170 lines
15 KiB
Markdown
170 lines
15 KiB
Markdown
# Verification record
|
|
|
|
This record retains historical verification facts from earlier checkpoints. The current T08 checkpoint is a local/disposable prototype only: it makes no deployed, live-ESI, live-Convex-capacity, or production-readiness claim. Dependency versions are pinned in `package.json`/`bun.lock`. T09 query/projection and T13 wallet work are not completion claims in this checkpoint.
|
|
|
|
## Initial offline/disposable-backend milestone
|
|
|
|
- `bun run check`: Svelte/TypeScript diagnostics pass. TypeScript 6.0.3 is intentional; the installed Svelte checker requires extra compatibility setup for TypeScript 7.
|
|
- `bun test`: offline tests exercise domain ownership/freshness, precise integer-cent accumulation, unknown/unpriced/BPC behavior, typed JEV routing and abstention, cryptographic envelopes, PKCE, SSO JWT checks, Convex ownership/session/snapshot rules, ESI cache/pagination/limiter behavior, and reference promotion/rollback/source failure handling. Final run: **66 passed, 0 failed**, across 10 files.
|
|
- `bun run build`: production Bun server builds. `svelte-adapter-bun` may emit an unresolved `bun:sqlite` warning while leaving that Bun builtin external. This is not a missing npm dependency: the resulting server and container were executed successfully under Bun.
|
|
- `scripts/smoke-web.ts`: executed against both the built production server and the final Docker web container in explicit fixture mode. Assistant, Characters and Assets SSR routes succeeded. `/value` and `/assets` returned the same 208,600,000 integer cents (2,086,000.00 ISK), two characters and two excluded/unpriced stacks. Foreign origins and oversized request bodies were rejected.
|
|
- Browser-bundle inspection: no references to `TOKEN_ENCRYPTION_KEY`, `CONVEX_BRIDGE_SECRET`, `CONVEX_SYNC_WORKER_SECRET`, `APP_AUTH_PRIVATE_KEY`, `refresh_token` or `TYPESAFE_API_KEY` in `build/client`.
|
|
- `docker compose config --quiet` and `docker build`: passed. The containerized fixture worker also executed with `--network none`; no archives were fetched.
|
|
No live EVE credentials, production volumes, or deployed endpoints were used for this T07 checkpoint. Optional disposable Convex smoke procedures remain documented below but are not evidence of a deployment.
|
|
|
|
## Historical verification from prior checkpoints
|
|
|
|
The following evidence was recorded before T07 and is retained as historical context. It is not evidence that this new T07 worker prototype has been deployed or exercised against live ESI.
|
|
|
|
- The initial disposable Convex smoke deployed functions/schema/auth to an isolated backend and verified session lookup, asset publication, preservation after failed staging, cross-user isolation, safe status projection, correctly signed wrong-audience JWT rejection, and session revocation. It caught and fixed an incorrect attempt to read reserved `aud` as a Convex identity custom claim; audience enforcement belongs in the backend `applicationID` auth configuration.
|
|
- The disposable backend/web containers were stopped and test-only environment files and keys removed after that verification. Typecheck and all 66 offline tests were rerun successfully without those files.
|
|
- Historical tested backend image:
|
|
|
|
```text
|
|
ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a
|
|
```
|
|
|
|
### Historical live development rollout — 2026-09-19 UTC
|
|
|
|
- The integrated gate recorded **97 tests passed, 0 failed, across 16 files**; Svelte/TypeScript check passed with 0 errors/0 warnings, and the Docker web build passed.
|
|
- An operator-created Infisical project was connected through a read-only Universal Auth identity. Generated app encryption/signing/bridge keys were imported, compared against the staging file, and locally verified for encryption round-trip and signing/JWKS consistency; the temporary `.env.keys` was removed and secret values were not displayed.
|
|
- Persistent self-hosted Convex schema/functions/auth configuration was deployed. Its administrator credential was derived locally for explicit deployment commands, not stored in the web environment.
|
|
- Pangolin/UniFi routing was verified: `https://dev-convex.evebot.app/version` returned HTTP 200 and a real WSS upgrade with `Origin: https://dev.evebot.app` passed. Pangolin authentication remained allowed on the main app but was disabled on the Convex API resource by the operator.
|
|
- One real TypeSafe request through `JevIntentRouter` returned `asset_valuation`, model `jev-1.13.0`, confidence 1, in 915 ms; this proves connectivity/routing for that sample, not calibration.
|
|
- One real public ESI `/markets/prices` request passed using pinned compatibility `2026-08-18`, returning fresh integer-cent estimates for Tritanium and Rifter. These remain global reference estimates, not Jita bids or executable prices.
|
|
- Real Reference Data/Hoboleaks/CCP archives totaling **114,291,615 compressed bytes (~109 MiB)** were parsed. The corrected Docker worker compiled them with `--network none`, a 4 GiB memory limit and two CPUs, explicitly targeting `/app/data/reference` in the shared volume. Peak RSS was not measured. The full online download path has fixture-based receipt/validator tests; the real full rebuild used already downloaded archives rather than fetching another copy.
|
|
- The web container opened the deployed production artifact, resolved Tritanium/Rifter, matched manifest/table counts, and passed SQLite integrity/foreign-key checks: **53,001 types, 5,082 blueprints, 8,490 systems, 13,978 gates, 21 explicitly recorded unresolved blueprint references**. Deployed version: `b9afed7830756a5e617fec31a2a88c917f07b8f64d2bc719e2176fb628c1e98b`.
|
|
- Live anonymous web smoke passed after deployment: SSR routes, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF rejection. A scan of **13 deployed client artifacts plus anonymous SSR output** found no managed secret values; bootstrap tokens and the deployment-admin key were absent from the web environment.
|
|
|
|
A subsequent operator test exposed `ERR_INVALID_RESPONSE` when submitting Connect Character: the global `no-referrer` response policy made native browser form submissions send `Origin: null`, which SvelteKit rejected before OAuth initiation. An isolated temporary-profile Firefox test reproduced that behavior and confirmed that `same-origin` preserves the native form Origin. App pages now use `same-origin` while auth responses retain `no-referrer`; null/missing/foreign origins remain rejected. The rebuilt deployment passed header and anonymous endpoint checks. EVE discovery and a server-to-Convex read also passed; diagnostics wrote no OAuth/character records. The operator then reached EVE login but reported a generic callback failure. Redacted callback diagnostics identified `scopes_invalid` after token verification; the parser was updated to accept EVE's singleton scope-string representation as well as arrays, with signed-token login/refresh regressions and malformed-claim rejection. The revised image and anonymous smoke passed. The operator subsequently confirmed successful character authorization and asset synchronization, including refresh-grant verification and owner continuity before asset publication, and confirmed that live Assets and chat `/value` returned matching totals without sharing the private amount.
|
|
|
|
Historical audit regressions covered native-form/CSRF boundaries, shared artifact-directory precedence, live readers rejecting fixture profiles, offline no-network behavior, archive receipts/replay, ZIP/TAR checksums and limits, duplicate records/JSON keys, Hoboleaks metadata, and immutable cache provenance/rollback/reuse. See [live setup](live-setup.md) and [reference operations](reference-operations.md).
|
|
|
|
## Historical T07 durable worker boundary regressions
|
|
|
|
- Full local `bun test`: **204 passed, 0 failed** across 27 files.
|
|
- `bun test tests/t07-sync.test.ts tests/t07-worker-runtime.test.ts tests/t07-route-boundaries.test.ts`: deterministic queue/fencing/retry regressions plus runtime alias/startup, missing-job/AbortSignal polling, HTTP 429/503 structured outcomes, forbidden worker-environment, hostile-origin, session-ordering and bounded-body checks (31 passed in the focused run).
|
|
- `bun build workers/sync.ts --target bun`: produces the same alias-resolved worker artifact copied by the Docker build to `build/sync-worker.js`. A no-cache Docker image build completed, and `docker run --rm --network none` started the image's bundled worker through `scripts/run-sync-worker.ts` with inert Convex/EVE values and `SYNC_WORKER_STARTUP_CHECK=1`; no live keys or network calls were used. `scripts/run-sync-worker.ts` is separately tested to reject general bridge/admin/JWT/JEV credentials without echoing them.
|
|
- The operational startup is `bun run secrets:run --worker -- docker compose --profile worker up -d --build sync-worker`; `--deployment`/`--configure` is reserved for Convex administration and configuration, not worker startup. Plain `docker compose up` leaves the worker stopped.
|
|
|
|
### Historical T07 prototype stage manifest (not the current T08 manifest)
|
|
|
|
The T07 stage includes the following files. T08 core files are intentionally excluded:
|
|
|
|
```text
|
|
.env.example
|
|
Dockerfile
|
|
README.md
|
|
compose.yaml
|
|
docs/architecture.md
|
|
docs/design-records/t07-durable-sync.md
|
|
docs/live-setup.md
|
|
docs/parallel-worktrees.md
|
|
docs/restore-rehearsal.md
|
|
docs/roadmap.md
|
|
docs/security.md
|
|
docs/verification.md
|
|
package.json
|
|
scripts/configure-convex.ts
|
|
scripts/generate-keys.ts
|
|
scripts/lib/infisical.ts
|
|
scripts/release-check.ts
|
|
scripts/run-sync-worker.ts
|
|
scripts/secrets.ts
|
|
src/convex/functions.ts
|
|
src/convex/schema.ts
|
|
src/lib/client/sync-queue.ts
|
|
src/lib/domain/model.ts
|
|
src/lib/server/application.ts
|
|
src/lib/server/store.ts
|
|
src/routes/+page.svelte
|
|
src/routes/api/sync/+server.ts
|
|
src/routes/api/sync/cancel/+server.ts
|
|
src/routes/api/sync/status/+server.ts
|
|
src/routes/assets/+page.svelte
|
|
tests/infisical.test.ts
|
|
tests/t07-route-boundaries.test.ts
|
|
tests/t07-sync.test.ts
|
|
tests/t07-worker-runtime.test.ts
|
|
tests/workflow-config.test.ts
|
|
workers/sync.ts
|
|
```
|
|
|
|
Excluded T08 core files: `src/lib/domain/inventory-location.ts`, `src/lib/server/inventory/`, `tests/fixtures/inventory/`, `tests/inventory-containment.test.ts`, and `tests/inventory-location.test.ts`.
|
|
|
|
## T08 local checkpoint
|
|
|
|
**Status:** implemented locally and undeployed. No live credentials, deployed endpoint, production volume, or production reference artifact was used.
|
|
|
|
- `bun test`: **254 passed, 0 failed** across 29 files. This is the combined local suite and includes parallel-core T09/T13 tests; it is not a T08-only count.
|
|
- Focused T08/T07 regression run: `bun test tests/t07-sync.test.ts tests/inventory-location.test.ts tests/t07-worker-runtime.test.ts` — 54 passed, 0 failed.
|
|
- `bunx tsc --noEmit`, `bun run check`, and `git diff --check` passed.
|
|
- `bun run build` passed with the known non-fatal unresolved `bun:sqlite` external warning.
|
|
- The 50k containment/enrichment checks and 2,500-row persistence check are synthetic local prototype validations, not measured live Convex capacity. Optional enrichment is conservatively capped before staging; larger/oversized payloads preserve raw assets and publish failed optional enrichment.
|
|
- Real-query generation rollover, mixed helper batches, public/private fact forgery, forbidden structures, missing-parent/reference-unknown rows, and oversized worker envelopes have regression coverage.
|
|
|
|
### Exact T08 checkpoint manifest
|
|
|
|
The following files comprise the T08 implementation/checkpoint, including additive shared integration files:
|
|
|
|
```text
|
|
compose.yaml
|
|
docs/architecture.md
|
|
docs/design-records/t08-inventory-location.md
|
|
docs/esi-operations.md
|
|
docs/parallel-worktrees.md
|
|
docs/roadmap.md
|
|
docs/verification.md
|
|
scripts/run-sync-worker.ts
|
|
src/convex/functions.ts
|
|
src/convex/schema.ts
|
|
src/lib/domain/capabilities.ts
|
|
src/lib/domain/inventory-location.ts
|
|
src/lib/domain/model.ts
|
|
src/lib/server/esi/index.ts
|
|
src/lib/server/inventory/containment.ts
|
|
src/lib/server/inventory/location-service.ts
|
|
src/lib/server/inventory/private-structure-cache.ts
|
|
src/lib/server/release-gate.ts
|
|
src/lib/server/store.ts
|
|
src/routes/auth/eve/+server.ts
|
|
src/routes/characters/+page.server.ts
|
|
src/routes/characters/+page.svelte
|
|
tests/contracts.test.ts
|
|
tests/esi.test.ts
|
|
tests/fixtures/esi/transport-metadata.json
|
|
tests/fixtures/inventory/cycles-and-missing.json
|
|
tests/fixtures/inventory/nested-assets.json
|
|
tests/inventory-containment.test.ts
|
|
tests/inventory-location.test.ts
|
|
tests/t07-sync.test.ts
|
|
tests/t07-worker-runtime.test.ts
|
|
workers/sync.ts
|
|
```
|
|
|
|
Explicitly excluded from this T08 manifest: accepted T09 core projection/query files `src/lib/server/inventory/projection.ts`, `src/lib/server/inventory/query-repository.ts`, `src/lib/server/inventory/query-service.ts`, `tests/inventory-query.test.ts`, and `tests/fixtures/inventory/query-assets.json`; all T13 wallet files/tests/fixtures under `src/lib/server/wallet/`, `tests/wallet-balance.test.ts`, `tests/fixtures/wallet/`, and `tests/fixtures/esi/wallet-balance-signed.json`.
|
|
|
|
## Optional disposable Convex smoke (not part of this checkpoint)
|
|
|
|
Use a **disposable** backend, set its `CONVEX_SELF_HOSTED_URL` and admin key, generate application keys and configure/deploy as in the README, then run:
|
|
|
|
```sh
|
|
SMOKE_ALLOW_WRITE=1 bun scripts/smoke-convex.ts
|
|
```
|
|
|
|
This writes synthetic users/characters and must not be casually pointed at a production deployment. It needs `CONVEX_BRIDGE_SECRET`, `APP_AUTH_ISSUER` and `APP_AUTH_PRIVATE_KEY` in the calling environment. A wrong-audience test is signed locally; no EVE identity is impersonated and no real EVE account is used.
|
|
|
|
## Deferred deployment and live-provider evidence
|
|
|
|
No deployed endpoint, live ESI request, live EVE credential, or production rollout is claimed for this T07 checkpoint. Existing operational procedures remain reference material only; deployment, migration/rollback, live-provider, browser failure-injection and production-readiness evidence are deferred. See [live setup](live-setup.md) and [reference operations](reference-operations.md).
|
|
|
|
## Not claimed as verified
|
|
|
|
- Live revocation/character-transfer scenarios, additional-character linking, live ESI behavior and deployed-artifact evidence are not claimed for this prototype.
|
|
- Broad TypeSafe inference quality or the proposed 0.80 confidence threshold's calibration on EVE requests.
|
|
- Compatibility with arbitrary future archive releases, station-data coverage, large-scale memory/performance benchmarks, or production-size market analytics.
|
|
- End-to-end browser automation/visual accessibility audit; the web smoke verifies the built server and endpoints, not all browser interactions.
|
|
- A comprehensive TLS/proxy security audit, backup/restore drills, rotation/recovery, remote revocation and full unlink/delete lifecycle, retention/GC, or multi-process refresh/job recovery. T05 adds local data-only-character cancellation only.
|
|
|
|
These remain explicit deployment/incremental-development gates, not silent success assumptions.
|