# Airlock IAM and Gateway version provenance
# Date: 2026-11-11

## Product-family evidence

The eight standard portal tenants publish the shared Airlock IAM UI, JSON:API route families, session/CSRF model and application-access selectors. Alternate listeners and gateway-only origins preserve the corresponding IAM or Gateway response contracts. Product-family evidence is retained in `recon/airlock-rest-route-catalogue-v3.txt`, `recon/airlock-angular-ui-route-graph-v1.txt`, `recon/airlock-portal-selector-matrix-v3.txt` and `recon/cloudfront-origin-allowlist-listeners-v12.txt`.

## Exact component evidence

The byte-identical public, OAuth2 and application-specific WADLs identify Jersey 3.1.10. That exact component version remains recorded separately and does not identify the enclosing Airlock IAM release. Evidence is `recon/airlock-public-wadl-contracts-v1.txt`, `recon/airlock-oauth-wadl-contracts-v1.txt` and `recon/airlock-application-wadl-route-expansion-v1.txt`.

The retained Loginapp OpenAPI route definitions are stable across upstream Airlock IAM 8.4.4 through 8.7.0. Compatibility across that range proves route provenance but does not select the deployed release; evidence is `recon/airlock-loginapp-openapi-route-expansion-v1.txt`.

## Reachable version surface

The IAM HTML shell, JavaScript runtime, REST metadata, cookies, Apache handoffs and Gateway error pages expose no Airlock IAM or Airlock Gateway release string. The eight tenants have byte-identical UI builds, but the build contains no defensible server release marker; build parity is `recon/airlock-eight-tenant-ui-build-parity-v1.txt`.

## Version conclusion

`Airlock IAM` and `Airlock Gateway` remain confirmed server-product families and deliberately unversioned. Jersey 3.1.10 remains an exact nested component. No Airlock release is inferred from the compatible OpenAPI range, shared client build, Apache headers, listener parity or neighboring deployments.