# Enterprise Readiness Validation Packet

- Date: 2026-05-22
- Scope: implementation evidence for
  [`ENTERPRISE_READINESS_PLAN_2026-05-21.md`](ENTERPRISE_READINESS_PLAN_2026-05-21.md)
- Status: automated local validation is passing; external/manual validation is still required before
  claiming the full enterprise gate complete.

This packet is the review artifact for the OSS-side work. It records what the current repository
proves, which commands produced the proof, and which plan gates still need evidence from a real
identity provider, real MCP clients, or a Kubernetes cluster.

## Completion Boundary

The remaining enterprise-readiness work is external validation, not more local validation-gate
polish. The repository now has automated proof for the implemented code paths and a validator that
rejects missing or stale artifacts. Additional validator hardening should only happen when it
directly captures one of the missing real receipts.

The work required before claiming the full enterprise gate complete is:

1. Run a real Entra dev-tenant smoke for happy-path OIDC login and missing-role denial.
2. Capture IdP role-claim configuration evidence, such as an app-role export or screenshot.
3. Smoke MCP authentication in Cursor and Claude Desktop. Claude Code is already captured.
4. Run a Kubernetes restore drill against a real local cluster and capture sampled recall evidence.
5. Capture SBOM and Cosign receipts from a new qualifying publish workflow or release assets.

Until those are captured, Sibyl is locally validated for the enterprise feature set but not fully
externally proven.

## Implemented Workstreams

| Workstream                         | Current evidence                                                                                                                                                                                                                                                                                                                                                                        | Status                                     |
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| W1 native OIDC authentication      | `apps/api/src/sibyl/auth/oidc.py`, `jit.py`, `silent_refresh.py`; OIDC routes in `apps/api/src/sibyl/api/routes/auth.py`; config in `apps/api/src/sibyl/config.py`; schema tables in `packages/python/sibyl-core/src/sibyl_core/backends/surreal/auth_schema.py`; API-key Argon2id in `apps/api/src/sibyl/auth/api_key_common.py`; Dependabot `uv` coverage in `.github/dependabot.yml` | Automated tests passing                    |
| W2 Sibyl Helm enterprise templates | `charts/sibyl/templates/httproute.yaml`, `networkpolicy.yaml`, `podsecurity.yaml`, `bootstrap-job.yaml`; OIDC and break-glass values in `charts/sibyl/values.yaml`; extra-provider fail check in `charts/sibyl/templates/_helpers.tpl`                                                                                                                                                  | Helm lint and template checks passing      |
| W3 SurrealDB wrapper               | `charts/surrealdb` with pinned chart dependency, RocksDB defaults, bootstrap job, snapshot CronJob, export CronJob, restore-drill CronJob                                                                                                                                                                                                                                               | Helm lint/template and backup gate passing |
| W4 audit log UI/API                | `/api/admin/audit` and `/api/admin/audit/export` in `apps/api/src/sibyl/api/routes/admin.py`; page at `apps/web/src/app/(main)/settings/admin/audit/page.tsx`; tests for API list, CSV, JSON, member denial, and web UI rendering/export                                                                                                                                                | Automated tests passing                    |
| W5 docs                            | `docs/users/login.md`, `cli-setup.md`, `mcp-setup.md`, `sharing-memory.md`; `docs/admin/installing.md`, `inviting-users.md`, `audit-log.md`, `backup-restore.md`, `break-glass.md`; VitePress nav links in `docs/.vitepress/config.mts`                                                                                                                                                 | Docs lint and build passing                |
| W6 hardening                       | Pod Security template, Trivy SBOM/CVE gate and Cosign signing in `.github/workflows/publish.yml`, durable release assets for image SBOM/Cosign receipts, LLM budget enforcement with per-bucket reservation locks, personal-memory deletion purge with audit receipts, recall concurrency limiter, backup restore-to-scratch workflow                                                   | Automated tests passing                    |

## Automated Receipts

These commands were run from `/Users/bliss/dev/sibyl`.

| Gate                     | Command                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | Receipt                                                                                                                                              |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Full monorepo check      | `moon run :check`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | `48 completed (34 cached)`; `api:test` included `1687 passed, 1 skipped, 13 deselected in 19.34s`                                                    |
| Backup restore gate      | `moon run backup-restore-gate`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | `20 passed` core, `17 passed` API, receipt `.moon/cache/backup-restore-gate/receipt.json` status `PASS`                                              |
| Chart lint               | `helm lint charts/sibyl charts/surrealdb`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | `2 chart(s) linted, 0 chart(s) failed`                                                                                                               |
| Sibyl chart render       | `helm template enterprise charts/sibyl ...` with Gateway API, classic Ingress, NetworkPolicy, Pod Security, bootstrap, and Entra OIDC enabled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | rendered `Namespace`, five `NetworkPolicy` resources, `Ingress`, `HTTPRoute`, and bootstrap `Job`                                                    |
| SurrealDB chart render   | `helm template enterprise-db charts/surrealdb ...` with snapshot, export, and restore-drill enabled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | rendered `ServiceAccount`, `Role`, `RoleBinding`, `Service`, three `CronJob` resources, and bootstrap `Job`                                          |
| Extra-provider guard     | `helm template bad charts/sibyl --set 'oidc.providers[0].name=github'`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | failed with `oidc.extra_providers_enabled must be true before enabling GitHub or Google OIDC providers`                                              |
| Provider-neutral ingress | `helm template default charts/sibyl \| rg -i 'kong\|nginx\|traefik\|alb\|gce'`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | no provider-specific ingress defaults matched                                                                                                        |
| Audit API focused tests  | `moon run api:test -- tests/test_surreal_auth_runtime.py::test_local_login_audits_break_glass_action tests/test_surreal_auth_runtime.py::test_create_api_key_writes_project_and_memory_space_scopes tests/test_surreal_auth_runtime.py::test_revoke_api_key_audits_revoke_action tests/test_organization_runtime.py::test_surreal_update_org_member_role_batches_lookup_and_update tests/test_organization_runtime.py::test_surreal_update_project_member_role_uses_batch_update tests/test_routes_admin.py::test_admin_audit_exports_enterprise_event_classes tests/test_auth_settings.py::test_settings_enterprise_auth_features_are_opt_in` | `7 passed in 2.14s`                                                                                                                                  |
| Auth defaults guard      | `moon run api:test -- tests/test_auth_settings.py tests/test_silent_refresh.py`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `30 passed in 2.37s`                                                                                                                                 |
| LLM budget guard         | `moon run api:test -- tests/ai/llm/test_budget.py tests/ai/test_llm_settings_api.py`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `9 passed in 3.58s`                                                                                                                                  |
| Privacy purge guard      | `moon run api:test -- tests/test_jobs_privacy.py tests/test_users_routes.py::test_delete_current_user_schedules_deletion tests/test_surreal_auth_runtime.py::test_request_user_deletion_schedules_private_memory_purge tests/test_surreal_content_persistence.py::test_soft_delete_private_raw_captures_marks_purge_window tests/test_surreal_content_persistence.py::test_purge_due_deleted_raw_captures_deletes_due_rows`                                                                                                                                                                                                                    | `5 passed in 2.21s`                                                                                                                                  |
| Local auth cookie guard  | `moon run api:test -- tests/test_routes_auth.py -q`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | `37 passed in 2.29s`; JSON local login/signup responses persist browser cookies                                                                      |
| Dependency update guard  | `ruby -e 'require "yaml"; data = YAML.load_file(".github/dependabot.yml"); ecosystems = data.fetch("updates").map { \|u\| u.fetch("package-ecosystem") }; abort ecosystems.inspect unless (["uv", "npm", "github-actions"] - ecosystems).empty?'`                                                                                                                                                                                                                                                                                                                                                                                              | Dependabot config parses and includes the workspace `uv` ecosystem                                                                                   |
| Break-glass guard tests  | `moon run api:test -- tests/test_routes_auth.py tests/test_auth_settings.py tests/test_surreal_auth_runtime.py::test_local_login_audits_break_glass_action tests/test_surreal_auth_runtime.py::test_break_glass_audit_details_requires_reason`                                                                                                                                                                                                                                                                                                                                                                                                 | `61 passed in 2.21s`                                                                                                                                 |
| Break-glass chart render | `helm template enterprise charts/sibyl --set breakGlass.enabled=true --set breakGlass.existingSecret=sibyl-break-glass --set 'breakGlass.allowedIPs[0]=203.0.113.0/24' --set breakGlass.expiresAt=2026-05-22T23:00:00Z \| rg -n "SIBYL_(LOCAL_AUTH\|BREAK_GLASS)" -C 1`                                                                                                                                                                                                                                                                                                                                                                        | rendered `SIBYL_BREAK_GLASS_ALLOWED_IPS` and `SIBYL_BREAK_GLASS_EXPIRES_AT`                                                                          |
| Break-glass CLI coverage | `moon run cli:test -- tests/test_auth_login.py`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | `281 passed in 3.23s`                                                                                                                                |
| Break-glass login UI     | `moon run web:test -- src/app/login/page.test.tsx`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | `6 passed`                                                                                                                                           |
| Web audit UI coverage    | `moon run --force web:test`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | `34 passed` test files, `129 passed` tests                                                                                                           |
| External evidence gate   | `moon run enterprise-readiness-evidence-test`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `78 passed in 1.31s`                                                                                                                                 |
| Evidence item listing    | `moon run enterprise-readiness-evidence -- --list`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | listed 13 required external evidence items                                                                                                           |
| Source template backfill | `moon run enterprise-readiness-evidence -- --write-source-templates`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | wrote fillable source JSON templates into `.moon/cache/enterprise-readiness-evidence/source/`                                                        |
| Rendered Helm capture    | `moon run enterprise-readiness-evidence -- --capture-rendered-helm-manifests`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | captured `rendered_helm_manifests` artifacts under `.moon/cache/enterprise-readiness-evidence`                                                       |
| Package diff capture     | `moon run enterprise-readiness-evidence -- --capture-package-lock-diff '5dcdc2a0^'`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | captured fresh `package_lock_diff` artifacts under `.moon/cache/enterprise-readiness-evidence`                                                       |
| Release evidence probe   | `moon run enterprise-readiness-evidence -- --preflight-latest-github-release-evidence`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | expected exit `1`; latest successful publish run `25999961892` is missing Docker security/signing jobs, SBOM artifacts, and Cosign receipt artifacts |
| Environment preflight    | `moon run enterprise-readiness-evidence -- --preflight-current-environment`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | expected exit `1`; source templates pass; desktop MCP clients, local Kubernetes, and release evidence are still missing                              |
| Audit capture guard      | `moon run enterprise-readiness-evidence -- --capture-audit-export-sample https://sibyl.example.com`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            | expected exit `1`; `audit export access token is required`                                                                                           |
| Audit export capture     | `SIBYL_ACCESS_TOKEN=<redacted> moon run enterprise-readiness-evidence -- --capture-audit-export-sample http://127.0.0.1:3334/api --audit-export-format json --audit-export-limit 50`                                                                                                                                                                                                                                                                                                                                                                                                                                                           | captured `audit_export_sample`; JSON sample includes 50 events from the local live API                                                               |
| Claude Code MCP capture  | `moon run enterprise-readiness-evidence -- --capture-mcp-client-smoke-evidence .moon/cache/enterprise-readiness-evidence/source/claude-code-mcp-smoke.json --manual-captured-by Nova`                                                                                                                                                                                                                                                                                                                                                                                                                                                          | captured `mcp_claude_code_auth`; temporary API key was revoked after the local smoke                                                                 |
| IdP config guard         | `moon run enterprise-readiness-evidence -- --capture-idp-role-claim-evidence missing.json`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | expected exit `1`; `IdP role-claim config not found: missing.json`                                                                                   |
| Entra capture guard      | `moon run enterprise-readiness-evidence -- --capture-entra-smoke-evidence missing.json`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | expected exit `1`; `Entra smoke receipt not found: missing.json`                                                                                     |
| MCP capture guard        | `moon run enterprise-readiness-evidence -- --capture-mcp-client-smoke-evidence missing.json`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | expected exit `1`; `MCP client smoke receipt not found: missing.json`                                                                                |
| Restore capture guard    | `moon run enterprise-readiness-evidence -- --capture-restore-drill-evidence missing.json`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | expected exit `1`; `restore drill receipt not found: missing.json`                                                                                   |
| Manual capture guard     | `moon run enterprise-readiness-evidence -- --capture-manual-evidence idp_role_claim_evidence`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | expected exit `1`; `manual evidence requires at least one artifact`                                                                                  |
| Evidence status          | `moon run enterprise-readiness-evidence -- --status`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | expected exit `1`; `4 PASS, 9 INCOMPLETE`; Helm, Claude Code MCP, audit export, and package-lock items: `PASS`                                       |
| Docs lint                | `moon run docs:lint`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `All matched files use Prettier code style!`                                                                                                         |
| Docs build               | `moon run --force docs:build`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | `build complete`                                                                                                                                     |

## Acceptance Gate Audit

| Gate                   | Evidence                                                                                                                                                                                                                                                                                                                                 | Result                                                                                                                                                                                                                                                                              |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Auth contract          | Mocked OIDC, JIT provisioning, missing-role denial, silent refresh, API-key Argon2id, local single-user defaults, and PBKDF2 compatibility tests are present and passing through `api:test`.                                                                                                                                             | Automated proof exists. Real Entra dev-tenant smoke is still missing.                                                                                                                                                                                                               |
| Session                | OIDC callback and silent refresh tests assert the access cookie is set and `sibyl_refresh_token` is not set. Local-auth refresh-token and JSON cookie persistence tests remain in `tests/test_routes_auth.py`.                                                                                                                           | Automated proof exists.                                                                                                                                                                                                                                                             |
| MCP compatibility      | `test_auth_mcp_token_verifier.py`, `test_mcp_oauth_session_refresh.py`, and MCP auth route tests cover JWT/API-key verifier and refresh-token compatibility. Claude Code was smoke-tested against the local MCP endpoint with a temporary scoped API key.                                                                                | Automated proof exists. Manual Cursor and Claude Desktop smoke tests are still missing.                                                                                                                                                                                             |
| Chart                  | Helm lint, enterprise render, SurrealDB render, extra-provider failure, provider-neutral ingress check, and break-glass ConfigMap render are passing.                                                                                                                                                                                    | Automated proof exists.                                                                                                                                                                                                                                                             |
| Data durability        | `moon run backup-restore-gate` passes and writes a PASS receipt. The SurrealDB chart renders snapshot, export, and restore-drill CronJobs; the restore drill now writes a structured receipt, emits a log-capturable JSON block, and supports an opt-in sampled recall hook.                                                             | Automated proof exists. A live local-cluster restore drill with sampled `recall` is still missing.                                                                                                                                                                                  |
| Audit                  | API tests prove filtered list, CSV export, JSON export, member denial, break-glass login events with actor/reason/window details, break-glass expiry/source guards, API-key create/revoke events, memory actions, and org/project role-change events. Web tests prove the audit page renders filters, rows, pagination, and JSON export. | Automated proof exists.                                                                                                                                                                                                                                                             |
| Docs                   | User/admin docs exist, are linked from VitePress nav, and pass `docs:lint` plus `docs:build`.                                                                                                                                                                                                                                            | Automated proof exists.                                                                                                                                                                                                                                                             |
| Security review packet | This file is the packet shell with local receipts and explicit missing external evidence. `enterprise-readiness-evidence` validates the final external artifact bundle and rejects stale generated package-lock and rendered Helm receipts.                                                                                              | Partial. Rendered Helm manifests, Claude Code MCP smoke, audit export sample, and package lock diff are captured locally; still needs IdP role-claim evidence, backup drill receipt from a cluster, Cursor/Desktop MCP smoke, and image SBOM/signature receipts from a release run. |

## Current Environment Preflight

These read-only probes were run from `/Users/bliss/dev/sibyl` on 2026-05-22 to identify which
remaining external receipts can be captured from the current machine.

| Surface             | Command                                                                                                                                                                   | Receipt                                                                                                                                                                   |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Desktop MCP clients | `/bin/ls -1 /Applications`; `/bin/ls -1 "$HOME/Applications"`; targeted `find` for Cursor/Claude config directories                                                       | `Codex.app`, `Visual Studio Code.app`, and `Claude Code URL Handler.app` are present; Cursor and Claude Desktop app/configs are absent                                    |
| Local Kubernetes    | `kubectl --context orbstack get ns`                                                                                                                                       | expected exit `1`; `127.0.0.1:26443` refused the connection                                                                                                               |
| Remote Kubernetes   | `kubectl config current-context`; `kubectl --context eks-us-west-2-int get ns sibyl restore enterprise`                                                                   | current context is `eks-us-west-2-int`; `sibyl`, `restore`, and `enterprise` namespaces are not present                                                                   |
| Release evidence    | `gh run list --repo hyperb1iss/sibyl --workflow publish.yml --limit 5 --json ...`; `moon run enterprise-readiness-evidence -- --preflight-latest-github-release-evidence` | latest successful publish run is `25999961892` from `2026-05-17`; preflight fails because security/signing jobs, SBOM artifacts, and Cosign receipt artifacts are missing |
| Combined preflight  | `moon run enterprise-readiness-evidence -- --preflight-current-environment`                                                                                               | source templates are present; Cursor, Claude Desktop, local Kubernetes, and qualifying release evidence are absent                                                        |

## External Evidence Still Required

The following cannot be proven from this local repository alone:

1. Real Entra dev-tenant smoke for happy-path login and missing-role denial.
2. Manual MCP authentication smoke against Cursor and Claude Desktop.
3. Local Kubernetes restore drill that imports an export into an ephemeral SurrealDB instance,
   verifies fixture row counts, writes the structured restore receipt, and samples a `recall` query.
4. Security-review attachments from live systems: IdP role-claim screenshot or config export,
   cluster backup-drill receipt, release SBOM artifact, and Cosign signature receipt.

The local audit export sample is captured in
`.moon/cache/enterprise-readiness-evidence/audit_export_sample/` from the local live API with the
bearer token omitted from the receipt. Replace it with a target-runtime export when validating a
specific deployment. The Claude Code MCP smoke receipt is captured in
`.moon/cache/enterprise-readiness-evidence/mcp_claude_code_auth/` from a local strict MCP config
using a temporary scoped API key that was revoked after the smoke test. The local rendered Helm
manifest evidence is captured in
`.moon/cache/enterprise-readiness-evidence/rendered_helm_manifests/`. The local package-lock diff
evidence is captured in `.moon/cache/enterprise-readiness-evidence/package_lock_diff/` from
`5dcdc2a0^..HEAD`; rerun the capture command if the auth dependency commits are rebased.

The final external evidence bundle is validated by:

```bash
moon run enterprise-readiness-evidence
```

Use
`moon run enterprise-readiness-evidence -- --init-template .moon/cache/enterprise-readiness-evidence`
to create the manifest skeleton, per-item `receipt.md` stubs, and fillable
`source/entra-smoke.json`, `source/mcp-client-smoke.json`, `source/restore-drill.json`, and
`source/idp-role-claim-config.json` input templates. The template command preserves existing
evidence files by default; use `--force-template` only when intentionally regenerating the bundle.
Existing evidence bundles can backfill or refresh just those source templates with
`moon run enterprise-readiness-evidence -- --write-source-templates`. After real artifacts are
captured, run `moon run enterprise-readiness-evidence -- --sync-hashes` to refresh the manifest
checksums. The `--status` mode reports every incomplete item at once before the final gate runs. The
current local environment can be checked with
`moon run enterprise-readiness-evidence -- --preflight-current-environment`; pass
`--kubernetes-context <context>` when the local restore-drill cluster is not the current kubectl
context. The local rendered Helm receipt can be captured with
`moon run enterprise-readiness-evidence -- --capture-rendered-helm-manifests`. The local package
receipt can be captured with
`moon run enterprise-readiness-evidence -- --capture-package-lock-diff <base-ref>`. Release SBOM and
Cosign receipts can be captured from a qualifying publish workflow with
`moon run enterprise-readiness-evidence -- --capture-github-release-evidence <run-id>`. That capture
requires successful Docker security and signing jobs for both `api` and `web`. It downloads
non-expired Actions artifacts when available and falls back to the GitHub Release's durable
CycloneDX SBOM and Cosign receipt assets when the short-lived Actions artifacts have expired; the
publish workflow attaches those durable assets to every new release. Use
`moon run enterprise-readiness-evidence -- --preflight-github-release-evidence <run-id>` to inspect
all release-evidence prerequisites before attempting artifact capture. Operators can skip manual run
ID lookup with
`moon run enterprise-readiness-evidence -- --preflight-latest-github-release-evidence` and
`moon run enterprise-readiness-evidence -- --capture-latest-github-release-evidence`. The current
latest successful publish run, `25999961892`, does not satisfy this stricter gate because it lacks
the Docker security/signing jobs, SBOM artifacts, and Cosign receipt artifacts. The gate requires
every external item to be marked `PASS`, every artifact to exist under the evidence directory, and
every artifact hash to match the manifest. A live audit export sample can be captured with
`SIBYL_ACCESS_TOKEN=<admin-token> moon run enterprise-readiness-evidence -- --capture-audit-export-sample <runtime-url>`.
The token is read from the environment and omitted from the receipt. The IdP role-claim config
export can be captured with
`moon run enterprise-readiness-evidence -- --capture-idp-role-claim-evidence <idp-config.json>`.
That config must include an `appRoles` list with enabled `Sibyl.Member`, `Sibyl.Admin`, and
`Sibyl.Owner` entries assignable to `User`; the role claim is `roles`. The Entra happy-path and
missing-role denial smoke tests must be captured from one structured JSON receipt with
`moon run enterprise-readiness-evidence -- --capture-entra-smoke-evidence <entra-smoke.json>`. That
receipt must include `status: "PASS"`, `provider: "entra"`, a non-empty `tenant_id`, `runtime`,
`role_claim: "roles"`, a happy-path flow whose `tid` matches the tenant and whose roles include
`Sibyl.Member` or higher, and a missing-role flow with no Sibyl roles plus `denied: true` or HTTP
`401`/`403`. Cursor, Claude Code, and Claude Desktop smoke tests are captured from one or more
structured JSON receipts with
`moon run enterprise-readiness-evidence -- --capture-mcp-client-smoke-evidence <mcp-smoke.json>`.
Each receipt must include `status: "PASS"`, a non-empty `runtime`, and at least one of
`clients.cursor`, `clients.claude_code`, or `clients.claude_desktop` with `status: "PASS"`,
`auth_method`, `tools_listed: true`, and either `tool_call_succeeded: true` or
`recall_succeeded: true`. Missing client entries remain `TODO` until captured. The Kubernetes
restore drill and restored-runtime recall sample must be captured from one structured JSON receipt
with
`moon run enterprise-readiness-evidence -- --capture-restore-drill-evidence <restore-drill.json>`.
That receipt can also be captured directly from a completed SurrealDB wrapper Job with
`moon run enterprise-readiness-evidence -- --capture-kubernetes-restore-drill <job-name> --kubernetes-context <context> --kubernetes-namespace <namespace>`.
The chart emits the JSON between `SIBYL_RESTORE_RECEIPT_JSON_BEGIN` /
`SIBYL_RESTORE_RECEIPT_JSON_END` markers when `restoreDrill.receipt.path` and
`restoreDrill.recallCheck` are configured. It must include `status: "PASS"`, a non-empty `runtime`,
matching `row_counts`, and a non-empty `recall_sample` with a query plus positive result count. The
remaining IdP role-claim attachment can be captured with
`moon run enterprise-readiness-evidence -- --capture-manual-evidence <item-key> --manual-artifact <file> --manual-runtime <runtime> --manual-flow <flow> --manual-result <result>`.
Manual capture is limited to IdP role-claim screenshots or equivalent attachments; structured IdP
config exports, Entra smoke, MCP-client smoke, Kubernetes restore, sampled recall, release,
audit-export, Helm-render, and package-lock proof must use dedicated capture paths.

Until those artifacts are captured, the code-side implementation is locally validated but the full
enterprise acceptance gate is not fully closed.
