{
  "schema_version": 1,
  "kind": "reviewed_recorded_evidence_not_live_status",
  "recorded_date_utc": "2026-10-22",
  "source_checkpoint": "1c012b375599f44b169a57f5874519b648f3798e",
  "scope": "Accepted M4 private diagnostics and human recovery; M5 public deployment is not asserted by this record.",
  "incident": {
    "client": "OpenCode 1.19.3",
    "model": "openai/gpt-6.1-sol",
    "authentication_route": "ChatGPT subscription OAuth in isolated client; no API-key fallback",
    "actual_tool_calls": 9,
    "baseline": {"observed_at": "2026-10-22T05:08:49.408640Z", "gitea_http": 200, "proxy_http": 200},
    "operator_stop": {"at": "2026-10-22T05:09:05.171375Z", "actor": "separately authorized operator"},
    "outage": {"observed_at": "2026-10-22T05:09:15.246599Z", "gitea_http": 502, "proxy_http": 200, "gitea_state": "exited", "proxy_health": "healthy", "sanitized_error_evidence": true},
    "operator_recovery": {"healthy_at": "2026-10-22T05:09:39.367167Z", "path": "human Tailscale SSH", "recovery_guard_fired": false},
    "recovery": {"observed_at": "2026-10-22T05:09:49.757035Z", "gitea_http": 200, "proxy_http": 200, "fresh_snapshots": true},
    "persistence": {"source": "separate operator anonymous application API comparison", "same_repository_id": true, "same_readme_blob": true, "all_application_data_integrity_claimed": false}
  },
  "tools": ["service_health", "recent_logs", "operational_state"],
  "tools_accept_arguments": false,
  "access_tests": [
    {"path": "diagnostic node to private MCP HTTPS", "expected": "allow", "passed": true},
    {"path": "diagnostic node to server SSH", "expected": "deny", "passed": true},
    {"path": "distinct excluded node to private MCP HTTPS", "expected": "deny", "passed": true},
    {"path": "human identity to root Tailscale SSH", "expected": "allow with check rule", "passed": true},
    {"path": "human identity to unapproved SSH user", "expected": "explicit SSH policy denial", "passed": true},
    {"path": "public network to private service ports before M5", "expected": "deny", "passed": true},
    {"path": "MCP administrative tools and extra arguments", "expected": "unknown tool or invalid input", "passed": true}
  ],
  "negative_network_controls": "Distinct nodes and identities; healthy allowed endpoint checks accompanied the denied probes.",
  "limits": {"health_timeout_seconds_per_endpoint": 2, "health_bytes_per_endpoint": 4096, "tool_deadline_seconds": 4, "snapshot_max_bytes": 32768, "snapshot_stale_after_seconds": 20, "publisher_poll_seconds": 2, "returned_log_events": 10, "structured_output_max_bytes": 4096, "wire_output_max_bytes": 12288},
  "caveats": ["Network admission does not assign MCP tool roles.", "Read-only tools do not isolate a process from inherited host privileges.", "The operator publisher has Docker authority; MCP does not.", "The provider receives sanitized prompts and diagnostic responses.", "This incident does not prove general prompt-injection immunity or complete data integrity."]
}