From 5803eece11562e6cd25618957b5ef3b90d061175 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:21:22 +0100
Subject: [PATCH 01/11] Prove authorized staging execution and replay
 protection

---
 .github/workflows/igraph-live-proof.yml | 30 ++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/igraph-live-proof.yml b/.github/workflows/igraph-live-proof.yml
index 9fc61a2..3121d80 100644
--- a/.github/workflows/igraph-live-proof.yml
+++ b/.github/workflows/igraph-live-proof.yml
@@ -191,6 +191,34 @@ jobs:
             --data-binary @/tmp/pact.json | tee /tmp/verify.json
           jq -e '.verified == true and (all(.validations[]; .status == "pass"))' /tmp/verify.json
 
+      - name: Prove authorized staging execution and replay protection
+        run: |
+          ARTIFACT_SHA="$(jq -r '.execution_scope.deploy_staging.artifact_hashes[0]' /tmp/pact.json)"
+          test -n "$ARTIFACT_SHA"
+          test "$ARTIFACT_SHA" != "null"
+          jq -n --slurpfile pact /tmp/pact.json --arg artifact "$ARTIFACT_SHA" \
+            '{pact:$pact[0], action:"deploy_staging", parameters:{target:"staging", artifact_sha256:$artifact}, human_approved:true}' \
+            >/tmp/execute-request.json
+          curl -fsS --max-time 120 -X POST "$IGRAPH_URL/v1/actions/execute" \
+            -H 'content-type: application/json' \
+            --data-binary @/tmp/execute-request.json | tee /tmp/execute-response.json
+          jq -e '
+            .event.status == "executed" and
+            .event.executor_invoked == true and
+            .receipt.status == "executed" and
+            (.event.evidence_sha256 | type == "string") and
+            (.event.evidence_sha256 | length == 64)
+          ' /tmp/execute-response.json
+          curl -fsS --max-time 120 -X POST "$IGRAPH_URL/v1/actions/execute" \
+            -H 'content-type: application/json' \
+            --data-binary @/tmp/execute-request.json | tee /tmp/replay-response.json
+          jq -e '
+            .event.status == "denied" and
+            .event.executor_invoked == false and
+            .receipt.status == "blocked" and
+            (.event.detail | test("Replay|duplicate|invocation limit"; "i"))
+          ' /tmp/replay-response.json
+
       - name: Prove signature tampering is blocked before execution
         run: |
           jq '.allowed_actions += ["deploy_production"]' /tmp/pact.json >/tmp/tampered-pact.json
@@ -244,7 +272,7 @@ jobs:
         if: always()
         run: |
           mkdir -p /tmp/igraph-live-proof
-          for file in /tmp/health.json /tmp/datahub-health.txt /tmp/discover.json /tmp/analyze-request.json /tmp/analyze.json /tmp/verify.json /tmp/pact.json /tmp/tampered-pact.json /tmp/tampered-request.json /tmp/tampered-response.json /tmp/expired-pact.json /tmp/expired-request.json /tmp/expired-response.json /tmp/unavailable-health.json /tmp/unavailable-response.json /tmp/igraph.log /tmp/igraph-unavailable.log; do
+          for file in /tmp/health.json /tmp/datahub-health.txt /tmp/discover.json /tmp/analyze-request.json /tmp/analyze.json /tmp/verify.json /tmp/pact.json /tmp/execute-request.json /tmp/execute-response.json /tmp/replay-response.json /tmp/tampered-pact.json /tmp/tampered-request.json /tmp/tampered-response.json /tmp/expired-pact.json /tmp/expired-request.json /tmp/expired-response.json /tmp/unavailable-health.json /tmp/unavailable-response.json /tmp/igraph.log /tmp/igraph-unavailable.log; do
             if [ -f "$file" ]; then
               cp "$file" /tmp/igraph-live-proof/
             fi

From f65d1a388d72dd6f435af5a0f3ce81763cc2027f Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:22:03 +0100
Subject: [PATCH 02/11] Correct live proof references and claim boundary

---
 docs/LIVE_PROOF.md | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/docs/LIVE_PROOF.md b/docs/LIVE_PROOF.md
index d62835a..d3dc45e 100644
--- a/docs/LIVE_PROOF.md
+++ b/docs/LIVE_PROOF.md
@@ -5,28 +5,33 @@ This page records the public GitHub Actions proof for the merged iGraph code.
 ## Merged code
 
 - Repository: https://github.com/etvjay/iGraph
-- Main commit: `0136cef2fa556d79f7565999f77cfc92c0a66d42`
-- Pull request: https://github.com/etvjay/iGraph/pull/2
-- Post-merge CI: https://github.com/etvjay/iGraph/actions/runs/31618368233
+- Main commit: `c9fc5dd92d024793dc20a037ff9feafeb22a92a5`
+- PR #2: https://github.com/etvjay/iGraph/pull/2
+- Evidence documentation: https://github.com/etvjay/iGraph/pull/3
+- Post-merge CI: https://github.com/etvjay/iGraph/actions/runs/31621253879
 
 ## Recorded live results
 
-The live-proof workflow ran against DataHub OSS and produced these results:
+The corrected live-proof workflow ran against DataHub OSS and produced these results:
 
 - `/health`: `context_mode=live`, `datahub_configured=true`, write-back disabled.
-- `/v1/discover`: 10 live candidates; the top candidate is `addresses` with
-  22 downstream assets and risk score 55.
-- `/v1/analyze`: live `addresses` context with 28 downstream assets, complete
-  retrieval, high risk 55/100, and signed Pact `igp_ce855182f9dc`.
+- `/v1/discover`: 10 live candidates; the selected `warehouses` context had 41 downstream
+  assets, 3 downstream dashboards, and risk score 55.
+- `/v1/analyze`: complete live `warehouses` context, high risk 55/100, context
+  fingerprint `1da0ef57ef64e47c`, and signed Pact `igp_cb78546442ad`.
+- `/v1/verify`: live post-read verification returned `verified=true` with complete
+  retrieval. This was a re-read proof; no real DataHub mutation was attempted.
 - Tampered Pact: `deny`, `executor_invoked=false`.
 - Expired Pact: `pact_stale`, `executor_invoked=false`.
 - Missing live context: `context_unavailable` / HTTP 503, with no fixture fallback.
 
-Download the complete workflow artifact from the successful proof run:
-https://github.com/etvjay/iGraph/actions/runs/31479477960/artifacts/9096775884
+Download the complete corrected proof artifact from run #9:
+https://github.com/etvjay/iGraph/actions/runs/31620540189/artifacts/9151279245
 
 ## Claim boundary
 
-This proves live reads, discovery, Pact signing, enforcement denial, expiry
-rejection, and fail-closed behavior. It does not prove production deployment,
-real database mutation, DataHub write-back, or a deployed public video.
\ No newline at end of file
+This proves live reads, discovery, Pact signing, live post-read verification,
+enforcement denial, expiry rejection, and fail-closed behavior. It does not prove
+a real database mutation, DataHub write-back, production deployment, or a deployed
+public video. Authorized staging execution and one-shot replay protection are
+covered by the follow-up proof workflow in the associated pull request.

From b68546df66e52e31616303bbf2d4b558dbd18942 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:22:07 +0100
Subject: [PATCH 03/11] Refresh submission evidence with corrected live proof

---
 docs/DEVPOST_SUBMISSION.md | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/docs/DEVPOST_SUBMISSION.md b/docs/DEVPOST_SUBMISSION.md
index 9942be4..e99685b 100644
--- a/docs/DEVPOST_SUBMISSION.md
+++ b/docs/DEVPOST_SUBMISSION.md
@@ -17,17 +17,19 @@ validation states, and optional DataHub custom-property/Document write-back.
 ## What the recorded proof demonstrates
 
 1. Live DataHub context is available and discovery returns 10 candidates.
-2. The `addresses` context binds 28 downstream assets into a signed Impact Pact
-   with a high consequence score of 55/100.
+2. The selected `warehouses` context binds 41 downstream assets and 3 dashboards
+   into a high-risk signed Impact Pact with score 55/100.
 3. A tampered Pact is denied before executor invocation.
 4. An expired Pact is rejected as `pact_stale` before executor invocation.
 5. Unavailable live context fails closed as `context_unavailable` / HTTP 503;
    iGraph does not substitute fixture metadata.
+6. Live post-read verification returns complete live context; it does not claim that
+   a real DataHub mutation occurred.
 
 The 10-second video is a silent, deterministic vector reconstruction of the
-control-room visual language, populated from the recorded proof artifact. It is
-labeled as a reconstruction and does not claim a production deployment, real
-database mutation, or DataHub write-back.
+control-room visual language, populated from recorded proof data. It is labeled as
+a reconstruction and does not claim a production deployment, real database
+mutation, or DataHub write-back.
 
 ## Built with
 
@@ -39,8 +41,8 @@ database mutation, or DataHub write-back.
 ## Links to include
 
 - Public source repository: `https://github.com/etvjay/iGraph`
-- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31479477960`
-- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31479477960/artifacts/9096775884`
+- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31620540189`
+- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31620540189/artifacts/9151279245`
 - Reproducible request: [`examples/change-request.json`](../examples/change-request.json)
 - Video asset: `igraph-demo-candidate.mp4` from the accompanying demo package
 
@@ -48,4 +50,4 @@ database mutation, or DataHub write-back.
 
 The built-in executor is a reversible staging simulator. Production deployment,
 real database mutation, and DataHub write-back remain outside this proof. The
-live proof keeps `IGRAPH_ENABLE_WRITEBACK=false`.
\ No newline at end of file
+live proof keeps `IGRAPH_ENABLE_WRITEBACK=false`.

From 60e80152c2e3c023db7bd8667742b4c95589bfec Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:33:44 +0100
Subject: [PATCH 04/11] Record authorized execution and replay proof

---
 docs/LIVE_PROOF.md | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/docs/LIVE_PROOF.md b/docs/LIVE_PROOF.md
index d3dc45e..63c1f2a 100644
--- a/docs/LIVE_PROOF.md
+++ b/docs/LIVE_PROOF.md
@@ -1,37 +1,41 @@
 # iGraph live proof
 
-This page records the public GitHub Actions proof for the merged iGraph code.
+This page records the public GitHub Actions proof for the iGraph control plane.
 
-## Merged code
+## Code and checks
 
 - Repository: https://github.com/etvjay/iGraph
-- Main commit: `c9fc5dd92d024793dc20a037ff9feafeb22a92a5`
-- PR #2: https://github.com/etvjay/iGraph/pull/2
-- Evidence documentation: https://github.com/etvjay/iGraph/pull/3
-- Post-merge CI: https://github.com/etvjay/iGraph/actions/runs/31621253879
+- Main branch: https://github.com/etvjay/iGraph/tree/main
+- Proof change: https://github.com/etvjay/iGraph/pull/4
+- Proof commit: `b68546df66e52e31616303bbf2d4b558dbd18942`
+- Ordinary CI for the proof branch: https://github.com/etvjay/iGraph/actions/runs/31740530254
 
 ## Recorded live results
 
-The corrected live-proof workflow ran against DataHub OSS and produced these results:
+Live proof run #10 ran against DataHub OSS and produced these results:
 
 - `/health`: `context_mode=live`, `datahub_configured=true`, write-back disabled.
-- `/v1/discover`: 10 live candidates; the selected `warehouses` context had 41 downstream
-  assets, 3 downstream dashboards, and risk score 55.
-- `/v1/analyze`: complete live `warehouses` context, high risk 55/100, context
-  fingerprint `1da0ef57ef64e47c`, and signed Pact `igp_cb78546442ad`.
+- `/v1/discover`: live discovery selected the `order_items` context. The compiled
+  context contained 37 downstream assets, 3 dashboards, and high risk 55/100.
+- `/v1/analyze`: signed Pact `igp_05f665c75cc1` with context fingerprint
+  `8a1838ad1be408fc`, complete live retrieval, and staging scope requiring human approval.
 - `/v1/verify`: live post-read verification returned `verified=true` with complete
   retrieval. This was a re-read proof; no real DataHub mutation was attempted.
+- Authorized staging action: with explicit approval, the reversible staging simulator
+  returned `executed`, `executor_invoked=true`, and a receipt with evidence.
+- Same-request replay: returned `denied` with `executor_invoked=false` because the
+  Pact invocation limit had already been consumed.
 - Tampered Pact: `deny`, `executor_invoked=false`.
 - Expired Pact: `pact_stale`, `executor_invoked=false`.
 - Missing live context: `context_unavailable` / HTTP 503, with no fixture fallback.
 
-Download the complete corrected proof artifact from run #9:
-https://github.com/etvjay/iGraph/actions/runs/31620540189/artifacts/9151279245
+Download the complete proof artifact from run #10:
+https://github.com/etvjay/iGraph/actions/runs/31740530138/artifacts/9197189421
 
 ## Claim boundary
 
 This proves live reads, discovery, Pact signing, live post-read verification,
-enforcement denial, expiry rejection, and fail-closed behavior. It does not prove
-a real database mutation, DataHub write-back, production deployment, or a deployed
-public video. Authorized staging execution and one-shot replay protection are
-covered by the follow-up proof workflow in the associated pull request.
+authorized reversible staging execution, one-shot replay protection, enforcement
+denial, expiry rejection, and fail-closed behavior. It does not prove a real
+database mutation, DataHub write-back, production deployment, or a deployed
+public video.

From 46673b4352ae0896dfe64739ef1c0e5e4488a3d4 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:33:51 +0100
Subject: [PATCH 05/11] Update submission with authorized proof evidence

---
 docs/DEVPOST_SUBMISSION.md | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/docs/DEVPOST_SUBMISSION.md b/docs/DEVPOST_SUBMISSION.md
index e99685b..73d031c 100644
--- a/docs/DEVPOST_SUBMISSION.md
+++ b/docs/DEVPOST_SUBMISSION.md
@@ -16,14 +16,17 @@ validation states, and optional DataHub custom-property/Document write-back.
 
 ## What the recorded proof demonstrates
 
-1. Live DataHub context is available and discovery returns 10 candidates.
-2. The selected `warehouses` context binds 41 downstream assets and 3 dashboards
-   into a high-risk signed Impact Pact with score 55/100.
-3. A tampered Pact is denied before executor invocation.
-4. An expired Pact is rejected as `pact_stale` before executor invocation.
-5. Unavailable live context fails closed as `context_unavailable` / HTTP 503;
+1. Live DataHub context is available and discovery selects a real showcase asset.
+2. The selected `order_items` context contains 37 downstream assets and 3 dashboards,
+   producing a high-risk 55/100 signed Pact.
+3. An explicitly approved `deploy_staging` action reaches only the reversible
+   staging simulator and returns an executed receipt with evidence.
+4. Repeating the same signed request is denied before a second executor invocation.
+5. A tampered Pact is denied before executor invocation.
+6. An expired Pact is rejected as `pact_stale` before executor invocation.
+7. Unavailable live context fails closed as `context_unavailable` / HTTP 503;
    iGraph does not substitute fixture metadata.
-6. Live post-read verification returns complete live context; it does not claim that
+8. Live post-read verification returns complete live context; it does not claim that
    a real DataHub mutation occurred.
 
 The 10-second video is a silent, deterministic vector reconstruction of the
@@ -41,8 +44,8 @@ mutation, or DataHub write-back.
 ## Links to include
 
 - Public source repository: `https://github.com/etvjay/iGraph`
-- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31620540189`
-- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31620540189/artifacts/9151279245`
+- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31740530138`
+- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31740530138/artifacts/9197189421`
 - Reproducible request: [`examples/change-request.json`](../examples/change-request.json)
 - Video asset: `igraph-demo-candidate.mp4` from the accompanying demo package
 

From 980557ec1ccca36af0d7e567bada83e1401b60c8 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:41:56 +0100
Subject: [PATCH 06/11] Stabilize live proof dataset selection

---
 .github/workflows/igraph-live-proof.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/igraph-live-proof.yml b/.github/workflows/igraph-live-proof.yml
index 3121d80..abbdc6c 100644
--- a/.github/workflows/igraph-live-proof.yml
+++ b/.github/workflows/igraph-live-proof.yml
@@ -167,7 +167,16 @@ jobs:
             (.candidates | length) > 0 and
             (any(.candidates[]; (.downstream_count // 0) > 0))
           ' /tmp/discover.json
-          URN="$(jq -r '.candidates | max_by(.downstream_count) | .urn' /tmp/discover.json)"
+          URN="$(jq -r '
+            .candidates[]
+            | select(
+                .urn == "urn:li:dataset:(urn:li:dataPlatform:snowflake,b2fd91.order_entry_db.order_entry.order_items,PROD)"
+              )
+            | .urn
+          ' /tmp/discover.json | head -n1)"
+          if [ -z "$URN" ] || [ "$URN" = "null" ]; then
+            URN="$(jq -r '.candidates | max_by(.downstream_count) | .urn' /tmp/discover.json)"
+          fi
           test -n "$URN"
           test "$URN" != "null"
           echo "Selected live dataset: $URN"

From 37002296253c54c594032dd72535e0736088429d Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 21:53:51 +0100
Subject: [PATCH 07/11] Refresh evidence for final live proof

---
 docs/DEVPOST_SUBMISSION.md |  4 ++--
 docs/LIVE_PROOF.md         | 13 ++++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/docs/DEVPOST_SUBMISSION.md b/docs/DEVPOST_SUBMISSION.md
index 73d031c..383895e 100644
--- a/docs/DEVPOST_SUBMISSION.md
+++ b/docs/DEVPOST_SUBMISSION.md
@@ -44,8 +44,8 @@ mutation, or DataHub write-back.
 ## Links to include
 
 - Public source repository: `https://github.com/etvjay/iGraph`
-- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31740530138`
-- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31740530138/artifacts/9197189421`
+- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31742150914`
+- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31742150914/artifacts/9197797604`
 - Reproducible request: [`examples/change-request.json`](../examples/change-request.json)
 - Video asset: `igraph-demo-candidate.mp4` from the accompanying demo package
 
diff --git a/docs/LIVE_PROOF.md b/docs/LIVE_PROOF.md
index 63c1f2a..c06951c 100644
--- a/docs/LIVE_PROOF.md
+++ b/docs/LIVE_PROOF.md
@@ -7,18 +7,17 @@ This page records the public GitHub Actions proof for the iGraph control plane.
 - Repository: https://github.com/etvjay/iGraph
 - Main branch: https://github.com/etvjay/iGraph/tree/main
 - Proof change: https://github.com/etvjay/iGraph/pull/4
-- Proof commit: `b68546df66e52e31616303bbf2d4b558dbd18942`
-- Ordinary CI for the proof branch: https://github.com/etvjay/iGraph/actions/runs/31740530254
+- Ordinary CI for the proof branch: https://github.com/etvjay/iGraph/actions/runs/31742150917
 
 ## Recorded live results
 
-Live proof run #10 ran against DataHub OSS and produced these results:
+Live proof run #13 ran against DataHub OSS and produced these results:
 
 - `/health`: `context_mode=live`, `datahub_configured=true`, write-back disabled.
 - `/v1/discover`: live discovery selected the `order_items` context. The compiled
   context contained 37 downstream assets, 3 dashboards, and high risk 55/100.
-- `/v1/analyze`: signed Pact `igp_05f665c75cc1` with context fingerprint
-  `8a1838ad1be408fc`, complete live retrieval, and staging scope requiring human approval.
+- `/v1/analyze`: signed Pact `igp_a2743e1961fb` with context fingerprint
+  `acc76d9fbdaecbfe`, complete live retrieval, and staging scope requiring human approval.
 - `/v1/verify`: live post-read verification returned `verified=true` with complete
   retrieval. This was a re-read proof; no real DataHub mutation was attempted.
 - Authorized staging action: with explicit approval, the reversible staging simulator
@@ -29,8 +28,8 @@ Live proof run #10 ran against DataHub OSS and produced these results:
 - Expired Pact: `pact_stale`, `executor_invoked=false`.
 - Missing live context: `context_unavailable` / HTTP 503, with no fixture fallback.
 
-Download the complete proof artifact from run #10:
-https://github.com/etvjay/iGraph/actions/runs/31740530138/artifacts/9197189421
+Download the complete proof artifact from run #13:
+https://github.com/etvjay/iGraph/actions/runs/31742150914/artifacts/9197797604
 
 ## Claim boundary
 

From 05fffca4becda4ef3a003ddbaca0462f2ccf8373 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 23:03:05 +0100
Subject: [PATCH 08/11] Refresh stale Pacts before authorized staging proof

---
 .github/workflows/igraph-live-proof.yml | 72 +++++++++++++++++++++----
 1 file changed, 63 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/igraph-live-proof.yml b/.github/workflows/igraph-live-proof.yml
index abbdc6c..cf5f91e 100644
--- a/.github/workflows/igraph-live-proof.yml
+++ b/.github/workflows/igraph-live-proof.yml
@@ -202,15 +202,68 @@ jobs:
 
       - name: Prove authorized staging execution and replay protection
         run: |
-          ARTIFACT_SHA="$(jq -r '.execution_scope.deploy_staging.artifact_hashes[0]' /tmp/pact.json)"
-          test -n "$ARTIFACT_SHA"
-          test "$ARTIFACT_SHA" != "null"
-          jq -n --slurpfile pact /tmp/pact.json --arg artifact "$ARTIFACT_SHA" \
-            '{pact:$pact[0], action:"deploy_staging", parameters:{target:"staging", artifact_sha256:$artifact}, human_approved:true}' \
-            >/tmp/execute-request.json
-          curl -fsS --max-time 120 -X POST "$IGRAPH_URL/v1/actions/execute" \
-            -H 'content-type: application/json' \
-            --data-binary @/tmp/execute-request.json | tee /tmp/execute-response.json
+          refresh_pact() {
+            curl -fsS --max-time 300 -X POST "$IGRAPH_URL/v1/analyze" \
+              -H 'content-type: application/json' \
+              --data-binary @/tmp/analyze-request.json | tee /tmp/analyze.json
+            jq -e '
+              (.pact.context.live == true) and
+              (.pact.context.retrieval_complete == true) and
+              ((.pact.context.downstream | length) > 0) and
+              ((.pact.signature | length) >= 32) and
+              ((.pact.context_hash | length) > 0)
+            ' /tmp/analyze.json
+            jq '.pact' /tmp/analyze.json >/tmp/pact.json
+            curl -fsS --max-time 300 -X POST "$IGRAPH_URL/v1/verify" \
+              -H 'content-type: application/json' \
+              --data-binary @/tmp/pact.json | tee /tmp/verify.json
+            jq -e '.verified == true and (all(.validations[]; .status == "pass"))' /tmp/verify.json
+          }
+
+          for attempt in $(seq 1 5); do
+            echo "Authorized staging attempt $attempt"
+            ARTIFACT_SHA="$(jq -r '.execution_scope.deploy_staging.artifact_hashes[0]' /tmp/pact.json)"
+            test -n "$ARTIFACT_SHA"
+            test "$ARTIFACT_SHA" != "null"
+            jq -n --slurpfile pact /tmp/pact.json --arg artifact "$ARTIFACT_SHA" \
+              '{pact:$pact[0], action:"deploy_staging", parameters:{target:"staging", artifact_sha256:$artifact}, human_approved:true}' \
+              >/tmp/execute-request.json
+
+            status="$(curl -sS --max-time 120 -o /tmp/execute-response.json -w '%{http_code}' \
+              -X POST "$IGRAPH_URL/v1/actions/execute" \
+              -H 'content-type: application/json' \
+              --data-binary @/tmp/execute-request.json || true)"
+            echo "Authorized staging attempt $attempt returned HTTP $status"
+            cat /tmp/execute-response.json
+
+            if [ "$status" = "200" ] && jq -e '
+              .event.status == "executed" and
+              .event.executor_invoked == true and
+              .receipt.status == "executed" and
+              (.event.evidence_sha256 | type == "string") and
+              (.event.evidence_sha256 | length == 64)
+            ' /tmp/execute-response.json >/dev/null 2>&1; then
+              break
+            fi
+
+            if [ "$attempt" = "5" ]; then
+              echo "Authorized staging execution did not stabilize after five attempts"
+              exit 1
+            fi
+
+            if jq -e '
+              .event.status == "pact_stale" and
+              (.event.detail | test("Denied before executor invocation"; "i"))
+            ' /tmp/execute-response.json >/dev/null 2>&1; then
+              echo "Live context drifted before execution; refreshing the Pact"
+              refresh_pact
+              continue
+            fi
+
+            echo "Authorized staging execution failed for a non-drift reason"
+            exit 1
+          done
+
           jq -e '
             .event.status == "executed" and
             .event.executor_invoked == true and
@@ -218,6 +271,7 @@ jobs:
             (.event.evidence_sha256 | type == "string") and
             (.event.evidence_sha256 | length == 64)
           ' /tmp/execute-response.json
+
           curl -fsS --max-time 120 -X POST "$IGRAPH_URL/v1/actions/execute" \
             -H 'content-type: application/json' \
             --data-binary @/tmp/execute-request.json | tee /tmp/replay-response.json

From 48fd1405c9a1e70d65d82eb6d87eb249eefff5ba Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 23:13:10 +0100
Subject: [PATCH 09/11] Resolve deterministic target through filtered live
 discovery

---
 .github/workflows/igraph-live-proof.yml | 45 ++++++++++++++++---------
 1 file changed, 29 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/igraph-live-proof.yml b/.github/workflows/igraph-live-proof.yml
index cf5f91e..30fc279 100644
--- a/.github/workflows/igraph-live-proof.yml
+++ b/.github/workflows/igraph-live-proof.yml
@@ -146,7 +146,7 @@ jobs:
         run: |
           for attempt in $(seq 1 36); do
             status="$(curl -sS --max-time 120 -o /tmp/discover.json -w '%{http_code}' "$IGRAPH_URL/v1/discover?query=%2A" || true)"
-            echo "Discovery attempt $attempt returned HTTP $status"
+            echo "Wildcard discovery attempt $attempt returned HTTP $status"
             if [ "$status" = "200" ] && jq -e '
               .live == true and
               ((.candidates | length) > 0) and
@@ -155,7 +155,7 @@ jobs:
               break
             fi
             if [ "$attempt" = "36" ]; then
-              echo "Live discovery did not return a dataset with loaded lineage"
+              echo "Live wildcard discovery did not return a dataset with loaded lineage"
               cat /tmp/discover.json || true
               exit 1
             fi
@@ -167,20 +167,33 @@ jobs:
             (.candidates | length) > 0 and
             (any(.candidates[]; (.downstream_count // 0) > 0))
           ' /tmp/discover.json
-          URN="$(jq -r '
-            .candidates[]
-            | select(
-                .urn == "urn:li:dataset:(urn:li:dataPlatform:snowflake,b2fd91.order_entry_db.order_entry.order_items,PROD)"
-              )
-            | .urn
-          ' /tmp/discover.json | head -n1)"
-          if [ -z "$URN" ] || [ "$URN" = "null" ]; then
-            URN="$(jq -r '.candidates | max_by(.downstream_count) | .urn' /tmp/discover.json)"
-          fi
-          test -n "$URN"
-          test "$URN" != "null"
-          echo "Selected live dataset: $URN"
-          jq -n --arg entity "$URN" '{action:"modify_asset", entity:$entity}' >/tmp/analyze-request.json
+
+          TARGET_URN="urn:li:dataset:(urn:li:dataPlatform:snowflake,b2fd91.order_entry_db.order_entry.order_items,PROD)"
+          for attempt in $(seq 1 36); do
+            status="$(curl -sS --get --max-time 120 \
+              -o /tmp/target-discover.json -w '%{http_code}' \
+              "$IGRAPH_URL/v1/discover" --data-urlencode "query=order_items" || true)"
+            echo "Target discovery attempt $attempt returned HTTP $status"
+            if [ "$status" = "200" ] && jq -e --arg target "$TARGET_URN" '
+              .live == true and
+              any(.candidates[]; .urn == $target and (.downstream_count // 0) > 0)
+            ' /tmp/target-discover.json >/dev/null 2>&1; then
+              break
+            fi
+            if [ "$attempt" = "36" ]; then
+              echo "Target order_items dataset did not become discoverable with loaded lineage"
+              cat /tmp/target-discover.json || true
+              exit 1
+            fi
+            sleep 5
+          done
+          cat /tmp/target-discover.json
+          jq -e --arg target "$TARGET_URN" '
+            .live == true and
+            any(.candidates[]; .urn == $target and (.downstream_count // 0) > 0)
+          ' /tmp/target-discover.json
+          echo "Selected deterministic live dataset: $TARGET_URN"
+          jq -n --arg entity "$TARGET_URN" '{action:"modify_asset", entity:$entity}' >/tmp/analyze-request.json
 
       - name: Prove Pact compilation and verification
         run: |

From 6cda108db67d6a009e88bb4aa3431f80fb9ac880 Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 23:24:47 +0100
Subject: [PATCH 10/11] docs: record green live proof run 16

---
 docs/LIVE_PROOF.md | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/docs/LIVE_PROOF.md b/docs/LIVE_PROOF.md
index c06951c..82ae253 100644
--- a/docs/LIVE_PROOF.md
+++ b/docs/LIVE_PROOF.md
@@ -7,34 +7,36 @@ This page records the public GitHub Actions proof for the iGraph control plane.
 - Repository: https://github.com/etvjay/iGraph
 - Main branch: https://github.com/etvjay/iGraph/tree/main
 - Proof change: https://github.com/etvjay/iGraph/pull/4
-- Ordinary CI for the proof branch: https://github.com/etvjay/iGraph/actions/runs/31742150917
+- Ordinary CI for the proof branch: https://github.com/etvjay/iGraph/actions/runs/31749044332
 
 ## Recorded live results
 
-Live proof run #13 ran against DataHub OSS and produced these results:
+Live proof run #16 ran against DataHub OSS and produced these results:
 
 - `/health`: `context_mode=live`, `datahub_configured=true`, write-back disabled.
-- `/v1/discover`: live discovery selected the `order_items` context. The compiled
-  context contained 37 downstream assets, 3 dashboards, and high risk 55/100.
-- `/v1/analyze`: signed Pact `igp_a2743e1961fb` with context fingerprint
-  `acc76d9fbdaecbfe`, complete live retrieval, and staging scope requiring human approval.
+- `/v1/discover`: live wildcard discovery returned DataHub showcase assets, and the deterministic
+  `order_items` target was found with loaded lineage.
+- `/v1/analyze`: signed Pact `igp_eb762f75370d` with context fingerprint
+  `db707cbee0416b60`, complete live retrieval, and staging scope requiring human approval.
+  The compiled context contained 37 downstream assets, 3 dashboards, and high risk 55/100.
 - `/v1/verify`: live post-read verification returned `verified=true` with complete
   retrieval. This was a re-read proof; no real DataHub mutation was attempted.
 - Authorized staging action: with explicit approval, the reversible staging simulator
-  returned `executed`, `executor_invoked=true`, and a receipt with evidence.
+  returned `executed`, `executor_invoked=true`, and a receipt with evidence hash
+  `14d0b81de9e6850255958da682bab0d0dc4f1534036752634ca07c6be0b21396`.
 - Same-request replay: returned `denied` with `executor_invoked=false` because the
   Pact invocation limit had already been consumed.
 - Tampered Pact: `deny`, `executor_invoked=false`.
 - Expired Pact: `pact_stale`, `executor_invoked=false`.
 - Missing live context: `context_unavailable` / HTTP 503, with no fixture fallback.
 
-Download the complete proof artifact from run #13:
-https://github.com/etvjay/iGraph/actions/runs/31742150914/artifacts/9197797604
+Download the complete proof artifact from run #16:
+https://github.com/etvjay/iGraph/actions/runs/31749044334/artifacts/9200418599
 
 ## Claim boundary
 
 This proves live reads, discovery, Pact signing, live post-read verification,
 authorized reversible staging execution, one-shot replay protection, enforcement
 denial, expiry rejection, and fail-closed behavior. It does not prove a real
-database mutation, DataHub write-back, production deployment, or a deployed
-public video.
+database mutation, DataHub write-back, production deployment, or a deployed public
+video.

From abdee4fe66a5c77bf1a5bb2a4df13e1ad8d597ee Mon Sep 17 00:00:00 2001
From: etvjay <etvictory620@gmail.com>
Date: Thu, 13 Aug 2026 23:24:53 +0100
Subject: [PATCH 11/11] docs: link devpost draft to green live proof

---
 docs/DEVPOST_SUBMISSION.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/DEVPOST_SUBMISSION.md b/docs/DEVPOST_SUBMISSION.md
index 383895e..ca01ed6 100644
--- a/docs/DEVPOST_SUBMISSION.md
+++ b/docs/DEVPOST_SUBMISSION.md
@@ -44,8 +44,8 @@ mutation, or DataHub write-back.
 ## Links to include
 
 - Public source repository: `https://github.com/etvjay/iGraph`
-- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31742150914`
-- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31742150914/artifacts/9197797604`
+- Live proof run: `https://github.com/etvjay/iGraph/actions/runs/31749044334`
+- Live proof artifact: `https://github.com/etvjay/iGraph/actions/runs/31749044334/artifacts/9200418599`
 - Reproducible request: [`examples/change-request.json`](../examples/change-request.json)
 - Video asset: `igraph-demo-candidate.mp4` from the accompanying demo package