`verification/TK-11415/e2e-proof.json`

244 lines
{
  "ticket": "TK-11415-tk-11133-residual-meilisearch-credential",
  "timestamp": "2026-09-11T00:58:50.803Z",
  "intent": "Verify public vendor configuration classification, existing containment and resolved approval; reconcile stale ticket blocker",
  "risk_tier": "R3 read-only external verification; R0 evidence artifact",
  "environment": "macstudio3; public Momentum bundle and vendor search API",
  "build_identity": "109edc246dabcc5b84fdf727a6130b9a0fe571ce",
  "key_digest": {
    "last4": "fbd6",
    "sha256_prefix": "66fd704dc09f"
  },
  "commands": [
    "node /tmp/tk11415-verify.mjs",
    "git show / remote / ls-files / check-ignore / log",
    "node --check (3 files)",
    "Python in-memory compile (3 files)",
    "node --test --test-reporter=tap tk11040-momentum-reconcile/meilisearch-client.test.mjs"
  ],
  "assertions": [
    {
      "name": "Anonymous vendor bundle publishes identical key",
      "verdict": "PASS",
      "evidence": {
        "url": "https://momentumco.com/build/assets/app-DOnLSWOi.js",
        "http": 200,
        "sha256": "e5abea7949aabe73c33881ae301d0f08d1b8ed5578ed7313c54ccd2ae29b1a8f"
      }
    },
    {
      "name": "public-key search",
      "verdict": "PASS",
      "evidence": {
        "http": 200,
        "hits": 1
      }
    },
    {
      "name": "invalid-key search",
      "verdict": "PASS",
      "evidence": {
        "http": 403,
        "code": "invalid_api_key"
      }
    },
    {
      "name": "key-management denial",
      "verdict": "PASS",
      "evidence": {
        "http": 403,
        "code": "invalid_api_key"
      }
    },
    {
      "name": "Memo resolved with canonical decision provenance",
      "verdict": "PASS",
      "evidence": {
        "ts": "2026-09-10T20:48:51Z",
        "agent": "approval-agent",
        "ticket": "TK-11435",
        "decision": "FILE",
        "memo": "2026-09-02-TK11133-meilisearch-key-rotation-routing.md",
        "dest": "_resolved",
        "reason": "SUPERSEDED/BLOCK \u2014 Momentum PUBLIC search-scoped key, not our secret; nothing to rotate; annotations already committed. No pending Steve action."
      }
    },
    {
      "name": "tk-11331-exec has no configured remotes",
      "verdict": "PASS",
      "evidence": {
        "head": "f6b46b773bcfc3172b74f66721b70d0f2fbd952b"
      }
    },
    {
      "name": "tk-11331-exec annotation commit exists",
      "verdict": "PASS",
      "evidence": {
        "commit": "497b463",
        "files": [
          "d3c_stage.mjs",
          "scripts/scrape_momentum_feed.py"
        ]
      }
    },
    {
      "name": "tk-11331-exec/d3c_stage.mjs public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "d3c_stage.mjs"
      }
    },
    {
      "name": "tk-11331-exec/d3c_stage.mjs syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "node --check"
      }
    },
    {
      "name": "tk-11331-exec/scripts/scrape_momentum_feed.py public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "scripts/scrape_momentum_feed.py"
      }
    },
    {
      "name": "tk-11331-exec/scripts/scrape_momentum_feed.py syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "Python in-memory compile"
      }
    },
    {
      "name": "hollywood-import has no configured remotes",
      "verdict": "PASS",
      "evidence": {
        "head": "38dc6196954375352c7cd07c409bf960042491e2"
      }
    },
    {
      "name": "hollywood-import annotation commit exists",
      "verdict": "PASS",
      "evidence": {
        "commit": "8d08f31",
        "files": [
          "momentum-feed/price-backfill.mjs",
          "momentum-feed/refresh.mjs"
        ]
      }
    },
    {
      "name": "hollywood-import/momentum-feed/price-backfill.mjs public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "momentum-feed/price-backfill.mjs"
      }
    },
    {
      "name": "hollywood-import/momentum-feed/price-backfill.mjs syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "node --check"
      }
    },
    {
      "name": "hollywood-import/momentum-feed/refresh.mjs public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "momentum-feed/refresh.mjs"
      }
    },
    {
      "name": "hollywood-import/momentum-feed/refresh.mjs syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "node --check"
      }
    },
    {
      "name": "hollywood-price-2026 has no configured remotes",
      "verdict": "PASS",
      "evidence": {
        "head": "681c9a6b782ad2e94ae0df0dff3e302b8af390da"
      }
    },
    {
      "name": "hollywood-price-2026 annotation commit exists",
      "verdict": "PASS",
      "evidence": {
        "commit": "bc898f7",
        "files": [
          "build_524_split.py",
          "split_analysis.py"
        ]
      }
    },
    {
      "name": "hollywood-price-2026/build_524_split.py public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "build_524_split.py"
      }
    },
    {
      "name": "hollywood-price-2026/build_524_split.py syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "Python in-memory compile"
      }
    },
    {
      "name": "hollywood-price-2026/split_analysis.py public classification",
      "verdict": "PASS",
      "evidence": {
        "file": "split_analysis.py"
      }
    },
    {
      "name": "hollywood-price-2026/split_analysis.py syntax",
      "verdict": "PASS",
      "evidence": {
        "compiler": "Python in-memory compile"
      }
    },
    {
      "name": "Authenticated snapshot remains contained",
      "verdict": "PASS",
      "evidence": {
        "tracked": false,
        "pathHistory": false,
        "ignored": true,
        "contentsRead": false,
        "credentialsExercised": false
      }
    },
    {
      "name": "Existing client happy/auth/schema suite",
      "verdict": "PASS",
      "evidence": {
        "pass": 3,
        "fail": 0,
        "artifact": "client-tests.tap"
      }
    }
  ],
  "limitations": [
    "GET /keys denial does not prove absence of every write permission; no write probes were attempted.",
    "No configured remotes establishes current configuration, not historical absence of pushes.",
    "Snapshot containment is checked by file tracking, ignore, and path history; no new whole-disk scan was run."
  ],
  "cleanup": "No vendor state changes, credential rotation, deletion, routing, publish, or push. Only redacted local evidence retained.",
  "rollback": "Evidence is additive; no operational rollback required.",
  "verdict": "PASS",
  "verification_runner": "verification/TK-11415/verify.mjs",
  "harness_note": "First run misread Node 26 default spec reporter as TAP. Explicit TAP rerun passed all 3 tests; live API evidence was retained without repeating requests.",
  "dtd": {
    "decision": "A: close resolved triage",
    "valid_votes": 2,
    "votes_for": 2,
    "abstentions": 4,
    "post_decision": "KEEP",
    "evidence": "dtd-verdict.md"
  }
}