Conformance to the product architecture

Generated by tools/traceability/conformance.py from docs/implementation/conformance/*.yaml and the runs recorded in docs/implementation/evidence/results/. Do not edit by hand. A PASSED item cites green evidence on unchanged sources, with nothing remaining and no blocker.

Summary

Status	Items
PASSED	696
BLOCKED	35
FAILED	0
IN_PROGRESS	198
NOT_STARTED	11
Items	940

By section

Section	Lot	Items	PASSED	IN_PROGRESS	BLOCKED	FAILED
A0 The five value elements of the product	main	5	0	5	0	0
A1 Structural decisions, client object storage and component licences	C02	27	17	10	0	0
A2 Global functional architecture and protections without the console	C04, C01	8	5	2	1	0
A3.1 Manager architecture	C01	13	6	7	0	0
A3.2 Mandatory operating functions and stop semantics	C01	23	19	4	0	0
A3.3 Administration sheet of every tool	C01	4	3	1	0	0
A3.4 Lifecycle states, administrative states and five state fields	C01	8	6	2	0	0
A3.5 Components to install, phases and dependency graph	C02	14	3	0	11	0
A3.6 Guided first installation, signed acceptance report, offline bundle and Manager recovery	C02	11	7	4	0	0
A4.1 Portal navigation tree	C09	13	6	7	0	0
A4.2 Functional portal screens	C09	28	21	7	0	0
A4.3 Profiles and rights enforced server side	C03	11	11	0	0	0
A4.4 Frontend architecture	C11	10	6	4	0	0
A5.1 Backend services to develop	C04	33	32	1	0	0
A5.2 Technical split of deployments	C04	10	7	3	0	0
A6.1 PostgreSQL schemas and tables	C05	24	18	6	0	0
A6.2 Key relations of the data model	C05	11	9	2	0	0
B3.1 Manager functions	C01	19	15	4	0	0
B3.2 Manager home page and uniform tabs	C01	3	2	1	0	0
B3.3 Technical stop and security suspend	C01	8	3	5	0	0
B3.4 Standard manifest of every component	C01	10	0	10	0	0
B3.5 Manager backend services and bring your own infrastructure	C01	14	13	1	0	0
B4.1 Deployment profiles	C02	6	6	0	0	0
B4.2 Installation workflow	C02	11	6	3	2	0
B4.3 What the client finds after installation	C02	14	2	0	12	0
B5.1 Functional tree of the portal	C09	17	2	15	0	0
B5.2 Priority screens	C09	15	0	15	0	0
B5.3 Shared frontend components and destructive actions	C11	12	10	2	0	0
B5.4 Portal roles	C03	11	11	0	0	0
B6.1 Control Plane modules	C04	25	24	1	0	0
B6.2 Independent runtime and security services	C04	13	12	1	0	0
B6.3 Main API contracts and operation_id	C04	21	20	1	0	0
B7.1 SQL split by domain	C05	18	17	1	0	0
B7.2 Common fields of business tables	C05	13	8	5	0	0
B7.3 Isolation by RLS and SQL roles	C05	5	4	1	0	0
B7.4 Marketplace SQL model	C07	5	4	1	0	0
B8.1 Content of a business plugin	C17	19	11	8	0	0
B8.2 Standard folder structure of a plugin	C07	3	3	0	0	0
B8.3 Plugin manifest	C07	11	5	6	0	0
B8.4 Marketplace end to end	C07	12	8	4	0	0
B8.5 Plugin distribution format	C16	9	6	2	1	0
B8.6 Business packs shipped with the platform	C08	13	13	0	0	0
B9.1 SDK package structure	C06	3	3	0	0	0
B9.2 Mandatory SDK contracts	C06	14	14	0	0	0
B9.3 Exposed SDK methods	C06	17	17	0	0	0
B9.4 SDK that cannot be bypassed	C04	10	9	0	1	0
B10.1 Official CLI	C12	18	18	0	0	0
B10.2 Mandatory rules for developers	C12	22	22	0	0	0
B10.3 Publication gates	C16	14	11	3	0	0
B10.4 Change management	C16	3	1	2	0	0
B11.1 Product documentation	C10	13	7	6	0	0
B11.2 Developer documentation	C13	16	16	0	0	0
B11.3 Living documentation	C13	3	2	1	0	0
B12.1 Licence coverage	C10	16	16	0	0	0
B12.2 Commercial scope	C10	3	2	1	0	0
B12.3 Licensing service architecture	C10	4	4	0	0	0
B12.4 Signed technical licence contract	C10	3	2	1	0	0
B12.5 Offline licence operation	C10	3	2	1	0	0
B12.6 Behaviour at expiry	C10	8	6	1	1	0
B13.1 Critical Platform Manager tables	C01	12	11	1	0	0
B13.2 Audit index and independent evidence	C14	5	2	2	1	0
B13.3 Security state registry and Kill Switch	C10	11	9	2	0	0
B13.4 Licence and support tables	C10	3	2	1	0	0
B13.5 Transactional outbox and external actions	C04	7	6	1	0	0
B14 Multi tenant isolation by layer	C03	16	15	0	1	0
B14.1 Protection of secrets and data	C14	14	13	0	1	0
B14.2 Separation of duties	C03	3	3	0	0	0
B15.1 Scalability by domain	C10	15	8	5	2	0
B15.2 Availability matrix, RTO and RPO	C10	7	5	2	0	0
B15.3 Upgrade and rollback	C02	10	10	0	0	0
B16.1 Installing the Finance plugin at a bank	C08	11	7	4	0	0
B16.2 Using the Finance plugin end to end	C08	11	5	6	0	0
B17 Development plan by lots	C10	12	12	0	0	0
B17.1 Product monorepo	C02	13	13	0	0	0
B17.2 Mandatory acceptance tests before delivery	C10	23	19	3	1	0
B18 Differentiation, non negotiable requirements and distribution release	C02	18	4	14	0	0
B19 The agent carries the user's identity	C03	19	19	0	0	0

Part A, A0. The five value elements of the product

Item	Status	Proof	Remaining or blocker
ARCH-A0-01 Platform Manager: install, configure, start, stop, update, supervise and repair the components	IN_PROGRESS	test_e2e_infrastructure_journey.py::test_machine_to_verified_restore test_services_operate.py::test_actions_rolling_restart_and_permissions test_services_operate.py::test_component_instances_change_peers (E-HB-E2E, E-RB-NM)	Sections A3.1, A3.2, A3.3, A3.4, A3.5, A3.6, B3.1, B3.2, B3.3, B3.4, B3.5, B4.1, B4.2, B4.3, B13.1, B15.3: 68 of 180 items not PASSED (IN_PROGRESS 43, BLOCKED 25, FAILED 0)
ARCH-A0-02 AI Control Plane: manage identities, rights, policies, models, data, agents and applications from a central console	IN_PROGRESS	test_iam_role_matrix.py::test_role_matrix test_iam_role_matrix.py::test_developer_cannot_approve_own_change_and_auditor_cannot_decide test_identity_context_delegation.py +1 (E-IR-IDENTITY, E-DF-PORTAL)	Sections A4.1, A4.2, A4.3, A4.4, A5.1, A6.1, A6.2, B5.1, B5.2, B5.3, B5.4, B6.1, B7.1, B7.2, B7.3, B14, B14.2, B19: 68 of 284 items not PASSED (IN_PROGRESS 67, BLOCKED 1, FAILED 0)
ARCH-A0-03 AI Runtime & Security Plane: run the agents with a mandatory check of every action	IN_PROGRESS	test_runtime_without_console.py::test_decisions_stay_enforced_with_console_and_admin_routes_down test_gateway_pep_untrusted.py::test_pep_model_gateway_denied test_gateway_pep_untrusted.py::test_pep_mcp_denied +1 (E-RB-CP, E-CP-SOC)	Sections A2, A5.2, B6.2, B6.3, B9.4, B13.5: 10 of 69 items not PASSED (IN_PROGRESS 8, BLOCKED 2, FAILED 0)
ARCH-A0-04 Developer Platform & Marketplace: ready to use SDK, project templates, business packs, skills, prompts, rules, plugins, MCP and connectors	IN_PROGRESS	test_developer_day_one.py::test_developer_day_one test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked test_business_packs.py::test_pack_is_complete_and_holds_no_credential (E-DF-DAY-ONE, E-BP-PACKS-MARKETPLACE)	Sections B7.4, B8.1, B8.2, B8.3, B8.4, B8.5, B8.6, B9.1, B9.2, B9.3, B10.1, B10.2, B10.3, B10.4, B11.2, B11.3, B16.1, B16.2: 38 of 204 items not PASSED (IN_PROGRESS 37, BLOCKED 1, FAILED 0)
ARCH-A0-05 Enterprise Operations: observability, AI SOC, compliance, backup, restore, support and commercial licences	IN_PROGRESS	test_trace_end_to_end.py test_soc_ai_sdr.py::test_recovery_needs_four_eyes_then_reauthorization test_evidence_gateway.py +4 (E-G06-OBS, E-CP-SOC, E-CP-EVIDENCE, E-CP-LICENSING, E-HB-E2E, E-FL-SUPPORT)	Sections B11.1, B12.1, B12.2, B12.3, B12.4, B12.5, B12.6, B13.2, B13.3, B13.4, B14.1, B15.1, B15.2, B17, B17.2: 31 of 140 items not PASSED (IN_PROGRESS 25, BLOCKED 6, FAILED 0)

Part A, A1. Structural decisions, client object storage and component licences

Item	Status	Proof	Remaining or blocker
ARCH-A1-01 Product type: enterprise distribution installed at the client	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-02 Deployment on premise, private, public cloud or hybrid	PASSED	test_lifecycle_profiles.py::test_profile_catalog_and_creation (E-ID-ARCH, E-ID-LIFECYCLE)
ARCH-A1-03 Disconnected operation possible	PASSED	test_bundle.py::test_manifest_of_verified_artifacts (E-ID-ARCH, E-ID-PACKAGING)
ARCH-A1-04 Frontend Next.js, React, TypeScript	PASSED	test_architecture_decisions.py::test_frontend_is_nextjs_react_typescript (E-ID-ARCH)
ARCH-A1-05 Business backend FastAPI, Python	PASSED	test_architecture_decisions.py::test_backend_is_fastapi_python (E-ID-ARCH)
ARCH-A1-06 Infrastructure controllers in Go	PASSED	test_architecture_decisions.py::test_infrastructure_controllers_are_go (E-ID-ARCH)
ARCH-A1-07 Main database PostgreSQL	PASSED	test_architecture_decisions.py::test_storage_is_client_provided_and_db_is_postgresql (E-ID-ARCH)
ARCH-A1-08 Cache and temporary coordination Redis	PASSED	test_architecture_decisions.py::test_redis_pins_are_bsd_or_traced_exception (E-ID-ARCH)
ARCH-A1-09 Object storage of the client, never imposed	PASSED	test_architecture_decisions.py::test_storage_is_client_provided_and_db_is_postgresql (E-ID-ARCH)
ARCH-A1-10 Kubernetes orchestration, existing clusters supported	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-11 Installation and operations by the Platform Manager	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-ARCH, E-ID-LIFECYCLE)
ARCH-A1-12 Governance Keycloak, OpenFGA, OPA	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-13 LLM: LiteLLM and vLLM	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-14 Agents: Navin runtime and compatible external agents	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-15 Observability Opik, OpenTelemetry, OpenSearch, Prometheus	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-A1-16 Security: DLP, audit, policies, detection, SOC, Kill Switch	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-17 SDK Python, TypeScript, Go and REST/OpenAPI API	PASSED	test_architecture_decisions.py::test_sdks_cover_python_typescript_go (E-ID-ARCH)
ARCH-A1-18 Extensions: signed, versioned, administrable business packs	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-19 Licence: annual or triennial subscription	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-20 Unlimited users	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-21 Unlimited agents and use cases	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-22 No usage billing for the licence	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-23 No public price	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-24 Connect S3, Azure Blob, GCS, IBM COS, SeaweedFS, S3 compatible	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-25 Capabilities declared per storage provider	IN_PROGRESS		Proof owned by another lot (C05, C07, C10); to cite once its evidence set is green
ARCH-A1-26 MIT or Apache-2.0 rule and traced exceptions	PASSED	test_architecture_decisions.py::test_redis_pins_are_bsd_or_traced_exception (E-ID-ARCH)
ARCH-A1-27 PostgreSQL and Redis with exact licences (SBOM, notices, legal document)	IN_PROGRESS	test_architecture_decisions.py::test_redis_pins_are_bsd_or_traced_exception (E-ID-ARCH)	release/sbom only lists the redis Python client, not the Redis 7.0.15 server; the Manager host catalogue keeps Redis 8.0.2 tri licensed (LEX-002 pending client approval); FR and EN legal notice to complete

Part A, A2. Global functional architecture and protections without the console

Item	Status	Proof	Remaining or blocker
ARCH-A2-01 Portal spaces: Admin, Security, Developer, Operations, Audit, Marketplace, Licensing	IN_PROGRESS	test_licensing.py::test_status_is_readable_by_any_user_without_sensitive_fields test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-RB-CP)	The screen by screen proof of the seven spaces belongs to lot C09 (portal); this lot only proves the APIs serving them.
ARCH-A2-02 Control plane modules: Platform Manager, Identity and Governance, AI Management, Developer Platform, Security and SOC, Enterprise License	PASSED	test_platform_core.py::test_operations_api_detail_logs_abort_retry_and_scope test_data_quality_governance.py::test_governance_registry test_llm_registry.py::test_model_registry_and_status +3 (E-RB-CP, E-RB-NM)
ARCH-A2-03 Runtime and enforcement plane: Navin runtime, LiteLLM/vLLM, Secure MCP Gateway, DLP and policy gateway	PASSED	test_agents_execution.py::test_kill_switch_blocks_new_runs test_llm_registry.py::test_litellm_sync_proxy test_platform_security_manifests.py::test_vllm_reachable_only_from_litellm_and_control_plane +2 (E-RB-CP)
ARCH-A2-04 Data and client infrastructure: PostgreSQL, Redis, RAG, Qdrant, client storage, internal services, business APIs	PASSED	test_core_rls.py::test_unscoped_app_role_sees_nothing test_core_redis.py::test_sources_of_truth_never_read_from_redis test_rag_governance.py::test_chunk_acl_forbidden_fragments_never_reach_the_context +2 (E-RB-CP)
ARCH-A2-05 Observability and security operations: Opik, OpenTelemetry, OpenSearch SIEM, Prometheus, Falco, Tetragon, WORM audit	IN_PROGRESS	test_soc_ai_sdr.py::test_signed_webhooks_falco_tetragon_opensearch test_evidence_gateway.py::test_gateway_redelivers_after_target_outage_without_loss_or_duplicate test_data_quality_governance.py::test_telemetry_ingest_overview_trace +1 (E-RB-CP)	Real Opik, OpenTelemetry collector and Prometheus are proven by lot C10 (observability); this lot only cites ingestion and audit collection.
ARCH-A2-06 Platform infrastructure: Kubernetes, Cilium, Argo CD, Helm, KEDA, Kyverno, Harbor, backup and DR	BLOCKED	test_platform_security_manifests.py::test_every_workload_has_a_network_policy test_platform_security_manifests.py::test_static_cluster_policies test_media_worker.py::test_helm_worker_kinds_are_media_worker_operations +1 (E-RB-CP)	Helm rendering and policies are validated offline; the real deployment on Kubernetes with Cilium, Argo CD, KEDA, Kyverno and Harbor needs a cluster [B-CLUSTER].
ARCH-A2-07 Sensitive protections stay enforced by the gateways and runtime, fail closed, when the console and the administration routes are down	PASSED	test_runtime_without_console.py::test_decisions_stay_enforced_with_console_and_admin_routes_down test_soc_ai_sdr.py::test_alerting_and_policy_engine_outage_never_weaken_enforcement (E-RB-CP)
ARCH-A2-08 Platform Manager space of the portal through the Control Plane (ADR-0128)	PASSED	test_platform_manager_bridge.py::test_operation_forwarded_on_behalf_and_audited test_platform_manager_bridge.py::test_space_requires_platform_admin (E-PO-BRIDGE)

Part A, A3.1. Manager architecture

Item	Status	Proof	Remaining or blocker
ARCH-A3.1-01 Component catalog	PASSED	test_catalog.py::test_catalog_loads_and_is_open_source_only (E-PO-SERVER)
ARCH-A3.1-02 Desired state controller and drift correction	PASSED	test_lifecycle_drift_backups.py::test_change_outside_the_manager_is_detected_and_reconciled (E-PO-SERVER)
ARCH-A3.1-03 Node Agent: inventory, health, authorised commands, heartbeats	IN_PROGRESS	test_platform_core.py::test_registration_evaluates_preflight_at_once_and_reregisters test_agent_signature.py::test_agent_and_server_signatures_are_identical (E-PO-SERVER)	The Go tests of navin-manager/agent-go (TestArbitraryCommandRefused, etc.) are not run here: go is missing on this machine.
ARCH-A3.1-04 Kubernetes Operator: component lifecycle	IN_PROGRESS	test_kubernetes_operator.py::test_install_converges_and_operates (E-PO-K8S)	The Go envtest tests of navin-manager/operator are not run: go missing.
ARCH-A3.1-05 Workflow Engine: long operations, resume, validation, rollback (internal engine instead of Temporal)	IN_PROGRESS	test_foundation.py::test_engine_failure_retry_abort_and_timeout test_availability_api.py::test_dag_order_and_kill_switch_survives_restart (E-PO-SERVER)	No ADR verified here justifies the internal engine instead of Temporal.
ARCH-A3.1-06 Deployment Engine (Helm + Argo CD)	IN_PROGRESS	test_services_install.py::test_opa_binary_install (E-PO-SERVER)	Binary and operator deployment proven; Helm and Argo CD not verified by a test.
ARCH-A3.1-07 Config Manager: parameters, versions, validations (PostgreSQL instead of Git)	PASSED	test_services_config.py::test_versions_diff_restore_and_secrets (E-PO-SERVER)
ARCH-A3.1-08 Inventory Service on PostgreSQL	PASSED	test_foundation.py::test_migrations_are_idempotent test_hosts_api.py::test_list_detail_patch (E-PO-SERVER)
ARCH-A3.1-09 Secret Integration: secure references	IN_PROGRESS	test_platform_core.py::test_settings_store_keeps_secrets_sealed (E-PO-SERVER)	No test against OpenBao or the client vault.
ARCH-A3.1-10 Monitoring Prometheus + OTel	IN_PROGRESS	test_hosts_api.py::test_metrics_series_bucketing (E-PO-SERVER)	Prometheus and OTel integration not proven end to end.
ARCH-A3.1-11 Remote Diagnostics: diagnostics, support bundles	PASSED	test_lifecycle_bundle_acceptance.py::test_support_bundle_has_no_secret_and_no_personal_data (E-PO-SERVER)
ARCH-A3.1-12 Upgrade Manager	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-PO-SERVER)
ARCH-A3.1-13 License Agent	NOT_STARTED		Lot C10; no test in this lot.

Part A, A3.2. Mandatory operating functions and stop semantics

Item	Status	Proof	Remaining or blocker
ARCH-A3.2-01 Install	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-PO-SERVER)
ARCH-A3.2-02 Configure and validate	PASSED	test_services_install.py::test_validation_errors (E-PO-SERVER)
ARCH-A3.2-03 Start in the right order	PASSED	test_availability_api.py::test_dag_order_and_kill_switch_survives_restart (E-PO-SERVER)
ARCH-A3.2-04 Controlled stop	IN_PROGRESS	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)	Draining a proxy's requests not proven.
ARCH-A3.2-05 Restart an instance or a component	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)
ARCH-A3.2-06 Upgrade with prior check	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-PO-SERVER)
ARCH-A3.2-07 Rollback	PASSED	test_lifecycle_upgrades.py::test_stateful_upgrade_backup_migration_refused_rollback_and_restore (E-PO-SERVER)
ARCH-A3.2-08 Scale replicas and resources	IN_PROGRESS	test_kubernetes_operator.py::test_install_converges_and_operates (E-PO-K8S)	3 to 6 workers scenario not proven.
ARCH-A3.2-09 Health	PASSED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-PO-SERVER)
ARCH-A3.2-10 Repair an invalid configuration	PASSED	test_services_config.py::test_versions_diff_restore_and_secrets (E-PO-SERVER)
ARCH-A3.2-11 Backup	PASSED	test_lifecycle_drift_backups.py::test_coordinated_backup_then_restore_executed_and_verified (E-PO-SERVER)
ARCH-A3.2-12 Restore on another cluster	PASSED	test_backup_recovery.py::test_dr_plan_targets_empty_by_default_and_exercise_measured (E-PO-SERVER)
ARCH-A3.2-13 Rotate certificates and credentials	NOT_STARTED		No test cited in this lot.
ARCH-A3.2-14 Authorised logs	PASSED	test_services_operate.py::test_commands_and_logs (E-PO-SERVER)
ARCH-A3.2-15 Metrics	PASSED	test_hosts_api.py::test_metrics_series_bucketing (E-PO-SERVER)
ARCH-A3.2-16 Dependencies and their state	PASSED	test_services_operate.py::test_uninstall_and_service_in_use test_services_install.py::test_connection_bindings_and_unmanaged_provider (E-PO-SERVER)
ARCH-A3.2-17 Drift	PASSED	test_lifecycle_drift_backups.py::test_change_outside_the_manager_is_detected_and_reconciled (E-PO-SERVER)
ARCH-A3.2-18 Maintenance windows	PASSED	test_kubernetes_operator.py::test_maintenance_protects_the_component (E-PO-K8S)
ARCH-A3.2-19 Functional diagnostics	PASSED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-PO-SERVER)
ARCH-A3.2-20 Lifecycle: enable, disable, decommission	PASSED	test_hosts_api.py::test_decommission_and_delete (E-PO-SERVER)
ARCH-A3.2-21 Security Lock	IN_PROGRESS	test_availability_api.py::test_dag_order_and_kill_switch_survives_restart (E-PO-SERVER)	Full lock during an incident not proven.
ARCH-A3.2-22 Refusal of dangerous stops without approved procedure	PASSED	test_availability_api.py::test_client_managed_destructive_refused (E-PO-SERVER)
ARCH-A3.2-23 Stop rules relayed by the portal	PASSED	test_platform_manager_bridge.py::test_manager_refusal_relayed_in_both_languages (E-PO-BRIDGE)

Part A, A3.3. Administration sheet of every tool

Item	Status	Proof	Remaining or blocker
ARCH-A3.3-01 Administration sheet per tool	PASSED	test_docs.py::test_service_pages_match_the_catalog (E-PO-SERVER)
ARCH-A3.3-02 Actions Configure, Restart, Upgrade, Logs, Metrics, Diagnostics	PASSED	test_services_operate.py::test_commands_and_logs (E-PO-SERVER)
ARCH-A3.3-03 Uniform sheet tabs	NOT_STARTED		No console test of the ten tabs.
ARCH-A3.3-04 Same operating model for the whole catalog	PASSED	test_catalog.py::test_every_template_renders (E-PO-SERVER)

Part A, A3.4. Lifecycle states, administrative states and five state fields

Item	Status	Proof	Remaining or blocker
ARCH-A3.4-01 Lifecycle states with controlled transitions	PASSED	test_kubernetes_unit.py::test_states_stay_distinct (E-PO-K8S)
ARCH-A3.4-02 Admin states ENABLED, DISABLED, MAINTENANCE, QUARANTINED, SUSPENDED	IN_PROGRESS	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)	Only enabled and maintenance exist; DISABLED, QUARANTINED, SUSPENDED absent.
ARCH-A3.4-03 Field desired_state	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)
ARCH-A3.4-04 Field observed_state	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)
ARCH-A3.4-05 Field health_status	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)
ARCH-A3.4-06 Field operation_status	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state test_platform_manager_bridge.py::test_operation_forwarded_on_behalf_and_audited (E-PO-BRIDGE)
ARCH-A3.4-07 Field security_state	IN_PROGRESS	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)	security_state summarises TLS and secrets, not an authorisation to run.
ARCH-A3.4-08 Desired/observed gap visible in the API	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)

Part A, A3.5. Components to install, phases and dependency graph

Item	Status	Proof	Remaining or blocker
ARCH-A3.5-01 Phase 0 bootstrap Manager, licence, environment	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-02 Phase 1 network, certificates, DNS, storage	PASSED	test_lifecycle_checks.py::test_tls_probes_real_handshakes test_lifecycle_checks.py::test_dns_forward_and_reverse_with_the_real_resolver (E-ID-LIFECYCLE)
ARCH-A3.5-03 Phase 2 PostgreSQL, Redis, client storage	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-04 Phase 3 Keycloak, SPIRE, secrets	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-05 Phase 4 OpenFGA, OPA, policy gateway	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-06 Phase 5 APISIX, audit gateway, data control	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-07 Phase 6 LiteLLM, vLLM	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-08 Phase 7 Navin runtime, NATS, Temporal, MCP gateway	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-09 Phase 8 Qdrant, Haystack, Docling, RAG	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-10 Phase 9 OTel, Opik, Prometheus, OpenSearch	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-11 Phase 10 SOC, Kill Switch, evidence	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-12 Phase 11 developer portal, SDK, packs	BLOCKED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-A3.5-13 Phase 12 diagnostics and final acceptance	PASSED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-ID-LIFECYCLE)
ARCH-A3.5-14 Dependency graph computed by the Manager	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-LIFECYCLE)

Part A, A3.6. Guided first installation, signed acceptance report, offline bundle and Manager recovery

Item	Status	Proof	Remaining or blocker
ARCH-A3.6-01 Guided step: Prepare the infrastructure	PASSED	test_lifecycle_checks.py::test_preflight_blocks_installation_on_critical_failures (E-ID-LIFECYCLE)
ARCH-A3.6-02 Guided step: Load the licence	IN_PROGRESS		Step present in the wizard, no dedicated behaviour test in this lot
ARCH-A3.6-03 Guided step: Connect client resources	PASSED	test_services_install.py::test_connection_bindings_and_unmanaged_provider (E-ID-LIFECYCLE)
ARCH-A3.6-04 Guided step: Choose the profile	PASSED	test_lifecycle_profiles.py::test_profile_catalog_and_creation (E-ID-LIFECYCLE)
ARCH-A3.6-05 Guided step: Install with progress, logs, resume	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-LIFECYCLE)
ARCH-A3.6-06 Guided step: Configure the policies	IN_PROGRESS		Step present in the wizard, no dedicated behaviour test in this lot
ARCH-A3.6-07 Guided step: Run acceptance tests	PASSED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-ID-LIFECYCLE)
ARCH-A3.6-08 Guided step: Activate the environment	IN_PROGRESS		Step present in the wizard, no dedicated behaviour test in this lot
ARCH-A3.6-09 Signed acceptance report PASS, FAIL, WAIVED justified	PASSED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-ID-LIFECYCLE)
ARCH-A3.6-10 Complete offline bundle, nothing downloaded at install	PASSED	test_bundle.py::test_manifest_of_verified_artifacts test_bundle.py::test_checksum_mismatch_refused test_bundle.py::test_verify_detects_modified_bundle (E-ID-PACKAGING)
ARCH-A3.6-11 Maintenance utility outside the web interface	IN_PROGRESS		CLI present; recovery test of a stopped Manager to write

Part A, A4.1. Portal navigation tree

Item	Status	Proof	Remaining or blocker
ARCH-A4.1-01 Overview	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)
ARCH-A4.1-02 Platform Manager	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-A4.1-03 AI Management	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::modelsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.1-04 Agents & Applications	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::agentsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.1-05 Developer Studio	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.1-06 Marketplace	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-developer.test.ts::marketplacePackagesCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.1-07 Data & RAG	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-operations.test.ts::knowledgeCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.1-08 Security & IAM	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.1-09 SOC & Response	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.1-10 Observability	IN_PROGRESS	observability.test.ts::Observability SLO screen nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::sloCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)	SLO and error budget screen delivered over GET /v1/telemetry/slo; Opik traces and Grafana dashboards stay outside the portal with no dedicated deep link.
ARCH-A4.1-11 Audit & Compliance	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.1-12 Enterprise Settings	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::tenantsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.1-13 Deep links to Opik, Keycloak, LiteLLM, OpenSearch	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.

Part A, A4.2. Functional portal screens

Item	Status	Proof	Remaining or blocker
ARCH-A4.2-01 Dashboard	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.2-02 Cluster Explorer	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::clustersCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-A4.2-03 Service Manager	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::servicesCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-A4.2-04 Configuration Center	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Portal Platform Manager space absent: waits for the platform_manager domain routes (lot C01).
ARCH-A4.2-05 Model Registry	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::modelVersionsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-06 Model Playground	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-A4.2-07 Agent Registry	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::agentsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-08 Agent Execution Explorer	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::sessionsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-09 Developer Projects	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::projectsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-10 Marketplace	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-developer.test.ts::marketplaceInstallationsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-11 Plugin Studio	IN_PROGRESS	api-conformance.test.ts::screen configs (ResourceView / Tester) nav-access.test.ts::navigation filtered by role from GET /v1/me screens-developer.test.ts::pluginsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)	The plugin catalogue (install, uninstall, status) exists; authoring and building a plugin in the portal is not provided.
ARCH-A4.2-12 Skill Library	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-operations.test.ts::skillsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-13 Prompt Registry	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-developer.test.ts::promptsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-14 MCP Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-operations.test.ts::mcpCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-15 Connector Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-operations.test.ts::connectorsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-16 RAG Studio	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-operations.test.ts::knowledgeCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-17 IAM Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::membersCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-18 Policy Studio	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::policiesCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-19 Privacy Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::dlpRulesCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-20 Approval Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::approvalsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-21 SOC Dashboard	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::socOrdersCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-22 Kill Switch Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::killSwitchesCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-23 Trace Explorer	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::correlationsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-24 Audit Explorer	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::auditEventsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-25 Evidence Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-security.test.ts::sealsCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-26 FinOps	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::usageCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-A4.2-27 Backup & DR	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Backup & DR screen not built: no backup, restore or DR route under /v1/platform-manager exists in docs/api/control-plane-v1.requests.json (policies, jobs, restore plans with approvals, DR plans with last test, observed RTO and RPO).
ARCH-A4.2-28 License Center	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-overview.test.ts::licenseHistoryCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)

Part A, A4.3. Profiles and rights enforced server side

Item	Status	Proof	Remaining or blocker
ARCH-A4.3-01 Platform Administrator profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-02 Security Administrator profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-03 SOC Analyst profile	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-A4.3-04 AI Governance Officer profile	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-A4.3-05 Data Steward profile	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-A4.3-06 Developer profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-07 Application Owner profile	PASSED	test_iam_role_matrix.py::test_application_owner_edits_own_agent_only test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-A4.3-08 Auditor profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-09 Finance/FinOps profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-10 Business User profile	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-A4.3-11 Rights enforced by OpenFGA and OPA on the backend	PASSED	test_iam_openfga_real.py::test_document_relations_allow_and_deny_per_action test_iam_opa_bundles_real.py::test_signed_bundle_revisions_loaded_and_enforced test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)

Part A, A4.4. Frontend architecture

Item	Status	Proof	Remaining or blocker
ARCH-A4.4-01 Next.js + React + TypeScript	PASSED	i18n.test.ts::en and fr have exactly the same keys (E-DF-PORTAL)
ARCH-A4.4-02 Design system (Tailwind + radix + webui tokens instead of MUI, client decision)	PASSED	i18n.test.ts::no em dash or en dash anywhere (E-DF-PORTAL)
ARCH-A4.4-03 API client generated from the OpenAPI specification	IN_PROGRESS	openapi-client.test.ts::the generated operation table is up to date with docs/api/openapi-v1.json openapi-client.test.ts::has one entry per operation of the specification api-conformance.test.ts::the table below covers every client call found in the portal source (E-DF-PORTAL)	Only new calls go through callOperation; the existing domain wrappers of resources.ts stay hand written (checked against the specification).
ARCH-A4.4-04 Real time by SSE or WebSocket (operations, traces, incidents, metrics)	IN_PROGRESS	sse.test.ts::follows the documented route with Last-Event-ID resumption and stops at end sse.test.ts::the run detail screen follows live runs realtime.test.ts::reconnects on unexpected closes only, a bounded number of times (E-DF-PORTAL)	Runs followed by SSE, voice by WebSocket; incidents, traces and metrics stay on periodic refresh, no documented stream route.
ARCH-A4.4-05 Monaco editor (Rego, YAML, prompts, JSON, manifests), bundled locally	PASSED	studio.test.ts::registers the contracts/v1 schemas in the editor, with the policy request wrapper (E-DF-PORTAL)
ARCH-A4.4-06 Forms with React Hook Form + Zod	PASSED	zod-csp.test.ts::parses objects without calling the Function constructor form-ids.test.ts::scopes every field id to its form instance (E-DF-PORTAL)
ARCH-A4.4-07 React Flow graphs (topologies, dependencies, visual traces)	IN_PROGRESS	components.test.ts::layers GET /v1/lineage/graph and keeps the nodes of a cycle (E-DF-PORTAL)	Layered DependencyGraph without React Flow (ADR-0148); React Flow not added, no interactive topology view.
ARCH-A4.4-08 Apache ECharts charts	IN_PROGRESS	mappers.test.ts (E-DF-PORTAL)	Recharts (MIT) used instead of ECharts (ADR-0148); to be confirmed by the client.
ARCH-A4.4-09 OIDC authentication with Keycloak	PASSED	session.test.ts::keeps no secret in localStorage after login and logout (E-DF-PORTAL)
ARCH-A4.4-10 React Flow limited to topology and execution views; Developer Studio code first	PASSED	studio.test.ts::conform to the documented API surface (E-DF-PORTAL)

Part A, A5.1. Backend services to develop

Item	Status	Proof	Remaining or blocker
ARCH-A5.1-01 platform-manager-api	PASSED	test_platform_core.py::test_operations_api_detail_logs_abort_retry_and_scope (E-RB-NM)
ARCH-A5.1-02 platform-reconciler: drift detected and reconciled	PASSED	test_lifecycle_drift_backups.py::test_change_outside_the_manager_is_detected_and_reconciled (E-RB-NM)
ARCH-A5.1-03 node-agent: registration, preflight and signature	PASSED	test_platform_core.py::test_registration_evaluates_preflight_at_once_and_reregisters test_foundation.py::test_agent_signature_is_required (E-RB-NM)
ARCH-A5.1-04 component-catalog	PASSED	test_catalog.py::test_catalog_loads_and_is_open_source_only test_platform_components.py::test_manifest_is_valid_against_the_schema (E-RB-CP, E-RB-NM)
ARCH-A5.1-05 configuration-service: versions, diff, restore	PASSED	test_services_config.py::test_versions_diff_restore_and_secrets (E-RB-NM)
ARCH-A5.1-06 deployment-service: provider and consumer installation	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-RB-NM)
ARCH-A5.1-07 health-controller: distinct liveness, readiness, smoke	PASSED	test_lifecycle_checks.py::test_liveness_readiness_and_smoke_are_distinct (E-RB-NM)
ARCH-A5.1-08 identity-integration: OIDC, SPIFFE, API keys	PASSED	test_core_auth.py::test_oidc test_core_auth.py::test_spiffe (E-RB-CP)
ARCH-A5.1-09 authorization-service: ReBAC and check	PASSED	test_core_secrets_authz.py::test_authz_tuples_and_check test_authz_rebac.py::test_agent_and_project_relations (E-RB-CP)
ARCH-A5.1-10 delegation-service: always narrower delegation, cascading revocation	PASSED	test_identity_context_delegation.py::test_restricted_delegation_is_always_narrower_and_revocation_cascades (E-RB-CP)
ARCH-A5.1-11 governance-registry	PASSED	test_data_quality_governance.py::test_governance_registry (E-RB-CP)
ARCH-A5.1-12 model-control-service: approved publication, canary, rollback	PASSED	test_llm_model_lifecycle.py::test_publication_needs_an_approval_then_canary_and_rollback_keep_history (E-RB-CP)
ARCH-A5.1-13 agent-control-service: suspend, approved resume, kill	PASSED	test_agents_execution.py::test_kill_switch_blocks_new_runs (E-RB-CP)
ARCH-A5.1-14 runtime-gateway: PEP on the model call	PASSED	test_gateway_pep_untrusted.py::test_pep_model_gateway_denied (E-RB-CP)
ARCH-A5.1-15 mcp-security-gateway	PASSED	test_gateway_pep_untrusted.py::test_pep_mcp_denied test_capabilities_gateways.py::test_mcp_gateway (E-RB-CP)
ARCH-A5.1-16 connector-service: signed webhooks, replay, dedupe	PASSED	test_capabilities_gateways.py::test_webhook_signature_replay_and_dedupe test_gateway_pep_untrusted.py::test_pep_connector_channel_a2a_denied (E-RB-CP)
ARCH-A5.1-17 developer-platform-service: developer day one	PASSED	test_core_contracts.py::test_apply_denied_by_policy (E-RB-CP)
ARCH-A5.1-18 pack-registry-service: unsigned or tampered pack refused	PASSED	test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused (E-RB-CP)
ARCH-A5.1-19 data-access-gateway: knowledge and memory PEP	PASSED	test_gateway_pep_untrusted.py::test_pep_knowledge_and_memory_denied (E-RB-CP)
ARCH-A5.1-20 privacy-service: authorised and audited detokenisation	PASSED	test_data_privacy.py::test_detokenize_requires_permission_and_is_audited (E-RB-CP)
ARCH-A5.1-21 storage-adapter-service: policy decided before the action	PASSED	test_storage_profiles_api.py::test_policy_decides_before_the_storage_action (E-RB-CP)
ARCH-A5.1-22 rag-governance-service: chunk ACL	PASSED	test_rag_governance.py::test_chunk_acl_forbidden_fragments_never_reach_the_context (E-RB-CP)
ARCH-A5.1-23 usage-budget-service: concurrent reservations	PASSED	test_finops_quotas.py::test_concurrent_reservations_one_rejected (E-RB-CP)
ARCH-A5.1-24 evaluation-service: quality gates and red team	IN_PROGRESS	test_data_evaluation.py::test_evaluation_gate_pass_and_fail test_data_evaluation.py::test_red_team_runs (E-RB-CP)	The real Ragas, Promptfoo and garak engines are not run by this lot; only the built in quality gates and red team are proven.
ARCH-A5.1-25 approval-service: approval by someone else	PASSED	test_approvals_promotion.py::test_promotion_waits_for_an_approval_from_someone_else (E-RB-CP)
ARCH-A5.1-26 audit-gateway: redelivery without loss or duplicate	PASSED	test_evidence_gateway.py::test_gateway_redelivers_after_target_outage_without_loss_or_duplicate (E-RB-CP)
ARCH-A5.1-27 evidence-service: seal verifiable online and offline	PASSED	test_evidence_gateway.py::test_seal_signature_verifies_online_and_offline (E-RB-CP)
ARCH-A5.1-28 detection-service: normalisation and correlation	PASSED	test_soc_ai_sdr.py::test_ingestor_normalizes_and_correlator_links_user_agent_tenant (E-RB-CP)
ARCH-A5.1-29 incident-service	PASSED	test_soc_ai_sdr.py::test_incident_lifecycle_assignment_and_auditable_timeline (E-RB-CP)
ARCH-A5.1-30 kill-switch-controller	PASSED	test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions test_soc_ai_sdr.py::test_kill_switches_persist_across_restart (E-RB-CP)
ARCH-A5.1-31 response-playbook-service: typed reactions only	PASSED	test_soc_ai_sdr.py::test_typed_reactions_only_never_a_free_command test_soc_ai_sdr.py::test_rate_limit_and_require_approval_reactions (E-RB-CP)
ARCH-A5.1-32 license-service: offline activation	PASSED	test_licensing.py::test_offline_issuance_and_file_activation_without_network (E-RB-CP)
ARCH-A5.1-33 diagnostic-service: preflight and sanitised support bundle	PASSED	test_lifecycle_checks.py::test_preflight_blocks_installation_on_critical_failures test_lifecycle_bundle_acceptance.py::test_support_bundle_has_no_secret_and_no_personal_data (E-RB-NM)

Part A, A5.2. Technical split of deployments

Item	Status	Proof	Remaining or blocker
ARCH-A5.2-01 control-api: Control Plane deployment	PASSED	test_platform_deploy_env.py::test_helm_env_names_are_settings test_platform_security_manifests.py::test_every_pod_spec_is_hardened (E-RB-CP)
ARCH-A5.2-02 platform-controller: Platform Manager outside the application chart	PASSED	test_platform_core.py::test_background_server_tasks (E-RB-NM)
ARCH-A5.2-03 security-enforcement: OPA, OpenFGA, network policies	PASSED	test_platform_security_manifests.py::test_default_deny_and_metadata_deny test_core_policies.py::test_opa_engine (E-RB-CP)
ARCH-A5.2-04 runtime-plane: worker, KEDA multimodal workers, sandbox, LiteLLM, vLLM	PASSED	test_platform_deploy_env.py::test_helm_worker_deployment test_media_worker.py::test_helm_worker_kinds_are_media_worker_operations test_platform_security_manifests.py::test_vllm_reachable_only_from_litellm_and_control_plane (E-RB-CP)
ARCH-A5.2-05 telemetry-plane	IN_PROGRESS	test_data_quality_governance.py::test_telemetry_ingest_overview_trace (E-RB-CP)	No distinct telemetry deployment unit in the chart; the observability stack is proven by lot C10.
ARCH-A5.2-06 audit-plane: durable audit collection	IN_PROGRESS	test_evidence_gateway.py::test_gateway_redelivers_after_target_outage_without_loss_or_duplicate (E-RB-CP)	The audit gateway runs as a worker job (audit_gateway), not as an isolated chart deployment.
ARCH-A5.2-07 soc-plane: works even when the portal is down	IN_PROGRESS	test_runtime_without_console.py::test_decisions_stay_enforced_with_console_and_admin_routes_down test_soc_ai_sdr.py::test_worker_runs_the_soc_scan_and_containment_verifier (E-RB-CP)	The SOC is served by the Control Plane and the worker, independent of the portal; no separate SOC deployment in the chart.
ARCH-A5.2-08 developer-plane: portal and documentation	PASSED	test_platform_security_manifests.py::test_portal_ingress_tls_headers_and_login_limit (E-RB-CP)
ARCH-A5.2-09 offline license-controller	PASSED	test_licensing.py::test_verifier_and_store_never_reach_the_network test_licensing.py::test_offline_issuance_and_file_activation_without_network (E-RB-CP)
ARCH-A5.2-10 Temporal for durable workflows, NATS JetStream for events, Redis only cache and coordination	PASSED	test_runtime_temporal_durable.py::test_durable_workflow_resumes_after_worker_kill test_runtime_nats_jetstream.py::test_dedup_ordering_redelivery_exactly_once test_core_redis.py::test_sources_of_truth_never_read_from_redis (E-RB-CP)

Part A, A6.1. PostgreSQL schemas and tables

Item	Status	Proof	Remaining or blocker
ARCH-A6.1-01 Domain core (tenants, organizations, business_units, environments, projects, settings)	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	Missing tables: organizations, business_units. No code uses them yet; to be created with the domain that will own them (no empty table).
ARCH-A6.1-02 Domain iam (users, groups, memberships, service_identities, delegations, access_grants)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-03 Domain platform inventory (clusters, nodes, components, component_versions, service_instances, dependencies)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-04 Domain platform operations (configurations, configuration_versions, operations, operation_steps, health_checks, maintenance_windows)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-05 Domain ai (providers, models, model_routes, model_deployments, model_prices, model_approvals)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-06 Domain agents (agents, agent_versions, agent_deployments, agent_runs, subagent_runs, checkpoints)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-07 Domain agent sessions (sessions, action_requests, tool_invocations, memory_scopes, memory_entries)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-08 Domain dev (projects, sdk_versions, project_templates, developer_environments, test_runs)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-09 Domain registry packs (packs, pack_versions, pack_installations, pack_assets, pack_dependencies)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-10 Domain registry assets (skills, skill_versions, prompts, prompt_versions, plugins, plugin_versions)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-11 Domain integration (mcp_servers, mcp_tools, connectors, connector_instances, connector_credentials)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-12 Domain data (data_sources, datasets, documents, document_acl, classifications, lineage_refs)	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	Missing tables: datasets. No code uses them yet; to be created with the domain that will own them (no empty table).
ARCH-A6.1-13 Domain rag (collections, ingestion_jobs, document_chunks, retrieval_policies, index_versions)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-14 Domain policy (policy_sets, policy_versions, policy_assignments, policy_tests, exceptions)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-15 Domain security signals (security_signals, detections, incidents, response_actions, quarantines, kill_switches)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-16 Domain security approvals (approvals, approval_steps, risk_assessments, dlp_events)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-17 Domain audit (events, decision_records, evidence_batches, evidence_objects, retention_policies, exports)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-18 Domain observability (trace_refs, alert_rules, alert_instances, service_slos, telemetry_configs)	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	Missing tables: service_slos. No code uses them yet; to be created with the domain that will own them (no empty table).
ARCH-A6.1-19 Domain finops (budgets, quotas, usage_records, cost_allocations, price_catalogs)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-20 Domain storage (profiles, buckets, storage_policies, object_refs, backup_records)	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)
ARCH-A6.1-21 Domain commercial (licenses, license_activations, entitlements, support_contracts, license_events)	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	Missing tables: support_contracts. No code uses them yet; to be created with the domain that will own them (no empty table).
ARCH-A6.1-22 Domain system (outbox_events, inbox_events, scheduled_jobs, migrations, feature_flags)	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	Missing tables: inbox_events. No code uses them yet; to be created with the domain that will own them (no empty table).
ARCH-A6.1-23 Large traces in Opik/Jaeger, logs in OpenSearch, files in client object storage	IN_PROGRESS	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_data_model_mapping.py::test_column_backed_concepts_exist test_data_model_mapping.py::test_manager_and_external_locations_exist (E-DP-DATAMODEL)	eai.telemetry_spans keeps summarised spans (cost, run_id) in PostgreSQL: to be reduced to trace references if the architecture decision requires it.
ARCH-A6.1-24 Tools with their own database (Keycloak, Opik, Temporal, OpenFGA): separate schemas and migrations	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)

Part A, A6.2. Key relations of the data model

Item	Status	Proof	Remaining or blocker
ARCH-A6.2-01 Tenant to organisations, projects, environments	IN_PROGRESS	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)	Organisations missing (see A6.1 core).
ARCH-A6.2-02 Cluster to nodes and service instances	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-03 Component to versions, dependencies, instances	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-04 Agent to versions, deployments, runs	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-05 Agent Run to actions, subagents, traces	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-06 Developer Project to packs, tests, versions	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-07 Pack Version to skills, prompts, MCP, connectors	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-08 User to delegations, approvals, audit events	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-09 Policy Version to assignments, tests, decisions	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-10 Incident to detection, response, evidence	PASSED	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)
ARCH-A6.2-11 License to activations, entitlements, support	IN_PROGRESS	test_data_model_mapping.py::test_relations_are_foreign_keys_or_reference_columns (E-DP-DATAMODEL)	Support contracts missing.

Part B, B3.1. Manager functions

Item	Status	Proof	Remaining or blocker
ARCH-B3.1-01 Discovery	PASSED	test_kubernetes_api.py::test_discovery_inventory (E-PO-K8S)
ARCH-B3.1-02 Preflight	PASSED	test_lifecycle_checks.py::test_preflight_blocks_installation_on_critical_failures (E-PO-SERVER)
ARCH-B3.1-03 Component Catalog	PASSED	test_catalog.py::test_topologies (E-PO-SERVER)
ARCH-B3.1-04 Dependency Manager	PASSED	test_availability_api.py::test_dag_order_and_kill_switch_survives_restart (E-PO-SERVER)
ARCH-B3.1-05 Configuration Manager	PASSED	test_services_config.py::test_config_groups_preview_and_apply (E-PO-SERVER)
ARCH-B3.1-06 Lifecycle Manager	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)
ARCH-B3.1-07 Health Manager	PASSED	test_services_operate.py::test_blueprint_round_trip_and_health_job (E-PO-SERVER)
ARCH-B3.1-08 Cluster Manager	PASSED	test_services_operate.py::test_component_instances_change_peers (E-PO-SERVER)
ARCH-B3.1-09 Scaling Manager	NOT_STARTED		Function not proven by a test in this lot.
ARCH-B3.1-10 Upgrade Manager	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-PO-SERVER)
ARCH-B3.1-11 Backup & Recovery	PASSED	test_backup_recovery.py::test_restore_needs_two_distinct_approvers_and_separate_privilege (E-PO-SERVER)
ARCH-B3.1-12 Certificate Manager	PASSED	test_lifecycle_checks.py::test_tls_probes_real_handshakes (E-PO-SERVER)
ARCH-B3.1-13 Secrets Integration	PASSED	test_services_config.py::test_versions_diff_restore_and_secrets (E-PO-SERVER)
ARCH-B3.1-14 Troubleshooting	PASSED	test_platform_core.py::test_operations_api_detail_logs_abort_retry_and_scope (E-PO-SERVER)
ARCH-B3.1-15 Capacity Planner	NOT_STARTED		Function not proven by a test in this lot.
ARCH-B3.1-16 Compliance Checker	NOT_STARTED		Function not proven by a test in this lot.
ARCH-B3.1-17 License Manager	NOT_STARTED		Function not proven by a test in this lot.
ARCH-B3.1-18 Support Bundle	PASSED	test_lifecycle_bundle_acceptance.py::test_support_bundle_has_no_secret_and_no_personal_data (E-PO-SERVER)
ARCH-B3.1-19 Installation Wizard	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason (E-PO-SERVER)

Part B, B3.2. Manager home page and uniform tabs

Item	Status	Proof	Remaining or blocker
ARCH-B3.2-01 Home page with real counts per environment	PASSED	test_platform_manager_bridge.py::test_summary_real_counts (E-PO-BRIDGE)
ARCH-B3.2-02 Services with real instances x/y and states	PASSED	test_platform_manager_bridge.py::test_services_five_state_fields_and_admin_state (E-PO-BRIDGE)
ARCH-B3.2-03 Real cluster topology in the console (INFUI-003)	IN_PROGRESS	topology.test.tsx nodes.test.tsx (E-PO-UI)	Uniform tabs (Audit, Support) not tested; node pools view not tested.

Part B, B3.3. Technical stop and security suspend

Item	Status	Proof	Remaining or blocker
ARCH-B3.3-01 Technical stop	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)
ARCH-B3.3-02 Security suspend	NOT_STARTED		Distinct effect on applications and transactions not proven.
ARCH-B3.3-03 Restart	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)
ARCH-B3.3-04 Rolling restart	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions (E-PO-SERVER)
ARCH-B3.3-05 Drain	NOT_STARTED		Distinct effect on applications and transactions not proven.
ARCH-B3.3-06 Scale-to-zero	NOT_STARTED		Distinct effect on applications and transactions not proven.
ARCH-B3.3-07 Node quarantine	IN_PROGRESS	nodes.test.tsx (E-PO-UI)	Distinct effect on applications and transactions not proven.
ARCH-B3.3-08 Emergency shutdown	IN_PROGRESS	test_availability_api.py::test_dag_order_and_kill_switch_survives_restart (E-PO-SERVER)	Distinct effect on applications and transactions not proven.

Part B, B3.4. Standard manifest of every component

Item	Status	Proof	Remaining or blocker
ARCH-B3.4-01 Manifest: Identity	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-02 Manifest: Support status	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-03 Manifest: Deployment	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-04 Manifest: Dependencies	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-05 Manifest: Configuration (schema, secretRefs)	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-06 Manifest: Operations	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-07 Manifest: Health	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-08 Manifest: Observability	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-09 Manifest: Security	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.
ARCH-B3.4-10 Manifest: Lifecycle (backup, approval, budget)	IN_PROGRESS	test_catalog.py::test_parameters_are_documented_and_valid (E-PO-SERVER)	The test validates the catalog schema, not every field of the reference manifest.

Part B, B3.5. Manager backend services and bring your own infrastructure

Item	Status	Proof	Remaining or blocker
ARCH-B3.5-01 platform-api	PASSED	test_foundation.py::test_api_requires_authentication (E-PO-SERVER)
ARCH-B3.5-02 installation-orchestrator	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-PO-SERVER)
ARCH-B3.5-03 configuration-service	PASSED	test_services_config.py::test_config_groups_preview_and_apply (E-PO-SERVER)
ARCH-B3.5-04 dependency-resolver	PASSED	test_services_install.py::test_connection_bindings_and_unmanaged_provider (E-PO-SERVER)
ARCH-B3.5-05 health-controller	PASSED	test_services_operate.py::test_blueprint_round_trip_and_health_job (E-PO-SERVER)
ARCH-B3.5-06 upgrade-controller	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-PO-SERVER)
ARCH-B3.5-07 backup-coordinator	PASSED	test_lifecycle_drift_backups.py::test_coordinated_backup_then_restore_executed_and_verified (E-PO-SERVER)
ARCH-B3.5-08 platform-diagnostics	PASSED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-PO-SERVER)
ARCH-B3.5-09 license-service	NOT_STARTED		Lot C10.
ARCH-B3.5-10 platform-node-agent	PASSED	test_agent_signature.py::test_agent_and_server_signatures_are_identical (E-PO-SERVER)
ARCH-B3.5-11 Agent never a generic shell: signed operations	PASSED	test_foundation.py::test_agent_signature_is_required (E-PO-SERVER)
ARCH-B3.5-12 BYOI existing Kubernetes	PASSED	test_kubernetes_api.py::test_manager_user_has_least_privilege (E-PO-K8S)
ARCH-B3.5-13 BYOI unmanaged provider	PASSED	test_services_install.py::test_connection_bindings_and_unmanaged_provider (E-PO-SERVER)
ARCH-B3.5-14 Control Plane platform_manager bridge	PASSED	test_platform_manager_bridge.py::test_operation_forwarded_on_behalf_and_audited (E-PO-BRIDGE)

Part B, B4.1. Deployment profiles

Item	Status	Proof	Remaining or blocker
ARCH-B4.1-01 Development profile	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason (E-ID-LIFECYCLE)
ARCH-B4.1-02 Standard Enterprise profile	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason test_lifecycle_profiles.py::test_standard_profile_satisfied_when_its_rules_hold (E-ID-LIFECYCLE)
ARCH-B4.1-03 Banking Secure profile	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason test_lifecycle_profiles.py::test_banking_secure_two_person_rule (E-ID-LIFECYCLE)
ARCH-B4.1-04 Air-Gapped profile	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason (E-ID-LIFECYCLE)
ARCH-B4.1-05 Hybrid profile	PASSED	test_lifecycle_profiles.py::test_each_profile_is_installable_or_blocked_with_reason (E-ID-LIFECYCLE)
ARCH-B4.1-06 No profile imposes a commercial limit	PASSED	test_lifecycle_profiles.py::test_profile_catalog_and_creation (E-ID-LIFECYCLE)

Part B, B4.2. Installation workflow

Item	Status	Proof	Remaining or blocker
ARCH-B4.2-01 Licence import	IN_PROGRESS		Covered by another lot (licence C10, discovery C01); proof to cite
ARCH-B4.2-02 Environment choice	PASSED	test_lifecycle_profiles.py::test_profile_catalog_and_creation (E-ID-LIFECYCLE)
ARCH-B4.2-03 Infrastructure discovery	IN_PROGRESS		Covered by another lot (licence C10, discovery C01); proof to cite
ARCH-B4.2-04 Connection of client services	PASSED	test_services_install.py::test_connection_bindings_and_unmanaged_provider (E-ID-LIFECYCLE)
ARCH-B4.2-05 Profile selection	PASSED	test_lifecycle_profiles.py::test_profile_catalog_and_creation (E-ID-LIFECYCLE)
ARCH-B4.2-06 Parameters	PASSED	test_services_install.py::test_validation_errors (E-ID-LIFECYCLE)
ARCH-B4.2-07 Prevalidation	PASSED	test_lifecycle_checks.py::test_preflight_blocks_installation_on_critical_failures test_services_install.py::test_artifact_missing_and_preflight_failure (E-ID-LIFECYCLE)
ARCH-B4.2-08 Ordered registered deployment	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-LIFECYCLE)
ARCH-B4.2-09 Security bootstrap	BLOCKED	test_services_install.py::test_opa_binary_install (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.2-10 Functional validation	BLOCKED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-ID-LIFECYCLE)	Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.2-11 Operational activation	IN_PROGRESS		Covered by another lot (licence C10, discovery C01); proof to cite

Part B, B4.3. What the client finds after installation

Item	Status	Proof	Remaining or blocker
ARCH-B4.3-01 Portal reachable with SSO and MFA	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-02 Admin accounts and emergency access	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-03 Components registered and supervised	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-LIFECYCLE)
ARCH-B4.3-04 Base policies and roles	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-05 SDK downloadable	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-06 Local offline documentation	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-07 Examples without real data	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-08 Business packs visible and installable	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-09 Traces and metrics	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-10 Alerts, detection, Kill Switch testable	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-11 Audit events and evidence viewable	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-12 Test model endpoint	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-13 Backups configured and restore documented	BLOCKED		Needs a real Kubernetes cluster for the end to end run; the local logic is proven by the cited tests [B-CLUSTER]
ARCH-B4.3-14 Ready on day one without magic permissions	PASSED	test_lifecycle_bundle_acceptance.py::test_signed_acceptance_report_with_evidence (E-ID-LIFECYCLE)

Part B, B5.1. Functional tree of the portal

Item	Status	Proof	Remaining or blocker
ARCH-B5.1-01 Overview	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)
ARCH-B5.1-02 Platform Manager	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-B5.1-03 Organizations & IAM	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-04 AI Models & Gateway	PASSED	nav-access.test.ts::navigation filtered by role from GET /v1/me screens-ai.test.ts::providersCfg routes, bodies, roles, confirmations and states (E-DF-PORTAL, E-PT-SCREENS)
ARCH-B5.1-05 Agents & Applications	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-06 Developer Studio	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-07 Enterprise Marketplace	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-08 Data & RAG	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-09 Security & Governance	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-10 SOC & Incident Response	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-11 Observability	IN_PROGRESS	observability.test.ts::Observability SLO screen nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	SLO and error budget screen delivered over GET /v1/telemetry/slo; Opik traces and Grafana dashboards stay outside the portal with no dedicated deep link.
ARCH-B5.1-12 Quality & Evaluation	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-13 FinOps	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-14 Audit & Compliance	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-15 Infrastructure	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-B5.1-16 Licensing & Support	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.1-17 Documentation	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.

Part B, B5.2. Priority screens

Item	Status	Proof	Remaining or blocker
ARCH-B5.2-01 Global dashboard	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-02 Service Manager	IN_PROGRESS	platform-manager.test.ts::Platform Manager space over the Control Plane bridge nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Space delivered over the /v1/platform-manager routes (C01) with configuration, operation body and role filtering tests; not replayed against a real Platform Manager from the portal, deep links lack a route exposing the base URL.
ARCH-B5.2-03 Agent Details	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-04 Execution Explorer	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-05 Policy Manager	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-06 Prompt & Skill Studio	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-07 MCP Studio	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-08 Plugin Builder	IN_PROGRESS	api-conformance.test.ts::screen configs (ResourceView / Tester) nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	The plugin catalogue (install, uninstall, status) exists; authoring and building a plugin in the portal is not provided.
ARCH-B5.2-09 Marketplace	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-10 Model Gateway	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-11 Data Protection	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-12 SOC Console	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-13 Kill Switch Center	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-14 Audit Explorer	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.
ARCH-B5.2-15 License Center	IN_PROGRESS	nav-access.test.ts::navigation filtered by role from GET /v1/me (E-DF-PORTAL)	Screen present without a dedicated vitest test of configuration, request bodies and states; to complete.

Part B, B5.3. Shared frontend components and destructive actions

Item	Status	Proof	Remaining or blocker
ARCH-B5.3-01 ResourceTable: search, filters, sort, pagination, export subject to permissions	PASSED	components.test.ts::searches, sorts numerically with missing values last and paginates (E-DF-PORTAL)
ARCH-B5.3-02 ResourceDetails: information, state, versions, dependencies, history	PASSED	components.test.ts::splits information, state, versions, dependencies and history from the real fields (E-DF-PORTAL)
ARCH-B5.3-03 ConfigurationEditor: forms generated from JSON Schema	PASSED	components.test.ts::generates the form fields from a JSON Schema of contracts/v1 (E-DF-PORTAL)
ARCH-B5.3-04 CodeEditor: Monaco for Python, TypeScript, JSON, YAML, Rego	IN_PROGRESS	studio.test.ts::registers the contracts/v1 schemas in the editor, with the policy request wrapper (E-DF-PORTAL)	Declared languages: json, markdown, rego, plaintext, yaml; Python and TypeScript not registered in EditorLanguage.
ARCH-B5.3-05 PermissionMatrix: roles, resources, operations	PASSED	components.test.ts::crosses subjects and resources with the relations of GET /v1/authz/tuples (E-DF-PORTAL)
ARCH-B5.3-06 ExecutionTimeline	PASSED	components.test.ts::merges steps and subagents of GET /v1/runs/{id}/steps and /subagents in time order (E-DF-PORTAL)
ARCH-B5.3-07 DependencyGraph	PASSED	components.test.ts::layers GET /v1/lineage/graph and keeps the nodes of a cycle (E-DF-PORTAL)
ARCH-B5.3-08 ApprovalDialog: human validation, separation of duties	PASSED	components.test.ts::enforces separation of duties, the approver roles and the reject comment (E-DF-PORTAL)
ARCH-B5.3-09 SecurityFindings: vulnerabilities, risks, evidence, remediations	PASSED	components.test.ts::orders by severity and counts, keeping risk, evidence and remediation (E-DF-PORTAL)
ARCH-B5.3-10 DeploymentProgress: steps, state, results, errors	PASSED	components.test.ts::reports steps, state, current step and errors (E-DF-PORTAL)
ARCH-B5.3-11 IncidentTimeline: detection, decision, containment, verification, resolution	PASSED	components.test.ts::shows detection, decision, containment, verification and resolution dated by real events only (E-DF-PORTAL)
ARCH-B5.3-12 Destructive actions: impacted resources, dependencies, risks and permissions shown before confirmation	IN_PROGRESS	components.test.ts::lists transitive dependents, risks and permissions and confirms only on the typed name (E-DF-PORTAL)	DestructiveConfirm available; existing destructive actions of ResourceView keep the simple confirmation (not wired to the component).

Part B, B5.4. Portal roles

Item	Status	Proof	Remaining or blocker
ARCH-B5.4-01 Platform Administrator role	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-B5.4-02 Security Administrator role	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-B5.4-03 SOC Analyst role	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-B5.4-04 Compliance/Auditor role	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-B5.4-05 AI Platform Engineer role	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-B5.4-06 AI Developer role	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-B5.4-07 Data Steward role	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-B5.4-08 Business Owner role	PASSED	test_iam_role_matrix.py::test_business_owner_approves_use_case_and_soc_analyst_cannot test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-B5.4-09 FinOps Manager role	PASSED	test_iam_role_matrix.py::test_role_matrix (E-IR-IDENTITY)
ARCH-B5.4-10 Support Engineer role	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix (E-IR-IDENTITY)
ARCH-B5.4-11 Every endpoint checks OpenFGA and OPA independently of the interface	PASSED	test_iam_openfga_real.py::test_require_relation_on_tool_routes_with_real_openfga test_iam_fail_closed.py::test_opa_killed_refuses_the_tool_call_and_audits_it (E-IR-IDENTITY)

Part B, B6.1. Control Plane modules

Item	Status	Proof	Remaining or blocker
ARCH-B6.1-01 platform-core: tenants, projects, environments	PASSED	test_core_tenancy.py::test_tenant_admin_flow test_core_tenancy.py::test_projects_and_environments (E-RB-CP)
ARCH-B6.1-02 platform-manager: Manager operations API	PASSED	test_platform_core.py::test_operations_api_detail_logs_abort_retry_and_scope (E-RB-NM)
ARCH-B6.1-03 component-registry: acyclic dependency graph	PASSED	test_platform_components.py::test_dependency_graph_is_acyclic_and_resolvable (E-RB-CP)
ARCH-B6.1-04 configuration-manager: persisted and audited settings	PASSED	test_security_api.py::test_settings_get_put_persist_and_audit (E-RB-CP)
ARCH-B6.1-05 identity-broker: OIDC and API keys	PASSED	test_core_auth.py::test_oidc test_core_auth.py::test_api_key_lifecycle (E-RB-CP)
ARCH-B6.1-06 authorization-service	PASSED	test_core_secrets_authz.py::test_authz_tuples_and_check (E-RB-CP)
ARCH-B6.1-07 delegation-service	PASSED	test_identity_context_delegation.py::test_restricted_delegation_is_always_narrower_and_revocation_cascades (E-RB-CP)
ARCH-B6.1-08 context-authority: creation, verification, signature of SDK contexts	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_signing_key_is_read_from_the_openbao_reference_and_never_exposed (E-RB-CP)
ARCH-B6.1-09 agent-registry	PASSED	test_capabilities_gateways.py::test_manifest_apply_every_capability_kind (E-RB-CP)
ARCH-B6.1-10 application-registry	PASSED	test_applications_registry.py::test_application_lifecycle_and_external_agent (E-RB-CP)
ARCH-B6.1-11 model-registry	PASSED	test_llm_registry.py::test_model_registry_and_status (E-RB-CP)
ARCH-B6.1-12 model-gateway-manager: LiteLLM sync without secret	PASSED	test_llm_registry.py::test_litellm_sync_proxy test_llm_registry.py::test_litellm_config_contains_no_secret (E-RB-CP)
ARCH-B6.1-13 prompt-registry	PASSED	test_data_retention_lineage_prompts.py::test_prompt_registry_render (E-RB-CP)
ARCH-B6.1-14 skill-registry	PASSED	test_capabilities_gateways.py::test_skill_loader_refuses_tampered_unsigned_blocked (E-RB-CP)
ARCH-B6.1-15 mcp-registry	PASSED	test_approvals_promotion.py::test_skill_and_mcp_status_routes (E-RB-CP)
ARCH-B6.1-16 connector-registry	PASSED	test_capabilities_gateways.py::test_webhook_signature_replay_and_dedupe (E-RB-CP)
ARCH-B6.1-17 plugin-manager	PASSED	test_capabilities_gateways.py::test_plugin_install_lifecycle (E-RB-CP)
ARCH-B6.1-18 policy-manager: revisions, diff, simulation	PASSED	test_iam_policy_simulator.py::test_revisions_diff_and_simulation (E-RB-CP)
ARCH-B6.1-19 data-governance	PASSED	test_data_quality_governance.py::test_governance_registry test_data_privacy.py::test_classify_and_dlp_modes (E-RB-CP)
ARCH-B6.1-20 rag-manager: source permission checked before ingestion	PASSED	test_rag_governance.py::test_source_permission_checked_before_ingestion (E-RB-CP)
ARCH-B6.1-21 approval-manager	PASSED	test_approvals_promotion.py::test_promotion_waits_for_an_approval_from_someone_else (E-RB-CP)
ARCH-B6.1-22 finops-manager	PASSED	test_finops_quotas.py::test_reserve_commit_release_cycle (E-RB-CP)
ARCH-B6.1-23 evaluation-manager: A/B comparisons	PASSED	test_evaluation_ab.py::test_comparison_is_saved_with_baseline_metrics_and_verdict (E-RB-CP)
ARCH-B6.1-24 licensing-manager	PASSED	test_licensing.py::test_annual_and_triennial_licences_activate_online (E-RB-CP)
ARCH-B6.1-25 documentation-service: documented and implemented API surface	IN_PROGRESS	test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)	No online documentation service in the Control Plane; documentation ships as files (docs/, OpenAPI) checked by tests.

Part B, B6.2. Independent runtime and security services

Item	Status	Proof	Remaining or blocker
ARCH-B6.2-01 agent-execution-gateway: mandatory entry point of executions (third party agents included)	PASSED	test_applications_registry.py::test_external_agent_model_and_mcp_gateways test_identity_context_delegation.py::test_opa_decision_is_taken_before_each_action_with_the_original_user (E-RB-CP)
ARCH-B6.2-02 navin-runtime-service: heartbeat, suspend, kill	PASSED	test_agents_execution.py::test_kill_switch_blocks_new_runs (E-RB-CP)
ARCH-B6.2-03 secure-mcp-gateway	PASSED	test_capabilities_gateways.py::test_mcp_gateway test_gateway_pep_untrusted.py::test_untrusted_mcp_result (E-RB-CP)
ARCH-B6.2-04 data-protection-gateway: DLP masking	PASSED	test_capabilities_gateways.py::test_tool_invoke_dlp_credentials_usage test_llm_gateway.py::test_control_dlp (E-RB-CP)
ARCH-B6.2-05 audit-gateway: independent durable collection	PASSED	test_evidence_gateway.py::test_gateway_redelivers_after_target_outage_without_loss_or_duplicate test_evidence_gateway.py::test_gateway_detects_outbox_sequence_gap (E-RB-CP)
ARCH-B6.2-06 evidence-service	PASSED	test_evidence_gateway.py::test_seal_signature_verifies_online_and_offline test_evidence_gateway.py::test_monitor_detects_sql_tampering_of_a_sealed_event (E-RB-CP)
ARCH-B6.2-07 security-detection-engine	PASSED	test_soc_ai_sdr.py::test_risk_engine_rules_are_traced test_soc_ai_sdr.py::test_egress_denied_is_blocked_and_opens_an_incident (E-RB-CP)
ARCH-B6.2-08 incident-controller	PASSED	test_soc_ai_sdr.py::test_incident_lifecycle_assignment_and_auditable_timeline (E-RB-CP)
ARCH-B6.2-09 kill-switch-controller	PASSED	test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions (E-RB-CP)
ARCH-B6.2-10 containment-verifier: verified only on real proof	PASSED	test_soc_ai_sdr.py::test_verified_only_on_real_proof_and_drift_is_reapplied test_soc_ai_sdr.py::test_network_isolation_waits_for_a_signed_in_cluster_receipt (E-RB-CP)
ARCH-B6.2-11 storage-adapter-service	PASSED	test_storage_profiles_api.py::test_presigned_urls_need_a_verified_capability_and_respect_expiry_and_scope (E-RB-CP)
ARCH-B6.2-12 telemetry-ingestion-service	PASSED	test_data_quality_governance.py::test_telemetry_ingest_overview_trace (E-RB-CP)
ARCH-B6.2-13 Execution workers, telemetry ingestion and SOC scale separately	IN_PROGRESS	test_platform_deploy_env.py::test_helm_worker_deployment test_media_worker.py::test_helm_worker_kinds_are_media_worker_operations (E-RB-CP)	The worker and the multimodal workers (KEDA) have their own deployments and replicas; telemetry ingestion and the SOC have no separate deployment yet.

Part B, B6.3. Main API contracts and operation_id

Item	Status	Proof	Remaining or blocker
ARCH-B6.3-01 Contract POST /platform/installations served by POST /api/v1/clusters/{cluster_id}/services	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP, E-RB-NM)
ARCH-B6.3-02 Contract GET /components served by GET /api/v1/clusters/{cluster_id}/services	PASSED	test_services_operate.py::test_component_instances_change_peers test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP, E-RB-NM)
ARCH-B6.3-03 Contract POST /components/{id}/operations served by POST /api/v1/clusters/{cluster_id}/services/{service}/actions	PASSED	test_services_operate.py::test_actions_rolling_restart_and_permissions test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP, E-RB-NM)
ARCH-B6.3-04 Contract PUT /components/{id}/configuration served by PUT /api/v1/clusters/{cluster_id}/services/{service}/config	PASSED	test_services_config.py::test_versions_diff_restore_and_secrets test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP, E-RB-NM)
ARCH-B6.3-05 Contract POST /agents served by POST /v1/agents	PASSED	test_agents_execution.py::test_kill_switch_blocks_new_runs test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-06 Contract POST /executions served by POST /v1/agents/{agent_id}/runs	PASSED	test_agents_execution.py::test_run_lifecycle_contract_and_invalid_transition test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-07 Contract POST /delegations served by POST /v1/delegations	PASSED	test_identity_context_delegation.py::test_restricted_delegation_is_always_narrower_and_revocation_cascades test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-08 Contract POST /authorization/check served by POST /v1/authz/check	PASSED	test_core_secrets_authz.py::test_authz_tuples_and_check test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-09 Contract POST /policies/validate served by POST /v1/policies/simulate	PASSED	test_iam_policy_simulator.py::test_revisions_diff_and_simulation test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-10 Contract POST /prompts served by POST /v1/prompts	PASSED	test_data_retention_lineage_prompts.py::test_prompt_registry_render test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-11 Contract POST /skills served by POST /v1/skills	PASSED	test_capabilities_gateways.py::test_skill_loader_refuses_tampered_unsigned_blocked test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-12 Contract POST /mcp-servers served by POST /v1/mcp/servers	PASSED	test_capabilities_gateways.py::test_mcp_gateway test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-13 Contract POST /plugins/installations served by POST /v1/marketplace/installations	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-14 Contract POST /models served by POST /v1/models	PASSED	test_llm_registry.py::test_model_registry_and_status test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-15 Contract POST /evaluations/runs served by POST /v1/evaluations/runs	PASSED	test_data_evaluation.py::test_evaluation_gate_pass_and_fail test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-16 Contract GET /audit/events served by GET /v1/audit/events	PASSED	test_data_quality_governance.py::test_audit_events_verify_export_correlations test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-17 Contract POST /incidents served by POST /v1/incidents	PASSED	test_data_quality_governance.py::test_incident_actions test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-18 Contract POST /security/containments served by POST /v1/soc/orders	PASSED	test_soc_ai_sdr.py::test_soc_roles_access_audit_and_sealed_chain_of_custody test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-19 Contract POST /security/recoveries served by POST /v1/soc/recoveries	PASSED	test_soc_ai_sdr.py::test_recovery_needs_four_eyes_then_reauthorization test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-20 Contract POST /license/activate served by POST /v1/license/activations	PASSED	test_licensing.py::test_annual_and_triennial_licences_activate_online test_architecture_contracts_map.py::test_every_mapped_route_exists_in_the_committed_openapi (E-RB-CP)
ARCH-B6.3-21 Every long operation returns an operation_id to follow progress, fetch the result and avoid duplicates	IN_PROGRESS	test_platform_core.py::test_operations_api_detail_logs_abort_retry_and_scope test_services_install.py::test_provider_and_consumer_install_end_to_end test_agents_execution.py::test_run_lifecycle_contract_and_invalid_transition (E-RB-CP, E-RB-NM)	The Manager returns an operation_id for every long operation; the Control Plane returns the id of the tracked resource and accepts Idempotency-Key only on runs and approvals: a common operation_id and deduplication on every long creation remain to be done.

Part B, B7.1. SQL split by domain

Item	Status	Proof	Remaining or blocker
ARCH-B7.1-01 Schema core	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-02 Schema platform	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-03 Schema iam	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-04 Schema governance	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-05 Schema ai	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-06 Schema models	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-07 Schema developer	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-08 Schema marketplace	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-09 Schema data	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-10 Schema privacy	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-11 Schema observability	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-12 Schema audit	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-13 Schema security	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-14 Schema finops	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-15 Schema licensing	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-16 Schema operations	PASSED	test_data_model_mapping.py::test_reference_schemas_cover_the_sixteen_schemas test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-17 Large content in client object storage, metadata, digests and ACL in PostgreSQL	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls (E-DP-DATAMODEL)
ARCH-B7.1-18 OpenTelemetry traces not copied into PostgreSQL	IN_PROGRESS	test_data_model_mapping.py::test_column_backed_concepts_exist (E-DP-DATAMODEL)	eai.telemetry_spans still stores summarised spans: to be replaced by references (trace_id) or justified by an ADR.

Part B, B7.2. Common fields of business tables

Item	Status	Proof	Remaining or blocker
ARCH-B7.2-01 Common field id	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-02 Common field tenant_id	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-03 Common field environment_id	IN_PROGRESS	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)	No table carries environment_id: the environment is a text column (marketplace_installations.environment, usage_events.environment). Normalisation to be decided.
ARCH-B7.2-04 Common field created_at	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-05 Common field updated_at	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-06 Common field created_by	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-07 Common field updated_by	IN_PROGRESS	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)	Carried only by eai.llm_model_rollouts; not generalised to business tables, no JSON Schema validation in the database for metadata.
ARCH-B7.2-08 Common field version	IN_PROGRESS	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)	Carried only by eai.storage_profiles, eai.memory_items, eai.llm_models; not generalised to business tables, no JSON Schema validation in the database for metadata.
ARCH-B7.2-09 Common field status	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-10 Common field metadata	IN_PROGRESS	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)	Carried only by eai.sessions, eai.kb_documents, eai.connector_credentials; not generalised to business tables, no JSON Schema validation in the database for metadata.
ARCH-B7.2-11 Common field classification	PASSED	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)
ARCH-B7.2-12 Common field correlation_id	IN_PROGRESS	test_data_model_mapping.py::test_common_fields_are_carried_where_declared (E-DP-DATAMODEL)	Carried only by eai.audit_events, eai.usage_events, eai.telemetry_spans (named trace_id); not generalised to business tables, no JSON Schema validation in the database for metadata.
ARCH-B7.2-13 Adapted schemas for global, association and immutable tables	PASSED	test_data_model_mapping.py::test_every_mapped_eai_table_exists_with_columns_and_rls test_core_rls.py::test_audit_is_append_only_for_app_role (E-DP-DATAMODEL)

Part B, B7.3. Isolation by RLS and SQL roles

Item	Status	Proof	Remaining or blocker
ARCH-B7.3-01 Tenant set from the verified identity with SET LOCAL in the transaction	PASSED	test_core_rls.py::test_raw_sql_inside_tx_is_isolated test_core_rls.py::test_tenant_scope_without_principal_and_role_reset_after_tx (E-DP-DATAMODEL)
ARCH-B7.3-02 Non privileged SQL role	PASSED	test_data_model_mapping.py::test_runtime_role_cannot_bypass_rls test_core_rls.py::test_unscoped_app_role_sees_nothing (E-DP-DATAMODEL)
ARCH-B7.3-03 Administrator and runtime connections separated	IN_PROGRESS	test_core_rls.py::test_tenant_scope_without_principal_and_role_reset_after_tx test_core_rls_forced.py::test_migrations_run_in_the_platform_context (E-DP-DATAMODEL)	A single login (EAI_DATABASE_URL): separation relies on SET LOCAL ROLE eai_app per transaction; a second runtime login without migration rights is still to be introduced.
ARCH-B7.3-04 Table owner and BYPASSRLS roles handled	PASSED	test_core_rls_forced.py::test_force_binds_the_table_owner test_core_rls_forced.py::test_every_tenant_table_has_forced_row_level_security test_data_model_mapping.py::test_runtime_role_cannot_bypass_rls (E-DP-DATAMODEL)
ARCH-B7.3-05 Tests proving a query cannot cross the tenant boundary	PASSED	test_core_rls.py::test_raw_sql_inside_tx_is_isolated test_core_rls.py::test_cannot_insert_into_other_tenant test_core_rls.py::test_api_isolation +1 (E-DP-DATAMODEL)

Part B, B7.4. Marketplace SQL model

Item	Status	Proof	Remaining or blocker
ARCH-B7.4-01 packages table (namespace, name, category, publisher, status)	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)	eai.marketplace_packages holds name, domain (category), owner (publisher) but no namespace and no package status column.
ARCH-B7.4-02 package_versions table (manifest, artifact, digest, signature, security status, date)	PASSED	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_production_publication_needs_gates_and_four_eyes (E-MK-MARKETPLACE)
ARCH-B7.4-03 Installations per tenant and environment (configuration, status, installed_by)	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_other_tenant_reaches_no_marketplace_resource (E-MK-MARKETPLACE)
ARCH-B7.4-04 Relations with approvals, dependencies, roles, secrets, history and rollback	PASSED	test_marketplace.py::test_upgrade_rollback_and_uninstall test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)
ARCH-B7.4-05 Versioned SQL migrations tested automatically	PASSED	test_core_migrations.py::test_all_migrations_applied test_core_migrations.py::test_new_migration_applied_in_order (E-MK-MARKETPLACE)

Part B, B8.1. Content of a business plugin

Item	Status	Proof	Remaining or blocker
ARCH-B8.1-01 Plugin holding agents: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-02 Plugin holding subagents: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-03 Plugin holding skills: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-04 Plugin holding prompts: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-05 Plugin holding rules: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The rules are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-06 Plugin holding OPA policies: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-07 Plugin holding OpenFGA relations: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The OpenFGA relations are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-08 Plugin holding MCP servers: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The MCP servers are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-09 Plugin holding MCP tools: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-10 Plugin holding connectors: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-11 Plugin holding workflows: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The workflows are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-12 Plugin holding RAG templates: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The RAG templates are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-13 Plugin holding evaluations: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-14 Plugin holding security tests: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-15 Plugin holding dashboards: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	kit element set aside by ADR-0169 (packs without dashboards)
ARCH-B8.1-16 Plugin holding alerts: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The alerts are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.
ARCH-B8.1-17 Plugin holding documentation: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-18 Plugin holding tests: validated, installed, activated	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.1-19 Plugin holding migrations: validated, installed, activated	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	The migrations are validated at publication (mandatory folder, tests/observability gates) but installer.py neither creates nor activates them in a registry.

Part B, B8.2. Standard folder structure of a plugin

Item	Status	Proof	Remaining or blocker
ARCH-B8.2-01 Official folder structure enforced by the validator	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.2-02 Mandatory files plugin.yaml, README.md, LICENSE, CHANGELOG.md	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing (E-MK-MARKETPLACE)
ARCH-B8.2-03 Unused folders may be omitted	PASSED	test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)

Part B, B8.3. Plugin manifest

Item	Status	Proof	Remaining or blocker
ARCH-B8.3-01 Metadata (namespace, name, version, category, publisher, displayName)	IN_PROGRESS	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing (E-MK-MARKETPLACE)	The schema holds name, version, owner, domain; namespace, category, publisher and displayName are not schema fields.
ARCH-B8.3-02 Platform and SDK compatibility ranges	PASSED	test_marketplace.py::test_version_ranges test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)
ARCH-B8.3-03 Declared contents	PASSED	test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.3-04 requestedPermissions data, tools, actions	PASSED	test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions test_marketplace.py::test_signed_pack_with_unsafe_permission_is_refused (E-MK-MARKETPLACE)
ARCH-B8.3-05 dataProtection (PII detection, masking, external export denied by default)	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)	dataProtection is accepted by the schema but piiDetectionRequired, maskingPolicy, externalExportDefault are neither required nor applied at install.
ARCH-B8.3-06 approvals requiredFor	IN_PROGRESS	test_marketplace.py::test_production_promotion_then_prod_install test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions (E-MK-MARKETPLACE)	Approvals are expressed as approvals.install/sensitive/production (quorum), not as a requiredFor list.
ARCH-B8.3-07 security (signed artifact, sandbox, dynamic authorization, audit)	IN_PROGRESS	test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	Signature enforced and dynamic authorization via /authorize; the sandboxRequired and auditRequired flags do not exist in the pack manifest.
ARCH-B8.3-08 Configuration schema	IN_PROGRESS	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	Configuration is free form (config); no configuration schema declared in the manifest is validated.
ARCH-B8.3-09 Tests flags (SDK conformance, authorization, security)	IN_PROGRESS	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities (E-MK-MARKETPLACE)	Unit, integration, authz, security tests required by the tests gate; no sdkConformance flag.
ARCH-B8.3-10 Documentation entrypoint	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing (E-MK-MARKETPLACE)
ARCH-B8.3-11 Permissions requested not granted: approval then only approved ones applied	PASSED	test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)

Part B, B8.4. Marketplace end to end

Item	Status	Proof	Remaining or blocker
ARCH-B8.4-01 Signed, versioned publication	PASSED	test_marketplace.py::test_publication_succeeds_with_every_gate test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused (E-MK-MARKETPLACE)
ARCH-B8.4-02 Analysis (manifest, SBOM, dependencies, security)	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities (E-MK-MARKETPLACE)
ARCH-B8.4-03 Evaluation (functional and security tests)	PASSED	test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities (E-MK-MARKETPLACE)
ARCH-B8.4-04 Approval of capabilities and permissions	PASSED	test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)
ARCH-B8.4-05 Installation in a precise tenant and environment	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_other_tenant_reaches_no_marketplace_resource (E-MK-MARKETPLACE)
ARCH-B8.4-06 Configuration (connectors, secrets, data sources, models)	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-MK-MARKETPLACE)
ARCH-B8.4-07 Verification (real connection and access tests)	IN_PROGRESS	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	Smoke tests check registration, scopes and skill loading; no real connector connection test.
ARCH-B8.4-08 Activation of approved agents, skills, tools and workflows	IN_PROGRESS	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-MK-MARKETPLACE)	Agents, skills and tools activated by grant; workflows are not installed.
ARCH-B8.4-09 Supervision (activity, quality, costs, incidents)	IN_PROGRESS	test_marketplace.py::test_upgrade_rollback_and_uninstall (E-MK-MARKETPLACE)	marketplace_events history and audit; no per plugin aggregated view of quality, costs and incidents.
ARCH-B8.4-10 Update (compatibility check, new approval)	PASSED	test_marketplace.py::test_upgrade_rollback_and_uninstall (E-MK-MARKETPLACE)
ARCH-B8.4-11 Suspension of the plugin or of capabilities	IN_PROGRESS	test_marketplace.py::test_upgrade_rollback_and_uninstall (E-MK-MARKETPLACE)	No suspended state in marketplace_installations and no suspension route; only uninstall or publisher revocation exists.
ARCH-B8.4-12 Uninstall preserving evidence and data	PASSED	test_marketplace.py::test_upgrade_rollback_and_uninstall (E-MK-MARKETPLACE)

Part B, B8.5. Plugin distribution format

Item	Status	Proof	Remaining or blocker
ARCH-B8.5-01 OCI artifacts in Harbor with ORAS	BLOCKED	test_marketplace.py::test_production_promotion_then_prod_install (E-MK-MARKETPLACE)	No real Harbor; proven with ORAS to a local zot registry [B-DOCKER]
ARCH-B8.5-02 SemVer	PASSED	test_marketplace.py::test_version_ranges (E-MK-MARKETPLACE)
ARCH-B8.5-03 Cosign signature	PASSED	test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.5-04 SBOM	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B8.5-05 Trivy scan	PASSED	test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities (E-MK-MARKETPLACE)
ARCH-B8.5-06 Provenance and licence control	IN_PROGRESS	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing (E-MK-MARKETPLACE)	Licence gate present; no provenance attestation (SLSA) is required.
ARCH-B8.5-07 Immutable digest referenced by the marketplace	PASSED	test_marketplace.py::test_production_publication_needs_gates_and_four_eyes test_marketplace.py::test_production_promotion_then_prod_install (E-MK-MARKETPLACE)
ARCH-B8.5-08 Local repository for air-gapped clients	IN_PROGRESS	test_marketplace.py::test_production_promotion_then_prod_install (E-MK-MARKETPLACE)	Local zot registry used in tests; no documented offline import of packs into the marketplace.
ARCH-B8.5-09 Signature and digest verified before every install	PASSED	test_marketplace.py::test_revoked_publisher_blocks_install_and_production test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused (E-MK-MARKETPLACE)

Part B, B8.6. Business packs shipped with the platform

Item	Status	Proof	Remaining or blocker
ARCH-B8.6-01 HR: recruitment, onboarding, leave, HR document analysis; HRIS, Workday, SuccessFactors, Odoo	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-02 Finance: analysis, reporting, reconciliation, accounts payable; ERP, SAP, Odoo, SQL	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-03 Banking: KYC, compliance, client documents, adviser assistance; core banking, CRM, document management, KYC tools	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-04 Risk & Compliance: controls, anomalies, audit preparation, regulations; GRC, SIEM, document management, referentials	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-05 Legal: contract search, clause analysis, files; document management, DMS, SharePoint	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-06 IT Operations: diagnostics, incidents, documentation, assistance; Jira, GitLab, Kubernetes, observability	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-07 Cybersecurity: alert analysis, investigation, vulnerability reports; SIEM, Wazuh API, scanners, CMDB (API integration, no GPL component shipped)	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-08 Sales/CRM: prospecting, qualification, follow up; Salesforce, HubSpot, Dynamics	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-09 Marketing: content, campaigns, reporting, studies; CMS, analytics, social networks	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-10 Procurement: offer analysis, suppliers, contracts; ERP, procurement, document management	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-11 Customer Support: FAQ, RAG, assistance, ticket qualification; Zendesk, ServiceNow, CRM	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-12 Document Intelligence: OCR, extraction, classification, validation; storage, document management, email, API	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked (E-BP-PACK-SOURCES, E-BP-PACKS-MARKETPLACE)
ARCH-B8.6-13 Every pack configurable, no real credential, sensitive connectors and actions disabled until their security is validated	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_business_packs.py::test_pack_signed_published_installed_sensitive_actions_blocked test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions +1 (E-BP-PACKS-MARKETPLACE)

Part B, B9.1. SDK package structure

Item	Status	Proof	Remaining or blocker
ARCH-B9.1-01 Shared contracts used by every SDK	PASSED	test_api_conformance.py::test_every_sdk_method_matches_the_api test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.1-02 Python modules and TypeScript, Go and Java equivalents	PASSED	test_api_conformance.py::test_every_sdk_method_matches_the_api test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.1-03 CLI, conformance tests, examples and docs	PASSED	test_api_conformance.py::test_every_sdk_method_matches_the_api test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)

Part B, B9.2. Mandatory SDK contracts

Item	Status	Proof	Remaining or blocker
ARCH-B9.2-01 Contract execution-context	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-02 Contract action-context	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-03 Contract delegation-context	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-04 Contract policy-decision	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-05 Contract tool-invocation	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-06 Contract llm-invocation	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-07 Contract data-access-context	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-08 Contract approval-request	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-09 Contract audit-event	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-10 Contract security-incident	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-11 Contract containment-order	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-12 Contract plugin-manifest	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-13 Contract storage-profile	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)
ARCH-B9.2-14 Contract license-entitlement	PASSED	test_governance_clients.py::test_embedded_contracts_match_the_repository (E-DF-SDK-PY)

Part B, B9.3. Exposed SDK methods

Item	Status	Proof	Remaining or blocker
ARCH-B9.3-01 identity interface	PASSED	test_api_conformance.py::test_every_sdk_method_matches_the_api test_sdk_interfaces.py::test_assume_service_cancel_record_and_storage_objects_confirm_their_result test_sdk_interfaces.py::test_assume_service_cancel_record_and_delete_propagate_every_refusal +7 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES, E-SC-B93-SERVER)
ARCH-B9.3-02 delegation interface	PASSED	test_sdk_interfaces.py::test_delegation_subagent_tools_and_mcp interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-03 authz interface	PASSED	test_sdk_interfaces.py::test_authz_check_batch_and_explain interfaces.test.ts::checkBatch and explain report the confirmed decisions interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-04 agent interface	PASSED	test_api_conformance.py::test_every_sdk_method_matches_the_api conformance.test.ts interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-05 subagent interface	PASSED	test_sdk_interfaces.py::test_delegation_subagent_tools_and_mcp interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-06 tools interface	PASSED	test_sdk_interfaces.py::test_delegation_subagent_tools_and_mcp interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-07 mcp interface	PASSED	test_sdk_interfaces.py::test_delegation_subagent_tools_and_mcp interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-08 llm interface	PASSED	test_sdk_interfaces.py::test_llm_rag_privacy_interfaces interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-09 rag interface	PASSED	test_sdk_interfaces.py::test_llm_rag_privacy_interfaces interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-10 privacy interface	PASSED	test_sdk_interfaces.py::test_llm_rag_privacy_interfaces interfaces.test.ts::delegation, subagent, tools, mcp, llm, rag and privacy interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-11 approval interface	PASSED	test_sdk_interfaces.py::test_approval_audit_trace_finops_security test_sdk_interfaces.py::test_assume_service_cancel_record_and_storage_objects_confirm_their_result test_sdk_interfaces.py::test_assume_service_cancel_record_and_delete_propagate_every_refusal +7 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES, E-SC-B93-SERVER)
ARCH-B9.3-12 audit interface	PASSED	test_sdk_interfaces.py::test_approval_audit_trace_finops_security test_sdk_interfaces.py::test_assume_service_cancel_record_and_storage_objects_confirm_their_result test_sdk_interfaces.py::test_assume_service_cancel_record_and_delete_propagate_every_refusal +5 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES, E-SC-B93-SERVER)
ARCH-B9.3-13 trace interface	PASSED	test_sdk_interfaces.py::test_approval_audit_trace_finops_security interfaces.test.ts::approval, audit, trace, finops, security and storage interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-14 finops interface	PASSED	test_sdk_interfaces.py::test_approval_audit_trace_finops_security interfaces.test.ts::approval, audit, trace, finops, security and storage interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-15 security interface	PASSED	test_sdk_interfaces.py::test_approval_audit_trace_finops_security interfaces.test.ts::approval, audit, trace, finops, security and storage interfaces_b93_test.go::TestB93MethodRoutes +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)
ARCH-B9.3-16 storage interface	PASSED	test_sdk_interfaces.py::test_storage_put_and_get_go_through_a_presigned_grant test_sdk_interfaces.py::test_assume_service_cancel_record_and_storage_objects_confirm_their_result test_sdk_interfaces.py::test_assume_service_cancel_record_and_delete_propagate_every_refusal +7 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES, E-SC-B93-SERVER)
ARCH-B9.3-17 Rule: no assumed OPA or OpenFGA decision	PASSED	test_sdk_interfaces.py::test_authz_errors_propagate_and_no_allow_is_assumed interfaces.test.ts::authz errors propagate and no allow is assumed interfaces_b93_test.go::TestB93NoAssumedAllow +1 (E-SC-PY-INTERFACES, E-SC-TS-INTERFACES, E-SC-GO-INTERFACES, E-SC-JAVA-INTERFACES)

Part B, B9.4. SDK that cannot be bypassed

Item	Status	Proof	Remaining or blocker
ARCH-B9.4-01 Identity and delegation validated by the gateway (signed context, audience, issuer, expiry)	PASSED	test_identity_context_delegation.py::test_tampered_wrong_audience_wrong_issuer_expired_and_foreign_tenant_are_refused (E-RB-CP)
ARCH-B9.4-02 OpenFGA and OPA rechecked by the gateway before each action	PASSED	test_identity_context_delegation.py::test_opa_decision_is_taken_before_each_action_with_the_original_user test_identity_context_delegation.py::test_policy_change_while_the_agent_runs_refuses_the_next_action (E-RB-CP)
ARCH-B9.4-03 LLM egress only through LiteLLM	PASSED	test_platform_security_manifests.py::test_vllm_reachable_only_from_litellm_and_control_plane test_llm_isolation.py::test_egress_barrier_denies_external_hosts_of_an_isolated_model (E-RB-CP)
ARCH-B9.4-04 MCP only through the Secure MCP Gateway	PASSED	test_gateway_pep_untrusted.py::test_pep_mcp_denied test_applications_registry.py::test_external_agent_model_and_mcp_gateways (E-RB-CP)
ARCH-B9.4-05 RAG through the data gateway and the storage ACL	PASSED	test_rag_governance.py::test_chunk_acl_forbidden_fragments_never_reach_the_context test_rag_governance.py::test_document_acl_and_other_tenant_refused (E-RB-CP)
ARCH-B9.4-06 Masking by the Data Protection Gateway	PASSED	test_capabilities_gateways.py::test_tool_invoke_dlp_credentials_usage test_llm_gateway.py::test_control_dlp (E-RB-CP)
ARCH-B9.4-07 Audit by the Audit Gateway with independent evidence	PASSED	test_evidence_gateway.py::test_seal_signature_verifies_online_and_offline test_evidence_gateway.py::test_forged_seal_signature_is_rejected (E-RB-CP)
ARCH-B9.4-08 Kill Switch enforced by admission, network and runtime	BLOCKED	test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions test_soc_ai_sdr.py::test_network_isolation_waits_for_a_signed_in_cluster_receipt test_platform_security_manifests.py::test_static_cluster_policies (E-RB-CP)	Runtime and signed network receipts proven here; the real enforcement by Kyverno admission and Cilium on a cluster needs a cluster [B-CLUSTER].
ARCH-B9.4-09 External agents without the SDK: gateways and secure connectors, network isolation, limited permissions	PASSED	test_applications_registry.py::test_external_agent_model_and_mcp_gateways test_applications_registry.py::test_guard_direct (E-RB-CP)
ARCH-B9.4-10 A third party agent with direct privileged database access is prevented by the database roles and network policies	PASSED	test_core_rls.py::test_unscoped_app_role_sees_nothing test_core_audit.py::test_app_role_cannot_rewrite test_platform_security_manifests.py::test_postgres_cluster_hardening +1 (E-RB-CP)

Part B, B10.1. Official CLI

Item	Status	Proof	Remaining or blocker
ARCH-B10.1-01 CLI command login --profile	PASSED	test_cli.py::test_login_dev_and_config_profiles test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-02 CLI command create agent --template secure-agent	PASSED	test_cli.py::test_reference_commands_of_the_architecture test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-03 CLI command create plugin --template enterprise-plugin	PASSED	test_cli_developer.py::test_create_plugin_with_the_enterprise_plugin_template (E-DX-CLI)
ARCH-B10.1-04 CLI command create mcp --template secure-mcp	PASSED	test_cli.py::test_reference_commands_of_the_architecture test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-05 CLI command create skill	PASSED	test_cli_developer.py::test_create_skill_and_prompt test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-06 CLI command create prompt	PASSED	test_cli_developer.py::test_create_skill_and_prompt test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-07 CLI command validate	PASSED	test_cli.py::test_validate_invalid_file_exits_1 test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-08 CLI command test	PASSED	test_cli_developer.py::test_test_without_scope_keeps_evaluation_behaviour test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-09 CLI command test security	PASSED	test_cli_developer.py::test_security_threshold_sets_exit_code test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-10 CLI command test authorization (authz)	PASSED	test_cli_developer.py::test_authz_failing_policy_and_empty_project test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-11 CLI command test sdk-conformance	PASSED	test_cli_developer.py::test_sdk_conformance test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-12 CLI command plugin build	PASSED	test_cli_developer.py::test_create_plugin_with_the_enterprise_plugin_template test_packs.py::test_cli_create_validate_build (E-DX-CLI)
ARCH-B10.1-13 CLI command plugin sign	PASSED	test_packs.py::test_cli_sign_and_publish_body_with_oci test_packs.py::test_sign_and_verify_with_cosign test_cli_developer.py::test_create_plugin_with_the_enterprise_plugin_template (E-DX-CLI)
ARCH-B10.1-14 CLI command plugin publish --registry	PASSED	test_cli.py::test_reference_commands_of_the_architecture test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-15 CLI command deploy --environment	PASSED	test_cli.py::test_reference_commands_of_the_architecture test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-16 CLI command runs list	PASSED	test_cli.py::test_runs_logs_chat_models_finops_quotas_audit test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-17 CLI command agent inspect	PASSED	test_cli.py::test_reference_commands_of_the_architecture test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)
ARCH-B10.1-18 CLI command doctor	PASSED	test_cli_developer.py::test_doctor_checks test_cli_developer.py::test_cli_reference_is_up_to_date (E-DX-CLI)

Part B, B10.2. Mandatory rules for developers

Item	Status	Proof	Remaining or blocker
ARCH-B10.2-01 Never forge, modify or replace the user identity	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_security_auth.py::test_claims_enforced test_identity_context_delegation.py::test_run_carries_original_user_and_subagent_never_gets_wider_rights (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-02 Controlled time limited delegation	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_identity_context_delegation.py::test_restricted_delegation_is_always_narrower_and_revocation_cascades test_identity_context_delegation.py::test_scheduled_run_needs_an_approved_mandate_bound_to_a_service_identity (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-03 Check rights on every sensitive access	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_core_secrets_authz.py::test_authz_tuples_and_check test_identity_context_delegation.py::test_revocation_during_a_run_blocks_the_next_sensitive_action (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-04 Call only authorised models through LiteLLM	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_llm_gateway.py::test_control_model_allowlist_and_status test_gateway_pep_untrusted.py::test_pep_model_gateway_denied (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-05 Use the Secure MCP Gateway	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_capabilities_gateways.py::test_mcp_gateway test_integration_usage.py::test_mcp_gateway_dlp_on_arguments_and_results (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-06 Apply document ACL before retrieval and generation	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_rag_governance.py::test_chunk_acl_forbidden_fragments_never_reach_the_context test_rag_governance.py::test_document_acl_and_other_tenant_refused (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-07 Protect PII before any non approved destination	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_llm_gateway.py::test_control_dlp test_quotas_dlp_realtime.py::test_adapter_file_dlp_blocks_before_call (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-08 No secret in code, prompt, log or repository	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_llm_registry.py::test_litellm_config_contains_no_secret test_evidence_config_redaction.py::test_secrets_and_pii_never_reach_logs (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-09 No sensitive data in clear in logs without an approved exception	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_evidence_config_redaction.py::test_secrets_and_pii_never_reach_logs test_llm_gateway.py::test_control_audit_hashes_only (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-10 Mandatory audit of decisions, actions and results	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_audit_mutation_coverage.py::test_every_mutation_route_audits test_iam_fail_closed.py::test_audit_store_unavailable_blocks_sensitive_mutations (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-11 Registered versioned prompts	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_data_retention_lineage_prompts.py::test_prompt_registry_render (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-12 Skills checked for signature, permissions and version	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_capabilities_gateways.py::test_skill_loader_refuses_tampered_unsigned_blocked (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-13 Only approved packages	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-14 Subagents never receive more rights than received	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_identity_context_delegation.py::test_run_carries_original_user_and_subagent_never_gets_wider_rights test_security_privilege.py::test_narrow_key_cannot_mint_broader_scopes (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-15 Actions suspended until the required approval	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_platform_opa.py::test_tool_invocation_approval_obligation test_approvals_promotion.py::test_promotion_waits_for_an_approval_from_someone_else (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-16 Budgets respected	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_integration_llm_finops.py::test_quota_exceeded_is_429_before_any_provider_call test_agents_execution.py::test_subagent_depth_count_and_budget_inheritance (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-17 Unauthorised network destinations forbidden	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_soc_ai_sdr.py::test_egress_denied_is_blocked_and_opens_an_incident test_llm_isolation.py::test_egress_barrier_denies_external_hosts_of_an_isolated_model (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-18 Risky code in a sandbox	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_runtime_gvisor_sandbox.py::test_untrusted_code_refused_when_sandbox_unavailable test_agents_execution.py::test_sandbox_execution_spec (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-19 Kill Switch orders obeyed immediately	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_agents_execution.py::test_kill_switch_blocks_new_runs test_llm_gateway.py::test_control_kill_switch (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-20 Never hide or delete a raised alert	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_observability_signals.py::test_alert_receiver_creates_dedups_and_resolves test_core_rls.py::test_audit_is_append_only_for_app_role (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-21 Security and conformance tests passed before publication	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_packs.py::test_cli_publish_refuses_an_unsigned_build (E-DX-CLI, E-DX-RULES)
ARCH-B10.2-22 Versioned rules package separating documentary rules from enforced controls	PASSED	test_cli_developer.py::test_rules_package_maps_every_rule_to_an_existing_control_and_test test_cli_developer.py::test_rules_package_is_copied_by_every_project_template test_cli_developer.py::test_create_plugin_with_the_enterprise_plugin_template (E-DX-CLI)

Part B, B10.3. Publication gates

Item	Status	Proof	Remaining or blocker
ARCH-B10.3-01 G1 Schema	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing (E-MK-MARKETPLACE)
ARCH-B10.3-02 G2 Dependencies (approved, licences, SBOM)	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)
ARCH-B10.3-03 G3 Security (Trivy, signatures, secrets)	PASSED	test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused (E-MK-MARKETPLACE)
ARCH-B10.3-04 G4 Authorization (RBAC, ABAC, OpenFGA, OPA tests)	PASSED	test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_signed_pack_with_unsafe_permission_is_refused (E-MK-MARKETPLACE)
ARCH-B10.3-05 G5 Tenant isolation	PASSED	test_marketplace.py::test_other_tenant_reaches_no_marketplace_resource (E-MK-MARKETPLACE)
ARCH-B10.3-06 G6 Privacy (PII, masking, DLP, logs, destinations)	IN_PROGRESS	test_marketplace.py::test_publication_succeeds_with_every_gate (E-MK-MARKETPLACE)	No dedicated PII/DLP gate at publication; dataProtection is not evaluated.
ARCH-B10.3-07 G7 Tool safety (MCP tools, side effects)	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-MK-MARKETPLACE)
ARCH-B10.3-08 G8 Quality (Promptfoo and Ragas thresholds)	PASSED	test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities (E-MK-MARKETPLACE)
ARCH-B10.3-09 G9 Resilience (timeouts, retries, idempotence, cancellation)	IN_PROGRESS	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-MK-MARKETPLACE)	Idempotence proven (payment exactly once); no timeouts/retries/cancellation gate.
ARCH-B10.3-10 G10 Audit	PASSED	test_marketplace.py::test_hr_pack_end_to_end_with_granted_permissions_only test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions (E-MK-MARKETPLACE)
ARCH-B10.3-11 G11 Kill Switch (suspension, no bypass)	IN_PROGRESS	test_marketplace.py::test_revoked_publisher_blocks_install_and_production (E-MK-MARKETPLACE)	Publisher revocation blocks install and production; no dedicated per pack Kill Switch gate.
ARCH-B10.3-12 G12 Approval (owner and security, production refused without it)	PASSED	test_marketplace.py::test_production_publication_needs_gates_and_four_eyes test_marketplace.py::test_production_promotion_then_prod_install test_approvals_promotion.py::test_promotion_waits_for_an_approval_from_someone_else (E-MK-MARKETPLACE)
ARCH-B10.3-13 OPA policies distributed as signed bundles without restart	PASSED	test_iam_opa_bundles_real.py::test_signed_bundle_revisions_loaded_and_enforced test_iam_opa_bundles_real.py::test_bundle_signed_with_another_key_is_refused_by_opa (E-MK-MARKETPLACE)
ARCH-B10.3-14 Bundle load status verified	PASSED	test_iam_opa_bundles_real.py::test_signed_bundle_revisions_loaded_and_enforced (E-MK-MARKETPLACE)

Part B, B10.4. Change management

Item	Status	Proof	Remaining or blocker
ARCH-B10.4-01 Pipeline Draft, Test, Security Review, Business Approval, Staging, Production, Monitoring	IN_PROGRESS	test_approvals_promotion.py::test_failing_blocking_suite_prevents_the_promotion test_approvals_promotion.py::test_promotion_waits_for_an_approval_from_someone_else test_marketplace.py::test_production_promotion_then_prod_install (E-MK-MARKETPLACE)	Promotion with blocking suite, third party approval and dev/test/staging/prod environments; no single state machine naming the seven stages.
ARCH-B10.4-02 Changes to prompts, skills, connectors, rules, models treated as application changes	IN_PROGRESS	test_approvals_promotion.py::test_skill_cannot_be_approved_outside_a_promotion test_approvals_promotion.py::test_failing_blocking_suite_prevents_the_promotion (E-MK-MARKETPLACE)	Skills go through promotion; prompts versioned; connectors, rules and models not covered by the same promotion.
ARCH-B10.4-03 Critical change: new evaluation and security approval by impact	PASSED	test_approvals_promotion.py::test_failing_blocking_suite_prevents_the_promotion test_marketplace.py::test_upgrade_rollback_and_uninstall test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions (E-MK-MARKETPLACE)

Part B, B11.1. Product documentation

Item	Status	Proof	Remaining or blocker
ARCH-B11.1-01 Product Overview	IN_PROGRESS	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide (E-DO-DOCS, E-DO-AIRGAP)	The offline bundle (tools/release/build.py, docs-offline) ships only docs/operations and docs/release: this guide outside these folders is not shipped yet (bundle owned by C02).
ARCH-B11.1-02 Architecture Guide (control, data and security planes and flows)	IN_PROGRESS	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist (E-DO-DOCS, E-DO-AIRGAP)	The offline bundle (tools/release/build.py, docs-offline) ships only docs/operations and docs/release: this guide outside these folders is not shipped yet (bundle owned by C02).
ARCH-B11.1-03 Deployment Guide (Kubernetes install, prerequisites, profiles)	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +1 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-04 Administrator Guide	IN_PROGRESS	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide (E-DO-DOCS, E-DO-AIRGAP)	No single administrator guide: the content is spread over the Manager docs (operations.md) and docs/operations/configuration.md; a consolidated FR and EN administrator guide remains to be written.
ARCH-B11.1-05 Security Hardening Guide (TLS, mTLS, RBAC, OPA, OpenFGA, secrets, network)	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +1 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-06 Operations Runbook (start, stop, restart, upgrade, diagnostics)	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +1 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-07 Backup & Recovery Guide (backups, restore, RTO, RPO)	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +1 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-08 Monitoring Guide	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +1 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-09 Incident Response Guide (SOC, playbooks, Kill Switch, recovery)	IN_PROGRESS	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist (E-DO-DOCS, E-DO-AIRGAP)	The offline bundle (tools/release/build.py, docs-offline) ships only docs/operations and docs/release: this guide outside these folders is not shipped yet (bundle owned by C02).
ARCH-B11.1-10 Compliance Mapping (control matrices and evidence)	IN_PROGRESS	test_kit_traceability.py (E-TRACE)	The matrices exist in generated form (traceability.yaml, STATUS, ARCHITECTURE_CONFORMANCE) but no written FR and EN Compliance Mapping guide (control to evidence) is shipped in the bundle.
ARCH-B11.1-11 Troubleshooting Guide	IN_PROGRESS	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist (E-DO-DOCS, E-DO-AIRGAP)	The offline bundle (tools/release/build.py, docs-offline) ships only docs/operations and docs/release: this guide outside these folders is not shipped yet (bundle owned by C02).
ARCH-B11.1-12 Licensing Guide (activation, offline, expiry, renewal)	PASSED	test_docs_kit.py::test_every_docu_requirement_has_its_french_and_english_guide test_docs_kit.py::test_repository_paths_quoted_in_the_guides_exist test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api +2 (E-DO-DOCS, E-DO-AIRGAP)
ARCH-B11.1-13 Release Notes	PASSED	test_release_bundle.py::test_release_notes_generated_and_deterministic test_docs_kit.py::test_no_long_dash_anywhere (E-DO-DOCS, E-DO-AIRGAP)

Part B, B11.2. Developer documentation

Item	Status	Proof	Remaining or blocker
ARCH-B11.2-01 Getting Started (first secure agent)	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-02 Python SDK Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +1 (E-DD-GUIDES)
ARCH-B11.2-03 TypeScript SDK Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +2 (E-DD-GUIDES)
ARCH-B11.2-04 Go SDK Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +2 (E-DD-GUIDES)
ARCH-B11.2-05 ExecutionContext Reference	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-06 ActionContext Reference	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-07 API Reference (OpenAPI and examples)	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-08 Agent Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-09 MCP Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-10 Skill Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-11 Prompt Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-12 Plugin Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-13 Connector Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-14 Policy Development Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-15 Testing Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)
ARCH-B11.2-16 Migration Guide	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve test_developer_guides.py::test_cli_commands_and_sub_commands_exist +3 (E-DD-GUIDES)

Part B, B11.3. Living documentation

Item	Status	Proof	Remaining or blocker
ARCH-B11.3-01 Developer portal fed by manifests, JSON schemas and OpenAPI	PASSED	test_developer_guides.py::test_guide_exists_in_french_and_english_with_the_same_structure test_developer_guides.py::test_links_and_quoted_paths_resolve (E-DD-GUIDES)
ARCH-B11.3-02 Marketplace showing plugin documentation, capabilities, examples and configuration	IN_PROGRESS	test_developer_guides.py::test_routes_quoted_in_the_guides_exist (E-DD-GUIDES)	The documentation explains the Marketplace routes (page, version, preflight); showing plugin documentation, capabilities, examples and configuration in the Marketplace screen remains to be verified by C07 and C09 (screens outside the C13 scope).
ARCH-B11.3-03 Executable examples run by tests	PASSED	test_developer_guides.py::test_typescript_snippets_compile test_developer_guides.py::test_go_snippets_vet_and_build test_developer_guides.py::test_java_snippets_compile_against_the_maven_build (E-DD-GUIDES)

Part B, B12.1. Licence coverage

Item	Status	Proof	Remaining or blocker
ARCH-B12.1-01 Unlimited users	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-02 Unlimited agents	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-03 Unlimited subagents	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-04 Unlimited applications	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-05 Unlimited use cases	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-06 Unlimited developers	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-07 Unlimited prompts and skills	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-08 Unlimited plugins and MCP	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-09 Unlimited connectors	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-10 Unlimited configured models	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_payload_carrying_a_price_or_a_limit_is_refused test_license_issuer.py::test_signed_payload_with_price_or_limit_is_refused (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-11 No commercial quota on requests or tokens	PASSED	test_licensing.py::test_many_users_agents_and_plugins_under_one_licence test_licensing.py::test_only_two_actions_can_ever_be_refused (E-CP-LICENSING)
ARCH-B12.1-12 Term of 12 or 36 months	PASSED	test_licensing.py::test_annual_and_triennial_licences_activate_online test_licensing.py::test_terms_other_than_12_or_36_months_and_inconsistent_dates_are_refused test_license_issuer.py::test_annual_and_triennial_licences_sign_and_verify (E-CP-LICENSING, E-LICENSE-ISSUER)
ARCH-B12.1-13 Online or offline activation	PASSED	test_licensing.py::test_annual_and_triennial_licences_activate_online test_licensing.py::test_offline_issuance_and_file_activation_without_network (E-CP-LICENSING)
ARCH-B12.1-14 Deployment on the contractually covered infrastructure	PASSED	test_licensing.py::test_tampered_unknown_key_and_wrong_environment_are_refused_and_audited test_licensing.py::test_dr_restore_cluster_migration_and_second_site (E-CP-LICENSING)
ARCH-B12.1-15 Support and updates per contract	PASSED	test_licensing.py::test_expiry_refuses_only_the_documented_actions_and_nothing_stops (E-CP-LICENSING)
ARCH-B12.1-16 Security, capacity and cost quotas configurable by the client, never licence restrictions	PASSED	test_licensing.py::test_only_two_actions_can_ever_be_refused test_perf_measurements.py::test_quotas_answer_429_with_documented_codes_and_recover (E-CP-LICENSING, E-DO-PERF)

Part B, B12.2. Commercial scope

Item	Status	Proof	Remaining or blocker
ARCH-B12.2-01 No billing per agent, user or use case	PASSED	test_licensing_no_price_scan.py::test_no_licence_price_in_catalog_contracts_docs_and_screens test_licensing_no_price_scan.py::test_issued_licence_payloads_carry_no_price test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases (E-CP-LICENSING)
ARCH-B12.2-02 Explicit contractual installation scope (organisation, environments, infrastructures, services, support)	IN_PROGRESS	test_licensing.py::test_tampered_unknown_key_and_wrong_environment_are_refused_and_audited (E-CP-LICENSING)	The payload carries customer_id, installation_group_id, environments and support_ref, but neither the list of covered infrastructures nor of covered services.
ARCH-B12.2-03 No hidden counter	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_verifier_and_store_never_reach_the_network test_licensing_no_price_scan.py::test_licensing_material_carries_no_amount_at_all (E-CP-LICENSING)

Part B, B12.3. Licensing service architecture

Item	Status	Proof	Remaining or blocker
ARCH-B12.3-01 Vendor side licence issuer (contract, client, product, term, scope, signature)	PASSED	test_license_issuer.py::test_command_line_round_trip test_license_issuer.py::test_keygen_writes_private_key_0600_and_a_public_jwk test_license_issuer.py::test_private_key_readable_by_others_is_refused (E-LICENSE-ISSUER)
ARCH-B12.3-02 Signed licence as a portable file or online activation	PASSED	test_licensing.py::test_offline_issuance_and_file_activation_without_network test_licensing.py::test_annual_and_triennial_licences_activate_online (E-CP-LICENSING)
ARCH-B12.3-03 Local verifier with an embedded public key	PASSED	test_licensing.py::test_key_rotation_accepts_every_listed_kid test_licensing.py::test_production_refuses_test_keys_and_malformed_keys test_licensing.py::test_verifier_and_store_never_reach_the_network (E-CP-LICENSING)
ARCH-B12.3-04 Platform entitlements (status, period, scope, support, renewal)	PASSED	test_licensing.py::test_status_is_readable_by_any_user_without_sensitive_fields test_licensing.py::test_renewal_without_gap_silences_the_banner_and_takes_over (E-CP-LICENSING)

Part B, B12.4. Signed technical licence contract

Item	Status	Proof	Remaining or blocker
ARCH-B12.4-01 Payload (schema_version, license_id, product_id, edition, customer_id, term, unlimited entitlements, usage_metered_for_licensing false, deployment_scope, support, issuer, issued_at, key_id)	IN_PROGRESS	test_license_issuer.py::test_annual_and_triennial_licences_sign_and_verify test_license_issuer.py::test_other_terms_and_inconsistent_dates_are_refused (E-LICENSE-ISSUER)	The v1 payload carries schema_version, license_id, product_id, edition, customer_id, term_months, valid_from, valid_until, environments, support_ref, issued_at, key_id; it lacks the entitlements object with explicit unlimited flags, usage_metered_for_licensing false, a structured deployment_scope and issuer (contract change shared with C06 contracts/v1).
ARCH-B12.4-02 Signed object (JWS) with verifiable canonicalisation	PASSED	test_license_issuer.py::test_non_canonical_payload_is_refused test_license_issuer.py::test_tampered_unknown_key_and_wrong_algorithm_are_refused (E-LICENSE-ISSUER)
ARCH-B12.4-03 A declarative signature property is refused	PASSED	test_license_issuer.py::test_non_canonical_payload_is_refused test_licensing.py::test_tampered_unknown_key_and_wrong_environment_are_refused_and_audited (E-LICENSE-ISSUER, E-CP-LICENSING)

Part B, B12.5. Offline licence operation

Item	Status	Proof	Remaining or blocker
ARCH-B12.5-01 Non sensitive activation request bound to the installation	IN_PROGRESS	test_licensing.py::test_status_is_readable_by_any_user_without_sensitive_fields (E-CP-LICENSING)	installation_id and installation_group_id are exposed to the administrator, but no formal activation request file (signed export sent to the vendor) is produced.
ARCH-B12.5-02 Local verification without any external call	PASSED	test_licensing.py::test_verifier_and_store_never_reach_the_network test_licensing.py::test_offline_issuance_and_file_activation_without_network (E-CP-LICENSING)
ARCH-B12.5-03 Renewals, standby installations, cluster migrations, hardware changes without unjustified blocking	PASSED	test_licensing.py::test_dr_restore_cluster_migration_and_second_site test_licensing.py::test_renewal_without_gap_silences_the_banner_and_takes_over test_backup_dr_extended.py::test_licence_of_the_group_stays_valid_after_dr_offline (E-CP-LICENSING, E-HB-BACKUP)

Part B, B12.6. Behaviour at expiry

Item	Status	Proof	Remaining or blocker
ARCH-B12.6-01 Active state	PASSED	test_licensing.py::test_state_rules_at_every_boundary (E-CP-LICENSING)
ARCH-B12.6-02 Expiring Soon with notifications to administrators and the contract owner	IN_PROGRESS	test_licensing.py::test_worker_warns_at_30_7_and_1_days_then_grace_and_expiry (E-CP-LICENSING)	Warnings at 30, 7 and 1 days go to platform administrators; no "contract owner" recipient is configurable.
ARCH-B12.6-03 Grace Period (operation kept with warnings)	PASSED	test_licensing.py::test_state_rules_at_every_boundary test_licensing.py::test_worker_warns_at_30_7_and_1_days_then_grace_and_expiry (E-CP-LICENSING)
ARCH-B12.6-04 Expired (renewal asked)	PASSED	test_licensing.py::test_expiry_refuses_only_the_documented_actions_and_nothing_stops (E-CP-LICENSING)
ARCH-B12.6-05 Revoked (contract specific procedure and approvals)	BLOCKED	test_licensing.py::test_state_rules_at_every_boundary (E-CP-LICENSING)	The contract revocation procedure and its approvers are a client and vendor decision [B-CLIENT]
ARCH-B12.6-06 Renewed (new licence loaded without interruption)	PASSED	test_licensing.py::test_renewal_without_gap_silences_the_banner_and_takes_over (E-CP-LICENSING)
ARCH-B12.6-07 Security, audit, recovery and containment stay operational at expiry	PASSED	test_licensing.py::test_expiry_refuses_only_the_documented_actions_and_nothing_stops test_licensing.py::test_only_two_actions_can_ever_be_refused (E-CP-LICENSING)
ARCH-B12.6-08 No commercial kill switch: the security Kill Switch is never used for licences	PASSED	test_licensing.py::test_only_two_actions_can_ever_be_refused test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions (E-CP-LICENSING, E-G06-SOC)

Part B, B13.1. Critical Platform Manager tables

Item	Status	Proof	Remaining or blocker
ARCH-B13.1-01 Table clusters -> nm.clusters	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-02 Table nodes -> nm.hosts	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-03 Table components -> nm.cluster_services	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-04 Table component_instances -> nm.host_components	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-05 Table dependencies -> nm.connections	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-06 Table config_revisions -> nm.config_versions	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-07 Table operations -> nm.operations	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-08 Table operation_steps -> nm.stages, nm.tasks	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-09 Table health_checks -> nm.service_checks	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-10 Table compatibility_matrix -> missing	IN_PROGRESS	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)	No compatibility_matrix table: compatibility comes from the catalog.
ARCH-B13.1-11 Table desired/observed reconciled -> nm.host_components.desired_state	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)
ARCH-B13.1-12 Table destructive actions under maintenance policy -> nm.maintenance_windows	PASSED	test_foundation.py::test_migrations_are_idempotent (E-PO-SERVER)

Part B, B13.2. Audit index and independent evidence

Item	Status	Proof	Remaining or blocker
ARCH-B13.2-01 Audit index table and independent evidence store	PASSED	test_core_audit.py::test_chain_is_valid_and_gapless test_evidence_gateway.py::test_seal_signature_verifies_online_and_offline test_storage_profiles_api.py::test_worm_audit_export_is_qualified_on_a_verified_object_lock_profile (E-G03-AUDIT, E-G03-EVIDENCE, E-G03-WORM)
ARCH-B13.2-02 Events partitioned by event_time, access constraints, retention and archiving	IN_PROGRESS	test_core_audit.py::test_app_role_cannot_rewrite test_evidence_gateway.py::test_legal_hold_blocks_purge_and_release_needs_two_distinct_approvers test_siem_audit_worm.py::test_audit_worm_job_exports_each_past_day_once_signed_by_transit (E-G03-AUDIT, E-G03-EVIDENCE, E-G03-WORM)	eai.audit_events is not a partitioned table (plain CREATE TABLE, V010): declarative partitioning by event_time and automatic partition creation are missing. RLS, REVOKE UPDATE/DELETE, retention with legal hold and daily WORM archiving are proven.
ARCH-B13.2-03 Distinct event_time, ingested_at and sealed_at	PASSED	test_evidence_gateway.py::test_event_time_ingested_at_sealed_at_are_distinct_and_ordered (E-G03-EVIDENCE)
ARCH-B13.2-04 PostgreSQL never WORM: evidence in qualified object storage, digests, signatures, verified immutability	BLOCKED	test_storage_profiles_api.py::test_worm_audit_export_is_refused_without_verified_object_lock test_storage_profiles_api.py::test_worm_audit_export_is_qualified_on_a_verified_object_lock_profile test_evidence_gateway.py::test_monitor_detects_sql_tampering_of_a_sealed_event +1 (E-G03-WORM, E-G03-EVIDENCE)	Object Lock proven on the local emulator; qualification on the client's real object storage needs that storage [B-CLIENT]
ARCH-B13.2-05 Fields of the reference table (event_type, severity, identities, execution ids, decision_reason, policy_revision, evidence_*, sanitized_metadata)	IN_PROGRESS	test_evidence_config_redaction.py::test_policy_decision_audited_with_id_version_reason_obligations test_evidence_config_redaction.py::test_audit_metadata_has_no_credentials_and_pii_goes_to_the_encrypted_payload (E-G03-EVIDENCE)	The information exists in jsonb columns (actor, resource, decision, context, evidence, attributes) but not under the reference column names (event_type, severity, result_status, evidence_state...): a view or normalised index columns remain to add.

Part B, B13.3. Security state registry and Kill Switch

Item	Status	Proof	Remaining or blocker
ARCH-B13.3-01 detections table (eai.soc_detections)	PASSED	test_soc_ai_sdr.py::test_ingestor_normalizes_and_correlator_links_user_agent_tenant test_soc_ai_sdr.py::test_soc_tables_are_tenant_isolated (E-G06-SOC)
ARCH-B13.3-02 incidents table (eai.incidents)	PASSED	test_soc_ai_sdr.py::test_incident_lifecycle_assignment_and_auditable_timeline (E-G06-SOC)
ARCH-B13.3-03 incident_events table (eai.incident_timeline)	PASSED	test_soc_ai_sdr.py::test_incident_lifecycle_assignment_and_auditable_timeline test_soc_ai_sdr.py::test_soc_roles_access_audit_and_sealed_chain_of_custody (E-G06-SOC)
ARCH-B13.3-04 containment_orders table	PASSED	test_soc_ai_sdr.py::test_typed_reactions_only_never_a_free_command test_soc_ai_sdr.py::test_proportionality_guard_in_the_platform (E-G06-SOC)
ARCH-B13.3-05 enforcement_receipts table (eai.containment_receipts)	PASSED	test_soc_ai_sdr.py::test_network_isolation_waits_for_a_signed_in_cluster_receipt (E-G06-SOC)
ARCH-B13.3-06 recovery_requests table	PASSED	test_soc_ai_sdr.py::test_recovery_needs_four_eyes_then_reauthorization (E-G06-SOC)
ARCH-B13.3-07 revoked_credentials (eai.kill_switches, target_type credential)	PASSED	test_soc_ai_sdr.py::test_credentials_identity_and_tenant_suspension_refused_by_auth (E-G06-SOC)
ARCH-B13.3-08 suspension_states (eai.kill_switches desired_state and observed_state)	PASSED	test_soc_ai_sdr.py::test_kill_switches_persist_across_restart test_soc_ai_sdr.py::test_credentials_identity_and_tenant_suspension_refused_by_auth (E-G06-SOC)
ARCH-B13.3-09 playbook_runs table	IN_PROGRESS	test_soc_ai_sdr.py::test_worker_runs_the_soc_scan_and_containment_verifier (E-G06-SOC)	Playbooks are lists of typed reactions (soc/catalog.py) traced by containment_orders and incident_timeline; no playbook_runs table groups one playbook execution.
ARCH-B13.3-10 tenant_id + target_type + target_id protected by concurrency control and versions	IN_PROGRESS	test_soc_ai_sdr.py::test_kill_switches_persist_across_restart test_soc_ai_sdr.py::test_retried_payment_never_executes_twice_even_when_killed_in_flight (E-G06-SOC)	The partial unique index kill_switches_active_target (tenant_id, reaction, target_type, target_ref) prevents two active suspensions, but no version column (optimistic lock) exists on kill_switches or containment_orders.
ARCH-B13.3-11 A containment order becomes VERIFIED only after confirmation by the enforcement points	PASSED	test_soc_ai_sdr.py::test_verified_only_on_real_proof_and_drift_is_reapplied test_soc_ai_sdr.py::test_network_isolation_waits_for_a_signed_in_cluster_receipt (E-G06-SOC)

Part B, B13.4. Licence and support tables

Item	Status	Proof	Remaining or blocker
ARCH-B13.4-01 license_installations (customer, installation group, cluster fingerprint hash, product, edition, validity, digest, key id, status, activation, last verification)	IN_PROGRESS	test_licensing.py::test_dr_restore_cluster_migration_and_second_site test_licensing.py::test_history_is_paginated (E-CP-LICENSING)	Split between license_installation and licenses (group, product, edition, valid_until > valid_from, token_sha256, key_id, activated_at); the cluster fingerprint hash, a persisted status column and last_verified_at are missing.
ARCH-B13.4-02 license_events	PASSED	test_licensing.py::test_history_is_paginated test_licensing.py::test_tampered_unknown_key_and_wrong_environment_are_refused_and_audited (E-CP-LICENSING)
ARCH-B13.4-03 Minimal data: never the number of users, prompts or agents	PASSED	test_licensing.py::test_entitlements_never_count_users_agents_apps_plugins_or_use_cases test_licensing.py::test_status_is_readable_by_any_user_without_sensitive_fields (E-CP-LICENSING)

Part B, B13.5. Transactional outbox and external actions

Item	Status	Proof	Remaining or blocker
ARCH-B13.5-01 The change and its outbox event in one SQL transaction	PASSED	test_evidence_gateway.py::test_rolled_back_change_leaves_no_event_and_committed_one_always_has_it (E-RB-CP)
ARCH-B13.5-02 A worker publishes to NATS JetStream	PASSED	test_evidence_gateway.py::test_gateway_publishes_to_real_jetstream_with_dedup test_worker.py::test_outbox_job_delivers_pending_events_to_triggers (E-RB-CP)
ARCH-B13.5-03 The consumer acknowledges after processing	PASSED	test_media_worker.py::test_nats_mode_publishes_through_the_outbox_and_acks_after_processing (E-RB-CP)
ARCH-B13.5-04 The event id deduplicates	PASSED	test_runtime_nats_jetstream.py::test_dedup_ordering_redelivery_exactly_once test_evidence_gateway.py::test_gateway_publishes_to_real_jetstream_with_dedup (E-RB-CP)
ARCH-B13.5-05 An unacknowledged publication is replayed	PASSED	test_evidence_gateway.py::test_gateway_redelivers_after_target_outage_without_loss_or_duplicate test_runtime_nats_jetstream.py::test_dedup_ordering_redelivery_exactly_once (E-RB-CP)
ARCH-B13.5-06 The evidence service seals and updates the state	PASSED	test_evidence_gateway.py::test_seal_signature_verifies_online_and_offline test_evidence_gateway.py::test_event_time_ingested_at_sealed_at_are_distinct_and_ordered (E-RB-CP)
ARCH-B13.5-07 Actions on external systems: idempotency keys, receipts, reconciliation, compensations	IN_PROGRESS	test_soc_ai_sdr.py::test_retried_payment_never_executes_twice_even_when_killed_in_flight test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_soc_ai_sdr.py::test_network_isolation_waits_for_a_signed_in_cluster_receipt (E-RB-CP)	Idempotency, receipts and reconciliation proven; no automatic compensation (reverse action) is defined yet for an external action committed then cancelled.

Part B, B14. Multi tenant isolation by layer

Item	Status	Proof	Remaining or blocker
ARCH-B14-01 Identity (realm, organisation, groups)	PASSED	test_core_tenancy.py::test_tenant_admin_flow test_identity_context_delegation.py:: (E-IR-IDENTITY)
ARCH-B14-02 API: tenant from the authenticated context	PASSED	test_core_tenancy.py::test_tenant_admin_flow (E-IR-IDENTITY)
ARCH-B14-03 PostgreSQL: RLS and SQL roles	PASSED	test_identity_context_delegation.py::test_identity_tables_are_tenant_isolated (E-IR-IDENTITY)
ARCH-B14-04 Redis: prefixes and ACL	PASSED	test_core_redis.py::test_tenant_isolation_and_clear test_core_redis.py::test_acl_user_with_password_file (E-IR-ISOLATION)
ARCH-B14-05 Qdrant: mandatory filters	PASSED	test_rag_qdrant_real.py::test_real_qdrant_two_tenants_never_leak test_rag_governance.py::test_document_acl_and_other_tenant_refused (E-IR-ISOLATION)
ARCH-B14-06 Agents: contexts, permissions	PASSED	test_identity_context_delegation.py::test_run_carries_original_user_and_subagent_never_gets_wider_rights (E-IR-IDENTITY)
ARCH-B14-07 MCP: identities, scopes	PASSED	test_capabilities_gateways.py::test_tool_scope_denied_and_rate_limit test_gateway_pep_untrusted.py::test_pep_mcp_denied (E-IR-ISOLATION)
ARCH-B14-08 Models: tenant control, budgets	PASSED	test_llm_isolation.py::test_project_mode_overrides_tenant_and_internal_hosts test_llm_isolation.py::test_egress_barrier_denies_external_hosts_of_an_isolated_model (E-IR-ISOLATION)
ARCH-B14-09 Storage: separate paths and buckets	PASSED	test_storage_profiles_api.py::test_profile_crud_keeps_only_a_credential_reference_and_is_tenant_isolated test_storage_profiles_api.py::test_presigned_urls_need_a_verified_capability_and_respect_expiry_and_scope (E-IR-ISOLATION)
ARCH-B14-10 Secrets by service, environment, organisation	PASSED	test_identity_context_delegation.py::test_signing_key_is_read_from_the_openbao_reference_and_never_exposed (E-IR-IDENTITY)
ARCH-B14-11 Kubernetes: namespaces, quotas, network policies	BLOCKED	test_platform_security_manifests.py::test_every_workload_has_a_network_policy test_platform_security_manifests.py::test_service_accounts_do_not_automount_by_default test_platform_security_manifests.py::test_static_cluster_policies (E-IR-ISOLATION)	Needs a real cluster [B-CLUSTER]
ARCH-B14-12 Logs: filtering, masking, read rights	PASSED	test_observability_stack.py::test_bootstrap_is_idempotent_and_logs_are_filtered_by_tenant test_evidence_config_redaction.py::test_secrets_and_pii_never_reach_logs (E-IR-ISOLATION)
ARCH-B14-13 Audit: isolated search	PASSED	test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B14-14 Plugins: activation per tenant	PASSED	test_llm_isolation.py::test_external_fallback_is_dropped_in_isolated_mode test_platform_security_manifests.py::test_default_deny_and_metadata_deny (E-IR-ISOLATION)
ARCH-B14-15 Kill Switch with strict scope	PASSED	test_marketplace.py::test_other_tenant_reaches_no_marketplace_resource test_marketplace.py::test_install_refuses_unapproved_or_unrequested_permissions (E-IR-ISOLATION)
ARCH-B14-16 Reinforced isolation profile	PASSED	test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions (E-IR-ISOLATION)

Part B, B14.1. Protection of secrets and data

Item	Status	Proof	Remaining or blocker
ARCH-B14.1-01 Integration with the client secret manager	PASSED	test_platform_secrets.py::test_external_secret_conventions test_iam_kms.py::test_openbao_transit_adapter test_core_secrets_authz.py::test_secrets_write_only (E-AP-PROTECTION)
ARCH-B14.1-02 Presidio DLP	PASSED	test_data_presidio_real.py::test_real_presidio_detects_banking_entities (E-AP-PROTECTION)
ARCH-B14.1-03 Tink cryptography	PASSED	test_data_envelope_tink.py::test_ciphertext_hides_the_plaintext_and_decrypts test_data_envelope_tink.py::test_other_tenant_or_context_cannot_decrypt (E-AP-PROTECTION)
ARCH-B14.1-04 Classification	PASSED	test_data_privacy.py::test_classify_and_dlp_modes (E-DM-DATA-MEDIA)
ARCH-B14.1-05 PII detection	PASSED	test_data_privacy.py::test_builtin_recognizers_and_validators test_integration_llm_finops.py::test_iban_valid_only_by_checksum_is_detected (E-DM-DATA-MEDIA, E-AP-PROTECTION)
ARCH-B14.1-06 Masking before the LLM call	PASSED	test_integration_llm_finops.py::test_tenant_rule_block_wins_over_mask_mode test_integration_llm_finops.py::test_model_response_goes_through_dlp test_quotas_dlp_realtime.py::test_adapter_file_dlp_blocks_before_call (E-AP-PROTECTION)
ARCH-B14.1-07 Reversible tokenisation	PASSED	test_data_privacy.py::test_detokenize_requires_permission_and_is_audited (E-DM-DATA-MEDIA)
ARCH-B14.1-08 Encryption with an approved key	BLOCKED	test_data_privacy.py::test_encrypt_decrypt_and_rotate test_iam_kms.py::test_pkcs11_wrap_sign_on_softhsm2 (E-DM-DATA-MEDIA, E-AP-PROTECTION)	Client's real HSM not available, proven on SoftHSM2 [B-CLIENT]
ARCH-B14.1-09 Detokenisation only for an authorised user	PASSED	test_data_privacy.py::test_detokenize_requires_permission_and_is_audited test_data_privacy.py::test_detokenize_denied_by_clearance_policy (E-DM-DATA-MEDIA)
ARCH-B14.1-10 Refusal of a forbidden external transfer	PASSED	test_llm_isolation.py::test_egress_barrier_denies_external_hosts_of_an_isolated_model test_evidence_config_redaction.py::test_dlp_masking_and_egress_decisions_are_chained_on_the_action (E-AP-PROTECTION, E-G03-EVIDENCE)
ARCH-B14.1-11 Log sanitisation	PASSED	test_evidence_config_redaction.py::test_secrets_and_pii_never_reach_logs test_evidence_config_redaction.py::test_span_attributes_refuse_free_text (E-G03-EVIDENCE)
ARCH-B14.1-12 Retention	PASSED	test_data_retention_lineage_prompts.py::test_retention_run_respects_legal_hold (E-DM-DATA-MEDIA)
ARCH-B14.1-13 Deletion workflow with proofs	PASSED	test_data_retention_lineage_prompts.py::test_subject_erasure_report test_siem_audit_worm.py::test_erase_subject_reaches_opik_and_clickhouse_and_respects_hold (E-DM-DATA-MEDIA, E-G03-WORM)
ARCH-B14.1-14 Token to value vault separated from agents with its own access control	PASSED	test_data_privacy.py::test_rls_isolation_privacy_tables test_data_privacy.py::test_detokenize_denied_by_clearance_policy (E-DM-DATA-MEDIA)

Part B, B14.2. Separation of duties

Item	Status	Proof	Remaining or blocker
ARCH-B14.2-01 Technical administrators cannot read business documents automatically	PASSED	test_iam_role_matrix.py::test_administrator_without_reader_acl_cannot_read_business_content (E-IR-IDENTITY)
ARCH-B14.2-02 A developer cannot disable logging	PASSED	test_iam_role_matrix.py::test_developer_cannot_approve_own_change_and_auditor_cannot_decide (E-IR-IDENTITY)
ARCH-B14.2-03 Manager, SOC, Data Governance and Studio rights separated with approvals	PASSED	test_iam_role_matrix.py::test_reference_roles_matrix test_iam_role_matrix.py::test_role_matrix test_iam_role_matrix.py::test_developer_cannot_approve_own_change_and_auditor_cannot_decide +1 (E-IR-IDENTITY)

Part B, B15.1. Scalability by domain

Item	Status	Proof	Remaining or blocker
ARCH-B15.1-01 Frontend replicas behind an ingress	PASSED	test_eo_scalability_helm.py::test_frontend_replicas_behind_an_ingress_with_hpa_and_pdb (E-EO-SCALING)
ARCH-B15.1-02 Stateless horizontally scaled backend API	PASSED	test_eo_scalability_helm.py::test_backend_api_is_stateless_and_scaled_horizontally (E-EO-SCALING)
ARCH-B15.1-03 Separate agent workers with concurrency quotas and KEDA	PASSED	test_eo_scalability_helm.py::test_agent_workers_are_separate_with_their_own_resources_and_keda test_platform_deploy_env.py::test_helm_worker_deployment (E-EO-SCALING)
ARCH-B15.1-04 Temporal workers per workflow type	IN_PROGRESS	test_eo_scalability_helm.py::test_agent_workers_are_separate_with_their_own_resources_and_keda (E-EO-SCALING)	A single agent-runs-temporal ScaledObject on the runs queue; no distinct worker Deployment per workflow type (Temporal stays an optional adapter).
ARCH-B15.1-05 NATS cluster with JetStream retention and replication	PASSED	test_availability_local_ha.py::test_nats_jetstream_r3_member_loss test_availability_helm.py::test_data_services_ha_values (E-HB-HA)
ARCH-B15.1-06 LiteLLM replicas, keys and routing	PASSED	test_eo_scalability_helm.py::test_litellm_replicas_scaled_with_pdb (E-EO-SCALING)
ARCH-B15.1-07 vLLM GPU pools, scheduling and memory constraints	BLOCKED	test_eo_scalability_helm.py::test_vllm_gpu_pools_ask_gpus_memory_and_bound_gpu_memory (E-EO-SCALING)	Real execution on GPU absent here [B-GPU]
ARCH-B15.1-08 Opik sized with its dependencies	IN_PROGRESS	test_backup_engines_real.py::test_opik_coordinated_plan_and_redis_rdb_backup_restore (E-HB-BACKUP)	No Opik sizing values (ClickHouse, MySQL, Redis) checked by a test; only the coordinated Opik backup plan is proven.
ARCH-B15.1-09 OpenSearch indexing, shards and retention	IN_PROGRESS	(E-G06-OBS)	OpenSearch shards and retention not checked by a dedicated render test.
ARCH-B15.1-10 Prometheus sized for cardinality and retention	IN_PROGRESS	(E-G06-OBS)	Prometheus retention and cardinality limits not checked by a dedicated test.
ARCH-B15.1-11 Audit Gateway durable ingestion with independent workers	PASSED	test_evidence_gateway.py (E-DO-BACKUP)
ARCH-B15.1-12 PostgreSQL HA, replication, pooling, backup	PASSED	test_availability_local_ha.py::test_postgres_streaming_failover_fencing_rejoin test_availability_local_ha.py::test_patroni_etcd_election_failover_fencing_rejoin test_availability_helm.py::test_cnpg_cluster_manifest_validates_against_pinned_crd_schema (E-HB-HA)
ARCH-B15.1-13 Redis HA, memory limits, eviction policy	PASSED	test_availability_local_ha.py::test_redis_sentinel_failover test_availability_helm.py::test_data_services_ha_values (E-HB-HA)
ARCH-B15.1-14 Qdrant collections, sharding and replication	IN_PROGRESS	(E-HB-HA)	Qdrant sharding and replication not proven by a test (single node Qdrant in the RAG tests).
ARCH-B15.1-15 Client storage capacities and SLA per provider	BLOCKED		Storage capacities and SLA specific to each client and provider [B-CLIENT]

Part B, B15.2. Availability matrix, RTO and RPO

Item	Status	Proof	Remaining or blocker
ARCH-B15.2-01 Critical Security (authorisation, delegation, Kill Switch, critical audit: HA and fail closed)	PASSED	test_soc_ai_sdr.py::test_alerting_and_policy_engine_outage_never_weaken_enforcement test_availability_helm.py::test_ha_profile_replicas_pdb_spread_antiaffinity_probes_shutdown (E-G06-SOC, E-HB-HA)
ARCH-B15.2-02 Critical Runtime (agent gateway, LiteLLM, MCP gateway: redundancy)	PASSED	test_eo_scalability_helm.py::test_litellm_replicas_scaled_with_pdb test_eo_scalability_helm.py::test_backend_api_is_stateless_and_scaled_horizontally (E-EO-SCALING)
ARCH-B15.2-03 Critical Data (PostgreSQL, evidence storage: validated backups and recovery)	IN_PROGRESS	test_backup_recovery.py::test_artifact_checksum_encryption_and_corruption_detected test_backup_dr_extended.py::test_periodic_restore_test_signed_report_and_alarm_on_corruption (E-HB-BACKUP)	BACK-010: real restore of Opik traces (ClickHouse, MySQL at the pinned versions) not replayed; the official static binaries can run unprivileged here but are not downloaded and wired yet. BACK-012 blocked [B-DOCKER].
ARCH-B15.2-04 Operations (Manager, configuration, workflows)	PASSED	test_backup_dr_extended.py::test_manager_rebuilt_from_bundle_and_backups_keeps_audit_identities_permissions test_backup_dr_extended.py::test_recovery_dag_runs_local_processes_in_dependency_order (E-HB-BACKUP)
ARCH-B15.2-05 Observability (buffering without critical loss)	IN_PROGRESS	(E-G06-OBS)	OTel collector buffering (persistent queue) not proven by a network loss test.
ARCH-B15.2-06 Developer Tools (marketplace, studio, documentation)	PASSED	(E-CP-MARKETPLACE, E-DO-DOCS)
ARCH-B15.2-07 RTO and RPO defined with each client, never a single imposed value	PASSED	test_backup_recovery.py::test_dr_plan_targets_empty_by_default_and_exercise_measured test_backup_dr_extended.py::test_dr_targets_set_by_client_traffic_model_and_health_checks (E-HB-BACKUP)

Part B, B15.3. Upgrade and rollback

Item	Status	Proof	Remaining or blocker
ARCH-B15.3-01 Upgrade: Analysis	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-ID-LIFECYCLE)
ARCH-B15.3-02 Upgrade: Simulation	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-ID-LIFECYCLE)
ARCH-B15.3-03 Upgrade: Preparation (backup)	PASSED	test_lifecycle_upgrades.py::test_stateful_upgrade_backup_migration_refused_rollback_and_restore (E-ID-LIFECYCLE)
ARCH-B15.3-04 Upgrade: Prevalidation	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-ID-LIFECYCLE)
ARCH-B15.3-05 Upgrade: Deployment	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-ID-LIFECYCLE)
ARCH-B15.3-06 Upgrade: Validation	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-ID-LIFECYCLE)
ARCH-B15.3-07 Upgrade: Monitoring	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-ID-LIFECYCLE)
ARCH-B15.3-08 Upgrade: Rollback	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-ID-LIFECYCLE)
ARCH-B15.3-09 Upgrade: Audit	PASSED	test_lifecycle_upgrades.py::test_stateless_upgrade_with_canary_then_rollback (E-ID-LIFECYCLE)
ARCH-B15.3-10 Upgrade: Irreversible migrations flagged, restore imposed	PASSED	test_lifecycle_upgrades.py::test_stateful_upgrade_backup_migration_refused_rollback_and_restore (E-ID-LIFECYCLE)

Part B, B16.1. Installing the Finance plugin at a bank

Item	Status	Proof	Remaining or blocker
ARCH-B16.1-01 Finance pack selected in the marketplace	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-02 Version, signature, SBOM and compatibility validated	PASSED	test_marketplace.py::test_unsigned_tampered_or_untrusted_pack_is_refused test_marketplace.py::test_publication_fails_when_a_gate_input_is_missing test_marketplace.py::test_version_ranges (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-03 OpenFGA and OPA determine the authorisations needed	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_identity_context_delegation.py::test_opa_decision_is_taken_before_each_action_with_the_original_user (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-04 Install and accesses approved by authorised owners	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once test_marketplace.py::test_production_publication_needs_gates_and_four_eyes (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-05 ERP, storage and source connectors configured	IN_PROGRESS	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.1-06 Credentials referenced in the client vault	PASSED	test_business_packs.py::test_pack_is_complete_and_holds_no_credential test_llm_registry.py::test_provider_crud_credentials_write_only (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-07 Authorised models selected from the registry	IN_PROGRESS	test_llm_registry.py::test_model_registry_and_status (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.1-08 Financial documents ingested with their ACL	IN_PROGRESS	test_rag_governance.py::test_source_permission_checked_before_ingestion test_rag_governance.py::test_document_acl_and_other_tenant_refused (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.1-09 Validation tests (SDK, security, masking, quality, permissions)	PASSED	test_marketplace.py::test_publication_fails_on_failed_tests_evaluations_or_vulnerabilities test_evidence_config_redaction.py::test_dlp_masking_and_egress_decisions_are_chained_on_the_action (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-10 Approved agents and tools activated	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.1-11 Operation: monitoring, audit, budgets, Kill Switch active	IN_PROGRESS	test_finops_usage.py::test_summary_group_by_and_budget_alerts test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions test_marketplace.py::test_upgrade_rollback_and_uninstall (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.

Part B, B16.2. Using the Finance plugin end to end

Item	Status	Proof	Remaining or blocker
ARCH-B16.2-01 Finance user signed in through Keycloak SSO	IN_PROGRESS	test_iam_keycloak_real.py::test_pkce_login_token_accepted_refresh_and_logout (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.2-02 The agent inherits the user identity with a signed context and limited permissions	PASSED	test_identity_context_delegation.py::test_restricted_delegation_is_always_narrower_and_revocation_cascades test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.2-03 OpenFGA + OPA per action	PASSED	test_identity_context_delegation.py::test_opa_decision_is_taken_before_each_action_with_the_original_user (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.2-04 MCP Finance reads the ERP within the authorised transactions	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.2-05 RAG Finance returns only documents the user may read	IN_PROGRESS	test_rag_governance.py::test_chunk_acl_forbidden_fragments_never_reach_the_context (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.2-06 Presidio + Tink data protection	IN_PROGRESS	test_data_presidio_real.py::test_real_presidio_detects_banking_entities test_rag_governance.py::test_restricted_chunks_are_sealed_at_rest (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.2-07 LiteLLM to an approved model (OpenAI compatible test provider)	PASSED	test_integration_llm_finops.py::test_tenant_rule_block_wins_over_mask_mode test_llm_gateway.py::test_control_kill_switch (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.2-08 Report generation with output control	IN_PROGRESS	test_security_prompt_injection.py::test_output_guard_rules (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.2-09 Audit + Opik + OpenTelemetry with user, agent, data, authorisations, result and cost	IN_PROGRESS	test_opik_integration.py::test_opik_down_keeps_postgres_copy_and_audit_event test_tracing.py::test_gateway_call_produces_linked_spans_without_personal_data (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.
ARCH-B16.2-10 ERP write needs its own authorisation and, when required, a human approval	PASSED	test_marketplace.py::test_finance_pack_end_to_end_payments_exactly_once (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)
ARCH-B16.2-11 The administrator finds the whole execution	IN_PROGRESS	test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids test_marketplace.py::test_upgrade_rollback_and_uninstall (E-BP-PACKS-MARKETPLACE, E-BP-FINANCE-FLOW)	Proven per building block; not yet replayed in one single Finance pack end to end test.

Part B, B17. Development plan by lots

Item	Status	Proof	Remaining or blocker
ARCH-B17-01 Lot 0 Foundations: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-02 Lot 1 Platform Manager: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-03 Lot 2 IAM & Governance: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-04 Lot 3 AI Runtime: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-05 Lot 4 Data Protection: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-06 Lot 5 Observability: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-07 Lot 6 Audit & SOC: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-08 Lot 7 Developer Platform: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-09 Lot 8 Marketplace: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-10 Lot 9 Enterprise Licensing: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-11 Lot 10 Enterprise Readiness: status against its end criterion	PASSED	test_foundation_lot_plan.py::test_kit_section_16_lots_are_the_roadmap_lots test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule test_kit_traceability.py (E-FL-LOTPLAN, E-TRACE)
ARCH-B17-12 Security and audit developed in parallel with the runtime	PASSED	test_foundation_lot_plan.py::test_dependencies_are_known_acyclic_and_the_lot_order_is_a_valid_schedule (E-FL-LOTPLAN)

Part B, B17.1. Product monorepo

Item	Status	Proof	Remaining or blocker
ARCH-B17.1-01 Target folder apps	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-02 Target folder backend	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-03 Target folder services	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-04 Target folder operators	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-05 Target folder sdk	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-06 Target folder cli	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-07 Target folder plugins	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-08 Target folder policies	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-09 Target folder deployment	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-10 Target folder database	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-11 Target folder docs	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-12 Target folder tests	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)
ARCH-B17.1-13 Target folder release	PASSED	test_architecture_decisions.py::test_monorepo_map_paths_exist (E-ID-ARCH)

Part B, B17.2. Mandatory acceptance tests before delivery

Item	Status	Proof	Remaining or blocker
ARCH-B17.2-01 Fresh reproducible install	PASSED	test_release_bundle.py::test_bundle_is_reproducible (E-DO-AIRGAP, E-DO-INSTALL)
ARCH-B17.2-02 Air-gap	PASSED	test_release_bundle.py::test_airgapped_install_in_empty_network_namespace (E-DO-AIRGAP)
ARCH-B17.2-03 Configuration validated, versioned and auditable	IN_PROGRESS	test_platform_deploy_env.py::test_deploy_values_are_valid_settings (E-DO-INSTALL)	Configuration versioning and audit proven on the Manager side (lot C01), to be cited.
ARCH-B17.2-04 Controlled observable start, stop and restart	IN_PROGRESS	test_availability_helm.py::test_ha_profile_replicas_pdb_spread_antiaffinity_probes_shutdown (E-HB-HA)	Manager service operations proven by lot C01, to be cited.
ARCH-B17.2-05 Upgrade with documented restore	PASSED	test_backup_recovery.py::test_restore_incompatible_major_and_rollback_on_corruption (E-HB-BACKUP)
ARCH-B17.2-06 IAM (SSO, MFA, roles, sessions)	PASSED	test_iam_keycloak_real.py test_iam_role_matrix.py (E-CP-IAM-REAL)
ARCH-B17.2-07 OpenFGA/OPA permissions with proven refusals	PASSED	test_iam_openfga_real.py test_iam_opa_bundles_real.py (E-CP-IAM-REAL, E-CP-AUTHZ)
ARCH-B17.2-08 Agent identity propagated on every action	PASSED	test_identity_context_delegation.py (E-CP-CONTEXT)
ARCH-B17.2-09 Tenant isolation	PASSED	test_core_rls_forced.py test_soc_ai_sdr.py::test_soc_routes_refuse_other_tenant_ids (E-CP-RLS, E-G06-SOC)
ARCH-B17.2-10 MCP security impossible to bypass	PASSED	test_capabilities_gateways.py test_security_egress_wiring.py (E-CP-CAPS)
ARCH-B17.2-11 DLP	PASSED	test_soc_ai_sdr.py::test_secret_is_blocked_before_export test_evidence_config_redaction.py (E-G06-SOC, E-DO-REDACTION)
ARCH-B17.2-12 RAG security	PASSED	test_rag_governance.py test_soc_ai_sdr.py::test_rag_poisoning_isolates_the_knowledge_base (E-CP-RAG-KIT, E-G06-SOC)
ARCH-B17.2-13 Complete verifiable audit	PASSED	test_core_audit.py test_audit_mutation_coverage.py (E-CP-AUDIT)
ARCH-B17.2-14 Opik/OTel traces, tokens, costs and latency correlated	PASSED	test_tracing.py test_observability_signals.py (E-CP-OBS)
ARCH-B17.2-15 SOC detection and investigation	PASSED	test_soc_ai_sdr.py::test_ingestor_normalizes_and_correlator_links_user_agent_tenant test_soc_ai_sdr.py::test_soc_roles_access_audit_and_sealed_chain_of_custody (E-G06-SOC)
ARCH-B17.2-16 Effective Kill Switch with no unauthorised resume	PASSED	test_soc_ai_sdr.py::test_kill_switch_cancels_run_and_subagents_and_refuses_new_actions test_soc_ai_sdr.py::test_recovery_needs_four_eyes_then_reauthorization (E-G06-SOC)
ARCH-B17.2-17 Controlled logged recovery	PASSED	test_soc_ai_sdr.py::test_emergency_lockdown_blocks_everything_but_soc_and_recovers test_backup_recovery.py::test_restore_needs_two_distinct_approvers_and_separate_privilege (E-G06-SOC, E-HB-BACKUP)
ARCH-B17.2-18 Scalability against client objectives	BLOCKED	test_eo_scalability_helm.py::test_backend_api_is_stateless_and_scaled_horizontally test_perf_measurements.py::test_every_scenario_has_coherent_metrics (E-EO-SCALING, E-DO-PERF)	Real load against client objectives needs a cluster [B-CLUSTER]
ARCH-B17.2-19 Backup and restore demonstrated	PASSED	test_recovery_postgres_real.py test_backup_dr_extended.py::test_periodic_restore_test_signed_report_and_alarm_on_corruption (E-HB-BACKUP)
ARCH-B17.2-20 Plugin marketplace install, permissions, update, rollback	PASSED	test_marketplace.py (E-CP-MARKETPLACE)
ARCH-B17.2-21 SDK conformance in every language	IN_PROGRESS	tests (E-CONTRACTS, E-DO-SDK-SNIPPETS)	Contracts and Python SDK proven here; TypeScript, Go and Java are proven by the E-SDK-TS, E-SDK-GO and E-SDK-JAVA sets of lot C06.
ARCH-B17.2-22 Licensing annual, triennial and offline	PASSED	test_licensing.py::test_annual_and_triennial_licences_activate_online test_licensing.py::test_offline_issuance_and_file_activation_without_network (E-CP-LICENSING)
ARCH-B17.2-23 Documentation procedures executable and verified	PASSED	test_docs_kit.py::test_python_modules_quoted_in_the_docs_exist_and_answer_help test_docs_kit.py::test_routes_quoted_in_the_guides_exist_in_the_published_api (E-DO-DOCS)

Part B, B18. Differentiation, non negotiable requirements and distribution release

Item	Status	Proof	Remaining or blocker
ARCH-B18-01 Assisted install	PASSED	test_services_install.py::test_provider_and_consumer_install_end_to_end (E-ID-LIFECYCLE)
ARCH-B18-02 Centralised versioned configuration	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-03 Unified portal	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-04 Standard SDK	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-05 Controls provided and tested	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-06 Signed pack marketplace	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-07 OpenFGA, OPA and user context	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-08 Execution Explorer and correlated audit	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-09 SOC, playbooks, Kill Switch	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-10 Version and dependency management	PASSED	test_lifecycle_upgrades.py::test_upgrade_compatibility_refusals (E-ID-LIFECYCLE)
ARCH-B18-11 Versioned documentation	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-12 Diagnostics and support bundle	PASSED	test_lifecycle_bundle_acceptance.py::test_support_bundle_has_no_secret_and_no_personal_data (E-ID-LIFECYCLE)
ARCH-B18-13 Single component catalog	PASSED	test_architecture_decisions.py::test_governance_llm_observability_components_are_catalogued (E-ID-ARCH)
ARCH-B18-14 Central agent registry	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-15 Centralised authorisation	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-16 Independent audit	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-17 Common documented tested SDK	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green
ARCH-B18-18 Frozen distribution release	IN_PROGRESS		Proof owned by the owning lot (C03 to C10); to cite once its set is green

Part B, B19. The agent carries the user's identity

Item	Status	Proof	Remaining or blocker
ARCH-B19-01 Field tenant_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-02 Field user_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-03 Field on_behalf_of carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-04 Field agent_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-05 Field agent_version carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-06 Field subagent_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-07 Field workload_identity carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-08 Field delegation_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-09 Field delegated_scopes carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-10 Field session_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-11 Field execution_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-12 Field trace_id carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-13 Field policy_revision carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-14 Field security_state carried by the agent	PASSED	test_identity_context_delegation.py::test_context_is_signed_verified_and_matches_the_contract test_identity_context_delegation.py::test_audit_events_carry_user_workload_delegation_and_causal_ids (E-IR-IDENTITY)
ARCH-B19-15 Effective rights = intersection	PASSED	test_identity_context_delegation.py::test_pattern_algebra_never_widens (E-IR-IDENTITY)
ARCH-B19-16 No privileged technical account for the agent	PASSED	test_identity_context_delegation.py::test_opa_decision_is_taken_before_each_action_with_the_original_user (E-IR-IDENTITY)
ARCH-B19-17 Secure connector enforces the user's rights	PASSED	test_connector_on_behalf_of.py::test_connector_enforces_user_right_on_technical_credential (E-IR-IDENTITY)
ARCH-B19-18 Scheduled workflows with a limited mandate	PASSED	test_identity_context_delegation.py::test_scheduled_run_needs_an_approved_mandate_bound_to_a_service_identity (E-IR-IDENTITY)
ARCH-B19-19 Central rule end to end	PASSED	test_identity_context_delegation.py::test_run_carries_original_user_and_subagent_never_gets_wider_rights (E-IR-IDENTITY)