# Nine-stage evidence matrix

Checked 2026-10-26. This distinguishes implementation from observed execution. The controlled demo fault was deployed to a tagged revision at zero production traffic; the healthy revision continued serving production. No operator supplied the repair.

| Stage | Implemented gate | Observed evidence |
|---|---|---|
| Monitor | Cloud Monitoring log alert, Pub/Sub authenticated push, revision-specific Cloud Logging | Actual HTTP 500 on revision `aegisflow-app-fault-97d2d674`, log insert `6adf4ba50001c1086f6e28ec`; Monitoring incident `0.oe9xlyttrtp4`; controller incident `304cc0cbdc423fcf`. |
| Plan | Canonical incident lookup, evidence and suspected root cause; safe reconciliation | Controller-created [incident #3](https://gitlab.com/circuitsai/aegisflow/-/issues/3). An initial token-formatting failure and operator reconciliation remain in the hash-linked timeline. |
| Govern | Frozen dependencies, permitted file/line bounds, two attempts, protected target, exact-SHA verification | One attempt reserved. An attribution mismatch blocked release. The correction checks documented human MR attribution, service-account pipeline provenance, and actual session tool results. Reconciliation requires authenticated exact-SHA review and preserves attempt counts. |
| Create | Real enabled Duo flow, diagnose/repair AgentComponents, custom MCP integration | [Session 10053574](https://gitlab.com/circuitsai/aegisflow/-/automate/agent-sessions/10053574), workload `4022660`, successful diagnostic MCP evidence read and actual agent-authored [MR !1](https://gitlab.com/circuitsai/aegisflow/-/merge_requests/1), repair SHA `7c18cf4a96b30e30543fae98eb00ad666914437e`. Trace SHA256 `2bc520df0828ba81234bb126d8c97472f7f963d26eb2753d5a445f9940c234dc`. |
| Verify | Go race/unit, controller, HTTP integration, regression, policy | Duo's new regression fails on fault commit `97d2d674` and passes on its repair. Independent local receipt: `evidence/duo-regression-verification.json`. CI Go, controller, integration and regression jobs pass in [pipeline 2991235711](https://gitlab.com/circuitsai/aegisflow/-/pipelines/2991235711); all 11 required jobs passed. Initial MR pipeline had an unrelated upstream drip timing failure; a single retry passed without source changes. |
| Secure | Bandit, Gitleaks, pip-audit, govulncheck, native GitLab SAST/secret reports, explicit fail-closed gate | Baseline [pipeline 2988496684](https://gitlab.com/circuitsai/aegisflow/-/pipelines/2988496684) passed all 11 jobs. Repair pipeline runs native SAST with `AST_ENABLE_MR_PIPELINES=true`; all 11 jobs passed, including native SAST/secret detection and the explicit security gate. No unavailable scan is counted as passed. |
| Package | Cloud Build, Syft image SBOM, Trivy gate, immutable digest | Controller/fault images have real immutable digests. The incident repair image was built; its image scan was denied by UNKNOWN-severity Debian advisories in the distroless base (DLA-4845-1, DLA-4792-1, DLA-4854-1; `evidence/blocked-image-scan.json`). A scratch runtime and controller-verified release remediation are pending deployment; the SBOM and passing image gate have not yet completed. Source inventory is distinct from image SBOM. |
| Configure | Terraform, separate foundation/app state, bounded resource policy, no destructive changes | Live protected-branch WIF targets CircuitsAI and `aegisflow-source`; excludes the Duo service account. Controller update plans permit only an in-place service image update. Incident-derived app configuration is pending. |
| Release | 10% canary, revision-bound probes, at least 120 requests over 60 seconds, independent metrics, approval/promotion or rollback | Healthy production remains unchanged. Repair canary, promotion or rollback and final incident closure are pending. No end-to-end release is claimed. |

Test doubles are confined to tests. Runtime uses real clients. Agent narrative statements alone do not establish MCP execution or MR authorship: the gate reads successful tool results from the reserved session and canonical GitLab pipeline details. The repair component's redundant MCP command omitted the controller URL and failed; the earlier diagnostic component successfully fetched actual incident evidence. Both outcomes remain visible in the trace.