Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- The reconciler controls desired state and collects status evidence; it cannot place new purchase orders, move Wallet funds or hold a master key.
- Concurrent host lifecycle reconciliation must be serialized with durable and atomic update/rollback discipline.
- An uncertain provider order result requires status evidence, never speculative repeat submission.
Verification still required
- Verify real authority boundaries across node manager and provider status sources without Docker socket access.
- Prove restart/activation failure isolation and lease/concurrency behavior beyond a single in-memory test fixture.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.