{
  "status": "operational",
  "checked_at": "2026-11-07T04:42:13.399Z",
  "version": "0.5.2",
  "uptime_seconds": 17010,
  "checks": {
    "storage": "ok",
    "anchoring": "ok",
    "ledger_chain": "ok",
    "ledger_sealing": "ok",
    "webhooks": "ok"
  },
  "ledger": {
    "blocks": 138,
    "entries": 267,
    "pending_entries": 0,
    "last_sealed_at": "2026-11-07T04:41:30.739Z",
    "oldest_pending_seconds": 0,
    "chain_verified": true,
    "head_hash": "313dba9d195aa20fe2c5e244f8d533497b9a4521adfa5cc58454408d9916c2b8",
    "issuer_key_id": "key_a521921c2ba20669",
    "bitcoin_anchoring": "on",
    "oldest_unanchored_block_at": "2026-11-07T04:39:15.731Z"
  },
  "storage": {
    "durable": true,
    "note": "Records are kept on durable storage."
  },
  "webhooks": {
    "pending": 0,
    "delivered_last_hour": 0,
    "failed_last_hour": 0
  },
  "arbitration": {
    "open_cases": 0,
    "awaiting_panel": 0
  },
  "money": {
    "spec": "rs-money-guard/1",
    "fee_mode_configured": "shadow",
    "fee_mode_effective": "shadow",
    "shadow_note": "Fees are computed and sealed as would-charge records; nothing is charged. Collection starts only on an explicit operator decision, and only while arbitration is ready.",
    "circuit_breaker": {
      "state": "closed",
      "tripped_at": null,
      "trip_reason": null,
      "resumed_at": null
    },
    "arbitration": {
      "configured": false,
      "answering": null,
      "ready": false,
      "checked_at": null
    },
    "caps_micro": {
      "per_transaction": 25000000,
      "daily_aggregate": 100000000
    },
    "today": {
      "day": "2026-11-07",
      "events": 0,
      "executed_micro": 0,
      "would_charge_micro": 0,
      "blocked_events": 0
    }
  },
  "quarantine": {
    "spec": "rs-quarantine/1",
    "window_ms": 900000,
    "max_staged_per_tenant": 25,
    "kinds": [
      "rating",
      "attestation",
      "statement"
    ],
    "entry_types": [
      "public.rating",
      "public.attestation",
      "public.statement",
      "record.corrected"
    ],
    "checks": [
      "schema",
      "lint",
      "anonymity",
      "drift"
    ],
    "staged_now": 0,
    "sealed_today": 0,
    "corrected_today": 0,
    "withdrawn_total": 0,
    "note": "Public records stage privately, pass checks, and seal only after the quarantine window; a sealed record is fixed by a linked correction, never by an edit."
  },
  "succession": {
    "spec": "rs-threshold-succession/1",
    "threshold": 2,
    "successors_total": 3,
    "window_ms": 604800000,
    "rule": "A threshold succession takes effect only when all of these hold on the public record: a plan naming three successor public keys was announced for the outgoing key and sealed; the challenge window fixed at announcement has fully elapsed; no designated successor has contested the plan; and at least two distinct announced successors have signed the activation statement binding that plan to one exact new key. A rotation to exactly the activated key is published as the threshold succession; a rotation to any other key is not, whatever else it carries. The governing plan is the latest non-superseded plan for the outgoing key; the full history stays published.",
    "current_key_id": "key_a521921c2ba20669",
    "state": "none_announced",
    "governing_plan": null,
    "counts": {
      "announced": 0,
      "contested": 0,
      "activated": 0,
      "superseded": 0
    },
    "ceremony_runbook": "https://www.a2ally.com/keys/succession",
    "note": "Threshold succession is announced by the operator, waits out a public challenge window, can be frozen by any one designated successor's signed contest, and activates only on two distinct successors' signatures over the exact next key. Designating successors is the operator's act; this surface reports the record as found."
  },
  "incidents": {
    "spec": "rs-incident-automation/1",
    "canary": {
      "model": "time_sliced",
      "model_note": "The deploy route runs one replica and supports no traffic splitting, so a new build serves all traffic for a short observation window while the smoke battery judges it; a confirmed regression rolls back automatically to the last-known-good build. No percentage slice is claimed.",
      "current_build": {
        "build_hash": "b6bd74504de6ac3870c3e95f0c65c0acd2946257062d57294b7d8ce4db69852c",
        "git_commit": "unknown",
        "verdict": "pass",
        "failed_checks": [],
        "verdict_at": "2026-11-06T23:58:48.431Z",
        "verdict_seq": 93,
        "last_check": {
          "verdict": "pass",
          "at": "2026-11-06T23:58:48.431Z",
          "source": "boot"
        }
      },
      "last_known_good": {
        "build_hash": "bf91846d204a44b9ee1b6a3330b2387d24fba3d82560d65c5bec701a0ee2d5c4",
        "git_commit": "a26174a",
        "verdict_at": "2026-11-06T22:14:52.902Z"
      },
      "builds_judged": 2,
      "checks_today": 0
    },
    "incidents": {
      "open": 0,
      "open_by_severity": {
        "info": 0,
        "warning": 0,
        "high": 0,
        "critical": 0
      },
      "filed_total": 0,
      "filed_today": 0,
      "acknowledged_total": 0
    },
    "paging": {
      "mode": "queue_only",
      "external_send": "none",
      "page_severity": "high",
      "queued_now": 0,
      "note": "Exceptions at or above the page severity wait in the operator queue (GET /v1/admin/incidents/queue). Nothing is sent anywhere by this lane: outbound messages need a human approval this automation does not hold."
    },
    "kinds": [
      "smoke_regression",
      "deploy_regression",
      "breaker_trip",
      "rollback"
    ],
    "severities": [
      "info",
      "warning",
      "high",
      "critical"
    ]
  },
  "abuse": {
    "spec": "rs-abuse-shield/1",
    "adaptive_limits": {
      "model": "escalating",
      "window_ms": 600000,
      "watch_at_refusals": 10,
      "throttle_at_refusals": 30,
      "note": "Static per-IP and per-account buckets still apply. On top of them, refusals are remembered in a trailing window: a watched subject is published in aggregate only, a throttled subject is refused even while its static bucket has tokens, and a tenant that sustains throttle-level abuse is auto-quarantined. IP subjects are never auto-quarantined."
    },
    "registration_friction": {
      "proof_of_work": {
        "algorithm": "sha256 leading-zero bits over challenge_id:nonce:counter",
        "difficulty_bits": 16,
        "challenge_ttl_ms": 600000,
        "single_use": true,
        "fires_when": "signups from one network reach 10 in an hour, or the network accumulates 10 abuse events in an hour",
        "challenge_route": "POST /v1/abuse/pow-challenge"
      }
    },
    "quarantine": {
      "reasons": [
        "rate_limit_abuse",
        "signup_abuse",
        "challenge_griefing",
        "operator_review"
      ],
      "duration_ms": 86400000,
      "open_now": 0,
      "filed_total": 0,
      "filed_today": 0,
      "appeals_filed": 0,
      "released_total": 0,
      "appeal_route": "POST /v1/me/abuse/appeal",
      "note": "Quarantine pauses an account's authenticated REST calls (the appeal route and public status stay reachable), seals its reason on the public record under a pseudonymous account reference, and expires on its own at the stated time. Release before expiry is an operator act, sealed with the quarantine it ends."
    },
    "witness_challenge_guards": {
      "evidence_escalation": "after 3 challenges against one witness in 30 days, further challenges need at least 2 evidence URLs on distinct hosts; after 6, the statement must also run to at least 100 characters",
      "evidence_spray": "one evidence set filed against 3 or more distinct witnesses in 30 days is refused"
    },
    "events_today": 7,
    "events_total": 13
  },
  "governor": {
    "spec": "rs-governor/1",
    "anchor_gate": {
      "state": "green",
      "anchoring": "ok",
      "bitcoin_anchoring": "on",
      "oldest_unanchored_block_at": "2026-11-07T04:39:15.731Z",
      "mcp_integrity": {
        "servers_changed_now": 0,
        "drift_observations_today": 0
      },
      "open_decision_cards": [],
      "proof_note": "The staged-proof battery and the weekly anchor run off-platform and keep no table on this deployment, so their verdict is not readable here; this section surfaces the on-platform evidence that verdict judges (anchoring state, the MCP drift record, open decision cards). A drift judgment is filed as an anchor_gate decision card and decided on this console."
    },
    "succession": {
      "spec": "rs-threshold-succession/1",
      "threshold": 2,
      "successors_total": 3,
      "window_ms": 604800000,
      "rule": "A threshold succession takes effect only when all of these hold on the public record: a plan naming three successor public keys was announced for the outgoing key and sealed; the challenge window fixed at announcement has fully elapsed; no designated successor has contested the plan; and at least two distinct announced successors have signed the activation statement binding that plan to one exact new key. A rotation to exactly the activated key is published as the threshold succession; a rotation to any other key is not, whatever else it carries. The governing plan is the latest non-superseded plan for the outgoing key; the full history stays published.",
      "current_key_id": "key_a521921c2ba20669",
      "state": "none_announced",
      "governing_plan": null,
      "counts": {
        "announced": 0,
        "contested": 0,
        "activated": 0,
        "superseded": 0
      },
      "ceremony_runbook": "https://www.a2ally.com/keys/succession",
      "note": "Threshold succession is announced by the operator, waits out a public challenge window, can be frozen by any one designated successor's signed contest, and activates only on two distinct successors' signatures over the exact next key. Designating successors is the operator's act; this surface reports the record as found."
    },
    "money": {
      "spec": "rs-money-guard/1",
      "fee_mode_configured": "shadow",
      "fee_mode_effective": "shadow",
      "shadow_note": "Fees are computed and sealed as would-charge records; nothing is charged. Collection starts only on an explicit operator decision, and only while arbitration is ready.",
      "circuit_breaker": {
        "state": "closed",
        "tripped_at": null,
        "trip_reason": null,
        "resumed_at": null
      },
      "arbitration": {
        "configured": false,
        "answering": null,
        "ready": false,
        "checked_at": null
      },
      "caps_micro": {
        "per_transaction": 25000000,
        "daily_aggregate": 100000000
      },
      "today": {
        "day": "2026-11-07",
        "events": 0,
        "executed_micro": 0,
        "would_charge_micro": 0,
        "blocked_events": 0
      }
    },
    "quarantine": {
      "spec": "rs-quarantine/1",
      "window_ms": 900000,
      "max_staged_per_tenant": 25,
      "kinds": [
        "rating",
        "attestation",
        "statement"
      ],
      "entry_types": [
        "public.rating",
        "public.attestation",
        "public.statement",
        "record.corrected"
      ],
      "checks": [
        "schema",
        "lint",
        "anonymity",
        "drift"
      ],
      "staged_now": 0,
      "sealed_today": 0,
      "corrected_today": 0,
      "withdrawn_total": 0,
      "note": "Public records stage privately, pass checks, and seal only after the quarantine window; a sealed record is fixed by a linked correction, never by an edit."
    },
    "incidents": {
      "spec": "rs-incident-automation/1",
      "canary": {
        "model": "time_sliced",
        "model_note": "The deploy route runs one replica and supports no traffic splitting, so a new build serves all traffic for a short observation window while the smoke battery judges it; a confirmed regression rolls back automatically to the last-known-good build. No percentage slice is claimed.",
        "current_build": {
          "build_hash": "b6bd74504de6ac3870c3e95f0c65c0acd2946257062d57294b7d8ce4db69852c",
          "git_commit": "unknown",
          "verdict": "pass",
          "failed_checks": [],
          "verdict_at": "2026-11-06T23:58:48.431Z",
          "verdict_seq": 93,
          "last_check": {
            "verdict": "pass",
            "at": "2026-11-06T23:58:48.431Z",
            "source": "boot"
          }
        },
        "last_known_good": {
          "build_hash": "bf91846d204a44b9ee1b6a3330b2387d24fba3d82560d65c5bec701a0ee2d5c4",
          "git_commit": "a26174a",
          "verdict_at": "2026-11-06T22:14:52.902Z"
        },
        "builds_judged": 2,
        "checks_today": 0
      },
      "incidents": {
        "open": 0,
        "open_by_severity": {
          "info": 0,
          "warning": 0,
          "high": 0,
          "critical": 0
        },
        "filed_total": 0,
        "filed_today": 0,
        "acknowledged_total": 0
      },
      "paging": {
        "mode": "queue_only",
        "external_send": "none",
        "page_severity": "high",
        "queued_now": 0,
        "note": "Exceptions at or above the page severity wait in the operator queue (GET /v1/admin/incidents/queue). Nothing is sent anywhere by this lane: outbound messages need a human approval this automation does not hold."
      },
      "kinds": [
        "smoke_regression",
        "deploy_regression",
        "breaker_trip",
        "rollback"
      ],
      "severities": [
        "info",
        "warning",
        "high",
        "critical"
      ]
    },
    "abuse": {
      "spec": "rs-abuse-shield/1",
      "adaptive_limits": {
        "model": "escalating",
        "window_ms": 600000,
        "watch_at_refusals": 10,
        "throttle_at_refusals": 30,
        "note": "Static per-IP and per-account buckets still apply. On top of them, refusals are remembered in a trailing window: a watched subject is published in aggregate only, a throttled subject is refused even while its static bucket has tokens, and a tenant that sustains throttle-level abuse is auto-quarantined. IP subjects are never auto-quarantined."
      },
      "registration_friction": {
        "proof_of_work": {
          "algorithm": "sha256 leading-zero bits over challenge_id:nonce:counter",
          "difficulty_bits": 16,
          "challenge_ttl_ms": 600000,
          "single_use": true,
          "fires_when": "signups from one network reach 10 in an hour, or the network accumulates 10 abuse events in an hour",
          "challenge_route": "POST /v1/abuse/pow-challenge"
        }
      },
      "quarantine": {
        "reasons": [
          "rate_limit_abuse",
          "signup_abuse",
          "challenge_griefing",
          "operator_review"
        ],
        "duration_ms": 86400000,
        "open_now": 0,
        "filed_total": 0,
        "filed_today": 0,
        "appeals_filed": 0,
        "released_total": 0,
        "appeal_route": "POST /v1/me/abuse/appeal",
        "note": "Quarantine pauses an account's authenticated REST calls (the appeal route and public status stay reachable), seals its reason on the public record under a pseudonymous account reference, and expires on its own at the stated time. Release before expiry is an operator act, sealed with the quarantine it ends."
      },
      "witness_challenge_guards": {
        "evidence_escalation": "after 3 challenges against one witness in 30 days, further challenges need at least 2 evidence URLs on distinct hosts; after 6, the statement must also run to at least 100 characters",
        "evidence_spray": "one evidence set filed against 3 or more distinct witnesses in 30 days is refused"
      },
      "events_today": 7,
      "events_total": 13
    },
    "witnesses": {
      "registered_keys": 1,
      "distinct_domains": 1,
      "confirmed_unaffiliated": 0,
      "cosignatures_total": 54,
      "finalized_through": null,
      "anchor_confirmed_through": 85,
      "stalest_key_verification_age_seconds": 1558,
      "quorum": {
        "confirmed_unaffiliated": 0,
        "required": 2,
        "source": "schedule",
        "schedule": [
          {
            "min_confirmed": 0,
            "required": 2
          },
          {
            "min_confirmed": 5,
            "required": 3
          },
          {
            "min_confirmed": 10,
            "required": 4
          },
          {
            "min_confirmed": 20,
            "required": 6
          },
          {
            "min_confirmed": 40,
            "required": 8
          }
        ],
        "next_step": {
          "at_confirmed": 5,
          "required": 3
        },
        "finalized_through": null,
        "anchor_confirmed_through": 85,
        "rule": "The quorum steps up on a published schedule as confirmed-unaffiliated witnesses grow: 2 required while fewer than 5 are confirmed, 3 at 5, 4 at 10, 6 at 20, 8 at 40. Every tier's requirement sits well below the count that triggers it, so churn is weather, not a freeze; the requirement is recomputed from the live count on every read."
      },
      "health_counts": {
        "active": 1,
        "quiet": 0,
        "stale": 0
      },
      "probes": {
        "recorded": 0,
        "last_probe_at": null
      },
      "liveness_basis": "Computed from the witness registry's own records (last key verification, cosignatures), plus the H7 probe record at /v1/witnesses/health: operator-run re-fetches of each witness's published key file, recorded append-only. Probes observe; they never adopt a key or change a registry record."
    },
    "decisions": {
      "open": 0,
      "decided": 0,
      "dismissed": 0,
      "decided_today": 0,
      "actions_total": 0,
      "actions_today": 0
    },
    "decision_kinds": [
      "anchor_gate",
      "succession",
      "money",
      "incident",
      "abuse",
      "witness",
      "general"
    ],
    "actions": [
      "pause",
      "resume",
      "override",
      "rebaseline",
      "flag",
      "note"
    ],
    "note": "One surface over the operatorless controls: every section is composed live from the lane that owns it, every decision card carries its evidence on the admin console, and every governor act (file, decide, dismiss, pause, resume, override, rebaseline, flag, note) seals on the public ledger. Nothing on this console sends anything anywhere."
  },
  "witness_health": {
    "spec": "rs-witness-resilience/1",
    "quorum": {
      "confirmed_unaffiliated": 0,
      "required": 2,
      "source": "schedule",
      "schedule": [
        {
          "min_confirmed": 0,
          "required": 2
        },
        {
          "min_confirmed": 5,
          "required": 3
        },
        {
          "min_confirmed": 10,
          "required": 4
        },
        {
          "min_confirmed": 20,
          "required": 6
        },
        {
          "min_confirmed": 40,
          "required": 8
        }
      ],
      "next_step": {
        "at_confirmed": 5,
        "required": 3
      },
      "finalized_through": null,
      "anchor_confirmed_through": 85,
      "rule": "The quorum steps up on a published schedule as confirmed-unaffiliated witnesses grow: 2 required while fewer than 5 are confirmed, 3 at 5, 4 at 10, 6 at 20, 8 at 40. Every tier's requirement sits well below the count that triggers it, so churn is weather, not a freeze; the requirement is recomputed from the live count on every read."
    },
    "witnesses": [
      {
        "label": "W-001",
        "key_fingerprint": "77b542fc",
        "affiliation": "affiliated",
        "current": true,
        "registered_at": "2026-11-07T00:31:30.651Z",
        "last_verified_at": "2026-11-07T04:16:15.643Z",
        "last_verified_age_seconds": 1558,
        "last_cosignature_at": "2026-11-07T04:40:46.698Z",
        "last_cosignature_age_seconds": 87,
        "cosignatures": 54,
        "health": "active",
        "last_probe": null
      }
    ],
    "aggregates": {
      "registered_keys": 1,
      "distinct_domains": 1,
      "confirmed_unaffiliated": 0,
      "active": 1,
      "quiet": 0,
      "stale": 0,
      "cosignatures_total": 54,
      "stalest_confirmed_cosignature_age_seconds": null,
      "probes_recorded": 0,
      "last_probe_at": null
    },
    "basis": "Health classes and ages are computed live from the witness registry's own records (key verifications and cosignatures). Probe outcomes are recorded only when an operator runs POST /v1/admin/witnesses/probe, which re-fetches each current key's published file through the same fetch path registration uses; a probe is observation, never adoption — it changes no registry row, no affiliation and no finality, and no probe daemon or scheduler runs on this deployment, so probe ages are published beside their outcomes.",
    "note": "A witness whose key was last verified more than 30 days ago reads stale and cannot cosign until it registers again. Witnesses are listed under neutral labels with short key fingerprints only — never a domain or a full key id."
  },
  "registry": {
    "agents": 3,
    "resources": 0,
    "licenses": 48
  },
  "witnesses": {
    "registered": 1,
    "relationship": "affiliated",
    "affiliated_witnesses": 0,
    "independent_confirmed": 0,
    "ledger2_genesis_ready": false,
    "key_records": 1,
    "cosignatures": 54,
    "blocks_with_cosignatures": 54,
    "head_cosignatures": 0,
    "page": "https://www.a2ally.com/witnesses",
    "list": "https://www.a2ally.com/v1/ledger/witnesses"
  }
}