Lifecycle Proof

ota proof lifecycle owns one workflow-declared service transaction instead of asking CI to copy start and stop shell commands.

It proves only the selected manager boundary. It is not application-output, deployment, or repo-global proof.

• authority-governed lifecycle proof accepts --grant <id> and binds selected services, their dependency closure, the assertion, lifecycle transitions, and cleanup into one terminal crossing transaction
• a grant required by any selected proof invocation refuses before prerequisites, services, assertions, or proof artifacts start
• a typed-effect denial in the selected proof closure returns OTA_EFFECT_POLICY_DENIED before replay checks, authority or sandbox admission, services, assertions, or proof artifacts; an admitted typed action still refuses because provider execution is disabled

ota proof lifecycle --workflow smoke --json --archive .

The workflow references an existing service manager. Start, stop, readiness, and dependency order remain on the canonical service surface rather than being duplicated in workflow shell.

services:  database:    manager:      kind: compose      name: app      file: compose.yaml      service: database    lifecycle:      teardown_assertion: manager_inactive workflows:  smoke:    run:      task: build    proof:      lifecycle:        services: [database]        assertion:          task: assert-database

• Ota obtains cleanup authority before start and finalizes leased services in reverse order after success, failure, or interruption.
• manager_inactive requires a typed manager observation. A failed HTTP or TCP probe never proves a service stopped.
• boundary_terminated is narrower: it proves Ota removed its exact ephemeral container session after structured manager commands, not that a host process is absent. Machine consumers should require the same boundary_identity in archive scope and every isolated service record.
• A failed isolated-session removal is runner-attested incomplete cleanup. It cannot become boundary_terminated or manager-derived inactivity evidence.
• Read proof_verdict and not_proved[]; a successful lifecycle transaction still retains application-output and broader-repository boundaries.