eden/docs/verification.md

Verification record

Initial milestone verified locally on 2026-09-18; live development rollout checked on 2026-09-19 UTC with Bun 1.3.14. Dependency versions are pinned in package.json/bun.lock.

Initial offline/disposable-backend milestone

• bun run check: Svelte/TypeScript diagnostics pass. TypeScript 6.0.3 is intentional; the installed Svelte checker requires extra compatibility setup for TypeScript 7.
• bun test: offline tests exercise domain ownership/freshness, precise integer-cent accumulation, unknown/unpriced/BPC behavior, typed JEV routing and abstention, cryptographic envelopes, PKCE, SSO JWT checks, Convex ownership/session/snapshot rules, ESI cache/pagination/limiter behavior, and reference promotion/rollback/source failure handling. Final run: 66 passed, 0 failed, across 10 files.
• bun run build: production Bun server builds. svelte-adapter-bun may emit an unresolved bun:sqlite warning while leaving that Bun builtin external. This is not a missing npm dependency: the resulting server and container were executed successfully under Bun.
• scripts/smoke-web.ts: executed against both the built production server and the final Docker web container in explicit fixture mode. Assistant, Characters and Assets SSR routes succeeded. /value and /assets returned the same 208,600,000 integer cents (2,086,000.00 ISK), two characters and two excluded/unpriced stacks. Foreign origins and oversized request bodies were rejected.
• Browser-bundle inspection: no references to TOKEN_ENCRYPTION_KEY, CONVEX_BRIDGE_SECRET, APP_AUTH_PRIVATE_KEY, refresh_token or TYPESAFE_API_KEY in build/client.
• docker compose config --quiet and docker build: passed. The containerized fixture worker also executed with --network none; no archives were fetched.
• Real self-hosted Convex: deployed functions/schema/auth to an isolated disposable backend and executed scripts/smoke-convex.ts. Verified session lookup, asset publication, preservation after failed staging, cross-user isolation, safe status projection, correctly signed wrong-audience JWT rejection, and session revocation. This caught and fixed an incorrect attempt to read reserved aud as a Convex identity custom claim; audience enforcement belongs in the backend applicationID auth configuration.

The disposable backend/web containers were stopped and test-only environment files and keys removed after verification. Typecheck and all 66 offline tests were rerun successfully without those files.

Tested backend image:

ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a

Reproducing the real Convex smoke

Use a disposable backend, set its CONVEX_SELF_HOSTED_URL and admin key, generate application keys and configure/deploy as in the README, then run:

SMOKE_ALLOW_WRITE=1 bun scripts/smoke-convex.ts

This writes synthetic users/characters and must not be casually pointed at a production deployment. It needs CONVEX_BRIDGE_SECRET, APP_AUTH_ISSUER and APP_AUTH_PRIVATE_KEY in the calling environment. A wrong-audience test is signed locally; no EVE identity is impersonated and no real EVE account is used.

Live development rollout — 2026-09-19 UTC

• Latest integrated gate (including native-form, callback diagnostics, and singleton-scope compatibility): 97 tests passed, 0 failed, across 16 files; Svelte/TypeScript check passed with 0 errors/0 warnings. Docker web build passed.
• Connected the operator-created Infisical project through a read-only Universal Auth identity. Generated app encryption/signing/bridge keys were imported by the operator, compared against the staging file, and locally verified for encryption round-trip and signing/JWKS consistency. The temporary .env.keys was then removed. Secret values were not displayed.
• Persistent self-hosted Convex schema/functions/auth configuration deployed. Its administrator credential is derived locally for explicit deployment commands, not stored in the web environment.
• Pangolin/UniFi routing was verified: https://dev-convex.evebot.app/version returned HTTP 200 and a real WSS upgrade with Origin: https://dev.evebot.app passed. Pangolin authentication remains allowed on the main app but was disabled on the Convex API resource by the operator.
• One real TypeSafe request through JevIntentRouter returned asset_valuation, model jev-1.13.0, confidence 1, in 915 ms. This proves connectivity/routing for that sample, not calibration.
• One real public ESI /markets/prices request passed using pinned compatibility 2026-08-18, returning fresh integer-cent estimates for Tritanium and Rifter. These remain global reference estimates, not Jita bids or executable prices.
• Real Reference Data/Hoboleaks/CCP archives totaling 114,291,615 compressed bytes (~109 MiB) were parsed. The corrected Docker worker compiled them with --network none, a 4 GiB memory limit and two CPUs, explicitly targeting /app/data/reference in the shared volume. Peak RSS was not measured. The full online download path has fixture-based receipt/validator tests; the real full rebuild used the already downloaded archives rather than fetching another copy.
• The web container's own read-only repository successfully opened the deployed production artifact, resolved Tritanium/Rifter, matched manifest/table counts, and passed SQLite integrity/foreign-key checks: 53,001 types, 5,082 blueprints, 8,490 systems, 13,978 gates, 21 explicitly recorded unresolved blueprint references. Deployed version: b9afed7830756a5e617fec31a2a88c917f07b8f64d2bc719e2176fb628c1e98b.
• Live anonymous web smoke passed after deployment: SSR routes, no demo fallback, asset/chat authentication gates, session-token protection, and CSRF rejection. A scan of 13 deployed client artifacts plus anonymous SSR output found no managed secret values; bootstrap tokens and the deployment-admin key were absent from the web environment.

A subsequent operator test exposed ERR_INVALID_RESPONSE when submitting Connect Character. The global no-referrer response policy made native browser form submissions send Origin: null; SvelteKit rejected them before OAuth initiation. An isolated, temporary-profile Firefox test reproduced that behavior and confirmed that same-origin preserves the native form Origin. App pages now use same-origin while auth responses retain no-referrer; null/missing/foreign origins remain rejected. The rebuilt deployment passed header and anonymous endpoint checks. EVE discovery and a server-to-Convex read also passed; diagnostics wrote no OAuth/character records. The operator subsequently reached EVE login but reported a generic failure after callback. Redacted callback-stage diagnostics were added and deployed: only fixed failure categories and allowlisted protocol status/claim names are retained; provider descriptions, JWT payloads, credentials, codes, cookies, and user identifiers are excluded. The next redacted callback diagnostic identified scopes_invalid after token verification. The parser now accepts EVE's singleton scope-string representation as well as arrays, with signed-token login/refresh regressions and malformed-claim rejection. The revised image and anonymous smoke passed. After that deployment, the operator confirmed successful character authorization and asset synchronization. Explicit sync exercises refresh-grant verification and owner continuity before asset publication. The operator also confirmed that the live Assets page and chat /value return matching totals, without sharing the private amount. This completes the initial live sign-in/sync/reference-valuation verification for one character.

Audit regressions cover native-form header/CSRF boundaries, shared artifact-directory precedence, live readers rejecting fixture profiles, offline no-network behavior, archive receipts/replay, ZIP CRC/length/duplicate records, TAR checksums/end markers, duplicate JSON keys, Hoboleaks file metadata, and immutable cache provenance/rollback/reuse. See live setup and reference operations.

Not claimed as verified

• Live revocation/character-transfer scenarios and additional-character linking; successful sign-in/sync for one real character is now operator-confirmed.
• Broad TypeSafe inference quality or the proposed 0.80 confidence threshold's calibration on EVE requests.
• Compatibility with arbitrary future archive releases, station-data coverage, large-scale memory/performance benchmarks, or production-size market analytics.
• End-to-end browser automation/visual accessibility audit; the web smoke verifies the built server and endpoints, not all browser interactions.
• A comprehensive TLS/proxy security audit, backup/restore drills, rotation/recovery, unlink/revocation UX, retention/GC, or multi-process refresh/job recovery.

These remain explicit deployment/incremental-development gates, not silent success assumptions.