REVIEWED PUBLIC SOURCE / HISTORICAL SNAPSHOT
Shared workspaces: browser verification and deployment boundary
This is the exact UTF-8 source text at the recorded commit. The implementation repository is private. Older records may describe earlier access, hosting or release decisions; their original wording is preserved. Links and commands inside the record remain inert source text and do not require repository access to read this record.
- Original path
docs/PORTAL_RECEIPT.md- Commit
b234cff1697714776dcceeaf9897e29216e4fd4c- SHA-256
82fe149f2a5fa0288e7aa880e3220b30643ad33511534615575eb02ae2c8206b- Size
- 14,986 bytes
Download the exact original bytes · Read the source
# E3 customer portal: verification receipt Recorded 2026-10-04 UTC. **The bounded E3 browser workflow and backend regressions passed for the recorded source.** The first failed browser attempt remains preserved. Verification covers disposable services and synthetic records; it does not establish deployment, customer admission or commercial-use permission. ## Intended delivery and evidence boundary [PORTAL_SPEC.md](PORTAL_SPEC.md) defines explicit sign-in, organization choice, local file inspection, reviewed publication, attributed review and portable download. Source is under `backend/portal`; the public research website and local application remain separate. A published record is labelled as not independently replayed. Browser checks preserve structure and original-byte linkage; only the configured local Python checker performs canonical replay. The verification workflow builds configured and unconfigured static portals and uses real Chromium against disposable Supabase Auth, Postgres, PostgREST and local workerd on a GitHub-hosted Linux runner. Accounts, organization names, scenario wording and observations are synthetic. No customer project, Docker stack on the developer workstation, production credentials or production deployment is involved. Reviewer separation means a different synthetic Auth identity from the publisher; it does not mean an independent human or scientific replication conducted the test. ## Execution progression | Attempt and PR branch head | Actual outcome | |---|---| | [1 — 37197270888](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37197270888), `677c5be9eaff0b101863687baf29fc08d6cb455d` | **Failed portal.** Backend: 16 passing Node results (15 subtests plus parent), zero failures. Browser: five passing and eight failing Node results (12 subtests plus parent). Initial publication and invitation returned 201, but host-side response-body inspection failed; dependent assertions also failed. There is no complete browser pass. | | [2 — 37197599686](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37197599686), `856d0bf825adbb43877fbf5c1025b422ea6605f6` | **Passed.** Browser: 15 passing Node results (14 subtests plus parent), zero failures/skips. Backend: 16 passing results (15 subtests plus parent), zero failures/skips. Includes transparent response observation, real review-response recovery and deterministic identity-conflict checks. | | [3 — 37198253398](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37198253398), `1ceb8ba2825df0a5864e9349240ac7a39fc4a483` | **Passed.** Browser and backend each have 16 passing Node results (15 subtests plus parent), zero failures/skips. Includes real mid-session authority changes, explicit substituted 429 retry faults and signed-in browser storage checks. | Attempt 1 retains separate [failed portal](evidence/workspace-portal/attempt-1/portal-receipt.json) and [passed backend](evidence/workspace-portal/attempt-1/integration-receipt.json) receipts. Its tested Actions merge checkout is `4d322777173a1ebeee54067e13690827fbe23666`, based on `96077f24782d8ba2713e3cc5fc15a97387d17ab5`. A tested merge checkout is distinct from the PR branch head and does not establish that the PR was merged. The [artifact and source audit](evidence/workspace-portal/attempt-1/review.json) verified 88 applicable source/copy hashes against that frozen branch head; the generated validator hash is recorded separately without claiming an independent rebuild. The [image inventory](evidence/workspace-portal/attempt-1/stack-images.json) matches the receipt's image hash. The response-body symptom matches an open [Playwright/Chromium report](https://github.com/microsoft/playwright/issues/42742) for no-store streamed Fetch; that report is supporting diagnostic context, not proof of our application's correctness. The follow-up harness forwards normal Worker mutations to the real service, captures the actual response bytes, and fulfills the browser request with those unchanged bytes. It compares browser status, UI behavior and database receipts. It fabricates no successful API reply and keeps the application's no-store bounded stream reader unchanged. Auth and ordinary reads continue through browser networking. Separate fault-injection cases deliberately drop a real committed response or create a real conflicting request identity. ## Successful baseline source and artifact linkage Attempt 2 evaluated Actions merge checkout `8eafbd7b064e31ae2f188b2c5301260d077684f4` against base `96077f24782d8ba2713e3cc5fc15a97387d17ab5`; its PR head is `856d0bf825adbb43877fbf5c1025b422ea6605f6`. Its portal receipt was recorded at `2026-10-04T11:09:33.585Z`, with Chromium `153.0.8010.12`. The job completed in 3 minutes 5 seconds, within its 25-minute limit. - [Portal receipt](evidence/workspace-portal/attempt-2/portal-receipt.json): SHA-256 `c74a07d7ac535334318cafc8616bdc7778075895ec1684038aac29a9e0b589fe`. - [Backend receipt](evidence/workspace-portal/attempt-2/integration-receipt.json): SHA-256 `1dd17e19cbfffe39ba3f34df9377fed9b6030ef0c8076e2221c1f94e8b650f62`. - [Image inventory](evidence/workspace-portal/attempt-2/stack-images.json): SHA-256 `fb6a61a0387fd57ecfcd0de51a44d63ee096b5786401cb2463c59cd019225669`. - [Source/artifact audit](evidence/workspace-portal/attempt-2/review.json) verifies all 88 applicable source/staged-copy hashes against both the evaluated head and current source bytes at baseline review. The generated validator remains a recorded evaluated input, without claiming an independent rebuild. Both receipts have `production_deployed: false`. The portal output hash is `3d5f4a10ddf5996e1f018d61d9288901abf2417026bce87ee7fedee9ccc3827a`. The same run passed 73 workerd unit checks, four operator checks, 36 portal core checks, both TypeScript checks, both static builds, the generated migration/schema guards and the pgTAP command with 33 assertions. Unit upstream responses are substituted; they remain distinct from the real backend/browser tests. ## Review correction verification Attempt 3 evaluated PR head `1ceb8ba2825df0a5864e9349240ac7a39fc4a483` through Actions merge checkout `1bb0934fcac987eed9aec886ca8a8d49b00de9f1`, against the same recorded base. Chromium remained `153.0.8010.12`. Its portal receipt was recorded at `2026-10-04T11:20:56.426Z`; the whole job completed in 3 minutes 9 seconds. The backend group took 44.74 seconds and browser group 20.37 seconds. - [Latest portal receipt](evidence/workspace-portal/attempt-3/portal-receipt.json): SHA-256 `bec30d4b62bb946be13d7b78e11d385fa6d7f63a170098f4b7f7203896cdc64e`. - [Latest backend receipt](evidence/workspace-portal/attempt-3/integration-receipt.json): SHA-256 `1e242287adec05071c4d3eb41d0c8443a06f950a8f11c765c5443cec1823cee3`. - [Latest source/artifact audit](evidence/workspace-portal/attempt-3/review.json) verifies all 88 applicable source/copy hashes against the evaluated head and current bytes at that review, plus all receipt, image-inventory and screenshot hashes. The generated validator remains separately recorded. The image inventory matches the earlier pinned inventory hash. Portal test-output SHA-256 is `ac2c902ea952e084f7b3d6301c7ec35d39df3796ded907c59d14eb03ace05d9d`. All 73 workerd, four operator and 36 portal-core checks also passed, along with the type checks, schema/migration guards, builds, pgTAP and unchanged-checkout check. Both latest receipts still report `production_deployed: false`. The added rate-limit tests deliberately substitute a one-shot HTTP 429 response after a real write committed and its response was dropped. Both publication and review retain the same body/key through that fault and recover the original receipt through a real 200 retry. This proves client retry behavior for the injected condition; it is not evidence of production rate-limiter configuration. The role-change test uses actual membership downgrade and revocation while the tab is open: rejected operations disable stale authority until explicit refresh. Signed-in and signed-out checks find no localStorage/sessionStorage entries, IndexedDB databases or cookies in the isolated browser context. ## Local checks and their scope The [early local core/build receipt](evidence/workspace-portal/local-checks.receipt.json) records 36 passing portal core tests, TypeScript checking and an unconfigured static build, with its own source hashes. Network responses in those unit tests are substituted; the receipt predates later UI corrections and is not transferred to their source. The [dependency audit](evidence/workspace-portal/npm-audit.json) reported zero advisories for the recorded locked dependencies at execution time; that is not a general security certification. The [local regression review](evidence/workspace-portal/local-regressions.review.json) retains both Python attempts: the initial checkout-working-directory run failed six artifact-root guard cases (1,021 passed, five skipped); the designated external-working-directory run passed 1,027 tests with five skips and 27 passing subtests in 121.90 seconds. Math checks and 30 Node controller checks passed. The skips are unavailable scipy, ripser and three CUDA checks in the CPU environment. No GPU execution is inferred. Log hashes link these local outcomes; later CI receipts provide their own evaluated-source linkage. ## Verified browser acceptance matrix All 15 browser subtests passed in attempt 3. The following claims are **Verified** within that source, synthetic fixture set, Chromium version and disposable stack. | Claim | Observed check | |---|---| | Explicit exchange | Existing-account sign-in; destination/file inspection; confirmed publication; exact original hash and downloaded bytes; review by a distinct account and complete portable export checked by Python. | | Local preview boundaries | Preview/cancellation sends no publication; canceled/empty selection retains candidate; malformed and oversized replacement preserves prior bytes while invalidating consent; imported markup remains text. | | Scope and authority | Two organizations and account switching; role-specific controls; owner invitation/revocation; intended-account acceptance; explicit membership change/revocation; real mid-session downgrade and revocation disable stale controls until refresh. | | Retained meaning | Green/blue alternatives, mismatch, unsupported wording and local history preserved; Unicode/NUL exact-byte publication/download and canonical replay. | | Conflict and recovery | Another actor advances the head; candidate survives; changed parent requires fresh confirmation. Lost publication/review responses retain identical requests through substituted 429 faults and recover the same real receipt. Identity conflicts retain frozen requests instead of generating new keys. | | Session and presentation | Sign-out fences a late response; real Auth denial clears the tab; visible keyboard focus; 390-pixel reduced-motion layout; no unexpected origins or localStorage/sessionStorage/IndexedDB/cookie persistence, including while signed in. | The empty file-selection control exercises the browser event path, not the operating system's native picker Cancel button. Actual Auth ban/401 exercises session invalidation; timer expiry is a separate deterministic core test. Keyboard and narrow-screen checks are bounded controls, not a comprehensive accessibility audit or proof across all browser engines and assistive technology. The latest [overview](evidence/workspace-portal/attempt-3/overview.png), [review](evidence/workspace-portal/attempt-3/review.png) and [narrow](evidence/workspace-portal/attempt-3/narrow.png) screenshots were visually inspected. The branch cards, discrepancy, missing-observation distinction, review attribution and actions remain readable; no clipped actions or exposed credentials were observed. Screenshots show synthetic identities only. The earlier attempt-2 screenshots remain retained with their original hashes. ## Receipt integrity, privacy and resource budget CI receipts retain evaluated checkout, PR head and base identities; source hashes cover portal/runtime/test sources, package lock, migrations, contracts, fixture generators and workflow. Staged pgTAP copies and the generated validator are also evaluated inputs. Image records identify Supabase CLI 2.119.0 and resolved service images. The final portal receipt additionally requires Chromium version and hashes of all three screenshots before status can become `passed`. Vite preview serves the built pages used by browser tests. Their meta CSP and configured/unconfigured network behavior were exercised. Generated `_headers` contains deployment response-header policies, including frame-ancestor and no-store directives; no production static host applied those headers in this test. Deployment header enforcement therefore remains **Not verified**. Only the integration receipt, portal receipt, image inventory and three fixed synthetic screenshot paths are uploaded. Screenshots precede invitation-token screens. Passwords, JWTs and invitation tokens are masked before child output is printed. Raw logs, ephemeral state files, Auth keys, browser profiles, traces, videos and downloaded scenario/export files are excluded from upload. Receipts and screenshots are subject to the workflow's 14-day artifact retention; reviewed sanitized receipt copies are retained here separately. The job has a 25-minute limit, each browser/integration test group has a bounded 10-minute timeout, and subprocesses have a 15-minute ceiling. Readiness and HTTP requests have explicit timeouts. Failure, timeout or cancellation does not count as passed. Cleanup targets only the owned disposable stack; caches, generated files and services remain in runner temporary storage. Local verification uses the configured external artifact root on G:. ## Remaining delivery gates The recorded workflow and its synthetic screenshots passed their bounded checks. Later source changes need their own applicable verification; an earlier passed receipt does not transfer to a new head. This receipt does not classify a CodeRabbit summary, a pending review or paid account status as line-by-line review or approval. Advisory findings and their disposition are recorded separately. Subsequent [source review](PORTAL_REVIEW.md) identified additional stale-authority and rate-limit retry cases. Attempt 3 verifies the follow-up controls. Attempt 2 remains pinned to `856d0bf`; it does not acquire claims for those later changes. Account/project ownership, region, budget, staging/production controls, customer terms, retention/deletion, measured backup restore, support and release approval remain E4 gates. Database restart evidence is not a restore drill. No human merge, production deployment, customer admission, GPU training or independent scientific replication is claimed by this portal receipt.