docs(stage2): integrate formal closure record

README.md

@@ -10,10 +10,13 @@ review. Network Automation Lab treats that work as a small QA platform: local
 inputs are validated deterministically, results become machine-readable and
 human-readable evidence, and unsafe or unavailable paths fail closed.
 
-**Stage 2: CLOSED / LIVE PROVEN** for one Owner-authorized MikroTik Lab1 VRRP
-read-only workflow, with observed RouterOS 7.24.2 compatibility, one exact
-command, zero retries, and valid canonical evidence.
-[Closure scope and evidence](docs/automation_readiness/actual_automation_integration_plan.md#stage-2-read-only-lab-adapter).
+**Stage 2: CLOSURE CANDIDATE.** Separate Owner-authorized one-shot VRRP
+read-only proofs completed for MikroTik Lab1 and Lab2, each through the same
+target-aware fail-closed runtime, one exact command, and zero retries. The
+Lab2 proof also has independently reviewed persistent startup bindings and
+fresh-process reconstruction. Final closure still requires independent review
+and remote Safe CI.
+[Closure candidate scope and evidence](docs/automation_readiness/stage2_formal_closure.md).
 
 The August 2026 release baseline is a local Stage-0 product.
 The supported release path is designed for local portfolio review: mock-only,
@@ -56,14 +59,15 @@ This accepted Stage-0 demo path is GET-only. It does not contact devices,
 invoke provider-backed operations, expose command or job execution controls,
 change configuration, or demonstrate production approval.
 
-For the recorded Stage-2 result, explain: a fresh Owner authorization was
+For the recorded Stage-2 result, explain: Lab1 first proved the bounded
+one-shot chain after two earlier attempts failed closed. Lab2 subsequently
+completed its own fresh Owner-authorized proof for
+`target.mikrotik.lab02`, `mikrotik.vrrp_status`. The Lab2 authorization was
 verified and consumed once through replay protection; pinned host trust and a
-dedicated read-only credential bound the workflow to MikroTik Lab1
-`target.mikrotik.lab01`, operation `mikrotik.vrrp_status`. It executed exactly
-`/interface vrrp print detail` once with zero retries, strictly parsed the
-observed RouterOS 7.24.2 result, and produced canonical evidence. Two earlier
-attempts failed closed before the third passed. This is an evidence discussion,
-not a live demo procedure.
+dedicated read-only credential bound the exact command
+`/interface vrrp print detail`, which ran once with zero retries and returned
+normalized evidence. Lab2 did not revalidate Lab1 or establish overall VRRP
+pair health. This is an evidence discussion, not a live demo procedure.
 
 Other internal or legacy surfaces are outside this interview path. For a
 documentation-first tour, use the
@@ -296,25 +300,28 @@ Stage 0 is the formally closed public baseline. Its closure is recorded in the
 It includes contributor and security guidance, Issue and pull request
 templates, newcomer-friendly Issues, and protected-`main` governance through
 pull requests and Safe CI. Stage 1's planning entry is retained as historical
-context. The separately authorized, bounded Stage-2 validation is now closed;
-the canonical [Stage model](docs/automation_readiness/actual_automation_integration_plan.md)
-records its proof and limits.
+context. The separately authorized, bounded Stage-2 implementation and live
+proofs now form a closure candidate; the canonical
+[Stage model](docs/automation_readiness/actual_automation_integration_plan.md)
+and [formal closure candidate](docs/automation_readiness/stage2_formal_closure.md)
+record the proof, remaining review gate, and limits.
 
 | Stage | Purpose | Status |
 | --- | --- | --- |
 | **Stage 0 — Closed public baseline** | Mock-only, dry-run, report-only, reviewer-visible, fail-closed validation and evidence | **CLOSED** |
 | **Stage 1 — Read-only Lab Integration Planning** | Historical planning entry for contracts, allowlists, failure behavior, evidence, and credential boundaries | Historical planning record; see the bounded Stage-2 outcome below |
-| **Stage 2 — Narrow Read-only Lab Adapter** | MikroTik Lab1 only; RouterOS 7.24.2 observed VRRP read-only shape; one exact command, zero retries, canonical evidence | **CLOSED / LIVE PROVEN** |
+| **Stage 2 — Narrow Read-only Lab Adapter** | Separate bounded MikroTik Lab1 and Lab2 VRRP proofs; target-aware composition; one exact command per authorization; zero retries; normalized evidence; persistent Lab2 startup reconstruction | **CLOSURE CANDIDATE — independent closure review and remote Safe CI pending** |
 | **Stage 3 — Controlled Config Plan Generation** | Future human-reviewable configuration plans only; no apply | **NOT STARTED / requires separate Owner authorization** |
 | **Stage 4 — Controlled Change Execution** | Permit narrowly approved lab changes with explicit safeguards and evidence | **Future / separate gate** |
 | **Stage 5 — Production-like Platform** | Add mature access control, audit, rollback, monitoring, and human approval | **Long-term / not currently authorized** |
 
-The bounded Stage-2 exit is the major-development pause point. Closure proves
-only the recorded Lab1 operation. It does not establish generic RouterOS or
-every MikroTik model/version, multi-vendor live execution, arbitrary CLI,
-write/config automation, automated retries, production HA readiness, fleet
-orchestration, autonomous remediation, anti-rollback replay protection, or
-Stage-3 functionality.
+The bounded Stage-2 exit is the major-development pause point. The candidate
+records two independent one-shot operations; the Lab2 proof did not revalidate
+Lab1 and does not establish overall Lab1/Lab2 VRRP pair health. It also does
+not establish generic RouterOS or every MikroTik model/version, multi-vendor
+live execution, arbitrary CLI, write/config automation, automated retries,
+production HA readiness, fleet orchestration, autonomous remediation,
+anti-rollback replay protection, or Stage-3 functionality.
 
 A roadmap item, Issue, pull request, merge, date, or milestone does **not** activate a
 capability. Every Stage advancement requires separate explicit authorization
@@ -481,11 +488,12 @@ release lanes; they are not performed by documentation-only changes.
 
 ## Current Release Status
 
-| Area | Current status (August baseline with Stage-2 closure) |
+| Area | Current status (August baseline with Stage-2 closure candidate) |
 | --- | --- |
 | Stage-0 Network Automation Lab | **CLOSED** at `main@aff250735ade18e4c274be8ac53c9672bb2cb07f` |
-| Stage-1 Read-only Lab Integration Planning | Historical planning-entry record; see Stage-2 closure |
-| Stage-2 bounded MikroTik Lab1 VRRP validation | **CLOSED / LIVE PROVEN** on `main@39da163d80e5d8b2dde215eb6c0979448d0739fd`; closure review PASS |
+| Stage-1 Read-only Lab Integration Planning | Historical planning-entry record; see the Stage-2 closure candidate |
+| Stage-2 bounded MikroTik VRRP validation | Lab1 historical proof retained; Lab2 proof PASS/CLOSED on repository baseline `ea73196281e38a01af7bf959cc5e1bc60b0b2499`; persistent Lab2 startup reconstruction and independent binding review PASS; overall Stage 2 is a **CLOSURE CANDIDATE** |
+| Dual-Lab AI Query | **NOT IMPLEMENTED / not authorized**; eligible only as future work after formal Stage-2 closure |
 | Stage 3 | **NOT STARTED / requires separate Owner authorization** |
 | Canonical reviewer interface | Flask dashboard on `127.0.0.1:5000` |
 | Secondary Next.js interface | Available as a bounded Stage-0 evidence surface |
@@ -518,12 +526,13 @@ future capabilities stay behind their separate authorization and safety gates.
   acceptance gates.
 - Address Node/NVM coexistence only if a later environment-maintenance task
   requires it.
-- Expand the proven Lab1 read-only workflow only through separately authorized
-  safety gates.
+- Begin any Dual-Lab AI Query work only after Stage-2 formal closure and a
+  separate authorized task. The completed Lab1 and Lab2 proofs grant no future
+  live authority.
 - Keep the post-merge Safe CI maintenance findings OPEN: npm has 5
   vulnerabilities (2 moderate, 2 high, 1 critical), and Next.js emitted 7
   filesystem-tracing warnings. These are non-Stage-2-blocking maintenance items;
-  Stage-2 closure does not resolve them.
+  the Stage-2 closure candidate does not resolve them.
 
 Current limitations also include variable local report availability, no
 guarantee that every clean checkout contains generated evidence, and a
@@ -540,6 +549,7 @@ deliberately non-executing public review path.
 - [Canonical Quick Start and demo runbook](docs/phase_2n/phase_2n_01_canonical_quick_start_and_demo_runbook_documentation_only.md)
 - [Accepted Stage-0 user-facing baseline](docs/phase_2n/phase_2n_05_final_user_facing_acceptance_review_phase_closure_review_only.md)
 - [Stage 0 formal closure](docs/automation_readiness/stage0_formal_closure.md)
+- [Stage 2 formal closure candidate](docs/automation_readiness/stage2_formal_closure.md)
 
 ### Architecture and safety
 
@@ -564,6 +574,6 @@ deliberately non-executing public review path.
 
 Historical records describe the state and authorization boundary at the time
 they were written. Use Current Release Status above and the canonical Stage
-model for the August baseline and subsequent bounded Stage-2 closure.
+model for the August baseline and subsequent bounded Stage-2 closure candidate.
 
 This project is distributed under the [MIT License](LICENSE).

docs/automation_readiness/actual_automation_integration_plan.md

@@ -1,10 +1,13 @@
 # Actual Automation Integration Plan
 
-**Decision summary: Stage 2 is CLOSED / LIVE PROVEN** for the separately
-Owner-authorized MikroTik Lab1 VRRP read-only workflow on observed RouterOS
-7.24.2 output. The third one-shot attempt passed and the closure review passed.
-The default public review path remains Stage-0 offline evidence browsing.
-Stage 3 is **NOT STARTED / requires separate Owner authorization**.
+**Decision summary: Stage 2 is a CLOSURE CANDIDATE.** The historical
+Owner-authorized MikroTik Lab1 VRRP proof remains accepted, and a later,
+separately authorized Lab2 one-shot proof passed through the same target-aware
+runtime. Persistent Lab2 startup bindings, fresh-process reconstruction, and
+their independent review also passed. Final Stage-2 closure still requires the
+separate independent closure review and remote Safe CI. The default public
+review path remains Stage-0 offline evidence browsing. Stage 3 is **NOT
+STARTED / requires separate Owner authorization**.
 
 ## 1. Purpose
 
@@ -97,11 +100,12 @@ Exit gate:
 
 ### Stage 2: Read-only Lab Adapter
 
-Status: **CLOSED / LIVE PROVEN**. The third real one-shot validation passed
-under its exact Owner authorization; formal closure review is PASS. This
-records a completed bounded operation and does not authorize another attempt.
+Status: **CLOSURE CANDIDATE**. The earlier Lab1 proof and later Lab2 proof each
+passed under separate exact Owner authorization. The Lab2 runtime closure gap
+is resolved, but final Stage-2 closure awaits independent closure review and
+remote Safe CI. Neither proof authorizes another attempt.
 
-#### Proven scope and result
+#### Historical Lab1 proven scope and result
 
 - Device: one specified MikroTik **Lab1**, identified publicly only as
   `target.mikrotik.lab01`.
@@ -119,7 +123,7 @@ STAGE2_RUNTIME_CHAIN_PROVEN = YES
 ROUTEROS_7_24_PARSER_COMPATIBILITY_PROVEN_LIVE = YES
 CALLER_GUARD_RESTORATION_PROVEN = YES
 STAGE2_CLOSURE_REVIEW = PASS
-STAGE2_STATUS = CLOSED / LIVE PROVEN
+HISTORICAL_LAB1_PROOF_STATUS = CLOSED / LIVE PROVEN
 ```
 
 #### Three live attempts
@@ -145,14 +149,15 @@ consumption, one credential resolution, one TCP connection, one SSH handshake,
 one authentication, one session, and one RouterOS command, with retry = 0.
 AI does not own or bypass these authorities.
 
-This closure proves only one specified Lab1, one VRRP read-only operation, one
-exact allowlisted command, and the observed RouterOS 7.24.2 output in a one-shot
-safety chain. It does **not** establish generic RouterOS support, all MikroTik
-versions/models, multi-vendor live support, arbitrary CLI, write/config
-automation, automated retries, production HA readiness, fleet orchestration,
-autonomous remediation, an anti-rollback guarantee, or Stage-3 functionality.
-Any further attempt needs fresh exact Owner authorization; scope expansion
-needs separate review and applicable safety gates.
+This historical proof establishes only the specified Lab1 operation and
+observed RouterOS 7.24.2 output. The later Lab2 proof below is separate: it did
+not revalidate Lab1 and cannot establish overall VRRP pair health. Neither
+proof establishes generic RouterOS support, all MikroTik versions/models,
+multi-vendor live support, arbitrary CLI, write/config automation, automated
+retries, production HA readiness, fleet orchestration, autonomous remediation,
+an anti-rollback guarantee, or Stage-3 functionality. Any further attempt
+needs fresh exact Owner authorization; scope expansion needs separate review
+and applicable safety gates.
 
 #### Closure evidence and code baseline
 
@@ -171,6 +176,56 @@ Open npm and Next.js maintenance items remain separate in the
 [project status](../../README.md#post-release-or-deferred); closure does not
 resolve them.
 
+#### Later Lab2 proof and persistent startup closure evidence
+
+The later proof used repository baseline
+`ea73196281e38a01af7bf959cc5e1bc60b0b2499` and a fresh, exact one-shot Owner
+authorization for `target.mikrotik.lab02`, `credential.mikrotik.lab02`, and
+`mikrotik.vrrp_status`. The resolved command was exactly
+`/interface vrrp print detail`. It executed once, with zero retries and a
+bounded duration of 625 ms. The authorization was consumed and cannot be
+reused.
+
+The accepted normalized record is `vrrp-lan`, VRID `88`, priority `100`,
+interval `1000` ms, version `3`, role `BACKUP`, `running=false`,
+`disabled=false`, and `invalid=false`. No raw RouterOS stdout is published.
+`running=false` is not independently characterized as a fault, and this proof
+does not establish Lab1 state or overall Lab1/Lab2 VRRP health.
+
+```text
+LAB2_S2_RO_11_LIVE_PROOF = PASS
+LAB2_LIVE_PROOF_STATUS = CLOSED
+FINAL_PERSISTENT_LAB2_TARGET_STARTUP_BINDING = YES
+FINAL_PERSISTENT_LAB2_KNOWN_HOST_STARTUP_BINDING = YES
+CANONICAL_FRESH_PROCESS_RUNTIME_RECONSTRUCTION = PASS
+PERSISTENT_STARTUP_BINDING_INDEPENDENT_REVIEW = PASS
+STAGE2_RUNTIME_CLOSURE_GAP = NONE
+HISTORICAL_TRUSTED_STARTUP_REPLAY_PROVENANCE = UNRESOLVED
+STAGE2_STATUS = CLOSURE CANDIDATE
+READY_FOR_DUAL_LAB_AI_QUERY = NO
+```
+
+The final deployment binding selects `target.mikrotik.lab02` at
+`192.168.88.3:22`, its exact Owner-controlled known-host snapshot, and the
+logical credential reference `credential.mikrotik.lab02`. The repository does
+not publish the personal filesystem prefix, credentials, keys, signatures,
+approval artifact, or raw output. The Owner-controlled persistent provider and
+external offline test are identified by filenames
+`stage2_lab2_trusted_runtime_binding.py` and
+`test_stage2_lab2_trusted_runtime_binding.py`, with accepted SHA-256 values
+`b21ff9df445cb3fc2bde3c0ea05dcbdc558c2b996a31c451ad5a6de13a8e77a5`
+and `22d0473709243de416d1aeccf88338316c81833cf15fcdb36be8874ba4ba0bf4`.
+The external offline test passed 6/6 and the focused repository validation
+passed 397/397 during independent startup-binding review.
+
+These external deployment pins are not repository capability and grant no
+future authority. Historical trusted-startup replay provenance remains
+unresolved and is not rewritten by the successful reconstruction.
+
+`OFFLINE_IMPLEMENTATION_AUTHORITY != LIVE_EXECUTION_AUTHORITY`
+
+`SOURCE_REACHABLE != EXECUTION_AUTHORIZED`
+
 #### Canonical bounded VRRP read-only sequence
 
 The following sequence indexes components used by the closed bounded workflow.
@@ -188,8 +243,8 @@ Neither this index nor component integration grants fresh execution authority.
 | S2-RO-07 | [Immutable offline known-host snapshot](stage2_vrrp_readonly_s2_ro_07_known_host_snapshot.md) | Formally closed; no transport authority |
 | S2-RO-08 | [Immutable VRRP read-only command policy](stage2_vrrp_readonly_s2_ro_08_command_policy.md) | Implemented bounded policy used by the proven workflow |
 | S2-RO-09 | [Pinned SSH transport](stage2_vrrp_readonly_s2_ro_09_pinned_ssh_transport.md) | Implemented bounded transport used by the proven workflow |
-| S2-RO-10 | [Trusted runtime composition](stage2_vrrp_readonly_s2_ro_10_trusted_runtime_composition.md) | Composed authority chain proven for this exact operation |
-| S2-RO-11 | [One-shot live entrypoint](stage2_vrrp_readonly_s2_ro_11_live_entrypoint.md) | Exact Owner-authorized one-shot invocation proven |
+| S2-RO-10 | [Trusted runtime composition](stage2_vrrp_readonly_s2_ro_10_trusted_runtime_composition.md) | Target-aware Lab1 + Lab2 chain; external persistent Lab2 startup reconstruction independently proven |
+| S2-RO-11 | [One-shot live entrypoint](stage2_vrrp_readonly_s2_ro_11_live_entrypoint.md) | Separate exact Owner-authorized Lab1 and Lab2 one-shot invocations proven; no reusable authority |
 
 The S2-RO-07 → S2-RO-08 → S2-RO-09 order is authoritative for scope
 discovery. It does not imply automatic authorization between slices.
@@ -313,10 +368,13 @@ evidence of a prior explicit Owner authorization and grants no standing live
 authority. Every new live access requires fresh exact Owner authorization.
 
 Stage 0 remains the default mock-only, dry-run, report-only public review path.
-Stage 2 is CLOSED / LIVE PROVEN only for the recorded Owner-authorized Lab1
-VRRP read-only operation. This closure activates no new adapter, protocol,
-provider, credential, device, or execution capability and permits no repeat
-attempt. Stage 3 remains NOT STARTED. Further live access or scope expansion
-requires the applicable capability gates and separate exact Owner approval.
+Stage 2 is a CLOSURE CANDIDATE based on the recorded, separately authorized
+Lab1 and Lab2 VRRP read-only proofs and completed persistent Lab2 startup
+reconstruction. This candidate activates no new adapter, protocol, provider,
+credential, device, or execution capability and permits no repeat attempt.
+Formal closure still requires independent closure review and remote Safe CI.
+Dual-Lab AI Query does not yet exist, and Stage 3 remains NOT STARTED. Further
+live access or scope expansion requires the applicable capability gates and
+separate exact Owner approval.
 
 This document does not start Phase 2C-10 or any implementation phase. It does not create a second safety matrix. It is a durable planning reference for future review and approval decisions.