# Deployment evidence fixtures

Deterministic, synthetic fixtures for the deployment and supply-chain readiness gates in `docs/specs/pdf2html-security-containment.md`, the Phase 0 deployment preflight contract, and readiness gate B7.

## Contract

- `suite.json` identifies the suite, fixed fixture clock, schemas, JSONL file, and exact case count.
- `cases.jsonl` contains one independently parseable case per line. Stable IDs use `DE-<GATE>-NNN`.
- `case.schema.json` defines the typed evidence envelope and explicit expected `outcome`, `error`, and human-auditable `evidence` assertions.
- `suite.schema.json` defines the suite manifest.
- `validate.py` performs JSON Schema validation when `jsonschema` is available and always performs deterministic semantic checks.

Each input is a redacted evidence observation, not a command or a live probe. `PASS` requires direct affirmative evidence. A direct contradiction is `FAIL`. Missing, stale, malformed, unauthenticated, unreadable, or otherwise indeterminate evidence is `BLOCKED`; it must never be inferred as passing.

The suite covers DNS, TLS, origin routing, CORS, CSRF, runtime containment, database access through `@platform-modules/db`, private S3-compatible storage, Stripe Tax, platform packages, health, readiness, rollback, SBOM, provenance, and vulnerability policy. Cases include positive, boundary, negative, malformed, duplicate/idempotent, stale/race-order, and fail-closed behavior where applicable.

## Safety and redaction

All domains, identifiers, digests, timestamps, counts, and statuses are synthetic. No source/customer PDF, customer content, object key, credential, cookie, signed URL, live token, connection string, or executable resource-exhaustion payload is present. `secret_names` may list required environment variable names only; secret values are forbidden.

Fixture consumers must not reinterpret `input.status` as the oracle. They must evaluate the assertions and compare their result to `expected`. The deliberately malformed timestamp case remains structurally valid so consumers can verify semantic fail-closed handling.

## Validation

Run only in an approved remote validation host (`debian1`, `debian2`, or `debian3`):

```sh
python3 quality/fixtures/deployment-evidence/validate.py
```

The validator performs no network access and no infrastructure mutation. A successful run reports the exact number of cases, gate count, outcome counts, and whether JSON Schema validation was available.