OBS-G2 — producer receipt exporter

Implementation status: PASS

Gate B (privacy/exporter): PASS

Gate B½ (dedicated-bucket routing): BLOCKED — external GCP Log Router behavior

Overall OBS-G2: BLOCKED — external platform dependency

Transport boundary

Implementation:

scripts/producer_receipt_export_gcp.py

The exporter:

1. validates each input against evidence:producer-run-receipt@1;
2. applies a fail-closed metadata/privacy guard;
3. checks compiled-projection export eligibility;
4. preserves the validated canonical receipt under a bounded structured payload;
5. derives a canonical receipt SHA-256;
6. derives a deterministic insertId from producer ID, run ID and receipt SHA;
7. uses the receipt finished_at as the Cloud Logging event timestamp;
8. supports entries.write dryRun=true before a real write.

The exporter does not create infrastructure, execute producers, or distribute service-account keys.

Builder proof

Three heterogeneous existing receipts passed both dryRun=true and real entries.write with HTTP 200:

substrate	producer	receipt SHA-256	deterministic insert ID
GitHub observer	producer.github.census-sampler-check	fca1c7a483766a6af0814137837d8b6ca10b1080a1a54632b7e033119ae7a003	c1e6a5adc31ec2e779010d0f6479dbb46ae29c7ce36e9082278ff91a83abf6ae
manifest translator	producer.manual.kb-evidence-selector	a2f03dab36f53610a119eae4309133e8babfce712a22f136c366149189d558e5	a7ddc46ec2592888cd908c3399ed0acf8e07ef8293aa31e56f0b113cd3398e86
local/systemd wrapper	producer.local.office-compile	5662b76440d686712db59800558ebe69989177bb12a61072ee6d6f654fd92def	592c336cf0304e73cba866bb42a8da4087bf8575a21a3398d9378ff8b0581018

Project-level Logging queries returned the expected producer/run identities, receipt hashes, and insert IDs.

Routing isolation evidence

Dedicated-bucket routing remains externally blocked and is independent of the exporter implementation.

The isolation campaign reproduced the anomaly across:

• the original custom sink;
• a second independent custom sink;
• the canonical Analytics-enabled estate-producer-runs bucket;
• a separate temporary plain Logging bucket;
• exact logName= predicates;
• control-plane state held stable beyond the normal troubleshooting window.

Representative fresh probes:

obs-g2-stable-20261005T060018-d3e9a33375b7
obs-g2-parallel-20261005T060502-97d00a0682f4
obs-g2-altbucket-20261005T061547-15ab641738fa

For these tests, custom destinations did not receive the fresh entries while _Default did. No current custom-sink exports/log_entry_count, exports/byte_count, or exports/error_count series explained the failure.

This substantially rules out the exporter implementation, the original sink object, the canonical destination bucket, Analytics enablement, filter syntax, and same-project destination IAM as sole causes.

Fresh canonical exporter proof

A later real non-diagnostic receipt was exported through the actual G2 exporter:

producer_id:
producer.local.office-compile

run_id:
local:producer.local.office-compile:20261005T001609413221Z:250862

receipt SHA-256:
6bf4582fa6e4020cff83ee3eaea4c9f74e814bbfc2ae5281a792067a6d5a48df

deterministic insertId:
636b5b5e0e454675b643e4cd17c7e6a04ba60107a5886f01adf841d701df65a6

finished_at:
2026-10-05T00:16:09.469779Z

Exporter results:

dry-run: HTTP 200
write:   HTTP 200

Physical verification for that fresh canonical receipt:

estate-producer-runs/_AllLogs: 0
_Default/_AllLogs:           1

This directly confirms that the remaining failure is downstream of the exporter.

The dedicated bucket currently contains three older non-probe receipts, so the observed system is inconsistent rather than a simple permanent destination access failure. Fresh acceptance still fails and therefore Gate B½ remains blocked.

Idempotency and privacy

Logical retry identity is deterministic through:

producer_id + run_id + canonical receipt SHA-256 → insertId

Cloud Logging is not treated as an exactly-once query store. Downstream analytics deduplicate by logical receipt identity and receipt SHA.

No command arguments, cwd, environment, absolute paths, credentials, tokens, transcripts, source payloads, private document contents, or dataset rows are projected. Focused tests cover canonical validation, privacy rejection, dry-run/write equivalence, and deterministic identity.

Decision

OBS-G2 implementation: PASS
Gate B:               PASS
Gate B½:              BLOCKED — external GCP routing
Overall OBS-G2:       BLOCKED — external platform dependency

The implementation is canonical and usable in main without claiming end-to-end routing acceptance. The remaining anomaly is tracked separately for Google Cloud escalation.

G3 may build on this transport contract, but canonical G3 acceptance and Gate C remain blocked until fresh receipts reliably reach the dedicated bucket.