{
  "authorization_commit_sha_rule": "Use the fresh deployed SHA read back immediately before apply.",
  "authorization_gate_status": "ready_to_request_explicit_authorization",
  "authorization_scope": {
    "apply_order": [
      "mapped-rich-base",
      "cross-surface-anchor",
      "rio-strategy-context",
      "governance-concept-schema",
      "helmer-7powers"
    ],
    "expected_after_apply_counts": {
      "claim_concept_map_links": 1,
      "claim_edges": 18,
      "claim_evidence": 34,
      "claim_governance_gate_links": 2,
      "claims": 12,
      "concept_maps": 1,
      "cross_surface_anchor_updates": 1,
      "helmer_ledger_rows_marked_applied": 1,
      "reasoning_tools": 1,
      "rio_strategy_anchors": 5,
      "rio_strategy_nodes": 2,
      "sources": 28
    },
    "gcp_parity_in_scope": false,
    "packet_set": "integrated Working Leo packet set",
    "target": "VPS production Postgres canonical Working Leo packet apply",
    "telegram_visible_post_authorized": false
  },
  "checks": {
    "all_evidence_paths_exist": true,
    "direct_claim_score_passed": true,
    "read_only_preflight_passed": true,
    "receipt_template_not_final_receipt": true,
    "receipt_validator_still_missing_receipt": true,
    "runbook_ready_not_executed": true,
    "session_plan_not_executed_and_gated": true
  },
  "claim_ceiling": "This packet requests explicit authorization and proves the request is bounded by retained evidence. It does not authorize production apply, does not run SQL, does not mutate production, and does not prove canonical rows were changed.",
  "clear_CTA": "If you want this production DB apply to run, first let Codex re-read the deployed SHA, then reply with the authorization sentence in `explicit_operator_authorization_text_template` after replacing `<DEPLOYED_SHA_READBACK>` with that SHA, plus the operator identity to record in the receipt.",
  "do_not_run_without": [
    "Exact operator authorization text naming production DB apply scope.",
    "Operator identity for the production receipt.",
    "Fresh preflight immediately before apply."
  ],
  "evidence_paths": {
    "direct_claim_score": {
      "bytes": 18108,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.json"
    },
    "preflight": {
      "bytes": 12598,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.json"
    },
    "receipt_template": {
      "bytes": 4889,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-template-current.json"
    },
    "receipt_validation": {
      "bytes": 986,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-validation-current.json"
    },
    "runbook": {
      "bytes": 18329,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.json"
    },
    "session_plan": {
      "bytes": 28799,
      "exists": true,
      "path": "docs/reports/leo-working-state-20260709/working-leo-authorized-apply-session-plan-current.json"
    }
  },
  "explicit_operator_authorization_text_template": "I authorize production DB apply for the integrated Working Leo packet set on VPS using deployed commit <DEPLOYED_SHA_READBACK> in this order: mapped-rich-base, cross-surface-anchor, rio-strategy-context, governance-concept-schema, helmer-7powers. Run preflight immediately before each phase, run the authorized apply SQL, run every postflight, run the non-posting direct-claim regression and scorer, capture service and cleanup readbacks, validate the production receipt, and do not post Telegram-visible messages unless separately authorized.",
  "generated_at_utc": "2026-07-13T01:12:12.771226+00:00",
  "mode": "production_apply_authorization_packet_not_executed",
  "next_non_user_action_after_authorization": [
    "Re-read deployed SHA, service state, and production preflight baseline.",
    "Run each packet phase in manifest order: preflight, authorized apply SQL, postflight.",
    "Run the non-posting direct-claim handler suite and strict scorer.",
    "Capture service readback, cleanup readback, and production receipt.",
    "Run the offline production receipt validator and retain the validation artifacts."
  ],
  "packet_generation_git_sha": "bef10341e9cc31f41cb5fbd0a55119f1766e41fd",
  "production_apply_authorization_present": false,
  "production_apply_executed": false,
  "ready_to_request_authorization": true
}
