# Eve SOTA environment capability record — 2026-09

- **Task:** `0.7`
- **Machine record:**
  [`eve-sota-environment-capabilities/2026-09-01.json`](eve-sota-environment-capabilities/2026-09-01.json)
- **Schema:**
  [`eve-sota-environment-capabilities.schema.json`](eve-sota-environment-capabilities.schema.json)
- **Live probe:**
  [`../../tools/eve-everywhere/probe-environment-capabilities.mjs`](../../tools/eve-everywhere/probe-environment-capabilities.mjs)
- **Verifier:**
  [`../../tools/eve-everywhere/verify-environment-capabilities.mjs`](../../tools/eve-everywhere/verify-environment-capabilities.mjs)

This record was observed from 2026-09-08T10:02:48.331Z through
2026-09-08T10:03:02.689Z and expires at **2026-09-09T10:03:02.689Z**. It is
bound to source commit `087ccdfb8a14818c607931a6ac68aea53a9b899c`, the current
probe implementation, 15 source-contract hashes, a hashed host boot ID, and
monotonic-clock bounds. A verifier failure means the capability must be
re-probed; an old record is never copied forward as a current fact.

## Re-probe and verify

The local credential file stays outside the repository. Source it only into the
probe process; the record retains environment-variable names and set/unset
states, never values.

```bash
set -a
. /root/Desktop/workspace/drawer/env-master.env
set +a
node tools/eve-everywhere/probe-environment-capabilities.mjs
node tools/eve-everywhere/verify-environment-capabilities.mjs
```

## Capability summary

| Capability                   | Status      | Exact claim                                                                                                          | Probe definitions                                   |
| ---------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
| `blender`                    | ready       | Blender 4.0.2 is executable through Bellona's resolution contract.                                                   | `blender.version`                                   |
| `unreal`                     | degraded    | Unreal 5.5.4-0+UE5 is present at the required path but did not complete initialization.                              | `unreal.required-path-version`                      |
| `nativeDesktop`              | unavailable | This probe process has no admissible native desktop observation or input path.                                       | `native.session-permissions`, `native.binding-load` |
| `localDatabase`              | ready       | The declared local oshun_dev PostgreSQL 16.14 (Debian 16.14-1.pgdg12+1) database answered a read-only query.         | `database.postgres-read`                            |
| `vectorStore`                | degraded    | pgvector is installed and an L1 operation works, but the L2 operating path fails and optional Qdrant is unavailable. | `vector.pgvector-operators`, `vector.qdrant-health` |
| `browsers`                   | ready       | Playwright 1.60.0 launched Chromium, Firefox, and WebKit and completed a DOM round trip in each.                     | `browser.playwright-launch`                         |
| `mobileHarness`              | degraded    | The Maestro repository harness is present, but no runnable mobile device or simulator boundary was observed.         | `mobile.android-harness`, `mobile.ios-harness`      |
| `externalChannelCredentials` | unavailable | No complete external-channel credential-name group is present in this probe process.                                 | `channels.environment-name-presence`                |

Statuses are deliberately non-transitive. For example, a ready browser engine
does not upgrade native desktop, and an installed pgvector extension does not
upgrade a failing vector operator.

## DCC and engine

- Blender: executable `/usr/bin/blender`; version `4.0.2`; version-probe exit
  `0`.
- Unreal: required path
  `/root/workspace/UnrealEngine-5.5/Engine/Binaries/Linux/UnrealEditor-Cmd`
  executable = `true`; version `5.5.4-0+UE5`; initialization-ready = `false`;
  failure class `vulkan-driver-unavailable`.

## Native desktop permission posture

The probe ran on `linux` as UID `0` in a `tty` session; remote = `true`;
graphical display = `none`. Portal ScreenCast = `false`, portal RemoteDesktop =
`false`, AT-SPI reachable = `false`, native binding = `unavailable`.

Permission posture: screen capture `unavailable`; synthetic input `unavailable`;
accessibility tree `unavailable`. Browser launch is explicitly excluded from
this conclusion.

## Local database and vector stores

PostgreSQL: container present = `true`; health = `healthy`; server =
`16.14 (Debian 16.14-1.pgdg12+1)`; read-only known result = `42`.

pgvector: extension `0.8.2`; L1 known distance `1`; L2 exit `1`; L2 failure
`stack-depth-limit-exceeded`; ready = `false`. Optional Qdrant: reachable =
`false`; HTTP = `none`.

## Browsers

Playwright version: `1.60.0`. A path alone is insufficient; every ready row
below includes a real launch and DOM round trip.

| Engine   | Executable | Runtime version | Launch | DOM result |
| -------- | ---------- | --------------- | ------ | ---------- |
| chromium | yes        | 148.0.7778.96   | ready  | 42         |
| firefox  | yes        | 150.0.2         | ready  | 42         |
| webkit   | yes        | 26.4            | ready  | 42         |

## Mobile harness

Repository Maestro YAML flows: `86`; Maestro `2.5.1`; ADB `1.0.41`; attached
ready Android devices = `0`; installed Android AVDs = `0`; available iOS
simulators = `0`; iOS applicable on this host = `false`.

## External channel credential-name posture

The table contains names and set/unset states only. It contains no credential
value, length, prefix, digest, source file, or provider/account identity.

| Channel group       | Required environment-variable names                                                                                   | Optional credential names                    | Presence                                                                                                                                  | Required-name completeness |
| ------------------- | --------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
| `email-sendgrid`    | `OSHUN_MESSAGING_EMAIL_FROM`, `OSHUN_SENDGRID_API_KEY`                                                                | —                                            | OSHUN_MESSAGING_EMAIL_FROM: unset; OSHUN_SENDGRID_API_KEY: unset                                                                          | incomplete                 |
| `email-smtp`        | `OSHUN_MESSAGING_EMAIL_FROM`, `OSHUN_SMTP_HOST`                                                                       | `OSHUN_SMTP_USERNAME`, `OSHUN_SMTP_PASSWORD` | OSHUN_MESSAGING_EMAIL_FROM: unset; OSHUN_SMTP_HOST: unset; OSHUN_SMTP_USERNAME: unset; OSHUN_SMTP_PASSWORD: unset                         | incomplete                 |
| `sms-twilio`        | `OSHUN_TWILIO_ACCOUNT_SID`, `OSHUN_TWILIO_AUTH_TOKEN`, `OSHUN_TWILIO_FROM`                                            | —                                            | OSHUN_TWILIO_ACCOUNT_SID: unset; OSHUN_TWILIO_AUTH_TOKEN: unset; OSHUN_TWILIO_FROM: unset                                                 | incomplete                 |
| `push-fcm`          | `OSHUN_FCM_ACCESS_TOKEN`, `OSHUN_FCM_PROJECT_ID`                                                                      | —                                            | OSHUN_FCM_ACCESS_TOKEN: unset; OSHUN_FCM_PROJECT_ID: unset                                                                                | incomplete                 |
| `push-apns`         | `OSHUN_APNS_TEAM_ID`, `OSHUN_APNS_KEY_ID`, `OSHUN_APNS_PRIVATE_KEY`, `OSHUN_APNS_BUNDLE_ID`                           | —                                            | OSHUN_APNS_TEAM_ID: unset; OSHUN_APNS_KEY_ID: unset; OSHUN_APNS_PRIVATE_KEY: unset; OSHUN_APNS_BUNDLE_ID: unset                           | incomplete                 |
| `push-expo`         | `OSHUN_EXPO_ACCESS_TOKEN`                                                                                             | —                                            | OSHUN_EXPO_ACCESS_TOKEN: unset                                                                                                            | incomplete                 |
| `push-webpush`      | `OSHUN_VAPID_PUBLIC_KEY`, `OSHUN_VAPID_PRIVATE_KEY`, `OSHUN_VAPID_SUBJECT`                                            | —                                            | OSHUN_VAPID_PUBLIC_KEY: unset; OSHUN_VAPID_PRIVATE_KEY: unset; OSHUN_VAPID_SUBJECT: unset                                                 | incomplete                 |
| `whatsapp-business` | `OSHUN_WHATSAPP_ACCESS_TOKEN`, `OSHUN_WHATSAPP_PHONE_NUMBER_ID`, `OSHUN_WHATSAPP_TEMPLATE`, `OSHUN_WHATSAPP_LANGUAGE` | —                                            | OSHUN_WHATSAPP_ACCESS_TOKEN: unset; OSHUN_WHATSAPP_PHONE_NUMBER_ID: unset; OSHUN_WHATSAPP_TEMPLATE: unset; OSHUN_WHATSAPP_LANGUAGE: unset | incomplete                 |
| `slack-app`         | `OSHUN_SLACK_BOT_TOKEN`                                                                                               | —                                            | OSHUN_SLACK_BOT_TOKEN: unset                                                                                                              | incomplete                 |
| `discord-bot`       | `OSHUN_DISCORD_BOT_TOKEN`                                                                                             | —                                            | OSHUN_DISCORD_BOT_TOKEN: unset                                                                                                            | incomplete                 |
| `telegram-outbound` | `OSHUN_TELEGRAM_BOT_TOKEN`                                                                                            | —                                            | OSHUN_TELEGRAM_BOT_TOKEN: unset                                                                                                           | incomplete                 |
| `telegram-webhook`  | `OSHUN_TELEGRAM_BOT_TOKEN`, `OSHUN_TELEGRAM_WEBHOOK_SECRET`                                                           | —                                            | OSHUN_TELEGRAM_BOT_TOKEN: unset; OSHUN_TELEGRAM_WEBHOOK_SECRET: unset                                                                     | incomplete                 |

Even a complete name group remains degraded here: no provider was contacted and
no channel was operator-selected or live-gated.

## Expiration and admission rules

- The verifier rejects the record at or after `expiresAt`.
- The verifier rejects a changed boot ID, impossible wall/monotonic clock
  relationship, future timestamps, overlong capture window, changed source
  contract, changed probe implementation, or record-digest mismatch.
- Every capability and probe definition is required exactly once. A package,
  path, container, extension, YAML flow, or browser executable cannot by itself
  claim runtime readiness.
- Credential fields outside the allowlisted name/presence structure are
  rejected.
- Re-run the live probe after expiration or invalidation. Do not edit timestamps
  or copy observations into a new record.

## Limitations

- This is a local developer-host observation, not staging or production
  capability.
- A ready capability proves only the named probe criteria; it does not admit any
  downstream Eve task or gap.
- The whole record expires after 24 hours and immediately after a host reboot,
  source-contract change, or probe-implementation change.
- Re-probing executes current observations; the probe has no mode that copies a
  prior record into a new fact.