and response health only; fresh unseal not exercised",
        "public_certificate_sha256": "b793d1480b1db276d25143b0f48824d62a7c5aaba7d317e79279ea0111cd23ac",
        "application_certificate_sha256": "77b47f393961eae63922631d0dc399411240c42e96cb6465c00da8389d264cde"
      }
    },
    "preservation": {
      "status": "passed",
      "resource_sets_unchanged": true,
      "resource_uids_unchanged": true,
      "resource_specs_unchanged": true,
      "original_certificate_and_key_bytes_unchanged": true,
      "published_ca_and_leaf_bytes_unchanged": true,
      "wingman_leaf_uses_unchanged_shared_key": true
    },
    "scoped_credential": {
      "status": "passed",
      "revocation": "revoked-absent-collection-twice",
      "independent_inactive_or_absent_checks": 2,
      "kubeconfig_removed": true,
      "issuance_payload_removed": true,
      "sanitized_journal_preserved": true,
      "checked_at": "2026-10-16T15:38:08.507886+00:00"
    },
    "secret_audit": {
      "status": "passed",
      "files_checked": 2045,
      "application_and_ca_keys_absent": true,
      "session_api_token_absent": true,
      "scoped_credential_material_absent": true,
      "scope": "Public source, plans, state, manifests and qualification logs; credential payload directory and private key storage excluded."
    }
  },
  "inherited_unchanged_provider_evidence": {
    "receipt": "wingman-acceptance.json",
    "provider_version": "15.9.0",
    "published_policy_crud_import_and_empty_plans": {
      "status": "passed",
      "combining_algorithm": "FIRST_MATCH",
      "checks": {
        "init": 0,
        "version": 0,
        "create-plan": 0,
        "create": 0,
        "create-empty": 0,
        "metadata-plan": 0,
        "metadata": 0,
        "metadata-empty": 0,
        "forget-for-import": 0,
        "import": 0,
        "import-empty": 0,
        "destroy-plan": 0,
        "destroy": 0,
        "cleanup-absence-1": 404,
        "cleanup-absence-2": 404,
        "destroy-empty": 0
      }
    },
    "certificate_schema": {
      "ubuntu": 25,
      "macos": 25,
      "qualification": "schema only"
    },
    "certificate_lifecycles": {
      "ubuntu": 16,
      "macos": 16,
      "cleanup": "typed absence twice on both hosts",
      "served_tls": "separate retained endpoint checks"
    },
    "qualification": "Previously qualified published provider is unchanged; 25 schemas and 16 lifecycles per host were not rerun for this xcsh-only advancement."
  },
  "inherited_builder_evidence": {
    "receipt": "wingman-builder-1.11.1-requalification.json",
    "desktop_mobile_clipboard_comparisons": 74,
    "source_download_comparisons": 93
  },
  "preserved_invocation_failures": [
    {
      "status": "failed",
      "cause": "Operator supplied unsupported --key-file; the guide already used valid positional input. No guide regression."
    },
    {
      "status": "failed",
      "cause": "Operator environment context assertion mismatch; corrected using the verified native context in the session environment."
    }
  ],
  "historical_receipts_changed": false,
  "delivery": "CI and Pages publication are tracked by the linked issue PR."
}