{
  "schema": 1,
  "kind": "SOURCE_ONLY_AMENDMENT_PREPARATION",
  "authority": "UL7JQCSH",
  "status": "NOT_EXECUTABLE; BINARY_PINS_AND_QUALIFICATION_PENDING",
  "candidate_commit": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
  "parent_commit": "527cd8e8d7ef192892d5630fce10e69a6d811893",
  "source_blobs": {
    "crates/spt-daemon/src/bootstrap_firewall.rs": "6e6d102c9043881fc721c3e0e7840a07e2ed40e6",
    "crates/spt-daemon/src/bootstrap_firewall/windows.rs": "c7cc6786af511b1d303cfbf407b1f5b32b0a4f65",
    "crates/spt-daemon/src/bootstrap_firewall/linux.rs": "8947958725008b5efc6ed55646869ffff53aa4ab",
    "crates/spt/src/serveverb.rs": "b7d57d39b902dfa277de4667e4d22bfaa31e43e6"
  },
  "changed_blob_paths": [
    "crates/spt-daemon/src/bootstrap_firewall/windows.rs"
  ],
  "upstream_gate_evidence": {
    "source": "Doyle UL7JQCSH",
    "ancestry_trailer_scope_tags": "PASS as reported; not rerun",
    "committed_sha_gate_refresh": "No final receipt supplied",
    "cold_build": "No final receipt or executable hashes supplied",
    "consumers": "Both OS full A/B required before field per fix-2 ruling; no results supplied"
  },
  "binary_bindings": {
    "spt_exe_sha256": null,
    "xtask_exe_sha256": null,
    "artifact_paths_and_sizes": null,
    "source_tree_for_final_driver_W": "Await cold artifact receipt; do not infer from target path"
  },
  "enforcement_criterion": {
    "source_ruling": ".spt/preserved/304-handoff/window6-doyle/doyle-ruling-297-fix2-shape-run-02.md",
    "primary_status_raw": 1,
    "primary_status_name": "OK",
    "required_enforcement_code": 1,
    "veto_enforcement_code": 20,
    "profile_inactive_code_5": "Informational on a multi-profile rule, not a refusal by itself",
    "predicate": "PrimaryStatus == OK AND 1 in raw AND 20 not in raw",
    "transport": "Raw numeric PrimaryStatus and UInt16Array enforcement; representation faults are separate failures"
  },
  "intended_window": 7,
  "isolation": {
    "proposed_fresh_root": "C:/Users/decid/Documents/projects/spt-core/.spt/preserved/hertz-fp-driver-review/d2/field-rig-r10-w7-UL7JQCSH",
    "exists_at_source_preparation": false,
    "root_created": false,
    "final_packet_nonce": null,
    "future_exclusivity": "CreateDirectoryW/CopyFileW fail-if-exists and one consumed marker remain required; all historical rigs and clocks retained",
    "disposal_authorized": false
  },
  "box_clear": {
    "additional_required_known_root": "C:/Users/decid/Documents/projects/spt-core/.worktrees/297-enforcement-shape/target",
    "source_of_path": "Doyle UL7JQCSH; cold receipt still pending",
    "retain_other_participating_roots": true,
    "sample_is_not_lease": true,
    "fresh_sample_after_producers_and_before_GO": true
  },
  "driver": {
    "historical_template": ".spt/preserved/hertz-fp-driver-review/d2/fp-driver-d2-r10-P9RLK4VU.sh",
    "historical_template_sha256": "b499cb07a045aed5707ce29dc0344dcd69d1e2e58d7883649c4b8252e2a89b39",
    "no_historical_file_edits": true,
    "configured_driver_materialized": false,
    "configured_driver_sha256": null,
    "source_assignments_ready": {
      "SUBJECT_SHA": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
      "SUBJECT_BLOB": "c7cc6786af511b1d303cfbf407b1f5b32b0a4f65"
    },
    "qualification_gates": [
      "Resolve the window6 path-valued request mismatch: canonical launcher-exit destination must survive actual consumer extraction including spaces; no in-place repair of frozen artifacts.",
      "Run-local environment-name evidence: bind exact nonce/time and preserve complete name enumeration; do not silently overwrite the historical shared destination.",
      "D3 request allowance must be measured against usable work deadline, excluding ledger reserve; no reuse of the misleading 44-second allowance that provided 14 seconds.",
      "Bind freshly emitted cleanup bytes and their approved file/hash settings; the old six-assignment source/executable rebind alone does not update the historical D3 pin.",
      "Requalify exact request transport with the selected immutable executor, and report statuses separately: setup, launcher, native capture."
    ],
    "clock_policy": "No new budget selected and no clock started. Previous 600/630/120/180 policy is historical baseline, not a grant for another window."
  },
  "d3_source_dependency_comparison": {
    "method": "Read-only comparison of committed source and decoded historical literal. No cleanup renderer, PowerShell or product command invoked. Predicted bytes are NOT a dispatchable product-emitted literal.",
    "candidate": "7890ead39bb7f14ed44aaae44b0951f098ffe9ac",
    "parent": "527cd8e8d7ef192892d5630fce10e69a6d811893",
    "historical_literal_sha256": "38e0f21b2cf2ef1f9d986c650f2f6b0d36335ba25c8b017fe8dcbd5219c94676",
    "historical_encoded_payload_sha256": "416280dbece2601203c74c3f8e2c46e13009125fa5870166894e079329fb1d43",
    "dependencies_equal": {
      "script": true,
      "encoded": true,
      "cleanup_command": true,
      "REMOVE_AND_VERIFY": true,
      "OWNERSHIP": false
    },
    "decoded_delta": "--- S2-pinned-decoded-payload\n+++ fix2-source-only-prediction\n@@ -16,11 +16,11 @@\n # verdict compared against \"Full\" -- so the success value itself was refused and no host\n # state could satisfy the arm. The repair is this ACCESSOR, not a cast: casting the\n # adapted value throws on \"Enforced\". CimInstanceProperties is the unadapted CIM view.\n-function RawValue($object, $name) {\n+function RawValue($object, $name, $expectedType = 'UInt16Array') {\n     $property = $object.CimInstanceProperties[$name]\n     if ($null -eq $property) { throw \"ENFORCEMENT_REPRESENTATION_FAULT: NetSecurity omitted required CIM property $name\" }\n-    if ([string]$property.CimType -ne 'UInt16Array') {\n-        throw \"ENFORCEMENT_REPRESENTATION_FAULT: CIM property $name has type $($property.CimType), expected UInt16Array\"\n+    if ([string]$property.CimType -ne $expectedType) {\n+        throw \"ENFORCEMENT_REPRESENTATION_FAULT: CIM property $name has type $($property.CimType), expected $expectedType\"\n     }\n     $property.Value\n }\n",
    "predicted_encoded_payload_sha256": "ec9a335ffea7803910a47bd4cb3243043efece5a15c01c2a6f6cd84baaca4bbd",
    "product_render_comparison": "PENDING",
    "safe_to_reuse_historical_payload_pin": false
  },
  "execution_gate": {
    "operator": "Doyle only",
    "requires": "Final hashes, approved immutable driver/executor/D3 bindings, required consumer receipts, fresh BOX CLEAR, and explicit one-window/provisioning authorization; actual run-bound GO separately answered by Doyle",
    "no_product_invocations": true,
    "no_build_test_or_host_probe_invocations": true,
    "no_keys_or_trust_or_apply": true,
    "no_firewall_mutation": true,
    "window6_closed": true
  }
}