# E2 workspace backend: execution receipt Recorded 2026-10-04 UTC. **Backend integration and application CI passed for the recorded pull-request head.** This verifies the E2 backend slice, not a production deployment or customer admission. ## Source and delivery scope The change is [PR #3](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3), stacked on the still-separate E1 [PR #2](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/2). Evaluated implementation head is `8beecbdce065a8361efcff0cb73d854d092df2a1`. No merge, production deployment, paid resource provisioning or customer admission is established by this receipt. The implementation adds a Cloudflare Worker adapter and Supabase Auth/Postgres exchange backend: current verified identity and organization roles; controlled invitations; original-byte revisions; exact-parent publication; scoped idempotent retries; separate-publisher reviews; audit metadata; and complete version-2 exports. Local `renigma.scenario` v1 records remain unchanged. The cloud performs bounded structural validation; the Python checker separately performs canonical replay with its explicitly configured local engine. A cloud review is a recorded human decision, not proof of model correctness or observation truth. ## Local verification actually recorded The designated CPU interpreter was `G:/RenigmaLLM_Artifacts/environment/Scripts/python.exe`; caches, fixtures and test output remained under the external artifact root. These results describe the evaluated E2 local source and do not substitute for the later authenticated database/HTTP transport run. | Check | Recorded result | |---|---| | Complete `python -B -m pytest -q` | 1,024 passed, 5 skipped, 27 subtests passed; 124.72 seconds | | `python -B -m renigma math-check` | Passed | | Node application/scenario controllers | 30 passed, no failures | | Historical Worker runtime checks before singleton transport revision | 57 passed | | Worker runtime checks after singleton transport revision | 62 passed; TypeScript check passed; confirmed in successful backend CI | | Separate privileged operator command checks | 4 passed; confirmed in successful backend CI | | SQL static parsing | Validation migration: 18 SQL statements / 14 PL/pgSQL units; backend migration: 43 / 14 | | Compact export-size calculation | 39 independent Python comparisons, including all base64 padding residues and 64 × 256 KiB payloads | The five Python skips are unavailable scipy, ripser and three CUDA checks in the CPU environment. They are not GPU execution evidence. The local logs are `full-tests.log`, `pytest.xml`, `math.json` and `ui.log` in `G:/RenigmaLLM_Artifacts/workspace-backend`. Worker unit checks use actual workerd with mocked upstream Auth/PostgREST responses; operator unit checks also use substituted responses. They remain distinct from the real authenticated stack execution below. Historical local results are not attached to unevaluated heads. ## Disposable integration progression, including failures All runs use synthetic users/records and a disposable Supabase Auth/Postgres stack with workerd. No production credentials or provisioned customer project are used. A failed setup or subtest remains a failed run, even when other checks within it succeeded. | Attempt and pull-request head | Actual outcome and correction | |---|---| | [1 — 37174805014](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37174805014), `b81f0e57e13ee3b45a85ff9ee1ccd87bed37a7fd` | Failed during synthetic Auth user creation. The fixture used a 76-byte password; it was shortened below the provider's 72-byte boundary. No authenticated integration pass. | | [2 — 37174998555](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37174998555), `0458f9753ea1720504d42b473ad1f22f5036d9d2` | Failed during real password sign-in: HTTP 422. Disposable configuration disabled the email provider; enabled that provider while retaining disabled public signup. No authenticated integration pass. | | [3 — 37175181627](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37175181627), `ea729d33ef86bd94bb5b217fefe986d6a13dc6b4` | Auth/bootstrap progressed, but the first owner invitation returned 403. The PL/pgSQL variable `current_role` collided with SQL `CURRENT_ROLE`; renamed it `member_role`. No complete integration pass. | | [4 — 37176130313](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37176130313), `c418e02c97d527d158ae108561f8a1abcb45e3e2` | pgTAP's 31 checks passed. Thirteen integration subtests passed, but the NUL-note transport case failed with HTTP 400; the containing test also failed. Entire integration run failed. | | [5 — 37176417526](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37176417526), `8beecbdce065a8361efcff0cb73d854d092df2a1` | Passed: 15 Node integration results (14 subtests plus their parent), zero skips; 33 pgTAP checks; 62 Worker runtime checks and four operator checks. The RPC's single-row `SETOF json` transport and strict Worker unwrap preserve NUL. | The table identifies PR branch heads. Each retained JSON `source_head` identifies the Actions merge checkout evaluated against the base branch; these can differ without contradicting the PR head. Later receipts explicitly retain both fields. Failed-run logs remain in this artifact directory as `ci-first-failed.log` through `ci-fourth-failed.log`. They are historical evidence, not successful release receipts. Sanitized failure receipts are retained beside the successful receipt. The NUL failure was diagnosed against [PostgREST v16.4 source](https://github.com/PostgREST/postgrest/blob/v16.4/src/library/PostgREST/Query/SqlFragment.hs#L223-L227): scalar JSON responses use extraction that PostgreSQL applies to escaped NUL; set-returning scalar responses aggregate without that extraction. The correction preserves valid NUL, original bytes and the public Worker HTTP body. It does not delete or replace NUL text. ## Successful run identity and retained artifacts The successful receipt's status is `passed`, its scope is `disposable_supabase_auth_postgres_and_local_workerd`, and `production_deployed` is false. It was recorded at `2026-10-04T04:15:41.419Z`. The pull-request head is `8beecbdce065a8361efcff0cb73d854d092df2a1`; the tested Actions merge-checkout `source_head` is `574c0e4d92ff2b20c97f75651adf6fdb2d31dda8`, based on `98e1134cce66458f977c84aae67b7dac6a465521`. These identities are distinct; an Actions merge checkout is not evidence that the PR was merged by a person. Downloaded sanitized artifacts are under `G:/RenigmaLLM_Artifacts/workspace-backend/ci-fifth-receipt/disposable-workspace-receipt-37176417526-1/`: - [integration-receipt.json](evidence/workspace-backend/integration-receipt.json) records source fingerprints and test scope. Its SHA-256 is `ca3505fa84323cf9f051211f1efc5432a6765687b1118026f0d4b4d623ba48ec`. - [stack-images.json](evidence/workspace-backend/stack-images.json) records CLI and resolved image identifiers. Its SHA-256 is `fb6a61a0387fd57ecfcd0de51a44d63ee096b5786401cb2463c59cd019225669`, matching the integration receipt's `images_sha256`. - The receipt's test-output SHA-256 is `22d6f61453a44b1ce2437ee8d59fdc6aed9a4d49af0022b018dde6e22f070db7`. This links the evaluated output without publishing raw ephemeral credentials. | Evaluated source | SHA-256 recorded by CI | |---|---| | Validation migration 001 | `4fc8a487a8d67080a1b03f5606067290820c258443e84d324ec220c473d5730c` | | Backend migration 002 | `8e13c59972d7f138d7fa04f28fac1e3639f9a6458e029504a9a40eaf33916f82` | | Worker `backend/src/index.ts` | `82acccc271d45db7805d961d67265b3f6a3e08c4b42b29689a5ca9aefb1a943b` | | Python workspace codec | `841b7fcc50d1398f2f8087025aae4e601015a9b807cb6888e1f76c262524b6ef` | | Closed scenario schema | `a6e5a0f9beab383d0e3f646c644ccff652107546c6d1c4b47f130a2c627faee1` | | Backend package lock | `28084a0b6351843fdc16333052f6886122488ea3617e7e5a31dd7c6cb158a7e3` | Runtime inventory: Supabase CLI `2.119.0` with archive SHA-256 `bf1c3ae93be98533eb8a3105dbf4564bd0b2d9dc24690d8a920f980ef975c1b4`; PostgREST `v16.4`; GoTrue `v2.197.0`; Kong `2.8.1`; and Supabase Postgres `17.11.0.002`. Full immutable image IDs and repository digests remain in the hashed image inventory, rather than relying on mutable image tags alone. Sanitized copies are retained in `docs/evidence/workspace-backend/`: the integration and image receipts, four `failed-.json` records, `local-checks.receipt.json` and `setof-transport.receipt.json`. All 71 applicable recorded source hashes were verified against the final source bytes. No runtime changes followed that verification; later documentation updates do not acquire new runtime execution claims. ## Enforced bounded profile and retained semantics The tested contract retains 256 KiB raw/canonical-pretty scenario bounds, 16 local prior revisions, 20,000 code points per source and 40,000 with its retained prior sources, 64 cloud revisions, 256 reviews, 2,000-code-point review notes, 1 MiB compact export metadata and 24 MiB complete compact exports. Metadata and total size are combined constraints. The exact export-size optimization counts compact metadata plus 17 field bytes and `4 * ceil(payload_bytes / 3)` base64 bytes for each revision; it changes no bound or stored payload. Tenant-scoped transactions preserve immutable history, conflicts, receipts and all review decisions. Current membership is checked before returning retries. Reviews require a different publisher and reviewer. Invitations are bound to already verified identities, hashed, single-use, revocable and valid for 24 hours; no invitation email is sent. Operator-only organization bootstrap remains separate from customer operations. Ordinary clients have RLS-constrained SELECT and no direct INSERT/UPDATE/DELETE grants. No autosync, automatic local-server connection, model-path upload, cloud grammar replay, customer-data training or change to the local release archive policy is introduced. Hashes establish byte linkage; they do not authenticate an unknown export sender, prove real-world reports or prove that a remote snapshot omitted nothing. Database administrators remain outside the ordinary append-only-client guarantee. ## Review and remaining gates A manual CodeRabbit full review was requested for earlier E2 source; subsequent fixes changed the head. No actual CodeRabbit review receipt for the current head is included at this receipt baseline. Do not count a request, configured paid account or unavailable review as a completed source review. Preserve any later findings and their disposition separately from deterministic test results. Human review and merge remain explicit; no automatic merge is claimed. Backend attempt 5 is verified above. [Application run 37176417532](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37176417532) also passed its Windows, Linux and website checks for the same pull-request head. These hosted checks are separate from the earlier local results and do not imply a merge or deployment. Stack restart is not a backup restore drill. E3 still requires the customer preview/cancel/publish/conflict/review/download experience and keyboard/narrow-screen checks. E4 requires verified account and project ownership, selected region/data handling, budget/quotas, staging and production boundaries, credential rotation/recovery, measured restore and rollback, support ownership, retention/deletion and customer licensing terms. SSO/provisioning and compliance claims require separate evidence. The existing Noncommercial license, public repository/site and local-only release ZIP policy remain unchanged. ## Subsequent advisory review corrections [Copilot review 5404327275](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3#pullrequestreview-5404327275) examined documentation/receipt head `045314437b7b3f7b1fd67b28d256ef5d31182de7`. Its three findings were accepted: - [Malformed backend payload errors](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3#discussion_r4176138748): invalid base64, unexpected fields and oversized payload replies now produce sanitized 503 unavailable, rather than caller validation errors. Typecheck and 65 workerd tests pass; the [new source-hashed receipt](evidence/workspace-backend/upstream-payload-error.receipt.json) is separate from the earlier 62-test baseline. - [Receipt encoding](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3#discussion_r4176138765): corrected a Windows text-decoding error and verified the UTF-8 characters. - [Stale E2 status](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3#discussion_r4176138781): reconciled the E1 contract supplement with the actual passing E2 integration. [CodeRabbit review 5404333442](https://github.com/ZuluYokohama/renigma-operational-semantics/pull/3#pullrequestreview-5404333442) completed on the same `0453144` head using the Advanced plan's included allowance. Its two actionable comments (4176144956 and 4176144963) confirm the encoding and stale-status fixes above. The receipt table now explicitly distinguishes PR heads from tested Actions merge checkouts, addressing the source-linkage observation. The additional issuer-authority comment is accepted: invitation acceptance requires an active verified owner as issuer; demotion/removal revokes that issuer's pending invitations. A banned/deleted issuer cannot grant access. The updated contract and real integration tests make that policy explicit. Scanner suggestions were also inspected: `RegExp.exec` is not a shell command; the JSON Schema HTTP identifier performs no network request; these Python file writers are not Flask handlers and correctly use `json.dumps`. The spelling `workerd` is the runtime's name. None establishes an executable injection or cleartext request. The prose line beginning with a PR number is rewrapped. CodeRabbit excluded the package lock through its filter and reported timeout while gathering four check contexts. Its review does not certify those checks; the actual Actions receipts do. No second included review or paid overage was requested. Review findings are fixed and tested by the implementation team, not represented as a new bot approval of later commits. PR checks identify execution of subsequent corrections; pinned baseline receipts remain unchanged.