archy/Release & Testing/Detailed Plans/04-Qualification-Test-Contract.md

Sanitized detailed source transcription S04, captured 2026-10-24. Original planning steps, acceptance criteria and historical evidence are retained rather than condensed. Read current context and precedence first: dated holds, approvals, test counts and “latest” labels below belong to their original checkpoint and do not grant current execution/publication authority. Privacy replacements preserve roles and test semantics. See section coverage.

Qualification and evidence contract

The pack began with static preview evidence only. Subsequent exact development-source, disposable-integration and local artifact checks are recorded below. They remain separate from accepted provenance, installed operator node acceptance, physical acceptance and release authority. T00 must inspect exact repository instructions and package/harness scripts before each rerun; do not invent stale command names.

Command safety and baseline

• Installed-app machine: backend execution ONLY through scripts/test-backend-isolated.sh after reading its current usage and isolation behavior. cargo test --no-run is compile-only, never runtime acceptance. No unrestricted cargo test.
• Frontend: inspect package.json/lockfile, use repository-approved frozen dependency installation and focused existing test commands; typecheck/lint/build before batch freeze. Add regressions to production modules, not a parallel mocked implementation.
• Integration: disposable synthetic publisher/buyer/late node, resource limits, no host home/credentials/wallet/live storage/container socket/host networking. Trusted CI source must be pinned to exact reviewed commit. Untrusted proposals isolated separately.
• Build native ARM lane where available as additional evidence. Required x86 source/artifact and booted ISO/OTA acceptance cannot be replaced by ARM compile. Pinned Debian ARM environment plus physical Pi acceptance needed for Pi claims.
• Prototype-only commands: node [private synthetic preview directory]check-details.cjs, check-zaps.cjs, check-v2.cjs (same directory prefix for each), against the isolated loopback static server. They simulate state, not production settlement or video.

Required evidence per run

Task/requirement IDs; source pins and review reference; sanitized environment/tool/architecture; exact command + exit status; test names/counts/skips; fixture versions/hash; artifact hashes; start/end timestamps; actual vs simulated dependencies; failure and successful rerun evidence; affected paths and missing gates. Keep raw operational/financial details private. No historical PASS copied into current candidate fields. A changed dependency invalidates impacted evidence.

Gate matrix

Gate	Minimum checks	Required evidence
G0 provenance	canonical exact accepted refs, all component pins, dirty-tree preservation, baseline	reviewed manifest + baseline command log
G1 source	focused regressions, lint/typecheck/build, full tests at freeze, contract review	exact commit + results + independent high-risk review
G2 integration	real isolated services and faults below	receipts, operation IDs, byte hashes and route evidence, not UI mocks
G3 artifact	installed exact backend/UI/app/APK payload, no hot patches	signed-owner-approved manifest/digests, served hashes, migration/rollback proof
G4 operator node	private preflight, scoped backup/approval, managed delivery, headless smoke	installed/served hashes, preservation/health evidence, UAT request
G5 physical/operator	actual Android/radio/x86/Pi where required, operator scenario results	device/environment scope, exact artifacts, explicit pass/fail/blocker
G6 release	complete ledger, ngit/mirror and metadata/asset resolution, owner authority	owner handoff; no automatic publication

Payment and tip matrix (A05/A06/A10/A11/B01/B02)

For native Cashu/Lightning/on-chain and external Lightning/on-chain: compatible/incompatible recipient, wallet/mint/network, unavailable balance vs zero, below minimum, fee changes, declined consent, exact receipt/producer credit and bounded funds. Price/recipient/film/revision substitution must be rejected. No BTCPay present/reachable; trace every enabled monetization entry point. Unsupported Fedimint adapter must not appear working. Public/customer views show producer-side unavailability only as “Not offered”; response/timing/status/header/polling comparisons must not reveal producer wallet existence, Archipelago-wallet status, backend/provider/configuration/balance/health or internal failure reason. Customer-owned errors disclose only customer state; producer diagnostics are separately authorized and redacted.

Exercise before/after side effect process crash, original response loss, unknown settlement, simultaneous clicks/tabs, stale quote, external invoice/address exposure, cancelled-unpaid authoritative state, mint/chain outage, late confirmation and restart. One logical intent, at most intended spend, no premature entitlement or tip total, no switch until resolution. On-chain real regtest signing/lease/broadcast, confirmation/reorg, supported bump and fee budget. Do not create chain faults on real funds.

Rental: payment vs first-play clock, atomic concurrent first start, watch-later, original window on resume, ranged/seek/cache/key expiry, renewal only explicit new approval after definitive expiry.

Metered: zero/off, whole-sat and upper-bound validation, below one complete chunk budget, exact-boundary stop, atomic reserved+spent accounting, overlapping tabs/device/session policy, rate/fee change reapproval, paid chunk retry and seek reuse policy, paused/stopped/background restrictions, unresolved chunk locks further spending, cap increase without history reset, lowered cap with in-flight reconciliation. No precharging whole ceiling. Confirmed/unconfirmed receipts survive restart and do not double debit.

Zaps: original preset/custom selection and return navigation, creator tip capabilities independent from film rent settings, explicit native/external approval, no access grant, no user assertion as settlement proof, rail-correct receipt attribution, exactly-once social/dashboard count.

Media, identity, distribution, UX

• Every remote media route/variant/redirect/master/trailer/subtitle/segment/key enforces authenticated FIPS and entitlement. FIPS denied while alternatives available must fail closed; restore without repayment. Cache cannot bypass expiry. Real codec decode, seek and background on installed player; mocks insufficient.
• Publisher P, buyer B and unrelated late C: complete catalog pagination, signed identity/revision/withdrawal, draft secrecy, relay partition/backfill, same discussion across local origins, stable media revision vs discussion key. Bounded threads/events/subscriptions; signed author mismatch and XSS rejected.
• Native A→B account transition, logout/expiry, signer cancellation, cached hints, iframe/tab/companion lifecycle; never sign using stale/app-generated keys.
• Original black containers, shell, detail-before-pay, original player and zap amount picker; nested return/focus, Escape/back, accessible icon labels, 320/390/768/1440 and landscape, keyboard/touch, reduced motion and disabled explanations.
• Backstage both source paths, save/reopen/reload, cancel/resume, worker restart/failure, no lost selection, protected old asset during replacement, explicit native publication consent and truthful pending outbox.
• Profits: mutually exclusive revenue buckets, confirmed-only total, pending not added, session subset not re-added, all-time vs selected period, timezone boundaries, paginated/truncated ledger disclosure, idempotent update/reorg/restart, unknown ≠ zero, no private payer budgets and gross ≠ net.
• Mesh: MESH-FOLLOWUP exact sanitized frame fixtures, names/body boundaries, late metadata, Unicode, malformed input; actual public device example and authorized RF/player acceptance separately.

System and full regression

Map every A–E requirement and original master checklist subrow at T00. B03 connectors without File Browser; account permissions and revoked downloads. B04/B05 upload/viewer historical acceptance retained but changed artifacts retested. C/D controls exercise current actual workflows and nullable/offline/security failures, not screenshots alone. Terminal real packaged PTY/tooling, private V4V provenance, website/guest/NPM management denial, source-owned cleanup, removed-app tombstones and unmanaged stores required.

Nonempty/monetary migration rehearsal includes unresolved purchases/chunks/tips, proofs/change, pending outbox, drafts/assets, comments/identity, stopped/uninstalled apps and unrelated store. Faults: disk full, permissions, worker drain failure, interrupted migration, failed health, rollback and restart. Never overwrite a wallet/journal with a stale backup while settlement may have advanced; stop for reconciliation.

Performance and final sign-off

Measure declared codec/bitrate/link/resources/concurrency, p50/p95 latency, memory/descriptors/queues and duplicate media sessions through soak, expiry and recovery. Parent plan targets are proposals: baseline and agree budgets before tuning, never silently relax them. No final pass with required ignored/skipped/blocked cases. Historical accepted external limitations stay narrow, explicit and separate from new defects.

T00 populated baseline command table

The complete result and evidence boundaries are in T00-BASELINE.md. Summary:

Repository/source	Focused/full command	Isolation	Baseline
core/dashboard fcc18b392f44e67d1fac6d676b0b39742d3b3cff	npm test; npm run type-check; npm run build	clean worktree, exact lock install, no live services	1,596/1,596 tests; type-check/build pass; build warnings recorded
core backend, same pin	ARCHY_TEST_REPO='/path/to/clean-reviewed-checkout' ./scripts/test-backend-isolated.sh	mandatory systemd-isolated harness; no live wallet/app data/network	2,074 passed, 5 explicit ignores, 0 failed
IndeeHub development branch a71118289d49066b13e664aa795e3468a162da3e based on unaccepted audit candidate	focused Vitest; npm test; npm run type-check; npm run build	source-only, no live services	focused 16/16; full 171/171; type-check/build pass
IndeeHub backend, same branch	npm run build; npm test -- --runInBand	source fixtures, no live services	build pass; 143 passed, 82 skipped fixture-gated, 0 failed

The IndeeHub results do not establish provenance or acceptance, and skipped suites are not passes. Artifact/integration/live/operator gates remain NOT_RUN.

Incremental development evidence after baseline

Development pin/scope	Result	Boundary
IndeeHub a1a393f0bea621df66417f086e698c01d6d095e8	focused peer/catalog 15/15; type-check/build pass; full frontend 179/179 across 29 files	Partial/invalid native completeness is rejected so prior verified catalog state is retained; unaccepted source base
IndeeHub through 6c1c7d0d0c47f3a2631500530b21b0aeb10da116	isolated production-browser journey passed at 390/1440px; Backstage source harness passed at 390/768/1024/1440px	Synthetic signed relay/empty projects, external traffic blocked, no payments or installed app/account; source-only
IndeeHub 91cd38201c5730b8707e23f9c0fb037f46175890	upload/Cloud frontend 7/7; frontend 181/181; type-check/build pass; backend upload contract 22/22; backend 161 passed and 82 fixture-gated skipped; backend build and new-file lint pass	Source-only multipart identity/project authority, bounded public types/protocol input, definite-failure abort and ambiguous-finalization preservation; no real storage, installed bridge or accepted source
IndeeHub 211b902e72dd5452a21dc16253013016e20c815b plus test-only ed5d60f5784ad84115b937fc6ada1d60b1512d35	editor safety 3/3; related rerun 15/15; clean full run before the added save-recovery case 183/183 across 30 files; type-check/build pass	Active upload blocks route/update/unload; stale project response cannot cross route; failed save retains exact pending values for retry. Initial full run retained as failed due two unrelated 5-second timeouts before focused and full successful reruns
Local manifest and Vite/nginx image scaffold through a2e2bd34acc8a2be6e178bef63f03fac474cdc64	deterministic manifest positive generation plus wrong-commit/symlink refusal; image helper shell syntax, latest-tag refusal, dirty-tree refusal and clean CHECK_ONLY pass	Immutable amd64 base digests and exact lockfile are required; manifest is explicitly UNQUALIFIED
Frontend through b79a5fbc03407ac5c5b9fbf6c2057712305566d0	production dependency audit zero; frontend 184/184, type-check and build pass; nginx policy 5/5; local linux/amd64 image revision, /health, provider revalidation, proxy-prefix and nginx syntax passed	Image efcce151… and hashed OCI archive remain UNQUALIFIED, local-only, unpushed, unsigned and uninstalled; large-chunk warning retained
API through 0be4165249076d4914059be26b1c1b09462fc0f4	build pass; disposable PostgreSQL full rerun 243/243 with zero skips; local linux/amd64 image booted as uid 1000, ran migrations and opened TCP listener against disposable PostgreSQL/Redis; no Sentry payload	Production dependency audit has zero high/critical and two moderate Swagger/js-yaml findings. Swagger document generation is disabled in production, but decorators require the runtime package. Image 386a62d… and archive remain UNQUALIFIED, local-only, unpushed, unsigned and uninstalled
Frontend through d67ba0d083131b7547b204580a7ae5ca269a6148	frontend 184/184; type-check/build pass; nginx/provider policy 7/7; zero production dependency findings; isolated runtime health, one provider entry, no-cache policy and proxy-prefix passed	Added exact bundled-provider entry and comment-only legacy-core injection guard; superseded as the installed candidate after proving rollback target health
Frontend through bc9babc864368608e34636f8bfee82b7a4729989	frontend 185/185; focused auth-modal regression 1/1; type-check/build pass; nginx/provider policy 7/7; zero production dependency findings; immutable runtime at 390/1440 passed sign-in dialog focus, labelled close, Escape and opener-focus restoration	Image 19e348a…, private and UNQUALIFIED; preserves the provider compatibility guard and original sign-in visuals
Core manifests through 92d6501a419a1089e707ace6675eed60d9c50e20	frontend/API manifests validate; exact local tags selected; no frontend post-install mutation; IndeeHub app-catalog metadata drift zero	Development manifest commits are not accepted integration history. Other pre-existing catalog omissions and installer-pin findings remain separate baseline issues
Superseded installed private Y1 attempt on operator node	lower-level exact-image, identity, private-draft, multipart initialize/abort, sign-out, preservation and responsive checks passed	Operator-visible PASS withdrawn: bc9babc… compiled out the Archipelago source and its digest/unparseable runtime identity produced a false Update badge. Retained as historical lower-level evidence only; not current operator acceptance
Corrected node-source Y1 candidate d6f9046… / core manifest 61bf9c99b…	frontend 185/185; focused source 10/10; nginx 8/8; type-check/build/audit pass; builder rejects omitted /relay and wrong repository; exact image 79eadbb… installed; served hash d250374…; shell revalidation, tagged version identity, seven-service health, 110 migrations and zero monetary/publication operations passed	Operator retest required for visible Archipelago source and absent false Update badge. No funds, publication, exposure, second node or new identity used
Disposable real-MinIO multipart lifecycle	12 MiB two-part upload survived MinIO restart and API service recreation; exact bytes verified; repeated finalize failed while preserving the committed object; private anonymous GET denied; abort removed unfinished multipart state; public poster policy allowed only the tested poster path	Exact pinned MinIO image, disposable named volume, rootless bounded loopback isolation; three harness-model/readiness attempts retained as discarded before the corrected pass; not installed Cloud UAT
Disposable full API upload authority	exact API image booted with disposable PostgreSQL, Redis and MinIO; two in-memory synthetic Nostr identities obtained sessions; owner created project and completed a 6 MiB multipart object; unrelated identity was denied initialize and presign; permission revocation denied later presign and abort	Dedicated rootless network and disposable volumes, synthetic credentials only, cleanup passed. First response-consumption harness attempt discarded before clean stack recreation; not independent review or installed identity UAT
Installed synthetic identity attempt	generated identity signed in; JWT subject and backend profile matched; one private draft was created	Harness then used full-document navigation, discarding its in-memory native bridge before Backstage assertion. No product defect established. Key was never persisted and is unrecoverable; one synthetic user/filmmaker/private draft remains. Draft is unpublished with no publication record, upload, payment, rent or pending outbox. No DB/admin bypass cleanup attempted
Installed synthetic identity SPA retry	native sign-in and JWT/profile match; profile-menu SPA navigation to Backstage; UI private-project creation; authenticated multipart initialize/abort; supported owner project deletion; UI sign-out; all session credentials and native selection cleared; restricted temporary key deleted	Exact installed Y1 images, no funds/publication/owner data. Retry account remains because no owner self-delete API exists. Actual installed Cloud connector and full computer-file upload remain unavailable/NOT_RUN; disposable real-storage and API authority evidence cover those lower layers but are not relabelled installed acceptance

Failure evidence is retained: the corrected browser pass followed harness/configuration expectation failures; the first database readiness attempt ran no tests; one full updated backend run had four five-second hook timeouts with 239 passes before exact focused 14/14 and clean full 243/243 reruns; and API image ebf75cf… failed production boot because Swagger had been pruned. The replacement 0be4165… restored the required runtime package and passed disposable boot. None of these failures are reclassified as passes.

An ad hoc frontend ESLint invocation also failed because this package has no local ESLint setup and npx selected an incompatible current ESLint; it is not recorded as a lint pass and changed no tracked files. The static build retains known import/chunk warnings and is about 85 MB, mostly bundled film imagery. operator node backup, installed/served hashes, data preservation, rollback readiness and money-free headless smoke are now passed for the exact private Y1 artifact. Operator identity login/logout, authenticated Cloud/upload, canonical provenance, independent review and release/physical gates remain open.