# E3 customer portal: verification receipt

Recorded 2026-10-04 UTC. **The bounded E3 browser workflow and backend regressions
passed for the recorded source.** The first failed browser attempt remains
preserved. Verification covers disposable services and synthetic records; it does
not establish deployment, customer admission or commercial-use permission.

## Intended delivery and evidence boundary

[PORTAL_SPEC.md](PORTAL_SPEC.md) defines explicit sign-in, organization choice,
local file inspection, reviewed publication, attributed review and portable
download. Source is under `backend/portal`; the public research website and local
application remain separate. A published record is labelled as not independently
replayed. Browser checks preserve structure and original-byte linkage; only the
configured local Python checker performs canonical replay.

The verification workflow builds configured and unconfigured static portals and
uses real Chromium against disposable Supabase Auth, Postgres, PostgREST and local
workerd on a GitHub-hosted Linux runner. Accounts, organization names, scenario
wording and observations are synthetic. No customer project, Docker stack on the
developer workstation, production credentials or production deployment is involved.
Reviewer separation means a different synthetic Auth identity from the publisher;
it does not mean an independent human or scientific replication conducted the test.

## Execution progression

| Attempt and PR branch head | Actual outcome |
|---|---|
| [1 — 37197270888](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37197270888), `677c5be9eaff0b101863687baf29fc08d6cb455d` | **Failed portal.** Backend: 16 passing Node results (15 subtests plus parent), zero failures. Browser: five passing and eight failing Node results (12 subtests plus parent). Initial publication and invitation returned 201, but host-side response-body inspection failed; dependent assertions also failed. There is no complete browser pass. |
| [2 — 37197599686](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37197599686), `856d0bf825adbb43877fbf5c1025b422ea6605f6` | **Passed.** Browser: 15 passing Node results (14 subtests plus parent), zero failures/skips. Backend: 16 passing results (15 subtests plus parent), zero failures/skips. Includes transparent response observation, real review-response recovery and deterministic identity-conflict checks. |
| [3 — 37198253398](https://github.com/ZuluYokohama/renigma-operational-semantics/actions/runs/37198253398), `1ceb8ba2825df0a5864e9349240ac7a39fc4a483` | **Passed.** Browser and backend each have 16 passing Node results (15 subtests plus parent), zero failures/skips. Includes real mid-session authority changes, explicit substituted 429 retry faults and signed-in browser storage checks. |

Attempt 1 retains separate [failed portal](evidence/workspace-portal/attempt-1/portal-receipt.json)
and [passed backend](evidence/workspace-portal/attempt-1/integration-receipt.json)
receipts. Its tested Actions merge checkout is
`4d322777173a1ebeee54067e13690827fbe23666`, based on
`96077f24782d8ba2713e3cc5fc15a97387d17ab5`. A tested merge checkout is distinct
from the PR branch head and does not establish that the PR was merged.
The [artifact and source audit](evidence/workspace-portal/attempt-1/review.json)
verified 88 applicable source/copy hashes against that frozen branch head;
the generated validator hash is recorded separately without claiming an
independent rebuild. The [image inventory](evidence/workspace-portal/attempt-1/stack-images.json)
matches the receipt's image hash.

The response-body symptom matches an open
[Playwright/Chromium report](https://github.com/microsoft/playwright/issues/42742)
for no-store streamed Fetch; that report is supporting diagnostic context, not
proof of our application's correctness. The follow-up harness forwards normal
Worker mutations to the real service, captures the actual response bytes, and
fulfills the browser request with those unchanged bytes. It compares browser
status, UI behavior and database receipts. It fabricates no successful API reply
and keeps the application's no-store bounded stream reader unchanged. Auth and
ordinary reads continue through browser networking. Separate fault-injection
cases deliberately drop a real committed response or create a real conflicting
request identity.

## Successful baseline source and artifact linkage

Attempt 2 evaluated Actions merge checkout
`8eafbd7b064e31ae2f188b2c5301260d077684f4` against base
`96077f24782d8ba2713e3cc5fc15a97387d17ab5`; its PR head is
`856d0bf825adbb43877fbf5c1025b422ea6605f6`. Its portal receipt was recorded at
`2026-10-04T11:09:33.585Z`, with Chromium `153.0.8010.12`. The job completed in
3 minutes 5 seconds, within its 25-minute limit.

- [Portal receipt](evidence/workspace-portal/attempt-2/portal-receipt.json):
  SHA-256 `c74a07d7ac535334318cafc8616bdc7778075895ec1684038aac29a9e0b589fe`.
- [Backend receipt](evidence/workspace-portal/attempt-2/integration-receipt.json):
  SHA-256 `1dd17e19cbfffe39ba3f34df9377fed9b6030ef0c8076e2221c1f94e8b650f62`.
- [Image inventory](evidence/workspace-portal/attempt-2/stack-images.json):
  SHA-256 `fb6a61a0387fd57ecfcd0de51a44d63ee096b5786401cb2463c59cd019225669`.
- [Source/artifact audit](evidence/workspace-portal/attempt-2/review.json)
  verifies all 88 applicable source/staged-copy hashes against both the evaluated
  head and current source bytes at baseline review. The generated validator remains a
  recorded evaluated input, without claiming an independent rebuild.

Both receipts have `production_deployed: false`. The portal output hash is
`3d5f4a10ddf5996e1f018d61d9288901abf2417026bce87ee7fedee9ccc3827a`.
The same run passed 73 workerd unit checks, four operator checks, 36 portal core
checks, both TypeScript checks, both static builds, the generated migration/schema
guards and the pgTAP command with 33 assertions. Unit upstream responses are
substituted; they remain distinct from the real backend/browser tests.

## Review correction verification

Attempt 3 evaluated PR head `1ceb8ba2825df0a5864e9349240ac7a39fc4a483` through
Actions merge checkout `1bb0934fcac987eed9aec886ca8a8d49b00de9f1`, against the
same recorded base. Chromium remained `153.0.8010.12`. Its portal receipt was
recorded at `2026-10-04T11:20:56.426Z`; the whole job completed in 3 minutes
9 seconds. The backend group took 44.74 seconds and browser group 20.37 seconds.

- [Latest portal receipt](evidence/workspace-portal/attempt-3/portal-receipt.json):
  SHA-256 `bec30d4b62bb946be13d7b78e11d385fa6d7f63a170098f4b7f7203896cdc64e`.
- [Latest backend receipt](evidence/workspace-portal/attempt-3/integration-receipt.json):
  SHA-256 `1e242287adec05071c4d3eb41d0c8443a06f950a8f11c765c5443cec1823cee3`.
- [Latest source/artifact audit](evidence/workspace-portal/attempt-3/review.json)
  verifies all 88 applicable source/copy hashes against the evaluated head and
  current bytes at that review, plus all receipt, image-inventory and screenshot
  hashes. The generated validator remains separately recorded.

The image inventory matches the earlier pinned inventory hash. Portal test-output
SHA-256 is `ac2c902ea952e084f7b3d6301c7ec35d39df3796ded907c59d14eb03ace05d9d`.
All 73 workerd, four operator and 36 portal-core checks also passed, along with
the type checks, schema/migration guards, builds, pgTAP and unchanged-checkout
check. Both latest receipts still report `production_deployed: false`.

The added rate-limit tests deliberately substitute a one-shot HTTP 429 response
after a real write committed and its response was dropped. Both publication and
review retain the same body/key through that fault and recover the original
receipt through a real 200 retry. This proves client retry behavior for the
injected condition; it is not evidence of production rate-limiter configuration.
The role-change test uses actual membership downgrade and revocation while the
tab is open: rejected operations disable stale authority until explicit refresh.
Signed-in and signed-out checks find no localStorage/sessionStorage entries,
IndexedDB databases or cookies in the isolated browser context.

## Local checks and their scope

The [early local core/build receipt](evidence/workspace-portal/local-checks.receipt.json)
records 36 passing portal core tests, TypeScript checking and an unconfigured
static build, with its own source hashes. Network responses in those unit tests
are substituted; the receipt predates later UI corrections and is not transferred
to their source. The [dependency audit](evidence/workspace-portal/npm-audit.json)
reported zero advisories for the recorded locked dependencies at execution time;
that is not a general security certification.

The [local regression review](evidence/workspace-portal/local-regressions.review.json)
retains both Python attempts: the initial checkout-working-directory run failed
six artifact-root guard cases (1,021 passed, five skipped); the designated
external-working-directory run passed 1,027 tests with five skips and 27 passing
subtests in 121.90 seconds. Math checks and 30 Node controller checks passed.
The skips are unavailable scipy, ripser and three CUDA checks in the CPU
environment. No GPU execution is inferred. Log hashes link these local outcomes;
later CI receipts provide their own evaluated-source linkage.

## Verified browser acceptance matrix

All 15 browser subtests passed in attempt 3. The following claims are **Verified**
within that source, synthetic fixture set, Chromium version and disposable stack.

| Claim | Observed check |
|---|---|
| Explicit exchange | Existing-account sign-in; destination/file inspection; confirmed publication; exact original hash and downloaded bytes; review by a distinct account and complete portable export checked by Python. |
| Local preview boundaries | Preview/cancellation sends no publication; canceled/empty selection retains candidate; malformed and oversized replacement preserves prior bytes while invalidating consent; imported markup remains text. |
| Scope and authority | Two organizations and account switching; role-specific controls; owner invitation/revocation; intended-account acceptance; explicit membership change/revocation; real mid-session downgrade and revocation disable stale controls until refresh. |
| Retained meaning | Green/blue alternatives, mismatch, unsupported wording and local history preserved; Unicode/NUL exact-byte publication/download and canonical replay. |
| Conflict and recovery | Another actor advances the head; candidate survives; changed parent requires fresh confirmation. Lost publication/review responses retain identical requests through substituted 429 faults and recover the same real receipt. Identity conflicts retain frozen requests instead of generating new keys. |
| Session and presentation | Sign-out fences a late response; real Auth denial clears the tab; visible keyboard focus; 390-pixel reduced-motion layout; no unexpected origins or localStorage/sessionStorage/IndexedDB/cookie persistence, including while signed in. |

The empty file-selection control exercises the browser event path, not the
operating system's native picker Cancel button. Actual Auth ban/401 exercises
session invalidation; timer expiry is a separate deterministic core test.
Keyboard and narrow-screen checks are bounded controls, not a comprehensive
accessibility audit or proof across all browser engines and assistive technology.
The latest [overview](evidence/workspace-portal/attempt-3/overview.png),
[review](evidence/workspace-portal/attempt-3/review.png) and
[narrow](evidence/workspace-portal/attempt-3/narrow.png) screenshots were visually
inspected. The branch cards, discrepancy, missing-observation distinction,
review attribution and actions remain readable; no clipped actions or exposed
credentials were observed. Screenshots show synthetic identities only.
The earlier attempt-2 screenshots remain retained with their original hashes.

## Receipt integrity, privacy and resource budget

CI receipts retain evaluated checkout, PR head and base identities; source hashes
cover portal/runtime/test sources, package lock, migrations, contracts, fixture
generators and workflow. Staged pgTAP copies and the generated validator are also
evaluated inputs. Image records identify Supabase CLI 2.119.0 and resolved service
images. The final portal receipt additionally requires Chromium version and
hashes of all three screenshots before status can become `passed`.

Vite preview serves the built pages used by browser tests. Their meta CSP and
configured/unconfigured network behavior were exercised. Generated `_headers`
contains deployment response-header policies, including frame-ancestor and
no-store directives; no production static host applied those headers in this
test. Deployment header enforcement therefore remains **Not verified**.

Only the integration receipt, portal receipt, image inventory and three fixed
synthetic screenshot paths are uploaded. Screenshots precede invitation-token
screens. Passwords, JWTs and invitation tokens are masked before child output is
printed. Raw logs, ephemeral state files, Auth keys, browser profiles, traces,
videos and downloaded scenario/export files are excluded from upload. Receipts
and screenshots are subject to the workflow's 14-day artifact retention; reviewed
sanitized receipt copies are retained here separately.

The job has a 25-minute limit, each browser/integration test group has a bounded
10-minute timeout, and subprocesses have a 15-minute ceiling. Readiness and HTTP
requests have explicit timeouts. Failure, timeout or cancellation does not count
as passed. Cleanup targets only the owned disposable stack; caches, generated
files and services remain in runner temporary storage. Local verification uses
the configured external artifact root on G:.

## Remaining delivery gates

The recorded workflow and its synthetic screenshots passed their bounded checks.
Later source changes need their own applicable verification; an earlier passed
receipt does not transfer to a new head. This receipt does not classify a
CodeRabbit summary, a pending review or paid account status as line-by-line review
or approval. Advisory findings and their disposition are recorded separately.

Subsequent [source review](PORTAL_REVIEW.md) identified additional stale-authority
and rate-limit retry cases. Attempt 3 verifies the follow-up controls. Attempt 2
remains pinned to `856d0bf`; it does not acquire claims for those later changes.

Account/project ownership, region, budget, staging/production controls, customer
terms, retention/deletion, measured backup restore, support and release approval
remain E4 gates. Database restart evidence is not a restore drill. No human merge,
production deployment, customer admission, GPU training or independent scientific
replication is claimed by this portal receipt.