Repository navigation
Core validation sweep: reliable test evidence, data durability, authorization, and CI #156
Description
running independently on Matthew's behalf while he works
Completed dev validation/integration: final head ef495eff15ed7aac51e72dc7a1db1bb96d2b3695 passed final branch CI and Node/installer checks. Exact source, retained browser reports and protection state were independently verified; final closeout evidence records all results and limits. Main has not been promoted: its concrete release-workflow and persistence blockers, reviewed candidate and resume steps are tracked separately in #189. This closes the completed dev sweep, not those remaining release tasks.
The work establishes a fresh, reviewable validation baseline and integrates the accumulated development changes. Three parallel tracks covered security, data durability and test reliability in isolated worktrees. The dated comments preserve failed repros, corrections, exact revisions and review evidence.
Completed work:
- Restore CI execution and verify disposable-database setup.
- Reject empty, incomplete, timed-out, flaky or process-failure evidence in required gates.
- Repair scoped failed-save/navigation and delayed-save data loss with regressions; retain explicit reload/crash and reconnect limits.
- Review authorization and dependencies; integrate focused fixes with negative controls and independent review.
- Complete unit, harness, type/lint, build, real database, browser, runtime and image checks on the reviewed application source.
- Publish and merge 22 focused audit follow-ups through integration PR #157.
- Publish and merge agent policy PR #188, with independent instructions review and exhaustive documentation-only equivalence proof.
- Track the documented residual durability, hosted, security and CI-enforcement gaps in Persist unsent layout changes across reload and browser restart without cross-account replay #181–Enforce the four validated GitHub Actions checks on protected dev #187.
Closeout criteria:
- Verify actual integrations: Integrate validated graph workflows, save recovery, and authentication fixes #157 merged as
9068cd31824991330c6d92196654e53e04e29063; Document validated admin integration policy for dev #188 merged asef495eff15ed7aac51e72dc7a1db1bb96d2b3695. - Verify applicable CI and retained reports on the final
devhead; record the actual source, counts and limits. - Close the completed dev validation issue Core validation sweep: reliable test evidence, data durability, authorization, and CI #156 and timeout issue Bound test timeouts across owned child processes #162 after final validation; keep main/release promotion open in Gate main publication and validate the production stack before promotion #189.
Validation provenance:
The frozen application head 385e7679 passed CI and supported-Node/installer checks: 603 unit passes with 26 explicitly DB-gated skips; 161 harness passes; 9 real database/MCP passes; browser selections 6 smoke, 42 new-user, 27 mobile, 3 performance, plus 3 graph-effects cases. Required browser reports had no failed/skipped/evidence-error cases. Fresh production audit: eight moderate, zero high/critical. Two separate local production-image startup/authentication probes passed. These are scoped checks, not comprehensive security or deployment clearance.
Actual merge 9068cd3 has parents 8a7de052 + 385e7679 and the identical complete tested tree 6bf014bcc30eb6e21c0deeae4db9c7d4effeaac2. The policy head f94ca2a changes exactly six independently reviewed Markdown files; every other tracked entry (677 paths, modes, types and blobs) is identical. Final merge ef495ef has parents 9068cd3 + f94ca2a and exactly the reviewed policy tree 6bdd9d820f98b9882c3dcf6a110badd88bfe78bc. See independent policy review and the repository ledger.
The earlier 9068cd3 push CI and redundant policy-PR CI were superseded by final-head validation; cancelled runs are not passes. Completed intermediate jobs remain historical evidence. Final-head push CI has now passed and its artifact was independently inspected for closeout.
Admin authority:
Matthew explicitly authorized permanently disabling only dev's “enforce rules for administrators” setting and using admin integration with a high testing bar. Independent read-back confirmed that only enforce_admins.enabled: true → false changed. Non-admin approving-review count remains one; force pushes and deletion remain disabled; all other protection fields are unchanged. These were native admin merges, not submitted non-author approvals. No identity or credential scope changed. AGENTS.md and the canonical playbook require independent review, applicable checks, exact-source evidence and final branch CI. The authorization covers dev, not main, releases or deployments.
Live-site boundary:
A bounded live guest observation passed UI create/read/reload and independent device-storage readback without hosted mutations. Desktop/phone entry rendering also passed. The live metadata still identifies the September 13 release; worker health explicitly leaves the database unprobed. This does not establish hosted D1 writes, email/OAuth, crash/restart, complete accessibility, all 62 acceptance questions or deployment of this integration. Nothing was deployed.
Focused follow-ups:
- Persist unsent layout changes across reload and browser restart without cross-account replay #181 — unsent layout persistence across reload/browser restart and owner isolation.
- Establish hosted D1 mutation and sync-recovery acceptance with owned browser fixtures #182 — hosted D1 mutations and sync-recovery acceptance with owned fixtures.
- Require server-verifiable CAPTCHA policy at authentication entry points #183 — server-verifiable CAPTCHA policy.
- Bind email authentication to token purpose and verified provider identity #184 — email-token purpose, provider linking and reset-session lifecycle.
- Remediate dev-tool advisories and remove unnecessary tooling from runtime images #185 — development-tool advisories and runtime-image packaging.
- Resolve the remaining production moderate dependency families in scoped PRs #186 — remaining production moderate dependency families.
- Enforce the four validated GitHub Actions checks on protected dev #187 — named CI-check enforcement while preserving the authorized admin exception.
- Gate main publication and validate the production stack before promotion #189 — main promotion release gates, publication safety and production persistence; source findings, with the required execution still pending.
Historical baseline: on October 23, the original improve/real-workflows-responsive checkout at a6d2d4138daf31fb07d8727fc33779a9bfdb1404 was 87 commits ahead of dev; its web units passed 275 cases, while GitHub CI workflows had been disabled for inactivity. Those baseline observations are not the final validation results. Original Core/Cloud worktrees remain clean and owned local test services have been stopped.
Final retained browser artifact: 12537396736, clean unchanged ef495ef, fingerprint e375ead712ec55ec23749d7b90d852f056a873e78d851bc76d320c4033a6921d. Actual final counts remain 6/42/27/3 plus three graph-effects passes, with no failed/skipped/evidence-error required cases. Owned temporary credential files were removed after local service cleanup; sanitized evidence is retained.
Activity
mvalancy commentedon Oct 23, 2026
The review baseline is now visible in draft PR #157. CI and Comprehensive Test Suite are active again, and fresh baseline runs have started. Parallel work has reproduced position-save loss after request failure, missing folder authorization, and false-success test evidence. Each fix is being developed in an isolated branch with failing-then-passing regression tests. No integration merge or deployment is being claimed from the baseline unit results.
mvalancy commentedon Oct 23, 2026
Focused draft PRs are now open: #158 (save/deletion safety), #159 (test evidence), and #160 (folder authorization). Independent reviews found additional edge cases in #158 and #159, and the review comments document those blockers before merge. Baseline CI confirmed the missing disposable-Neo4j flag; unit, lint/type, and build jobs pass. Runtime/dependency and CI corrections are being validated locally, including a clean install and a fresh owned database fixture.
mvalancy commentedon Oct 23, 2026
Progress update (2026-10-23):
7504d0daa229eb5a8fe93ecbbb40d6e478183669. Independent review approved the scoped fixes; all 105 harness tests passed again on the actual merge commit, with a tree identical to the reviewed head. This is not a deployment or protected-branch promotion.The baseline CI run demonstrated the missing disposable-DB marker and did not pass overall. It was superseded after the integration branch advanced; cancellation of remaining gates is not counted as success. Integrated gates and protected-branch approval remain outstanding on #157.
mvalancy commentedon Oct 23, 2026
Timeout follow-up is now published as draft #164 at
f8ccacc81e32a740fbcb5ea9f1ac9a40fa71dfc1.The failing-before fixtures showed 600 ms timeouts taking about 4 seconds and a resistant descendant surviving after its wrapper closed. The correction isolates each POSIX command in its own owned process group, bounds TERM/KILL/output draining, and cleans up concurrent owned commands on cancellation while preserving caller signal handling.
Validation: 116 stdlib checks passed (11 new real-process cases), 38 focused adapter checks passed after the final reporting wording change, and the committed harness ran all 275 installed web unit tests successfully. That real report records the exact commit, a clean tree, and no source changes during execution. Platform/containment limits and the reproduction are documented in the repository.
Independent review is in progress. The PR remains draft; it does not establish browser acceptance or production parity. Integration and its disposable-stack gate remain tracked by #157.
mvalancy commentedon Oct 23, 2026
Review/validation update:
No claim that the full integrated application or deployed graphdone.com has passed is being made.
mvalancy commentedon Oct 23, 2026
New-user gate follow-up is published as draft #166, scoped to tests and repository guidance at
e6cf1ace2bf5addb4cbcba7b13fab20ddc599210on the mobile-test dependency (#163).Two recorded-AI failures came from fixture calls to intentionally removed contributor CRUD. Authorized nested fixture setup/cleanup now works without reopening those APIs, and the test uses the existing manual refresh action. The narrow-screen status failure was reproduced with a delayed save: forcing document navigation before acknowledgement left Analytics at one completed item. The corrected test checks the exact mutation, GraphQL/HTTP success, saved UI state, and independent API readback before navigation, while retaining the original expected count of two.
All nine focused headed cases passed with zero retries. A 750 ms delayed-save case remains as regression coverage; no assertion timeout or expected value was weakened. The PR also strengthens screenshot evidence by bringing the saved note into view. Final acceptance belongs to the combined strict 42-case gate, including the parallel recovery scenario. The interrupted redundant partial run is not counted as acceptance evidence.
Separately, timeout cleanup #164 passed independent review at its exact corrected head and has merged into the integration branch. No production release or production parity is claimed by these local checks.
mvalancy commentedon Oct 23, 2026
The clean combined snapshot
aece6797ef61b21665c924762fb8c9ff68870c3acompleted the strict headed new-user gate: 36 passed, 6 failed, 0 skipped across 42 actual browser cases. The unified report additionally records one failed execution-evidence case for the nonzero process exit; its rollup is therefore 36 passed / 7 failed. This is a failed gate, not a release-ready result.The six failures are under investigation: compact landscape control selection (two tests), dragging with the compact-layout lock still enabled, measuring animated node bounding boxes instead of translation, framing expectations that ignore reserved control space, and a details-save sequence whose second save stayed disabled. Test corrections must preserve actual persistence and geometry assertions; the save sequence is being investigated for a product race before any assertion change.
The same combined tree passed 516 unit tests (25 explicitly database-gated skips), 118 harness tests, lint, type checking, and builds. The first real-Neo4j contract run had two environment CPU-guard failures under concurrent local load; that failed evidence is retained and a serial CI-equivalent run is underway. Browser and contract tests use only the isolated audit database.
Parallel authentication follow-ups now include PR #169 (atomic magic-link consumption, including expiry at SQLite execution time), production startup secret validation, and GraphQL password-login abuse controls. These are receiving scoped regression tests and independent review before integration. None of these results claims that graphdone.com has been redeployed.
mvalancy commentedon Oct 23, 2026
The password-login follow-up is published as focused draft #171 at
46388cb62acfa198f13b294621216bf6cb1cb799and has independent exact-head approval.The server now limits failed/in-flight GraphQL password attempts per canonical account and IP, including aliases and concurrent requests. Successful sequential logins do not consume the failure budget. The policy is five account failures and 20 IP failures per 15-minute window, with bounded storage and documented per-process/replica, proxy, shared-network, and temporary-denial limits.
Validation: seven of the first eight regression cases failed before the correction; all 16 focused tests now pass, including real in-memory SQLite/bcrypt and an owned loopback Apollo HTTP429 check. Independent review reran those 16 successfully. All 44 server tests, typecheck, lint (zero errors), and diff checks passed after an isolated install. The successful-login test performs 45 consecutive logins without browser storage.
CAPTCHA verification and the other authentication findings remain separate work. This does not establish production deployment parity. Integration validation and merges remain tracked by #157; no existing runtime port or shared database was used for this follow-up.
mvalancy commentedon Oct 23, 2026
Progress: PR #172 now carries the responsive acceptance corrections. Its final focused run passed 8/8 with one headed Chromium worker and zero retries (653 visible buttons inspected, no content failures). The earlier 6/8 revision exposed a navigation-readiness race and remains recorded. No underlying app assertions were relaxed: persisted drags, 17-second translation stability, all-view saved data, per-step camera movement, obstacle clearance, and unchanged world positions remain checked.
The reviewed auth fixes (#169, #170, #171) were combined locally with folder authorization: 126/126 server tests passed. The login/folder merge required retaining both new imports at the same source location. The candidate then passed a fresh lockfile install and all package builds. Independent exact-SHA review comments are on the scoped PRs.
The details-save issue is a real delayed-completion race. Its isolated browser rerun passed, so a natural-timing rerun is not the regression proof: the new controlled Apollo/component cases reproduce stale draft replacement and are being fixed/reviewed, including graph/account switching and undo history.
Final integration is still pending. The runtime-only CI new-user gate is red and does not yet contain these stacked browser corrections; it is not being waived or described as green. I am also exercising the later existing CI mobile/performance gates and checking that empty fixtures cannot silently count as successful performance coverage. Production-site deployment remains outside this work.
mvalancy commentedon Oct 23, 2026
The performance gate audit confirmed two evidence gaps: its existing cases can skip empty/default graphs or missing metrics, and the API latency loop does not check HTTP success, GraphQL errors, or returned work items. The operation is a
workItemsquery, notget_graph_context.A focused test-only patch now creates and cleans its own four-node/three-edge graph for each of the three cases; checks rendered IDs, real metric samples, saved coordinates, and all 20 successful exact-data API responses; and keeps the existing budgets unchanged. Required performance and mobile CI steps now use the strict unified reporter with one worker and zero test retries. No mobile test assertions or application code are changed in this patch.
Regression evidence: before the configuration correction, controlled child processes exiting zero with all cases skipped were accepted for both required sequences; the new three targeted tests failed. After correction, all 143 harness tests pass. Actual collection finds 3 performance cases and 27 mobile cases. The focused headed performance run is now underway against the owned localhost stack; this is not a deployment-health claim. Review and browser results will follow in the focused PR.
mvalancy commentedon Oct 23, 2026
Post-fix performance browser evidence is now green: 3/3 passed in 33.9 seconds, zero skips and zero retries, one headed Chromium worker on the owned localhost stack. Test/instrumentation code was exact
4a4a11f; the clean combined app wasb009245035559fccadd350a02c106b6da42347c6. Final PR head1a16d4echanges only the dated evidence note.Both required metric snapshots came from the matching four-node/three-edge fixture and reported a terminal real tick: alpha 0, average tick 0.2 ms, and zero saved-position drift. The snapshot case independently checked all live coordinates and API saved-coordinate readback. All 20
PerfWorkItemsresponses passed HTTP/GraphQL/exact-data checks; conservative p95 was 13.7 ms. All edge → work item → graph cleanup counts passed. The same stricter browser cases had previously failed 2/3 on absent metrics against unchanged appaece679.Fresh scoped-branch checks: 150/150 harness tests, 275/275 web tests, and web typecheck pass after pinned install and core build. The earlier combined-base harness count was 151; the public base excludes an unrelated regression. Independent review found and corrected cleanup ordering, and is checking the final JSON/traces. This browser run used the direct headed JSON reporter; required-skip/retry/manifest behavior is independently covered by the harness regressions.
Artifacts remain in the audit worktree at
test-artifacts/audit-20261023/perf-final.json,perf-final.log, and per-case trace directories. The repository lesson records the commands, versions, measurements, failed-before evidence, and limits. This small placed graph is not a frame-rate, unplaced/large-graph, MCP, or deployed-site benchmark. The full integrated acceptance gates are still required.mvalancy commentedon Oct 23, 2026
The frozen combined candidate
f8a11e16a593738d485547eb1dfe117438cc3ed6completed the 42-case strict headed new-user gate: 41 passed, 1 failed, 0 skipped in 508s. Its report additionally records the nonzero process exit as a failed execution-evidence case (41/2 across 43 report entries). Start/end source fingerprints match and the tree stayed clean.The only failing browser case was the button audit: a navigation still displayed the static pre-React loading shell after its unchanged 5s deadline. This overlapped production-image builds/unpacking; that is an observation, not a proven cause. The artifact lacks a failing route and trace because the old trace setting was first-retry-only while strict gates correctly use zero retries. A narrow evidence-only follow-up will retain failure traces and route/viewport diagnostics, then the full gate will run serially with builds complete. No timeout or retry limit is being relaxed. All three details-save cases and the corrected motion/navigation/framing cases passed in this run.
Other combined evidence: 590 unit passes (25 explicitly DB-gated skips), 151 harness passes, all workspace builds/types, corrected lint with zero errors, 8 real-Neo4j contract cases, and 8 real HTTP folder/current-role checks. The production dependency gate reports zero high, zero critical, and eight moderate findings; the bundle budget passes (largest gzipped chunk 265.8 KiB versus 450 KiB limit).
The strict performance correction in #175 passed all three headed cases with independently reviewed traces, exact query data and owned cleanup. Both production image variants built successfully and rejected missing signing secrets in isolated read-only/network-disabled probes. Configured startup/authentication checks are underway. Public merges remain limited to #159/#164/#165 until the combined gates are finalized; no hosted deployment is claimed.
mvalancy commentedon Oct 23, 2026
The strict browser failure showed the static HTML loading shell, before the application mounted. It does not establish a clipped button or identify a root cause. Concurrent image builds are a hypothesis; the failed run is being retained. Its missing trace was explained by on-first-retry tracing combined with a zero-retry gate.
Focused draft PR #176 now adds failure-only traces, explicit route/viewport context, and bounded failure diagnostics without changing deadlines, assertions, or retries. It also retains trace/JSON files in each report so later Playwright output cleanup cannot erase them. Independent review reproduced an inherited unrelated-file/symlink copy path; the new downloadable evidence now requires canonical owned regular files under test-artifacts. Standalone and dashboard views provide escaped download links.
At exact head
a494741, all 160 harness tests pass. Command-forwarding, retention, and unsafe-source probes failed before their corrections. The button sweep still collects once; no new browser run or application change was made in this follow-up. The serialized complete acceptance rerun remains the final validation gate. Repository guidance distinguishes the redacted custom JSON attachment from raw authenticated Playwright traces; public progress uses summaries, not raw traces.mvalancy commentedon Oct 23, 2026
The full mobile gate on clean combined candidate
f8a11e16a593738d485547eb1dfe117438cc3ed6has now completed: 26 browser cases passed and one failed, with zero skipped/unexecuted cases (246s, exit 1). The strict adapter adds one synthetic failed process-evidence case, so the report rollup is 26 passed / 2 failed across 28 entries. This is retained separately from the earlier capped mobile probe.The remaining case expects the former
node-inspectorafter a real node tap; its captured DOM contains the current Edit work item dialog. We are checking the intended interaction and replacing stale fixture assumptions only with demonstrated behavior and owned data. A green retry alone will not count as a fix.PR #176 adds retained failure traces, bounded startup diagnostics and owned-path attachment handling. It is independently reviewed and composed locally into candidate
e120df4b849969854ffe529a64df3d42498ae4cf. The complete headed new-user gate is now running serially on that frozen source, with no Docker build overlap and no changed deadlines or retries. The prior 41-pass/1-failure startup result remains recorded.Public merge state is unchanged: #159, #164 and #165 are merged into the audit integration branch. Remaining scoped PRs and integration #157 stay draft pending the complete combined gates, final remote CI and protected-branch review. No deployment has occurred.
mvalancy commentedon Oct 23, 2026
The complete strict headed new-user gate now passes 42/42 cases, zero failures/skips/retries, exit 0, in 588.361 seconds. It ran on clean frozen candidate
e120df4b849969854ffe529a64df3d42498ae4cf; start/end source fingerprints match (5d8eb5cc8e034173785f76f3ca5b6b400f8f1388ec71771e3a6ab2e3043f0636). Target: owned local Core/Neo4j stack athttp://127.0.0.1:13127. Command:xvfb-run --auto-servernum node tests/run-unified.mjs --sequence new-user --out test-artifacts/audit-20261023/final-new-user-traced, with the pinned one-worker/zero-retry/retained-failure-trace manifest.The earlier clean
f8a11e1result (41 passed, one pre-React startup failure plus synthetic exit evidence) remains retained. This later pass does not establish its cause or claim a runtime fix. PR #176 only improved diagnostic evidence.Combined harness checks also pass 161/161 on
e120df4. The remaining mobile case is being replaced with reviewed owned-data coverage for the current touch editor, including persistence and unchanged coordinates. Full mobile, strict smoke/performance, final living-graph checks and actual public integration CI remain pending. Scoped public merges are still limited to #159, #164 and #165; no deployment or protected-branch merge has occurred.mvalancy commentedon Oct 23, 2026
CI/review mechanics have been checked independently before the final integration:
devrequires one approval, including for admins. The current author cannot self-approve; agent review comments do not satisfy that requirement. Repository auto-merge is disabled. No branch protection/settings were changed.CI Success(including the browser gate), both minimum-Node/Node24 matrix jobs, and installer/deploy-config checks. There are currently no named required status contexts configured, so the merge decision will verify these directly.cc4e8efca776b79c1be8a725943660037d1deff0ran the older direct new-user command with inherited CI retries: 40 passed and one flaky details case across41 discovered, then26/27 mobile cases. It lacked Preserve newer work-item drafts through delayed save completion #174's save-race fix, Exercise pending layout recovery through real browser navigation #167's extra layout-recovery case and the final strict execution settings. Those results remain recorded as such.e120df4now passes the full 42-case zero-retry headed new-user gate, and the corrected owned-data touch test has a separate focused pass. Remaining final mobile/performance/smoke/living gates and actual public integration CI are still pending.We will request a real non-author GitHub review after the final integration is concrete and its intended checks pass. No protected merge or hosted deployment has occurred.
mvalancy commentedon Oct 23, 2026
The strict mobile run on clean
f8a11e1had 26 actual passes and one failed touch-test expectation. The tap opened the current quick editor, while the old case waited for a historical inspector component. The additional unified failure row records the nonzero process exit; it is not another failed browser case.Focused draft PR #177 (
98c5b73, stacked on #173) now uses an owned graph/task and verifies Locked state, an actual touch tap, the correct editor, exact save acknowledgement, independent API readback, reload/reopen, and unchanged coordinates. It passed 1/1 in 14.7 seconds with zero skips/retries against unchanged combined appe120df4. Confirmed cleanup removes only that fixture in edge → task → graph order.Two development runs saved correctly but failed on SVG title-selection mistakes; both logs/traces are retained. The final assertion uses the actual rendered SVG text elements and exact full-title equality, with no deadline change. Independent source/artifact review found no blocking issue; the exact public-head review is being posted. The repository lesson preserves all failed-before evidence and limits.
No application implementation changed. The final complete strict mobile run remains required; this emulated touch case does not establish physical-device or native-keyboard behavior.
mvalancy commentedon Oct 23, 2026
All planned local combined gates are green, with earlier failures retained:
b009245e120df4e120df4e120df4e120df4bdf82ccbdf82ccb009245Build, types, lint, pinned installation, bundle budget, production high/critical audit threshold, and both container startup/authentication checks also passed. Eight production moderate advisories remain; this is not a comprehensive security or hosted-release claim. Full provenance and remaining acceptance gaps are being consolidated in the repository ledger.
The reviewed scoped PR stack is now merged into audit integration
84f1c0d132a6fda6a6bc13270363cf18b69a89f0. Its complete Git tree is identical to tested candidatebdf82cc:f5a394d442193a502ffa144022fcdcfeb8889f90, independently verified. All scoped PRs #158–#177 (excluding tracking issue #162) are merged into the stack/integration; nodevmerge has occurred. The two merge conflicts retained both authorization imports and both incident links, matching the tested tree exactly. The normal SSH merge path for workflow changes used the existing same-account authorization; no scopes or protection settings changed.A fresh read-only graphdone.com page-load check at 20:42 UTC rendered the sign-in controls at 1440px and 390px without JavaScript errors, failed requests, HTTP errors or horizontal overflow. The initial probe's missing-
mainexpectation was incorrect for this sign-in page and is retained separately; the page has no main landmark, so complete accessibility is not claimed. This check did not exercise email, sign-in transactions, guest persistence or D1 mutations. The live release remains Coref8fb968/ Cloud304629e, built September 13;/healthreports worker liveness and explicitly does not probe the database.Next: publish/merge the documentation-only consolidated ledger, freeze the final public head, complete its public CI and fresh merged-head checks, then request a real non-author review of protected #157. Auto-merge is disabled. No deployment has occurred.
mvalancy commentedon Oct 23, 2026
Final merged-head validation found a new blocking dependency result after the earlier green scans. On unchanged clean
78a90cc,npm audit --omit=dev --audit-level=high --jsonnow exits 1 with eight moderate and one high advisory: GHSA-mrhx-c7xc-m3w5, affecting installed Zod 3.25.76. Build,590 unit tests (+25 explicit DB-gated skips),161 harness tests,types,lint,bundle and 8 real Neo4j contract tests all passed on that exact merged head; the audit alone blocks final approval.The advisory was published October 1 and reviewed/updated October 23; this is not a newly published advisory at the time of this check. The earlier GitHub job genuinely reported only eight moderate findings. Rechecking with the same npm 10.9.9 client used in CI now also reports the Zod high finding; the exact metadata/cache/backend cause of the earlier discrepancy is unproven. We retain both results and do not waive the fresh failure.
We are preparing a narrow patched dependency update. The installed MCP SDK 1.32.2 already imports
zod/v4, supports^3.25 || ^4.0, and no application source imports Zod directly. Zod 4.6.7 satisfies the existing SDK dependency range. Verification will include the actual resolved SDK dependency path, bounded early-rejection regressions, SDK parsing/transport compatibility, real GraphDone MCP stdio behavior and renewed audit/build/test gates. The upstream fix addresses oversized constrained collections; unbounded collections and complete DoS resistance are not claimed.Protected #157 remains draft and unmerged. Its current browser CI remains useful evidence for the unchanged application, but the earlier security success is not sufficient for final signoff. No deployment has occurred.
mvalancy commentedon Oct 23, 2026
A deeper actual-process check found an MCP stdio defect after the merged-head tests: startup/CPU/consistency messages could corrupt stdout even while tool calls succeeded. Draft PR #179 moves exactly eight diagnostic writes to stderr and adds an actual SDK subprocess check to the existing disposable Neo4j contract.
The new regression failed before the fix on four JSON parse errors. Afterward, all 9 real contract cases passed with zero skips; 97 MCP unit tests, package build, typecheck and lint also passed (26 explicit database-gated unit skips, 31 existing lint warnings). The test checks owned data readback, invalid-call recovery, retained stderr diagnostics and subprocess termination. The separate compiled probe retained its failure and verified edge-first cleanup.
This is head
26f15f0774794e191b50ba9dea9b7f125dafb80d, based on the frozen integration revision. Independent review and combined validation with the separate Zod dependency correction are still pending. No deployed-site, complete authorization or load-test claim follows from these checks.mvalancy commentedon Oct 23, 2026
The two focused follow-ups now pass together on clean, unchanged candidate
df1fac165a5f1421602c3706db8b86090b54a4f5:A subsequent two-file documentation-only update records those results; it does not relabel the tested source. Exact-head independent review of both scoped PRs is recorded. The current public
78a90ccCI has passed smoke, strict new-user and strict mobile, and is finishing graph-effects/performance checks; it remains historical browser evidence because its dependency audit predated the newly observed finding. We are preserving it before merging the follow-ups and rerunning final public CI on the patched head. Protected #157 remains unmerged and no deployment has occurred.mvalancy commentedon Oct 23, 2026
Final integration validation is complete at frozen head
385e7679fabc60b80cd65cf0a1aa4cdf3d592514. All 22 scoped follow-up PRs are merged into the audit integration branch. PR #157 is now ready for review; review requests were sent to Patel230 and jeffreygh.e463f4a3846e87b2c6fbe48e1be93102087cd70e; its entire tree6bf014bcc30eb6e21c0deeae4db9c7d4effeaac2exactly matches the frozen PR head. Source fingerprint:a07170414e585b9e2c2356d836b07e1071b0f8ace69b1b12185f64ac60085ab8.The strict reports do not retain raw Playwright JSON or inline per-case performance metric attachments. Performance assertions passed; the source and count checks above were made against the retained case arrays. The main/nightly production-stack job is intentionally skipped on PRs and is not counted as passed. Cancelled superseded runs are not passed runs.
At 2026-10-23 21:34 UTC, fresh read-only live metadata still returned HTTP 200 and Core
f8fb968/ Cloud304629e, built September 13./healthexplicitly reportsdb: not_probed; OAuth is unconfigured and guest storage is device-local. The separate desktop/phone sign-in rendering check passed, but hosted authentication, D1 writes and persistence remain unverified. Nothing was deployed.The remaining integration blocker is the repository's one non-author approval rule, enforced for admins. The current
devprotection has no named required status checks; the checks above are our explicitly verified merge criteria, and enforcing named checks remains a settings follow-up. Auto-merge is disabled. No protection or authentication permissions were changed. The protecteddevmerge and any release remain pending; audit-branch merges do not imply either.mvalancy commentedon Oct 23, 2026
Codex is running independently on Matthew's behalf while he works. The main issue body now has the requested wording and an accurate completed/open checklist.
A further live observation at 2026-10-23 22:09:31–22:09:53 UTC passed one device-local guest workflow on graphdone.com:
This is a bounded one-off observation, not the registered local-only acceptance runner or CI. It does not establish hosted account persistence, email/OAuth, browser restart, storage eviction, offline app-shell operation, physical-phone behavior or deployment of PR #157.
The remaining layout reload/crash guarantee is now tracked in #181. Actual hosted D1 write/sync acceptance is tracked in #182. These follow-ups preserve the distinction between proven in-tab recovery, proven device-local guest reload, and unverified hosted/crash behavior. The frozen Core PR and its passing evidence are unchanged; its required non-author review remains pending.
mvalancy commentedon Oct 23, 2026
Normal protected-merge attempt at 2026-10-23 22:18:24 UTC:
GitHub still reports
REVIEW_REQUIRED, with requests pending for Patel230 and jeffreygh and no submitted non-author review. Final source/checks and original worktrees remain unchanged. All independent closeout work is recorded: the exact requested wording, completed checklist, validated guest observation, and focused follow-ups #181–#187.This issue and #162 remain open until legitimate approval permits the protected merge and its actual resulting commit passes applicable post-merge checks. The failed merge attempt is not a merge or closure.
mvalancy commentedon Oct 23, 2026
Completed at 2026-10-23T22:56:42.374372+00:00 on frozen
devheadef495eff15ed7aac51e72dc7a1db1bb96d2b3695.9068cd3; agent-policy Document validated admin integration policy for dev #188 merged asef495ef. Both actual merge parents and complete trees were independently checked. The policy changes only six reviewed Markdown files; all 677 other entries match the already validated application.ef495ef. Lint/types, build/bundle, 603 unit cases (26 explicitly DB-gated skips), 161 harness cases, nine real Neo4j/MCP cases, both Node versions and installer/config checks pass.ef495ef, fingerprinte375ead712ec55ec23749d7b90d852f056a873e78d851bc76d320c4033a6921d.385e7679, with unchanged runtime/build/dependency content in the documentation-only final head.devadmin enforcement is off under Matthew's explicit instruction. Every other protection field was verified unchanged. The high testing bar is now in AGENTS.md, CLAUDE.md and the canonical playbook. These were admin merges, not submitted non-author approvals.Cancelled superseded runs are not passes. Main/nightly-only production-stack smoke and the PR-only report-comment job on push events are intentionally skipped, not counted as tests. Normalized reports do not retain raw Playwright JSON or inline performance metric attachments; actual assertions and strict evidence checks passed. Original Core/Cloud worktrees remain clean; owned local test services and the disposable guest browser are closed.
This completes the scoped dev validation/integration work and the integrated timeout defect #162. Main promotion is being tracked separately with its concrete release-gate blockers; no main merge is claimed. Follow-ups #181–#187 remain open for the explicitly recorded durability, hosted-service, security and check-enforcement work. The live guest create/read/reload observation is separate from hosted persistence. No deployment occurred and no complete hosted-release claim is made.
mvalancy commentedon Oct 23, 2026
Clean closeout/checkpoint verification:
775362ea; dev isef495eff. No main PR was opened and no release publication or deployment was triggered.test-artifacts/audit-20261023/retained-baseline-patches/evidence directory. Corrected regressions and incident lessons remain in the published repository.The next work is the bounded resume sequence in #189, not an untracked continuation of this completed dev sweep.