Evidence / Current Verified State

Internal evidence. Explicit boundaries.

OBEAX uses evidence-first status labels. PASS means the named internal test gate passed in the stated environment. It does not imply external certification, customer deployment or production suitability beyond what was actually tested.

OBEAX Evidence ConsoleInternal Private Runtime Evidence

V37 COMPLETE_POLICY_NON_BYPASSFrozen checkpointPROVEN

P01–P08 runtime matrixPrivate isolated PostgreSQLPASS

Final acceptance blockersV37 acceptance review0

Session principal bindingD02 private runtimePASS

Server-derived AI model bindingD02 private runtimePASS

Approval authorityD02 private runtimePASS

Boundary / risk authorityD02 private runtimePASS

Controller wrappersPrivate + extended runtimePASS

Independent after-checkD02PASS

Wrapper-role direct kernel writesLeast privilegeDENIED

Execution attempt / result side effect in D02 wrapper proofPrivate runtimeZERO

Canonical mutationFrozen evidenceNO

Real-world executionCurrent frozen evidenceNO

D03 clean installDeploymentUNVERIFIED

D04 restore / DRRecoveryUNVERIFIED

D05 integrated routeConnector pathUNVERIFIED

External security reviewIndependentNOT CLAIMED

CertificationExternalNOT CLAIMED

Real customer pilotCommercialUNVERIFIED

What this proves

The internal runtime control path has meaningful adversarial evidence.

Trusted policy non-bypass

Caller attempts to weaken or strengthen trusted policy are not treated as execution authority in the proven V37 path.

Approval floors and authority

Required approvals and approval authority were exercised in private runtime tests with negative cases.

Execution-time revalidation

Revocation and stale source conditions were tested close to execution authorization.

Replay and tenant binding

Replay and cross-tenant negative cases were included in the runtime matrix.

Server-derived principals

D02 proved private-runtime session principal and AI model binding primitives.

Controller least privilege

External wrapper roles were denied direct trusted internal functions, binding-table access and kernel-table writes.

Frozen evidence

V37 and D02 checkpoints were preserved with hashes/manifests in the internal evidence process.

What this does not prove

Internal proof is not production certification.

No external pentest claim

An independent security assessment has not yet been claimed.

No formal certification claim

ISO 27001, SOC 2 or equivalent certification is not claimed.

No real-customer production claim

No paid customer or enterprise production deployment is claimed here.

No real-world execution claim

The frozen evidence described here deliberately avoided external connector side effects.

Clean deployment still open

D03 clean installation remains a required professionalization gate.

Recovery still open

D04 backup/restore and DR evidence remain required.

Release frontier

Next gates are deployment and integration, not another marketing claim.

Database authentication + application dependency lock

Production-grade bootstrap and exact application dependency contract.

D03 clean install

Fresh supported Linux environment, exact hashes and invariant checks.

D04 restore / DR

Hashed backup, isolated restore, structural/security recheck and measured recovery.

D05 integrated route

Agent/API → OBEAX → synthetic connector → verified result/evidence.

External review

Independent security testing and findings remediation.

Customer pilot

Start in shadow/no-side-effect mode before restricted real execution.