{
  "schema": "livingip.observatoryReadAdapterOidcReadinessReceipt.v1",
  "status": "partial_oidc_t2",
  "required_runtime_tier": "T3_live_gcp_staging_api",
  "current_runtime_tier": "T2_authenticated_github_oidc_partial_inventory",
  "workflow": {
    "run_id": 29389090997,
    "url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997",
    "revision": "33399bd9acfa09e4e5409873e86c8c46ac694a8d",
    "ref": "refs/heads/main",
    "identity": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com",
    "wif_authentication": "pass",
    "gcloud_setup": "pass",
    "checker_execution": "pass",
    "artifact_upload": "pass",
    "credential_cleanup": "pass",
    "job_conclusion": "failure_due_to_blocked_readiness_enforcement"
  },
  "summary": {
    "pass_count": 8,
    "blocked_count": 10,
    "fail_count": 0,
    "passed_checks": [
      "artifact_repositories",
      "cloud_build_contract",
      "github_actions_readiness_ci",
      "gcp_cloudsql_restore_drill_contract",
      "canonical_postgres_restore_contract",
      "local_canonical_postgres_restore_preflight",
      "gcp_runtime_baseline_contract",
      "gcp_service_communications_contract"
    ],
    "permission_or_resource_read_blocks": [
      {
        "check": "cloud_build_service_account",
        "missing_permission": "iam.serviceAccounts.get"
      },
      {
        "check": "github_actions_artifact_ci",
        "missing_permission": "iam.workloadIdentityPoolProviders.get"
      },
      {
        "check": "network_ingress",
        "missing_permission": "compute.firewalls.list"
      },
      {
        "check": "compute_runtime_service_accounts",
        "missing_permission": "compute.instances.list"
      },
      {
        "check": "compute_disk_snapshots",
        "missing_permission": "compute.resourcePolicies.get"
      },
      {
        "check": "backup_buckets",
        "missing_permission": "bucket metadata read denied; exact permission was not retained by the checker"
      },
      {
        "check": "cloud_sql_standby_target",
        "missing_permission": "Cloud SQL instance read denied or target invisible to this identity"
      },
      {
        "check": "kb_source_restore_access",
        "missing_permission": "secretmanager.secrets.list"
      }
    ],
    "evidence_blocks": [
      "local_sqlite_postgres_restore_canary",
      "kb_restore_or_replication"
    ]
  },
  "security_readback": {
    "artifact_builder_deploy_authorized": false,
    "cloud_run_service_created": false,
    "cloud_sql_queried": false,
    "secret_values_logged": false,
    "production_or_vercel_routing_changed": false
  },
  "source_artifact": {
    "github_run_url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997",
    "artifact_name": "gcp-readiness",
    "summary_sha256": "6a1be356c069b8affacc492ac3b1e1ca63b917f92a32d7d886511a226c52925b",
    "checker_sha256": "56ce4e8ba655a47e6e620a2c7039ee54fa10b1c53431d1dc6ec4db5189bb17f5",
    "local_download_path": "/private/tmp/observatory-read-adapter-oidc-29389090997/gcp-readiness"
  },
  "proof_paths": [
    "docs/reports/observatory-read-adapter/gcp-oidc-readiness-29389090997-redacted.json",
    "https://github.com/living-ip/teleo-infrastructure/actions/runs/29389090997"
  ],
  "claim_ceiling": "GitHub OIDC and the artifact-only identity work. The receipt does not prove broad GCP inventory, adapter prerequisites, a live Cloud Run service, or a teleo_canonical query."
}