root

ci → green (exact-head Root CI run 29741431633: 27 tests, 103 assertions, CLI bundle, lifecycle dry-runs, numbered-spec contract, and port-registry gate)

commit → db9b7fe3a666780e057f7e2498acccdc6b070199

observedAt → 2026-07-20

evidenceMode → automated

Root now defines the canonical `frauthy.com` public origin, intentional service subdomains, Terraform ownership boundary, hermetic Dagger registry location, `master` trunk semantics, deployment states, human bootstrap gates, and rollback/admission invariants.

`frauthy.dev` was an earlier placeholder origin, not an approved production domain. Current delivery contracts reject it for the public Site; intentional service endpoints remain beneath `frauthy.com`.

infrastructure

ci → green (exact-head Infrastructure CI run 29740829130: Terraform formatting, validation, mocked environment plans, topology tests, lifecycle guards, and Compose validation)

deploy → Terraform owns the complete Cloudflare, Neon, DNS, routing, secrets-reference, and environment topology contract; no apply or provider mutation was performed

commit → cb971dc2427d978035bc35a46c07ef1748fa81b5

observedAt → 2026-07-20

evidenceMode → automated

Bootstrap remains fail-closed until dedicated Cloudflare and Neon accounts, the Frauthy 1Password vault and secret references, remote state, imports, and reviewed no-replacement plans exist.

devops

ci → green (exact-head DevOps CI run 29743161995, E2E Smoke run 29743161922, and Delivery Foundation run 29743162105)

build → pass (Dagger exact-source analysis, change graph, build-once Site checks, package admission, immutable evidence, and Terraform plan-only verification)

deploy → Master-triggered Dagger delivery is wired but mutation remains disabled until Terraform-owned targets and protected credentials are activated

commit → 72c4dbfc85ed6b8a60b4cd771b6bfdeb55f505ea

observedAt → 2026-07-20

evidenceMode → automated

The Dagger module is hermetic and loaded from an exact immutable DevOps commit. It verifies binary Site artifacts inside the pinned Bun container rather than transporting fonts through a text API.

DEVOPS-5 remains open pending a dedicated least-privilege `FRAUTHY_CI_TOKEN` and live cross-repository dispatch evidence. DEVOPS-7 remains open pending verified aggregate coverage enforcement.

site

ci → green (exact-head Site CI run 29743237251 and Dagger Delivery run 29743236771)

build → pass (frozen install, UI SDK, 21 unit tests and 252 assertions, LCOV, zero Astro diagnostics, ESLint, deterministic social card, six-page static build, 14 browser/accessibility checks, Lighthouse budgets, binary inventory, Syft SPDX, provenance, HMAC evidence, and signed-bundle admission)

deploy → Dagger produces and admits one immutable `frauthy.com` artifact from `master`; provider mutation remains disabled and no Pages deployment occurred

commit → 264c0fd4bb08e297460e7c0c2968c2a67a1d1d56

observedAt → 2026-07-20

evidenceMode → automated

Browser, accessibility, Lighthouse, per-file binary hashes, package evidence, and final directory identity gate the same build artifact. Dagger admitted 33 files and 2,714,639 bytes at Site digest `sha256:b6ce6c31cb3bbd6b64db2d5eb358acb6c03c68ae4f2b688b0f69ce710de6f273`; the legacy direct-deploy workflows remain visible refusal stubs.

sdk

ci → green (exact-head SDK CI run 29740865737)

release → Dagger change-graph documentation now targets master-triggered multi-language SDK packaging; no package was published

commit → ade384246bf8b7d5cba70475e0985e777756e898

observedAt → 2026-07-20

evidenceMode → automated

cloud

ci → green (exact-head Cloud CI run 29740869572)

deploy → Portal links use the canonical Site origin while Cloud deployment remains a Terraform-owned, Dagger-gated future activation; no provider mutation occurred

commit → aa211a421f98431202e612a2002794a58506a1d4

observedAt → 2026-07-20

evidenceMode → automated

market

ci → green (exact-head Market CI run 29740874306)

deploy → Marketplace links use the canonical Site origin while image publication and runtime rollout remain gated; no image or provider resource was published

commit → d1eeb351cf46373eb7c66ca711b0a57550ebd75e

observedAt → 2026-07-20

evidenceMode → automated

research

ci → green (exact-head Research CI run 29740877330 for canonical Site-link adoption)

commit → 1fd92d6d19ae0fcf4c1d47d1ffd10fe6ab467ecc

observedAt → 2026-07-20

evidenceMode → automated

Project Management links now use `https://frauthy.com`; this delivery digest does not close any numbered gap.

Program-wide

No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.

Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.