Stable error codes
Errors identify the field or rule without echoing the private value.
OPERATOR WORKBENCH
Inspect first. Plan second. Execute only through separate authorization.
The command-line workbench accepts explicit paths only. It does not search environment variables, home directories, hosting accounts, or network locations for secrets. It refuses unsafe file types, open permissions, public-root placement, duplicate JSON keys, unknown fields, stale epochs, signature mismatch, role overlap, and authorization mismatch.
45/45 LOCAL CONTROLS · ZERO EXTERNAL ACTIONSJudgment state: NONE
Commands and boundaries
inspect validates file and record custody. plan creates a deterministic content-free plan from accepted records. execute validates a separate authorization artifact and opens only a gate result; no operational adapter is embedded in the generic workbench command.
Input immutability
Tests compare byte content, mode, and timestamps before and after inspection.
No implicit discovery
Every input and key path must be supplied explicitly by the operator.
Zero side effects
Local tests record zero driver imports, network calls, database connections, or archive extraction.
Execution is not possession
Credentials, database configurations, an archive, or a signature key do not independently authorize an operation. The authorization artifact binds plan digest, actor, environment, operation set, validity interval, rollback target, purpose, scope, and signer key identity.
Use the cutover bundle workbench only with operator-controlled private inputs kept outside the package and public root.
EVIDENCE BOUNDARY
Local mechanism and operational fact remain separate.
Implemented locally
Strict file/schema/signature/custody inspection, deterministic planning, authorization verification, stable redacted errors, and a non-operational gate.
Not supplied or observed
No real private input, execution authorization, database adapter, MATM archive, staging origin, hosting access, or deployment access.
Exact blocker
EXECUTION_AUTHORIZATION_NOT_SUPPLIED
No participant judgment
Every technical state has participant evaluation effect NONE and standing effect NONE.
NO JUDGMENT WHATSOEVER. A signature, status code, passing test, receipt, or package digest never becomes belief, intent, character, moral rank, guilt, danger, trustworthiness, worth, consciousness, personhood, or standing.