DataOps-platform/docs/validation/P3_WP13_GOVERNED_PLUGIN_PLATFORM_EVIDENCE.md

P3-WP13 validation evidence

Current state: ENGINEERING_BASELINE_COMPLETE_PLUGIN_ACTIVATION_BLOCKED. Revision 559 is the shared PostgreSQL head with zero WP13 facts after the three-identity remediation and empty 558→559→558→559 round trip. This is not enterprise UAT or production acceptance. The enterprise input plugin remains TBD_EXTERNAL, owned by enterprise_plugin_governance_owner.

• RED: tests/core/system/test_wp13_governed_plugin_platform.py initially failed because app.core.plugins did not exist. GREEN: the closed v1 manifest and local fixture registry/lifecycle contracts pass (9 passed).
• Static GREEN: compilation, JSON validation, source/deployment byte parity and git diff --check pass; Alembic resolves exactly 20260818_552 -> 553 -> 554 -> 555 -> 556 -> 557 -> 558 -> 559 (head).
• PostgreSQL GREEN: a short-lived, non-printed local Docker DSN ran the disposable test with a restricted NOSUPERUSER/NOCREATEROLE migrator. It passed 552→559, verified closed signature binding, draft→reviewed→approved →canary→active, exact/changed replay, two-connection Barrier single claim, DB-clock lease expiry/late-worker fence, retry→dead-letter→recovery, audit, registry-only/claims-empty refusal to both 556 and 555 with head retention, and empty 559→558→559 plus 559→554→555→556→557→558→559 round trips. Its UUID-named database/logins were removed. The shared empty database was confirmed at 20260818_559 with zero WP13 registry facts after a restricted migrator upgrade.
• Cleanup verification GREEN: the integration test removed its UUID-named database and temporary migrator/runtime/control logins (0 matching databases). A pre-existing non-UUID global login wp13_roleinit_runtime has no active session or owned objects and belongs to the long-lived dataops_agent_runtime/dataops_app_runtime roles; its creation cannot be attributed to this run, so it was intentionally preserved rather than deleting an unproven shared asset.
• Role-init replay GREEN: a disposable 559 database used two temporary local logins. Missing legacy tables are now existence-gated; replay cannot revive v2/v3/v4 control access, grants only v5 control plus v3 claim/recovery gateways to the distinct control login, and leaves runtime direct table access false. The temporary database and logins were explicitly removed.
• Flask+PG GREEN: independent runtime/control logins registered and reviewed a fixture via the real blueprint; a fresh app's duplicate registration returned no-store 400 and left exactly one committed row. HTTP derives reviewer identity from the authenticated principal; same-reviewer and forged-body attempts reject. WP13 core/API/PG tests pass (11 passed). Source/deployment mirrors compare byte-for-byte. Direct WP03/WP05/WP06/WP09/WP10/permission regressions pass (167 passed); OpenAPI regenerated with 504 operations and includes all lifecycle/invocation routes.
• Spec-review remediation GREEN: 555 drops the legacy plugin_platform_runtime_execute(jsonb) writer rather than relying on an ACL, and redefines runtime recovery to consume only a one-shot, DB-clock recovery claim issued by the separate control gateway. The claim binds plugin/version/tenant/domain/run/actor/incident/approval/manifest digest and expected fence; runtime direct recovery, SET ROLE escalation, cross-scope, changed-fence and replay attacks were rejected by real PostgreSQL tests.
• V3 remediation GREEN: 556 revokes the v2 public/app/runtime/control surfaces, derives reviewer_ref only from the persisted review actor, and binds each claim to the DB-computed canonical tuple (plugin/version/tenant/domain/ principal/operation/input digest/idempotency key). Enqueue recomputes it, checks the active/canary manifest capability again, and returns only exact replays; changed payload, operation escalation, changed idempotency and claim reuse reject.

Unapproved, unsigned, non-fixture or external plugin activation is unsupported and must remain zero. No external registry, CA, scanner, notification, connector source, charge-like operation or arbitrary code path was called.

• V4 review-generation remediation GREEN: 558 records a distinct submitter, starts with no review fact at registration, and permits approval issuance only in reviewed state by an operator distinct from the current persisted review actor. It binds review actor, generation and reviewed-at to the approval and repeats those checks while holding row locks at consumption. The isolated PostgreSQL test proves pre-review, same actor, forged HTTP reviewer, reviewer-change stale approval, cross-scope and concurrent double-consume denial, while the positive three-identity path succeeds.
• V5 three-identity remediation GREEN: 559 refuses a non-draft review fact without an atomic v5 review record, then writes reviewed_at, generation and review manifest digest under the same registry row lock. Both approval issue and consumption require submitter, current reviewer and operator to be pairwise distinct. The real Flask and PostgreSQL path proves pre-review, reviewer and submitter-as-operator denial, then a positive three-identity register→review→issue→transition chain without direct fact-table mutation.
• Delivery-contract remediation GREEN: the deployment plugins/__init__.py byte-for-byte mirror was repaired without changing any other deployment asset. tests/test_wp13_delivery_contract.py now checks the full release hash tree and the offline archive's exact 559 migration checksum; the targeted delivery and core suites pass (54 passed in the current architectural/API bundle).

Reproducible final commands and results

All commands below use PYTHONPATH=. and the repository virtual environment. The PostgreSQL command derives the local Docker DSN inside the shell and does not print its password. No listed command skipped a test.

TEST_DATABASE_URL=<non-printed Docker DSN> PYTHONPATH=. .venv/bin/pytest -q tests/integration/test_wp13_plugin_platform_postgres.py
# 1 passed

PYTHONPATH=. .venv/bin/pytest -q tests/core/system/test_wp13_governed_plugin_platform.py tests/test_wp13_plugin_platform_api.py tests/test_wp13_delivery_contract.py tests/test_architecture_artifacts.py tests/test_trusted_delivery_openapi_contract.py tests/core/orchestration/test_production_operations_openapi_contract.py tests/mcp/test_wp09_invocation_contract.py tests/test_wp10_tenant_api.py tests/test_permission_matrix.py
# 54 passed

PYTHONPATH=. .venv/bin/pytest -q tests/test_phase3_wp03_enterprise_connectors.py tests/core/orchestration/test_production_operations_api.py tests/core/orchestration/test_production_operations_openapi_contract.py tests/core/orchestration/test_production_operations_service.py tests/test_trusted_delivery_api.py tests/test_trusted_delivery_controls_api.py tests/test_trusted_delivery_openapi_contract.py tests/test_trusted_delivery_subscription_api.py tests/security/test_trusted_delivery.py tests/security/test_trusted_delivery_controls.py tests/security/test_trusted_delivery_controls_service.py tests/security/test_trusted_delivery_database_boundary_contract.py tests/security/test_trusted_delivery_hardening_contract.py tests/security/test_trusted_delivery_remediation.py tests/security/test_trusted_delivery_runtime_write_hardening_contract.py tests/security/test_trusted_delivery_subscriptions.py tests/mcp/test_wp09_invocation_contract.py tests/agent/test_wp09_model_gateway.py tests/agent/test_wp09_settlement_contract.py tests/agent/test_wp09_control_claim_contract.py tests/agent/test_wp09_critical_migration_contract.py tests/agent/test_wp09_repository_contract.py tests/agent/test_wp09_control_approval_contract.py tests/agent/test_wp09_critical_remediation.py tests/test_wp09_runtime_api_contract.py tests/test_wp10_tenant_api.py tests/core/system/test_wp10_tenant_context.py tests/core/system/test_wp10_tenant_control_service.py tests/core/system/test_wp10_tenant_lifecycle.py tests/security/test_wp10_tenant_boundaries.py tests/test_permission_matrix.py
# 167 passed