Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Node-local provider lifecycle authority must never become a Provider order proxy or expose a general Docker API.
- Provider registry updates require an unambiguous signed snapshot representation, strict duplicate-key rejection, and monotonic generation/replay fencing.
- Separate control and data planes must preserve role authorization; signing-root rotations require explicitly verified trust transitions.
Verification still required
- Prove persistent monotonic registry revision/fence storage and signer transition with approved YSQL roles.
- Do not activate test-only adapter fixtures or ambient provider discovery in production; runtime identity and mTLS gates remain independent.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.