# ELA merge-readiness review Verdict: NO-GO for merging fix/e2e-remediation-20260906 as reviewed. Findings after refutation: 0 blocker, 4 major, 2 minor, 0 nit. Scope: main f15bfab5bac096ab6f806e3de3cf546312039748 ... HEAD fbd2ece457bc5a211156be268a6eaf9e52815b3b. Review source: committed diff only; uncommitted tracked changes excluded. Evidence: current local tests, source/caller inspection, PostgreSQL17 reproductions and four independent per-finding CLI refutations. Limits: no production/staging/device/provider access, no commits, no tracked edits, no remote publication. ## Verdict and required conditions Fix the four major findings before merge: bind verification to the current accepted engagement, repair stale member-end reconciliation with a new forward migration, make both SQL builders safe for delimiter-bearing data, and migrate required browser test helpers to v2. Re-run the corresponding regressions and the required gates on the final reviewed commit. Current unit passes do not override red PostgreSQL/browser/fuzz results. Resolve or explicitly disposition remaining test/harness failures with reproducible evidence; do not weaken assertions or remove production/DSAR guards to obtain a pass. The two minor findings are missing OpenAPI auth metadata and contradictory DSAR test expectations. Production release is independently NO-GO: the branch itself leaves ordinary emergency activation gated, DSAR fulfilment uncomposed, migration/grant/worker adoption unrehearsed on the actual deployment, and provider/device/legal evidence open. A future code merge must preserve those holds. The migration section gives the coordinated deploy order and rollback limits; this review authorizes no deployment. ## Findings and refutation ### 1. Replacement engagements inherit an earlier firm’s verified status — major `apps/api/src/member-verification-work.ts:17`; lens: dispatch. In relational mode, firm A can be verified while the case remains open, then be replaced by firm B. Reassignment and acceptance preserve the case-wide verification_status. The new member reader presents A’s outcome as B’s current verification, and the mobile hero suppresses the pending verification action. The new advertised admin action also accepts the stale value; the underlying unrestricted closure mutation predates this branch. Evidence: New reader: 'verification_status',coalesce(c.verification_status,'pending'),'work',( ...; only work is scoped by c.runtime_data->>'firmId'=f.api_firm_id and c.assigned_at=vt.assigned_at. Mobile activeCaseHero.ts:138: if (read.data.verification_status === "verified") ... headline: "Lawyer contact is verified.". server.ts:28479 spreads storedCase and clears only firmReportedResolvedAt; the relational writer does not reset verification_status. PostgreSQL17 reproduction returned {state:"assigned",verification_status:"verified",work:null} after B accepted; subsequent mark_verified closed without B verification. Fix: Derive current verification from the current accepted firm and acceptance timestamp, or reset/recompute it atomically on engagement change. Preserve A’s evidence as historical. Require current-engagement verification for closure and add a regression for verified A -> reassigned B -> B pending. Refutation: KEEP MAJOR. Independent codex exec -s danger-full-access -c model_reasoning_effort=high inspected callers, task cancellation, SQL status triggers and closure guards. New stale submissions are prevented, but existing case-wide status is not invalidated. Narrowed: closure mutation gap itself is pre-existing. See refutations/refute-verification-carry.log (exit 0); reproduced in logs/reassignment-probe-prepared.log. ### 2. A previous member-end timestamp prevents the replacement firm’s resolution report — major `db/verification-durable-002/001_canonical_verification_tasks.sql:77`; lens: dispatch, data. After the member ends A’s engagement, ops can reassign B and B can accept. Force assignment retains memberEndRequestedAt from A. When B reports resolution, the new trigger selects A’s earlier timestamp as the current task due time, violating due_at >= assigned_at and rolling back the report. Repeated firm reports cannot recover; a fresh authorized member-end request can replace the stale time. Evidence: select min(value::timestamptz) into entry_at from (values (current_case.runtime_data->>'firmReportedResolvedAt'), (current_case.runtime_data->>'memberEndRequestedAt')) entries(value) where value is not null; task_due_at:=entry_at;. Lines29–31 require (due_reason='case_entry' and due_at>=assigned_at). server.ts:30539 records the member end; :28479 keeps it on replacement. PostgreSQL17 reproduced ERROR: new row for relation "verification_tasks" violates check constraint "verification_tasks_due_reason_time_check" after B’s report. Fix: Add a new forward migration that derives verification-entry timestamps only from the current accepted engagement, and clear current engagement end fields during reassignment while retaining original audit evidence. Test member-end A -> B accepts -> B reports resolution. Do not edit this historically applied SQL file. Refutation: KEEP MAJOR with narrowed recovery statement. Independent Codex checked state guards, first acceptance, serialization, task cancellation, ON CONFLICT behavior and later migrations. Retaining the timestamp predates the diff; the atomic CHECK failure is new. See refutations/refute-member-end-reassignment.log (exit 0); reproduced in logs/reassignment-probe-prepared.log. ### 3. Valid dollar-delimiter text can block relational emergency commands — major `apps/api/src/case-relational-command-sql.ts:114`; lens: dispatch, data, security. The new case and pre-arm builders interpolate member-derived JSON inside a fixed DO $identity$ body. Accepted idempotency keys or pre-arm addresses containing $identity$ terminate that body and abort persistence. Failed new writes roll back, but a valid retained legacy row can survive checked adoption and then break commands for unrelated cases because each command serializes all cases. Ordinary production dispatch remains gated; enabled relational development/reviewer paths are affected. Evidence: const rows = `jsonb_to_recordset(${jsonSql(split.cases)}) as incoming(...)`; then `do $identity$ begin ... select 1 from cases existing left join ${rows} ... end $identity$;`. textSql only doubles apostrophes. prearm-command-store.ts:166,189 repeats this with input.rows. The schemas accept request_$identity$_123 and address_input='Near $identity$ square'. Actual generated pre-arm SQL failed in PostgreSQL17 with syntax error at or near "square" (logs/sql-delimiter-probe.log). Arbitrary SQL execution is not established. Fix: Stage request data outside procedural dollar-quoted bodies and reference staged rows inside them, or use consistently delimiter-safe encoding. Cover new input and adopted legacy case/arm payloads, including unrelated subsequent commands. Refutation: KEEP MAJOR, narrowed to configured relational paths and persistent legacy-data availability risk. Independent Codex verified that client_arm_id rejects dollar signs but dispatch idempotency_key and pre-arm address permit them; adoption preserves such values outside its own DO body. Fresh failures do not persist poison. See refutations/refute-sql-delimiter.log (exit 0). ### 4. Required browser journeys still read v1 after the v2 case-read cutover — major `apps/api/src/server.ts:53475`; lens: quality, evidence. The branch correctly rejects v1 case facts that cannot represent missing location/deadline data, but leaves required browser test helpers on v1. Three brief/access journeys independently seed no-location cases and then fail before UI assertions; two close-case journeys fail when the shared queue contains such a case. CI unconditionally runs this suite. Evidence: New guard: if (v1 && (v1Location === null || repositoryDetail.live_case.verification.due_at === null)) { sendCaseReadVersionRequired(response); return; }. apps/admin/tests/visual/portal-routes.spec.ts:1769 still calls requestApiJson(`/v1/admin/cases/${encodeURIComponent(caseId)}`); :489 reads /v1/admin/cases/live. Fresh Linux run recorded five case_read_version_required failures among 19 failures/9 passes; the three brief/access seed calls are at1845,1897,1941. The live portal already routes its case reads to v2. Fix: Migrate browser helper reads and response parsing to v2, keeping the existing behavioral assertions and truthful no-location fixtures. Update canonical location setup only where the journey requires a point. Do not remove the compatibility guard or blindly replace screenshot baselines. Refutation: KEEP MAJOR. Independent Codex confirmed new guard versus unchanged callers, valid no-signal seeds, direct API calls bypassing the portal’s v2 mapper, and unconditional CI inclusion. Qualified close-case failures as shared-state dependent; separated screenshot/font failures. See refutations/refute-visual-v2.log (exit 0) and logs/admin-visual-freeports.log. ### 5. The new contact-reveal operation omits its bearer security declaration — minor `openapi/v1.yaml:11`; lens: security, quality. The new contact-reveal operation requires a bearer session in prose and server enforcement, but declares no OpenAPI security requirement or bearer scheme. Generated auth-aware clients cannot infer the operation’s credential requirement. This is acknowledged release debt, not an authentication bypass. Evidence: operationId: revealGeneralHelpContact; description: Requires an admin bearer session with help_thread_reply permission and MFA verified within ten minutes. No operation/root security or bearer security scheme exists in v1; openapi/baseline/v1.yaml mirrors the omission. server.ts:51664 enforces the session, permission and fresh MFA before audited disclosure. Fix: Define the bearer scheme and reference it on this operation, update the contract baseline deliberately, and verify the generated operation declares authenticated access. Refutation: Minor; mandatory per-finding CLI refutation applies only to blockers/majors. Independent evidence/contract review identified the omission; primary confirmed the complete operation and server enforcement. See refutations/evidence-review.log. ### 6. New DSAR truth tests still require fulfilment that the safety contract forbids — minor `apps/api/src/dsar-fulfilment-truth.integration.test.ts:89`; lens: quality, evidence. Both newly committed export/delete truth subtests expect HTTP200 and a fulfilled request from the uncomposed durable DSAR repository. HEAD deliberately returns503 before any erasure, and the neighboring safety integration test correctly requires that behavior. The opt-in suite is therefore internally contradictory and reliably red. Evidence: assert.equal(response.status, 200); then wait until request status === "fulfilled". The repository is createPostgresPersistentDsarRepository({ execSql }); server.ts:49520 checks fulfilmentMode === "unavailable" and returns dsar_fulfilment_unavailable. Fresh serial PostgreSQL run fails both "export cannot return fixture counts for an empty member" and "delete cannot return fixture counts for an empty member" with503 !==200. Fix: Reconcile the obsolete component-truth tests with the unavailable fulfilment contract. Keep and strengthen assertions that the request/deadline stay unchanged and no erasure starts; move actual-count assertions to a real composed fulfilment service when implemented. Preserve the production safety guard. Refutation: Minor: mandatory independent CLI refutation does not apply. Primary verified the test setup, current guard, adjacent dsar-fulfilment-safety integration tests, new-file commit and repeated PostgreSQL failures. This is a test-contract defect, not a request to enable DSAR fulfilment. Each major was reviewed in a separate fresh `codex exec -s danger-full-access -c model_reasoning_effort=high -C /tmp/ela-review-20260912-2245 -` invocation, with its own self-contained strict read-only refutation prompt. All four exited0 and returned KEEP with the qualifications recorded above. No blocker/major was retained without a completed independent review. Broader dispatch, data/security and evidence/quality/scope CLI reviews are retained separately; they are not substituted for these per-finding refutations. ## Scout ## Commit groups ### Mobile entry, recovery and accessibility - `9d9ab168` Fix renewal guidance after legacy membership expiry - `8faf2161` Simplify trusted contact phone entry - `667654e7` Clarify sign-in recovery and require a disclosure choice - `1511e0a6` Verify microphone permission recovery on iOS - `827bb181` Accept local numbers with a disclosed country default - `98537e3e` Show recovery when support channels cannot open - `08e456ac` Improve instructional contrast and live text sizing - `41d3f3ad` Qualify Essential response copy with active membership ### Case, portal and operator facts - `8e150851` Verify portal actions and truthful case facts - `a3c7bd14` Distinguish recorded Help replies from delivery - `e7708eca` Verify atomic firm assignment and displaced access - `bd007278` Verify distinct review recovery states - `efbd5fed` Put current console work before guidance - `2d7caaa1` Keep closed case timelines truthful - `32e4b550` Record closed case evidence and approved decisions - `acf30140` Add audited Help contact reveal - `cfc1df18` Show recorded offer and delivery states - `fbd2ece4` Keep the safety flag out of the admin Help panel ### Money, coverage and entitlement authority - `1cc20465` Use recorded issued-policy terms - `118a84ed` Route App Store refund requests to Apple - `98ccfa38` Read current member entitlements across API processes - `9eea1e89` Check current entitlement before refund requests - `c80a91bb` Confirm refund writes before reporting completion - `09817f13` Bind refund approval to the reviewed payment - `189fd646` Separate active plan status from payment evidence ### Privacy and durable composition - `28e2f61c` Restore privacy request tracking in the current console - `6424513d` Validate current case composition and record release blockers - `7bee00a3` Add scoped DSAR proof and collection checks - `a200ebd6` Add durable dispatch, verification, help and config migrations (unapplied) - `12d0c48c` Commit the remediation run's remaining working-tree code ### Harness, evidence history and documentation - `b2de52ef` Seed canonical location in admin smoke - `045aeb6d` Bound API test concurrency and certificate setup time - `f4862cce` Move remediation evidence out of branch history - `faab1ce0` Record release limits and final history proof - `e7579276` Update runbooks, spec, PRD and backlog for the remediation run ## Recorded release holds Register status: 15 blocked, 35 verified, 45 in progress, 110 not started, 1 implemented but unverified. These are the branch’s own classifications, not this review’s finding severities. - **F1 — Critical — ordinary production emergency entry points deliberately reject requests**: {"requirement": "Ordinary production activation and supported composition", "next_action": "Keep the guard. Prepare and independently verify a release candidate with complete canonical dependencies. After all provider, environment and device acceptance evidence exists, obtain separate launch approval before any deliberate guard revision."}; {"requirement": "Provider and worker acceptance", "next_action": "Provide current controlled-provider acceptance records and the missing sender/environment attestations. Supply worker cron, systemd, health, crash/restart, negative-health and queue-completion evidence listed by the two failed validators. No production access is authorised in this run."}; {"requirement": "Database and scheduler environment", "next_action": "Run the migration, role-permission, restart and scheduler drills on an isolated PostgreSQL 17 environment with reviewed runtime and scheduler grants. Local PostgreSQL 16.11 tests do not establish those results."}; {"requirement": "Native and device acceptance", "next_action": "Complete M1 on available simulators and controlled APNs/FCM devices. Verify background, terminated-app, reconnect and watch behavior. Record platform gaps explicitly."} - **M1 — Active case after force assignment, before firm acceptance; [screenshot](../2026-09-05-end-to-end-review/screenshots/mobile-live-assignment-contradiction.png)**: Local runtime uses synthetic receipt reconciliation with outbound disabled. It does not prove provider delivery or authentication.; Android, physical-device background/location/push behavior and phone-to-watch transport remain unverified.; Canonical lifecycle and current v2 read dependencies remain uncommitted. The selective slice commit is evidence for this working checkout, not a standalone release candidate.; Legacy comms_log state still describes send-intent metadata. The current console takes channel badges from durable delivery records and uses comms_log only for matching message links.; Production dispatch guard remains required under F1. F11/O3 refund limitations remain frozen and were not investigated. - **M6 — Help sheet and subscription support guidance; [Help](../2026-09-05-end-to-end-review/screenshots/mobile-help-channels.png)**: Controlled call/email receipt remains unverified under M6. No receiving endpoint or communication sender was supplied for this run. Next: supply a sandbox sender and mailbox/test phone, exercise the approved response path and retain member-receipt evidence. Contact reveal and saved reply do not prove delivery. - **O2 — Takeover and KYC resubmission dialogs; [case](../2026-09-05-end-to-end-review/screenshots/ops-inert-confirmation.png), [KYC](../2026-09-05-end-to-end-review/screenshots/ops-kyc-inert-resubmit.png)**: Native Live Activity acceptance and real Postgres restart still need proof.; The new portal sends conditional writes. Older API clients may omit the additive update token.; Browser assignment succeeds. Dialog overflow repair and stable-state contrast need a second run.; This slice does not close full acceptance. Live Member 360 acceptance labels, stale entitlement/payment identity during refunds, unknown response recovery, other panels and modes, full document content, screen-reader use, all text sizes/themes, Android runtime, providers and physical devices remain open. No migration was added. Production grants are unverified.; Exact next action: run takeover and KYC resubmission confirm/cancel with a working screen reader. Verify spoken member/case identity, control names, background isolation and focus return. Resolve the local VoiceOver automation timeout or supply a manual screen-reader run. Do not count the availability probe as product acceptance. - **O7 — Coverage empty desk, Config pricing and redirected legacy sections; [coverage](../2026-09-05-end-to-end-review/screenshots/ops-coverage-empty.png), [config](../2026-09-05-end-to-end-review/screenshots/ops-config.png)**: Blocked on remaining implementation: signed real-OTP provenance, safe final export projection/packaging, HTTP challenge/download, current digest/owner checks, delivery audit and recovery. The proposed server patch is unapplied.; Collector output is internal and readyForDelivery:false. Synthetic-table tests do not establish every current schema predicate or safe disclosure. SQL and file reads do not form one atomic snapshot.; Complete account deletion, current holds/retention and stale-writer prevention remain incomplete. Historical masked notification rows cannot be attributed by guessing a masked address.; Controlled sign-in provider, physical devices, PostgreSQL 17 and production grants remain unverified. No real provider or recipient was used.; D3/D5/D9 are approved. These decisions do not verify implementation. Work stops at the user-approved record/CI/report boundary; coverage remains unchanged.; Release review, 2026-09-08: committed HEAD has the scoped DSAR collector and identity modules, but the server does not import them. The fail-closed dsar_fulfilment_unavailable HTTP response and unavailable durable fulfilment mode exist only in preserved uncommitted source. Current local CI does not establish this protection in a fresh HEAD release. See RELEASE-REVIEW.md. - **R1 — Complete production dispatch/pre-arm durable composition (F1)**: Local composition/worker checks pass. Production guard remains; complete provider, worker, PG17/grant and device evidence is absent.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R5 — Unify identity, policy, profile window and guarantee facts (F11)**: Local fact and refund slices have committed evidence. Every status combination is not verified. F11/O3 remain frozen at 38e4a6cd by user instruction.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R6 — Repair Help completion/recovery and decide channel contract (F5 + integration gap)**: D2 call/email and D7 audited fresh-MFA contact access are implemented. Consecutive local actions and saved-write recovery pass. No real controlled recipient receipt was verified.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R11 — Update smoke tests to current portal and add cross-surface acceptance**: Current full CI passed with four API test processes. Earlier certificate/OTP child timeouts meet the user-approved harness-flake rule. CI validates the preserved working checkout, not a fresh HEAD checkout or provider/device readiness.; Complete cross-surface role/session rehearsal remains unverified.; Tested source is the preserved working checkout; earlier canonical dependencies remain uncommitted. - **R12 — Deliver mobile usability changes M1–M8**: M2/M3/M4/M5/M7/M8 local criteria are verified. M1 and M6 retain provider/device limits; all iOS and Android UX criteria have not passed.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R13 — Deliver ops usability changes O1–O8**: O1/O4/O5/O6/O8 are locally verified. O2 screen-reader acceptance and O7 privacy integration are blocked. O3 remains frozen.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R14 — Restore or explicitly retire redirected/deferred capabilities**: Required workflows remain in the current console. D3 does not authorize retirement. Privacy export/download/deletion are incomplete; pending-N20 remains unapplied.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R15 — Run actual provider/device and durable lifecycle acceptance**: Local durable tests and native/browser evidence exist. Actual sandbox IAP/KYC/provider receipts, physical iOS/Android, paired watch and complete recovery/theme/locale evidence are missing.; Verification is for the reviewed working checkout. Earlier canonical dependencies remain uncommitted; partial commits are not a standalone release candidate. - **R16 — Refresh release evidence and full CI**: Current full CI passed with four API test processes. Earlier certificate/OTP child timeouts meet the user-approved harness-flake rule. CI validates the preserved working checkout, not a fresh HEAD checkout or provider/device readiness.; Current staging, production/provider/worker/device attestations are incomplete. A CI pass alone would not close readiness.; Tested source is the preserved working checkout; earlier canonical dependencies remain uncommitted. - **N8 — High — complete privacy export and deletion remain unavailable**: Blocked on remaining implementation: signed real-OTP provenance, safe final export projection/packaging, HTTP challenge/download, current digest/owner checks, delivery audit and recovery. The proposed server patch is unapplied.; Collector output is internal and readyForDelivery:false. Synthetic-table tests do not establish every current schema predicate or safe disclosure. SQL and file reads do not form one atomic snapshot.; Complete account deletion, current holds/retention and stale-writer prevention remain incomplete. Historical masked notification rows cannot be attributed by guessing a masked address.; Controlled sign-in provider, physical devices, PostgreSQL 17 and production grants remain unverified. No real provider or recipient was used.; D3/D5/D9 are approved. These decisions do not verify implementation. Work stops at the user-approved record/CI/report boundary; coverage remains unchanged.; Release review, 2026-09-08: committed HEAD has the scoped DSAR collector and identity modules, but the server does not import them. The fail-closed dsar_fulfilment_unavailable HTTP response and unavailable durable fulfilment mode exist only in preserved uncommitted source. Current local CI does not establish this protection in a fresh HEAD release. See RELEASE-REVIEW.md. Additional release conditions from the runbooks and migration notes: ordinary production dispatch/pre-arm/local-SMS creation deliberately remains unavailable; complete production worker/provider composition before altering those guards. Rehearse migration order, checked adoption and actual runtime-role privileges on PostgreSQL 17. Stop old API/worker writers at the Help/config/canonical boundaries. Verify recovery, scheduler ownership, retention/holds, APNs/FCM and physical iOS/Android/Watch behavior. DSAR collection and identity components do not implement complete authorized export/download/deletion. Preserve open request state and the 503 hold. Historical pack/issued-term gaps remain unknown rather than reconstructed facts. ## Scope assessment This is much broader than a test-only remediation branch. It adds transactional case/deadman stores, canonical adoption, delivery and push journals, verification/grace/dispute workflows, versioned configuration, refund binding and durable completion, DSAR components, new v2 contracts, mobile recovery flows and substantial operator UI work. Those changes are linked to the review register. The five-file `.agents/skills/vc-pitch-deck` addition is unrelated fundraising tooling. Root dependency manifests and the lockfile, CI YAML, vendor patches and deployment configuration are unchanged. The API workspace package script changes contract-test concurrency. Large generated-looking material consists mainly of the 14,063-line work register and 5,243-line v2 OpenAPI file. The ESLint addition excludes only the preserved pending-N20 source snapshot under docs/qa. The test-concurrency cap and 30-second certificate deadline retain assertions; no new blanket test skip was established. Production guards and explicit component holds are intentional release decisions, not reported as accidental defects. ## History evidence The backup ref resolves to `915ef6cacb42ce0b22a7d86bf30d5ac1b515fab5`. The documented outside-docs empty diff is reproducible against the named cleanup snapshot `f4862cce543f834067058b75845b737533c32b64`. Against current HEAD it contains 312 paths because four later commits add migrations, remaining code and documentation. The 31-commit/31-untracked-directory language in RELEASE-REVIEW is historical; current HEAD has 35 commits and all 34 new SQL files tracked. The command’s ordinary exit 0 is not itself proof of equality; this review checked its output. No raw screenshot/log paths were found in the remediation directory across these 35 commits by the recorded path scan. All 29 original full commit messages were also verified byte for byte. Some original logs are retrievable through the backup ref, including DSAR and refund summaries. Remaining raw archive bytes and command outputs cannot be validated because `/Users/stevanl/dev/ela-evidence/2026-09-06-end-to-end-remediation` is absent here. See `history-check.json`. ## Migrations and deployment order There are **34 added SQL files in 33 directories**. No existing migration is edited. Every file is tracked at HEAD. There is no checked-in automatic migration runner/registration list that proves production application; deploy scripts do not run this sequence. `ela_schema_migrations` belongs to the external deployment process (the test harness creates an empty ledger). The commit label “unapplied” is not evidence about a remote database. Dated notes document isolated local PostgreSQL 16.11 use, so those files must already be treated as immutable. This review uses disposable PostgreSQL 17 databases; those applications are not production registration. Actual staging/production status remains **unknown for all 34 files**. No file supplies a production rollback SQL procedure. Keep additive columns, receipts, guards and immutable evidence. Post-adoption return to old snapshot writers/current-data export is unproved. Migration 013 retention can irreversibly purge eligible rows. Issued-policy terms and verification-005 lack an explicit outer transaction and should be applied atomically per file. Do not wrap dispatch-004 plus 005 in one transaction: commit newly added enum labels before use. | Migration | Schema / backfill | Required order | Code/schema skew and reversal | |---|---|---|---| | `db/config-transaction-001/001_config_versions_and_receipts.sql` | Config revision, write receipts, writer contract fence; existing rows start revision 1. | hard-001 and dispatch-007; stop old API writers first. | New writes need revision/receipts; old cached writers can falsely acknowledge after their fenced async write fails. Retain fence and versions. | | `db/device-token-durable-001/001_registration_version.sql` | Per-registration UUID backfill/default, rotated by current registration writes. | ela-090, notif-durable-001, device-meta-001; before version-aware token/push code. | Missing column prevents current reads/writes; old rejection writers do not protect a newer registration. Additive, retain versions. | | `db/dispatch-transaction-001/001_case_commands.sql` | Snapshot revision and command receipts; atomic state plus outbound intent. | hard-001/003, r1r2-slice-a, close-fanout-001; stop old snapshot writers. | New command writer fails without schema. Mixed writers break acknowledged-state guarantees; retain receipts. | | `db/dispatch-transaction-002/001_notification_claims.sql` | Notification leases and provider-attempt journal. | dispatch-001 and existing outbox; before claim worker. | New worker cannot claim without columns/tables; old worker does not honor leases. At-least-once delivery, uncertain attempts are retained. | | `db/dispatch-transaction-003/001_delivery_receipts.sql` | Verified provider delivery inbox; no recipient/body/token copies. | dispatch-002; before callback reconciliation. | Callbacks cannot be durably acknowledged without inbox; retain early and unmatched receipts. | | `db/dispatch-transaction-004/001_relational_case_commands.sql` | Canonical case UUID/external identity mapping, runtime/dispatch data and command state; no automatic legacy import. | ela-028/029/030 and dispatch-001..003; commit this file before 005 uses new enum values. | New relational adapter requires fields; old adapter remains unsafe after adoption. Explicit checked import is separate; never invent absent clocks. | | `db/dispatch-transaction-005/001_relational_notification_records.sql` | Canonical notifications, delivery/claim records and adoption writer guards; no legacy data import. | dispatch-001..004, hard-001, r1r2-slice-a. | New relational notifications fail before schema. After adoption legacy snapshot/outbox writes are refused. Preserve receipts and attempts. | | `db/dispatch-transaction-006/001_accepted_firm_withdrawal.sql` | Replace case-state guard to permit accepted-firm withdrawal/reassignment. | dispatch-004; before new withdrawal command. | Code first: supported transition can be rejected by old SQL state guard. Schema first is additive behavior; terminal states stay terminal. | | `db/dispatch-transaction-007/001_atomic_admin_action_audit.sql` | Typed admin command identity and audit hash payload support; keep prior hashed serialization. | ela-070, lr-020d, dispatch-006. | New audited commands require columns/chain behavior; ambiguous old chain tip blocks work and must be reconciled, not rewritten. | | `db/dispatch-transaction-008/001_location_consent.sql` | Nullable sharing end and recorded consent on live streams; old deadlines retained, old consent unknown. | hard-001 before new location writer. | New unlimited-window writes fail under old NOT NULL; old code cannot represent new null deadline. Keep additive fields. | | `db/dispatch-transaction-009/001_recorded_audit_state.sql` | Nullable typed case-audit state with original non-case event state preserved in JSON. | ela-029 and dispatch-004. | New domain audits fail without relaxation; old NOT NULL cannot be restored after such events exist. | | `db/dispatch-transaction-010/001_audit_state_evidence_check.sql` | Repair 009 CHECK so missing JSON state cannot pass via SQL NULL. | Immediately after dispatch-009. | Existing invalid evidence blocks validation; reconcile against source, do not manufacture state. Retain stricter constraint. | | `db/dispatch-transaction-011/001_checked_adoption.sql` | Adoption receipt, source digest/counts, legacy writer guards. | dispatch-001..010; explicit checked adoption after backup and quiescence. | New adoption CLI needs schema; adopted database rejects old writers. No reverse data export/downgrade approval supplied. | | `db/dispatch-transaction-012/001_deadman_commands.sql` | Per-member deadman revisions, cancellation/command receipts and recovery claims; duplicate live-arm check. | deadman-001; deadman-002 files 001/002/004/005; dispatch-004. | Resolve duplicate live arms before apply. New pre-arm code needs schema; old writes fenced per adopted member. Retain emergency promises and receipts. | | `db/dispatch-transaction-013/001_deadman_retention_and_grants.sql` | Deadman retention helper, persistent writer guard and grants; preserve active cases/holds, purge eligible resolved history. | dispatch-012, ela-016, hard-001, dsar-durable-001; retention owner, not API role. | No job started; call only with complete hold/case truth. Purges are not reversible. Retain fence even after per-member rows are purged. | | `db/dispatch-transaction-013/002_nightly_retention.sql` | Wire deadman cleanup into existing nightly retention function and actual purge counters. | 013/001 and complete ela-095b retention schema/tables. | No cron schedule installed. Old retention function can erase emergency promises; do not restore it. Full production nightly run remains unverified. | | `db/dsar-identity-001/001_export_identity_challenges.sql` | Export/session/content-bound HMAC challenge store, attempt/rate limits and consume guards. | Independent component; before any future service composition. | Current HTTP routes do not use it. Missing schema blocks assertReady; preserve rows for proof/rate-limit windows. Never reset counters by deleting recent rows. | | `db/help-delivery-001/001_reply_push_outbox.sql` | Reply push intents, per-device claims, attempts; existing replies not backfilled. | hard-004; device/audit tables for worker. | New atomic reply/worker needs tables. Old replies retain unknown delivery; old inline sends are not stopped by a DB fence alone. | | `db/help-delivery-002/001_case_safety_outcomes.sql` | Expand reply delivery/attempt outcomes for duress and missing case context. | help-delivery-001; coordinate worker switch. | Code first: new blocked/suppressed outcomes violate old CHECK. Mixed workers unsupported; retain recorded outcomes. | | `db/help-request-001/001_member_request_receipts.sql` | Member-scoped idempotency hash and receipt IDs/times with message transaction. | hard-004 before current Help ingress. | Missing table prevents reliable retries; old clients can omit request keys by contract. Keep receipts beyond thread deletion until retention/DSAR policy handles them. | | `db/help-writer-001/001_current_writer_contract.sql` | Require current Help writer-contract session setting on snapshot mutation. | hard-004; stop old ingress and API processes before apply. | Old async writer may send externally despite rejected persistence. Fence is compatibility, not authz; runtime role must not own/disable triggers. | | `db/issued-policy-terms-001/001_issued_terms.sql` | Nullable issued policy terms plus immutability trigger; no guessed historical terms. | fi-010; wrap file in one transaction (no BEGIN/COMMIT in file). | New reader expects column; old writer may lack preserved issued evidence. Once recorded, terms cannot be replaced. Keep historical nulls. | | `db/member-push-durable-001/001_case_lifecycle_push_outbox.sql` | Case lifecycle event/outbox, device claims/outcomes and audit records. | Canonical dispatch and verification schema; version-aware token migration before worker use. | New transitions/push reads need tables and triggers; missing schema causes rollback/hold. No provider sends in migration. Keep retry/evidence journal. | | `db/verification-durable-001/001_followup_timestamp_prerequisite.sql` | Create missing set_updated_at helper only if absent; no data changes. | Before historical ela-064 on a fresh database (not ordinary directory sort). | Clean historical ela-064 otherwise fails. Existing installations retain their helper; inspect actual body before rollout. | | `db/verification-durable-002/001_canonical_verification_tasks.sql` | Current-acceptance task identity, due reason, uniqueness, reconciliation trigger/backfill against actual cases. | dispatch-013, dir-durable-001, ela-060..065 including 001 prerequisite. | Missing trigger/shape fails canonical readiness or loses task atomicity. Prior inconsistent tasks/duplicates need reconciliation. Confirmed stale member-end defect requires a NEW superseding migration. | | `db/verification-durable-003/001_submission_receipts.sql` | One immutable submission receipt/hash per task; task delete cascades receipt. | verification-002 and canonical/admin audits. | New submission code requires table; old writers lack durable retry response. Keep original evidence/audit. | | `db/verification-durable-004/001_member_attestation_receipts.sql` | Member reauthentication/receipt fields; drop contradictory created_at lower-bound check; no invented evidence. | ela-061..063 before current member attestation. | New writes need fields; keep valid freshness constraint. Do not restore old unsafe API or discard attestation evidence. | | `db/verification-durable-005/001_canonical_grace_handoff.sql` | Rename old grace function and install handoff that no-ops old SQL writer for adopted canonical data. | verification-002..004 plus ela-065; wrap whole file in a transaction. | Schema first without matching API grace worker can stop progress while cron still returns zero. Code first/mixed scheduler can mutate separate ownership. Coordinate cutover and age monitoring. | | `db/verification-durable-006/001_followup_closure_receipts.sql` | Audited final follow-up receipt, separate from initial conditional evidence; revoke old unaudited close helper. | ela-064 and canonical case/audit commands. | Selected factory needs receipt table; older helper callers lose permission. Preserve legacy closures without fabricating receipts; retained evidence prevents blind rollback. | | `db/verification-durable-007/001_followup_member_evidence.sql` | Exact follow-up/task/case/firm identity FK and member evidence receipt status. | verification-004 and006. | New member flow needs columns/FK; old readers may not understand evidence_saved. Keep existing receipts and composite identity. | | `db/verification-durable-008/001_reauthentication_method.sql` | Explicit biometric/PIN reauthentication method and truthful passed-session checks. | verification-007. | New PIN writes fail against old biometrics-only constraint; old method remains unknown. Retain method evidence and validate actual runtime permissions. | | `db/verification-durable-009/001_dispute_triage_commands.sql` | Owned dispute triage receipts/actions and resolved-close guard; expand final disputed outcome. | verification-006..008, existing dispute/triage schema and canonical command audit. | New dispute write fails against old outcomes/schema; closed_resolved is deliberately blocked pending review. No scheduler installed; old direct decisions unsafe. | | `db/verification-durable-010/001_dispute_review_event_truth.sql` | Replace dispute creation event to record review work rather than fictitious ops takeover. | verification-009 and old dispute trigger infrastructure. | Schema first affects only new events. Code first with old function continues misleading events. Prior immutable events are not rewritten. | | `db/voice-notes-004/001_erasure_fences.sql` | Erase/tombstone guards for audio keys, transcript, segments and playable thread state; stale resurrection refused. | voice-notes-001/003 and case-chat-001 before repaired erasure component. | Old writer after schema can be rejected instead of resurrecting deleted data. Partial erasure fails closed. No deletion authorization, hold policy or complete DSAR proof implied. | Deploy sequence implied by these files: (1) inventory actual schema, roles, old writers and holds; take a verified backup and stop affected ingress/workers; (2) install historical foundations, with verification-001 **before ela-064**; (3) apply dispatch-001..013 in dependency order, committing 004 before005 and applying both013 files only with their full prerequisites; (4) apply verification-002..010 with a coordinated API grace-worker handoff; (5) install the independent Help/config/issued-terms/device/push/voice prerequisites before their new code, then DSAR identity only as a still-uncomposed component; (6) perform checked canonical adoption with old writers stopped and reconcile invalid legacy evidence; (7) boot the matching API/worker build, verify runtime-role writes, callbacks, retention and scheduler age/recovery; (8) keep ordinary production dispatch and full DSAR fulfilment gated until their separate acceptance is complete. Some independent files may be reordered where their stated prerequisites hold; a lexicographic directory sweep is unsafe. `migration-inventory.json` records each file SHA256 and whether the selected composition harness includes it. That harness omits DSAR identity and nightly013/002, which have separate tests. Disposable owner-role migration tests strip historical cron scheduling and scope enum checks; they do not establish the unmodified production runner, grants or scheduler. ## Claim-to-artifact matrix “Yes” is scoped to the stated property; it never substitutes for a production acceptance result. Historical logs prove historical runs. A present source file with passing tests does not make an old screenshot or old combined working-tree result a fresh-HEAD artifact. Names below resolve under `docs/qa/2026-09-06-end-to-end-remediation/` unless a source path or backup ref is specified. `backup-evidence-check.json` records safe summaries/hashes, without copying raw old logs. | Claim | Artifact | Proven? / currentness | |---|---|---| | Full npm run ci passed in 188.20s; API 1457 pass/45 skip | FINAL-CI.md; CLEAN-GREEN-HANDOFF.md; external logs/clean-green-concurrency-full-ci-once.log | No for current HEAD. Explicitly tested the preserved working checkout at the named earlier harness/fixture commits. Final full-CI log absent at archive path and backup. Fresh lint/typecheck/build and unit results are separate; fresh browser CI is red. | | Remediation complete / item verified | work-register.json; BACKLOG-FINAL-RECORD.md; FINAL-REPORT.md | No for the whole branch. Register explicitly has 35 verified,15 blocked,45 in progress,110 not started,1 implemented/unverified. Counts reproduced. Individual verified slices do not establish parent acceptance. All206 item claims/pointers retained in register-claims.json. | | 2095 command records document the run | COMMANDS.md and work-register.json | Yes as a historical command register:1674 zero exits,421 nonzero. Deliberate red reproductions/setup failures are included; exit0 is not an acceptance conclusion. No final-HEAD attribution for the whole register. | | Visual report reflects the review checkpoint | visual-report.html and COMMANDS.md | Yes as a dated cdd16caa/failed-CI checkpoint, not as the latest state. Later FINAL-CI supersedes it. Referenced image bytes are mostly outside the available checkout; this review did not render every historical screenshot. | | Cleanup preserves outside-docs product contents | EVIDENCE-CLEANUP.md; RELEASE-REVIEW.md; backup/e2e-remediation-pre-rewrite | Yes at named cleanup snapshots f4862cce/faab1ce0. Exact user-style exclusion command is empty at cleanup, but312 paths differ at current HEAD after four more commits. It is a dated proof, not evidence that current HEAD still equals the backup. | | All29 original/test commit messages preserved; raw remediation artifacts removed from branch history | EVIDENCE-CLEANUP.md; local backup ref915ef6ca | Yes: full original commit-message bytes match the first29 rewritten commits in order; raw screenshot/log path scan across35 commits found none in the remediation directory. Does not prove secure erasure of old objects; backup intentionally retains them. | | Current release is not self-contained;31 migrations remain untracked | RELEASE-REVIEW.md (31-commit historical snapshot) | No as a statement about current HEAD; it accurately names an earlier snapshot. a200ebd6 and12d0c48c subsequently commit migrations and remaining source. Current HEAD has34 added SQL files in33 directories and code components present. Production release still blocked. | | Ordinary production dispatch/pre-arm/local-SMS remains refused | F1-COMPOSITION.md; RELEASE-REVIEW.md; docs/runbooks/19-predispatch-deadman.md; server.ts production gates | Yes from current source and guard contract tests. Supplying DATABASE_URL alone does not lift the deliberate guard. No production service was contacted. Keep the guard until separately proven composition and rollout. | | Durable canonical commands, adoption, verification and recovery pass selected PostgreSQL slices | F1-* notes; MIGRATIONS.md; case-storage-composition.integration.test.ts and other adjacent integration tests | Historical subset claims have explicit boundaries; not proof of the entire HEAD suite. This review applies current SQL on PostgreSQL17 but records integration failures/cancellations and two independently reproduced reassignment defects. Runtime-role/scheduler/rollout proof still absent. | | D9 identity migration is frozen and proof is export/session/content-bound | D9-IDENTITY-MIGRATION.md; dsarIdentityChallenge.ts/tests; backup D9-IDENTITY-migration-checkpoint.json | Yes for current file hash:02d1c5e766d84c39493a30d9288652b4c267ad452bd094bbf34f8b07fa3b454c matches. Component checks do not establish HTTP composition, trusted sign-in-channel provenance, final-byte package or secure download. No production imports compose this service. | | O7 DSAR component tests pass24/24; whole fulfilment is safely unavailable | O7-FINAL-RECORD.md; backup logs/closure-o7-final-database.log; server.ts:49517 | Yes for historical log summary24pass0fail0skip and current pre-erasure503 guard. No for complete DSAR fulfilment at HEAD. The collector/identity implementation is uncomposed; requests remain open rather than falsely fulfilled. | | DSAR collector scopes ownership, records real files and returns a deterministic digest | O7-DSAR-COLLECTOR.md; O7-DSAR-STORE-INVENTORY.md; dsarExportCollector.ts/tests | Yes for the implemented internal component boundaries reviewed in source; not a deliverable export. Uses one read-only SQL snapshot, but filesystem is not transactionally atomic. readyForDelivery is unconditionally false; partial/missing stores and sensitive/free-text disclosure review remain explicit. | | Voice erasure survives stale writers and recoverable partial deletion | VOICE-ERASURE-MIGRATIONS.md; N8-VOICE-ERASURE.md; voice-notes-004; voice-notes-dsar-durability.integration.test.ts | Local component evidence only. Current guards retain tombstones and refuse resurrection. Does not authorize deletion or prove all stores, legal holds, production files or complete privacy fulfilment. Fresh isolated test outcome is in the tests table. | | Current entitlement reads avoid stale cross-process membership decisions | F11-CURRENT-ENTITLEMENT-READS.md; F11-REFUND-CURRENT-PREFLIGHT.md; entitlement-current-read.integration.test.ts; server.ts current-read helpers | Source/tests support current durable reads with unavailable state on failed authority. Historical logs alone do not prove HEAD; current tests included below. Real provider event timing and deployed multi-process behavior remain release checks. | | Refund approval binds reviewed service payment/provider/amount/currency | F11-REFUND-REVIEWED-TARGET.md; refund-reviewed-target.contract.test.ts; Member360Client.tsx; backup closure-refund-target-contracts-final.log | Yes for historical70pass0skip and current comparison/UI capture. HEAD rejects changed reviewed target before intent/provider work; keeps original target/draft across MFA. API field remains optional for old callers as explicitly documented. Not real settlement or full F11/O3 acceptance. | | Refund completion awaits durable write and cannot overwrite a replacement purchase | F11-REFUND-DURABLE-OUTCOME.md; F11-D8-REFUND-CONFLICT.md; server.ts:12979 and:37946; backup closure-refund-target-full-api.log | Yes for historical1432pass43skip and source payment/version-conditional awaited persistence. Pending reconciliation is distinct from completion. Apple request is distinct from issued refund. Full external reconciliation/settlement remains unverified. | | Help replies/contact reveal are truthful, current and audit-gated | F5-*; N16/N17/N18-*; audited Help contact note; server.ts:51664; last safety-flag commit | Current source and local tests support revision/context checks, audit-before-disclosure, no automatic delivery claim and duress suppression. Full channel policy/physical delivery remains open. OpenAPI bearer declaration omission retained as a minor finding; no auth bypass established. | | No applied migration was edited; hashes/rollback limits are preserved | MIGRATIONS.md and family-specific migration notes; git diff main...HEAD -- db | Yes:34 additions and no existing SQL edit. Historical local application is documented; production application/registration and grants are unknown. Some frozen checkpoints reachable in backup, not all. No safe current-data downgrade is demonstrated. | | Final tests/certificate repair kept assertions and production limits | FINAL-CI.md; apps/api/package.json; certificate helper and smoke diffs | Yes from diff: concurrency4 and30-second certificate helper, no blanket test disable. That does not prove the fresh full gate green; opt-in integration and browser suites expose failures now. | | Issued policy terms and plan/payment facts are not reconstructed from current configuration | F11-ISSUED-POLICY-TERMS.md; issuedPolicyTerms.ts; policy/receipt tests; insurance_policy_numbers migration | Source preserves recorded issued terms and explicit unknown history, and separates active service from payment receipts. It does not establish missing historical terms or live insurer policy approval; production rollout is separate. | Coverage: the independent evidence review enumerated120 changed docs/plans/evidence paths, including103 remediation Markdown files, complete COMMANDS/register/visual-report contents, guides, compliance/design docs, five changed runbooks, master plan and evidence examples. The root additionally read spec/README.md, PRD change, CI/router/justfile/scripts and reviewed the added pitch-deck skill as unrelated scope. The stored121-entry document inventory includes spec. Of728 distinct archive references extracted by that review from the register,118 corresponding artifacts are reachable through the backup tree. Relocated absolute paths are unavailable in this Linux checkout. This is an explicit reproducibility limit, not evidence of falsified results. The complete206-entry register claim/pointer inventory is retained in `register-claims.json`. The source register includes chronology and nested observations; row status is not converted into a current-HEAD pass. ## Test environment and method Tests used a clean `git archive HEAD` under `REVIEW/tree`, leaving the initial working tree outside the review copy intact. A second archive under `REVIEW/install20-tree` verified the requested fallback `mise exec node@20 ... npm ci`: Node20.20.2/npm10 installation succeeded despite engine warnings. The repository router targets Node22, while CI targets Node24. Initial shell-wrapper runs requested20/24 but actually resolved22.22.3; this was detected and recorded, not relabeled as a Node24 pass. Later commands explicitly prepend the requested Node binary directory: typecheck/lint, current API contract suite and browser/remaining integration checks use24.21.0. Per-command JSON records exact commands and actual runtime. PostgreSQL17.10 ran in an owned disposable Docker container with loopback-only trust authentication and synthetic databases. No production schema/data/role was read. The first all-API integration run used concurrency4 and exposed cross-schema enum/extension interference. A serial run followed; then a fresh database with `pgcrypto` installed in `public` removed extension-placement ambiguity. Test harnesses apply the repository migrations but scope historical enum checks, strip cron scheduling and substitute an owned grant role as documented. They do not test an unmodified full production migration runner. The large composition test’s120-second parent deadline and shutdown behavior prevented a clean full result; the remaining files were attempted separately on another prepared database. Node24 hangs are kept separate from the completed serial Node22 result. Browser tests used the installed lockfile Playwright1.61.1 and its Chromium. The CI container is pinned to Playwright1.51.1; that exact container/font stack was not reproduced. Port3100 was already occupied by another process, so subsequent Playwright runs used allocated local ports. The custom Chrome smoke needed a local `--no-sandbox` launcher because its initial DevTools startup failed; no test code was changed. Both custom admin smokes eventually printed their success lines but failed to exit and were bounded by the review timeout. Screenshots and traces are local synthetic artifacts. Snapshot differences are reported, not approved. FFmpeg7.0.2 was installed as an isolated test binary; the real stitching integration passed. This is not production FFmpeg6.1.1 equivalence. The mobile document lifecycle integration ran from its documented mobile workspace after the API build and passed. APNs/real-provider checks were not enabled. No existing test was edited. The prepared full Node 24 run reached its 1,200-second cap: 88 passed, 52 failed and 26 cancelled. It also encountered PostgreSQL connection exhaustion, so its failures are not a clean isolated product result. The separate database used for the remaining 26 files shared that PostgreSQL server and overlapped the stuck composition process; it finished with 260 passed, 10 failed and 4 cancelled. These resource and harness limits remain unresolved. They do not replace the separate successful defect reproductions or the completed earlier serial run. ## Complete command/results table Commands below are exact shell invocations recorded by the runner. All are foreground child processes that were polled through completion or bounded timeout. The cwd is `REVIEW/tree` except the Node20 install archive and the mobile-workspace integration, which are identified in `tests.json`. Summary cells preserve emitted summary lines; an explicit note is used where a command emits no summary. Every failing test name is listed in the failure appendix. Repeated rows document prerequisite/runtime corrections, not extra passes to erase an earlier failure. | Command / log | Outcome | Verbatim summary | Failures | |---|---|---|---| | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; CHROME_PATH=/tmp/ela-review-20260912-2245/REVIEW/chromium-local npm run admin:browser-smoke'`
[admin-browser-smoke-linux](logs/admin-browser-smoke-linux.log)
Node v24.21.0 | Assertions passed; harness did not exit (exit 124) | admin browser smoke passed at http://127.0.0.1:35913
REVIEW TIMEOUT after 180 seconds | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; CHROME_PATH=$(node --input-type=module -e '"'"'import {chromium} from "playwright"; console.log(chromium.executablePath())'"'"') npm run admin:browser-smoke'`
[admin-browser-smoke](logs/admin-browser-smoke.log)
Node v24.21.0 | FAIL (exit 1) | Node.js v24.21.0 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run admin:smoke'`
[admin-smoke-node24](logs/admin-smoke-node24.log)
Node v24.21.0 | Assertions passed; harness did not exit (exit 124) | admin portal smoke passed at http://127.0.0.1:46727
REVIEW TIMEOUT after 180 seconds | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run admin:smoke'`
[admin-smoke](logs/admin-smoke.log)
Node v22.22.3 | Assertions passed; harness did not exit (exit 143) | admin portal smoke passed at http://127.0.0.1:42493
Terminated owned harness after 341 seconds; assertions completed but process did not exit. | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run admin:test'`
[admin-test](logs/admin-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 246
# pass 246
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run admin:v2:grep-gate'`
[admin-v2-grep-gate](logs/admin-v2-grep-gate.log)
Node v22.22.3 | PASS (exit 0) | ok admin v2 grep gates | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; ADMIN_VISUAL_API_PORT=43913 ADMIN_VISUAL_ADMIN_PORT=45769 npm run admin:visual:artifacts'`
[admin-visual-artifacts-freeports](logs/admin-visual-artifacts-freeports.log)
Node v24.21.0 | FAIL (exit 1) | 1 failed | 1 reported names; [appendix](#failure-admin-visual-artifacts-freeports) | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run admin:visual:artifacts'`
[admin-visual-artifacts](logs/admin-visual-artifacts.log)
Node v24.21.0 | FAIL (exit 1) | Error: Process from config.webServer was not able to start. Exit code: 1 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; ADMIN_VISUAL_API_PORT=43913 ADMIN_VISUAL_ADMIN_PORT=45769 npm run admin:visual'`
[admin-visual-freeports](logs/admin-visual-freeports.log)
Node v24.21.0 | FAIL (exit 1) | 19 failed
9 passed (1.5m) | 19 reported names; [appendix](#failure-admin-visual-freeports) | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run admin:visual'`
[admin-visual](logs/admin-visual.log)
Node v24.21.0 | FAIL (exit 1) | Error: Process from config.webServer was not able to start. Exit code: 1 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run analytics:evidence:check'`
[analytics-evidence-check](logs/analytics-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - ELA-009 live README records unresolved analytics evidence: Stack torn down to free VPS resources. | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run analytics:examples:check'`
[analytics-examples-check](logs/analytics-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Analytics evidence example artifacts validated. | None | | `mise exec node@24 -- bash -c 'npm run visual:android:preflight'`
[android-preflight](logs/android-preflight.log)
Node v22.22.3 | FAIL (exit 1) | On macOS, the default SDK path is usually $HOME/Library/Android/sdk. | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'python3 ../local_services_check.py fuzz'`
[api-contract-fuzz](logs/api-contract-fuzz.log)
Node v22.22.3 | FAIL (exit 1) | ====================== 90 failures, 3 warnings in 37.26s ======================= | 90 reported names; [appendix](#failure-api-contract-fuzz) | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; INTEGRATION=1 ELA_TEST_DATABASE_URL=postgresql://postgres@127.0.0.1:32788/ela_e2e_remediation_prepared_review node --test --test-concurrency=1 apps/api/dist/*.integration.test.js'`
[api-integration-prepared](logs/api-integration-prepared.log)
Node v24.21.0 | TIMEOUT (exit 124) | ℹ tests 166
ℹ pass 88
ℹ fail 52
ℹ cancelled 26
ℹ skipped 0
REVIEW TIMEOUT after 1200 seconds | 73 reported names; [appendix](#failure-api-integration-prepared) | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; PATH=/tmp/ela-review-20260912-2245/REVIEW/bin:$PATH INTEGRATION=1 ELA_TEST_DATABASE_URL=postgresql://postgres@127.0.0.1:32788/ela_e2e_remediation_remaining_review node --test --test-concurrency=1 apps/api/dist/admin-config-store.integration.test.js apps/api/dist/apple-refund-intent.integration.test.js apps/api/dist/case-command-store.integration.test.js apps/api/dist/case-legacy-adoption.integration.test.js apps/api/dist/case-location-store.integration.test.js apps/api/dist/case-notification-claims.integration.test.js apps/api/dist/case-relational-state.integration.test.js apps/api/dist/device-push-storage.integration.test.js apps/api/dist/dsar-fulfilment-safety.integration.test.js apps/api/dist/dsar-fulfilment-truth.integration.test.js apps/api/dist/dsar-request-durability.integration.test.js apps/api/dist/dsarExportCollector.integration.test.js apps/api/dist/dsarIdentityChallenge.integration.test.js apps/api/dist/entitlement-current-read.integration.test.js apps/api/dist/help-audit.integration.test.js apps/api/dist/help-case-action.integration.test.js apps/api/dist/help-durability.integration.test.js apps/api/dist/help-reply-push.integration.test.js apps/api/dist/help-request-keys.integration.test.js apps/api/dist/help-writer-fence.integration.test.js apps/api/dist/issued-policy-terms.integration.test.js apps/api/dist/payment-receipt-storage.integration.test.js apps/api/dist/predispatch-deadman-store.integration.test.js apps/api/dist/snapshot-writer-fence.integration.test.js apps/api/dist/voice-notes-dsar-durability.integration.test.js apps/api/dist/voice-notes-stitch-ffmpeg.integration.test.js'`
[api-integration-remaining](logs/api-integration-remaining.log)
Node v24.21.0 | FAIL (exit 1) | ℹ tests 274
ℹ pass 260
ℹ fail 10
ℹ cancelled 4
ℹ skipped 0 | 10 reported names; [appendix](#failure-api-integration-remaining) | | `mise exec node@24 -- bash -c 'INTEGRATION=1 ELA_TEST_DATABASE_URL=postgresql://postgres@127.0.0.1:32788/ela_e2e_remediation_review node --test --test-concurrency=1 apps/api/dist/*.integration.test.js'`
[api-integration-serial](logs/api-integration-serial.log)
Node v22.22.3 | FAIL (exit 1) | # tests 322
# pass 272
# fail 44
# cancelled 5
# skipped 1 | 49 reported names; [appendix](#failure-api-integration-serial) | | `mise exec node@24 -- bash -c 'INTEGRATION=1 ELA_TEST_DATABASE_URL=postgresql://postgres@127.0.0.1:32788/ela_e2e_remediation_review npm run contract:test'`
[api-integration](logs/api-integration.log)
Node v22.22.3 | FAIL (exit 1) | # tests 1729
# pass 1640
# fail 69
# cancelled 5
# skipped 15 | 70 reported names; [appendix](#failure-api-integration) | | `mise exec node@24 -- bash -c 'npm run test --workspace @ela/api-types'`
[api-types-test](logs/api-types-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 16
# pass 16
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run arrest-rehearsal:evidence:check'`
[arrest-rehearsal-evidence-check](logs/arrest-rehearsal-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - provider sandbox evidence missing recipient allowlist: provider-sandbox/ela-099/2026-q2/recipient-allowlist.json | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run arrest-rehearsal:examples:check'`
[arrest-rehearsal-examples-check](logs/arrest-rehearsal-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Arrest-simulation rehearsal provider examples validated. | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run arrest-rehearsal:run'`
[arrest-rehearsal-run](logs/arrest-rehearsal-run.log)
Node v24.21.0 | PASS (exit 0) | } | None | | `mise exec node@24 -- bash -c 'npm run auth:test'`
[auth-test](logs/auth-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 26
# pass 26
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run backup:evidence:check'`
[backup-evidence-check](logs/backup-evidence-check.log)
Node v22.22.3 | PASS (exit 0) | Backup evidence validation passed. | None | | `mise exec node@24 -- bash -c 'npm run backup:examples:check'`
[backup-examples-check](logs/backup-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Backup evidence example artifacts validated. | None | | `mise exec node@24 -- bash -c 'npx playwright install chromium'`
[browser-install](logs/browser-install.log)
Node v22.22.3 | PASS (exit 0) | mise node@24.21.0 ✓ installed | None | | `mise exec node@24 -- bash -c 'npm run build'`
[build24](logs/build24.log)
Node v22.22.3 | PASS (exit 0) | Exported: dist/android | None | | `mise exec node@24 -- bash -c 'npm run cases:test'`
[cases-test](logs/cases-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 97
# pass 97
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@20 -- bash -c 'npm run ci'`
[ci20](logs/ci20.log)
Node v22.22.3 | FAIL (exit 1) | All matched files use Prettier code style!
✖ 4686 problems (4686 errors, 0 warnings) | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run closed-beta:evidence:check'`
[closed-beta-evidence-check](logs/closed-beta-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - ELA-098 store submission gate is not green | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run comms:test'`
[comms-test](logs/comms-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 82
# pass 82
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run contract:breaking'`
[contract-breaking](logs/contract-breaking.log)
Node v22.22.3 | PASS (exit 0) | OpenAPI v1 matches baseline. Both versions parse and resolve refs; v2 case reads are declared. | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; PATH=/tmp/ela-review-20260912-2245/REVIEW/bin:$PATH npm run contract:test'`
[contract-test-confirmed24](logs/contract-test-confirmed24.log)
Node v24.21.0 | PASS (exit 0) | ℹ tests 1502
ℹ pass 1457
ℹ fail 0
ℹ cancelled 0
ℹ skipped 45 | None | | `mise exec node@24 -- bash -c 'npm run contract:test'`
[contract-test](logs/contract-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 1502
# pass 1456
# fail 0
# cancelled 0
# skipped 46 | None | | `mise exec node@24 -- bash -c 'npm run env:example:check'`
[env-example-check](logs/env-example-check.log)
Node v22.22.3 | PASS (exit 0) | .env.example covers required production env vars. | None | | `mise exec node@24 -- bash -c 'npm run event-taxonomy:check'`
[event-taxonomy-check](logs/event-taxonomy-check.log)
Node v22.22.3 | PASS (exit 0) | INV-ELA-019 ok: 69 PRD §8 events match packages/events. | None | | `mise exec node@24 -- bash -c 'npm run events:test'`
[events-test](logs/events-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 3
# pass 3
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run format:check'`
[format-check](logs/format-check.log)
Node v22.22.3 | PASS (exit 0) | All matched files use Prettier code style! | None | | `mise exec node@20 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/20.20.2/bin:$PATH; npm ci'`
[install20-confirmed](logs/install20-confirmed.log)
Node v20.20.2 | PASS (exit 0) | added 1044 packages, and audited 1059 packages in 26s
23 vulnerabilities (10 moderate, 12 high, 1 critical) | None | | `mise exec node@20 -- bash -c 'npm ci'`
[install20](logs/install20.log)
Node v22.22.3 | PASS (exit 0) | added 1044 packages, and audited 1059 packages in 30s
23 vulnerabilities (10 moderate, 12 high, 1 critical) | None | | `mise exec node@24 -- bash -c 'npm run kyc:test'`
[kyc-test](logs/kyc-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 38
# pass 38
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; node ../legacy-contracts-probe.mjs'`
[legacy-postgres-contracts](logs/legacy-postgres-contracts.log)
Node v24.21.0 | FAIL (exit 1) | ℹ tests 36
ℹ pass 33
ℹ fail 2
ℹ cancelled 0
ℹ skipped 1 | 2 reported names; [appendix](#failure-legacy-postgres-contracts) | | `mise exec node@24 -- bash -c 'npm run legal-policy:evidence:check'`
[legal-policy-evidence-check](logs/legal-policy-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - legal policy evidence missing privacy and ToS counsel sign-off: legal/policies/ela-privacy-tos-counsel-signoff-2026-05-08.pdf | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'GIT_DIR=/tmp/ela-review-20260912-2245/.git GIT_WORK_TREE=/tmp/ela-review-20260912-2245/REVIEW/tree npm run lifecycle:fixture-gate'`
[lifecycle-fixture-gate-context](logs/lifecycle-fixture-gate-context.log)
Node v22.22.3 | PASS (exit 0) | # tests 5
# pass 5
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run lifecycle:fixture-gate'`
[lifecycle-fixture-gate](logs/lifecycle-fixture-gate.log)
Node v22.22.3 | FAIL (exit 1) | # tests 5
# pass 5
# fail 0
# cancelled 0
# skipped 0 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run lint'`
[lint-confirmed24](logs/lint-confirmed24.log)
Node v24.21.0 | PASS (exit 0) | No diagnostic output; exit 0 (there is no emitted test summary line). | None | | `mise exec node@24 -- bash -c 'npm run lint'`
[lint24](logs/lint24.log)
Node v22.22.3 | PASS (exit 0) | No diagnostic output; exit 0 (there is no emitted test summary line). | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run local:smoke:ci'`
[local-smoke-ci](logs/local-smoke-ci.log)
Node v24.21.0 | PASS (exit 0) | local app smoke passed for smoke_user_20260912035519267 | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; INTEGRATION=1 node --test dist-test/documentsLifecycle.integration.test.js'`
[mobile-documents-integration-context](logs/mobile-documents-integration-context.log)
Node v24.21.0 | PASS (exit 0) | ℹ tests 1
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0 | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; INTEGRATION=1 node --test apps/mobile/dist-test/documentsLifecycle.integration.test.js'`
[mobile-documents-integration](logs/mobile-documents-integration.log)
Node v24.21.0 | PASS (exit 0) | ℹ tests 1
ℹ pass 0
ℹ fail 0
ℹ cancelled 0
ℹ skipped 1 | None | | `mise exec node@24 -- bash -c 'npm run mobile:security:test'`
[mobile-security-test](logs/mobile-security-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 1108
# pass 1107
# fail 0
# cancelled 0
# skipped 1 | None | | `mise exec node@24 -- bash -c 'npm run observability:evidence:check'`
[observability-evidence-check](logs/observability-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - ELA-011 live README records unresolved observability evidence: This task remains **artifactComplete: true, liveEvidenceComplete: false**. Re-attempt when: | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run observability:examples:check'`
[observability-examples-check](logs/observability-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Observability evidence example artifacts validated. | None | | `mise exec node@24 -- bash -c 'npm run observability:pii-check'`
[observability-pii-check](logs/observability-pii-check.log)
Node v22.22.3 | PASS (exit 0) | INV-ELA-004 observability PII scrubber check passed | None | | `mise exec node@24 -- bash -c 'npm run observability:test'`
[observability-test](logs/observability-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 4
# pass 4
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run oncall:evidence:check'`
[oncall-evidence-check](logs/oncall-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - on-call vendor evidence missing Nightwatch paging drill evidence: evidence/ELA-096/live/nightwatch-paging-drills-2026-05-08.json | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run oncall:examples:check'`
[oncall-examples-check](logs/oncall-examples-check.log)
Node v22.22.3 | PASS (exit 0) | On-call vendor drill example validated. | None | | `mise exec node@24 -- bash -c 'npm run pdpl:evidence:check'`
[pdpl-evidence-check](logs/pdpl-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - 2026-05 monthly register outcome is not final: Pre-beta PR must record legal approval or explicit risk acceptance | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run pentest:evidence:check'`
[pentest-evidence-check](logs/pentest-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - missing rooted Android adversarial extraction evidence: evidence/ELA-089/rooted-android-artifacts-2026-05-08.json | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run prd:tasks:check'`
[prd-tasks-check](logs/prd-tasks-check.log)
Node v22.22.3 | PASS (exit 0) | PRD implementation task flags are consistent with blockers and live-evidence notes. | None | | `mise exec node@24 -- bash -c 'npm run production:readiness:check'`
[production-readiness-check](logs/production-readiness-check.log)
Node v22.22.3 | FAIL (exit 1) | Node.js v22.22.3 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run provider-credentials:evidence:check'`
[provider-credentials-evidence-check](logs/provider-credentials-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - provider credential evidence missing production provider environment attestation: evidence/provider-credentials/production-env-attestation-2026-05-08.json | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run provider-credentials:examples:check'`
[provider-credentials-examples-check](logs/provider-credentials-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Provider credential example templates validated. | None | | `mise exec node@24 -- bash -c 'npm run provider-readiness:check'`
[provider-readiness-check](logs/provider-readiness-check.log)
Node v22.22.3 | PASS (exit 0) | Provider readiness guards and classifications validated. | None | | `mise exec node@24 -- bash -c 'npm run public-launch:evidence:check'`
[public-launch-evidence-check](logs/public-launch-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - ELA-100 closed beta gate is not green | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'python3 ../local_services_check.py realtime'`
[realtime-smoke](logs/realtime-smoke.log)
Node v22.22.3 | PASS (exit 0) | } | None | | `mise exec node@24 -- bash -c 'npm run realtime:test'`
[realtime-test](logs/realtime-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 54
# pass 54
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; node ../reassignment-probe.mjs'`
[reassignment-probe-prepared](logs/reassignment-probe-prepared.log)
Node v24.21.0 | Defect reproduced (exit 0) | PRIOR_VERIFICATION_AFTER_REASSIGNMENT {"state":"assigned","verification_status":"verified","work":null}
Reproduced verification_tasks_due_reason_time_check failure on B resolution. | None | | `mise exec node@24 -- bash -c 'node ../reassignment-probe.mjs'`
[reassignment-probe](logs/reassignment-probe.log)
Node v22.22.3 | FAIL (exit 1) | Node.js v22.22.3 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run residency:consistency:check'`
[residency-consistency-check](logs/residency-consistency-check.log)
Node v22.22.3 | FAIL (exit 1) | - KYC runbook allows a replacement region but no legal/product region decision memo is attached | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; node --version && npm --version'`
[runtime-versions-fixed](logs/runtime-versions-fixed.log)
Node v24.21.0 | PASS (exit 0) | 11.19.0 | None | | `mise exec node@24 -- bash -c 'node --version; npm --version; command -v node; command -v npm; mise current'`
[runtime-versions](logs/runtime-versions.log)
Node v22.22.3 | PASS (exit 0) | python 3.12.13 | None | | `mise exec node@24 -- bash -c 'npm run server-hardening:evidence:check'`
[server-hardening-evidence-check](logs/server-hardening-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - server hardening docs must not claim password rotation or live TLS while artifacts are absent | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'node ../probe-dollar.mjs'`
[sql-delimiter-probe](logs/sql-delimiter-probe.log)
Node v22.22.3 | Defect reproduced (exit 0) | {"source":"actual createPreArmCommandStore SQL","exit":3,"stderr":"ERROR: syntax error at or near \"square\"\nLINE 3: ...ource\":\"address\",\"address_input\":\"Near $identity$ square\",\"a...\n ^\n"} | None | | `mise exec node@24 -- bash -c 'npm run store:evidence:check'`
[store-evidence-check](logs/store-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - store submission evidence missing Google Play Console receipt GPC-ELA-2026-05-08-001: evidence/ELA-098/receipts/GPC-ELA-2026-05-08-001.pdf | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; npm run typecheck'`
[typecheck-confirmed24](logs/typecheck-confirmed24.log)
Node v24.21.0 | PASS (exit 0) | No diagnostic output; exit 0 (there is no emitted test summary line). | None | | `mise exec node@24 -- bash -c 'npm run typecheck'`
[typecheck24](logs/typecheck24.log)
Node v22.22.3 | PASS (exit 0) | No diagnostic output; exit 0 (there is no emitted test summary line). | None | | `mise exec node@24 -- bash -c 'npm run ui:test'`
[ui-test](logs/ui-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 55
# pass 55
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run validate:eas'`
[validate-eas](logs/validate-eas.log)
Node v22.22.3 | PASS (exit 0) | EAS config validated for iOS and Android build profiles. | None | | `mise exec node@24 -- bash -c 'npm run visual-regression:evidence:check'`
[visual-regression-evidence-check](logs/visual-regression-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - visual regression evidence missing Chromatic build evidence: evidence/visual-regression/chromatic-build-2026-05-08.json | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run visual-regression:examples:check'`
[visual-regression-examples-check](logs/visual-regression-examples-check.log)
Node v22.22.3 | FAIL (exit 1) | - visual state matrix must contain exactly 38 states, found 52 | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run visual:states:check'`
[visual-states-check](logs/visual-states-check.log)
Node v22.22.3 | PASS (exit 0) | Visual state fixtures include release-critical full seeds and text assertions. | None | | `mise exec node@24 -- bash -c 'export PATH=/home/stevan/.local/share/mise/installs/node/24.21.0/bin:$PATH; PATH=/tmp/ela-review-20260912-2245/REVIEW/bin:$PATH node --test apps/api/dist/voice-notes-stitch-ffmpeg.integration.test.js'`
[voice-ffmpeg-integration](logs/voice-ffmpeg-integration.log)
Node v24.21.0 | PASS (exit 0) | ℹ tests 1
ℹ pass 1
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0 | None | | `mise exec node@24 -- bash -c 'npm run workers:evidence:check'`
[workers-evidence-check](logs/workers-evidence-check.log)
Node v22.22.3 | FAIL (exit 1) | - pg_cron verification still shows queued worker rows without live completion proof | No failing test name emitted; see log / diagnostics below | | `mise exec node@24 -- bash -c 'npm run workers:examples:check'`
[workers-examples-check](logs/workers-examples-check.log)
Node v22.22.3 | PASS (exit 0) | Worker evidence example artifacts validated. | None | | `mise exec node@24 -- bash -c 'npm run workers:test'`
[workers-test](logs/workers-test.log)
Node v22.22.3 | PASS (exit 0) | # tests 19
# pass 19
# fail 0
# cancelled 0
# skipped 0 | None | | `mise exec node@24 -- bash -c 'node scripts/check-zero-iap.mjs --self-test'`
[zero-iap-self-test](logs/zero-iap-self-test.log)
Node v22.22.3 | PASS (exit 0) | Purchase-SDK self-test passed: react-native-iap allowed; RevenueCat import, raw StoreKit self-grant, and forbidden manifest dependency all failed as expected. | None | | `mise exec node@24 -- bash -c 'node scripts/check-zero-iap.mjs'`
[zero-iap](logs/zero-iap.log)
Node v22.22.3 | PASS (exit 0) | Purchase-SDK guard passed: no forbidden purchase SDKs (RevenueCat et al.) and no client-side entitlement self-grant patterns found. react-native-iap is the only sanctioned purchase SDK. | None | ## Result interpretation and setup failures - Cold `npm run ci` stopped at lint with4,686 errors before shared-package declarations were built. The unchanged CI order runs lint before the initial TypeScript build. After building the graph, lint and typecheck passed; this does not establish4,686 independent new source defects. The overall cold gate is still recorded as failed. - The lifecycle fixture gate initially saw no tracked source in the archive’s inherited Git context. Re-running with explicit `GIT_DIR`/`GIT_WORK_TREE` passed all5 helper tests and the gate. - `admin:smoke` and `admin:browser-smoke` completed assertions but did not terminate; success text is not converted to an exit0 run. Initial Chrome DevTools failure and occupied3100 startup failures were followed by real free-port/Linux runs. - Fresh admin visual regression:19failed/9passed. Five v1-read failures are the independently confirmed branch regression. Other failures include visual baseline/font differences, absent Linux snapshots, a contrast-debt assertion, a document popup timeout and obsolete Triage heading expectations. Artifact capture also fails its expected target selector. All names are below; no baseline was approved or changed in the real tree. - Schemathesis4.26.1 used the CI `--checks all --max-examples25` settings against a freshly started loopback API:2,811 cases,90 distinct failures across the96 v1 operations. Failures include undocumented responses, positive-data schema rejection, negative-data acceptance and method/auth ordering. These are not90 independently established new product bugs. The operation/check labels are retained below. - PostgreSQL results include harness cancellations and stale test expectations as well as assertion failures. The new DSAR truth tests expect200 despite the intentional503 guard; the corresponding safety tests correctly preserve the hold. The notification claim scenario reports that its controlled provider was never reached; timing/root cause is not attributed without proof. The large composition test’s parent120-second timeout cascades into unstarted/cancelled subtests; those names are retained. - Opt-in old contract probes that require DATABASE_URL were given a separately migrated local schema.33passed,2failed,1liveAPNs check remained skipped. Failures: the OTP test’s replaced in-memory users handle is not updated, and one signed-link test expected200 but got410. These are not represented as proof of a new authorization defect. - Evidence gates intentionally remain red where signed/provider/device/live artifacts are missing. `production:readiness:check` additionally crashes on the pre-existing missing HelpContactOpsScreen.tsx read; visual-evidence/example gates expect38states while the unchanged matrix has52. These pre-existing gate defects are not assigned to this diff. - `npm ci` reports23dependency vulnerabilities (10moderate,12high,1critical); dependency declarations and the lockfile are unchanged by the branch; the API workspace script changes test concurrency. No dependency remediation or remote advisory investigation was part of this review. ## Suites not executable within the authorized environment | Suite / entrypoint | Exact reason / coverage | |---|---| | `npm run visual:ios`, `visual:ios:critical`, `visual:ios:state-matrix`, `visual:ios:user-flows` | Require macOS/Xcode/xcrun, simulator/dev-client and Maestro; unavailable on Linux. `acceptance:local` includes these and therefore cannot complete here. Mobile JS unit/document flow and both Expo bundle exports were exercised. | | `npm run visual:android`, `visual:android:critical` | Preflight executed and reports missing adb, Maestro and Android SDK/emulator directories. These are device/emulator flows, outside the requested device-free Linux subset. | | Apple Watch/native/APNs/FCM/StoreKit tests and CI iOS simulator job | Require Apple tooling, actual devices and/or live credentials. Presentation contracts/unit checks pass where included; no native background or provider-delivery acceptance is asserted. | | Live renewal APNs/provider/SMS/email/KYC/IAP/capture scripts | Need live credentials, seed identity and external delivery or deployment; user forbids remote actions. The APNs opt-in test retains its explicit skip. Local controlled providers and relevant store tests were run. | | `just check` | `just` is not installed. Its typecheck, API/mobile tests, lint and zero-IAP constituent commands were run. `just sim`, `just ship`, deploy and signing recipes are not Linux review tests and were not run. | | Archived `docs/qa/2026-09-05-end-to-end-review/scripts/{connected-journeys,kyc-journey,runtime-probes,realtime-close}.mjs` | Historical runner depends on a macOS-specific Node path, redacted realtime secrets, missing private seed-state.json and long-lived fixed-port services. The seed script writes session tokens into its evidence file; it was not executed as a safe current regression suite. Current local smoke/Chrome/Playwright/realtime/document checks provide executable Linux coverage. | | `admin:public-portal-smoke` | Its public-firm hydration test is included in the full admin:visual run; the alias is not counted as an additional independent pass. | | `admin:visual:update` / evidence capture / release/shipping helpers | Mutation or operational recipes, not additional test suites. No snapshots were approved and no provider, production, remote report or application deployment was performed. | ## Failure appendix Names are taken from test output (including parent/cancelled entries); count-of-names can differ from a runner’s failed-test count. Full diagnostic context remains in the linked log. ### admin-visual-artifacts-freeports - [chromium] › apps/admin/tests/visual/admin-v2-artifacts.spec.ts:320:5 › captures AV2-005 before goldens and wireframe references ### admin-visual-freeports - [chromium] › apps/admin/tests/visual/card.spec.ts:31:7 › Card primitive › renders wireframe card header, actions, and visual baseline - [chromium] › apps/admin/tests/visual/confirm-dialog.spec.ts:43:7 › ConfirmDialog primitive › renders icon box, typed-match state, inert background, reduced motion, axe, and visual baseline - [chromium] › apps/admin/tests/visual/doc-thumb.spec.ts:38:7 › DocThumb primitive › renders hatched document thumbnails, type tags, and visual baseline - [chromium] › apps/admin/tests/visual/empty-state.spec.ts:31:7 › EmptyState primitive › renders wireframe icon, message, action, axe, and visual baseline - [chromium] › apps/admin/tests/visual/kpi-card.spec.ts:31:7 › KpiCard primitive › matches visual baseline and passes axe with reduced motion - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1424:9 › admin portal visual baselines › close-case confirmation requires a canonical reason in light mode - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1424:9 › admin portal visual baselines › close-case confirmation requires a canonical reason in dark mode - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1500:7 › admin portal visual baselines › firm panel states each firm's duty roster and seeds the editor from it - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1601:7 › admin portal visual baselines › firm-panel contrast debt predates the roster editor (it is the surface's own token) - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1822:7 › admin portal visual baselines › copy brief link puts the server's own minted URL on the clipboard - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1886:7 › admin portal visual baselines › a refused re-issue is reported and leaves the clipboard untouched - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1938:7 › admin portal visual baselines › LR-020b renders durable access evidence without invented issuance facts - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:1987:7 › admin portal visual baselines › LR-026 coverage reviewer can open the member-scoped document - [chromium] › apps/admin/tests/visual/portal-routes.spec.ts:2041:9 › admin portal visual baselines › admin-portal matches its committed baseline - [chromium] › apps/admin/tests/visual/segmented-control.spec.ts:31:7 › SegmentedControl primitive › renders wireframe segments and passes axe - [chromium] › apps/admin/tests/visual/sla-donut.spec.ts:39:7 › SlaDonut primitive › renders elapsed-fill tones and passes axe - [chromium] › apps/admin/tests/visual/status-badge.spec.ts:33:7 › StatusBadge primitive › renders all wireframe variants and passes axe - [chromium] › apps/admin/tests/visual/timeline.spec.ts:31:7 › Timeline primitive › renders wireframe timeline states and passes axe - [chromium] › apps/admin/tests/visual/toast.spec.ts:50:7 › Toast primitive › renders wireframe classes, reduced motion, axe, and visual baseline ### api-contract-fuzz - DELETE /trusted-contacts/{contact_id} — Undocumented HTTP status code - GET /admin/kyc/manual-reviews — Undocumented HTTP status code - GET /kyc/status — Undocumented HTTP status code - GET /kyc/status — Undocumented HTTP status code - GET /subscription/status — Undocumented HTTP status code - GET /trusted-contacts — Undocumented HTTP status code - PATCH /admin/directories/consulates/{consulate_id} — Unsupported methods - PATCH /admin/directories/law-firms/{firm_id} — Unsupported methods - PATCH /admin/directories/police-stations/{police_station_id} — Unsupported methods - PATCH /admin/directories/public-holidays/{holiday_id} — Unsupported methods - POST /admin/auth/login — Undocumented HTTP status code - POST /admin/auth/login — API rejected schema-compliant request - POST /admin/kyc/manual-reviews/{review_id}/decision — Undocumented HTTP status code - POST /auth/otp — Undocumented HTTP status code - POST /auth/otp — API rejected schema-compliant request - POST /auth/otp/request — API rejected schema-compliant request - POST /auth/otp/verify — Undocumented HTTP status code - POST /cases/dispatch — API rejected schema-compliant request - POST /cases/{case_id}/client-attestation — Undocumented HTTP status code - POST /cases/{case_id}/client-attestation — Undocumented HTTP status code - POST /cases/{case_id}/close — Undocumented HTTP status code - POST /cases/{case_id}/locations — API rejected schema-compliant request - POST /device-push-tokens — Undocumented HTTP status code - POST /documents/upload — API rejected schema-compliant request - POST /firm/cases/{case_id}/decline — Undocumented HTTP status code - POST /firm/cases/{case_id}/need-info — Undocumented HTTP status code - POST /kyc/sumsub/access-token — API rejected schema-compliant request - POST /magic-links/exchange — Undocumented HTTP status code - POST /payments/apple-refund-intent — Undocumented HTTP status code - POST /payments/checkout — Undocumented HTTP status code - POST /payments/checkout — API rejected schema-compliant request - POST /payments/money-back-refund — Undocumented HTTP status code - POST /payments/restore-entitlement — Undocumented HTTP status code - POST /trusted-contacts — Undocumented HTTP status code - POST /webhooks/appstore — Server error - POST /webhooks/appstore — Undocumented HTTP status code - POST /webhooks/resend — Server error - POST /webhooks/revenuecat — Server error - POST /webhooks/revenuecat — Undocumented HTTP status code - PUT /family-shield/roster — API rejected schema-compliant request - PUT /kyc/profile/address — Undocumented HTTP status code - PUT /kyc/profile/address — Undocumented HTTP status code - PUT /kyc/profile/medical — Undocumented HTTP status code - PUT /kyc/profile/medical — Undocumented HTTP status code - PUT /kyc/profile/personal — Undocumented HTTP status code - PUT /kyc/profile/personal — Undocumented HTTP status code - PUT /kyc/profile/priors — Undocumented HTTP status code - PUT /kyc/profile/priors — API rejected schema-compliant request - PUT /trusted-contacts/{contact_id} — Undocumented HTTP status code - TRACE /admin/cases/firm-contact-confirmation-tick — Unsupported methods - TRACE /admin/cases/firm-sla-tick — Unsupported methods - TRACE /admin/config/underwriter — Unsupported methods - TRACE /admin/insurance/claims/prior-exclusion-check — Unsupported methods - TRACE /admin/insurance/policy-number — Unsupported methods - TRACE /admin/insurance/policy-number/preview — Unsupported methods - TRACE /admin/kyc/document-exceptions — Unsupported methods - TRACE /admin/kyc/manual-reviews — Unsupported methods - TRACE /admin/runtime-mode — Unsupported methods - TRACE /admin/verification/followups — Unsupported methods - TRACE /admin/verification/tasks — Unsupported methods - TRACE /auth/otp/request — Unsupported methods - TRACE /cases/dispatch — Unsupported methods - TRACE /device-push-tokens — Unsupported methods - TRACE /documents — Unsupported methods - TRACE /documents/pre-screen — Unsupported methods - TRACE /documents/signed — Unsupported methods - TRACE /documents/signed-url — Unsupported methods - TRACE /documents/upload — Unsupported methods - TRACE /family-shield/adult-invite — Unsupported methods - TRACE /family-shield/adult-invite/consent — Unsupported methods - TRACE /family-shield/adult-invite/context — Unsupported methods - TRACE /family-shield/adult-invite/declaration — Unsupported methods - TRACE /family-shield/roster — Unsupported methods - TRACE /health — Unsupported methods - TRACE /kyc/sumsub/access-token — Unsupported methods - TRACE /payments/capabilities — Unsupported methods - TRACE /plans/interstitial — Unsupported methods - TRACE /plans/tier-picker — Unsupported methods - TRACE /police-stations — Unsupported methods - TRACE /readiness/stakeholders — Unsupported methods - TRACE /subscription/apple/purchase-intent — Unsupported methods - TRACE /subscription/apple/verify — Unsupported methods - TRACE /subscription/purchase-eligibility — Unsupported methods - TRACE /subscription/receipts — Unsupported methods - TRACE /support/tickets — Unsupported methods - TRACE /trusted-contact/status — Unsupported methods - TRACE /webhooks/appstore — Unsupported methods - TRACE /webhooks/email — Unsupported methods - TRACE /webhooks/sumsub — Unsupported methods - TRACE /webhooks/twilio/status — Unsupported methods ### api-integration-prepared - two independent stores do not submit the same live claim - an accepted send with a failed result write recovers as unknown, then retries - an early delivery callback survives the send result, retry and restart - terminal failure survives restart and queues one real ops notice - durable legacy delivery workers claim once and retain uncertain provider outcomes - durable relational delivery workers claim once and retain uncertain provider outcomes - verified HTTP callback changes the member's polled delivery status - insurance handoff rolls back every audit store and rejects a stale reviewed case - session storage failures cannot confirm sign-out or authorize member actions - default relational composition commits and restores cases and deadmen - a committed grace notice survives loss of the post-commit caller - member pushes claim each device once across concurrent workers and restart - provider timeout retains uncertainty and retries the same durable delivery - database loss after provider acceptance is recoverable uncertainty, not rejection - a committed provider result with a lost database reply is never sent again - missing configuration and Android support stay explicit recoverable holds - revoked or reassigned tokens and duress never authorize a provider send - provider rejection revokes only the still-current device registration - a delayed provider rejection cannot revoke a newer registration - provider credentials can recover without burning the member retry budget - repeated rejected sends exhaust three retries without inventing member delivery - a lifecycle-intent failure rolls back its case transition and receipt - overdue verification moves canonical ownership to a new pending firm - concurrent grace processors commit one ownership transition - a failed grace audit rolls back task, ownership and notification intents - grace resolves a lost commit reply without a second mutation - operator verification wins a race before the grace commit - an ownership change wins a race before the grace commit - grace rechecks a replacement paused before commit - grace escalates to operations when no eligible replacement remains - the real API entrypoint catches up overdue grace after restart - a disputed follow-up creates durable actionable triage and keeps resolution blocked - dispute claim and decisions enforce roles, ownership, evidence, replay and restart - dispute audit failure rolls back and lost commit replies replay one saved action - a valid dispute stays unverified and escalation records actual operations takeover - dispute decisions reject changed assignment and historical review cannot verify its replacement - operator work reads current ownership and Triage fails closed when that read is unavailable - conditional follow-up can be closed with audited final evidence before case resolution - follow-up access, validation and stale MFA fail before mutation - concurrent follow-up retries keep one receipt through restart and reject changed evidence - follow-up audit failure rolls back evidence and ownership; a lost reply recovers its receipt - failed contact stands down only the current firm and queues a new unaccepted assignment - a historical follow-up cannot change replacement firm ownership or verification - two operators cannot commit different final findings for one follow-up - follow-up closure rechecks ownership when another operator reassigns before commit - failed-contact follow-up reselects after a firm pause and escalates when none remain - member follow-up evidence stays separate until the operator records its final outcome - the explicit member route records PIN truth and rejects stale or mismatched evidence - follow-up member retries survive another instance and preserve a saved receipt after operator closure - follow-up evidence rolls back with audit failure and recovers a lost commit reply - new member routes enforce session revocation and current task ownership - follow-up evidence shares the case attempt limit and cannot prove another follow-up - a foreign member cannot attest another member's case - apps/api/dist/case-storage-composition.integration.test.js - apps/api/dist/device-push-storage.integration.test.js - apps/api/dist/dsar-fulfilment-safety.integration.test.js - apps/api/dist/dsar-fulfilment-truth.integration.test.js - apps/api/dist/dsar-request-durability.integration.test.js - apps/api/dist/dsarExportCollector.integration.test.js - apps/api/dist/dsarIdentityChallenge.integration.test.js - apps/api/dist/entitlement-current-read.integration.test.js - apps/api/dist/help-audit.integration.test.js - apps/api/dist/help-case-action.integration.test.js - apps/api/dist/help-durability.integration.test.js - apps/api/dist/help-reply-push.integration.test.js - apps/api/dist/help-request-keys.integration.test.js - apps/api/dist/help-writer-fence.integration.test.js - apps/api/dist/issued-policy-terms.integration.test.js - apps/api/dist/payment-receipt-storage.integration.test.js - apps/api/dist/predispatch-deadman-store.integration.test.js - apps/api/dist/snapshot-writer-fence.integration.test.js - apps/api/dist/voice-notes-dsar-durability.integration.test.js - apps/api/dist/voice-notes-stitch-ffmpeg.integration.test.js ### api-integration-remaining - two independent stores do not submit the same live claim - an accepted send with a failed result write recovers as unknown, then retries - an early delivery callback survives the send result, retry and restart - terminal failure survives restart and queues one real ops notice - verified HTTP callback changes the member's polled delivery status - durable legacy delivery workers claim once and retain uncertain provider outcomes - durable relational delivery workers claim once and retain uncertain provider outcomes - export cannot return fixture counts for an empty member - delete cannot return fixture counts for an empty member - durable privacy fulfilment reports actual storage work ### api-integration-serial - two independent stores do not submit the same live claim - an accepted send with a failed result write recovers as unknown, then retries - durable legacy delivery workers claim once and retain uncertain provider outcomes - durable relational delivery workers claim once and retain uncertain provider outcomes - provider timeout retains uncertainty and retries the same durable delivery - default relational composition commits and restores cases and deadmen - database loss after provider acceptance is recoverable uncertainty, not rejection - a committed provider result with a lost database reply is never sent again - missing configuration and Android support stay explicit recoverable holds - revoked or reassigned tokens and duress never authorize a provider send - provider rejection revokes only the still-current device registration - a delayed provider rejection cannot revoke a newer registration - provider credentials can recover without burning the member retry budget - repeated rejected sends exhaust three retries without inventing member delivery - a lifecycle-intent failure rolls back its case transition and receipt - overdue verification moves canonical ownership to a new pending firm - concurrent grace processors commit one ownership transition - a failed grace audit rolls back task, ownership and notification intents - grace resolves a lost commit reply without a second mutation - operator verification wins a race before the grace commit - an ownership change wins a race before the grace commit - grace rechecks a replacement paused before commit - grace escalates to operations when no eligible replacement remains - the real API entrypoint catches up overdue grace after restart - a disputed follow-up creates durable actionable triage and keeps resolution blocked - dispute claim and decisions enforce roles, ownership, evidence, replay and restart - dispute audit failure rolls back and lost commit replies replay one saved action - a valid dispute stays unverified and escalation records actual operations takeover - dispute decisions reject changed assignment and historical review cannot verify its replacement - operator work reads current ownership and Triage fails closed when that read is unavailable - conditional follow-up can be closed with audited final evidence before case resolution - follow-up access, validation and stale MFA fail before mutation - concurrent follow-up retries keep one receipt through restart and reject changed evidence - follow-up audit failure rolls back evidence and ownership; a lost reply recovers its receipt - failed contact stands down only the current firm and queues a new unaccepted assignment - a historical follow-up cannot change replacement firm ownership or verification - two operators cannot commit different final findings for one follow-up - follow-up closure rechecks ownership when another operator reassigns before commit - failed-contact follow-up reselects after a firm pause and escalates when none remain - member follow-up evidence stays separate until the operator records its final outcome - the explicit member route records PIN truth and rejects stale or mismatched evidence - follow-up member retries survive another instance and preserve a saved receipt after operator closure - follow-up evidence rolls back with audit failure and recovers a lost commit reply - new member routes enforce session revocation and current task ownership - follow-up evidence shares the case attempt limit and cannot prove another follow-up - a foreign member cannot attest another member's case - export cannot return fixture counts for an empty member - delete cannot return fixture counts for an empty member - durable privacy fulfilment reports actual storage work ### api-integration - POST /auth/otp/request creates the user and persists a hashed OTP row - relational case commands commit state, intents and receipts atomically in Postgres - imports all case evidence atomically and keeps original request receipts - changed source and canonical conflicts cannot partially import - exact exports detect tampering and refuse numeric precision loss - delivery before a send result keeps the missing acceptance time - a second process finishing between receipt read and preview is replayed - maintenance CLI requires a private verified export and records only safe output - late audit failure rolls back cases, intents, attempts and adoption marker - lost commit acknowledgement and simultaneous adoption resolve to one receipt - checked legacy adoption preserves evidence and refuses ambiguous or changing data - two independent stores do not submit the same live claim - an accepted send with a failed result write recovers as unknown, then retries - durable legacy delivery workers claim once and retain uncertain provider outcomes - durable relational delivery workers claim once and retain uncertain provider outcomes - database loss after provider acceptance is recoverable uncertainty, not rejection - default relational composition commits and restores cases and deadmen - a committed provider result with a lost database reply is never sent again - missing configuration and Android support stay explicit recoverable holds - revoked or reassigned tokens and duress never authorize a provider send - provider rejection revokes only the still-current device registration - a delayed provider rejection cannot revoke a newer registration - provider credentials can recover without burning the member retry budget - repeated rejected sends exhaust three retries without inventing member delivery - a lifecycle-intent failure rolls back its case transition and receipt - overdue verification moves canonical ownership to a new pending firm - concurrent grace processors commit one ownership transition - a failed grace audit rolls back task, ownership and notification intents - grace resolves a lost commit reply without a second mutation - operator verification wins a race before the grace commit - an ownership change wins a race before the grace commit - grace rechecks a replacement paused before commit - grace escalates to operations when no eligible replacement remains - the real API entrypoint catches up overdue grace after restart - a disputed follow-up creates durable actionable triage and keeps resolution blocked - dispute claim and decisions enforce roles, ownership, evidence, replay and restart - dispute audit failure rolls back and lost commit replies replay one saved action - a valid dispute stays unverified and escalation records actual operations takeover - dispute decisions reject changed assignment and historical review cannot verify its replacement - operator work reads current ownership and Triage fails closed when that read is unavailable - conditional follow-up can be closed with audited final evidence before case resolution - follow-up access, validation and stale MFA fail before mutation - concurrent follow-up retries keep one receipt through restart and reject changed evidence - follow-up audit failure rolls back evidence and ownership; a lost reply recovers its receipt - failed contact stands down only the current firm and queues a new unaccepted assignment - a historical follow-up cannot change replacement firm ownership or verification - two operators cannot commit different final findings for one follow-up - follow-up closure rechecks ownership when another operator reassigns before commit - failed-contact follow-up reselects after a firm pause and escalates when none remain - member follow-up evidence stays separate until the operator records its final outcome - the explicit member route records PIN truth and rejects stale or mismatched evidence - follow-up member retries survive another instance and preserve a saved receipt after operator closure - follow-up evidence rolls back with audit failure and recovers a lost commit reply - new member routes enforce session revocation and current task ownership - follow-up evidence shares the case attempt limit and cannot prove another follow-up - a foreign member cannot attest another member's case - export cannot return fixture counts for an empty member - delete cannot return fixture counts for an empty member - durable privacy fulfilment reports actual storage work - Help completion and both operator audit records commit together - reply requires a current open case owned by the request member: open - close requires a current open case owned by the request member: open - a Help completion that holds the case lock commits before later closure - simultaneous operators can commit only one reply - Case Help legacy actions serialize with case closure - Case Help relational actions serialize with case closure - Help storage acknowledges durable work and preserves concurrent changes - a timed-out late commit is found by the same key on another instance - Help member request keys prevent a lost response from duplicating work - durable deadman decisions use committed state across API instances ### legacy-postgres-contracts - POST /auth/otp/request creates the user and persists a hashed OTP row - LR-020b admin case detail and records ledger expose only real signed-link access rows ## Evidence-gate diagnostics ### analytics-evidence-check - analytics evidence missing live PostHog docker compose ps output: evidence/ELA-009/live/docker-compose-ps.txt - analytics evidence missing live PostHog health check output: evidence/ELA-009/live/posthog-health.txt - analytics evidence missing live PostHog smoke output: evidence/ELA-009/live/posthog-smoke-output.json - analytics evidence missing live captured-event query proof: evidence/ELA-009/live/capture-query-proof.json - analytics evidence missing self-hosted PostHog project settings export: evidence/ELA-009/live/project-settings.json - ELA-009 README has incomplete checklist item: - [ ] `evidence/ELA-009/live/docker-compose-ps.txt` - ELA-009 README has incomplete checklist item: - [ ] `evidence/ELA-009/live/posthog-health.txt` - ELA-009 README has incomplete checklist item: - [ ] `evidence/ELA-009/live/posthog-smoke-output.json` - ELA-009 README has incomplete checklist item: - [ ] `evidence/ELA-009/live/capture-query-proof.json` - ELA-009 README has incomplete checklist item: - [ ] `evidence/ELA-009/live/project-settings.json` - ELA-009 README records unresolved analytics evidence: The repository-side hard gate is enforced by `npm run ci`. Live evidence requires production secrets and a PostHog project key, which are intentionally not committed. Capture the required live artifacts with `ELA_009_RUN_LIVE=1 scripts/capture-analytics-evidence.sh` during the approved deployment window. - ELA-009 live README records unresolved analytics evidence: # ELA-009 — Live evidence (deferred) - ELA-009 live README records unresolved analytics evidence: fail while this file records deferred live evidence or while the live artifacts - ELA-009 live README records unresolved analytics evidence: Live deploy **deferred** until the expanded ClickHouse-backed compose is installed on the VPS and the live evidence artifacts are captured. This remains a non-trivial disk/RAM expansion; ClickHouse alone is roughly 3-5 GB for a usable single-node setup. - ELA-009 live README records unresolved analytics evidence: This task remains **artifactComplete: true, liveEvidenceComplete: false**. Re-attempt when: - ELA-009 live README records unresolved analytics evidence: Stack torn down to free VPS resources. ### android-preflight - adb is required for Android visual testing: platform-tools device control and screenshots; PATH plus ANDROID_HOME/ANDROID_SDK_ROOT/default SDK locations were checked - maestro is required for Android visual testing: rendered text assertions for critical Android states - ANDROID_HOME= - ANDROID_SDK_ROOT= - Checked tool directories: ### arrest-rehearsal-evidence-check - provider sandbox evidence directory missing: provider-sandbox/ela-099/2026-q2 - provider sandbox evidence missing required file: provider-sandbox/ela-099/2026-q2/twilio.json - provider sandbox evidence missing required file: provider-sandbox/ela-099/2026-q2/email.json - provider sandbox evidence missing required file: provider-sandbox/ela-099/2026-q2/nightwatch.json - provider sandbox evidence missing recipient allowlist: provider-sandbox/ela-099/2026-q2/recipient-allowlist.json ### closed-beta-evidence-check - closed beta evidence missing law-firm live-intake matrix: evidence/ELA-100/directories/law-firm-live-intake-matrix-2026-05-08.json - closed beta evidence missing UK/AU consulate verification matrix: evidence/ELA-100/directories/consulate-uk-au-verification-2026-05-08.json - closed beta evidence missing runbook tabletop rehearsal sign-off: evidence/ELA-100/runbooks/tabletop-rehearsal-signoff-2026-05-08.json - closed beta evidence missing ops paging drill evidence: evidence/ELA-100/paging/ops-paging-drills-2026-05-08.json - closed beta evidence missing closed-beta region-proof attestation: evidence/ELA-100/attestations/region-proof-2026-05-08.json - closed beta evidence missing two-week beta SLA ledger: evidence/ELA-100/beta-run/sla-ledger-2026-05-08.json - closed beta evidence missing PRD §28 acceptance matrix proof: evidence/ELA-100/prd-28-acceptance-matrix-2026-05-08.json - closed beta provider sandbox recipient allowlist missing: provider-sandbox/ela-100/2026-beta/recipient-allowlist.json - DXB law firm readiness row is not passing - AUH law firm readiness row is not passing - SHJ law firm readiness row is not passing - AJM law firm readiness row is not passing - RAK law firm readiness row is not passing - UAQ law firm readiness row is not passing - FUJ law firm readiness row is not passing - consulate verification missing passing GB row - consulate verification missing passing AU row - rehearsal row is not passing: | OPS-ELA-100-R01 | 2026-04-24T09:00:00+04:00 | Business hours | 5 | `twilio/r01.json` | `email/r01.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R01 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r01.json - closed beta evidence missing OPS-ELA-100-R01 email delivery log: provider-sandbox/ela-100/2026-beta/email/r01.json - rehearsal row is not passing: | OPS-ELA-100-R02 | 2026-04-25T22:00:00+04:00 | Off-hours | 5 | `twilio/r02.json` | `email/r02.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R02 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r02.json - closed beta evidence missing OPS-ELA-100-R02 email delivery log: provider-sandbox/ela-100/2026-beta/email/r02.json - rehearsal row is not passing: | OPS-ELA-100-R03 | 2026-04-27T11:30:00+04:00 | Business hours | 5 | `twilio/r03.json` | `email/r03.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R03 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r03.json - closed beta evidence missing OPS-ELA-100-R03 email delivery log: provider-sandbox/ela-100/2026-beta/email/r03.json - rehearsal row is not passing: | OPS-ELA-100-R04 | 2026-04-28T02:15:00+04:00 | Off-hours | 5 | `twilio/r04.json` | `email/r04.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R04 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r04.json - closed beta evidence missing OPS-ELA-100-R04 email delivery log: provider-sandbox/ela-100/2026-beta/email/r04.json - rehearsal row is not passing: | OPS-ELA-100-R05 | 2026-04-30T16:45:00+04:00 | Business hours | 5 | `twilio/r05.json` | `email/r05.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R05 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r05.json - closed beta evidence missing OPS-ELA-100-R05 email delivery log: provider-sandbox/ela-100/2026-beta/email/r05.json - rehearsal row is not passing: | OPS-ELA-100-R06 | 2026-05-01T23:40:00+04:00 | Off-hours | 5 | `twilio/r06.json` | `email/r06.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R06 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r06.json - closed beta evidence missing OPS-ELA-100-R06 email delivery log: provider-sandbox/ela-100/2026-beta/email/r06.json - rehearsal row is not passing: | OPS-ELA-100-R07 | 2026-05-03T10:10:00+04:00 | Business hours | 5 | `twilio/r07.json` | `email/r07.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R07 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r07.json - closed beta evidence missing OPS-ELA-100-R07 email delivery log: provider-sandbox/ela-100/2026-beta/email/r07.json - rehearsal row is not passing: | OPS-ELA-100-R08 | 2026-05-04T04:05:00+04:00 | Off-hours | 5 | `twilio/r08.json` | `email/r08.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R08 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r08.json - closed beta evidence missing OPS-ELA-100-R08 email delivery log: provider-sandbox/ela-100/2026-beta/email/r08.json - rehearsal row is not passing: | OPS-ELA-100-R09 | 2026-05-06T14:20:00+04:00 | Business hours | 5 | `twilio/r09.json` | `email/r09.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R09 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r09.json - closed beta evidence missing OPS-ELA-100-R09 email delivery log: provider-sandbox/ela-100/2026-beta/email/r09.json - rehearsal row is not passing: | OPS-ELA-100-R10 | 2026-05-07T21:10:00+04:00 | Off-hours | 5 | `twilio/r10.json` | `email/r10.json` | Unverified | - closed beta evidence missing OPS-ELA-100-R10 Twilio delivery log: provider-sandbox/ela-100/2026-beta/twilio/r10.json - closed beta evidence missing OPS-ELA-100-R10 email delivery log: provider-sandbox/ela-100/2026-beta/email/r10.json - closed beta evidence missing DSAR-ELA-100-01 DSAR export: evidence/ELA-100/dsar/drill-01-export.json - closed beta evidence missing DSAR-ELA-100-01 DSAR delete audit: evidence/ELA-100/dsar/drill-01-delete-audit.json - closed beta evidence missing DSAR-ELA-100-02 DSAR export: evidence/ELA-100/dsar/drill-02-export.json - closed beta evidence missing DSAR-ELA-100-02 DSAR delete audit: evidence/ELA-100/dsar/drill-02-delete-audit.json - closed beta evidence missing DSAR-ELA-100-03 DSAR export: evidence/ELA-100/dsar/drill-03-export.json - closed beta evidence missing DSAR-ELA-100-03 DSAR delete audit: evidence/ELA-100/dsar/drill-03-delete-audit.json - ELA-095 PDPL evidence pack gate is not green - Residency consistency gate is not green - ELA-096 outsourced on-call vendor gate is not green - ELA-097 pen-test closure gate is not green - ELA-099 arrest-simulation rehearsal gate is not green - ELA-098 store submission gate is not green ### legal-policy-evidence-check - legal policy evidence missing privacy policy counsel review: legal/policies/ela-privacy-policy-counsel-review-2026-05-08.pdf - legal policy evidence missing Terms of Service counsel review: legal/policies/ela-terms-of-service-counsel-review-2026-05-08.pdf - legal policy evidence missing privacy and ToS counsel sign-off: legal/policies/ela-privacy-tos-counsel-signoff-2026-05-08.pdf ### observability-evidence-check - observability evidence missing live observability docker compose ps output: evidence/ELA-011/live/docker-compose-ps.txt - observability evidence missing live observability smoke output: evidence/ELA-011/live/observability-smoke-output.txt - observability evidence missing Sentry synthetic event export: evidence/ELA-011/live/sentry-synthetic-event.json - observability evidence missing Loki observability-smoke query export: evidence/ELA-011/live/loki-observability-smoke-query.json - observability evidence missing live redaction query proof: evidence/ELA-011/live/redaction-query-proof.json - observability evidence missing health/synthetic alert rule export: evidence/ELA-011/live/alert-rule-export.json - ELA-011 README records unresolved observability evidence: | Sentry self-hosted on UK VPS receives synthetic error | Pending live `scripts/observability-smoke.mjs` output and Sentry event screenshot/export | - ELA-011 README records unresolved observability evidence: | Loki ingests structured logs from workers + admin | Pending Loki query result for `component=observability-smoke`; worker/admin wiring follows when those services deploy | - ELA-011 README records unresolved observability evidence: | Health/synthetic ingestion wired to alerting | Pending alert rule or on-call evidence after live Sentry project is initialized | - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/docker-compose-ps.txt` - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/observability-smoke-output.txt` - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/sentry-synthetic-event.json` - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/loki-observability-smoke-query.json` - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/redaction-query-proof.json` - ELA-011 README has incomplete checklist item: - [ ] `evidence/ELA-011/live/alert-rule-export.json` - ELA-011 README records unresolved observability evidence: Repository-side implementation is complete: self-hosted Docker Compose manifest, SDK-level scrubber, adversarial tests, smoke harness, CI invariant guard, and guarded live capture script are committed. Live VPS installation and captured artifacts remain operational evidence items. Capture them with `ELA_011_RUN_LIVE=1 scripts/capture-observability-evidence.sh` during the approved deployment window. - ELA-011 live README records unresolved observability evidence: # ELA-011 — Live evidence (deferred) - ELA-011 live README records unresolved observability evidence: Live deploy **not attempted** in this session. Reasoning: - ELA-011 live README records unresolved observability evidence: must fail while this file records deferred live evidence or while the live - ELA-011 live README records unresolved observability evidence: - Original live deploy was deferred because the earlier compose covered Sentry web/worker/cron + Postgres + Redis, but not **Snuba** + **ClickHouse** for the events index. - ELA-011 live README records unresolved observability evidence: Live deploy deferred. For now: - ELA-011 live README records unresolved observability evidence: This task remains **artifactComplete: true, liveEvidenceComplete: false**. Re-attempt when: ### oncall-evidence-check - on-call vendor evidence missing Nightwatch signed DPA: legal/vendor-dpa/nightwatch-response-services-2026-05-08.pdf - on-call vendor evidence missing Nightwatch paging sign-off: legal/vendor-dpa/nightwatch-ela-096-paging-signoff-2026-05-08.pdf - on-call vendor evidence missing Nightwatch paging drill evidence: evidence/ELA-096/live/nightwatch-paging-drills-2026-05-08.json ### pdpl-evidence-check - data-flow-map.md missing PII field/class: Trusted contact name/phone/channel - PDPL evidence pack missing legal and compliance PDPL sign-off memo: evidence/ELA-095/approvals/legal-compliance-signoff-2026-05-08.pdf - PDPL evidence pack missing May 2026 region attestation export: evidence/ELA-095/attestations/region-attestation-2026-05.json - PDPL evidence pack missing May 2026 egress audit export: evidence/ELA-095/attestations/egress-audit-2026-05.json - PDPL evidence pack missing subprocessor DPA register: evidence/ELA-095/dpa/subprocessor-dpa-register-2026-05.pdf - subprocessors.md has incomplete sign-off checklist item: - [ ] Legal confirms Akamai/Linode London residency override for beta. - subprocessors.md has incomplete sign-off checklist item: - [ ] Legal confirms AWS `me-central-1` S3/KMS DPA and region terms. - subprocessors.md has incomplete sign-off checklist item: - [ ] Legal confirms KYC, billing, push, SMS/WhatsApp/email, maps, on-call, - subprocessors.md has incomplete sign-off checklist item: - [ ] Compliance confirms monthly region attestation and egress audit cadence. - subprocessors.md has incomplete sign-off checklist item: - [ ] Product/ops confirms user-facing privacy notice reflects these transfers. - ELA-095 README has incomplete sign-off checklist item: - [ ] `evidence/ELA-095/approvals/legal-compliance-signoff-2026-05-08.pdf` - ELA-095 README has incomplete sign-off checklist item: - [ ] `evidence/ELA-095/attestations/region-attestation-2026-05.json` - ELA-095 README has incomplete sign-off checklist item: - [ ] `evidence/ELA-095/attestations/egress-audit-2026-05.json` - ELA-095 README has incomplete sign-off checklist item: - [ ] `evidence/ELA-095/dpa/subprocessor-dpa-register-2026-05.pdf` - monthly region attestation row is not final: 2026-05-08 | Akamai Connected Cloud London v1 per `evidence/ELA-002/provisioning-snapshot.txt`; UAE residency override remains documented | Raw documents, generated packets, backups, and case-audit exports required to remain AWS `me-central-1`; live AWS evidence pending ELA-004/ELA-016 external resource checks | Subprocessor list reconciled in `subprocessors.md`; no unlisted egress approved for beta | Compliance owner: pending PR approval; Legal owner: pending PR approval - monthly region attestation row lacks compliance and legal approval: 2026-05-08 | Akamai Connected Cloud London v1 per `evidence/ELA-002/provisioning-snapshot.txt`; UAE residency override remains documented | Raw documents, generated packets, backups, and case-audit exports required to remain AWS `me-central-1`; live AWS evidence pending ELA-004/ELA-016 external resource checks | Subprocessor list reconciled in `subprocessors.md`; no unlisted egress approved for beta | Compliance owner: pending PR approval; Legal owner: pending PR approval - Akamai Connected Cloud (Linode) DPA status is not production-ready: Pending counsel review - Amazon Web Services S3 DPA status is not production-ready: Pending account-owner procurement confirmation - Amazon Web Services S3 processing status is not production-ready: Planned/partially implemented - Amazon Web Services KMS DPA status is not production-ready: Pending account-owner procurement confirmation - Amazon Web Services KMS processing status is not production-ready: Planned/partially implemented - Sumsub DPA status is not production-ready: Pending - Sumsub processing status is not production-ready: Planned integration - Sumsub region/residency proof is not attached: Vendor-controlled region under DPA; region proof required before beta - RevenueCat DPA status is not production-ready: Pending - RevenueCat processing status is not production-ready: Planned integration - RevenueCat region/residency proof is not attached: Vendor-controlled region under DPA - Apple App Store / APNS DPA status is not production-ready: Apple developer terms/DPA review pending - Apple App Store / APNS processing status is not production-ready: Planned integration - Google Play / FCM DPA status is not production-ready: Google developer terms/DPA review pending - Google Play / FCM processing status is not production-ready: Planned integration - Twilio or approved SMS provider DPA status is not production-ready: Pending vendor selection - Twilio or approved SMS provider processing status is not production-ready: Candidate - Twilio or approved SMS provider region/residency proof is not attached: Provider region under DPA; UAE/UK routing proof required - WhatsApp Business provider DPA status is not production-ready: Pending vendor selection - WhatsApp Business provider processing status is not production-ready: Candidate - WhatsApp Business provider region/residency proof is not attached: Provider region under DPA; routing proof required - Approved email provider DPA status is not production-ready: Pending vendor selection - Approved email provider processing status is not production-ready: Candidate - Approved email provider region/residency proof is not attached: Provider region under DPA; routing proof required - Voice/phone escalation provider DPA status is not production-ready: Pending vendor selection - Voice/phone escalation provider processing status is not production-ready: Candidate - Voice/phone escalation provider region/residency proof is not attached: Provider region under DPA; routing proof required - Mapbox or approved maps/geocoding provider DPA status is not production-ready: Pending vendor decision - Mapbox or approved maps/geocoding provider processing status is not production-ready: Candidate - Mapbox or approved maps/geocoding provider region/residency proof is not attached: Vendor region under DPA; routing proof required - External on-call vendor DPA status is not production-ready: Signed DPA artifact required - External on-call vendor processing status is not production-ready: Blocked / missing legal artifacts - External on-call vendor region/residency proof is not attached: UAE primary, UK-only continuity handling pending DPA proof - Pen-test vendor DPA status is not production-ready: Pending vendor selection - Pen-test vendor processing status is not production-ready: Candidate - GitHub DPA status is not production-ready: GitHub terms/DPA review pending - 2026-05 monthly register DPA gaps must be closed, found: DPA confirmations pending for every external vendor except internal emergency recipients - 2026-05 monthly register Region gaps must be closed, found: Live region proof pending for S3/KMS and provider routing - 2026-05 monthly register outcome is not final: Pre-beta PR must record legal approval or explicit risk acceptance ### pentest-evidence-check - docs/security/pentest-2026-05.pdf is too small to be a retained signed security artifact - missing Crescent Shield retest confirmation: legal/security/crescent-shield-ela-097-retest-confirmation-2026-05-08.pdf - missing jailbroken iOS adversarial extraction evidence: evidence/ELA-089/jailbroken-ios-artifacts-2026-05-08.json - missing rooted Android adversarial extraction evidence: evidence/ELA-089/rooted-android-artifacts-2026-05-08.json ### provider-credentials-evidence-check - provider credential evidence missing Sumsub KYC configuration: evidence/provider-credentials/sumsub-kyc-config-2026-05-08.json - provider credential evidence missing RevenueCat product configuration: evidence/provider-credentials/revenuecat-products-2026-05-08.json - provider credential evidence missing Twilio sender configuration: evidence/provider-credentials/twilio-senders-2026-05-08.json - provider credential evidence missing transactional email domain configuration: evidence/provider-credentials/email-domain-2026-05-08.json - provider credential evidence missing Mapbox token restrictions: evidence/provider-credentials/mapbox-token-restrictions-2026-05-08.json - provider credential evidence missing production provider environment attestation: evidence/provider-credentials/production-env-attestation-2026-05-08.json ### public-launch-evidence-check - public launch evidence missing UAE trademark search and clearance PDF: legal/trademark/TM-UAE-ELA-2026-05-08.pdf - public launch evidence missing Nice class 9/45 conflict review workbook: legal/trademark/nice-9-45-clearance.xlsx - public launch evidence missing public-launch legal sign-off memo: legal/ela-public-launch-signoff-2026-05-08.pdf - public launch evidence missing top-20 consulate verification artifact: evidence/ELA-101/directories/top-20-consulate-verification-2026-05-08.json - public launch evidence missing all-emirate police station verification artifact: evidence/ELA-101/directories/police-station-verification-2026-05-08.json - public launch evidence missing PRD §28 acceptance matrix proof: evidence/ELA-101/prd-28-acceptance-matrix-2026-05-08.json - public launch evidence missing seven-night full-suite artifact 2026-05-02: evidence/ELA-101/nightly-suite/2026-05-02.json - public launch evidence missing seven-night full-suite artifact 2026-05-03: evidence/ELA-101/nightly-suite/2026-05-03.json - public launch evidence missing seven-night full-suite artifact 2026-05-04: evidence/ELA-101/nightly-suite/2026-05-04.json - public launch evidence missing seven-night full-suite artifact 2026-05-05: evidence/ELA-101/nightly-suite/2026-05-05.json - public launch evidence missing seven-night full-suite artifact 2026-05-06: evidence/ELA-101/nightly-suite/2026-05-06.json - public launch evidence missing seven-night full-suite artifact 2026-05-07: evidence/ELA-101/nightly-suite/2026-05-07.json - public launch evidence missing seven-night full-suite artifact 2026-05-08: evidence/ELA-101/nightly-suite/2026-05-08.json - consulate row is not passing: | 1 | IN | India | Embassy of India Abu Dhabi | 2026-05-06 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 2 | PK | Pakistan | Embassy of Pakistan Abu Dhabi | 2026-05-06 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 3 | BD | Bangladesh | Bangladesh Embassy Abu Dhabi | 2026-05-06 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 4 | PH | Philippines | Philippine Embassy Abu Dhabi | 2026-05-06 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 5 | GB | United Kingdom | British Embassy Abu Dhabi | 2026-05-08 | Email, after-hours phone, escalation phone | Unverified | - consulate row is not passing: | 6 | AU | Australia | Australian Embassy UAE | 2026-05-08 | Email, after-hours phone, Canberra fallback | Unverified | - consulate row is not passing: | 7 | EG | Egypt | Embassy of Egypt Abu Dhabi | 2026-05-05 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 8 | JO | Jordan | Embassy of Jordan Abu Dhabi | 2026-05-05 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 9 | LB | Lebanon | Embassy of Lebanon Abu Dhabi | 2026-05-05 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 10 | NP | Nepal | Embassy of Nepal Abu Dhabi | 2026-05-05 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 11 | LK | Sri Lanka | Embassy of Sri Lanka Abu Dhabi | 2026-05-04 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 12 | RU | Russia | Embassy of Russia Abu Dhabi | 2026-05-04 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 13 | CN | China | Embassy of China Abu Dhabi | 2026-05-04 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 14 | ZA | South Africa | South African Embassy Abu Dhabi | 2026-05-04 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 15 | US | United States | U.S. Embassy Abu Dhabi | 2026-05-03 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 16 | CA | Canada | Embassy of Canada Abu Dhabi | 2026-05-03 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 17 | FR | France | Embassy of France Abu Dhabi | 2026-05-03 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 18 | DE | Germany | Embassy of Germany Abu Dhabi | 2026-05-03 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 19 | IR | Iran | Embassy of Iran Abu Dhabi | 2026-05-02 | Email, emergency phone, escalation phone | Unverified | - consulate row is not passing: | 20 | NG | Nigeria | Embassy of Nigeria Abu Dhabi | 2026-05-02 | Email, emergency phone, escalation phone | Unverified | - DXB police station coverage row is not passing - AUH police station coverage row is not passing - SHJ police station coverage row is not passing - AJM police station coverage row is not passing - RAK police station coverage row is not passing - UAQ police station coverage row is not passing - FUJ police station coverage row is not passing - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-02 | `gha-full-suite-20260502.1` | `launch-green-01` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-03 | `gha-full-suite-20260503.1` | `launch-green-02` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-04 | `gha-full-suite-20260504.1` | `launch-green-03` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-05 | `gha-full-suite-20260505.1` | `launch-green-04` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-06 | `gha-full-suite-20260506.1` | `launch-green-05` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-07 | `gha-full-suite-20260507.1` | `launch-green-06` | Blocked | Unverified | Artifact missing | - seven-night suite row must pass with all PRD §28 rows green: | 2026-05-08 | `gha-full-suite-20260508.1` | `launch-green-07` | Blocked | Unverified | Artifact missing | - Live provider credential evidence gate is not green - ELA-095 PDPL evidence pack gate is not green - Residency consistency gate is not green - ELA-004 encrypted backup and restore is green but public launch docs still record it as blocked - ELA-011 observability gate is not green - ELA-009 analytics gate is not green - ELA-012 worker gate is not green - Server hardening evidence gate is not green - Legal policy evidence gate is not green - ELA-096 outsourced on-call vendor gate is not green - ELA-097 pen-test closure gate is not green - ELA-098 store submission gate is not green - Visual regression evidence gate is not green - ELA-099 arrest-simulation rehearsal gate is not green - ELA-100 closed beta gate is not green ### residency-consistency-check - residency evidence missing legal/product storage-region decision memo: evidence/residency/legal-region-decision-2026-05-09.pdf - residency evidence missing approved AWS storage-region proof: evidence/residency/aws-region-proof-2026-05-09.json - decision has unresolved residency checklist item: - [ ] Legal/product storage-region memo: approve current AWS `me-central-1` - decision has unresolved residency checklist item: - [ ] User privacy policy + ToS (legal counsel) - decision has unresolved residency checklist item: - [ ] Subprocessor DPA clauses re-checked - subprocessors has unresolved residency checklist item: - [ ] Legal confirms Akamai/Linode London residency override for beta. - subprocessors has unresolved residency checklist item: - [ ] Legal confirms AWS `me-central-1` S3/KMS DPA and region terms. - subprocessors has unresolved residency checklist item: - [ ] Legal confirms KYC, billing, push, SMS/WhatsApp/email, maps, on-call, - subprocessors has unresolved residency checklist item: - [ ] Compliance confirms monthly region attestation and egress audit cadence. - subprocessors has unresolved residency checklist item: - [ ] Product/ops confirms user-facing privacy notice reflects these transfers. - kycEvidence has unresolved residency checklist item: - [ ] Run KMS test against live AWS `me-central-1` key. - kycEvidence has unresolved residency checklist item: - [ ] Capture signed URL expiry rejection against live S3 object. - ELA-016 live evidence records unresolved storage-region/AWS integration follow-up - KYC runbook allows a replacement region but no legal/product region decision memo is attached ### server-hardening-evidence-check - server hardening evidence missing Postgres password rotation evidence: evidence/server-hardening/postgres-password-rotation-2026-05-08.txt - server hardening evidence missing Caddy domain TLS evidence: evidence/server-hardening/caddy-domain-tls-2026-05-08.txt - server hardening docs must not claim password rotation or live TLS while artifacts are absent ### store-evidence-check - apps/mobile/app.json expo.ios.infoPlist.NSLocationAlwaysAndWhenInUseUsageDescription must mention active case - store submission evidence missing App Store Connect receipt ASC-ELA-2026-05-08-001: evidence/ELA-098/receipts/ASC-ELA-2026-05-08-001.pdf - store submission evidence missing Google Play Console receipt GPC-ELA-2026-05-08-001: evidence/ELA-098/receipts/GPC-ELA-2026-05-08-001.pdf ### visual-regression-evidence-check - visual state matrix must contain exactly 38 states, found 52 - visual regression evidence missing retained iOS critical screenshot for 14-pre-dispatch: tests/visual/screenshots/14-pre-dispatch/ios-dark.png - visual regression evidence missing retained Android critical screenshot for 14-pre-dispatch: tests/visual/screenshots/14-pre-dispatch/android-dark.png - visual regression evidence missing retained iOS critical screenshot for 15-active-case: tests/visual/screenshots/15-active-case/ios-dark.png - visual regression evidence missing retained Android critical screenshot for 15-active-case: tests/visual/screenshots/15-active-case/android-dark.png - visual regression evidence missing retained iOS critical screenshot for 18-error: tests/visual/screenshots/18-error/ios-dark.png - visual regression evidence missing retained Android critical screenshot for 18-error: tests/visual/screenshots/18-error/android-dark.png - visual regression evidence missing retained iOS critical screenshot for 19-duress: tests/visual/screenshots/19-duress/ios-dark.png - visual regression evidence missing retained Android critical screenshot for 19-duress: tests/visual/screenshots/19-duress/android-dark.png - visual regression evidence missing iOS visual run manifest: tests/visual/screenshots/ios-run-manifest.json - visual regression evidence missing Android visual run manifest: tests/visual/screenshots/android-run-manifest.json - visual regression evidence missing Chromatic project evidence: evidence/visual-regression/chromatic-project-2026-05-08.json - visual regression evidence missing Chromatic build evidence: evidence/visual-regression/chromatic-build-2026-05-08.json ### visual-regression-examples-check - visual state matrix must contain exactly 38 states, found 52 ### workers-evidence-check - worker evidence missing cron smoke output: evidence/ELA-012/live/cron-smoke-output.txt - worker evidence missing worker systemd status output: evidence/ELA-012/live/worker-systemd-status.txt - worker evidence missing worker health output: evidence/ELA-012/live/worker-health.txt - worker evidence missing worker crash/restart proof: evidence/ELA-012/live/worker-crash-restart.txt - worker evidence missing negative health probe output: evidence/ELA-012/live/negative-health-probe.txt - worker evidence missing worker queue claim/completion proof: evidence/ELA-012/live/worker-queue-claim-proof.txt - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/cron-smoke-output.txt` - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/worker-systemd-status.txt` - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/worker-health.txt` - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/worker-crash-restart.txt` - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/negative-health-probe.txt` - ELA-012 README has incomplete checklist item: - [ ] `evidence/ELA-012/live/worker-queue-claim-proof.txt` - ELA-012 live README records unresolved worker evidence: # ELA-012 — Live evidence (partial) - ELA-012 live README records unresolved worker evidence: while this file records partial live evidence or while the worker artifacts - ELA-012 live README records unresolved worker evidence: ## What's still pending - ELA-012 live README records unresolved worker evidence: - ⏳ Negative health probe (worker stopped → `/healthz` 5xx) - ELA-012 live README records unresolved worker evidence: This task is **artifactComplete: true, liveEvidenceComplete: false** until the - pg_cron verification must include captured_at timestamp - pg_cron verification must show active ela_worker_heartbeat_tick job - pg_cron verification still shows queued worker rows without live completion proof ## Coverage and unverified items Dispatch review traced actual committed command/adoption/verification code, callers and constraints; data/security review read all34new SQL files plus entitlement/refund/DSAR/voice/config/Help/push/auth changes; evidence review parsed the entire changed-document and command/register corpus; quality/scope reviewed real source diffs and added skips/debug/suppression/vendor/config surface. The whole main...HEAD diff was scanned for private-key, provider-key, token/JWT and credential-assignment patterns. Twenty candidate locations were reviewed as synthetic test/smoke values; no live secret was established. That pattern scan does not certify the unavailable external archive or every historical Git object. Unverified: actual production/staging migration ledger, grants/ownership/RLS, database-role execution and installed function hashes; scheduler installation/age/recovery and provider reconciliation; native iOS/Android/Watch/background/offline delivery; complete DSAR identity/provenance/export/download/deletion/retention/holds; real refund settlement; unavailable historical screenshots/logs and exact combined-checkout-to-HEAD equivalence; exact CI container rendering and a green full end-to-end acceptance run. Current fresh Linux evidence and the retained refutations support NO-GO without claiming those external checks. Review files: `findings.json`, `notes.md`, `tests.json`, per-command `logs/`, per-finding `refutations/`, `migration-inventory.json`, `claims.json`, `register-claims.json`, `history-check.json`, `backup-evidence-check.json`, and the committed-source test archives. All owned processes and the disposable PostgreSQL container are stopped before final delivery; the final tracked-file check is recorded in `workspace-integrity.json`.