Disciplines · Audits

Eve SOTA environment capability record — 2026-09

The local credential file stays outside the repository.

10sections4 minread
Markdown source
On this page

This record was observed from 2026-09-08T10:02:48.331Z through 2026-09-08T10:03:02.689Z and expires at 2026-09-09T10:03:02.689Z. It is bound to source commit 087ccdfb8a14818c607931a6ac68aea53a9b899c, the current probe implementation, 15 source-contract hashes, a hashed host boot ID, and monotonic-clock bounds. A verifier failure means the capability must be re-probed; an old record is never copied forward as a current fact.

Re-probe and verify#

The local credential file stays outside the repository. Source it only into the probe process; the record retains environment-variable names and set/unset states, never values.

bash
set -a
. /root/Desktop/workspace/drawer/env-master.env
set +a
node tools/eve-everywhere/probe-environment-capabilities.mjs
node tools/eve-everywhere/verify-environment-capabilities.mjs

Capability summary#

Capability Status Exact claim Probe definitions
blender ready Blender 4.0.2 is executable through Bellona's resolution contract. blender.version
unreal degraded Unreal 5.5.4-0+UE5 is present at the required path but did not complete initialization. unreal.required-path-version
nativeDesktop unavailable This probe process has no admissible native desktop observation or input path. native.session-permissions, native.binding-load
localDatabase ready The declared local oshun_dev PostgreSQL 16.14 (Debian 16.14-1.pgdg12+1) database answered a read-only query. database.postgres-read
vectorStore degraded pgvector is installed and an L1 operation works, but the L2 operating path fails and optional Qdrant is unavailable. vector.pgvector-operators, vector.qdrant-health
browsers ready Playwright 1.60.0 launched Chromium, Firefox, and WebKit and completed a DOM round trip in each. browser.playwright-launch
mobileHarness degraded The Maestro repository harness is present, but no runnable mobile device or simulator boundary was observed. mobile.android-harness, mobile.ios-harness
externalChannelCredentials unavailable No complete external-channel credential-name group is present in this probe process. channels.environment-name-presence

Statuses are deliberately non-transitive. For example, a ready browser engine does not upgrade native desktop, and an installed pgvector extension does not upgrade a failing vector operator.

DCC and engine#

  • Blender: executable /usr/bin/blender; version 4.0.2; version-probe exit 0.
  • Unreal: required path /root/workspace/UnrealEngine-5.5/Engine/Binaries/Linux/UnrealEditor-Cmd executable = true; version 5.5.4-0+UE5; initialization-ready = false; failure class vulkan-driver-unavailable.

Native desktop permission posture#

The probe ran on linux as UID 0 in a tty session; remote = true; graphical display = none. Portal ScreenCast = false, portal RemoteDesktop = false, AT-SPI reachable = false, native binding = unavailable.

Permission posture: screen capture unavailable; synthetic input unavailable; accessibility tree unavailable. Browser launch is explicitly excluded from this conclusion.

Local database and vector stores#

PostgreSQL: container present = true; health = healthy; server = 16.14 (Debian 16.14-1.pgdg12+1); read-only known result = 42.

pgvector: extension 0.8.2; L1 known distance 1; L2 exit 1; L2 failure stack-depth-limit-exceeded; ready = false. Optional Qdrant: reachable = false; HTTP = none.

Browsers#

Playwright version: 1.60.0. A path alone is insufficient; every ready row below includes a real launch and DOM round trip.

Engine Executable Runtime version Launch DOM result
chromium yes 148.0.7778.96 ready 42
firefox yes 150.0.2 ready 42
webkit yes 26.4 ready 42

Mobile harness#

Repository Maestro YAML flows: 86; Maestro 2.5.1; ADB 1.0.41; attached ready Android devices = 0; installed Android AVDs = 0; available iOS simulators = 0; iOS applicable on this host = false.

External channel credential-name posture#

The table contains names and set/unset states only. It contains no credential value, length, prefix, digest, source file, or provider/account identity.

Channel group Required environment-variable names Optional credential names Presence Required-name completeness
email-sendgrid OSHUN_MESSAGING_EMAIL_FROM, OSHUN_SENDGRID_API_KEY — OSHUN_MESSAGING_EMAIL_FROM: unset; OSHUN_SENDGRID_API_KEY: unset incomplete
email-smtp OSHUN_MESSAGING_EMAIL_FROM, OSHUN_SMTP_HOST OSHUN_SMTP_USERNAME, OSHUN_SMTP_PASSWORD OSHUN_MESSAGING_EMAIL_FROM: unset; OSHUN_SMTP_HOST: unset; OSHUN_SMTP_USERNAME: unset; OSHUN_SMTP_PASSWORD: unset incomplete
sms-twilio OSHUN_TWILIO_ACCOUNT_SID, OSHUN_TWILIO_AUTH_TOKEN, OSHUN_TWILIO_FROM — OSHUN_TWILIO_ACCOUNT_SID: unset; OSHUN_TWILIO_AUTH_TOKEN: unset; OSHUN_TWILIO_FROM: unset incomplete
push-fcm OSHUN_FCM_ACCESS_TOKEN, OSHUN_FCM_PROJECT_ID — OSHUN_FCM_ACCESS_TOKEN: unset; OSHUN_FCM_PROJECT_ID: unset incomplete
push-apns OSHUN_APNS_TEAM_ID, OSHUN_APNS_KEY_ID, OSHUN_APNS_PRIVATE_KEY, OSHUN_APNS_BUNDLE_ID — OSHUN_APNS_TEAM_ID: unset; OSHUN_APNS_KEY_ID: unset; OSHUN_APNS_PRIVATE_KEY: unset; OSHUN_APNS_BUNDLE_ID: unset incomplete
push-expo OSHUN_EXPO_ACCESS_TOKEN — OSHUN_EXPO_ACCESS_TOKEN: unset incomplete
push-webpush OSHUN_VAPID_PUBLIC_KEY, OSHUN_VAPID_PRIVATE_KEY, OSHUN_VAPID_SUBJECT — OSHUN_VAPID_PUBLIC_KEY: unset; OSHUN_VAPID_PRIVATE_KEY: unset; OSHUN_VAPID_SUBJECT: unset incomplete
whatsapp-business OSHUN_WHATSAPP_ACCESS_TOKEN, OSHUN_WHATSAPP_PHONE_NUMBER_ID, OSHUN_WHATSAPP_TEMPLATE, OSHUN_WHATSAPP_LANGUAGE — OSHUN_WHATSAPP_ACCESS_TOKEN: unset; OSHUN_WHATSAPP_PHONE_NUMBER_ID: unset; OSHUN_WHATSAPP_TEMPLATE: unset; OSHUN_WHATSAPP_LANGUAGE: unset incomplete
slack-app OSHUN_SLACK_BOT_TOKEN — OSHUN_SLACK_BOT_TOKEN: unset incomplete
discord-bot OSHUN_DISCORD_BOT_TOKEN — OSHUN_DISCORD_BOT_TOKEN: unset incomplete
telegram-outbound OSHUN_TELEGRAM_BOT_TOKEN — OSHUN_TELEGRAM_BOT_TOKEN: unset incomplete
telegram-webhook OSHUN_TELEGRAM_BOT_TOKEN, OSHUN_TELEGRAM_WEBHOOK_SECRET — OSHUN_TELEGRAM_BOT_TOKEN: unset; OSHUN_TELEGRAM_WEBHOOK_SECRET: unset incomplete

Even a complete name group remains degraded here: no provider was contacted and no channel was operator-selected or live-gated.

Expiration and admission rules#

  • The verifier rejects the record at or after expiresAt.
  • The verifier rejects a changed boot ID, impossible wall/monotonic clock relationship, future timestamps, overlong capture window, changed source contract, changed probe implementation, or record-digest mismatch.
  • Every capability and probe definition is required exactly once. A package, path, container, extension, YAML flow, or browser executable cannot by itself claim runtime readiness.
  • Credential fields outside the allowlisted name/presence structure are rejected.
  • Re-run the live probe after expiration or invalidation. Do not edit timestamps or copy observations into a new record.

Limitations#

  • This is a local developer-host observation, not staging or production capability.
  • A ready capability proves only the named probe criteria; it does not admit any downstream Eve task or gap.
  • The whole record expires after 24 hours and immediately after a host reboot, source-contract change, or probe-implementation change.
  • Re-probing executes current observations; the probe has no mode that copies a prior record into a new fact.