eden/docs/first-wave-verification.md

First-wave integration evidence

Scope: T01–T04 from parallel-worktrees.md. This is a private local integration record, not a public release or complete M0/M1 acceptance.

Integrated result

Four lane orchestrators delegated implementation/research and independent reviews in separate worktrees. Parent integration reviews identified and corrected additional issues before local integration. No work from T05 onward was started.

Lane	Integrated scope	Acceptance boundary
T01	Gitea workflow preparation, server rollout gates, release checks, isolated fixture/gate smoke and restore rehearsal documentation	Partial. Container CI is disabled. Browser/OAuth, actual Gitea execution, disposable Convex restore, instance credentials, migration rollback and post-restore invalidation remain unverified or unimplemented.
T02	Dataset/identity/job/report contracts, resource-scoped authorization helpers, opaque server-stored cursor contracts and shared reference ports	Accepted after parent final hardening review. Contracts and helper tests only; no persistence, workers, consent lifecycle or inventory query service implemented.
T03	Indexed immutable reference readers, station-source adapter/evidence, group IDs, schema/rollback validation and verified-station checker	Local fixture/code integration only. Production-source replay was explicitly deferred by the operator; deployed mounted-artifact verification remains open. Station coverage is explicitly incomplete.
T04	Bounded exact signed decimal ingestion, signed money/quantity formatting and non-negative market-price adapter	Implemented and reviewed; shared UI uses exact formatting. No wallet capability implemented.

Canonical reference reader/record types live in src/lib/domain/reference.ts; server types re-export them. Compiler/source/manifest types remain server-only. No duplicate cursor-based reference adapter was introduced.

Final combined checks

Verified code commit: 39b680bb3724ecf573fec8fdccc3ce3c345e6e87.

A separate batch/combined-verification worktree used its own dependencies/build output and a sanitized environment (env -i, explicit PATH/HOME/TMPDIR, APP_MODE=demo, APP_RELEASE_ID=fixture). No live .env.local, persistent backend or reference volume was copied into it. Frozen-lockfile installation completed in that worktree before the final run.

Command	Result
bun test	136 passed, 0 failed; 728 assertions across 22 files
bun run check	0 errors, 0 warnings
bun run build	Passed; known bun:sqlite external-resolution warning remains
bun run release:check	Passed in fixture/demo mode; not production deployment evidence
bun run test:fixture	Passed with temporary synthetic reference artifacts
bun run test:release-gates	Passed disabled anonymous/authenticated route checks and enabled anonymous rate-limit thresholds
git diff --check	Passed

Enabled-route smoke covers six anonymous sync 401 responses followed by 429, and thirty schema-invalid chat 400 responses followed by 429, without backend/provider trap calls. Disabled-route smoke demonstrates early denial before session/backend access. It is not browser automation or a real OAuth/provider test.

Integration findings corrected

• Signed decimal resource limits now apply after scaling to cents; strict whole-input parsing rejects terminal newlines.
• Convex missing/invalid capability configuration fails closed. Web baseline defaults remain for development compatibility. Backend policy must be changed/verified before web policy; changing only web configuration does not revoke existing subscriptions or grants.
• Docker CI remains disabled because runner registration, isolation, labels, protected refs and action availability could not be verified by authorized read-only inspection.
• Anonymous requests no longer consume the same rate-limit bucket twice; authenticated user-keyed limits remain.
• Restore marker commands default to verification and require explicit local/disposable write acknowledgement. Loopback is not itself proof that an instance is disposable. The unsafe arbitrary-target legacy smoke command is not an executable restore runbook step.
• Reference exact lookups preserve group IDs. Station records retain both sourceVerified and verified/system_listed evidence with nullable names.
• Rollback checks reader schema, profile, counts, paths and source-cache/provenance integrity. The verified-station checker uses an indexed deterministic query rather than assuming the first station is verified.
• Importer identity advanced to reference-compiler/3-6; a regression demonstrates rebuilding a prior 3-5 artifact missing the newly required station index. Existing artifacts require compatibility checks/rebuild; do not deploy these readers onto an unverified mounted artifact.
• Contract helpers use per-resource grants, approved scope preservation, canonical principal fields, duplicate rejection, cursor revalidation and explicit terminal-page semantics. Independent parent review accepted the final hardening patch without blockers. Typed helpers still require validated runtime envelopes, array/object bounds, coverage shapes and numeric/string fields in future adapters.

Approved decisions and remaining gates

Approved: deployment capability allowlist; Gitea CI; half-away-from-zero signed rounding; bounded decimal parsing (8192 raw characters, 4096 coefficient digits, exponent and cents shift within ±1000); opaque server-stored inventory cursors; one shared domain reference contract.

Still open:

1. T01 browser/OAuth fixtures and failure injection; actual isolated Convex restore including instance credentials; executable migration rollback and post-restore session/grant invalidation. A runbook is not evidence these mechanisms exist or were exercised.
2. Gitea runner/ref trust validation and an authorized workflow run; container CI remains disabled meanwhile.
3. T03 production-source replay and mounted-reader verification. The operator explicitly deferred the proposed isolated ~109 MiB archive replay; source inspection and synthetic ZIP tests do not prove production coverage.
4. Recovery details, stale-authority windows, retention/GC, quotas and public admission decisions for later tasks. Contracts do not approve these policies.
5. Singleton ingestion/persistence remains a T06/T07 requirement before inventory delivery; optional contracts do not backfill unknown legacy data.

No pushes, public-signup changes or production deployment were performed by this orchestration. Local commits and worktrees are retained. Later tasks must not treat partial T01/T03 acceptance as satisfied hard dependencies without an explicit readiness decision.