# WP-PA-002 Implementation Evidence

Baseline: `a2229bc26902e79d63a368e8ab002ebefd4f0863`  
Implementer: Codex (`IMPLEMENTER`)  
Date: 2026-07-30

## Scope delivered

- repeatable Sandbox project and actor bootstrap manifest;
- operational CLI for authenticated bootstrap and consistent SQLite backup;
- hardened loopback-only Compose profile and external secret template;
- activation, rollback, credential rotation, cursor recovery, backup and
  restore runbook;
- regression coverage against the real migrated database schema;
- independent-review brief for Claude Code.

## Local verification

Python: `3.12.13`

```text
PYTHONPATH=src python3.12 -m unittest discover -s tests -v
Ran 24 tests in 7.315s
OK

PIP_NO_CACHE_DIR=1 <clean-venv>/bin/pip install --no-deps .
<clean-venv>/bin/python -m unittest discover -s tests -v
Ran 24 tests in 6.201s
OK

python3.12 -m compileall -q src tests
git diff --check
```

Both final commands completed without output or error.

The operational exercise used a fresh migrated database and verified:

- first bootstrap creates the project and five distinct formal actors;
- replay with the same manifest and stable idempotency keys creates no
  additional events;
- PO, PM, PA, Codex and Claude identities authenticate independently and can
  read the roster, synchronize events and query role-filtered pending actions;
- online backup completes with `PRAGMA integrity_check = ok`;
- the restored database has the same maximum `event_log.cursor` as its source.

The backup exercise initially exposed an incorrect `events(sequence)` query.
The implementation now queries the actual migrated schema,
`event_log(cursor)`, and
`test_backup_is_consistent_and_integrity_checked` prevents regression.

## Container verification handoff

No Docker or Podman runtime is installed in the implementer's Work
environment. The implementer therefore did not claim container-build or
runtime evidence. The independent reviewer must build the exact review commit
in a Docker-capable environment and verify:

- successful image and Compose build;
- healthy service;
- runtime UID `65532`;
- read-only root filesystem, dropped capabilities and
  `no-new-privileges`;
- loopback-only published port;
- persistent database volume.

This is an explicit review task in `WP-PA-002-REVIEW-BRIEF.md`, not a waived
acceptance criterion.

## Secret handling and authority

No populated environment file or actor credential is part of the worktree.
`deploy/project-bus.env.example` contains placeholders only. The runbook keeps
SG, PTO and existing project threads authoritative until an independent
`APPROVE` and PM `ACCEPT`. No endpoint, VM, purchase or internet-facing
deployment was created by this work package.