`verification/e2e-proof.json`

39 lines
{
  "intent": "Make the Marketing Command Center understandable to a 10-year-old and make Quick Post offer many more assets.",
  "risk_tier": "R3",
  "environment": "Mac2 local Marketing Command Center on http://127.0.0.1:9661",
  "build_commit": "193bd34 (Quick Post UI); verification harness commit recorded in git history",
  "timestamp": "2026-09-01T18:02:00-07:00",
  "preconditions": [
    "MCC service listening on :9661",
    "Basic Auth configured",
    "Live platform adapters not invoked"
  ],
  "checks": [
    {"name":"Unauthenticated boundary","command":"GET /api/health without credentials","verdict":"PASS","evidence":"HTTP 401"},
    {"name":"Authenticated health","command":"GET /api/health with MCC credentials","verdict":"PASS","evidence":"ok=true, panels=33"},
    {"name":"Panel inventory","command":"GET /api/panels with MCC credentials","verdict":"PASS","evidence":"33 panels returned"},
    {"name":"Channel status","command":"GET /api/channels/status with MCC credentials","verdict":"PASS","evidence":"4 platform records returned"},
    {"name":"Expanded catalog source","command":"GET /api/assets/catalog?limit=200 with MCC credentials","verdict":"PASS","evidence":"catalog endpoint returned product records; Quick Post merges up to 200"},
    {"name":"Protected Quick Post APIs","command":"GET composer targets, sounds catalog, and channel status with and without credentials","verdict":"PASS","evidence":"Each anonymous request returned 401; each credentialed request returned 200"},
    {"name":"Playable music suggestions","command":"GET /quickpost-music/soft-showroom.mp3 with credentials","verdict":"PASS","evidence":"HTTP 200 audio/mpeg; three 12-second DW-original previews expose duration and commercial-use metadata"},
    {"name":"Unchecked live boundary","command":"POST /api/channels/publish with dryRun=false and confirm=false","verdict":"PASS","evidence":"HTTP 400 explicit-confirmation error; channels-outbox SHA-256 unchanged"},
    {"name":"No-write fan-out inspection","command":"POST /api/channels/publish with inspectOnly=true and dryRun=true","verdict":"PASS","evidence":"inspectOnly=true, writePerformed=false; channels-outbox SHA-256 unchanged"},
    {"name":"Cross-browser CTA","command":"node scripts/cta-quickpost.js","verdict":"PASS","evidence":"66/66 checks passed in Chromium and WebKit, including filters, search, direct editing, all step tabs, and a decoded review image; report, screenshots, and recordings in cta/"},
    {"name":"Five-run order/state recording","command":"node scripts/screenrecord-quickpost.js","verdict":"PASS","evidence":"154 recorded actions passed across five distinct full-control combinations, including decoded review-image assertions; append-only log, report, and five recordings in screenrecord/quickpost/"},
    {"name":"No draft-store mutation","command":"git diff -- data/quickpost-drafts.json","verdict":"PASS","evidence":"No diff; publish and draft boundaries were intercepted before reaching Express"}
  ],
  "side_effects": {"social_posts":0,"emails":0,"spend_usd":0,"external_writes":0},
  "validation_loop": {
    "reviewer": "Contrarian v2 gate",
    "correlation_id": "MCC-CONTRARIAN-V2-20260901-1802",
    "verdict": "SHIP IT for the local-only milestone",
    "remaining_caveats": [
      "Live platform delivery and automatic music attachment were not tested because those actions remain gated.",
      "Before live-release approval, add a checked-in track provenance manifest and a browser assertion that audio currentTime advances."
    ]
  },
  "cleanup": "No production or remote service touched; local MCC process retained for browser review.",
  "verdict": "PASS — local UX, credential boundaries, server-side publish safety, playable music suggestions, Chromium/WebKit Quick Post journey, and five distinct recorded action orders pass; no social posts, emails, spend, deploys, or external writes performed."
}