`verification/ken-rollout/independent-verification.json`

288 lines
{
  "task_id": "TK-11438",
  "owner": "codex-run-11438-verifier",
  "risk": "R4",
  "timestamp": "2026-09-11T17:41:15.071Z",
  "assertions": [
    {
      "name": "Ken unique identity and online restart",
      "verdict": "PASS",
      "detail": {
        "before_pid": 92641,
        "after_pid": 25903,
        "restart_time": 39
      }
    },
    {
      "name": "DATABASE_URL dotenv Unix socket identity",
      "verdict": "PASS",
      "detail": {
        "database": "bertha_betting",
        "role": "macstudio3",
        "addr": null,
        "readonly": "on"
      }
    },
    {
      "name": "DATABASE_URL saved dump Unix socket identity",
      "verdict": "PASS",
      "detail": {
        "database": "bertha_betting",
        "role": "macstudio3",
        "addr": null,
        "readonly": "on"
      }
    },
    {
      "name": "KEN_DATABASE_URL dotenv Unix socket identity",
      "verdict": "PASS",
      "detail": {
        "database": "ken",
        "role": "macstudio3",
        "addr": null,
        "readonly": "on"
      }
    },
    {
      "name": "KEN_DATABASE_URL saved dump Unix socket identity",
      "verdict": "PASS",
      "detail": {
        "database": "ken",
        "role": "macstudio3",
        "addr": null,
        "readonly": "on"
      }
    },
    {
      "name": "Four effective/saved URL fields agree with dotenv",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "Captured operational switches and Ken trading configuration unchanged",
      "verdict": "PASS",
      "detail": {
        "settings": {
          "safe_mode": "false",
          "trading_on": "true",
          "kalshi_env": "prod",
          "config_hash": "556a9eb6c8fed4832b515ffd6dba0de1"
        },
        "ksettings": [
          {
            "key": "live_run",
            "value_hash": "5007ffdbce2484c46f0f1ebfed156a79"
          },
          {
            "key": "trade_config",
            "value_hash": "c77ced4a430c742f316497e371b18efc"
          }
        ]
      }
    },
    {
      "name": "LAN /api/setup none auth",
      "verdict": "PASS",
      "detail": {
        "status": 401,
        "body_sha256": "ca730ec7fc2b7edb7277e5b8e58d6a474971ca59dafb499141a4856c06132638",
        "body_code_units": 35
      }
    },
    {
      "name": "LAN /api/setup invalid auth",
      "verdict": "PASS",
      "detail": {
        "status": 401,
        "body_sha256": "ca730ec7fc2b7edb7277e5b8e58d6a474971ca59dafb499141a4856c06132638",
        "body_code_units": 35
      }
    },
    {
      "name": "LAN /api/setup valid auth",
      "verdict": "PASS",
      "detail": {
        "status": 200,
        "body_sha256": "b7618c456aa65071f5e72b8d56effe52b8edccbb2173a34abfac7ea514d3f2f0",
        "body_code_units": 75
      }
    },
    {
      "name": "LAN /api/trading/history none auth",
      "verdict": "PASS",
      "detail": {
        "status": 401,
        "body_sha256": "ca730ec7fc2b7edb7277e5b8e58d6a474971ca59dafb499141a4856c06132638",
        "body_code_units": 35
      }
    },
    {
      "name": "LAN /api/trading/history invalid auth",
      "verdict": "PASS",
      "detail": {
        "status": 401,
        "body_sha256": "ca730ec7fc2b7edb7277e5b8e58d6a474971ca59dafb499141a4856c06132638",
        "body_code_units": 35
      }
    },
    {
      "name": "LAN /api/trading/history valid auth",
      "verdict": "PASS",
      "detail": {
        "status": 200,
        "body_sha256": "5e461574d4ae8b1ce2c5495529884fdecb0dbe49b483473258640165a9212d7c",
        "body_code_units": 1195
      }
    },
    {
      "name": "Ken PID has no TCP 5432 socket",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "Ken PID has active Unix sockets",
      "verdict": "PASS",
      "detail": {
        "lines": 7,
        "sha256": "53c2cefe2834d7e98a83c8ae9d458de9b0ccb969d357530c0037bad80386ad2f"
      }
    },
    {
      "name": "Application database sessions use Unix sockets",
      "verdict": "PASS",
      "detail": [
        {
          "datname": "bertha_betting",
          "usename": "macstudio3",
          "client_addr": null,
          "client_port": -1,
          "pid": 20448
        },
        {
          "datname": "ken",
          "usename": "macstudio3",
          "client_addr": null,
          "client_port": -1,
          "pid": 20457
        }
      ]
    },
    {
      "name": "DATABASE_URL missing socket fails closed",
      "verdict": "PASS",
      "detail": {
        "code": "ENOENT"
      }
    },
    {
      "name": "KEN_DATABASE_URL missing socket fails closed",
      "verdict": "PASS",
      "detail": {
        "code": "ENOENT"
      }
    },
    {
      "name": "Server source unchanged",
      "verdict": "PASS",
      "detail": "8c20f30eb1a31fe7ad5c3884094dab8fcb0020ea7cf87d1b7c0a974693e9dc74"
    },
    {
      "name": "Hourly wrapper exact approved one-line change; not executed",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "env rollback rehearsal restored exact prior bytes",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "wrapper rollback rehearsal restored exact prior bytes",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "plist rollback rehearsal restored exact prior bytes",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "Durable dotenv matches prepared bytes",
      "verdict": "PASS",
      "detail": true
    },
    {
      "name": "Reconciliation durable and loaded socket; interval preserved; exit zero",
      "verdict": "PASS",
      "detail": {
        "interval": 1800,
        "last_exit": 0
      }
    },
    {
      "name": "Reconciliation post-reload result",
      "verdict": "PASS",
      "detail": {
        "last_line": "[reconcile-canary] OK \u2014 returned=$472535.99 invested=$319060.81 balance=$163375.18 (all reconcile within $2)",
        "mtime": "2026-09-11T17:38:14.880Z"
      }
    }
  ],
  "commands": [
    "node --check /tmp/tk11438-ken-approved/independent-check.cjs",
    "node /tmp/tk11438-ken-approved/independent-check.cjs (read-only; initial sandbox EPERM, authorized retry PASS)",
    "direct existing PM2 getMonitorData RPC",
    "node-postgres read-only identity/config/activity SELECTs using dotenv and saved PM2 URLs",
    "LAN HTTP GET /api/setup and /api/trading/history with missing, invalid and valid Basic Auth",
    "lsof -nP -a -p 25903 -iTCP and -U",
    "launchctl print gui/501/com.steve.ken-reconcile-canary",
    "plutil -convert json -o - reconciliation plist; source/backup hash reads; latest canary log read",
    "git show --stat --oneline HEAD and git rev-parse HEAD"
  ],
  "application_mutations": 0,
  "email_sends": 0,
  "pid": 25903,
  "pm_id": 15,
  "warnings": [
    {
      "name": "Whole risk_state.config comparison",
      "reason": "Baseline whole-config hash differs. Unchanged server.js lines 8027-8031 refresh weather_cache on scan. This is consistent with expected cache churn, but baseline omitted individual other keys, so exclusive cause and all-key preservation cannot be proved retroactively.",
      "baseline_hash": "2fddc5b0ff823bbe1ea724dca0dca0d0",
      "current_hash": "556a9eb6c8fed4832b515ffd6dba0de1"
    }
  ],
  "commit": "d840eb666dbe5986eb48925ef9e694c3c3d450d3",
  "verdict": "PASS",
  "status": "complete",
  "skipped": [
    {
      "name": "Hourly email-capable wrapper execution",
      "verdict": "SKIP",
      "reason": "Explicitly excluded from authorization; parent separately verifies SELECT-only signal module."
    },
    {
      "name": "Full-fleet TCP shutdown",
      "verdict": "SKIP",
      "reason": "Outside Ken batch."
    },
    {
      "name": "Live rollback execution",
      "verdict": "SKIP",
      "reason": "Healthy rollout; rollback reviewed and copies rehearsed, no induced production fault."
    }
  ],
  "rollback_review": {
    "original_must_fix": "Reload bootstrap failure left unloaded job outside rollback marker",
    "resolution": "Parent now journals before bootout and restores loaded or absent prior target; reviewed actual helper and four mocked fault scenarios",
    "mocked_scenarios": [
      "loaded recovery",
      "unloaded recovery",
      "unexpected error fails closed",
      "bootstrap failure retains journal"
    ],
    "mocked_artifact": "/tmp/tk11438-ken-approved/rollback-fault-proof.json",
    "live_rollback_performed": false
  },
  "parent_acceptance_required": true
}