{
  "schema": "host-integration-dependency/v1",
  "meta": {
    "author": "Lukas Bower",
    "purpose": "Bind advertised host surfaces and use cases to exact integration obligations.",
    "milestone": "Milestone 26e — generated host-integration and use-case dependency contract",
    "graph_id": "m26e-host-integration",
    "source_sha256": "b1e498b4af0de89b2c07cabbdac1327285bce4cb591dbfea071f554ad6acaa56",
    "resolved_manifest_sha256": "0fd40c602c76806c30de6963765e4d4b4057716da238c1d6fc14d8fb20858f11",
    "implementation_surface_inventory_sha256": "cbde9ce076eecd01a78a9ac3243b43e4d9a8279c54a957fd8e1fe31fa80caff6"
  },
  "host_profiles": [
    {
      "id": "linux-aarch64",
      "os": "linux",
      "architectures": [
        "aarch64"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ]
    },
    {
      "id": "linux-x86-64",
      "os": "linux",
      "architectures": [
        "x86_64"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ]
    },
    {
      "id": "macos-arm64",
      "os": "macos",
      "architectures": [
        "aarch64"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ]
    }
  ],
  "dependencies": [
    {
      "id": "a2a-gateway",
      "owner": "future-a2a-gateway",
      "owning_milestone": "m28c-a2a-policy-ir",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m28c-a2a-policy-ir",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "A2A"
      ]
    },
    {
      "id": "authenticated-console-projection",
      "owner": "host-shell",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu",
        "worker-heartbeat",
        "worker-lora"
      ],
      "use_cases": [
        "agent-action-airlock",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "mac-endpoint-compliance",
        "mac-release-factory"
      ],
      "namespace_paths": [
        "/queen/ctl"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "worker-control"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "dry-run",
        "live"
      ],
      "unavailable_owner": "host-shell",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "close one authenticated console session",
      "idempotency": "command and target receipt correlation",
      "fencing": "role-scoped capability ticket",
      "readiness": "transport authentication does not imply Worker READY",
      "degraded": "typed unavailable or connection failure",
      "package_requirements": [
        "bin/coh",
        "bin/cohsh"
      ],
      "artifact_requirements": [
        "authenticated transcript"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "coh",
        "cohsh",
        "console"
      ]
    },
    {
      "id": "cas-artifact",
      "owner": "cas-host-tool",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "model-rollout-flight-recorder",
        "private-lora-foundry"
      ],
      "playbooks": [
        "mac-private-peft-grid",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/queen/export/ctl"
      ],
      "actions": [
        "peft.export",
        "peft.import"
      ],
      "schemas": [
        "host-ticket/v2"
      ],
      "dependencies": [],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "fixture",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "cas-host-tool",
      "auth_refs": [],
      "timeout_ms": 10000,
      "retry_limit": 1,
      "cancel": "abort before publish",
      "idempotency": "content digest",
      "fencing": "public verification key and manifest digest",
      "readiness": "verified artifact is separate from Worker or provider readiness",
      "degraded": "missing or mismatched artifact",
      "package_requirements": [
        "bin/cas-tool",
        "resources/keys/cas_verification_key.hex"
      ],
      "artifact_requirements": [
        "CAS manifest hash",
        "public verification result"
      ],
      "evidence_lane": "artifact-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "CAS",
        "artifact"
      ]
    },
    {
      "id": "docker-provider",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "agent-action-airlock",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "mac-endpoint-compliance",
        "mac-private-peft-grid",
        "mac-release-factory"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [
        "docker.restart",
        "docker.status-check",
        "docker.stop"
      ],
      "schemas": [
        "host-ticket-result/v1",
        "host-ticket/v1"
      ],
      "dependencies": [
        "host-ticket-executor"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment Docker provider",
      "auth_refs": [],
      "timeout_ms": 30000,
      "retry_limit": 1,
      "cancel": "provider-specific bounded cancellation",
      "idempotency": "ticket id and observed container state",
      "fencing": "host-ticket agent fence",
      "readiness": "Docker availability is not Worker READY",
      "degraded": "explicit unavailable result",
      "package_requirements": [
        "external Docker runtime"
      ],
      "artifact_requirements": [
        "provider version",
        "redacted action receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "Docker",
        "container"
      ]
    },
    {
      "id": "federation-provider",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "multi-hive-mission-control"
      ],
      "playbooks": [
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [
        "gpu.lease.grant",
        "gpu.lease.release",
        "gpu.lease.renew"
      ],
      "schemas": [
        "host-ticket-result/v1",
        "host-ticket/v1"
      ],
      "dependencies": [
        "host-ticket-executor",
        "rest-gateway-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment federation peer",
      "auth_refs": [
        "env:COHESIX_RELAY_TOKEN"
      ],
      "timeout_ms": 30000,
      "retry_limit": 2,
      "cancel": "bounded relay deadline",
      "idempotency": "ticket id peer and relay cursor",
      "fencing": "local agent lock and remote auth reference",
      "readiness": "peer connectivity does not imply Worker READY",
      "degraded": "peer unavailable with retained local receipt",
      "package_requirements": [
        "bin/host-ticket-agent",
        "external accepted peer"
      ],
      "artifact_requirements": [
        "peer identity",
        "relay receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "federation",
        "multi-hive",
        "relay"
      ]
    },
    {
      "id": "fuse-mount-projection",
      "owner": "host-cli",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "multi-hive-mission-control"
      ],
      "playbooks": [
        "mixed-logistics-digital-twin"
      ],
      "namespace_paths": [
        "/"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "rest-gateway-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "host FUSE environment",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "unmount and close gateway session",
      "idempotency": "read path and bounded write request",
      "fencing": "authenticated gateway identity",
      "readiness": "mounted projection does not imply provider or Worker readiness",
      "degraded": "typed unsupported or unavailable mount",
      "package_requirements": [
        "bin/coh",
        "host FUSE support"
      ],
      "artifact_requirements": [
        "mount conformance transcript"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "FUSE",
        "filesystem mount",
        "mount"
      ]
    },
    {
      "id": "general-inference-provider",
      "owner": "future-inference-boundary",
      "owning_milestone": "m27e-inference-ir-and-compatibility-contract",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27e-inference-ir-and-compatibility-contract",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "OpenAI-compatible",
        "inference"
      ]
    },
    {
      "id": "general-training-provider",
      "owner": "future-ai-provider",
      "owning_milestone": "m27d-live-peft-reference-paths",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27d-live-peft-reference-paths",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "general training",
        "training runtime"
      ]
    },
    {
      "id": "gpu-host-provider",
      "owner": "gpu-host-bridge",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "gpu-flight-deck",
        "model-rollout-flight-recorder",
        "private-lora-foundry"
      ],
      "playbooks": [
        "mac-private-peft-grid",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/gpu"
      ],
      "actions": [
        "gpu.lease.grant",
        "gpu.lease.release",
        "gpu.lease.renew"
      ],
      "schemas": [
        "gpu-lease/v1",
        "host-ticket-result/v1"
      ],
      "dependencies": [
        "host-ticket-executor"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment GPU provider",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 30000,
      "retry_limit": 1,
      "cancel": "provider result deadline",
      "idempotency": "lease id and provider observation",
      "fencing": "lease epoch and host ticket fence",
      "readiness": "live NVML or CUDA inventory is separate from WorkerGpu READY",
      "degraded": "zero-device and unavailable are explicit",
      "package_requirements": [
        "bin/gpu-bridge-host",
        "external NVML or CUDA provider"
      ],
      "artifact_requirements": [
        "provider version",
        "redacted provider receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "CUDA",
        "GPU provider",
        "NVIDIA",
        "NVML"
      ]
    },
    {
      "id": "gpu-receipt-path",
      "owner": "worker-supervisor",
      "owning_milestone": "m26e-host-worker-integration",
      "class": "target-runtime",
      "obligation": "role_required",
      "host_profiles": [
        "linux-aarch64",
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu"
      ],
      "use_cases": [
        "gpu-flight-deck",
        "model-rollout-flight-recorder"
      ],
      "playbooks": [
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/gpu",
        "/gpu/<id>/lease",
        "/shard/<label>/worker/<id>/telemetry"
      ],
      "actions": [
        "gpu.lease.grant",
        "gpu.lease.release",
        "gpu.lease.renew"
      ],
      "schemas": [
        "gpu-lease/v1",
        "host-ticket-result/v2",
        "host-ticket/v2"
      ],
      "dependencies": [
        "worker-control"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "live"
      ],
      "unavailable_owner": "worker-supervisor",
      "auth_refs": [],
      "timeout_ms": 5000,
      "retry_limit": 0,
      "cancel": "bounded supervisor shutdown or revoke",
      "idempotency": "receipt sequence plus Worker generation",
      "fencing": "lease epoch supervisor generation and cap generation",
      "readiness": "durable WorkerGpu READY precedes admitted work",
      "degraded": "faulted or stale receipt is explicit and cannot become READY",
      "package_requirements": [
        "cohesix-worker-images.cpio",
        "worker-gpu"
      ],
      "artifact_requirements": [
        "target transcript",
        "worker component evidence"
      ],
      "evidence_lane": "target-session",
      "mandatory_target_session": true,
      "advertised_terms": [
        "GPU receipt",
        "WorkerGpu"
      ]
    },
    {
      "id": "host-ticket-executor",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "agent-action-airlock",
        "gpu-flight-deck",
        "model-rollout-flight-recorder",
        "multi-hive-mission-control",
        "private-lora-foundry",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "jetson-manufacturing-safety",
        "jetson-traffic-safety",
        "mac-endpoint-compliance",
        "mac-private-peft-grid",
        "mac-release-factory",
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [
        "docker.restart",
        "docker.status-check",
        "docker.stop",
        "gpu.lease.grant",
        "gpu.lease.release",
        "gpu.lease.renew",
        "k8s.cordon",
        "k8s.drain",
        "k8s.lease.sync",
        "peft.activate",
        "peft.export",
        "peft.import",
        "peft.rollback",
        "systemd.restart",
        "systemd.start",
        "systemd.status-check",
        "systemd.stop"
      ],
      "schemas": [
        "host-ticket-result/v2",
        "host-ticket/v2"
      ],
      "dependencies": [
        "authenticated-console-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "host-ticket-agent",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 30000,
      "retry_limit": 1,
      "cancel": "bounded action deadline and terminal journal",
      "idempotency": "ticket id action and provider observation",
      "fencing": "single local agent lock and cursor",
      "readiness": "admitted or executed ticket is not Worker READY",
      "degraded": "typed dead-letter or provider-unavailable receipt",
      "package_requirements": [
        "bin/host-ticket-agent"
      ],
      "artifact_requirements": [
        "bounded action receipt",
        "journal identity"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "host action",
        "host ticket",
        "host-ticket-agent"
      ]
    },
    {
      "id": "industry-provider-family",
      "owner": "future-framework-adapters",
      "owning_milestone": "m27d-framework-adapters",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27d-framework-adapters",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "industry provider"
      ]
    },
    {
      "id": "kubernetes-provider",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "agent-action-airlock",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "jetson-manufacturing-safety",
        "jetson-traffic-safety",
        "mac-private-peft-grid",
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [
        "k8s.cordon",
        "k8s.drain",
        "k8s.lease.sync"
      ],
      "schemas": [
        "host-ticket-result/v1",
        "host-ticket/v1"
      ],
      "dependencies": [
        "host-ticket-executor"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment Kubernetes provider",
      "auth_refs": [
        "file-ref:kubeconfig"
      ],
      "timeout_ms": 60000,
      "retry_limit": 1,
      "cancel": "provider-specific bounded cancellation",
      "idempotency": "ticket id and observed resource version",
      "fencing": "host-ticket fence and provider resource version",
      "readiness": "Kubernetes availability is not Worker READY",
      "degraded": "explicit unavailable result",
      "package_requirements": [
        "external Kubernetes client and cluster"
      ],
      "artifact_requirements": [
        "provider version",
        "redacted action receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "Kubernetes",
        "cluster",
        "k8s"
      ]
    },
    {
      "id": "mcp-gateway",
      "owner": "future-mcp-gateway",
      "owning_milestone": "m28c-mcp-policy-ir",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m28c-mcp-policy-ir",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "MCP",
        "Model Context Protocol"
      ]
    },
    {
      "id": "nemo-provider",
      "owner": "future-nemo-provider",
      "owning_milestone": "m27d-nemo-provider-family",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27d-nemo-provider-family",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "NeMo"
      ]
    },
    {
      "id": "packaging",
      "owner": "release-tooling",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "packaging",
      "obligation": "release_required",
      "host_profiles": [
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "authenticated-console-projection",
        "cas-artifact",
        "host-ticket-executor",
        "python-sdk-projection",
        "rest-gateway-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "release-tooling",
      "auth_refs": [],
      "timeout_ms": 300000,
      "retry_limit": 0,
      "cancel": "atomic staging directory",
      "idempotency": "exact release manifest file set",
      "fencing": "version and artifact hashes",
      "readiness": "package presence is separate from runtime acceptance",
      "degraded": "missing or unexpected file fails closed",
      "package_requirements": [
        "cohesix runtime release manifest"
      ],
      "artifact_requirements": [
        "exact bundle file set",
        "release hashes"
      ],
      "evidence_lane": "release-validation",
      "mandatory_target_session": false,
      "advertised_terms": [
        "bundle",
        "package",
        "packaging",
        "release"
      ]
    },
    {
      "id": "peft-host-provider",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "model-rollout-flight-recorder",
        "private-lora-foundry"
      ],
      "playbooks": [
        "mac-private-peft-grid"
      ],
      "namespace_paths": [
        "/queen/export/ctl"
      ],
      "actions": [
        "peft.activate",
        "peft.export",
        "peft.import",
        "peft.rollback"
      ],
      "schemas": [
        "host-ticket-result/v2",
        "host-ticket/v2"
      ],
      "dependencies": [
        "cas-artifact",
        "host-ticket-executor"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment PEFT provider",
      "auth_refs": [],
      "timeout_ms": 120000,
      "retry_limit": 1,
      "cancel": "provider result deadline",
      "idempotency": "adapter digest and action receipt",
      "fencing": "host-ticket fence and model generation",
      "readiness": "provider result is separate from WorkerLora READY",
      "degraded": "missing trainer or runtime is explicit",
      "package_requirements": [
        "external PEFT trainer or runtime"
      ],
      "artifact_requirements": [
        "adapter digest",
        "redacted provider receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "LoRA",
        "PEFT",
        "adapter training"
      ]
    },
    {
      "id": "peft-receipt-path",
      "owner": "worker-supervisor",
      "owning_milestone": "m26e-host-worker-integration",
      "class": "target-runtime",
      "obligation": "role_required",
      "host_profiles": [
        "linux-aarch64",
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-lora"
      ],
      "use_cases": [
        "model-rollout-flight-recorder",
        "private-lora-foundry"
      ],
      "playbooks": [
        "mac-private-peft-grid"
      ],
      "namespace_paths": [
        "/queen/export/ctl",
        "/shard/<label>/worker/<id>/telemetry"
      ],
      "actions": [
        "peft.activate",
        "peft.export",
        "peft.import",
        "peft.rollback"
      ],
      "schemas": [
        "host-ticket-result/v2",
        "host-ticket/v2"
      ],
      "dependencies": [
        "worker-control"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "live"
      ],
      "unavailable_owner": "worker-supervisor",
      "auth_refs": [],
      "timeout_ms": 5000,
      "retry_limit": 0,
      "cancel": "bounded supervisor shutdown or revoke",
      "idempotency": "receipt sequence plus Worker generation",
      "fencing": "lease epoch supervisor generation and cap generation",
      "readiness": "durable WorkerLora READY precedes admitted work",
      "degraded": "faulted or stale receipt is explicit and cannot become READY",
      "package_requirements": [
        "cohesix-worker-images.cpio",
        "worker-lora"
      ],
      "artifact_requirements": [
        "target transcript",
        "worker component evidence"
      ],
      "evidence_lane": "target-session",
      "mandatory_target_session": true,
      "advertised_terms": [
        "LoRA receipt",
        "PEFT receipt",
        "WorkerLora"
      ]
    },
    {
      "id": "production-worker-bundle",
      "owner": "future-production-bundle",
      "owning_milestone": "m28b-production-worker-ticket-driver-inventory",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m28b-production-worker-ticket-driver-inventory",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "production Worker bundle"
      ]
    },
    {
      "id": "prometheus-otel-export",
      "owner": "future-inference-telemetry",
      "owning_milestone": "m27e-inference-receipts-otel-and-evidence",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27e-inference-receipts-otel-and-evidence",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "OpenTelemetry",
        "Prometheus"
      ]
    },
    {
      "id": "python-sdk-projection",
      "owner": "python-client",
      "owning_milestone": "m26e-python-library-as-built-compatibility",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu",
        "worker-heartbeat",
        "worker-lora"
      ],
      "use_cases": [
        "agent-action-airlock",
        "gpu-flight-deck",
        "model-rollout-flight-recorder",
        "multi-hive-mission-control",
        "private-lora-foundry",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "jetson-manufacturing-safety",
        "jetson-traffic-safety",
        "mac-endpoint-compliance",
        "mac-private-peft-grid",
        "mac-release-factory",
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/queen/ctl",
        "/shard/<label>/worker/<id>/telemetry"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "authenticated-console-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "python-client",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "close bounded client session",
      "idempotency": "request and receipt id",
      "fencing": "generated auth and namespace contract",
      "readiness": "SDK object state cannot create Worker READY",
      "degraded": "typed backend unavailable",
      "package_requirements": [
        "python/cohesix-py"
      ],
      "artifact_requirements": [
        "Python parity report"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "Python",
        "SDK",
        "cohesix-playbook"
      ]
    },
    {
      "id": "rest-gateway-projection",
      "owner": "host-gateway",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu",
        "worker-heartbeat",
        "worker-lora"
      ],
      "use_cases": [
        "agent-action-airlock",
        "multi-hive-mission-control"
      ],
      "playbooks": [
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin"
      ],
      "namespace_paths": [
        "/"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "authenticated-console-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "dry-run",
        "live"
      ],
      "unavailable_owner": "host-gateway",
      "auth_refs": [
        "env:COHESIX_GATEWAY_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "close bounded gateway request and console session",
      "idempotency": "HTTP request and Cohesix receipt id",
      "fencing": "authenticated delegated caller identity",
      "readiness": "HTTP success cannot imply Worker READY",
      "degraded": "typed gateway or target unavailable",
      "package_requirements": [
        "bin/hive-gateway",
        "resources/openapi/hive-gateway.yaml"
      ],
      "artifact_requirements": [
        "OpenAPI hash",
        "REST parity report"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "OpenAPI",
        "REST",
        "gateway"
      ]
    },
    {
      "id": "semantic-context",
      "owner": "future-semantic-context",
      "owning_milestone": "m27c-semantic-ir-and-object-contract",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27c-semantic-ir-and-object-contract",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "Context Capsule",
        "semantic object"
      ]
    },
    {
      "id": "sidecar-provider",
      "owner": "host-sidecar-bridge",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "optional",
      "host_profiles": [
        "linux-aarch64",
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "authenticated-console-projection"
      ],
      "required_modes": [
        "missing",
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment sidecar adapter",
      "auth_refs": [
        "env:COHESIX_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "close bridge session",
      "idempotency": "adapter scope and sequence",
      "fencing": "role-scoped ticket",
      "readiness": "model or fixture sidecar cannot satisfy live evidence",
      "degraded": "explicit unavailable",
      "package_requirements": [
        "bin/host-sidecar-bridge when selected",
        "bin/sidecar-bus with live,modbus,dnp3 when field-bus selected"
      ],
      "artifact_requirements": [
        "adapter classification",
        "exact native ACK WAL and interoperability inventory"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "DNP3",
        "Modbus",
        "sidecar"
      ]
    },
    {
      "id": "siem-evidence-export",
      "owner": "evidence-tooling",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [
        "multi-hive-mission-control",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "mac-endpoint-compliance"
      ],
      "namespace_paths": [
        "/log/queen.log",
        "/worker"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "python-sdk-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment SIEM sink",
      "auth_refs": [],
      "timeout_ms": 10000,
      "retry_limit": 1,
      "cancel": "bounded export file or sink request",
      "idempotency": "evidence record hash",
      "fencing": "manifest and target identity",
      "readiness": "export success cannot promote source evidence",
      "degraded": "local redacted NDJSON remains distinct from accepted sink",
      "package_requirements": [
        "python/cohesix-py"
      ],
      "artifact_requirements": [
        "redacted evidence hashes",
        "sink result"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "SIEM",
        "audit",
        "evidence"
      ]
    },
    {
      "id": "swarmui-projection",
      "owner": "operator-ui",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "host-projection",
      "obligation": "release_required",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu",
        "worker-heartbeat",
        "worker-lora"
      ],
      "use_cases": [
        "gpu-flight-deck",
        "self-healing-edge-swarm"
      ],
      "playbooks": [],
      "namespace_paths": [
        "/worker"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [
        "rest-gateway-projection"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "dry-run",
        "live"
      ],
      "unavailable_owner": "operator-ui",
      "auth_refs": [
        "env:COHESIX_GATEWAY_TOKEN"
      ],
      "timeout_ms": 5000,
      "retry_limit": 1,
      "cancel": "close bounded UI polling session",
      "idempotency": "generated row and evidence hash",
      "fencing": "authenticated gateway caller",
      "readiness": "UI labels cannot create Worker READY",
      "degraded": "explicit stale or unavailable view",
      "package_requirements": [
        "bin/swarmui",
        "ui assets"
      ],
      "artifact_requirements": [
        "UI parity report",
        "asset hashes"
      ],
      "evidence_lane": "projection-compatibility",
      "mandatory_target_session": false,
      "advertised_terms": [
        "SwarmUI",
        "UI"
      ]
    },
    {
      "id": "swarmui-workbench",
      "owner": "future-ui-workbench",
      "owning_milestone": "m27f-integration-truth-model",
      "class": "future-provider",
      "obligation": "future",
      "host_profiles": [
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [],
      "use_cases": [],
      "playbooks": [],
      "namespace_paths": [],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "disabled"
      ],
      "allowed_modes": [
        "missing",
        "disabled"
      ],
      "unavailable_owner": "m27f-integration-truth-model",
      "auth_refs": [],
      "timeout_ms": 1000,
      "retry_limit": 0,
      "cancel": "not implemented",
      "idempotency": "not implemented",
      "fencing": "not implemented",
      "readiness": "unavailable",
      "degraded": "typed future",
      "package_requirements": [],
      "artifact_requirements": [],
      "evidence_lane": "future",
      "mandatory_target_session": false,
      "advertised_terms": [
        "desktop workbench"
      ]
    },
    {
      "id": "systemd-provider",
      "owner": "host-ticket-agent",
      "owning_milestone": "m26e-host-integration-dependency-contract",
      "class": "external-provider",
      "obligation": "use_case_required",
      "host_profiles": [
        "linux-x86-64"
      ],
      "worker_roles": [],
      "use_cases": [
        "agent-action-airlock",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "jetson-manufacturing-safety",
        "jetson-traffic-safety"
      ],
      "namespace_paths": [
        "/host"
      ],
      "actions": [
        "systemd.restart",
        "systemd.start",
        "systemd.status-check",
        "systemd.stop"
      ],
      "schemas": [
        "host-ticket-result/v1",
        "host-ticket/v1"
      ],
      "dependencies": [
        "host-ticket-executor"
      ],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "missing",
        "disabled",
        "fixture",
        "mock",
        "dry-run",
        "live"
      ],
      "unavailable_owner": "deployment systemd provider",
      "auth_refs": [],
      "timeout_ms": 30000,
      "retry_limit": 1,
      "cancel": "provider-specific bounded cancellation",
      "idempotency": "ticket id and observed unit state",
      "fencing": "host-ticket agent fence",
      "readiness": "systemd unit availability is not Worker READY",
      "degraded": "explicit unsupported on non-systemd hosts",
      "package_requirements": [
        "external systemd runtime"
      ],
      "artifact_requirements": [
        "provider version",
        "redacted action receipt"
      ],
      "evidence_lane": "external-provider",
      "mandatory_target_session": false,
      "advertised_terms": [
        "service manager",
        "systemd"
      ]
    },
    {
      "id": "worker-control",
      "owner": "worker-supervisor",
      "owning_milestone": "m26e-host-worker-integration",
      "class": "target-runtime",
      "obligation": "role_required",
      "host_profiles": [
        "linux-aarch64",
        "linux-x86-64",
        "macos-arm64"
      ],
      "worker_roles": [
        "worker-gpu",
        "worker-heartbeat",
        "worker-lora"
      ],
      "use_cases": [
        "agent-action-airlock",
        "gpu-flight-deck",
        "model-rollout-flight-recorder",
        "multi-hive-mission-control",
        "private-lora-foundry",
        "self-healing-edge-swarm"
      ],
      "playbooks": [
        "jetson-critical-infra",
        "jetson-manufacturing-safety",
        "jetson-traffic-safety",
        "mac-endpoint-compliance",
        "mac-private-peft-grid",
        "mac-release-factory",
        "mixed-closed-loop-ai-factory",
        "mixed-logistics-digital-twin",
        "mixed-medical-edge-ai"
      ],
      "namespace_paths": [
        "/queen/ctl",
        "/shard/<label>/worker/<id>/telemetry"
      ],
      "actions": [],
      "schemas": [],
      "dependencies": [],
      "required_modes": [
        "live"
      ],
      "allowed_modes": [
        "live"
      ],
      "unavailable_owner": "worker-supervisor",
      "auth_refs": [],
      "timeout_ms": 5000,
      "retry_limit": 0,
      "cancel": "bounded shutdown then revoke",
      "idempotency": "exact role slot lease epoch and generation",
      "fencing": "compiler-owned capability generation",
      "readiness": "control acknowledgement remains distinct from durable READY",
      "degraded": "missing role or fault remains a typed blocker",
      "package_requirements": [
        "cohesix-worker-images.cpio",
        "worker-gpu",
        "worker-heart",
        "worker-lora"
      ],
      "artifact_requirements": [
        "target transcript",
        "worker component evidence"
      ],
      "evidence_lane": "target-session",
      "mandatory_target_session": true,
      "advertised_terms": [
        "Worker control",
        "Worker lifecycle"
      ]
    }
  ],
  "use_cases": [
    {
      "id": "agent-action-airlock",
      "title": "The Agent Action Airlock",
      "dependencies": [
        "authenticated-console-projection",
        "host-ticket-executor",
        "worker-control"
      ],
      "promotion": "requires a live Worker target session plus each selected external executor row"
    },
    {
      "id": "gpu-flight-deck",
      "title": "The GPU Flight Deck",
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path",
        "host-ticket-executor",
        "swarmui-projection",
        "worker-control"
      ],
      "promotion": "requires live provider inventory and separate exact WorkerGpu receipt proof"
    },
    {
      "id": "model-rollout-flight-recorder",
      "title": "Model Rollout with a Flight Recorder",
      "dependencies": [
        "cas-artifact",
        "gpu-host-provider",
        "gpu-receipt-path",
        "host-ticket-executor",
        "peft-host-provider",
        "peft-receipt-path",
        "worker-control"
      ],
      "promotion": "requires verified artifacts, live providers, and exact current-generation receipts"
    },
    {
      "id": "multi-hive-mission-control",
      "title": "Multi-Hive Mission Control",
      "dependencies": [
        "federation-provider",
        "rest-gateway-projection",
        "siem-evidence-export",
        "worker-control"
      ],
      "promotion": "requires independently accepted peers and target-bound evidence"
    },
    {
      "id": "private-lora-foundry",
      "title": "The Private LoRA Foundry",
      "dependencies": [
        "cas-artifact",
        "peft-host-provider",
        "peft-receipt-path",
        "worker-control"
      ],
      "promotion": "requires live host PEFT execution and a separate WorkerLora receipt"
    },
    {
      "id": "self-healing-edge-swarm",
      "title": "The Self-Healing Edge Swarm",
      "dependencies": [
        "host-ticket-executor",
        "siem-evidence-export",
        "worker-control"
      ],
      "promotion": "requires target Worker proof and every selected remediation provider"
    }
  ],
  "playbooks": [
    {
      "id": "jetson-critical-infra",
      "use_case": "agent-action-airlock",
      "dependencies": [
        "host-ticket-executor",
        "kubernetes-provider",
        "systemd-provider",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "jetson"
          }
        ],
        "execute_actions": [
          "modbus.read",
          "systemd.status-check"
        ],
        "recovery_actions": [
          "systemd.stop"
        ],
        "external_dependencies": [
          {
            "id": "critical-infra-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    },
    {
      "id": "jetson-manufacturing-safety",
      "use_case": "self-healing-edge-swarm",
      "dependencies": [
        "host-ticket-executor",
        "kubernetes-provider",
        "systemd-provider",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "jetson"
          }
        ],
        "execute_actions": [
          "systemd.start",
          "gpu.workload.submit"
        ],
        "recovery_actions": [
          "gpu.workload.cancel",
          "systemd.stop"
        ],
        "external_dependencies": [
          {
            "id": "manufacturing-safety-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    },
    {
      "id": "jetson-traffic-safety",
      "use_case": "self-healing-edge-swarm",
      "dependencies": [
        "host-ticket-executor",
        "kubernetes-provider",
        "systemd-provider",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "jetson"
          }
        ],
        "execute_actions": [
          "systemd.start",
          "gpu.workload.submit"
        ],
        "recovery_actions": [
          "gpu.workload.cancel",
          "systemd.stop"
        ],
        "external_dependencies": [
          {
            "id": "traffic-safety-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    },
    {
      "id": "mac-endpoint-compliance",
      "use_case": "agent-action-airlock",
      "dependencies": [
        "docker-provider",
        "host-ticket-executor",
        "siem-evidence-export",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "macos"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "macos"
          }
        ],
        "execute_actions": [
          "endpoint_compliance.observe"
        ],
        "recovery_actions": [
          "endpoint_compliance.observe"
        ],
        "external_dependencies": [],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "none",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "macos-controller"
      }
    },
    {
      "id": "mac-private-peft-grid",
      "use_case": "private-lora-foundry",
      "dependencies": [
        "cas-artifact",
        "docker-provider",
        "gpu-host-provider",
        "kubernetes-provider",
        "peft-host-provider",
        "peft-receipt-path",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "macos"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "remote-cuda"
          }
        ],
        "execute_actions": [
          "peft.export",
          "peft.import",
          "peft.activate"
        ],
        "recovery_actions": [
          "peft.rollback"
        ],
        "external_dependencies": [
          {
            "id": "m27d-peft-pipeline",
            "owner": "milestone-27d",
            "kind": "accepted_milestone"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "macos-controller"
      }
    },
    {
      "id": "mac-release-factory",
      "use_case": "self-healing-edge-swarm",
      "dependencies": [
        "docker-provider",
        "host-ticket-executor",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "macos"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "macos"
          }
        ],
        "execute_actions": [
          "mac_release.build",
          "mac_release.test",
          "mac_release.archive",
          "mac_release.codesign",
          "mac_release.notarize",
          "mac_release.upload"
        ],
        "recovery_actions": [
          "launchd.stop"
        ],
        "external_dependencies": [],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "none",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "macos-controller"
      }
    },
    {
      "id": "mixed-closed-loop-ai-factory",
      "use_case": "multi-hive-mission-control",
      "dependencies": [
        "federation-provider",
        "kubernetes-provider",
        "python-sdk-projection",
        "rest-gateway-projection",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "fleet"
          }
        ],
        "execute_actions": [
          "peft.export",
          "peft.import",
          "peft.activate"
        ],
        "recovery_actions": [
          "peft.rollback"
        ],
        "external_dependencies": [
          {
            "id": "m27d-peft-pipeline",
            "owner": "milestone-27d",
            "kind": "accepted_milestone"
          },
          {
            "id": "closed-loop-factory-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    },
    {
      "id": "mixed-logistics-digital-twin",
      "use_case": "multi-hive-mission-control",
      "dependencies": [
        "federation-provider",
        "fuse-mount-projection",
        "kubernetes-provider",
        "rest-gateway-projection",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "fleet"
          }
        ],
        "execute_actions": [
          "systemd.start",
          "gpu.workload.submit"
        ],
        "recovery_actions": [
          "gpu.workload.cancel",
          "systemd.stop"
        ],
        "external_dependencies": [
          {
            "id": "logistics-digital-twin-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    },
    {
      "id": "mixed-medical-edge-ai",
      "use_case": "gpu-flight-deck",
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path",
        "kubernetes-provider",
        "worker-control"
      ],
      "workflow": {
        "schema": "cohesix-workflow/v1",
        "topology": [
          {
            "id": "controller",
            "owner": "coh-workflow",
            "host_class": "linux"
          },
          {
            "id": "target-hive",
            "owner": "root-task",
            "host_class": "sel4"
          },
          {
            "id": "provider-host",
            "owner": "host-ticket-agent",
            "host_class": "fleet"
          }
        ],
        "execute_actions": [
          "systemd.start",
          "gpu.workload.submit"
        ],
        "recovery_actions": [
          "gpu.workload.cancel",
          "systemd.stop"
        ],
        "external_dependencies": [
          {
            "id": "medical-edge-app",
            "owner": "deployment-owner",
            "kind": "signed_application"
          }
        ],
        "stages": [
          {
            "id": "preflight",
            "after": [],
            "owner": "controller",
            "postcondition": "Resolve exact packages, external applications, native targets, topology and credential references before any write.",
            "when": "normal"
          },
          {
            "id": "admit",
            "after": [
              "preflight"
            ],
            "owner": "target-hive",
            "postcondition": "Authenticate the caller and admit one bounded ticket under current writer and policy authority.",
            "when": "normal"
          },
          {
            "id": "execute",
            "after": [
              "admit"
            ],
            "owner": "provider-host",
            "postcondition": "Dispatch only the admitted action through its registered native executor; dispatch alone is non-terminal.",
            "when": "normal"
          },
          {
            "id": "observe",
            "after": [
              "execute"
            ],
            "owner": "provider-host",
            "postcondition": "Read exact native object identity and postcondition, retaining bounded immutable artifacts.",
            "when": "normal"
          },
          {
            "id": "verify",
            "after": [
              "observe"
            ],
            "owner": "controller",
            "postcondition": "Validate every signed causal chain and exact target/Worker/native correlation before advancing.",
            "when": "normal"
          },
          {
            "id": "recover",
            "after": [
              "verify"
            ],
            "owner": "controller",
            "postcondition": "Submit a separately admitted recovery ticket linked to the verified original graph; stopping a service does not reverse publication or certify safety.",
            "when": "explicit_recovery"
          }
        ],
        "worker_tier": "executable",
        "evidence_schema": "cohesix-causal-evidence/v1",
        "governance_mode": "observe",
        "authority_custodian": "root-admitted-ticket",
        "bypass_posture": "Native administrators remain independent; labels and package presence grant no Cohesix authority.",
        "package_profile": "linux-aarch64-cuda"
      }
    }
  ],
  "advertised_surfaces": [
    {
      "id": "cargo-target:cas-tool:bin:cas-tool",
      "kind": "cargo_target",
      "path": "apps/cas-tool#bin:cas-tool",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "cas-artifact",
        "packaging"
      ]
    },
    {
      "id": "cargo-target:cas-tool:lib:cas_tool",
      "kind": "cargo_target",
      "path": "apps/cas-tool#lib:cas_tool",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "cas-artifact",
        "packaging"
      ]
    },
    {
      "id": "cargo-target:coh-status:lib:coh_status",
      "kind": "cargo_target",
      "path": "apps/coh-status#lib:coh_status",
      "implementation_class": "deferred",
      "production_reachable": false,
      "dependencies": [
        "semantic-context"
      ]
    },
    {
      "id": "cargo-target:coh:bin:coh",
      "kind": "cargo_target",
      "path": "apps/coh#bin:coh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "fuse-mount-projection",
        "packaging"
      ]
    },
    {
      "id": "cargo-target:coh:lib:coh",
      "kind": "cargo_target",
      "path": "apps/coh#lib:coh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "fuse-mount-projection",
        "packaging"
      ]
    },
    {
      "id": "cargo-target:cohesix-proto:lib:cohesix_proto",
      "kind": "cargo_target",
      "path": "apps/cohesix-proto#lib:cohesix_proto",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection"
      ]
    },
    {
      "id": "cargo-target:cohesix-rest:lib:cohesix_rest",
      "kind": "cargo_target",
      "path": "crates/cohesix-rest#lib:cohesix_rest",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "rest-gateway-projection"
      ]
    },
    {
      "id": "cargo-target:cohesix-worker-evidence:lib:cohesix_worker_evidence",
      "kind": "cargo_target",
      "path": "crates/cohesix-worker-evidence#lib:cohesix_worker_evidence",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "siem-evidence-export",
        "worker-control"
      ]
    },
    {
      "id": "cargo-target:cohsh-core:lib:cohsh_core",
      "kind": "cargo_target",
      "path": "crates/cohsh-core#lib:cohsh_core",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection"
      ]
    },
    {
      "id": "cargo-target:cohsh:bin:cohsh",
      "kind": "cargo_target",
      "path": "apps/cohsh#bin:cohsh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "worker-control"
      ]
    },
    {
      "id": "cargo-target:cohsh:lib:cohsh",
      "kind": "cargo_target",
      "path": "apps/cohsh#lib:cohsh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "worker-control"
      ]
    },
    {
      "id": "cargo-target:gpu-bridge-host:bin:gpu-bridge-host",
      "kind": "cargo_target",
      "path": "apps/gpu-bridge-host#bin:gpu-bridge-host",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path"
      ]
    },
    {
      "id": "cargo-target:gpu-bridge-host:lib:gpu_bridge_host",
      "kind": "cargo_target",
      "path": "apps/gpu-bridge-host#lib:gpu_bridge_host",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path"
      ]
    },
    {
      "id": "cargo-target:hive-gateway:bin:hive-gateway",
      "kind": "cargo_target",
      "path": "apps/hive-gateway#bin:hive-gateway",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "rest-gateway-projection"
      ]
    },
    {
      "id": "cargo-target:host-cuda:lib:host_cuda",
      "kind": "cargo_target",
      "path": "crates/host-cuda#lib:host_cuda",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "gpu-host-provider"
      ]
    },
    {
      "id": "cargo-target:host-sidecar-bridge:bin:host-sidecar-bridge",
      "kind": "cargo_target",
      "path": "apps/host-sidecar-bridge#bin:host-sidecar-bridge",
      "implementation_class": "host_model",
      "production_reachable": false,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "cargo-target:host-sidecar-bridge:lib:host_sidecar_bridge",
      "kind": "cargo_target",
      "path": "apps/host-sidecar-bridge#lib:host_sidecar_bridge",
      "implementation_class": "host_model",
      "production_reachable": false,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "cargo-target:host-ticket-agent:bin:host-ticket-agent",
      "kind": "cargo_target",
      "path": "apps/host-ticket-agent#bin:host-ticket-agent",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "host-ticket-executor"
      ]
    },
    {
      "id": "cargo-target:host-ticket-agent:lib:host_ticket_agent",
      "kind": "cargo_target",
      "path": "apps/host-ticket-agent#lib:host_ticket_agent",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "host-ticket-executor"
      ]
    },
    {
      "id": "cargo-target:sidecar-bus:bin:sidecar-bus",
      "kind": "cargo_target",
      "path": "apps/sidecar-bus#bin:sidecar-bus",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "cargo-target:sidecar-bus:lib:sidecar_bus",
      "kind": "cargo_target",
      "path": "apps/sidecar-bus#lib:sidecar_bus",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "cargo-target:swarmui:bin:swarmui",
      "kind": "cargo_target",
      "path": "apps/swarmui#bin:swarmui",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "swarmui-projection",
        "swarmui-workbench"
      ]
    },
    {
      "id": "cargo-target:swarmui:lib:swarmui",
      "kind": "cargo_target",
      "path": "apps/swarmui#lib:swarmui",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "swarmui-projection",
        "swarmui-workbench"
      ]
    },
    {
      "id": "tracked:docs/GPU_NODES.md",
      "kind": "tracked_surface",
      "path": "docs/GPU_NODES.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path"
      ]
    },
    {
      "id": "tracked:docs/HOST_API.md",
      "kind": "tracked_surface",
      "path": "docs/HOST_API.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "host-ticket-executor",
        "rest-gateway-projection"
      ]
    },
    {
      "id": "tracked:docs/HOST_TOOLS.md",
      "kind": "tracked_surface",
      "path": "docs/HOST_TOOLS.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "authenticated-console-projection",
        "host-ticket-executor",
        "packaging"
      ]
    },
    {
      "id": "tracked:docs/INTERFACES.md",
      "kind": "tracked_surface",
      "path": "docs/INTERFACES.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "authenticated-console-projection",
        "rest-gateway-projection",
        "worker-control"
      ]
    },
    {
      "id": "tracked:docs/PYTHON_SUPPORT.md",
      "kind": "tracked_surface",
      "path": "docs/PYTHON_SUPPORT.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "python-sdk-projection"
      ]
    },
    {
      "id": "tracked:docs/TEST_PLAN.md",
      "kind": "tracked_surface",
      "path": "docs/TEST_PLAN.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "packaging",
        "worker-control"
      ]
    },
    {
      "id": "tracked:docs/USE_CASES.md",
      "kind": "tracked_surface",
      "path": "docs/USE_CASES.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "host-ticket-executor",
        "worker-control"
      ]
    },
    {
      "id": "tracked:tools/cohesix-py/README.md",
      "kind": "tracked_surface",
      "path": "tools/cohesix-py/README.md",
      "implementation_class": "contract",
      "production_reachable": false,
      "dependencies": [
        "python-sdk-projection"
      ]
    },
    {
      "id": "tracked:tools/cohesix-py/pyproject.toml",
      "kind": "tracked_surface",
      "path": "tools/cohesix-py/pyproject.toml",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "packaging",
        "python-sdk-projection"
      ]
    },
    {
      "id": "workspace:cas-tool",
      "kind": "workspace_member",
      "path": "apps/cas-tool",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "cas-artifact",
        "packaging"
      ]
    },
    {
      "id": "workspace:coh",
      "kind": "workspace_member",
      "path": "apps/coh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "fuse-mount-projection",
        "packaging"
      ]
    },
    {
      "id": "workspace:coh-status",
      "kind": "workspace_member",
      "path": "apps/coh-status",
      "implementation_class": "deferred",
      "production_reachable": false,
      "dependencies": [
        "semantic-context"
      ]
    },
    {
      "id": "workspace:cohesix-proto",
      "kind": "workspace_member",
      "path": "apps/cohesix-proto",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection"
      ]
    },
    {
      "id": "workspace:cohesix-rest",
      "kind": "workspace_member",
      "path": "crates/cohesix-rest",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "rest-gateway-projection"
      ]
    },
    {
      "id": "workspace:cohesix-worker-evidence",
      "kind": "workspace_member",
      "path": "crates/cohesix-worker-evidence",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "siem-evidence-export",
        "worker-control"
      ]
    },
    {
      "id": "workspace:cohsh",
      "kind": "workspace_member",
      "path": "apps/cohsh",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection",
        "worker-control"
      ]
    },
    {
      "id": "workspace:cohsh-core",
      "kind": "workspace_member",
      "path": "crates/cohsh-core",
      "implementation_class": "contract",
      "production_reachable": true,
      "dependencies": [
        "authenticated-console-projection"
      ]
    },
    {
      "id": "workspace:gpu-bridge-host",
      "kind": "workspace_member",
      "path": "apps/gpu-bridge-host",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "gpu-host-provider",
        "gpu-receipt-path"
      ]
    },
    {
      "id": "workspace:hive-gateway",
      "kind": "workspace_member",
      "path": "apps/hive-gateway",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "rest-gateway-projection"
      ]
    },
    {
      "id": "workspace:host-cuda",
      "kind": "workspace_member",
      "path": "crates/host-cuda",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "gpu-host-provider"
      ]
    },
    {
      "id": "workspace:host-sidecar-bridge",
      "kind": "workspace_member",
      "path": "apps/host-sidecar-bridge",
      "implementation_class": "host_model",
      "production_reachable": false,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "workspace:host-ticket-agent",
      "kind": "workspace_member",
      "path": "apps/host-ticket-agent",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "host-ticket-executor"
      ]
    },
    {
      "id": "workspace:sidecar-bus",
      "kind": "workspace_member",
      "path": "apps/sidecar-bus",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "sidecar-provider"
      ]
    },
    {
      "id": "workspace:swarmui",
      "kind": "workspace_member",
      "path": "apps/swarmui",
      "implementation_class": "production_live",
      "production_reachable": true,
      "dependencies": [
        "swarmui-projection",
        "swarmui-workbench"
      ]
    }
  ],
  "lanes": [
    {
      "id": "dry-run-providers",
      "mode": "dry-run",
      "dependencies": [
        "docker-provider",
        "federation-provider",
        "gpu-host-provider",
        "host-ticket-executor",
        "kubernetes-provider",
        "peft-host-provider",
        "sidecar-provider",
        "systemd-provider"
      ],
      "target": null,
      "expected_result": "provider-live obligations remain unsatisfied"
    },
    {
      "id": "fixture-contracts",
      "mode": "fixture",
      "dependencies": [
        "docker-provider",
        "gpu-host-provider",
        "host-ticket-executor",
        "kubernetes-provider",
        "peft-host-provider",
        "sidecar-provider",
        "systemd-provider"
      ],
      "target": null,
      "expected_result": "fixtures remain non-promoting"
    },
    {
      "id": "mock-contracts",
      "mode": "mock",
      "dependencies": [
        "docker-provider",
        "federation-provider",
        "gpu-host-provider",
        "host-ticket-executor",
        "kubernetes-provider",
        "peft-host-provider",
        "sidecar-provider",
        "systemd-provider"
      ],
      "target": null,
      "expected_result": "host models remain non-promoting"
    },
    {
      "id": "pi4-target-session",
      "mode": "live",
      "dependencies": [
        "gpu-receipt-path",
        "peft-receipt-path",
        "worker-control"
      ],
      "target": "pi4",
      "expected_result": "fresh Pi target rows may pass only with exact current-session identity"
    },
    {
      "id": "qemu-target-session",
      "mode": "live",
      "dependencies": [
        "gpu-receipt-path",
        "peft-receipt-path",
        "worker-control"
      ],
      "target": "qemu",
      "expected_result": "fresh QEMU target rows may pass only with exact current-session identity"
    }
  ],
  "conformance_vectors": [
    {
      "id": "circular-dependency",
      "mutation": "make worker-control depend transitively on itself",
      "expected_error": "circular host-integration dependency"
    },
    {
      "id": "future-live",
      "mutation": "select a future provider as live",
      "expected_error": "future dependency is selectable as current/live"
    },
    {
      "id": "missing-owner",
      "mutation": "clear owner or select a nonexistent owning milestone",
      "expected_error": "unknown owning milestone"
    },
    {
      "id": "mode-substitution",
      "mutation": "use fixture mock or dry-run for a live-required row",
      "expected_error": "observed mode does not satisfy required mode"
    },
    {
      "id": "secret-evidence",
      "mutation": "include a credential value in observation evidence",
      "expected_error": "sensitive material"
    },
    {
      "id": "stale-target",
      "mutation": "bind a target session to a stale graph or manifest hash",
      "expected_error": "target session identity mismatch"
    },
    {
      "id": "unknown-reference",
      "mutation": "reference an unknown action path or schema",
      "expected_error": "unknown generated reference"
    },
    {
      "id": "worker-ready-substitution",
      "mutation": "treat provider or host readiness as Worker READY",
      "expected_error": "provider state cannot become Worker READY"
    },
    {
      "id": "wrong-target",
      "mutation": "submit a Pi target session to the QEMU lane",
      "expected_error": "wrong target"
    }
  ],
  "providers": {
    "schema": "cohesix-provider-contract/v1",
    "profiles": [
      {
        "id": "jetson-orin-nano-jp7",
        "os": "linux",
        "architecture": "aarch64",
        "board": "NVIDIA Jetson Orin Nano Engineering Reference Developer Kit Super",
        "ubuntu": "24.04",
        "l4t": "39.2.1",
        "jetpack": "7.2.1",
        "cuda_toolkit": "13.2.2",
        "compute_capability": "8.7",
        "shared_memory": true,
        "host_headroom_bytes": 2147483648,
        "observation_ttl_ms": 5000,
        "unsupported": [
          "mig",
          "dla",
          "pva"
        ],
        "execution_lanes": [
          "native",
          "systemd",
          "nvidia_container"
        ]
      },
      {
        "id": "mac-apple-m4-macos27",
        "os": "macos",
        "architecture": "arm64",
        "board": "Apple M4 Mac16,1",
        "ubuntu": "not-applicable",
        "l4t": "not-applicable",
        "jetpack": "not-applicable",
        "cuda_toolkit": "not-applicable",
        "compute_capability": "not-applicable",
        "shared_memory": true,
        "host_headroom_bytes": 2147483648,
        "observation_ttl_ms": 5000,
        "unsupported": [
          "cuda",
          "mig",
          "dla",
          "pva"
        ],
        "execution_lanes": [
          "native",
          "launchd",
          "metal"
        ]
      }
    ],
    "families": [
      {
        "id": "apple_ml",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m28a-external-executor-conformance",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "can",
        "integration_id": "industry-provider-family",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "ccsds",
        "integration_id": "industry-provider-family",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "cuda",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m27b-jetson-orin-nano-live-conformance",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "cuda.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "cuda.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "dicom",
        "integration_id": "industry-provider-family",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "dnp3",
        "integration_id": "sidecar-provider",
        "owner": "sidecar-bus",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "candidate",
        "actions": [
          {
            "id": "dnp3.control",
            "legacy_argument_fields": [
              "endpoint",
              "point"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "host-ticket-result/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 6000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "cohesix-field-bus-wal/v1",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "dnp3.control"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-record/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "sidecar-bus",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "endpoint",
              "unit",
              "outstation",
              "operation_sha256",
              "sequence",
              "acknowledgement_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "sidecar-bus",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "sidecar-bus",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "sidecar-bus",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "sidecar-bus",
                "postcondition": "Validate exact unit/outstation, remote ACK, mapped operation digest, durable sequence and original observation time.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "sidecar-bus",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "sidecar-bus",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_supported"
              },
              {
                "id": "export_evidence",
                "owner": "sidecar-bus",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "dnp3.read",
            "legacy_argument_fields": [
              "endpoint",
              "point"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "host-ticket-result/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 6000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "cohesix-field-bus-wal/v1",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "dnp3.read"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-record/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "sidecar-bus",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "endpoint",
              "unit",
              "outstation",
              "operation_sha256",
              "sequence",
              "acknowledgement_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "sidecar-bus",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "sidecar-bus",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "sidecar-bus",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "sidecar-bus",
                "postcondition": "Validate exact unit/outstation, remote ACK, mapped operation digest, durable sequence and original observation time.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "sidecar-bus",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "sidecar-bus",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_supported"
              },
              {
                "id": "export_evidence",
                "owner": "sidecar-bus",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "docker",
        "integration_id": "docker-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "docker.restart",
            "legacy_argument_fields": [
              "container"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "docker.restart"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "image_digest",
              "container_id",
              "event_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "docker.status-check",
            "legacy_argument_fields": [
              "container"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "docker.status-check"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "image_digest",
              "container_id",
              "event_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "docker.stop",
            "legacy_argument_fields": [
              "container"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "docker.stop"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "image_digest",
              "container_id",
              "event_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "endpoint_compliance",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": false,
        "availability": "candidate",
        "actions": [
          {
            "id": "endpoint_compliance.observe",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "endpoint_compliance.observe"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "gpu.lease",
        "integration_id": "gpu-host-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-gpu-workload-and-mig-executor",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "gpu.lease.grant",
            "legacy_argument_fields": [
              "gpu_id",
              "mem_mb",
              "streams",
              "ttl_s",
              "priority",
              "budget_ttl_s",
              "budget_ops"
            ],
            "effect": "mutation",
            "target_grammar": "physical_device",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.lease.grant"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "gpu.lease.release",
            "legacy_argument_fields": [
              "gpu_id",
              "reason"
            ],
            "effect": "mutation",
            "target_grammar": "physical_device",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.lease.release"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "gpu.lease.renew",
            "legacy_argument_fields": [
              "gpu_id",
              "ttl_s",
              "priority"
            ],
            "effect": "mutation",
            "target_grammar": "physical_device",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.lease.renew"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "gpu.workload",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m28a-gpu-workload-and-mig-executor",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "gpu.workload.cancel",
            "legacy_argument_fields": null,
            "effect": "mutation",
            "target_grammar": "physical_device",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.workload.cancel"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "gpu.workload.observe",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "physical_device",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.workload.observe"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "gpu.workload.submit",
            "legacy_argument_fields": null,
            "effect": "mutation",
            "target_grammar": "physical_device",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "gpu.workload.submit"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "iec104",
        "integration_id": "industry-provider-family",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "jetson",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m27b-jetson-orin-nano-live-conformance",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "jetson.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "jetson.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-sidecar-bridge",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-sidecar-bridge",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-sidecar-bridge",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-sidecar-bridge",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-sidecar-bridge",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-sidecar-bridge",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-sidecar-bridge",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-sidecar-bridge",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "k8s",
        "integration_id": "kubernetes-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "k8s.cordon",
            "legacy_argument_fields": [
              "node",
              "reason",
              "ttl_s"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "k8s.cordon"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "k8s.drain",
            "legacy_argument_fields": [
              "node",
              "reason",
              "ttl_s"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "k8s.drain"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "k8s.lease.sync",
            "legacy_argument_fields": [
              "node",
              "reason",
              "ttl_s"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "k8s.lease.sync"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "launchd",
        "integration_id": "systemd-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": false,
        "availability": "candidate",
        "actions": [
          {
            "id": "launchd.restart",
            "legacy_argument_fields": [
              "service"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "launchd.restart"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "service",
              "plist_sha256",
              "runs",
              "pid",
              "start_seconds",
              "start_microseconds",
              "executable_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "launchd.start",
            "legacy_argument_fields": [
              "service"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "launchd.start"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "service",
              "plist_sha256",
              "runs",
              "pid",
              "start_seconds",
              "start_microseconds",
              "executable_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "launchd.status-check",
            "legacy_argument_fields": [
              "service"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "launchd.status-check"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "service",
              "plist_sha256",
              "runs",
              "pid",
              "start_seconds",
              "start_microseconds",
              "executable_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "launchd.stop",
            "legacy_argument_fields": [
              "service"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "launchd.stop"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "service",
              "plist_sha256",
              "runs",
              "pid",
              "start_seconds",
              "start_microseconds",
              "executable_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "mac_release",
        "integration_id": "packaging",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": false,
        "availability": "candidate",
        "actions": [
          {
            "id": "mac_release.archive",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.archive"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "mac_release.build",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.build"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "mac_release.codesign",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.codesign"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "mac_release.notarize",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.notarize"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "mac_release.test",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.test"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "mac_release.upload",
            "legacy_argument_fields": [
              "target_id"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "cohesix-causal-graph/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "mac_release.upload"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-graph/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "target_id",
              "input_sha256",
              "output_sha256",
              "submission_id",
              "upload_id",
              "build_id"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "mig",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m28a-gpu-workload-and-mig-executor",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "modbus",
        "integration_id": "sidecar-provider",
        "owner": "sidecar-bus",
        "owning_task": "m28a-industry-sidecar-contracts",
        "required_for_release_a": false,
        "availability": "candidate",
        "actions": [
          {
            "id": "modbus.control",
            "legacy_argument_fields": [
              "endpoint",
              "point"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "host-ticket-result/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 6000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "cohesix-field-bus-wal/v1",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "modbus.control"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-record/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "sidecar-bus",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "endpoint",
              "unit",
              "outstation",
              "operation_sha256",
              "sequence",
              "acknowledgement_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "sidecar-bus",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "sidecar-bus",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "sidecar-bus",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "sidecar-bus",
                "postcondition": "Validate exact unit/outstation, remote ACK, mapped operation digest, durable sequence and original observation time.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "sidecar-bus",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "sidecar-bus",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_supported"
              },
              {
                "id": "export_evidence",
                "owner": "sidecar-bus",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          },
          {
            "id": "modbus.read",
            "legacy_argument_fields": [
              "endpoint",
              "point"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "host-ticket-result/v1",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 6000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v1",
            "required_fact_schema_ref": "cohesix-field-bus-wal/v1",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "modbus.read"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "cohesix-causal-record/v1",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "sidecar-bus",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "endpoint",
              "unit",
              "outstation",
              "operation_sha256",
              "sequence",
              "acknowledgement_sha256"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "sidecar-bus",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "sidecar-bus",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "sidecar-bus",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "sidecar-bus",
                "postcondition": "Validate exact unit/outstation, remote ACK, mapped operation digest, durable sequence and original observation time.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "sidecar-bus",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "sidecar-bus",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_supported"
              },
              {
                "id": "export_evidence",
                "owner": "sidecar-bus",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "model_registry",
        "integration_id": "peft-host-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-external-executor-conformance",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "model_registry.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "model_registry.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "network",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": true,
        "availability": "candidate",
        "actions": [
          {
            "id": "network.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "network.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-sidecar-bridge",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-sidecar-bridge",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_enabled"
              },
              {
                "id": "preflight",
                "owner": "host-sidecar-bridge",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_enabled"
              },
              {
                "id": "execute",
                "owner": "host-sidecar-bridge",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_enabled"
              },
              {
                "id": "observe",
                "owner": "host-sidecar-bridge",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_enabled"
              },
              {
                "id": "verify",
                "owner": "host-sidecar-bridge",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_enabled"
              },
              {
                "id": "compensate",
                "owner": "host-sidecar-bridge",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_enabled"
              },
              {
                "id": "export_evidence",
                "owner": "host-sidecar-bridge",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_enabled"
              }
            ]
          }
        ]
      },
      {
        "id": "nvidia",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "nvidia.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "nvidia.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "nvml",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m27b-jetson-orin-nano-live-conformance",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "nvml.discover",
            "legacy_argument_fields": null,
            "effect": "read_only",
            "target_grammar": "none",
            "argument_schema_ref": "unavailable",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "nvml.discover"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "gpu-bridge-host",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "device_uuid",
              "topology_generation"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "gpu-bridge-host",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "gpu-bridge-host",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "gpu-bridge-host",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "gpu-bridge-host",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "gpu-bridge-host",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "gpu-bridge-host",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "gpu-bridge-host",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "otel",
        "integration_id": "prometheus-otel-export",
        "owner": "coh",
        "owning_task": "m28a-observability-exporters",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "peft",
        "integration_id": "peft-host-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-external-executor-conformance",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "peft.activate",
            "legacy_argument_fields": [
              "model_id",
              "model",
              "registry_root",
              "registry"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "peft.activate"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "peft.export",
            "legacy_argument_fields": [
              "job_id",
              "job",
              "out_dir",
              "out"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "peft.export"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "peft.import",
            "legacy_argument_fields": [
              "model_id",
              "model",
              "job_id",
              "job",
              "adapter_dir",
              "from",
              "export_root",
              "export",
              "registry_root",
              "registry",
              "publish"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "peft.import"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "peft.release",
            "legacy_argument_fields": [],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 300000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "peft.release"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "peft.rollback",
            "legacy_argument_fields": [
              "registry_root",
              "registry"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket/v2",
            "receipt_schema_ref": "host-ticket-result/v2",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "peft.rollback"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      },
      {
        "id": "prometheus",
        "integration_id": "prometheus-otel-export",
        "owner": "coh",
        "owning_task": "m28a-observability-exporters",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "siem",
        "integration_id": "siem-evidence-export",
        "owner": "coh",
        "owning_task": "m28a-observability-exporters",
        "required_for_release_a": false,
        "availability": "not_implemented",
        "actions": []
      },
      {
        "id": "systemd",
        "integration_id": "systemd-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-native-provider-discovery-and-actions",
        "required_for_release_a": true,
        "availability": "not_implemented",
        "actions": [
          {
            "id": "systemd.restart",
            "legacy_argument_fields": [
              "unit"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "systemd.restart"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "unit",
              "invocation_id",
              "journal_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "systemd.start",
            "legacy_argument_fields": [
              "unit"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "systemd.start"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "unit",
              "invocation_id",
              "journal_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "systemd.status-check",
            "legacy_argument_fields": [
              "unit"
            ],
            "effect": "read_only",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "admin_only",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": false,
            "writer_epoch_required": false,
            "operator_approval_required": false,
            "admission_mode": "read_only",
            "decision_requirement": "not_required",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "systemd.status-check"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "unit",
              "invocation_id",
              "journal_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          },
          {
            "id": "systemd.stop",
            "legacy_argument_fields": [
              "unit"
            ],
            "effect": "mutation",
            "target_grammar": "native_id",
            "argument_schema_ref": "host-ticket-provider-arguments/v1",
            "receipt_schema_ref": "unavailable",
            "evidence_profile": "bounded_native",
            "read_visibility": "ticket_scoped",
            "timeout_ms": 30000,
            "maximum_request_bytes": 2048,
            "idempotency_required": true,
            "writer_epoch_required": true,
            "operator_approval_required": true,
            "admission_mode": "operator_approved",
            "decision_requirement": "unavailable",
            "intent_schema_ref": "host-ticket/v2",
            "required_fact_schema_ref": "unavailable",
            "policy_id": "delegated-host-ticket",
            "maximum_grant_scope": [
              "systemd.stop"
            ],
            "state_freshness_bound_ms": 5000,
            "reservation_or_recheck_mode": "recheck_before_dispatch",
            "decision_receipt_schema_ref": "unavailable",
            "selected_governance_mode": "observe",
            "supported_governance_modes": [
              "observe",
              "recommend"
            ],
            "authority_custodian": "root-admitted-ticket",
            "credential_custodian": "host-ticket-agent",
            "bypass_posture": "Native administrative access remains outside Cohesix authority.",
            "failure_posture": "Refuse missing or ambiguous native evidence; never replay an ambiguous side effect.",
            "redaction": [
              "credentials",
              "raw_ticket",
              "private_key",
              "payload"
            ],
            "native_identity_fields": [
              "source_id",
              "native_id",
              "generation",
              "observation_unix_ms",
              "expires_unix_ms",
              "unit",
              "invocation_id",
              "journal_cursor"
            ],
            "correlation_fields": [
              "ticket_id",
              "subject_id",
              "action_id",
              "idempotency_key",
              "writer_epoch",
              "evidence_id"
            ],
            "lifecycle": [
              {
                "id": "discover",
                "owner": "host-ticket-agent",
                "postcondition": "Native source identifies the exact object and observation expiry.",
                "unavailable": "not_implemented"
              },
              {
                "id": "preflight",
                "owner": "host-ticket-agent",
                "postcondition": "Validate ticket, subject, profile, target, bounds, approval and current writer epoch before dispatch.",
                "unavailable": "not_implemented"
              },
              {
                "id": "execute",
                "owner": "host-ticket-agent",
                "postcondition": "The admitted provider owns one bounded operation; dispatch alone is non-terminal.",
                "unavailable": "not_implemented"
              },
              {
                "id": "observe",
                "owner": "host-ticket-agent",
                "postcondition": "Read native object identity, invocation or generation, event cursor and terminal state.",
                "unavailable": "not_implemented"
              },
              {
                "id": "verify",
                "owner": "host-ticket-agent",
                "postcondition": "Bind observed postcondition and immutable output hashes to the admitted action and exact native identity.",
                "unavailable": "not_implemented"
              },
              {
                "id": "compensate",
                "owner": "host-ticket-agent",
                "postcondition": "Require a separately admitted exact compensation target; irreversible or ambiguous state is unavailable.",
                "unavailable": "not_implemented"
              },
              {
                "id": "export_evidence",
                "owner": "host-ticket-agent",
                "postcondition": "Export bounded source references with correlation and explicit missing evidence; labels never grant authority.",
                "unavailable": "not_implemented"
              }
            ]
          }
        ]
      }
    ],
    "integration_surfaces": [
      {
        "id": "cas",
        "integration_id": "cas-artifact",
        "owner": "cas-tool",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "local"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "cas-tool",
        "package_artifacts": [
          "cas-tool"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "coh",
        "integration_id": "host-ticket-executor",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "cohsh",
        "integration_id": "authenticated-console-projection",
        "owner": "cohsh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "tcp"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "cohsh",
        "package_artifacts": [
          "cohsh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "direct_console",
        "integration_id": "authenticated-console-projection",
        "owner": "cohsh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "tcp"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "cohsh",
        "package_artifacts": [
          "cohsh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "evidence",
        "integration_id": "siem-evidence-export",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "local"
        ],
        "posture": "read_only",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "federation",
        "integration_id": "federation-provider",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "host-ticket-agent",
        "package_artifacts": [
          "host-ticket-agent"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "fleet",
        "integration_id": "worker-control",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "fuse_direct",
        "integration_id": "fuse-mount-projection",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "secure9p"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "fuse_rest",
        "integration_id": "fuse-mount-projection",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "gpu_bridge",
        "integration_id": "gpu-host-provider",
        "owner": "gpu-bridge-host",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "tcp"
        ],
        "posture": "ticket_control",
        "required_actions": [
          "nvidia.discover",
          "cuda.discover",
          "nvml.discover"
        ],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "gpu-bridge-host",
        "package_artifacts": [
          "gpu-bridge-host"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "hive_gateway",
        "integration_id": "rest-gateway-projection",
        "owner": "hive-gateway",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "http"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "hive-gateway",
        "package_artifacts": [
          "hive-gateway"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "host_sidecar",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "host-sidecar-bridge",
        "package_artifacts": [
          "host-sidecar-bridge"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "host_ticket_agent",
        "integration_id": "host-ticket-executor",
        "owner": "host-ticket-agent",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "host-ticket-agent",
        "package_artifacts": [
          "host-ticket-agent"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "jetson",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "local"
        ],
        "posture": "read_only",
        "required_actions": [
          "jetson.discover"
        ],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "host-sidecar-bridge",
        "package_artifacts": [
          "host-sidecar-bridge"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "network",
        "integration_id": "sidecar-provider",
        "owner": "host-sidecar-bridge",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "local"
        ],
        "posture": "read_only",
        "required_actions": [
          "network.discover"
        ],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "host-sidecar-bridge",
        "package_artifacts": [
          "host-sidecar-bridge"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "otel",
        "integration_id": "prometheus-otel-export",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "https"
        ],
        "posture": "read_only",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "prometheus",
        "integration_id": "prometheus-otel-export",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "http"
        ],
        "posture": "read_only",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "python_sdk",
        "integration_id": "python-sdk-projection",
        "owner": "cohesix-py",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "cohesix-py",
        "package_artifacts": [
          "cohesix-py"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "release_bundle",
        "integration_id": "packaging",
        "owner": "release-bundle",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "local"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "release-bundle",
        "package_artifacts": [
          "release_bundle.sh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "rest",
        "integration_id": "rest-gateway-projection",
        "owner": "hive-gateway",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "http"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "hive-gateway",
        "package_artifacts": [
          "hive-gateway"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "siem",
        "integration_id": "siem-evidence-export",
        "owner": "coh",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "https"
        ],
        "posture": "read_only",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "coh",
        "package_artifacts": [
          "coh"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      },
      {
        "id": "swarmui",
        "integration_id": "swarmui-projection",
        "owner": "swarmui",
        "owning_task": "m28a-integration-surface-registry",
        "topology": "explicit controller and target endpoints; native execution remains on its selected host",
        "transports": [
          "rest"
        ],
        "posture": "ticket_control",
        "required_actions": [],
        "worker_roles": [],
        "worker_evidence_tier": "none",
        "identity_requirement": "validated delegated ticket for control; generated read classification for projections",
        "secret_requirement": "protected file or platform secret reference; no credentials in argv or artifacts",
        "durability_owner": "swarmui",
        "package_artifacts": [
          "swarmui"
        ],
        "conformance_runner": "scripts/ci/provider_conformance_run.sh",
        "observed_mode": "unknown",
        "read_visibility": "admin_only"
      }
    ],
    "read_visibility": [
      {
        "prefix": "/",
        "class": "admin_only",
        "owner_binding": "none"
      },
      {
        "prefix": "/gpu",
        "class": "ticket_scoped",
        "owner_binding": "explicit_scope"
      },
      {
        "prefix": "/models",
        "class": "ticket_scoped",
        "owner_binding": "explicit_scope"
      },
      {
        "prefix": "/proc/capabilities",
        "class": "public",
        "owner_binding": "none"
      },
      {
        "prefix": "/proc/version",
        "class": "public",
        "owner_binding": "none"
      },
      {
        "prefix": "/shard",
        "class": "ticket_scoped",
        "owner_binding": "worker_subject"
      },
      {
        "prefix": "/worker",
        "class": "ticket_scoped",
        "owner_binding": "worker_subject"
      }
    ],
    "export": {
      "schema": "cohesix-derived-export/v1",
      "formats": [
        "prometheus",
        "otel",
        "cloudevents",
        "in_toto",
        "siem",
        "slsa"
      ],
      "maximum_bytes": 65536,
      "field_allowlist": [
        "ticket_id",
        "action",
        "graph_sha256",
        "provider_graph_sha256",
        "kind",
        "outcome",
        "source",
        "native_identity_sha256",
        "artifact_sha256",
        "record_sha256"
      ],
      "build_actions": []
    },
    "relay_credentials": [
      {
        "peer": "hive-b",
        "request_auth_ref": "env:COHESIX_RELAY_HIVE_B_TOKEN",
        "delegated_ticket_ref": "env:COHESIX_RELAY_HIVE_B_TICKET"
      },
      {
        "peer": "hive-c",
        "request_auth_ref": "env:COHESIX_RELAY_HIVE_C_TOKEN",
        "delegated_ticket_ref": "env:COHESIX_RELAY_HIVE_C_TICKET"
      }
    ],
    "identity_mappings": [
      {
        "id": "enterprise",
        "kind": "oidc",
        "enabled": false,
        "issuer": "https://identity.example.invalid",
        "audience": "cohesix",
        "algorithm": "RS256",
        "keyset_sha256": [],
        "maximum_ttl_s": 300,
        "rules": []
      },
      {
        "id": "kubernetes-service-account",
        "kind": "kubernetes",
        "enabled": false,
        "issuer": "https://kubernetes.example.invalid",
        "audience": "cohesix",
        "algorithm": "RS256",
        "keyset_sha256": [],
        "maximum_ttl_s": 300,
        "rules": []
      },
      {
        "id": "local-operator",
        "kind": "local",
        "enabled": false,
        "issuer": "local:operator-host",
        "audience": "cohesix",
        "algorithm": "os-euid",
        "keyset_sha256": [],
        "maximum_ttl_s": 300,
        "rules": []
      },
      {
        "id": "spiffe-workload",
        "kind": "spiffe",
        "enabled": false,
        "issuer": "spiffe://example.invalid",
        "audience": "cohesix",
        "algorithm": "ES256",
        "keyset_sha256": [],
        "maximum_ttl_s": 300,
        "rules": []
      }
    ],
    "siem_delivery": {
      "schema": "cohesix-siem-delivery/v1",
      "enabled": false,
      "endpoint": "https://siem.example.invalid/cohesix/events",
      "credential_ref": "env:COHESIX_SIEM_TOKEN",
      "maximum_entries": 64,
      "maximum_wal_bytes": 4194304,
      "maximum_attempts": 5,
      "timeout_ms": 5000,
      "maximum_backoff_ms": 300000
    },
    "gpu_executor": {
      "schema": "cohesix-gpu-local/v1",
      "transport": "unix_socket",
      "authentication": "hmac_sha256",
      "maximum_frame_bytes": 16384,
      "maximum_jobs": 64,
      "maximum_wal_bytes": 4194304,
      "lease_heartbeat_ttl_ms": 1000,
      "maximum_request_bytes": 8192,
      "maximum_device_allocation_bytes": 67108864,
      "maximum_streams": 1,
      "maximum_runtime_ms": 30000,
      "entrypoints": [
        "vadd",
        "matmul"
      ],
      "profile": "jetson-orin-nano-jp7"
    },
    "macos_targets": [
      {
        "id": "local-endpoint-compliance",
        "operation": {
          "action": "endpoint_compliance.observe"
        }
      }
    ],
    "deployment_profiles": [
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "linux-aarch64-controller",
        "os": "linux",
        "architecture": "aarch64",
        "version": "1.2.0",
        "integration_surfaces": [
          "coh",
          "cohsh",
          "direct_console",
          "evidence",
          "fleet",
          "fuse_direct",
          "fuse_rest",
          "hive_gateway",
          "host_sidecar",
          "host_ticket_agent",
          "otel",
          "prometheus",
          "rest",
          "siem"
        ],
        "required_credentials": [
          "AGENT_TICKET",
          "DELEGATION_KEY",
          "REQUEST_AUTH",
          "ROOT_TICKET",
          "SIDECAR_TICKET",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "LICENSE.txt",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/coh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/cohsh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-sidecar-bridge",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-ticket-agent",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/sidecar-bus",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/coh/run/lease/schema",
            "schema_value": "gpu-lease/v1"
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/root_task/schema",
            "schema_value": "1.29"
          },
          {
            "path": "contracts/implementation_surface_inventory.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-implementation-surface-inventory/v1"
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-provider-registry/v1"
          },
          {
            "path": "docs/ADOPTION.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CAUSAL_EVIDENCE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CI_WORKFLOWS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/FIELD_BUS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/HOST_TOOLS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/INTERFACES.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/PRIVATE_LORA_RELEASE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/SECURITY.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/USERLAND_AND_CLI.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1.6",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          },
          {
            "path": "packaging/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/ci/cohesix-journey.yml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-export.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-gateway.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-sidecar-bridge.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-ticket-agent.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "resources/openapi/hive-gateway.yaml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/build_python_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/render_host_services.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/stage_host_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/__init__.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/audit.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/auth.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/authority.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/backends.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/client.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/defaults.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/errors.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence_graph.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/hf_native.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/identity.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/integrations.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/journey.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/native_providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/operator.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/orchestration.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/paths.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbook_cli.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbooks.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/provider_generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/receipts.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/snapshots.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/ticket.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/worker.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/workload.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/ci_evidence_pack.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/common.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/cuda_recipe.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/lease_run.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/peft_roundtrip.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_release.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_request.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/siem_export_ndjson.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/telemetry_write_pull.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/use_case_playbook.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/pyproject.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          }
        ]
      },
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "linux-aarch64-cuda",
        "os": "linux",
        "architecture": "aarch64",
        "version": "1.2.0",
        "integration_surfaces": [
          "coh",
          "cohsh",
          "direct_console",
          "evidence",
          "fleet",
          "fuse_direct",
          "fuse_rest",
          "gpu_bridge",
          "hive_gateway",
          "host_sidecar",
          "host_ticket_agent",
          "jetson",
          "network",
          "otel",
          "prometheus",
          "rest",
          "siem"
        ],
        "required_credentials": [
          "AGENT_TICKET",
          "DELEGATION_KEY",
          "GPU_INVENTORY_TICKET",
          "GPU_MAC",
          "REQUEST_AUTH",
          "ROOT_TICKET",
          "SIDECAR_TICKET",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "LICENSE.txt",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/coh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/cohesix-cuda-reference",
            "kind": "elf",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/cohsh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/gpu-bridge-host",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-sidecar-bridge",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-ticket-agent",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/sidecar-bus",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/coh/run/lease/schema",
            "schema_value": "gpu-lease/v1"
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/root_task/schema",
            "schema_value": "1.29"
          },
          {
            "path": "contracts/implementation_surface_inventory.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-implementation-surface-inventory/v1"
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-provider-registry/v1"
          },
          {
            "path": "docs/ADOPTION.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CAUSAL_EVIDENCE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CI_WORKFLOWS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/FIELD_BUS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/HOST_TOOLS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/INTERFACES.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/PRIVATE_LORA_RELEASE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/SECURITY.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/USERLAND_AND_CLI.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1.6",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          },
          {
            "path": "packaging/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/ci/cohesix-journey.yml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-export.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-gateway.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-gpu-executor.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-gpu-inventory.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-sidecar-bridge.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-ticket-agent.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "resources/openapi/hive-gateway.yaml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/build_python_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/render_host_services.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/stage_host_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/__init__.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/audit.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/auth.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/authority.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/backends.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/client.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/defaults.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/errors.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence_graph.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/hf_native.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/identity.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/integrations.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/journey.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/native_providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/operator.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/orchestration.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/paths.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbook_cli.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbooks.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/provider_generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/receipts.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/snapshots.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/ticket.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/worker.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/workload.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/ci_evidence_pack.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/common.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/cuda_recipe.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/lease_run.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/peft_roundtrip.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_release.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_request.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/siem_export_ndjson.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/telemetry_write_pull.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/use_case_playbook.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/pyproject.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          }
        ]
      },
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "linux-aarch64-desktop",
        "os": "linux",
        "architecture": "aarch64",
        "version": "1.2.0",
        "integration_surfaces": [
          "coh",
          "evidence",
          "rest",
          "swarmui"
        ],
        "required_credentials": [
          "REQUEST_AUTH",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "LICENSE.txt",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/coh",
            "kind": "elf",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "elf",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/swarmui",
            "kind": "elf",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/SWARMUI.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          }
        ]
      },
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "linux-x86-64-controller",
        "os": "linux",
        "architecture": "x86_64",
        "version": "1.0.0-beta",
        "integration_surfaces": [
          "coh",
          "cohsh",
          "direct_console",
          "evidence",
          "fleet",
          "fuse_direct",
          "fuse_rest",
          "hive_gateway",
          "host_sidecar",
          "host_ticket_agent",
          "otel",
          "prometheus",
          "rest",
          "siem"
        ],
        "required_credentials": [
          "AGENT_TICKET",
          "DELEGATION_KEY",
          "REQUEST_AUTH",
          "ROOT_TICKET",
          "SIDECAR_TICKET",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "bin/coh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/cohsh",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-sidecar-bridge",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-ticket-agent",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/sidecar-bus",
            "kind": "elf",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/coh/run/lease/schema",
            "schema_value": "gpu-lease/v1"
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/root_task/schema",
            "schema_value": "1.29"
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-provider-registry/v1"
          },
          {
            "path": "docs/FIELD_BUS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1.6",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          },
          {
            "path": "packaging/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-export.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-gateway.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-sidecar-bridge.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/systemd/cohesix-ticket-agent.service.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "resources/openapi/hive-gateway.yaml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/render_host_services.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          }
        ]
      },
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "macos-controller",
        "os": "macos",
        "architecture": "aarch64",
        "version": "1.2.0",
        "integration_surfaces": [
          "coh",
          "cohsh",
          "direct_console",
          "evidence",
          "fleet",
          "fuse_direct",
          "fuse_rest",
          "hive_gateway",
          "host_sidecar",
          "host_ticket_agent",
          "otel",
          "prometheus",
          "rest",
          "siem"
        ],
        "required_credentials": [
          "AGENT_TICKET",
          "DELEGATION_KEY",
          "REQUEST_AUTH",
          "ROOT_TICKET",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "LICENSE.txt",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/coh",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/cohsh",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-sidecar-bridge",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/host-ticket-agent",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/sidecar-bus",
            "kind": "mach_o",
            "executable": true,
            "version": "0.1.0",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/coh/run/lease/schema",
            "schema_value": "gpu-lease/v1"
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1.29",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1.29",
            "schema_pointer": "/root_task/schema",
            "schema_value": "1.29"
          },
          {
            "path": "contracts/implementation_surface_inventory.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-implementation-surface-inventory/v1"
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/schema",
            "schema_value": "cohesix-provider-registry/v1"
          },
          {
            "path": "docs/ADOPTION.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CAUSAL_EVIDENCE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/CI_WORKFLOWS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/FIELD_BUS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/HOST_TOOLS.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/INTERFACES.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/PRIVATE_LORA_RELEASE.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/SECURITY.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/USERLAND_AND_CLI.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1.6",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          },
          {
            "path": "packaging/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/ci/cohesix-journey.yml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/launchd/org.cohesix.gateway.plist.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "packaging/launchd/org.cohesix.ticket-agent.plist.in",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "resources/openapi/hive-gateway.yaml",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/build_python_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/render_host_services.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "scripts/install/stage_host_package.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/README.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/__init__.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/audit.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/auth.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/authority.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/backends.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/client.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/defaults.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/errors.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/evidence_graph.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/hf_native.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/identity.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/integrations.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/journey.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/native_providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/operator.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/orchestration.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/paths.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbook_cli.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/playbooks.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/provider_generated.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/providers.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/receipts.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/snapshots.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/ticket.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/worker.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/cohesix/workload.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/ci_evidence_pack.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/common.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/cuda_recipe.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/lease_run.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/peft_roundtrip.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_release.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/private_lora_request.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/siem_export_ndjson.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/telemetry_write_pull.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/examples/use_case_playbook.py",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "tools/cohesix-py/pyproject.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          }
        ]
      },
      {
        "schema": "cohesix-host-package-profile/v1",
        "id": "macos-desktop",
        "os": "macos",
        "architecture": "aarch64",
        "version": "1.2.0",
        "integration_surfaces": [
          "coh",
          "evidence",
          "rest",
          "swarmui"
        ],
        "required_credentials": [
          "REQUEST_AUTH",
          "TCP_AUTH"
        ],
        "artifacts": [
          {
            "path": "LICENSE.txt",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/Extensions/SwarmUIIntents.appex/Contents/Info.plist",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/Extensions/SwarmUIIntents.appex/Contents/MacOS/SwarmUIIntents",
            "kind": "mach_o",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/Extensions/SwarmUIIntents.appex/Contents/Resources/Metadata.appintents/extract.actionsdata",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/Extensions/SwarmUIIntents.appex/Contents/Resources/Metadata.appintents/version.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/Info.plist",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "SwarmUI.app/Contents/MacOS/swarmui",
            "kind": "mach_o",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/coh",
            "kind": "mach_o",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "bin/hive-gateway",
            "kind": "mach_o",
            "executable": true,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/coh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/cohsh_policy.toml",
            "kind": "toml",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "config/root_task_resolved.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "contracts/provider_registry.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "docs/SWARMUI.md",
            "kind": "text",
            "executable": false,
            "version": "1",
            "schema_pointer": null,
            "schema_value": null
          },
          {
            "path": "package.sbom.json",
            "kind": "json",
            "executable": false,
            "version": "1",
            "schema_pointer": "/bomFormat",
            "schema_value": "CycloneDX"
          }
        ]
      }
    ]
  }
}