One-shot activation preflight.
Mandatory abort, every time.
A production-shaped preflight that can prove identity, request binding and independent review—but cannot mint an activation ticket, release a callable, invoke the Adapter or commit a call.
Live one-shot Activation Ticket authority
Repository evidence may qualify an abort-only preflight. It cannot create a live ticket or authorize port 8110.
Capability-free hold-quorum terminal
Only the exact 40-field terminal receipt crosses the boundary.
Facts enter. Authority does not.
digest + terminal facts
no permit, vote, target object
fresh detached roots
Exact shape, exact digest, zero inherited execution surface
Root, owner, key and class separation
Describes one activation; authorizes none
No mutable lookup can change the requested identity
Short-lived and single purpose
Expiry fires the abort latch; it never extends authority.
Atomic claim surface 1/3
Replay, partial claim or cross-generation reuse fails closed before target verification proceeds.
Identity without an instance
Adapter facts are digest-bound before latch arming
Fresher than the request
Nothing callable can escape
activationSurfaceBound, productionInstanceBound and callableBound are all closed-schema false.
Security arms destruction, not execution
Bypass is structurally forbidden
bypassAllowed is signed. A missing, true or renamed value breaks the exact 38-field schema.
Every terminal class fires the latch
Latch expires before its parent request
Atomic claim surface 2/3
An armed latch can be claimed once. There is no “unarm then rearm” mutation path.
Independent review, abort-only verdict
“Qualified” proves facts and latch posture only; it explicitly does not authorize activation.
Detached signer verifies the entire chain
Narrowest evidence window
Atomic claim surface 3/3
The third and final nonce can only lead to latch fire and preflight destruction.
There is no transition from “qualified” to “active”
Success still destroys the preflight
24 complete paths, zero activation tickets.
Failure cannot skip custody closeout
360 corrupt paths deterministically fail closed.
SRE terminal evidence
Every external-effect counter remains zero
| Surface | Value | Surface | Value |
|---|---|---|---|
| Payloads / callables | 0 / 0 | Tickets / permits | 0 / 0 |
| Network / persistence | 0 / 0 | Adapter invokes / commits | 0 / 0 |
| Host contacts / mutations | 0 / 0 | Port 8110 calls | 0 |
Executable cryptographic evidence
Real WebCrypto P-256 sign and verify; no fetch, network, process, host or environment access.
One qualified lane + six 60-case fault families
| Suite | Cases | Expected |
|---|---|---|
| Complete abort-only path | 24 | QUALIFIED + DESTROYED |
| Cut 99 / Request / Target | 180 | REJECT |
| Latch / Attestation / Closeout | 180 | ABORT + DESTROY |
Before claim, after arm, during closeout
Each cutpoint names its required terminal class and preserves the zero-ticket fence.
Cut 100 extends—not resets—the verified model
Three repository-bound, one live red gate
21 owned production gaps
Portal is live; Controller execution is not
Detached one-shot Activation Ticket + dual-control arming
abort-only, destroyed
still fail closed
The next cut must not reuse this preflight object, latch, signer nonce or any Cut 99 permit material.