eden/docs/verification.md

Verification record

This record retains historical verification facts from earlier checkpoints. The current T08 checkpoint is a local/disposable prototype only: it makes no deployed, live-ESI, live-Convex-capacity, or production-readiness claim. Dependency versions are pinned in package.json/bun.lock. T09 query/projection and T13 wallet work are not completion claims in this checkpoint.

Initial offline/disposable-backend milestone

• bun run check: Svelte/TypeScript diagnostics pass. TypeScript 6.0.3 is intentional; the installed Svelte checker requires extra compatibility setup for TypeScript 7.
• bun test: offline tests exercise domain ownership/freshness, precise integer-cent accumulation, unknown/unpriced/BPC behavior, typed JEV routing and abstention, cryptographic envelopes, PKCE, SSO JWT checks, Convex ownership/session/snapshot rules, ESI cache/pagination/limiter behavior, and reference promotion/rollback/source failure handling. Final run: 66 passed, 0 failed, across 10 files.
• bun run build: production Bun server builds. svelte-adapter-bun may emit an unresolved bun:sqlite warning while leaving that Bun builtin external. This is not a missing npm dependency: the resulting server and container were executed successfully under Bun.
• scripts/smoke-web.ts: executed against both the built production server and the final Docker web container in explicit fixture mode. Assistant, Characters and Assets SSR routes succeeded. /value and /assets returned the same 208,600,000 integer cents (2,086,000.00 ISK), two characters and two excluded/unpriced stacks. Foreign origins and oversized request bodies were rejected.
• Browser-bundle inspection: no references to TOKEN_ENCRYPTION_KEY, CONVEX_BRIDGE_SECRET, CONVEX_SYNC_WORKER_SECRET, APP_AUTH_PRIVATE_KEY, refresh_token or TYPESAFE_API_KEY in build/client.
• docker compose config --quiet and docker build: passed. The containerized fixture worker also executed with --network none; no archives were fetched. No live EVE credentials, production volumes, or deployed endpoints were used for this T07 checkpoint. Optional disposable Convex smoke procedures remain documented below but are not evidence of a deployment.

Historical verification from prior checkpoints

The following evidence was recorded before T07 and is retained as historical context. It is not evidence that this new T07 worker prototype has been deployed or exercised against live ESI.

• The initial disposable Convex smoke deployed functions/schema/auth to an isolated backend and verified session lookup, asset publication, preservation after failed staging, cross-user isolation, safe status projection, correctly signed wrong-audience JWT rejection, and session revocation. It caught and fixed an incorrect attempt to read reserved aud as a Convex identity custom claim; audience enforcement belongs in the backend applicationID auth configuration.

• The disposable backend/web containers were stopped and test-only environment files and keys removed after that verification. Typecheck and all 66 offline tests were rerun successfully without those files.

• Historical tested backend image:

  ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a
  

Historical live development rollout — 2026-09-19 UTC

• The integrated gate recorded 97 tests passed, 0 failed, across 16 files; Svelte/TypeScript check passed with 0 errors/0 warnings, and the Docker web build passed.
• An operator-created Infisical project was connected through a read-only Universal Auth identity. Generated app encryption/signing/bridge keys were imported, compared against the staging file, and locally verified for encryption round-trip and signing/JWKS consistency; the temporary .env.keys was removed and secret values were not displayed.
• Persistent self-hosted Convex schema/functions/auth configuration was deployed. Its administrator credential was derived locally for explicit deployment commands, not stored in the web environment.
• Pangolin/UniFi routing was verified: https://dev-convex.evebot.app/version returned HTTP 200 and a real WSS upgrade with Origin: https://dev.evebot.app passed. Pangolin authentication remained allowed on the main app but was disabled on the Convex API resource by the operator.
• One real TypeSafe request through JevIntentRouter returned asset_valuation, model jev-1.13.0, confidence 1, in 915 ms; this proves connectivity/routing for that sample, not calibration.
• One real public ESI /markets/prices request passed using pinned compatibility 2026-08-18, returning fresh integer-cent estimates for Tritanium and Rifter. These remain global reference estimates, not Jita bids or executable prices.
• Real Reference Data/Hoboleaks/CCP archives totaling 114,291,615 compressed bytes (~109 MiB) were parsed. The corrected Docker worker compiled them with --network none, a 4 GiB memory limit and two CPUs, explicitly targeting /app/data/reference in the shared volume. Peak RSS was not measured. The full online download path has fixture-based receipt/validator tests; the real full rebuild used already downloaded archives rather than fetching another copy.
• The web container opened the deployed production artifact, resolved Tritanium/Rifter, matched manifest/table counts, and passed SQLite integrity/foreign-key checks: 53,001 types, 5,082 blueprints, 8,490 systems, 13,978 gates, 21 explicitly recorded unresolved blueprint references. Deployed version: b9afed7830756a5e617fec31a2a88c917f07b8f64d2bc719e2176fb628c1e98b.
• Live anonymous web smoke passed after deployment: SSR routes, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF rejection. A scan of 13 deployed client artifacts plus anonymous SSR output found no managed secret values; bootstrap tokens and the deployment-admin key were absent from the web environment.

A subsequent operator test exposed ERR_INVALID_RESPONSE when submitting Connect Character: the global no-referrer response policy made native browser form submissions send Origin: null, which SvelteKit rejected before OAuth initiation. An isolated temporary-profile Firefox test reproduced that behavior and confirmed that same-origin preserves the native form Origin. App pages now use same-origin while auth responses retain no-referrer; null/missing/foreign origins remain rejected. The rebuilt deployment passed header and anonymous endpoint checks. EVE discovery and a server-to-Convex read also passed; diagnostics wrote no OAuth/character records. The operator then reached EVE login but reported a generic callback failure. Redacted callback diagnostics identified scopes_invalid after token verification; the parser was updated to accept EVE's singleton scope-string representation as well as arrays, with signed-token login/refresh regressions and malformed-claim rejection. The revised image and anonymous smoke passed. The operator subsequently confirmed successful character authorization and asset synchronization, including refresh-grant verification and owner continuity before asset publication, and confirmed that live Assets and chat /value returned matching totals without sharing the private amount.

Historical audit regressions covered native-form/CSRF boundaries, shared artifact-directory precedence, live readers rejecting fixture profiles, offline no-network behavior, archive receipts/replay, ZIP/TAR checksums and limits, duplicate records/JSON keys, Hoboleaks metadata, and immutable cache provenance/rollback/reuse. See live setup and reference operations.

Historical T07 durable worker boundary regressions

• Full local bun test: 204 passed, 0 failed across 27 files.
• bun test tests/t07-sync.test.ts tests/t07-worker-runtime.test.ts tests/t07-route-boundaries.test.ts: deterministic queue/fencing/retry regressions plus runtime alias/startup, missing-job/AbortSignal polling, HTTP 429/503 structured outcomes, forbidden worker-environment, hostile-origin, session-ordering and bounded-body checks (31 passed in the focused run).
• bun build workers/sync.ts --target bun: produces the same alias-resolved worker artifact copied by the Docker build to build/sync-worker.js. A no-cache Docker image build completed, and docker run --rm --network none started the image's bundled worker through scripts/run-sync-worker.ts with inert Convex/EVE values and SYNC_WORKER_STARTUP_CHECK=1; no live keys or network calls were used. scripts/run-sync-worker.ts is separately tested to reject general bridge/admin/JWT/JEV credentials without echoing them.
• The operational startup is bun run secrets:run --worker -- docker compose --profile worker up -d --build sync-worker; --deployment/--configure is reserved for Convex administration and configuration, not worker startup. Plain docker compose up leaves the worker stopped.

Historical T07 prototype stage manifest (not the current T08 manifest)

The T07 stage includes the following files. T08 core files are intentionally excluded:

.env.example
Dockerfile
README.md
compose.yaml
docs/architecture.md
docs/design-records/t07-durable-sync.md
docs/live-setup.md
docs/parallel-worktrees.md
docs/restore-rehearsal.md
docs/roadmap.md
docs/security.md
docs/verification.md
package.json
scripts/configure-convex.ts
scripts/generate-keys.ts
scripts/lib/infisical.ts
scripts/release-check.ts
scripts/run-sync-worker.ts
scripts/secrets.ts
src/convex/functions.ts
src/convex/schema.ts
src/lib/client/sync-queue.ts
src/lib/domain/model.ts
src/lib/server/application.ts
src/lib/server/store.ts
src/routes/+page.svelte
src/routes/api/sync/+server.ts
src/routes/api/sync/cancel/+server.ts
src/routes/api/sync/status/+server.ts
src/routes/assets/+page.svelte
tests/infisical.test.ts
tests/t07-route-boundaries.test.ts
tests/t07-sync.test.ts
tests/t07-worker-runtime.test.ts
tests/workflow-config.test.ts
workers/sync.ts

Excluded T08 core files: src/lib/domain/inventory-location.ts, src/lib/server/inventory/, tests/fixtures/inventory/, tests/inventory-containment.test.ts, and tests/inventory-location.test.ts.

T08 local checkpoint

Status: implemented locally and undeployed. No live credentials, deployed endpoint, production volume, or production reference artifact was used.

• bun test: 254 passed, 0 failed across 29 files. This is the combined local suite and includes parallel-core T09/T13 tests; it is not a T08-only count.
• Focused T08/T07 regression run: bun test tests/t07-sync.test.ts tests/inventory-location.test.ts tests/t07-worker-runtime.test.ts — 54 passed, 0 failed.
• bunx tsc --noEmit, bun run check, and git diff --check passed.
• bun run build passed with the known non-fatal unresolved bun:sqlite external warning.
• The 50k containment/enrichment checks and 2,500-row persistence check are synthetic local prototype validations, not measured live Convex capacity. Optional enrichment is conservatively capped before staging; larger/oversized payloads preserve raw assets and publish failed optional enrichment.
• Real-query generation rollover, mixed helper batches, public/private fact forgery, forbidden structures, missing-parent/reference-unknown rows, and oversized worker envelopes have regression coverage.

Exact T08 checkpoint manifest

The following files comprise the T08 implementation/checkpoint, including additive shared integration files:

compose.yaml
docs/architecture.md
docs/design-records/t08-inventory-location.md
docs/esi-operations.md
docs/parallel-worktrees.md
docs/roadmap.md
docs/verification.md
scripts/run-sync-worker.ts
src/convex/functions.ts
src/convex/schema.ts
src/lib/domain/capabilities.ts
src/lib/domain/inventory-location.ts
src/lib/domain/model.ts
src/lib/server/esi/index.ts
src/lib/server/inventory/containment.ts
src/lib/server/inventory/location-service.ts
src/lib/server/inventory/private-structure-cache.ts
src/lib/server/release-gate.ts
src/lib/server/store.ts
src/routes/auth/eve/+server.ts
src/routes/characters/+page.server.ts
src/routes/characters/+page.svelte
tests/contracts.test.ts
tests/esi.test.ts
tests/fixtures/esi/transport-metadata.json
tests/fixtures/inventory/cycles-and-missing.json
tests/fixtures/inventory/nested-assets.json
tests/inventory-containment.test.ts
tests/inventory-location.test.ts
tests/t07-sync.test.ts
tests/t07-worker-runtime.test.ts
workers/sync.ts

Explicitly excluded from this T08 manifest: accepted T09 core projection/query files src/lib/server/inventory/projection.ts, src/lib/server/inventory/query-repository.ts, src/lib/server/inventory/query-service.ts, tests/inventory-query.test.ts, and tests/fixtures/inventory/query-assets.json; all T13 wallet files/tests/fixtures under src/lib/server/wallet/, tests/wallet-balance.test.ts, tests/fixtures/wallet/, and tests/fixtures/esi/wallet-balance-signed.json.

Optional disposable Convex smoke (not part of this checkpoint)

Use a disposable backend, set its CONVEX_SELF_HOSTED_URL and admin key, generate application keys and configure/deploy as in the README, then run:

SMOKE_ALLOW_WRITE=1 bun scripts/smoke-convex.ts

This writes synthetic users/characters and must not be casually pointed at a production deployment. It needs CONVEX_BRIDGE_SECRET, APP_AUTH_ISSUER and APP_AUTH_PRIVATE_KEY in the calling environment. A wrong-audience test is signed locally; no EVE identity is impersonated and no real EVE account is used.

Deferred deployment and live-provider evidence

No deployed endpoint, live ESI request, live EVE credential, or production rollout is claimed for this T07 checkpoint. Existing operational procedures remain reference material only; deployment, migration/rollback, live-provider, browser failure-injection and production-readiness evidence are deferred. See live setup and reference operations.

Not claimed as verified

• Live revocation/character-transfer scenarios, additional-character linking, live ESI behavior and deployed-artifact evidence are not claimed for this prototype.
• Broad TypeSafe inference quality or the proposed 0.80 confidence threshold's calibration on EVE requests.
• Compatibility with arbitrary future archive releases, station-data coverage, large-scale memory/performance benchmarks, or production-size market analytics.
• End-to-end browser automation/visual accessibility audit; the web smoke verifies the built server and endpoints, not all browser interactions.
• A comprehensive TLS/proxy security audit, backup/restore drills, rotation/recovery, remote revocation and full unlink/delete lifecycle, retention/GC, or multi-process refresh/job recovery. T05 adds local data-only-character cancellation only.

These remain explicit deployment/incremental-development gates, not silent success assumptions.