Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- LibreDB/Studio inspection accounts must be read-only, separate from application principals and incapable of ledger or schema mutation.
- Secret material should be loaded through scoped files/rotation, not propagated as broad operator credentials.
Verification still required
- Verify live read-only YSQL/Redis permissions, session behavior and ingress separately.
- A pinned Studio image or offline health probe is not a live authorization test.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.