AP-SPEC-066 Epic 5: launch gate and operator qualification simulation

.gitleaksignore

@@ -72,3 +72,13 @@ af4791caed6a8cb6fc37313f9cacfe52bc0e2394:product/integrations/auths-stripe/fixtu
 # generator now names the key "commit" and writes digests as "sha256:<hex>".
 d92064d919b7c2498ce62588ff48a82284f0bcd7:formal/proof-coverage-v1.json:generic-api-key:9
 d92064d919b7c2498ce62588ff48a82284f0bcd7:formal/proof-coverage-v1.json:generic-api-key:84
+
+# Public metadata in signed development-rehearsal evidence (7 October 2026).
+# key_sha256 is hex::encode(AttemptKey), the SHA-256 of public attempt identity;
+# support.rs never exports provider credentials. Preserve the exact signed-run
+# support bytes; these exceptions cover only the named historical fingerprints.
+8b6f96e7e43dacf5b7f237cfc015f84a513a2bd1:qualification/simulation/evidence/airtable-live-2026-10-07/support-bundle.json:generic-api-key:1
+3e9704b5d4d12bc654fc48de9b03ab6adb9fcb41:qualification/simulation/evidence/stripe-platform-live-2026-10-07/support-bundle.json:generic-api-key:1
+# Ordinary progress prose triggered the generic key rule. The current prose
+# avoids the ambiguous wording; no credential occurred in the historical line.
+3e9704b5d4d12bc654fc48de9b03ab6adb9fcb41:docs/PROGRAM_BOARD.md:generic-api-key:477

architecture/dependency-graph.dot

@@ -763,6 +763,7 @@ digraph auths_architecture {
   "xtask" -> "auths-did-key" [label="normal"];
   "xtask" -> "auths-did-web" [label="normal"];
   "xtask" -> "auths-errors" [label="normal"];
+  "xtask" -> "auths-gateway" [label="normal"];
   "xtask" -> "auths-github" [label="normal"];
   "xtask" -> "auths-hsm-attested" [label="normal"];
   "xtask" -> "auths-kubernetes" [label="normal"];
@@ -777,6 +778,7 @@ digraph auths_architecture {
   "xtask" -> "auths-radicle" [label="normal"];
   "xtask" -> "auths-raw-key" [label="normal"];
   "xtask" -> "auths-receipts" [label="normal"];
+  "xtask" -> "auths-recipe-qualification" [label="normal"];
   "xtask" -> "auths-records-api" [label="normal"];
   "xtask" -> "auths-registries" [label="normal"];
   "xtask" -> "auths-signature" [label="normal"];

architecture/dependency-graph.json

@@ -16991,6 +16991,18 @@
         "std"
       ]
     },
+    {
+      "source": "xtask",
+      "source_layer": "tooling",
+      "target": "auths-gateway",
+      "target_layer": "product",
+      "scope": "internal",
+      "kind": "normal",
+      "target_condition": null,
+      "optional": false,
+      "default_features": true,
+      "features": []
+    },
     {
       "source": "xtask",
       "source_layer": "tooling",
@@ -17169,6 +17181,18 @@
       "default_features": true,
       "features": []
     },
+    {
+      "source": "xtask",
+      "source_layer": "tooling",
+      "target": "auths-recipe-qualification",
+      "target_layer": "product",
+      "scope": "internal",
+      "kind": "normal",
+      "target_condition": null,
+      "optional": false,
+      "default_features": true,
+      "features": []
+    },
     {
       "source": "xtask",
       "source_layer": "tooling",

bindings/fixtures/gateway/production-codes.json

@@ -20,6 +20,110 @@
         "id": "lease-never-precedes-claim"
       }
     },
+    {
+      "code": "gateway.commissioning.binding-mismatch",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.clock-untrusted",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.contention",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.exhausted",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.expired",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.registration-missing",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.restore-rollback",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.revocation-rollback",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.revocation-stale",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.revoked",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.state-corrupt",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.store-unavailable",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
+    {
+      "code": "gateway.commissioning.unavailable",
+      "owner": "commissioning-budget",
+      "stage": "before-custody",
+      "status": "implemented",
+      "epic": 5,
+      "case": null
+    },
     {
       "code": "gateway.connection.credential-generation-missing",
       "owner": "engine",

bindings/fixtures/qualification/commissioning-v2.json

@@ -0,0 +1,18 @@
+{
+  "schema": "auths.qualification-commissioning-vectors/2",
+  "synthetic": true,
+  "trust_root": "{\"public_key_b64\":\"0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc\",\"root_id\":\"test-root\",\"schema\":\"auths.qualification-trust-root/1\",\"signature_suite\":\"ed25519-v1\"}",
+  "signer_certificate": "{\"root_signature_b64\":\"CbNmJUTovHK87FHlPhOC2TtvjfxmR5FHDvg4EAsNSjLR5bjqqG4zBOhDwbwXlNN97La1kMEVU57h3ApQVI_MCg\",\"statement\":{\"issued_at\":1789913600,\"not_after\":1790086400,\"not_before\":1789913600,\"permitted_artifact_kinds\":[\"qualification-commissioning-permit\"],\"public_key_b64\":\"oJql9HpnWYAv-VX43C0qFKXJnSO-l_hkEn_5ODRVpPA\",\"root_id\":\"test-root\",\"schema\":\"auths.qualification-signer-certificate/1\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"test-commissioner\",\"signer_kind\":\"protected-software-release-key-v1\"}}",
+  "revocation_list": "{\"root_signature_b64\":\"sAtYxcGQsy05npek7vQrBcpqiHKWqcEV-g4EowFJhxs4guxt73ual7FEngULuO3H15qIZLIy4HrbJdyISzJVAA\",\"statement\":{\"issued_at\":1789996400,\"next_update\":1790086400,\"revoked_qualifications\":[],\"revoked_signers\":[],\"root_id\":\"test-root\",\"schema\":\"auths.qualification-revocation-list/1\",\"sequence\":1}}",
+  "permit": "{\"signature_b64\":\"0nrpp-Hm34Xnj5fGodRMJJDp6ifsNFCvFJ4M3j7aS9Jz73Y7HkXjYi1GfhzQWLTh6tRTP-VhzSHoukbmeTN6Bg\",\"statement\":{\"binding\":{\"allowed_actions\":[\"6363636363636363636363636363636363636363636363636363636363636363\",\"6464646464646464646464646464646464646464646464646464646464646464\"],\"maximum_credential_leases\":32,\"offline_evidence\":{\"conformance_sha256\":\"8749fb03dc89fe583529f59c613c78319e893898118092c61344812be78d1b5c\",\"differential_sha256\":\"5f22f2e011050cbabf1f58bdf92a2912fa489353309b594b4db327865e82cd7f\"},\"principal_sha256\":\"6060606060606060606060606060606060606060606060606060606060606060\",\"protected_run\":\"github.com/auths-dev/auths-proof/actions/runs/1/attempts/1\",\"provider_environment_class\":\"provider-test-mode\",\"resources_sha256\":\"6262626262626262626262626262626262626262626262626262626262626262\",\"source_commit\":\"0123456789abcdef0123456789abcdef01234567\",\"trusted_contexts_sha256\":[\"6161616161616161616161616161616161616161616161616161616161616161\",\"6565656565656565656565656565656565656565656565656565656565656565\"],\"tuple\":{\"compiled_recipe_sha256\":\"1111111111111111111111111111111111111111111111111111111111111111\",\"gateway_semantic_closure_sha256\":\"4444444444444444444444444444444444444444444444444444444444444444\",\"profile_lock_sha256\":\"2222222222222222222222222222222222222222222222222222222222222222\",\"provider_contract_id\":\"3333333333333333333333333333333333333333333333333333333333333333\",\"recipe_family\":\"example-refund-v1\",\"target\":{\"arch\":\"x86_64\",\"credential_store_kind\":\"aws-secrets-manager-v1\",\"gateway_build_sha256\":\"5555555555555555555555555555555555555555555555555555555555555555\",\"gateway_package\":\"auths-gateway\",\"gateway_version\":\"1.0.0-rc.1\",\"os\":\"linux\",\"store_kind\":\"postgresql-v1\",\"store_schema\":\"auths.gateway-store/1\"}}},\"issued_at\":1790000000,\"not_after\":1790007200,\"not_before\":1790000000,\"schema\":\"auths.qualification-commissioning-permit/2\",\"signature_suite\":\"ed25519-v1\",\"signer_id\":\"test-commissioner\"}}",
+  "permit_digest": "6023cdfdc1af437745f506196bfb853dc10e9d9e53be86337d230a8934a44480",
+  "budget_scope_sha256": "01640eb7b447d8b909e6955a186f95e3c7bc6765174ee23d8b3dbd0db1c845e5",
+  "budget_binding_sha256": "d6782163617e1f1aa54cd272fb776fc70426a90fade59718b24306cbfe2275c0",
+  "limits": {
+    "actions": 256,
+    "contexts": 4,
+    "leases": 1024,
+    "seconds": 7200,
+    "bytes": 32768
+  }
+}