{
  "schema": "guanghu.ops-experience-receipt/v1",
  "receipt_id": "EXP-20260726-001-AUTHORIZATION-IS-NOT-TRANSPORT",
  "intent": "Push the recovered Fifth Domain changes to the current code channel.",
  "scope": "repository-push",
  "input": "A scoped work order or approval existed, but the current instance had no verified repository transport.",
  "evidence": [
    "server-tools/lake-lamp-authz/authorize-repo-push.js",
    "commit b03619e"
  ],
  "decision": "Fail closed instead of reporting a push.",
  "action": "Separated authorization state from credential transport and added an explicit transport-required guard.",
  "observed_result": "The helper now refuses to claim success when repository transport is absent.",
  "correction": "Verify target repository, branch, current approval and actual transport independently before push.",
  "invariant_id": "INV-AUTH-TRANSPORT-EXECUTION-SEPARATION",
  "invariant": "Authorization, credential transport, action execution and remote receipt are separate proofs.",
  "verification": [
    "Automated test covers missing transport.",
    "Remote commit is read back after a real push."
  ],
  "receipt_path": "commit:b03619e",
  "promotion_state": "REVIEWED",
  "recorded_at": "2026-07-26T12:00:00+08:00"
}