[cariandrum22]

Summary

Inventory all 73 workflow jobs and seven external qualification responsibilities after the Hosted/physical measurement split. CI rejects missing, duplicate or unclassified entries and keeps commissioning obligations explicit. Inventory validity never grants qualification admission.

Repair the managed-provider reference importer: preserve the original producer, execution lane and observation time, append a separate hash-bound import history, and reject output overwrite. Importing local evidence no longer relabels it as a Hosted observation.

Validation

• Responsibility inventory and negative fixtures cover omitted/duplicated jobs, unknown classifications, incomplete owners/evidence, invalid paths and false commissioning claims.
• Actual import-tool regression covers repeated imports, source/lane preservation, stale and local evidence, malformed input and output collisions; JSON-schema and enterprise-readiness validators pass.
• TypeScript checks, workflow inventory/actionlint, Python Ruff/mypy and documentation validation pass.

Notes

Stacked on the CI-boundary migration #226. This is the first completeness repair, not completion of external qualification. Remaining items include trusted artifact-bound admission, bare-metal capability and performance profiles, test-tenant IaC/live interoperability, real KMS, complete conformance plans, and bounded recovery. They remain explicit in the inventory and documentation.

SDK tools here are reference/scaffold sources; the separate SDK must adopt the import repair. No live Auth0 trial or tenant provisioning is claimed. The originally unsigned commits have been replaced with signed commits and verified tree correspondence. This revision is rebased on the corrected CI boundary and the independently reviewable rustls update in #228. External qualification and merge/release admission remain held.