eden/docs/first-wave-verification.md

# First-wave integration evidence

Scope: T01–T04 from [parallel-worktrees.md](parallel-worktrees.md). This is a private local integration record, not a public release or complete M0/M1 acceptance.

## Integrated result

Four lane orchestrators delegated implementation/research and independent reviews in separate worktrees. Parent integration reviews identified and corrected additional issues before local integration. No work from T05 onward was started.

| Lane | Integrated scope | Acceptance boundary |
|---|---|---|
| T01 | Gitea workflow preparation, server rollout gates, release checks, isolated fixture/gate smoke and restore rehearsal documentation | Partial. Container CI is disabled. Browser/OAuth, actual Gitea execution, disposable Convex restore, instance credentials, migration rollback and post-restore invalidation remain unverified or unimplemented. |
| T02 | Dataset/identity/job/report contracts, resource-scoped authorization helpers, opaque server-stored cursor contracts and shared reference ports | Accepted after parent final hardening review. Contracts and helper tests only; no persistence, workers, consent lifecycle or inventory query service implemented. |
| T03 | Indexed immutable reference readers, station-source adapter/evidence, group IDs, schema/rollback validation and verified-station checker | Local fixture/code integration only. Production-source replay was explicitly deferred by the operator; deployed mounted-artifact verification remains open. Station coverage is explicitly incomplete. |
| T04 | Bounded exact signed decimal ingestion, signed money/quantity formatting and non-negative market-price adapter | Implemented and reviewed; shared UI uses exact formatting. No wallet capability implemented. |

Canonical reference reader/record types live in `src/lib/domain/reference.ts`; server types re-export them. Compiler/source/manifest types remain server-only. No duplicate cursor-based reference adapter was introduced.

## Final combined checks

Verified code commit: `39b680bb3724ecf573fec8fdccc3ce3c345e6e87`.

A separate `batch/combined-verification` worktree used its own dependencies/build output and a sanitized environment (`env -i`, explicit PATH/HOME/TMPDIR, `APP_MODE=demo`, `APP_RELEASE_ID=fixture`). No live `.env.local`, persistent backend or reference volume was copied into it. Frozen-lockfile installation completed in that worktree before the final run.

| Command | Result |
|---|---|
| `bun test` | 136 passed, 0 failed; 728 assertions across 22 files |
| `bun run check` | 0 errors, 0 warnings |
| `bun run build` | Passed; known `bun:sqlite` external-resolution warning remains |
| `bun run release:check` | Passed in fixture/demo mode; not production deployment evidence |
| `bun run test:fixture` | Passed with temporary synthetic reference artifacts |
| `bun run test:release-gates` | Passed disabled anonymous/authenticated route checks and enabled anonymous rate-limit thresholds |
| `git diff --check` | Passed |

Enabled-route smoke covers six anonymous sync `401` responses followed by `429`, and thirty schema-invalid chat `400` responses followed by `429`, without backend/provider trap calls. Disabled-route smoke demonstrates early denial before session/backend access. It is not browser automation or a real OAuth/provider test.

## Integration findings corrected

- Signed decimal resource limits now apply **after** scaling to cents; strict whole-input parsing rejects terminal newlines.
- Convex missing/invalid capability configuration fails closed. Web baseline defaults remain for development compatibility. Backend policy must be changed/verified before web policy; changing only web configuration does not revoke existing subscriptions or grants.
- Docker CI remains disabled because runner registration, isolation, labels, protected refs and action availability could not be verified by authorized read-only inspection.
- Anonymous requests no longer consume the same rate-limit bucket twice; authenticated user-keyed limits remain.
- Restore marker commands default to verification and require explicit local/disposable write acknowledgement. Loopback is not itself proof that an instance is disposable. The unsafe arbitrary-target legacy smoke command is not an executable restore runbook step.
- Reference exact lookups preserve group IDs. Station records retain both `sourceVerified` and `verified`/`system_listed` evidence with nullable names.
- Rollback checks reader schema, profile, counts, paths and source-cache/provenance integrity. The verified-station checker uses an indexed deterministic query rather than assuming the first station is verified.
- Importer identity advanced to `reference-compiler/3-6`; a regression demonstrates rebuilding a prior 3-5 artifact missing the newly required station index. Existing artifacts require compatibility checks/rebuild; do not deploy these readers onto an unverified mounted artifact.
- Contract helpers use per-resource grants, approved scope preservation, canonical principal fields, duplicate rejection, cursor revalidation and explicit terminal-page semantics. Independent parent review accepted the final hardening patch without blockers. Typed helpers still require validated runtime envelopes, array/object bounds, coverage shapes and numeric/string fields in future adapters.

## Approved decisions and remaining gates

Approved: deployment capability allowlist; Gitea CI; half-away-from-zero signed rounding; bounded decimal parsing (8192 raw characters, 4096 coefficient digits, exponent and cents shift within ±1000); opaque server-stored inventory cursors; one shared domain reference contract.

Still open:

1. T01 browser/OAuth fixtures and failure injection; actual isolated Convex restore including instance credentials; executable migration rollback and post-restore session/grant invalidation. A runbook is not evidence these mechanisms exist or were exercised.
2. Gitea runner/ref trust validation and an authorized workflow run; container CI remains disabled meanwhile.
3. T03 production-source replay and mounted-reader verification. The operator explicitly deferred the proposed isolated ~109 MiB archive replay; source inspection and synthetic ZIP tests do not prove production coverage.
4. Recovery details, stale-authority windows, retention/GC, quotas and public admission decisions for later tasks. Contracts do not approve these policies.
5. Singleton ingestion/persistence remains a T06/T07 requirement before inventory delivery; optional contracts do not backfill unknown legacy data.

No pushes, public-signup changes or production deployment were performed by this orchestration. Local commits and worktrees are retained. Later tasks must not treat partial T01/T03 acceptance as satisfied hard dependencies without an explicit readiness decision.