atraxis 1.0.2__tar.gz

atraxis-1.0.2/.dockerignore

@@ -0,0 +1,15 @@
+*
+!pyproject.toml
+!README.md
+!LICENSE
+!atraxis/
+!atraxis/**
+!deploy/
+!deploy/compose/
+!deploy/compose/locks/
+!deploy/compose/locks/**
+**/__pycache__
+**/*.pyc
+
+!deploy/docker/
+!deploy/docker/**

atraxis-1.0.2/.github/workflows/browser-engine.yml

@@ -0,0 +1,71 @@
+name: native browser engine acceptance
+on: [push, pull_request, workflow_dispatch]
+permissions:
+  contents: read
+jobs:
+  browser-engine:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    container:
+      image: mcr.microsoft.com/playwright/python:v1.55.0-noble@sha256:640d578aae63cfb632461d1b0aecb01414e4e020864ac3dd45a868dc0eff3078
+      options: --init --ipc=host
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Verify running browser image identity
+        env:
+          CI_JOB_CONTAINER_ID: ${{ job.container.id }}
+        run: python scripts/chain/image-identities.py browser-engine image-evidence/browser-engine.json
+      - name: Install native daemon dependency
+        timeout-minutes: 3
+        run: |
+          sed -i 's|http://archive.ubuntu.com|https://archive.ubuntu.com|g; s|http://security.ubuntu.com|https://security.ubuntu.com|g' /etc/apt/sources.list.d/ubuntu.sources
+          apt-get -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 -o Acquire::Retries=1 update
+          apt-get -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 -o Acquire::Retries=1 install --yes --no-install-recommends libmagic1t64 python3.12-venv libnss3-tools
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: |
+          # The job container and host checkout use different UIDs.
+          # Trust only this job's explicit checkout for provenance inspection.
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          python scripts/chain/prepare-public-inputs.py
+      - name: Install independent service environments
+        run: |
+          python -m venv "$RUNNER_TEMP/browser-web"
+          python -m venv "$RUNNER_TEMP/browser-engine"
+          python -m venv "$RUNNER_TEMP/browser-auton"
+          AUTON_PACKAGE=autond "$RUNNER_TEMP/browser-auton/bin/python" -m pip install .auton-source
+          "$RUNNER_TEMP/browser-engine/bin/python" -m pip install '.acceptance/engine[service,redis,auton]' .acceptance/engine/client redislite==6.2.912183
+          "$RUNNER_TEMP/browser-web/bin/python" -m pip install . '.acceptance/engine/client[observations]' playwright==1.55.0
+          "$RUNNER_TEMP/browser-engine/bin/python" -m pip check
+          "$RUNNER_TEMP/browser-web/bin/python" -m pip check
+          "$RUNNER_TEMP/browser-auton/bin/python" -m pip check
+      - name: Collect every browser acceptance case
+        run: '"$RUNNER_TEMP/browser-web/bin/python" scripts/check-test-collection.py --runner unittest browser_engine_tests'
+      - name: Execute native forms against actual SQLite engine and Redis delivery
+        run: |
+          ATROPOS_TEST_PYTHON="$RUNNER_TEMP/browser-engine/bin/python" \
+            AUTON_TEST_SOURCE="$GITHUB_WORKSPACE/.auton-source" \
+            AUTON_TEST_DAEMON="$RUNNER_TEMP/browser-auton/bin/autond" \
+            "$RUNNER_TEMP/browser-web/bin/python" -m unittest discover -s browser_engine_tests -v
+      - name: Retain browser image identity
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-identity-browser-engine
+          path: image-evidence/browser-engine.json
+          retention-days: 14
+          if-no-files-found: error

atraxis-1.0.2/.github/workflows/chain.yml

@@ -0,0 +1,86 @@
+name: container chain acceptance
+on: [push, pull_request, workflow_dispatch]
+permissions:
+  contents: read
+jobs:
+  chain:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install cryptography==50.0.2 PyYAML==6.0.3
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: python scripts/chain/prepare-public-inputs.py
+      - name: Build separate installed service images (no publication)
+        run: |
+          docker build --tag atraxis-acceptance:ci .
+          docker build --tag atraxis-ingress:ci --file scripts/network/Dockerfile .
+          docker build --tag atraxis-chain:ci --file scripts/chain/atraxis.Dockerfile .
+          docker build --tag atropos-chain:ci --file scripts/chain/engine.Dockerfile .
+          docker build --tag auton-chain:ci --file scripts/chain/auton.Dockerfile .
+      - name: Verify built image identities and locked base layers
+        run: python scripts/chain/image-identities.py chain acceptance-artifacts/image-identities.json
+      - name: Verify installed candidates match pinned sources
+        run: python scripts/chain/verify-installed-candidates.py
+      - name: Collect every container acceptance case
+        run: python scripts/check-test-collection.py --runner unittest container_tests
+      - name: Run complete HTTPS chain with disposable effects and failure injection
+        env:
+          AUTON_TEST_SOURCE: ${{ github.workspace }}/.auton-source
+        shell: bash
+        run: python -m unittest discover -s container_tests -v 2>&1 | tee acceptance-artifacts/short-chain.log
+      - name: Preserve synthetic provenance and short-chain evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chain-evidence
+          path: acceptance-artifacts/*
+          retention-days: 7
+          if-no-files-found: error
+  compose:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install cryptography==50.0.2 PyYAML==6.0.3
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: python scripts/chain/prepare-public-inputs.py
+      - name: Collect operator Compose acceptance
+        run: python scripts/check-test-collection.py --runner unittest compose_tests
+      - name: Build and verify operator Compose with disposable pinned inputs
+        # Root prepares test-owned UID 10001 files on this disposable runner only.
+        # All four long-running Compose services retain their non-root protections.
+        run: sudo "$(command -v python)" -m unittest discover -s compose_tests -v

atraxis-1.0.2/.github/workflows/dockerhub.yml

@@ -0,0 +1,83 @@
+name: Docker Hub image
+on:
+  pull_request:
+  push:
+    branches: [main, release/dockerhub]
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the tested stable image to Docker Hub
+        type: boolean
+        default: false
+permissions:
+  contents: read
+concurrency:
+  group: dockerhub-atraxis
+  cancel-in-progress: false
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Check publication guards
+        run: |
+          python scripts/check-test-collection.py --runner unittest deploy/docker/tests
+          python -m unittest discover -s deploy/docker/tests -v
+      - name: Read package identity
+        id: identity
+        run: |
+          python - <<'PY'
+          import os, tomllib
+          from pathlib import Path
+          version = tomllib.loads(Path('pyproject.toml').read_text())['project']['version']
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              print('version=' + version, file=output)
+          PY
+      - uses: docker/setup-buildx-action@v4
+      - name: Build the Linux amd64 image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: deploy/docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          tags: atraxis:test
+          build-args: |
+            VERSION=${{ steps.identity.outputs.version }}
+            REVISION=${{ github.event.pull_request.head.sha || github.sha }}
+          cache-from: type=gha,scope=atraxis
+          cache-to: type=gha,mode=max,scope=atraxis
+      - name: Test the installed image and durable state
+        run: python deploy/docker/check-image.py
+      - name: Record tested image identity
+        run: |
+          mkdir -p image-evidence
+          docker image inspect atraxis:test > image-evidence/image.json
+          docker run --rm --network none --read-only --entrypoint cat atraxis:test /usr/local/share/atraxis/environment.json > image-evidence/environment.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: docker-image-evidence
+          path: image-evidence/
+          retention-days: 14
+      - name: Check Docker Hub credential availability
+        if: (github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main') || (github.event_name == 'push' && github.ref == 'refs/heads/release/dockerhub')
+        env:
+          TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: test -n "$TOKEN" || { echo 'Configure DOCKERHUB_TOKEN for this repository.'; exit 1; }
+      - name: Log in to Docker Hub
+        if: (github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main') || (github.event_name == 'push' && github.ref == 'refs/heads/release/dockerhub')
+        uses: docker/login-action@v4
+        with:
+          username: decryptus
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Publish the exact tested image
+        if: (github.event_name == 'workflow_dispatch' && inputs.publish && github.ref == 'refs/heads/main') || (github.event_name == 'push' && github.ref == 'refs/heads/release/dockerhub')
+        run: python deploy/docker/release.py atraxis --image atraxis:test

atraxis-1.0.2/.github/workflows/endurance.yml

@@ -0,0 +1,62 @@
+name: two-hour container endurance
+on:
+  workflow_dispatch:
+  push:
+    branches: [qualification/endurance]
+permissions:
+  contents: read
+jobs:
+  endurance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 165
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install cryptography==50.0.2 PyYAML==6.0.3
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: python scripts/chain/prepare-public-inputs.py
+      - name: Build separate installed service images (no publication)
+        run: |
+          docker build --tag atraxis-acceptance:ci .
+          docker build --tag atraxis-ingress:ci --file scripts/network/Dockerfile .
+          docker build --tag atraxis-chain:ci --file scripts/chain/atraxis.Dockerfile .
+          docker build --tag atropos-chain:ci --file scripts/chain/engine.Dockerfile .
+          docker build --tag auton-chain:ci --file scripts/chain/auton.Dockerfile .
+      - name: Verify installed candidates match pinned sources
+        run: python scripts/chain/verify-installed-candidates.py
+      - name: Collect every container acceptance case
+        run: python scripts/check-test-collection.py --runner unittest container_tests
+      - name: Run complete HTTPS chain with disposable effects and failure injection
+        env:
+          AUTON_TEST_SOURCE: ${{ github.workspace }}/.auton-source
+        shell: bash
+        run: python -m unittest discover -s container_tests -v 2>&1 | tee acceptance-artifacts/short-chain.log
+      - name: Run two-hour saturation and recovery after the complete short gate
+        timeout-minutes: 145
+        env:
+          AUTON_TEST_SOURCE: ${{ github.workspace }}/.auton-source
+          CHAIN_ENDURANCE_SECONDS: '7200'
+        shell: bash
+        run: python -m unittest discover -s container_tests -p test_load.py -v 2>&1 | tee acceptance-artifacts/endurance.log
+      - name: Preserve synthetic progress including failed runs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: endurance-progress
+          path: acceptance-artifacts/*
+          retention-days: 7
+          if-no-files-found: warn

atraxis-1.0.2/.github/workflows/guided-deployment.yml

@@ -0,0 +1,24 @@
+name: Guided inventory deployment
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  qualify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: [systemd, compose]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install '.[installer,textual]'
+      - if: matrix.mode == 'systemd'
+        run: |
+          sudo loginctl enable-linger "$(id -un)"
+          sudo systemctl start "user@$(id -u).service"
+          echo "XDG_RUNTIME_DIR=/run/user/$(id -u)" >> "$GITHUB_ENV"
+      - run: python scripts/check-guided-deployment.py "${{ matrix.mode }}"

atraxis-1.0.2/.github/workflows/memory.yml

@@ -0,0 +1,60 @@
+name: four-hour memory qualification
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  endurance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 300
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install cryptography==50.0.2 PyYAML==6.0.3
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: python scripts/chain/prepare-public-inputs.py
+      - name: Build separate installed service images (no publication)
+        run: |
+          docker build --tag atraxis-acceptance:ci .
+          docker build --tag atraxis-ingress:ci --file scripts/network/Dockerfile .
+          docker build --tag atraxis-chain:ci --file scripts/chain/atraxis.Dockerfile .
+          docker build --tag atropos-chain:ci --file scripts/chain/engine.Dockerfile .
+          docker build --tag auton-chain:ci --file scripts/chain/auton.Dockerfile .
+      - name: Verify installed candidates match pinned sources
+        run: python scripts/chain/verify-installed-candidates.py
+      - name: Collect every container acceptance case
+        run: python scripts/check-test-collection.py --runner unittest container_tests
+      - name: Run complete HTTPS chain with disposable effects and failure injection
+        env:
+          AUTON_TEST_SOURCE: ${{ github.workspace }}/.auton-source
+        shell: bash
+        run: python -m unittest discover -s container_tests -v 2>&1 | tee acceptance-artifacts/short-chain.log
+      - name: Run four-hour saturation, quiescence and recovery after the complete short gate
+        timeout-minutes: 280
+        env:
+          AUTON_TEST_SOURCE: ${{ github.workspace }}/.auton-source
+          CHAIN_ENDURANCE_SECONDS: '14400'
+        shell: bash
+        run: python -m unittest discover -s container_tests -p test_load.py -v 2>&1 | tee acceptance-artifacts/endurance.log
+      - name: Preserve synthetic progress including failed runs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: memory-progress
+          path: acceptance-artifacts/*
+          retention-days: 7
+          if-no-files-found: warn

atraxis-1.0.2/.github/workflows/operator-compose.yml

@@ -0,0 +1,170 @@
+name: operator Compose acceptance
+on: [push, pull_request, workflow_dispatch]
+permissions:
+  contents: read
+jobs:
+  compose:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      transfer_sha256: ${{ steps.transfer.outputs.sha256 }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install cryptography==50.0.2 PyYAML==6.0.3
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/atropos
+          ref: 613856430e87cd5abac0ea346d8d60a63b73cc57
+          path: .acceptance/engine
+          persist-credentials: false
+      - uses: actions/checkout@v4
+        with:
+          repository: decryptus/auton
+          ref: 7f57348b144fa62400bad31160d4b4ad5c00f53c
+          path: .auton-source
+          persist-credentials: false
+      - name: Verify public inputs and prepare the bounded Auton fixture
+        run: python scripts/chain/prepare-public-inputs.py
+      - name: Collect operator Compose acceptance
+        run: python scripts/check-test-collection.py --runner unittest compose_tests
+      - name: Build and verify worker profiles, recreation and cold restoration
+        shell: bash
+        run: sudo env ATRAXIS_EXPORT_RECOVERY=1 "$(command -v python)" -m unittest discover -s compose_tests -v 2>&1 | tee acceptance-artifacts/compose.log
+      - name: Verify installed packages match both source candidates
+        run: |
+          python - <<'PY'
+          import hashlib
+          import json
+          from pathlib import Path
+          import subprocess
+          source = Path('.acceptance/engine')
+          expected = {str(p.relative_to(source)): hashlib.sha256(p.read_bytes()).hexdigest()
+              for p in sorted((source / 'atropos').rglob('*.py'))}
+          expected.update({str(p.relative_to(source / 'client')): hashlib.sha256(p.read_bytes()).hexdigest()
+              for p in sorted((source / 'client/atropos_client').rglob('*.py'))})
+          web_files = {str(p): hashlib.sha256(p.read_bytes()).hexdigest()
+              for p in sorted(Path('atraxis').rglob('*.py'))}
+          web_files.update({name: digest for name, digest in expected.items() if name.startswith('atropos_client/')})
+          verifier = '''import hashlib, importlib.util, json
+          from importlib.metadata import version
+          from pathlib import Path
+          project, release = json.loads(%r)
+          assert version(project) == release
+          assert version('sonicprobe') == '0.3.62'
+          assert version('atropos-client') == '1.0.0'
+          if project == 'atraxis-atropos':
+              from atropos import __version__ as engine_version
+              assert engine_version == release, 'engine_runtime_version_mismatch'
+          for name, digest in json.loads(%r).items():
+              package, relative = name.split('/', 1)
+              spec = importlib.util.find_spec(package)
+              path = Path(spec.origin).parent / relative
+              assert str(path).startswith('/usr/local/lib/python3.12/site-packages/')
+              assert hashlib.sha256(path.read_bytes()).hexdigest() == digest, name
+          print('Installed package bytes verified:', project)
+          '''
+          images = {}
+          for image, project, release, files in (
+                  ('atraxis-install-engine:local', 'atraxis-atropos', '1.0.0', expected),
+                  ('atraxis-install-web:local', 'atraxis', '1.0.2', web_files)):
+              subprocess.run(['docker', 'run', '--rm', '-i', '--network', 'none', '--read-only',
+                  '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--memory', '512m',
+                  '--cpus', '2', '--pids-limit', '128', '--entrypoint', 'python', image, '-'],
+                  input=verifier % (json.dumps([project, release]), json.dumps(files)),
+                  text=True, check=True, timeout=60)
+              images[image] = dict(files=files, image=subprocess.check_output(
+                  ['docker', 'image', 'inspect', '--format', '{{.Id}}', image], text=True).strip())
+          Path('acceptance-artifacts/installed-packages.json').write_text(json.dumps(images, indent=2) + '\n')
+          PY
+      - name: Retain the locked Python and native environments
+        run: |
+          python - <<'PY'
+          import json
+          from pathlib import Path
+          import subprocess
+          specification = json.loads(Path('deploy/compose/locks/versions.json').read_text())
+          environments = {}
+          for profile in ('web', 'engine', 'proxy'):
+              image = 'atraxis-install-' + profile + ':local'
+              output = subprocess.check_output(['docker', 'run', '--rm', '--network', 'none',
+                  '--read-only', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
+                  '--memory', '128m', '--cpus', '1', '--pids-limit', '32', '--entrypoint', 'cat',
+                  image, '/usr/local/share/atraxis/environment.json'], timeout=30)
+              assert len(output) <= 1024 * 1024
+              environment = json.loads(output)
+              assert environment['profile'] == profile
+              assert environment['base_image'] == specification['base_image']
+              assert environment['python'] == specification['python']
+              environments[profile] = dict(environment=environment, image_id=subprocess.check_output(
+                  ['docker', 'image', 'inspect', '--format', '{{.Id}}', image],
+                  text=True, timeout=30).strip())
+          Path('acceptance-artifacts/locked-environments.json').write_text(
+              json.dumps(environments, indent=2) + '\n')
+          PY
+      - name: Bind transferred images and manifest to the verified source job
+        id: transfer
+        run: |
+          python - <<'PY'
+          import json, os, sys
+          sys.path.insert(0, 'compose_tests')
+          from recovery_transfer import TRANSFER, MANIFEST, MAX_MANIFEST_BYTES, confirm_images, digest
+          confirm_images(json.loads((TRANSFER / MANIFEST).read_text()))
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('sha256=' + digest(TRANSFER / MANIFEST, MAX_MANIFEST_BYTES) + '\n')
+          PY
+      - name: Transfer disposable recovery fixture to a separate runner
+        uses: actions/upload-artifact@v4
+        with:
+          name: operator-recovery-transfer-${{ github.run_id }}-${{ github.run_attempt }}
+          path: acceptance-transfer/*
+          retention-days: 1
+          compression-level: 1
+          if-no-files-found: error
+      - name: Retain synthetic acceptance evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: operator-compose-evidence
+          path: acceptance-artifacts/*
+          retention-days: 30
+          if-no-files-found: error
+  recover:
+    needs: compose
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install PyYAML==6.0.3
+      - uses: actions/download-artifact@v4
+        with:
+          name: operator-recovery-transfer-${{ github.run_id }}-${{ github.run_attempt }}
+          path: acceptance-transfer
+      - name: Collect separate-host recovery acceptance
+        run: python scripts/check-test-collection.py --runner unittest recovery_tests
+      - name: Restore verified archives on a fresh host without rebuilding
+        shell: bash
+        env:
+          TRANSFER_SHA256: ${{ needs.compose.outputs.transfer_sha256 }}
+        run: |
+          mkdir -p acceptance-artifacts
+          sudo env ATRAXIS_TRANSFER_SHA256="$TRANSFER_SHA256" "$(command -v python)" -m unittest discover -s recovery_tests -v 2>&1 | tee acceptance-artifacts/recovery.log
+      - name: Retain recovery results without fixture credentials or keys
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: operator-host-recovery-evidence
+          path: acceptance-artifacts/*
+          retention-days: 30
+          if-no-files-found: error