{
  "review_window_utc": {
    "from": "2026-10-04T04:00:00Z",
    "to": "2026-10-07T03:38:00Z"
  },
  "captured_at": "2026-10-07T03:44:52.642159+00:00",
  "claim_scope": "Point-in-time editorial evidence. Planned or staged work is not described as deployed.",
  "connection_tests": [
    {
      "evidence": "unrepaired_retina",
      "source_sha256": "760aa3a4bd7bbae184bcf093561a0860caba8b69492ff5927171de33c359bb7d",
      "engine": "webkit",
      "mobile": true,
      "duration_requested": 180,
      "started_at": "2026-10-06T13:46:42.860Z",
      "completed_at": "2026-10-06T13:49:47.744Z",
      "stable": false,
      "scope": "Disposable synthetic desktop; browser-engine behavior, not actual iPhone hardware.",
      "connection_count": 4,
      "error_count": 0,
      "duration_units": "seconds"
    },
    {
      "evidence": "repaired_retina_final",
      "source_sha256": "17dabea4fd93f9aeb8b208161dc213c7eead235e25b64318075447541523cc06",
      "engine": "webkit",
      "mobile": true,
      "duration_requested": 180,
      "started_at": "2026-10-06T14:22:27.811Z",
      "completed_at": "2026-10-06T14:25:33.703Z",
      "stable": true,
      "scope": "Disposable synthetic desktop; browser-engine behavior, not actual iPhone hardware.",
      "connection_count": 1,
      "error_count": 0,
      "duration_units": "seconds"
    },
    {
      "evidence": "chrome_six_minutes",
      "source_sha256": "b8a5c61965b10f3f5e7b9ab8d0cde5a2cd55048513a06cd3493f55feadd094f1",
      "engine": "chromium",
      "mobile": false,
      "duration_requested": 360,
      "started_at": "2026-10-06T14:13:38.166Z",
      "completed_at": "2026-10-06T14:19:39.475Z",
      "stable": true,
      "scope": "Disposable synthetic desktop; browser-engine behavior, not actual iPhone hardware.",
      "connection_count": 1,
      "error_count": 0,
      "duration_units": "seconds"
    },
    {
      "evidence": "decoder_recovery",
      "source_sha256": "7a6354e4e413c32e661c7b4b3940bad3ff8616bf76f6ea88b96672fcbe7fffae",
      "all_passed": true,
      "scope": "Synthetic decoder-failure signal in an isolated desktop; verifies compatibility recovery without any user command or data.",
      "checks": [
        {
          "test": "Decoder failure selects compatibility mode",
          "passed": true
        },
        {
          "test": "Renderer recovers and confirms actual frames",
          "passed": true
        },
        {
          "test": "Unsent local draft preserved",
          "passed": true
        },
        {
          "test": "No JavaScript errors",
          "passed": true
        }
      ]
    }
  ],
  "memory_export": {
    "checked_sources": 409,
    "indexed_note_sources": 409,
    "all_409_notes_covered": true,
    "notes_with_redactions": 8,
    "originals_modified": false,
    "redaction_type": "Credential-like content in screened derivatives; originals unchanged."
  },
  "candidate_dependency_audit": {
    "scope": "Before and after scans of staged developer CLI dependency bundles. Transitive findings can propagate to parent packages; counts are not distinct exploitable flaws or a whole-host security certification.",
    "counts": {
      "info": 0,
      "low": 1,
      "moderate": 0,
      "high": 37,
      "critical": 0,
      "total": 38
    },
    "blanket_secure_claim": false,
    "earlier_counts": {
      "info": 0,
      "low": 1,
      "moderate": 3,
      "high": 48,
      "critical": 1,
      "total": 53
    }
  },
  "physical_phone_acceptance": false,
  "external_otp_tests_not_implied": true,
  "secrets_in_public_report": false,
  "editorial_checkpoint_utc": "2026-10-07T03:38:00Z",
  "detached_job_proof": {
    "state": "completed",
    "created_at": "2026-10-07T03:32:00.376434+00:00",
    "started_at": "2026-10-07T03:32:00.482475+00:00",
    "finished_at": "2026-10-07T03:32:08.523396+00:00",
    "exit": 0,
    "automatic_deployment": false,
    "model_call": false,
    "scope": "One synthetic eight-second task, not an assertion about all CLI subcommands or arbitrary deployment recovery."
  },
  "repair_mechanism": {
    "initial_test_device_scale": 3,
    "initial_negotiation": {
      "width": 3840,
      "height": 2400,
      "dpi": 288
    },
    "bounded_target": {
      "width": 1280,
      "height": 800,
      "dpi": 96
    },
    "diagnosis_scope": "Reproduced failing mobile WebKit fixture; not a universal cause of remote desktop disconnects.",
    "fixes": [
      "Initialize remote dimensions before the client bootstrap",
      "Use compatibility rendering for the failing Safari path",
      "Confirm actual rendered output before reporting ready",
      "Preserve draft during renderer recovery"
    ],
    "physical_device_validation_complete": false
  },
  "desktop_deployment": {
    "success": true,
    "completed_at": "2026-10-06T14:30:29.286841+00:00",
    "profile_volume_preserved": true,
    "application_environment_unchanged": true,
    "ports_and_security_unchanged": true,
    "other_containers_unchanged": true,
    "host_rebooted": false,
    "image_digest": "sha256:912372e4d458225f976440a657098a4c566079d5a1d9f976e5ff816648683128",
    "version_tag": "enclave-webtop-workbench:20261006-r15"
  },
  "integration_checkpoint": {
    "qdrant": "Persisted and authenticated service; initial semantic build was in progress at the checkpoint.",
    "established_hermes_retrieval": "SQLite FTS5 with source references and exact-quotation checks; not silently renamed semantic retrieval.",
    "semantic_design": "Local embedding, deterministic source identity, content hashes, product metadata, staging collection and alias verification. Design is not an acceptance result.",
    "n8n": "Native workflow and credential configuration work; a CLI task-broker port collision occurred during setup. No complete product-wide workflow certification is claimed.",
    "weekly_update": "Under implementation at checkpoint; an unreviewed generated updater was not treated as a completed unattended rollout."
  },
  "limitations": [
    "Browser-engine fixtures do not certify physical iPhone/iPad behavior.",
    "Finite sustained sessions are not an uptime guarantee.",
    "CLI dependency findings are not a whole-host audit or distinct exploited vulnerabilities.",
    "The approved Markdown export is not every AWS file or conversation.",
    "No independent disaster recovery or complete account-migration claim.",
    "Subscription and third-party service limits still apply."
  ],
  "interface_fixture_tests": {
    "scope": "Live disposable Selkies/X11 container, synthetic Basic-auth owner, no customer profiles or files. Not physical Safari.",
    "engine": "webkit",
    "all_passed": true,
    "checks": [
      {
        "test": "Workspaces interface reaches real stream",
        "passed": true
      },
      {
        "test": "Actual stream keyboard input attached",
        "passed": true
      },
      {
        "test": "Clipboard roundtrip is explicit",
        "passed": true
      },
      {
        "test": "Multiline paste requires review",
        "passed": true
      },
      {
        "test": "Application window switcher and focus",
        "passed": true
      },
      {
        "test": "Real GTK drag across remote frame",
        "passed": true
      },
      {
        "test": "Transfer inbox uploads real bytes",
        "passed": true
      },
      {
        "test": "Completed upload can download without auth leak",
        "passed": true
      },
      {
        "test": "Responsive 320x740",
        "passed": true
      },
      {
        "test": "Responsive 390x844",
        "passed": true
      },
      {
        "test": "Responsive 430x932",
        "passed": true
      },
      {
        "test": "Responsive 844x390",
        "passed": true
      },
      {
        "test": "Responsive 768x1024",
        "passed": true
      },
      {
        "test": "Responsive 1365x900",
        "passed": true
      },
      {
        "test": "Responsive 390x360",
        "passed": true
      },
      {
        "test": "Second tab cannot steal desktop control",
        "passed": true
      },
      {
        "test": "Reconnect retains local draft without desktop restart",
        "passed": true
      },
      {
        "test": "Safe diagnostics omit private test text",
        "passed": true
      },
      {
        "test": "Sensitive drafts are not in local storage",
        "passed": true
      },
      {
        "test": "No browser script errors",
        "passed": true
      }
    ],
    "source_sha256": "3d9b2dde1273b45064e101d859f6d12fa57d1d20a74e59df46aa5b557e414418"
  },
  "production_read_checks": {
    "scope": "Live local HTTP read checks using the unchanged existing application password; no desktop input, lease takeover, provider login or fresh external OTP.",
    "checked_at": "2026-10-06T14:34:01.781328+00:00",
    "all_passed": true,
    "checks": [
      {
        "test": "Existing password opens /mobile.html",
        "passed": true,
        "http": 200
      },
      {
        "test": "Existing password opens /desktop.html",
        "passed": true,
        "http": 200
      },
      {
        "test": "Existing password opens /desktop-classic.html",
        "passed": true,
        "http": 200
      },
      {
        "test": "Existing password opens /",
        "passed": true,
        "http": 200
      },
      {
        "test": "Existing password opens /workspace.webmanifest",
        "passed": true,
        "http": 200
      },
      {
        "test": "Existing password opens /workspace-sw.js",
        "passed": true,
        "http": 200
      },
      {
        "test": "Unauthenticated mobile API refused",
        "passed": true,
        "http": 401
      },
      {
        "test": "No-ticket stream refused",
        "passed": true,
        "http": 401
      },
      {
        "test": "Companion runs without administrator privilege",
        "passed": true
      },
      {
        "test": "Production companion build matches tested release",
        "passed": true
      }
    ],
    "source_sha256": "14d43404426d001c12f6d52f208b18943d51e40e6f23e1c7487628b91bc256e1"
  },
  "authorization_page_fixture_tests": {
    "scope": "Isolated application with synthetic account and codes; no actual provider login started.",
    "checks": [
      {
        "test": "Owner password required",
        "passed": true
      },
      {
        "test": "Public request cannot use local bypass",
        "passed": true
      },
      {
        "test": "Native selectable text fields rendered",
        "passed": true
      },
      {
        "test": "No private response caching",
        "passed": true
      },
      {
        "test": "CSRF required",
        "passed": true
      },
      {
        "test": "Foreign origin refused",
        "passed": true
      },
      {
        "test": "Arbitrary commands refused",
        "passed": true
      },
      {
        "test": "Approved fixed native check accepted",
        "passed": true
      },
      {
        "test": "Expired links and codes removed",
        "passed": true
      },
      {
        "test": "Foreign provider domain rejected",
        "passed": true
      },
      {
        "test": "Embedded userinfo rejected",
        "passed": true
      }
    ],
    "all_passed": true,
    "source_sha256": "5f8d171e7e1623b7b32879c3306c8a3352c10cf91971472249827a2eee1dc054"
  },
  "memory_import": {
    "imported_at": "2026-10-05T13:06:19.065662+00:00",
    "notes": 409,
    "source_hash_mismatches": 0,
    "source_files_modified": false,
    "coverage_scope": "Manifest-verified exported Markdown notes with preserved source paths, not the complete previous workstation."
  },
  "hermes_application_path_tests": {
    "checked_at": "2026-10-05T15:06:12.185695+00:00",
    "scope": "Live existing Open WebUI service identity -> LiteLLM -> screened project retrieval -> local Ollama. Not a new browser OTP or provider-subscription test.",
    "all_passed": true,
    "checks": [
      {
        "test": "AWS additive rule",
        "passed": true,
        "http": 200,
        "stream": false
      },
      {
        "test": "Current Webtop default, streaming",
        "passed": true,
        "http": 200,
        "stream": true
      },
      {
        "test": "Standing GSC allocation",
        "passed": true,
        "http": 200,
        "stream": false
      },
      {
        "test": "Unknown project fails with no evidence",
        "passed": true,
        "http": 200,
        "stream": false
      },
      {
        "test": "Unauthenticated gateway request refused",
        "passed": true
      },
      {
        "test": "Existing general Hermes route still works",
        "passed": true
      }
    ]
  },
  "hermes_local_configuration": {
    "model": "hermes3:8b",
    "context_tokens": 8192,
    "local_only": true,
    "commands_executed": false,
    "exact_quotes_checked": true,
    "scope": "Fields from the saved source-grounded local answer receipt, not a maximum model capability claim.",
    "generation_policy": "Configured output is bounded; this is a configuration observation, not a maximum model capability."
  },
  "repair_operator_notes": {
    "source_kind": "Dated operator repair handoff, distinct from the raw test-count receipts",
    "source_sha256": "d5966ae9e63b3752aed64f6456be6d8c355b20a7c2a84bd14db3a23bd9ab0c1f",
    "noted_mechanism": "The first stream negotiation preceded the later bounded dimensions. The repair chose JPEG compatibility for Safari and kept H.264 selectable.",
    "configuration_details": [
      "JPEG compatibility is offered for the Safari path and H.264 remains selectable. Several repairs were made together; the isolated performance contribution of JPEG was not measured.",
      "The input implementation does not append an extra Enter after pasting. The paste fixture proves explicit review, not every terminal behavior."
    ]
  },
  "operating_policy": {
    "local_backup_retention_requested_days": 40,
    "retention_scope": "Registered local backup files only; active data, original sources and repositories excluded.",
    "weekly_automatic_update_acceptance_complete_at_checkpoint": false,
    "subscription_and_api_routes": "Separate credentials and billing paths. The local source-aware route is configured without a paid provider fallback; no exhaustive all-provider failure matrix is claimed."
  },
  "source_freshness_regression": {
    "scope": "A failed then corrected current-release answer. Historical failure is retained rather than overwritten.",
    "records": [
      {
        "record": "live-route-before-freshness-fix",
        "checked_at": "2026-10-05T14:59:09.543860+00:00",
        "source_sha256": "ce176b204584d0f923ff518b8c840150ddade57a98d1d634ef1f55d0fa41cf02",
        "current_release_checks": [
          {
            "test": "Current Webtop default, streaming",
            "passed": false,
            "http": 200,
            "stream": true
          }
        ]
      },
      {
        "record": "live-route-final-acceptance",
        "checked_at": "2026-10-05T15:06:12.185695+00:00",
        "source_sha256": "795f2477523dc3822abbc6ff335f2547f35c80204b8da14cd5a0d824464e5ff3",
        "current_release_checks": [
          {
            "test": "Current Webtop default, streaming",
            "passed": true,
            "http": 200,
            "stream": true
          }
        ]
      }
    ],
    "configuration_inspection": {
      "source_sha256": "8892d5ea96c46f3144500ac4d59b7a3869b92670a9c356c85c96866aa3b4ca68",
      "rule": "The retrieval code replaces an older indexed copy with its live operational record and restricts precise current-Webtop-version questions to the live release record.",
      "configuration_inspection_is_not_a_universal_accuracy_test": true
    }
  },
  "earlier_mobile_promotion": {
    "completed_at": "2026-10-06T01:18:24.326690+00:00",
    "success": true,
    "profile_volume_preserved": true,
    "host_rebooted": false,
    "source_sha256": "c1bb3e488c97ac703d2b5c040b8a070e4e26fff43de8f9ec9c6a01d2af30dedf"
  },
  "user_report": {
    "source_kind": "User-provided report in the authorized conversation, after the mobile rollout and before the repair request",
    "quote": "Webtop connects but connection then disconnects again. And again",
    "independent_device_test": false,
    "device_type_not_established_by_quote": true
  },
  "candidate_resolution": {
    "selection": "Latest stable registry version for each explicit allowlisted package, resolved into an exact lock before build",
    "requested_package_count": 18,
    "resolved_package_count": 18,
    "dependency_lock_sha256": "7ed26d87068ab42173950cd5af71dd6e47cd70eaca5530077aca51a67aac9337",
    "scope": "Staged package policy and lock. Not a completed automatic production update."
  },
  "earlier_promotion_test_gate": {
    "checked_at": "2026-10-06T01:17:21.437192+00:00",
    "approved": true,
    "scope": "Disposable profiles and synthetic owner identity; real WebKit and Chrome engines with real Selkies/X11 input. No physical iPhone/iPad or fresh Cloudflare OTP test.",
    "checks": [
      {
        "suite": "chromium live UI",
        "passed": true,
        "count": 20
      },
      {
        "suite": "webkit live UI",
        "passed": true,
        "count": 20
      },
      {
        "suite": "chrome lifecycle/legacy",
        "passed": true,
        "count": 7
      },
      {
        "suite": "webkit lifecycle/legacy",
        "passed": true,
        "count": 7
      },
      {
        "suite": "API validation",
        "passed": true,
        "count": 32
      },
      {
        "suite": "WebKit stream authentication",
        "passed": true,
        "count": 8
      }
    ],
    "source_sha256": "f140e35185f3f0a6482bfdb3c05e63e9daeda89420c4786a179575bfb33ea9e6"
  }
}