# Cal.diy Isolated-Live Connector Qualification

## Result

**Status:** PASS

**Execution date:** 2026-07-13

**Topology:** one AIP daemon, one pinned Cal.diy API deployment, separate AIP
and Cal.diy PostgreSQL databases, Redis, an RFC 7662 OAuth introspection fixture,
and one non-agent qualification runner on two internal Docker networks.

This record qualifies the AIP Cal.diy connector against its pinned upstream
implementation. It does not qualify the complete AIP platform or replace a
deployment's capacity, backup, observability, disaster-recovery, and rollout
controls.

## Artifact Identity

| Artifact | Identity |
| --- | --- |
| AIP source base | `d1d1a79d030d16e12d2ec8b46201e29cdfbdce5e` plus source digest `07b500c9ac0ff8ac5becc6b77c5661587fbe08de97522e21fed0e98edd94cee0` |
| Qualification harness | `sha256:605d580cb913ccf6673e6ca6465261b5593e71df806ca93f4b6d9def79950691` |
| AIP qualification image | `sha256:60ace4f074ad7f790801c6171e3f1dc9b66e7bf0dea4ed7291233a5b107131fd` |
| AIP builder image | `sha256:77237dd363a0b127bb5ef532c2d64c0deb380b738e43a9c4bdac73398d6d0a08` |
| AIP runtime base image | `sha256:240c36104698159b16dd76db37a24d97d04487d7635a6bb1a6f60064141fc969` |
| Cal.diy upstream revision | `f00434927386c9ecdcbd7e6c5f82d22044a245bc` |
| Cal.diy source tree | `ae0db7000d0479c20af5c82de60863a34165e2e2` |
| Cal.diy image | `sha256:52be5e3d24f65c4c42793702d93e68fa19ffa2c2fd45269e3ae60e6e81f0cc4a` |
| Qualification runner | `sha256:50ae7f4dda0ef887ff4259bcfb610a2d6d4ea78bf6440a49c0ae583050a3a01a` |

The AIP source and harness digests include tracked and untracked files used by
the build. They are retained because the qualification changes had not yet been
committed. Release promotion must rebuild and repeat the campaign from the
release commit.

## Security Boundary

- The requester and approver use independent OAuth bearer tokens and distinct
  principals. The approval decision is bound to the transport-authenticated
  approver, not to a caller-supplied identity field.
- The trusted identity directory maps the requester to one verified tenant, one
  Cal.diy external account, and one opaque credential handle. The deployment
  credential provider resolves owner-only secret material at invocation time.
- Credential material is absent from AIP envelopes, MCP results, manifests,
  durable lifecycle state, audit evidence, errors, and this report.
- Native AIP HTTP uses a separate owner-only bearer-token file.
- Both Docker networks are `internal`; the stack publishes no qualification
  port to the host and contains no agent service.
- Cal.diy webhook verification covers the exact raw body with constant-time
  HMAC-SHA256 comparison, a signed event-time window, and durable duplicate
  suppression.

## Reproduction

From the repository root, with the clean pinned Cal.diy checkout and admitted
local images available, run:

```bash
examples/cal-diy-qualification/qualify.sh
```

The script creates owner-only runtime secrets, resets only the dedicated Compose
project volumes, builds the locked AIP daemon without registry access, verifies
selected source files in the Cal.diy image, runs the initial workflow, restarts
the namespace owner and bound sidecars, and runs recovery verification. The
stack remains available for operator inspection after success.

## Required Assertions

The campaign fails unless every assertion below succeeds:

1. Native AIP invokes a real Cal.diy profile capability through `aipd`.
2. Independent OAuth-authenticated MCP sessions expose the stable AIP facade.
3. Exactly 81 Cal.diy capabilities are admitted with credential-required
   contracts and valid schemas.
4. Real Cal.diy slot discovery finds capacity before a write is attempted.
5. `plan` validates provider availability and creates no booking.
6. `commit` is durably blocked pending approval and creates no booking.
7. A separately authenticated authority reads the policy hash, submits evidence,
   and approves the immutable request.
8. Approval resume commits the transaction and creates exactly one correlated
   Cal.diy booking.
9. Replaying the exact action and idempotency key returns the original booking
   and does not create another provider mutation.
10. A valid webhook is accepted once, an exact replay is idempotent, an invalid
    HMAC is rejected, and stale signed event time is rejected.
11. The action, transaction, webhook event, idempotency result, and provider fact
    survive an `aipd` restart without another mutation.

## Observed Evidence

| Evidence | Observed value |
| --- | --- |
| Native message type | `aip.core.v1.action_result` |
| MCP transport | Streamable HTTP |
| Admitted Cal.diy capabilities | 81 |
| Available slot capacity | 8 |
| Booking count before plan/commit | 0 |
| Booking count after approval, replay, and restart | 1 |
| Pending approval observed | PASS |
| Authenticated approval decision observed | PASS |
| Transaction status | `committed` |
| Action state | `completed` |
| Exact replay reused provider result | PASS |
| Valid webhook | HTTP 204 |
| Duplicate webhook | HTTP 204, one AIP event |
| Invalid webhook HMAC | HTTP 401 |
| Stale webhook timestamp | HTTP 400 |
| Restart recovery | PASS |

Disposable correlation identifiers and all immutable artifact identities are
retained in
[`evidence/cal-diy-qualification-2026-07-13.json`](evidence/cal-diy-qualification-2026-07-13.json).

## Deterministic Gates

The live campaign is supplemented by repository-owned deterministic evidence:

- the complete 12-family frozen RFC 0004 connector driver, with cancellation
  and streaming explicitly not applicable because the connector advertises
  neither behavior;
- 25 connector unit tests, 11 HTTP/contract tests, daemon composition and MCP
  process-boundary tests;
- workspace schema, auth, runtime, gateway, MCP, Postgres recovery, transport,
  profile, connector, integration, conformance, and benchmark targets;
- `cargo test --workspace --all-targets`;
- `cargo clippy --workspace --all-targets -- -D warnings`;
- `cargo fmt --all --check`.

Ignored live suites for Dify, Chatwoot, and CrewAI were not executed and are not
counted as evidence for this qualification.