Evidence / Current Verified State

Internal evidence. Explicit boundaries.

OBEAX uses evidence-first status labels. PASS means the named internal test gate passed in the stated environment. It does not imply external certification, customer deployment or production suitability beyond what was actually tested.

OBEAX Evidence ConsoleInternal Private Runtime Evidence
V37 COMPLETE_POLICY_NON_BYPASSFrozen checkpointPROVEN
P01–P08 runtime matrixPrivate isolated PostgreSQLPASS
Final acceptance blockersV37 acceptance review0
Session principal bindingD02 private runtimePASS
Server-derived AI model bindingD02 private runtimePASS
Approval authorityD02 private runtimePASS
Boundary / risk authorityD02 private runtimePASS
Controller wrappersPrivate + extended runtimePASS
Independent after-checkD02PASS
Wrapper-role direct kernel writesLeast privilegeDENIED
Execution attempt / result side effect in D02 wrapper proofPrivate runtimeZERO
Canonical mutationFrozen evidenceNO
Real-world executionCurrent frozen evidenceNO
D03 clean installDeploymentUNVERIFIED
D04 restore / DRRecoveryUNVERIFIED
D05 integrated routeConnector pathUNVERIFIED
External security reviewIndependentNOT CLAIMED
CertificationExternalNOT CLAIMED
Real customer pilotCommercialUNVERIFIED
What this proves

The internal runtime control path has meaningful adversarial evidence.

Trusted policy non-bypass

Caller attempts to weaken or strengthen trusted policy are not treated as execution authority in the proven V37 path.

Approval floors and authority

Required approvals and approval authority were exercised in private runtime tests with negative cases.

Execution-time revalidation

Revocation and stale source conditions were tested close to execution authorization.

Replay and tenant binding

Replay and cross-tenant negative cases were included in the runtime matrix.

Server-derived principals

D02 proved private-runtime session principal and AI model binding primitives.

Controller least privilege

External wrapper roles were denied direct trusted internal functions, binding-table access and kernel-table writes.

Frozen evidence

V37 and D02 checkpoints were preserved with hashes/manifests in the internal evidence process.

What this does not prove

Internal proof is not production certification.

No external pentest claim

An independent security assessment has not yet been claimed.

No formal certification claim

ISO 27001, SOC 2 or equivalent certification is not claimed.

No real-customer production claim

No paid customer or enterprise production deployment is claimed here.

No real-world execution claim

The frozen evidence described here deliberately avoided external connector side effects.

Clean deployment still open

D03 clean installation remains a required professionalization gate.

Recovery still open

D04 backup/restore and DR evidence remain required.

Release frontier

Next gates are deployment and integration, not another marketing claim.

Database authentication + application dependency lock

Production-grade bootstrap and exact application dependency contract.

D03 clean install

Fresh supported Linux environment, exact hashes and invariant checks.

D04 restore / DR

Hashed backup, isolated restore, structural/security recheck and measured recovery.

D05 integrated route

Agent/API → OBEAX → synthetic connector → verified result/evidence.

External review

Independent security testing and findings remediation.

Customer pilot

Start in shadow/no-side-effect mode before restricted real execution.