Assignment ADR-0055/revenue/007, coordinator 01a0e095-f279-7fd0-a8ef-92ce8f9547fc/local, prepares an executable for separately reviewed execution. Root remains the sole canonical memo publisher and indexer. This is a prepared owner memo.
The exact runner SHA256 is f2b1876b5cb65ccac10fb8a1e7e1a01bb8f8e0dd3f0f71db83cd69f760f97eb2. It binds diagnostic dpl_7don8uKMCcNB5hjLBjDMMJNpZwsn/source ed414c52522bf9722868fd415c61bb6f61231d17 and cleanup dpl_GRmcTeKMc8qcqmvW8aMkSfDMAUo7/source 14090538972f5dea9ae6dfdc05d9f94328afd3a5. The original Ed25519 key remains under RAM custody, with no load, new key, signature, promotion or diagnostic POST. Copying the runner to the original loader path does not authorize loading it.
Observed production domain and automatic alias metadata defines exactly three expected affected aliases: revenue.sguildswim.com, revenue-brown-chi.vercel.app and revenue-jack-allreds-projects.vercel.app. Three other aliases retain exact baseline targets. Promotion effects remain unobserved; any extra effect fails verification and invokes exact cleanup once. Cron deployment ID and all five hosts change to the promoted artifact; definitions, schedules, enabled/disabled state and business runtime remain pinned. Provider updatedAt may advance. A vercel.app SSO302 proves protection, never app health or removed canonical route absence.
40 focused tests pass using inert signing and control-plane/HTTP mocks. The runner checks root execution approval, exclusive claim, pinned inputs, READY sources, complete aliases/domains, business environment/settings and remote function configs. It permits one signed empty canonical POST with a 10-second whole-request budget and 30-second authority window, without redirects or retry. Every post-promotion outcome attempts exact cleanup once, verifies canonical404, observes trusted expiry and returns to custody's unconditional key-reference destruction. Cleanup or expiry uncertainty remains explicit and requires operator recovery. Process termination requires external exact cleanup and key-session recovery; in-process finally is not crash assurance.
Closed catalog response validation preserves actual role evidence, including privilege gaps, and rejects extra output. No database, role, grant, migration, protocol or financial/provider action is introduced. Integrated004 and joined readiness remain outside this preparation. Root must review006 and007 together before deciding execution. Evidence lives in docs/adr0055/serving-invocation-review in the Revenue portable-runtime managed checkout, with exact runner, tests, metadata, business-preservation proof and packet hashes.