{
  "schema_version": 1,
  "work_package": "P3-WP07",
  "local_contracts": [
    {"scenario": "runtime_instance_restart", "expected": "stateless request replay, health probe and idempotent task lease"},
    {"scenario": "dependency_disconnect", "expected": "bounded retry, fail-closed delivery and incident propagation"},
    {"scenario": "database_unavailable", "expected": "connection budget is bounded; no migration or task double-commit"},
    {"scenario": "migration_concurrency", "expected": "single migrator Job; runtime image has no migration capability"},
    {"scenario": "self_signed_external_provider", "expected": "disabled external provider and unapproved key-id reject caller supplied trust roots"},
    {"scenario": "evidence_path_swap_or_link", "expected": "directory-FD/O_NOFOLLOW/fstat/nlink reader rejects symlink, hardlink and pre-open replacement"},
    {"scenario": "unbound_compatibility_pair", "expected": "missing base/candidate/rollback contract manifests or changed artifact/SBOM without bound approval rejects"},
    {"scenario": "hook_policy_lifecycle", "expected": "pre-install/pre-upgrade hook NetworkPolicy weight -30 precedes role-init/db-migrate and remains until next hook creation"},
    {"scenario": "caller_authored_compatibility_approval", "expected": "unsigned or unapproved approval JSON cannot authorize different base/candidate artifact-SBOM pairs"},
    {"scenario": "production_external_backup_without_registry", "expected": "external production backup rejects without pre-approved KMS key and registry signer signature"},
    {"scenario": "manifest_self_signed_public_key", "expected": "restore rejects a manifest integrity signature that carries a replaceable public key"},
    {"scenario": "restore_target_replay", "expected": "a new target can be recorded once only; exact or different repeated request rejects"},
    {"scenario": "runtime_serviceaccount_namespace", "expected": "runtime ServiceAccount namespace follows .Values.namespace rather than Helm release namespace"},
    {"scenario": "expired_registry_signed_approval", "expected": "an otherwise valid external approval with expired or unbounded UTC RFC3339 validity is rejected before compatibility verdict"},
    {"scenario": "restore_registry_key_swap", "expected": "a manifest naming key-a rejects a valid key-b re-signature even when both keys are registry approved"}
  ],
  "enterprise_uat_required": ["node_failover", "zone_failover", "regional_recovery", "approved_recovery_objectives", "enterprise_load_balancer"],
  "result": "local_contract_ready"
}