Evidence, not declaration

A configuration file records what you want, not what is true on the host; backup: true is only a line in a file. Onebox keeps the two apart.

Approval is not model intent

A statement that the user approved is data, not authority.

The current CLI requires a local human ceremony bound to the exact sealed plan, operator label, server, observed state, inputs, risk, and expiry. ob plan and ob approve are separate commands so the reviewed object and the answer cannot drift unnoticed. The resulting local_cli artifact is tamper-evident, but it is not authenticated identity or an independently issued capability: an actor with access to the same local runner can create it.

That limitation is part of the contract. A future external approval provider would need its own trust root, enrollment, revocation, and recovery design; Onebox does not pretend a local checksum creates that boundary.

Secrets follow the same rule: they enter through a trusted local or encrypted flow, never through ordinary model-visible arguments.

Declaration is not protection

Backup applies the principle to data recovery. A service reports Managed only while, all at once:

• the recorded immutable image digest is effective
• resource policy is effective
• driver health verifies through its qualified probe
• the declared protection objective is currently satisfied
• the backup schedule is installed
• the latest recoverable point is within policy
• replay continuity passes where applicable
• restore-drill proof is fresh

Any one of those expiring returns the service to Run immediately. Historical proof stays visible but cannot be mistaken for current protection.

Trusting the policy block alone would report a protected service even if its backups had been failing for a month.

Tier and envelope are separate

Managed would always be accompanied by the recovery kind (snapshot, pitr or cold) plus the observed recovery point and measured restore time. Otherwise “managed Redis” reads as point-in-time recovery it does not have.

Observation cannot mutate

Read commands do not repair, converge, prune or create. ob status and ob doctor read evidence; they never trigger the check that produces it.

In the proposed assurance layer, the check process has no converge methods in its operation graph.

Origins are published

See origin annotations for ob canonical, including # default, # shorthand, # override and defaults such as retainReleases: 5. Structured output labels authored, default, environment-override, observed and derived values.

Checkout provenance

The journal’s git_sha and the audit table’s GIT column show the checkout’s short HEAD revision. Modified, staged, deleted, or untracked files add +dirty; release directory IDs use -dirty to keep their existing safe format. If Git cannot read either the revision or the working-tree state, the field is omitted.

This describes the checkout when inspected. Git-ignored files are excluded, and the revision does not prove which bytes were shipped. The sealed plan’s payload digest binds the staged release contents separately.

Drift fails closed

A server-side artifact that differs from what the plan bound is a typed drift error before mutation, not a silent reconciliation. The plan expires after fifteen minutes for the same reason: an approval bound to observed state is worthless once that state may have moved.

What this costs

Observed evidence can produce worse-looking status pages. A service that oscillates between Managed and Run because a drill keeps being deferred for disk space looks broken, where a tool that trusted the declaration would look fine.