The exact Grade 5 flow replays
Canonical and immutable APIs each return 202, a ready operation, a native Content id, 20 exhaustive coverage rows, 9 standards, 52 items, equal-or-higher DOK, and a 100-percent calibration target.
Blueprint · Integrator API · mastery_gate · attempt 1
Adopt: the API and its audit trail both reproduce.
The mastery-gate API passes the documented Grade 5 journey, auth boundary, tenant isolation, and live CASE/Content checks. The repaired publication runtime now gives the mastery-gate report its own fan-scoped deployment, while the adaptive sibling retains its own evidence identity.
Adoption decision
The product flow and certification identities both hold
The audit identities are isolated
The mastery-gate report is live at alphatest-blueprint-qc-mastery-gate; the adaptive sibling’s report, matrix, and audit independently identify adaptive_diagnostic. The credential-free dual-fan verifier exits 0.
Tech-lead call: adopt the mastery-gate surface. Re-run
verify-hosting.mjs and probe.mjs before promotion; any non-zero result revokes this pass.Endpoint-level evidence
Current wire and publication results
The credentialed rerunner repeats mutations with fresh idempotency keys. The hosting verifier requires no credentials and checks both report and evidence identities together.
| Check | Canonical API | Immutable API | Acceptance evidence |
|---|---|---|---|
| Health | 200 PASS | 200 PASS | mastery_gate; release state ready |
| Anonymous list | 401 PASS | 401 PASS | Typed authentication-required |
| Authorized list | 200 PASS | 200 PASS | Request-correlated Content 2xx trace |
| Exact Grade 5 create | 202 PASS | 202 PASS | Ready; 12 CASE + 8 Content 2xx calls |
| Idempotency | 202 / 409 PASS | 202 / 409 PASS | Same body replays; changed body is rejected |
| Detail + coverage | 200 PASS | 200 PASS | 20 rows; 9 standards; 52 items; ≥ DOK; target 100 |
| Cross-tenant reads | 404 / 404 PASS | 404 / 404 PASS | Operation and blueprint remain non-enumerating |
| Cross-tenant create | 422 PASS | Canonical boundary | No Location and no write |
| Direct datastore | 401 PASS | Unauthenticated Supabase REST denied | |
| Dual-fan audit identity | EXIT 0 · PASS | Both reports, matrices, and audits retain their own fan identity | |
DoD D2 + D5
Security and upstream reality pass independently
Both API deployments deny tenant-data list requests without a JWT.
The isolation tenant cannot enumerate newly created resources.
The API-fronted Supabase boundary rejects direct unauthenticated REST.
Both exact create flows carry sanitized traces to the declared Platform3 host.
No local mock is credited. Published receipts retain no JWT, Authorization value, service key, raw idempotency key, opaque resource id, or tenant payload.
Severity-ranked gaps
No open findings
0open gaps
RESOLVED BUG — mastery_gate now retains a distinct audit identity
Observed: node site/verify-hosting.mjs exited 0 at 2026-07-28 07:20 UTC. Both public reports returned 200; each live-probe matrix and artifact audit identified its own fan value.
Repair: the runtime derives a fan-scoped mastery-gate project instead of publishing both reports through one mutable target. The acceptance gate remains in the downloadable verifier so a future collision fails loudly.
Classification: the prior P0 was a BUG against already-published distinct canonical identities. Current evidence closes the QC finding; it does not erase the audit history.
Cross-deliverable QC
Verdicts by approved cell
| Deliverable | Verdict | Fresh evidence |
|---|---|---|
| Architecture | PASS | Approved bytes; 56 ITDs; all 12 standard API axes pinned. |
| Data dictionary | PASS | Approved hash; canonical mastery-gate origin and endpoint contract agree. |
| Customer website | PASS | Approved hash; exact Grade 5 create agrees with the live API. |
| Implementation@mastery_gate | PASS | Fresh canonical + immutable API, security, CASE, and Content probes pass. |
| Surface QC publication | PASS | Credential-free dual-fan verification exits 0 with six public identity checks. |
All 12 standard API decision axes checked
Write granularity, read shape, query model, concurrency, idempotency, auth shape, eventing, error envelope, tenant routing, conformance evidence, privacy/retention, and list endpoints each map to active architecture ITDs. The exact ITD map is in the artifact audit.
Independent reassessment
Replay both halves of the verdict
First verify publication identity without credentials. Then, with reviewer fixtures, independently replay the API pass. Scripts print sanitized output only.
curl -fsSLO 'https://alphatest-andymontgomery-9773s-projects.vercel.app/blueprint/integrator_api/surface_qc@mastery_gate/verify-hosting.mjs'
node verify-hosting.mjs
# Expected current result: exit 0, both fan identities retained
curl -fsSLO 'https://alphatest-andymontgomery-9773s-projects.vercel.app/blueprint/integrator_api/surface_qc@mastery_gate/probe.mjs'
: "${BLUEPRINT_PROD_REVIEWER_JWT:?mint a fresh demo reviewer JWT}"
: "${BLUEPRINT_ISOLATION_REVIEWER_JWT:?mint a fresh isolation JWT}"
: "${SUPABASE_URL:?set the public Supabase project URL}"
node probe.mjs
# Expected current result: exit 0, API baseline reproducedHosting 0Both fan identities are durable
Hosting 1Publication pass revoked
API 0 / 1 / 2Pass / divergence / credentials unavailable
Rollback routing
No rollback is open
PRIOR DEFECThosting collision
→REPAIRfan-scoped target
→CURRENT GATEexit 0
- The prior P0 was correctly triaged as a BUG in publication identity, not an API feature request.
- The mastery-gate report now publishes through its fan-scoped project and the actual origin is retained in the audit evidence.
- The master rewrite generator consumes recorded state deployment URLs; it does not compose a shared QC fallback for this cell.
- If either canonical fan later identifies the wrong report, matrix, or audit, route the regression to the earliest publication-runtime cell and restore the P0.
Benchmark comparison
Endpoint evidence plus repeatable reassessment
Qualys SSL Labs’ analyze API was fetched live at 2026-07-28 07:20 UTC and returned READY, endpoint grade A+, progress 100, engine 2.4.2. This report matches its explicit overall-state and replay discipline, and adds auth, upstream, tenant, documentation-byte, dual-publication, and rollback-routing evidence.