{
  "schemaVersion": "1.0",
  "id": "controlled-workflows-20261113",
  "date": "2026-11-13",
  "timezone": "America/Toronto",
  "status": "author-run controlled evidence",
  "boundary": "Fresh local Studio, released SDK, original OPA and a synthetic HTTP/SQLite resource. Scripted reviewers. No customer system, real payment, or production deployment.",
  "versions": {
    "sdk": "osuite@2.13.0",
    "studioSource": "a03e86ae0bdfcdf1e5d9216ca2b7ff4f8c8b6c72",
    "opa": "1.22.4",
    "node": "24.22.0",
    "sdkTarballSha256": "98807e101bdd5ac20c38f6dd8d28b99b6a92baa75bc230f1fa099d814d3001c4"
  },
  "main": {
    "run": "main-02",
    "sequences": 288,
    "scenarios": 24,
    "variants": 3,
    "arms": [
      {
        "id": "opa-precheck",
        "name": "Policy precheck + ordinary resource",
        "sequences": 72,
        "normalCompleted": 9,
        "normalTotal": 9,
        "unsafeEffects": 27,
        "sameOperationRepeatEffects": 15,
        "publicReads": 3
      },
      {
        "id": "sdk-precheck",
        "name": "Precheck + released SDK + ordinary resource",
        "sequences": 72,
        "normalCompleted": 9,
        "normalTotal": 9,
        "unsafeEffects": 27,
        "sameOperationRepeatEffects": 0,
        "publicReads": 3
      },
      {
        "id": "conventional-resource",
        "name": "Conventional journal + protected resource",
        "sequences": 72,
        "normalCompleted": 9,
        "normalTotal": 9,
        "unsafeEffects": 0,
        "sameOperationRepeatEffects": 0,
        "publicReads": 0
      },
      {
        "id": "sdk-resource",
        "name": "Released SDK + the same protected resource",
        "sequences": 72,
        "normalCompleted": 9,
        "normalTotal": 9,
        "unsafeEffects": 0,
        "sameOperationRepeatEffects": 0,
        "publicReads": 0
      }
    ],
    "interpretation": "Precheck arms deliberately lack commit-time enforcement. The protected arms share the same resource checks and have equal safety; this is not a general vendor ranking. Effect counts may overlap and are not incident frequencies.",
    "callbackCompletedWithNonSuccessBusinessStatus": 33,
    "callbackInterpretation": "Callback lifecycle completion is not a promise of business success. These returns were denied, business_duplicate or business_declined; the conventional journal uses the same lifecycle convention."
  },
  "semantics": {
    "run": "bank-repeat-01",
    "scope": "Separate known-family replication, not a fully connected industry product chain",
    "rows": 936,
    "receiverOutputs": 1872,
    "nativeInvocations": 4,
    "originalCaptureReplays": 12,
    "falseSupportedClaims": 0,
    "roleRegressions": 0,
    "perArm": {
      "rows": 312,
      "definitive": 119,
      "unknown": 37,
      "unsupported": 156
    },
    "interpretation": "All three methods have the same classifications. No unique correctness, human maintenance saving or new industry-profile validation is established."
  },
  "cloud": {
    "region": "Canada Central",
    "vm": "Standard_D4as_v5",
    "replication": {
      "run": "cloud-contract-01",
      "sequences": 144,
      "scenarios": 24,
      "variants": 3,
      "arms": [
        {
          "id": "opa-precheck",
          "sequences": 72,
          "normalCompleted": 9,
          "normalTotal": 9,
          "unsafeEffects": 27,
          "sameOperationRepeatEffects": 15,
          "publicReads": 3
        },
        {
          "id": "conventional-resource",
          "sequences": 72,
          "normalCompleted": 9,
          "normalTotal": 9,
          "unsafeEffects": 0,
          "sameOperationRepeatEffects": 0,
          "publicReads": 0
        }
      ]
    },
    "load": {
      "run": "cloud-load-01",
      "offers": 1152,
      "uniqueEffects": 576,
      "duplicateEffects": 0,
      "unsafeEffects": 0,
      "inFlight": [
        1,
        8,
        32
      ],
      "wavesPerLevel": 3,
      "restartCases": 9
    },
    "scope": "Original OPA + synthetic resource only, not cloud SDK/Studio capacity or a product SLA. Replication retains its unsafe control results; zero duplicate/unsafe load results belong only to cloud-load-01. Restart happened after all load responses."
  },
  "sourceRecords": [
    {
      "record": "main-02 independent Python verification",
      "sha256": "997a1d4e101fe9da3d7a27787efe5ce3250b1a492923c0d862c395cdc31f705a"
    },
    {
      "record": "known-family independent readback",
      "sha256": "cafa0dcd55e9a4bf1d961517aa86f3c95c724e84142423ef70f6a1cace75879e"
    },
    {
      "record": "cloud independent load readback",
      "sha256": "372ac75ca5c1b3c945e7705bcc8204382c8e705625d1cebf07a2fdfec033ccba"
    }
  ],
  "disclosure": "This public aggregate is not the complete raw reproducibility package. Hashes identify retained source reports, not external certification. Raw sessions, credentials and private material are excluded. Scoped technical review can establish an appropriate shareable subset."
}