From 2a464ab394e7c1a2598b467a49e5229f5dffd453 Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Thu, 20 Aug 2026 04:34:40 +0000
Subject: [PATCH 1/6] feat: integrate CASTUO binary evolution boundary

Add repository-specific S-001A integration metadata, bounded evidence references, rollback/trust controls and fail-closed promotion state.
---
 docs/castuo-system-integration.md             | 28 +++++++++
 evidence/s001a/evidence-envelope.json         | 63 +++++++++++++++++++
 .../s001a/fixtures/S-001A-frozen-fixture.json | 53 ++++++++++++++++
 evidence/s001a/foreign-verification.json      |  1 +
 evidence/s001a/negative-security-tests.json   | 34 ++++++++++
 evidence/s001a/replay-result.json             | 37 +++++++++++
 governance/castuo-integration.yaml            | 14 +++++
 7 files changed, 230 insertions(+)
 create mode 100644 docs/castuo-system-integration.md
 create mode 100644 evidence/s001a/evidence-envelope.json
 create mode 100644 evidence/s001a/fixtures/S-001A-frozen-fixture.json
 create mode 100644 evidence/s001a/foreign-verification.json
 create mode 100644 evidence/s001a/negative-security-tests.json
 create mode 100644 evidence/s001a/replay-result.json
 create mode 100644 governance/castuo-integration.yaml

diff --git a/docs/castuo-system-integration.md b/docs/castuo-system-integration.md
new file mode 100644
index 0000000..dd4c4a7
--- /dev/null
+++ b/docs/castuo-system-integration.md
@@ -0,0 +1,28 @@
+# CASTÚO-SYSTEM integration boundary
+
+This repository is part of the CASTÚO-SYSTEM ecosystem and receives an adaptation of the binary evolution architecture. The canonical capability is `S-001A` — evidence-preserving local continuity under connectivity loss.
+
+The integration preserves these states: `VALIDATED_LOCAL`, `EVIDENCE_SCOPED`, `HUMAN_REVIEW_PENDING`, `EXTERNAL_VERIFICATION_PENDING`, `PROMOTION_BLOCKED` and `NOT_CLAIMED`. Local execution never implies production, field, N5/N6, federation, provider independence or full sovereignty.
+
+The promotion predicate is conjunctive:
+
+```text
+PROMOTE = capability ∧ evidence ∧ replay ∧ security
+          ∧ sovereignty ∧ resilience ∧ review ∧ rollback
+```
+
+Any unknown, pending or failed mandatory state remains blocking. Private keys, secrets, credentials, PII and production payloads are excluded from this integration.
+
+## Common references
+
+- Canonical contract: `CAP-S001A-OFFLINE-CONTINUITY`.
+- Evidence scenario: `S-001A`.
+- Current claim boundary: `LOCAL_RESULT_NO_CLAIM`.
+- Next gate: independent review, trusted signature ceremony and authorized representative rollback.
+
+## Repository role
+
+**Role:** `evidence`
+**Description:** Portable public evidence packages, fixtures, hashes and bounded claims.
+
+This repository must implement only the controls applicable to this boundary and must link its evidence to a commit or tag.
diff --git a/evidence/s001a/evidence-envelope.json b/evidence/s001a/evidence-envelope.json
new file mode 100644
index 0000000..c2ebb7f
--- /dev/null
+++ b/evidence/s001a/evidence-envelope.json
@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.0.0",
+  "evidence_id": "E3-001-LOCAL-CASTUO-AUDIT-2026-08-20",
+  "capability_id": "S-001A",
+  "contract": "CAP-S001A-OFFLINE-CONTINUITY",
+  "execution": {
+    "mode": "LOCAL_ONLY",
+    "environment": "sandbox",
+    "platform": "Linux",
+    "runtime": "Python 3.12.3",
+    "source_repository": "Traky12/Castuo-system",
+    "source_commit": "5d4c5b64b0546406702badc4a3098dd67f262da3",
+    "external_network": false,
+    "production_claim": false
+  },
+  "scope": {
+    "scenario": "S-001A",
+    "fixture": "governance/evidence/E3-001-S001A/fixtures/S-001A-frozen-fixture.json",
+    "claim_boundary": "LOCAL_RESULT_NO_CLAIM"
+  },
+  "observations": {
+    "replay": "PASS_LOCAL_NO_CLAIM",
+    "targeted_pytest": "53 passed, 1 skipped",
+    "python_compileall": "PASS",
+    "secret_hook": "PASS_NO_STAGED_FILES",
+    "binary_gate": "BLOCK",
+    "independence": "NOT_ESTABLISHED",
+    "review": "PENDING"
+  },
+  "promotion": {
+    "status": "BLOCKED",
+    "decision": "BLOCK",
+    "reason": "security, independent review and rollback evidence are not closed",
+    "one_d": true,
+    "one_v": true,
+    "one_r": false,
+    "one_a": false
+  },
+  "artifacts": {
+    "baseline": "dafd24b20c437a8945b8b2ae304ec35580600418f56cbf5a0644e65d84b82e7c",
+    "contract": "042f7cde58776ad039944848018fb0b913cc21afc1c576364e6d2fe7a8e052e0",
+    "gate_validator": "319d2710f2c51dc8926f08c356cf2933e15e17c39ebdc491534a9fb34a0ef1c7",
+    "gate_state": "3d7f69326854200ea17315ad540ceda5384de12bf275f1ed3ff6e7a5a7836b31",
+    "gate_validation": "5df7de3436ba08c2c5e5203fc016bfd8f0a9dd4e24617bf03d70ce895d3ec9a7",
+    "replay_result": "301d39926274ebd6c592700ca2b4736aeb4d0b24e75a91fe2bdd3b5f6102c9f5",
+    "test_log": "321662b2ad18ba0eb9563b3ee1005a51248af08b66edc9baca8bf0c1ecee5f88",
+    "security_log": "7be71c23b16f12d45c6ef1852697f35198e67aead0c138791574f41d52a5ace5"
+  },
+  "review": {
+    "state": "PENDING",
+    "reviewer": null,
+    "independence": "REQUIRED",
+    "review_date": null
+  },
+  "limitations": [
+    "La ejecución es local-only y no constituye validación independiente.",
+    "No se ejecutó operación remota, despliegue, sincronización real ni piloto de campo.",
+    "Los controles anticiberataques observados en el registro del ecosistema están documentados; su cobertura operacional requiere pruebas y evidencia fechada.",
+    "No se verificó salida de proveedor ni operación continuada con proveedor alternativo.",
+    "No se promociona N5, N6, producción, federación, operación comercial ni soberanía plena."
+  ],
+  "next_gate": "F4_SECURITY_AND_RECOVERY_EVIDENCE"
+}
diff --git a/evidence/s001a/fixtures/S-001A-frozen-fixture.json b/evidence/s001a/fixtures/S-001A-frozen-fixture.json
new file mode 100644
index 0000000..f8d00fc
--- /dev/null
+++ b/evidence/s001a/fixtures/S-001A-frozen-fixture.json
@@ -0,0 +1,53 @@
+{
+  "fixture_id": "S-001A-FROZEN-E3-001",
+  "scenario_id": "S-001A",
+  "version": "1.0.0",
+  "purpose": "Independent replay of evidence-preserving local continuity under connectivity loss",
+  "initial_state": "CONNECTED",
+  "events": [
+    {
+      "seq": 1,
+      "event": "OPERATION_STARTED",
+      "network": "AVAILABLE",
+      "expected_state": "ACTIVE"
+    },
+    {
+      "seq": 2,
+      "event": "NETWORK_DOWN",
+      "network": "UNAVAILABLE",
+      "expected_state": "BUFFERED"
+    },
+    {
+      "seq": 3,
+      "event": "LOCAL_EVENT_APPENDED",
+      "network": "UNAVAILABLE",
+      "expected_state": "BUFFERED",
+      "evidence_required": true
+    },
+    {
+      "seq": 4,
+      "event": "NETWORK_RESTORED",
+      "network": "AVAILABLE",
+      "expected_state": "RECOVERING"
+    },
+    {
+      "seq": 5,
+      "event": "BUFFER_REPLAYED",
+      "network": "AVAILABLE",
+      "expected_state": "SYNCHRONIZED"
+    },
+    {
+      "seq": 6,
+      "event": "EVIDENCE_REPLAYED",
+      "network": "AVAILABLE",
+      "expected_state": "REVIEWABLE"
+    }
+  ],
+  "expected_invariants": {
+    "local_operation_continues": true,
+    "evidence_preserved": true,
+    "synchronization_after_recovery": true,
+    "evidence_loss": 0,
+    "production_claim": false
+  }
+}
diff --git a/evidence/s001a/foreign-verification.json b/evidence/s001a/foreign-verification.json
new file mode 100644
index 0000000..fd6db6f
--- /dev/null
+++ b/evidence/s001a/foreign-verification.json
@@ -0,0 +1 @@
+{"checks": {"event_sequence": true, "fixture_id": true, "invariants": true, "no_production_claim": true, "scenario_id": true, "state_sequence": true}, "status": "PASS_FOREIGN_SEMANTIC_REPLAY"}
diff --git a/evidence/s001a/negative-security-tests.json b/evidence/s001a/negative-security-tests.json
new file mode 100644
index 0000000..9f2c21f
--- /dev/null
+++ b/evidence/s001a/negative-security-tests.json
@@ -0,0 +1,34 @@
+{
+  "baseline_envelope_sha256": "69fecb511ba069f0cce43d6d09dd5be1afe7e656c7d993c96e531b4f8014ea27",
+  "cases": [
+    {
+      "case_id": "NEG-001-TAMPERED-CLAIM-BOUNDARY",
+      "expected": "BLOCK",
+      "observed": "BLOCK",
+      "reason": "tampered envelope changes canonical digest"
+    },
+    {
+      "case_id": "NEG-002-UNKNOWN-GATE-STATE",
+      "expected": "BLOCK",
+      "observed": "BLOCK",
+      "reason": "unknown mandatory state is not green"
+    },
+    {
+      "case_id": "NEG-003-SCOPE-EXPANSION",
+      "expected": "BLOCK",
+      "observed": "BLOCK",
+      "reason": "scope expansion requires reassessment"
+    },
+    {
+      "case_id": "NEG-004-REPLAY-FAILURE",
+      "expected": "BLOCK",
+      "observed": "BLOCK",
+      "reason": "replay failure blocks promotion"
+    }
+  ],
+  "claim_boundary": "LOCAL_RESULT_NO_CLAIM",
+  "execution_mode": "LOCAL_ONLY",
+  "promotion": "BLOCKED",
+  "status": "PASS_LOCAL_NO_CLAIM",
+  "suite_id": "S-001A-NEGATIVE-SECURITY-LOCAL-001"
+}
diff --git a/evidence/s001a/replay-result.json b/evidence/s001a/replay-result.json
new file mode 100644
index 0000000..80c03b4
--- /dev/null
+++ b/evidence/s001a/replay-result.json
@@ -0,0 +1,37 @@
+{
+  "evidence_id": "E3-001-LOCAL-REPLAY",
+  "scenario_id": "S-001A",
+  "fixture_id": "S-001A-FROZEN-E3-001",
+  "execution_mode": "LOCAL_ONLY",
+  "independence": "NOT_ESTABLISHED",
+  "review_state": "PENDING",
+  "observed_sequence": [
+    "OPERATION_STARTED",
+    "NETWORK_DOWN",
+    "LOCAL_EVENT_APPENDED",
+    "NETWORK_RESTORED",
+    "BUFFER_REPLAYED",
+    "EVIDENCE_REPLAYED"
+  ],
+  "observed_states": [
+    "ACTIVE",
+    "BUFFERED",
+    "BUFFERED",
+    "RECOVERING",
+    "SYNCHRONIZED",
+    "REVIEWABLE"
+  ],
+  "invariants": {
+    "local_operation_continues": true,
+    "evidence_preserved": true,
+    "synchronization_after_recovery": true,
+    "evidence_loss": 0,
+    "production_claim": false
+  },
+  "environment": {
+    "python": "3.12.3",
+    "platform": "Linux-6.18.38+-x86_64-with-glibc2.39"
+  },
+  "claim_boundary": "LOCAL_RESULT_NO_CLAIM",
+  "promotion": "BLOCKED"
+}
diff --git a/governance/castuo-integration.yaml b/governance/castuo-integration.yaml
new file mode 100644
index 0000000..97043e5
--- /dev/null
+++ b/governance/castuo-integration.yaml
@@ -0,0 +1,14 @@
+schema_version: "1.0.0"
+ecosystem: "CASTUO-SYSTEM"
+repository: "castuo-evidence"
+role: "evidence"
+capability: "S-001A"
+contract: "CAP-S001A-OFFLINE-CONTINUITY"
+execution_mode: "LOCAL_ONLY"
+claim_boundary: "LOCAL_RESULT_NO_CLAIM"
+promotion: "BLOCKED"
+owner: "PENDING"
+evidence_reference: "PENDING_REPOSITORY_ADAPTATION"
+next_gate: "INDEPENDENT_REVIEW_AND_AUTHORIZED_ROLLBACK"
+secrets_in_repository: false
+production_claim: false

From ceac5d46eda85265ad82b169d8ffdc139858ff90 Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Thu, 20 Aug 2026 04:56:50 +0000
Subject: [PATCH 2/6] docs: add independent review reproduction runbook

Document exact reproduction, trust verification, negative testing, rollback and reviewer attestation steps without simulating promotion.
---
 ...PENDENT-REVIEW-REPRODUCTION-AND-SIGNING.md | 244 ++++++++++++++++++
 1 file changed, 244 insertions(+)
 create mode 100644 docs/INDEPENDENT-REVIEW-REPRODUCTION-AND-SIGNING.md

diff --git a/docs/INDEPENDENT-REVIEW-REPRODUCTION-AND-SIGNING.md b/docs/INDEPENDENT-REVIEW-REPRODUCTION-AND-SIGNING.md
new file mode 100644
index 0000000..5707760
--- /dev/null
+++ b/docs/INDEPENDENT-REVIEW-REPRODUCTION-AND-SIGNING.md
@@ -0,0 +1,244 @@
+# Runbook de reproducción y firma independiente de S-001A
+
+Este procedimiento debe ejecutarse por una persona distinta del autor del paquete y en un entorno controlado por esa persona. La firma del manifest prueba integridad y autenticidad del paquete; la attestation del revisor prueba que la reproducción fue realizada por una autoridad independiente. Ninguna de las dos, por separado, cambia automáticamente el gate.
+
+## 0. Precondiciones
+
+El revisor debe recibir por canales separados:
+
+| Artefacto | Origen requerido |
+|---|---|
+| Repositorio y commit congelado | GitHub / owner del paquete |
+| Certificado público de raíz | Trust authority, fuera de GitHub |
+| Fingerprint esperado de la raíz | Trust authority, canal fuera de banda |
+| Certificado público del signer | Trust authority |
+| Firma detached del manifest | Signing authority |
+| Manifest canónico | Owner del paquete |
+| SBOM y hashes auxiliares | Owner del paquete |
+| Identidad y clave del revisor | Organización del revisor, HSM o almacén protegido |
+
+No se deben solicitar ni copiar claves privadas del owner o de la autoridad firmante.
+
+## 1. Obtener el commit congelado
+
+```bash
+set -euo pipefail
+umask 077
+
+WORK="$HOME/castuo-review-s001a-$(date -u +%Y%m%dT%H%M%SZ)"
+git clone https://github.com/Traky12/Castuo-system.git "$WORK/repo"
+cd "$WORK/repo"
+git fetch --tags origin
+
+git checkout --detach 2106b27
+git rev-parse HEAD
+```
+
+El revisor debe confirmar que el commit coincide con el commit comunicado por el owner. Si no coincide, detenerse con `BLOCK`.
+
+## 2. Comprobar que no hay cambios locales
+
+```bash
+git status --porcelain
+
+test -z "$(git status --porcelain)" || {
+  echo "BLOCK: working tree is not clean"
+  exit 1
+}
+```
+
+## 3. Validar sintaxis, manifest y scripts
+
+```bash
+python3 -m json.tool \
+  governance/evidence/E3-001-S001A/package-closure-manifest-2026-08-20.json \
+  > /dev/null
+
+python3 -m json.tool \
+  governance/evidence/E3-001-S001A/security-gate-decision.json \
+  > /dev/null
+
+python3 -m json.tool \
+  governance/evidence/E3-001-S001A/gate-state.json \
+  > /dev/null
+
+python3 -m compileall -q scripts/assurance
+find scripts/assurance -type d -name __pycache__ -prune -exec rm -rf {} +
+```
+
+## 4. Reproducir S-001A
+
+```bash
+python3 governance/evidence/E3-001-S001A/scripts/replay_s001a.py \
+  --fixture governance/evidence/E3-001-S001A/fixtures/S-001A-frozen-fixture.json \
+  --output "$WORK/local-replay.json" \
+  | tee "$WORK/replay.stdout"
+
+python3 scripts/assurance/foreign_verify_s001a.py \
+  governance/evidence/E3-001-S001A/fixtures/S-001A-frozen-fixture.json \
+  governance/evidence/E3-001-S001A/replay-result.json \
+  | tee "$WORK/foreign-verification.stdout"
+```
+
+El resultado esperado es `PASS_LOCAL_NO_CLAIM` para el replay y `PASS_FOREIGN_SEMANTIC_REPLAY` para la verificación semántica. El scope debe permanecer `S-001A`.
+
+## 5. Ejecutar pruebas negativas
+
+```bash
+python3 scripts/assurance/run_negative_security_cases.py \
+  | tee "$WORK/negative-security-tests.stdout"
+```
+
+Cada caso debe observar `BLOCK`: manifest alterado, estado desconocido, expansión de scope y fallo de replay. Cualquier `ALLOW`, `PROMOTE` o caso no ejecutado es un bloqueo.
+
+## 6. Verificar la raíz y la firma del manifest
+
+El revisor debe copiar los siguientes artefactos desde la autoridad correspondiente a un directorio protegido que no se versionará:
+
+```text
+$WORK/trust/root-ca.cert.pem
+$WORK/trust/root-ca.cert.sha256
+$WORK/trust/staging-signer.cert.pem
+$WORK/trust/evidence-manifest.sig
+```
+
+No se debe generar una raíz temporal para esta verificación. La raíz aprobada debe llegar por el canal de trust authority.
+
+```bash
+ROOT_CERT="$WORK/trust/root-ca.cert.pem"
+SIGNER_CERT="$WORK/trust/staging-signer.cert.pem"
+SIGNATURE="$WORK/trust/evidence-manifest.sig"
+MANIFEST="governance/evidence/E3-001-S001A/package-closure-manifest-2026-08-20.json"
+EXPECTED_ROOT_FP=$(tr -d '[:space:]' < "$WORK/trust/root-ca.cert.sha256")
+
+openssl x509 -in "$ROOT_CERT" -outform DER \
+  | sha256sum | awk '{print toupper($1)}'
+
+scripts/assurance/verify_signed_manifest.sh \
+  --manifest "$MANIFEST" \
+  --signature "$SIGNATURE" \
+  --signer-cert "$SIGNER_CERT" \
+  --root-cert "$ROOT_CERT" \
+  --expected-root-fingerprint "$EXPECTED_ROOT_FP"
+```
+
+El único resultado aceptable es `PASS: trust root, signer chain and manifest signature verified`. La autoridad de confianza debe comprobar además vigencia, revocación, propósito del certificado y que el fingerprint fue aprobado fuera de banda.
+
+## 7. Ejecutar rollback en entorno propio autorizado
+
+El revisor no debe declarar rollback operacional basándose sólo en el simulador local del owner. Si dispone de una ventana de staging aprobada, debe crear su propio registro de autorización:
+
+```bash
+cat > "$WORK/staging-authorization.json" <<'EOF'
+{
+  "authorized": true,
+  "environment": "staging",
+  "scope": "S-001A",
+  "remote_side_effects": false,
+  "owner": "REPLACE_WITH_OPERATIONS_OWNER",
+  "window_id": "REPLACE_WITH_APPROVED_CHANGE_WINDOW"
+}
+EOF
+```
+
+Después debe ejecutar el simulador o runbook operacional aprobado, conservar logs, hashes pre/post, estado restaurado, evidencia preservada, tiempos de detección/recuperación y retest. Para un simulacro puramente local:
+
+```bash
+python3 scripts/assurance/simulate_authorized_rollback.py \
+  --sandbox "$WORK/staging-sandbox" \
+  --authorization-file "$WORK/staging-authorization.json" \
+  --environment staging \
+  --fault corrupt-evidence \
+  --output "$WORK/authorized-staging-rollback.json"
+```
+
+El resultado esperado es `PASS_STAGING_NO_PRODUCTION_CLAIM`. Esto demuestra el procedimiento del simulador, pero sólo el owner operacional puede decidir si constituye evidencia suficiente de rollback representativo.
+
+## 8. Crear el registro de revisión independiente
+
+El revisor debe completar una copia del registro sin cambiar el fixture ni el script:
+
+```bash
+cp governance/evidence/E3-001-S001A/independent-review/review-record.yaml \
+  "$WORK/review-record.yaml"
+```
+
+Debe rellenar identidad, organización, conflicto de interés, fecha, commit, comandos, hashes, resultados, desviaciones, limitaciones y recomendación. Un registro mínimo aprobado debe incluir:
+
+```yaml
+reviewer:
+  reviewer_id: REPLACE_WITH_REAL_REVIEWER_ID
+  organization: REPLACE_WITH_ORGANIZATION
+  independence: CONFIRMED
+  conflict_check: CLEAR
+execution:
+  package_commit: 2106b27
+  observed_decision: APPROVED_WITHIN_DECLARED_SCOPE
+  observed_status: PASS_LOCAL_NO_CLAIM
+  evidence_hashes_verified: true
+  negative_tests_reproduced: true
+  rollback_reproduced: true
+review:
+  review_date: REPLACE_WITH_UTC_DATE
+  limitations_acknowledged: true
+  recommendation: APPROVED_WITHIN_DECLARED_SCOPE
+promotion_impact:
+  one_r: true
+  one_a: false
+  gate_status: REVIEW_READY_NOT_PROMOTED
+  claim: LOCAL_RESULT_NO_CLAIM
+```
+
+No se debe marcar `one_r: true` hasta completar realmente la reproducción.
+
+## 9. Firmar la attestation del revisor
+
+La clave privada debe estar en el HSM o almacén protegido del revisor. No se debe crear una clave desechable para simular independencia.
+
+```bash
+openssl dgst -sha256 \
+  -sign "$REVIEWER_PRIVATE_KEY" \
+  -out "$WORK/review-record.yaml.sig" \
+  "$WORK/review-record.yaml"
+
+openssl x509 -in "$REVIEWER_CERT" -pubkey -noout \
+  > "$WORK/reviewer-public-key.pem"
+
+openssl dgst -sha256 \
+  -verify "$WORK/reviewer-public-key.pem" \
+  -signature "$WORK/review-record.yaml.sig" \
+  "$WORK/review-record.yaml"
+```
+
+La organización debe conservar el certificado o identidad pública del revisor, el fingerprint, el método de revocación y la relación entre el revisor y la decisión. La firma se adjunta como attestation, no como sustituto de la decisión del gate.
+
+## 10. Entregar el paquete al gate authority
+
+```bash
+sha256sum \
+  "$WORK/review-record.yaml" \
+  "$WORK/review-record.yaml.sig" \
+  "$WORK/foreign-verification.stdout" \
+  "$WORK/negative-security-tests.stdout" \
+  "$WORK/authorized-staging-rollback.json" \
+  > "$WORK/reviewer-artifact-hashes.sha256"
+```
+
+El gate authority debe comprobar que el commit, manifest, firma, reviewer attestation y rollback pertenecen al mismo scope y versión. Sólo después puede actualizar los estados binarios. El revisor no debe cambiar directamente `gate-state.json` para forzar `PROMOTE`.
+
+## Criterio final
+
+El estado puede cambiar a `PROMOTE` sólo si la organización confirma simultáneamente:
+
+```text
+capability
+∧ evidence
+∧ replay
+∧ security
+∧ sovereignty
+∧ resilience
+∧ independent_review
+∧ rollback_verified
+```
+
+Una firma local válida, un reviewer record sin attestation, un rollback simulado o un check de CI en verde por sí solos no satisfacen el predicado.

From eea90687002b90ddceb5e86fd0129dc3cc13afd9 Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Sat, 22 Aug 2026 04:49:02 +0000
Subject: [PATCH 3/6] docs: synchronize CASTUO ecosystem evidence boundary

---
 .../CASTUO-ECOSYSTEM-SYNC-2026-08-22.md       | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md

diff --git a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
new file mode 100644
index 0000000..00fa990
--- /dev/null
+++ b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
@@ -0,0 +1,31 @@
+# CASTÚO ecosystem sync — 2026-08-22
+
+This repository participates in the CASTÚO-SYSTEM integration graph as **Portable evidence and replay package**.
+
+## Canonical source
+
+The current canonical root is [](https://github.com/Traky12/Castuo-system). The synchronized core checkpoint is .
+
+The source repository contains the binary promotion model, SABIONDA authority boundaries, detached Ed25519 non-repudiation controls, EU AI Act applicability dossier, HSM/revocation assurance material, required-check guidance, hardened self-hosted runner plan, local runner acceptance simulator, and the canonical Evidence Pack.
+
+## Integration boundary
+
+This file is a navigation and provenance pointer. It does not copy core implementation into this repository, does not create a production authorization, and does not assert independent review, field validation, trust-root ceremony, vendor exit, or EU AI Act approval. Repository-specific implementation and evidence remain authoritative only when linked to a verifiable commit and replayable artifact.
+
+The current ecosystem state is:
+
+
+
+## Required evidence boundary
+
+A local validation is  / . Promotion requires the conjunctive binary gate, including independent review, external trust-root attestation, authorized rollback evidence, required GitHub checks and legal review where applicable. Unknown, missing or non-replayable evidence remains .
+
+## Navigation
+
+- Root architecture: [](https://github.com/Traky12/Castuo-system)
+- Integration status: [](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/GITHUB-INTEGRATION-STATUS.md)
+- Ecosystem matrix: [](https://github.com/Traky12/Castuo-system/blob/main/docs/architecture/ECOSYSTEM-INTEGRATION-MATRIX-2026-08-20.md)
+- Runner acceptance guide: [](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/REQUIRED-CHECKS-AND-RUNNER-ACCEPTANCE.md)
+- Evidence Center: [](https://github.com/Traky12/castuo-evidence)
+
+This pointer must be reviewed independently before being used as evidence for any external or production claim.

From ab98778e83f88b1d9969ad9b36fc54257caba18e Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Sat, 22 Aug 2026 04:50:55 +0000
Subject: [PATCH 4/6] docs: synchronize CASTUO ecosystem evidence boundary

---
 .../CASTUO-ECOSYSTEM-SYNC-2026-08-22.md       | 21 ++++++++++++-------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
index 00fa990..43fede7 100644
--- a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
+++ b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
@@ -4,7 +4,7 @@ This repository participates in the CASTÚO-SYSTEM integration graph as **Portab
 
 ## Canonical source
 
-The current canonical root is [](https://github.com/Traky12/Castuo-system). The synchronized core checkpoint is .
+The current canonical root is [Traky12/Castuo-system](https://github.com/Traky12/Castuo-system). The synchronized core checkpoint is `04362ef5aa6e439c2c4557c1be923f30d2b2b8a5`.
 
 The source repository contains the binary promotion model, SABIONDA authority boundaries, detached Ed25519 non-repudiation controls, EU AI Act applicability dossier, HSM/revocation assurance material, required-check guidance, hardened self-hosted runner plan, local runner acceptance simulator, and the canonical Evidence Pack.
 
@@ -14,18 +14,23 @@ This file is a navigation and provenance pointer. It does not copy core implemen
 
 The current ecosystem state is:
 
-
+```text
+PROMOTION=BLOCKED
+PRODUCTION=NOT_AUTHORIZED
+CLAIM=LOCAL_RESULT_NO_CLAIM
+REMOTE_RUNNER=NOT_AVAILABLE_AT_LAST_AUDIT
+```
 
 ## Required evidence boundary
 
-A local validation is  / . Promotion requires the conjunctive binary gate, including independent review, external trust-root attestation, authorized rollback evidence, required GitHub checks and legal review where applicable. Unknown, missing or non-replayable evidence remains .
+A local validation is `VALIDATED_LOCAL` / `LOCAL_RESULT_NO_CLAIM`. Promotion requires the conjunctive binary gate, including independent review, external trust-root attestation, authorized rollback evidence, required GitHub checks and legal review where applicable. Unknown, missing or non-replayable evidence remains `BLOCKED`.
 
 ## Navigation
 
-- Root architecture: [](https://github.com/Traky12/Castuo-system)
-- Integration status: [](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/GITHUB-INTEGRATION-STATUS.md)
-- Ecosystem matrix: [](https://github.com/Traky12/Castuo-system/blob/main/docs/architecture/ECOSYSTEM-INTEGRATION-MATRIX-2026-08-20.md)
-- Runner acceptance guide: [](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/REQUIRED-CHECKS-AND-RUNNER-ACCEPTANCE.md)
-- Evidence Center: [](https://github.com/Traky12/castuo-evidence)
+- Root architecture: [Castuo-system](https://github.com/Traky12/Castuo-system)
+- Integration status: [GITHUB-INTEGRATION-STATUS.md](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/GITHUB-INTEGRATION-STATUS.md)
+- Ecosystem matrix: [ECOSYSTEM-INTEGRATION-MATRIX-2026-08-20.md](https://github.com/Traky12/Castuo-system/blob/main/docs/architecture/ECOSYSTEM-INTEGRATION-MATRIX-2026-08-20.md)
+- Runner acceptance guide: [REQUIRED-CHECKS-AND-RUNNER-ACCEPTANCE.md](https://github.com/Traky12/Castuo-system/blob/main/docs/governance/REQUIRED-CHECKS-AND-RUNNER-ACCEPTANCE.md)
+- Evidence Center: [castuo-evidence](https://github.com/Traky12/castuo-evidence)
 
 This pointer must be reviewed independently before being used as evidence for any external or production claim.

From 7e2237f22be619381a346375c71adcb952f5c36d Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Sat, 22 Aug 2026 05:01:29 +0000
Subject: [PATCH 5/6] docs: add deep ecosystem audit boundary

---
 docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
index 43fede7..3f757f9 100644
--- a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
+++ b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
@@ -34,3 +34,11 @@ A local validation is `VALIDATED_LOCAL` / `LOCAL_RESULT_NO_CLAIM`. Promotion req
 - Evidence Center: [castuo-evidence](https://github.com/Traky12/castuo-evidence)
 
 This pointer must be reviewed independently before being used as evidence for any external or production claim.
+
+## Deep audit — 2026-08-22
+
+The deep cross-repository audit found this integration branch ahead of its default branch with no branch divergence after the latest synchronization pass. The repository is included in the canonical audit scope, but GitHub reports zero registered Actions runners for the audited ecosystem. Therefore remote runner-dependent validation remains unexecuted.
+
+This repository must consume canonical promotion state and must not infer `PROMOTE` from implementation presence, local tests, dashboard status, or this pointer. Independent review, trust-root attestation, authorized rollback evidence and legal AI Act review remain separate binary predicates.
+
+Audit claim: `AUDIT_ONLY_NO_PROMOTION_CLAIM`.

From cf40032ed4b62aa5558147adbbebead21b8493df Mon Sep 17 00:00:00 2001
From: Traky12 <2.02805065e+08+Traky12@users.noreply.github.com>
Date: Sat, 22 Aug 2026 05:16:52 +0000
Subject: [PATCH 6/6] docs: record second ecosystem audit

---
 docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
index 3f757f9..a805fab 100644
--- a/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
+++ b/docs/governance/CASTUO-ECOSYSTEM-SYNC-2026-08-22.md
@@ -42,3 +42,11 @@ The deep cross-repository audit found this integration branch ahead of its defau
 This repository must consume canonical promotion state and must not infer `PROMOTE` from implementation presence, local tests, dashboard status, or this pointer. Independent review, trust-root attestation, authorized rollback evidence and legal AI Act review remain separate binary predicates.
 
 Audit claim: `AUDIT_ONLY_NO_PROMOTION_CLAIM`.
+
+## Deep audit round 2 — 2026-08-22
+
+The second audit compared integration and default branches, reviewed PR and protection state, and inspected representative failed workflows. All audited integration refs are ahead of their default branches with no behind or divergent ref observed. GitHub reports zero registered Actions runners across the audited graph. Root workflow jobs show no runner, no start time and zero steps, so they do not constitute test evidence.
+
+`Cast-o` has separate `failure` and `action_required` workflow results that require job-level investigation; they are not silently classified as runner failures. This repository must preserve the distinction between infrastructure absence, workflow failure, policy action required and successful execution.
+
+Audit claim: `AUDIT_ONLY_NO_PROMOTION_CLAIM`. Promotion remains blocked until security, review, rollback, trust-root and legal predicates are independently closed.