{
  "product": "InFinBot",
  "revision": "2026-10-14-proxy-only-7",
  "artifact": "infinbot_proxy.py",
  "artifact_sha256": "08b980d46cab3be25566b9ccc24b74dfa503c3fcb18bc01d7def8460bb24c8d8",
  "critical_defects": 0,
  "production_release": "BLOCKED",
  "scope": "111 isolated software tests and actual credential-free sotality.com account GET; host operations and upstream broker authentication remain unverified",
  "pass_1": [
    {
      "id": "SOFTWARE_REGRESSION",
      "mandatory": true,
      "status": "pass",
      "evidence": "103 unittest tests passed; compileall exit 0; actual loopback WSGI client page/auth-denial test passed"
    },
    {
      "id": "SAMPLE_AND_UNIT_CHECKS",
      "mandatory": true,
      "status": "pass",
      "evidence": "839644 ES futures and 23716 ES options source rows validated; two stock and two option SDK fixture bars validated with incomplete pagination retained; exact MES 5 USD/point, 0.25 tick and 1.25 USD/tick checks passed"
    },
    {
      "id": "CLICKWRAP_AND_TENANT_CONTROLS",
      "mandatory": true,
      "status": "pass",
      "evidence": "Client-page three JavaScript scenarios passed; paid/no-acceptance and accepted/no-payment cannot activate; wrong hash/version/CSRF, cross-origin and tenant injection blocked; direct SQL suspension denies next frame; expired paid entitlement denies fresh frame"
    },
    {
      "id": "HOST_ACCEPTANCE",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Actual Mac, configured current provider observations, signing consumer and ledger not accessed; pending acceptance work, not missing-data software defects"
    },
    {
      "id": "OLD_CREDENTIAL_NETWORK_CHECK",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Observed supplied old pair HTTP401 on paper /v2/account at 2026-10-13T22:34:12.791671+00:00; live endpoint network failure, no HTTP status; replacement and broker revocation record remain unverified"
    },
    {
      "id": "PROXY_ONLY_CLIENT_ROUTING",
      "mandatory": true,
      "status": "pass",
      "evidence": "111 tests passed; GET routes pinned to sotality.com; no credential headers forwarded; redirect/order/credential-query routes blocked; default rotation does not open key files; real WebSocket calls blocked without proxy contract"
    },
    {
      "id": "ACTUAL_PROXY_ACCOUNT_ACCESS",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Actual GET https://sotality.com/v2/account at 2026-10-14T19:31:57.818559+00:00 returned HTTP403; zero credentials/direct Alpaca calls/orders; origin of denial and upstream binding unverified"
    }
  ],
  "pass_2": [
    {
      "id": "OPERATION_FAILURE_PATHS",
      "mandatory": true,
      "status": "pass",
      "evidence": "Scheduler backend fixtures preserve other jobs, are idempotent, reject unmarked duplicates, and restore previous definitions after failed readback; notifier timeout sends once, never infers phone delivery; stale phone receipt rejected"
    },
    {
      "id": "PUBLIC_SAMPLE_PROVENANCE",
      "mandatory": true,
      "status": "pass",
      "evidence": "Sample SHA256 receipts retained; ES not relabeled MES; SDK examples labeled provider fixtures; no ledger writes or worker activation"
    },
    {
      "id": "ACTUAL_MAC_OPERATIONS",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Operations command stopped HOST_OPERATIONS_UNAVAILABLE in non-Mac workspace; no schedules installed or notification sent here"
    },
    {
      "id": "COMMERCIAL_HOST_BINDING_AND_BROWSER_RENDER",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Trusted authenticated session middleware, bounded TLS transport and actual browser viewport review require intended deployment host; no LGC contract modification"
    },
    {
      "id": "OFFSITE_AND_APPLICATION_RECOVERY",
      "mandatory": true,
      "status": "unverified",
      "evidence": "Owner native snapshot receipt passed; offsite restore and actual application restart not performed"
    },
    {
      "id": "PROXY_SCOPE_REVIEW",
      "mandatory": true,
      "status": "pass",
      "evidence": "Client file-auth setup retired; setup no longer requests broker credentials; legacy HTTP hostnames only normalize to proxy; no hidden direct fallback or fabricated success"
    }
  ]
}