First verified remote witness checkpoint.

Recorded results

Evidence fingerprints

These fingerprints allow comparison with separately retained artifacts. A publicly stated fingerprint alone does not establish independent custody, immutability or a trusted timestamp.

Signed checkpoint SHA-256

48c21a7f35ddae66d8672e0e3a7700f52ab228242523c7d467d30a13d263ff98

Local archive manifest SHA-256

899686a76fd040ca47596e56b39848b3b4e431c8dfe9d0919d5dec6edd2ed1ad

Test date

22 October 2026; object created at 09:15:28 UTC

Evidence custody: The operator created an 11-file local archive. The underlying private evidence is not published on this page. Verification described here comes from the operator-supplied results, not an external audit.

Evidence update — 28 October 2026

The archived witness checkpoint from 22 October 2026 has been reverified offline on the operator’s Chromebook.

• The archive manifest checksum and all nine listed file hashes matched.
• The checkpoint’s Ed25519 signature verified using the retained witness public key.
• The expected run ID and archived bundle/policy hash bindings matched.

Run ID: 762cfa27-9867-4723-ab96-1abf29f2bfa0

Checkpoint SHA-256:
48c21a7f35ddae66d8672e0e3a7700f52ab228242523c7d467d30a13d263ff98

This confirms signature validity and the checked archive bindings relative to the retained public key. It does not establish independent key provenance, current authorization or revocation status.

The issuer signature chain was not reverified during this check. No network requests were made, so current remote-storage availability and configuration were not checked.

Previously recorded limitations remain open: remote duplicate-run rejection, permanent deletion resistance and the oversized-request HTTP 502 issue. This update is operator-performed verification, not an external audit, production certification or completion of the wider Alongkind 207M programme.

Evidence update — 29 October 2026

The archived issuer signature chain for the 22 October synthetic witness checkpoint has now been reverified offline on the operator’s Chromebook.

• Four archived input-file hashes matched.
• Three verifier scripts matched the reviewed source, with trailing newlines normalized.
• All three receipt signatures, their hash-chain links and the signed issuer checkpoint verified.
• The root-signed policy verified at archived epoch 1, with issuer key ID 7b6401f8d1d0fa70337820de and recorded state active.

Run ID: 762cfa27-9867-4723-ab96-1abf29f2bfa0

This extends the witness-signature reverification recorded on 28 October. The three receipts describe synthetic events; valid signatures authenticate the recorded claims, not real provider enforcement.

No replay ledger was requested. No network requests or file-write operations were invoked. Current revocation status, independent key provenance, durable replay protection and permanent deletion resistance remain unestablished.

This is operator-performed offline verification—not an external audit, production certification or completion of the wider Alongkind 207M programme. The previously recorded remote duplicate-run and oversized-request HTTP 502 issues remain open.

Separate PostgreSQL verification — completed 29 October 2026

Operator-supplied Chromebook terminal results record completion of the Alongkind 207M-V3-E PostgreSQL 17.11 native HBA parser exercise. This was a separate, disposable-cluster test, not a deployment of the proposed policy to either existing cluster.

• Native parser: PASS — exact 10/10 HBA rules matched; zero parser errors. Verification checked the parsed fields and rule order using a read-only SQL transaction against the disposable server’s Unix socket.
• The dedicated disposable server was cleanly shut down. The complete disposable run was archived and its contents verified before its temporary directory was removed.
• Final checks reported the protected main cluster online and the protected authentication-lab cluster down.

Exact HBA candidate SHA-256

fdf1a326daf92dd4ff37a826af7baa0dcd6c4a319d999d6051c36d7668f3efbc

Retained full-run archive SHA-256

63aab65c4c93cac7d2c921aaaf627af4c5cef0d916ca3911717274833baf0f24

The archive remains privately retained by the operator. Its published fingerprint supports comparison with separately retained evidence; it does not establish independent custody, an independent audit or a trusted timestamp.

Scope: this completes the disposable native-parser exercise only. Real login tests were not performed. Parser acceptance does not prove authentication enforcement for actual connections, complete the wider PostgreSQL authentication programme, or establish the security of the separate 207M cryptographic, permission or revocation layers.

Limits and remaining work

• Duplicate-run rejection has not been exercised through a second remote POST.
• Permanent deletion resistance and independent retention have not been proven.
• An oversized-request HTTP 502 remains unresolved; local tests expected HTTP 413.
• Production-wide authority enforcement, certification and independent human audit are not claimed.

The tested revision was isolated from ordinary traffic during the recorded preflight. This result supports the Alongkind Control Evidence Matrix, but does not certify every cell.