Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Operator control is scoped to authenticated policy and auditable administrative intent; other services retain secret, wallet and provider authority.
- Customer support chats require expiry after 48 hours of inactivity unless specifically pinned; pinned conversations must remain available for authorized support.
- Initial bootstrap plaintext password must never be persisted in operator ControlStore snapshots, audit records or secret metadata.
Verification still required
- Confirm support retention, authentication and audit invariants in the current Operator implementation; historical phase evidence is not a live system test.
- Live settings repository behavior and sensitive administrative recovery require separate security-owner validation.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.