fix(validation): secure blocker walkthrough evidence setup

Author: haydaramru

WALKTHROUGH.md

@@ -35,6 +35,21 @@ ignored directory:
 validation-output/walkthroughs/<walkthrough-id>/observation.md
 ```
 
+The walkthrough base, each run directory, and each observation file contain
+private evaluation evidence. Create or normalize them before starting:
+
+```bash
+WALKTHROUGH_BASE="$PWD/validation-output/walkthroughs"
+install -d -m 0700 "$WALKTHROUGH_BASE"
+install -d -m 0700 "$WALKTHROUGH_BASE/<walkthrough-id>"
+chmod 0600 "$WALKTHROUGH_BASE/<walkthrough-id>/observation.md"
+```
+
+The controller rejects an evidence base or ancestor that is group- or
+world-writable. The `<walkthrough-id>` recorded inside `observation.md` is the
+same identifier every later command for that walkthrough must reuse; do not
+generate a second ID after the observation clock starts.
+
 Never record a hostname, IP address, CIDR, username, key path, credential,
 target-file value, raw traffic, or payload. Use only `operator-workstation` and
 the configured non-sensitive target alias, normally `field-host`.
@@ -183,9 +198,14 @@ working tree stays clean. Start from the repository root:
 
 ```bash
 DEPLOY_COMMIT=<full-40-character-sha>
-BLOCKER_ID="blocker-$(date -u +%Y%m%dT%H%M%SZ)"
+WALKTHROUGH_BASE="$PWD/validation-output/walkthroughs"
+BLOCKER_ID="<existing-observation-log-walkthrough-id>"
 BLOCKER_DIR="/tmp/eventhorizon-$BLOCKER_ID"
-BLOCKER_OUTPUT="$PWD/validation-output/walkthroughs/$BLOCKER_ID"
+BLOCKER_OUTPUT="$WALKTHROUGH_BASE/$BLOCKER_ID"
+
+test -f "$BLOCKER_OUTPUT/observation.md"
+chmod 0700 "$WALKTHROUGH_BASE" "$BLOCKER_OUTPUT"
+chmod 0600 "$BLOCKER_OUTPUT/observation.md"
 
 git worktree add --detach "$BLOCKER_DIR" "$DEPLOY_COMMIT"
 printf '\n# WALKTHROUGH_ONLY_PROTECTED_PATH_MISMATCH\n' \

tests/test_deployment_controller.py

@@ -795,6 +795,26 @@ def test_target_configuration_example_contains_only_strict_keys(self) -> None:
         self.assertNotIn("REPOSITORY_URL", entries)
         self.assertNotIn("PUBLIC_OBSERVATION_ALLOWED", entries)
 
+    def test_blocker_walkthrough_reuses_a_private_observation_directory(
+        self,
+    ) -> None:
+        walkthrough = (REPO_ROOT / "WALKTHROUGH.md").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertIn(
+            'BLOCKER_ID="<existing-observation-log-walkthrough-id>"',
+            walkthrough,
+        )
+        self.assertIn(
+            'chmod 0700 "$WALKTHROUGH_BASE" "$BLOCKER_OUTPUT"',
+            walkthrough,
+        )
+        self.assertNotIn(
+            'BLOCKER_ID="blocker-$(date -u +%Y%m%dT%H%M%SZ)"',
+            walkthrough,
+        )
+
     def test_ci_workflow_has_the_exact_stable_read_only_job_contract(self) -> None:
         workflow_path = REPO_ROOT / ".github/workflows/ci.yml"
         workflow_text = workflow_path.read_text(encoding="utf-8")
@@ -1225,9 +1245,10 @@ def test_check_only_warns_about_untracked_files_without_loading_target(self) ->
                     check=False,
                 )
 
-            self.assertEqual(completed.returncode, 2)
             result = json.loads(completed.stdout)
-            self.assertEqual(result["outcome"], "BLOCKED")
+            self.assertIn(completed.returncode, {0, 2})
+            self.assertIn(result["outcome"], {"PASS", "BLOCKED"})
+            self.assertEqual(result["exit_code"], completed.returncode)
             self.assertIn(
                 "WARNING",
                 [check["status"] for check in result["checks"]],