{
  "verified_date_sydney": "2026-10-27",
  "scope": "One author-authorized, assistant-operated finite Azure trial; not independent reader replay or public-release approval.",
  "subscription_alias": "MVP Sub",
  "resource_group": "ra-lab-assurance-20261027",
  "environment": {
    "location": "australiaeast",
    "vm_size": "Standard_B1s",
    "image": "Canonical:ubuntu-24_04-lts:server:24.04.202610210",
    "azure_cli": "2.91.0",
    "bicep": "0.48.1",
    "runner_python": "3.14.7",
    "source_sha256": {
      "lab.py": "b411d997ff66cfe6a891bb72aea8fbbab2ff06655c796ac1ef8eeaa8a0d4d83b",
      "main.bicep": "40bc522b1f51da1f8c5155459e46b34e37f0067033d7b8c8fd39c693ded6005b",
      "probe.py": "1e4eb37394695d3a3b6108420803150549c4d407d0713e17d2d4e125a1f6deb9",
      "validate.py": "ff44cd908dcfe243286957d51ff61104fe178a8898d1afe7ce17352c6ac036f5"
    }
  },
  "deployment": {
    "first_run": "Succeeded; R setup write returned 201, but runner rejected combined Run Command output. Stopped, preserved evidence and deleted group before parser revision.",
    "second_run": "Fresh group deployment, validation and what-if succeeded after compatibility regression tests.",
    "second_run_manifest_created_utc": "2026-10-27T00:01:12.893608+00:00",
    "isolation_checks": "Storage public network, Shared Key and anonymous Blob access disabled; TLS 1.2 minimum; approved endpoints; no public VM IPs, VNet peering or custom route tables.",
    "property_review_limit": "Extended property checks were assistant-operated after comparisons, not an independent preflight or continuous deep-drift audit.",
    "seeder": "Three synthetic markers created; temporary grants removed and deallocation confirmed before baseline.",
    "management_egress": "Explicit accepted NAT/AzureCloud HTTPS; not zero egress."
  },
  "comparisons": {
    "case_order": ["R", "S", "C", "M"],
    "requests_per_case_per_state": 3,
    "latest_observed_outcomes": {
      "baseline": ["SUCCESS_MATCH", "SUCCESS_MATCH", "SUCCESS_MATCH", "NOT_FOUND"],
      "identity": ["SUCCESS_MATCH", "AUTHORIZATION_DENIED", "AUTHORIZATION_DENIED", "NOT_FOUND"],
      "network": ["SUCCESS_MATCH", "SUCCESS_MATCH", "TRANSPORT_TIMEOUT", "NOT_FOUND"],
      "combined": ["SUCCESS_MATCH", "AUTHORIZATION_DENIED", "TRANSPORT_TIMEOUT", "NOT_FOUND"],
      "failure_after_recorded_retry": ["AUTHORIZATION_DENIED", "AUTHORIZATION_DENIED", "TRANSPORT_TIMEOUT", "AUTHORIZATION_DENIED"],
      "recovered": ["SUCCESS_MATCH", "AUTHORIZATION_DENIED", "TRANSPORT_TIMEOUT", "NOT_FOUND"]
    },
    "full_latest_state_validator_pass": true,
    "all_first_attempts_passed": false,
    "read_attempts_including_restored_baseline_and_failed_comparison": 96,
    "setup_writes_in_second_run": 3,
    "immutable_attempt_batches_in_second_run": 35,
    "negative_result": {
      "failure_state_recorded_utc": "2026-10-27T00:23:55.345650+00:00",
      "initial_required_reads": "Three SUCCESS_MATCH/200 responses beginning 00:24:18 UTC despite no listed assignments; failed comparison retained.",
      "later_missing_object_control": "AuthorizationPermissionMismatch/403 at 00:26:31 UTC.",
      "explicit_readiness_retries": 1,
      "readiness_window_minutes": 30,
      "retry_required_reads": "Three authorization denials beginning 00:28:09 UTC without another control change.",
      "limit": "Not an exact revocation time, propagation cause or SLA. Fresh connections and a role-list result did not guarantee immediate denial."
    },
    "recovery": "Only required-container reader restored; spare denied and canary timeout retained. No broad baseline grants restored by recovery.",
    "timeout_limit": "Effective worker NIC canary deny and active endpoint routes were retained, but a timeout alone is not causal proof or service denial."
  },
  "telemetry": {
    "actual_table": "StorageBlobLogs",
    "packaged_query_executed": true,
    "exact_positive_rows": 1,
    "positive_checks": "Expected requester, GetBlob and HTTP 200.",
    "distractor_rows": {"nonexistent_request": 0, "other_container_uri": 0, "other_real_request_id": 0},
    "final_bounded_blob_rows": 81,
    "final_bounded_management_events": 626,
    "management_event_limit": 5000,
    "management_window_start_utc": "2026-10-26T23:46:00Z",
    "limits": "Counts are collection sizes, not successful-read counts or completeness/latency claims. Final management export precedes final teardown; deletion is separately confirmed. Detailed independent actor/correlation review remains outstanding.",
    "effective_policy_note": "Platform-reported IPv6 outbound deny was present alongside worker NIC NSG; not created by this template or tested as an IPv6 scenario."
  },
  "cost": {
    "currency": "AUD",
    "approved_aggregate_cap": 50,
    "planning_allowance": 20,
    "basis": "Dated Azure Retail Prices API unit prices plus contingency; not an offer-specific invoice or calculator export.",
    "settled_actual": null,
    "status": "UNCONFIRMED; initial Cost Management response had no rows; later request returned HTTP 429. Neither establishes zero cost."
  },
  "cleanup": {
    "both_runs_deleted": true,
    "final_group_absence_confirmed_utc": "2026-10-27T00:41:36.724380+00:00",
    "separate_group_exists_read": false,
    "within_approved_24_hours": true,
    "safety_cleanup_automation": "Cleared after confirmed deletion.",
    "limits": "Billing lag and any external artifacts/assignments require separate review."
  },
  "evidence_handling": "Filled immutable approvals, keys, deployment outputs, source snapshots, guest streams, attempts, queries, errors and cleanup records retained in the restricted session artifact directory outside the repository. This record and VALIDATION.md are sanitized summaries, not independently authenticated evidence.",
  "publication_ready": false,
  "remaining_release_holds": [
    "Independent operator replay and review of the packaged instructions.",
    "Attributable settled-cost review and billing-lag reconciliation.",
    "Author review of sanitized evidence and negative-result narrative.",
    "Refresh six drafts and final QA; obtain a validated Council Gate 2 before publication packaging."
  ]
}