{
  "date": "2026-10-23",
  "scope": "local release candidate; user confirms no production environment",
  "status": "local engineering and automated gates passed; production acceptance not performed",
  "toolchain": "go1.27.3",
  "workspaceModules": 18,
  "hardware": {
    "cpu": "Apple M4",
    "memoryBytes": 25769803776,
    "dockerCPUs": 10,
    "dockerMemoryBytes": 8319504384
  },
  "candidates": {
    "fago": "10b634cd07690885a51ce442f1633847fbebc07e",
    "fago-cli": "d05f791402cc38ccfdaf510c17ce2fc4f9abe2d6",
    "fago-vben5": "36cc3f15e41cc94124594bf482381c29ce64ae29"
  },
  "integration": {
    "mysql": {
      "topLevelPassed": 32,
      "race": true,
      "database": "dedicated isolated test database"
    },
    "postgres": {
      "topLevelPassed": 32,
      "race": true,
      "database": "dedicated isolated test database"
    }
  },
  "capacity": {
    "mysql": {
      "requests": 2700,
      "errors": 0,
      "maxP95MS": 122.226,
      "thresholdP95MS": 500,
      "rounds": 9
    },
    "postgres": {
      "requests": 2700,
      "errors": 0,
      "maxP95MS": 100.328,
      "thresholdP95MS": 500,
      "rounds": 9
    }
  },
  "recovery": {
    "mysql": {
      "tables": 31,
      "restoreSeconds": 5.382,
      "rollbackSeconds": 2.527,
      "checks": [
        "v12 data upgraded to v13 and migration rerun succeeded",
        "all current tables restored with identical row fingerprints and CLI readiness",
        "previous release full snapshot restored with identical row fingerprints",
        "restored identity sequence accepts subsequent writes"
      ],
      "cleanup": "all three owned databases dropped; private dumps removed"
    },
    "postgres": {
      "tables": 31,
      "restoreSeconds": 3.241,
      "rollbackSeconds": 1.696,
      "checks": [
        "v12 data upgraded to v13 and migration rerun succeeded",
        "all current tables restored with identical row fingerprints and CLI readiness",
        "previous release full snapshot restored with identical row fingerprints",
        "restored identity sequence accepts subsequent writes"
      ],
      "cleanup": "all three owned databases dropped; private dumps removed"
    }
  },
  "checks": {
    "mysqlSourceVulnerabilities": "0 reachable; 0 imported-package findings; 1 module-only advisory",
    "mysqlRuntime": "API/worker ready, independent loopback metrics, business metrics 404, SIGTERM, configuration redaction passed",
    "mysqlMigrations": "blank and historical upgrades, v12 failure fencing and full restore/rollback passed",
    "postgresSourceVulnerabilities": "0 reachable; 0 imported-package findings; 1 module-only advisory",
    "postgresRuntime": "API/worker ready, independent loopback metrics, business metrics 404, SIGTERM, configuration redaction passed",
    "postgresMigrations": "blank and historical upgrades, v12 failure fencing and full restore/rollback passed",
    "workspace": "18 workspace modules race/vet passed; pgx upgrade followed by PostgreSQL unit/race/vet and complete database regressions",
    "staticModules": "19 source modules including two vendor modules passed dependency DAG checks; CLI is additional workspace member",
    "independent": "18 modules GOWORK=off passed after final pgx upgrade",
    "frontend": "91 tests, typecheck, OpenAPI generation and production build passed",
    "contracts": "659 OpenAPI examples; 634 actual responses (368 encrypted, 266 plain)",
    "proxy": "concurrent atomic proxy publication; all archives valid",
    "golden": "Go and frontend SM4 vectors byte-identical after LF attribute fix",
    "documentation": "synchronization, links, subpath build and browser navigation verified"
  },
  "limitations": [
    "No production environment, production TLS/network/host/account hardening or RPO/RTO verified",
    "No new browser business E2E video or manual user acceptance; evidence is real TCP/TLS test reports",
    "Capacity covers fixed two-tenant plain JSON TLS loopback reads only; no production JWE capacity or soak claim",
    "Database snapshot rollback verified; no prior published production binary or traffic cutover exercised",
    "govulncheck reports one module-level OpenPGP advisory without imported packages or reachable calls",
    "golangci-lint unavailable; gofmt, race, vet and independent builds executed"
  ],
  "scanner": "Go: go1.27.3\nScanner: govulncheck@v1.9.0\nDB: https://vuln.go.dev\nDB updated: 2026-10-21 00:27:29 +0000 UTC",
  "testedArtifacts": {
    "mysql": [
      {
        "name": "fago-api",
        "sha256": "d639a99c689fbd2b4fc73ed75902f99ebf6a94f6f9b68ba12ec4e4c7c386f599",
        "bytes": 27604658
      },
      {
        "name": "fago-worker",
        "sha256": "ded00f43756bd8f1a4e45799c66ed757ea95076d4b10bf035268909004a200c4",
        "bytes": 14571202
      },
      {
        "name": "fago-cli",
        "sha256": "54f758b8c35bae3a202bc7ccfbea0755a1f497f491d20848ef24253508ce9d9f",
        "bytes": 13834706
      }
    ],
    "postgres": [
      {
        "name": "fago-api",
        "sha256": "9bb0783ad8c26bbfb9c1e566bc3bc8824d69b559bcdc5f028b0cbadadfce42bc",
        "bytes": 30981074
      },
      {
        "name": "fago-worker",
        "sha256": "ecb477d834547422ed54c53da21f9403e187b832bb59f4dd729fcfca50fdc4ad",
        "bytes": 18280434
      },
      {
        "name": "fago-cli",
        "sha256": "07a0057e2766e4315dd189df24854dc9dff20ba8f425a8e57683b21c0331f753",
        "bytes": 17393890
      }
    ]
  }
}