R1 local verification

14 October 2026. The local application gate passed. This is not a public R1 release or full-POC acceptance.

Reproducible source

Canonical code is project/Code. Source manifest records SHA-256 per file and aggregate revision 42255ea5726dce38c9153d26d4608220d31550e04cef4c14edd0d7e263901a9c. No Git commit or push was created; the repository began with untracked inputs and has no configured author identity. The content manifest identifies the reviewed source without inventing an author.

Fixtures: sample-data.json v0.1.0, business clock 11 October 2026 and week starting 5 October. Runtime: Windows, Node v24.21.0, PostgreSQL 17.11; pinned npm dependencies. Hardware: ASUS ZenBook UX363EA_UX371EA, Intel Core i7-1165G7 @ 2.80GHz, 8 logical processors, approximately 16 GiB RAM. Execution used the local NTFS AppData copy because Google Drive failed npm archive writes.

Executed checks

Commands: npm run typecheck, npm run test, npm run test:integration, npm run build, npm run test:e2e and node scripts/verify-local.mjs with an explicit evidence directory. The final browser suite reported 3 passed. The isolated test database was prevention_test, separate from prevention_dev.

Machine-readable local checks record restart, timing, links and focus results, including the UTC timestamp. The benchmark used one sequential synthetic visitor with growing review history; it is not a concurrent load/capacity result. The final suite was executed after the optional-field and keyboard-access fixes.

Reviewed screenshots

• English case, desktop
• English member, desktop
• Dutch member, 360px
• Dutch review, 360px

Corrections and remaining boundaries

The first browser run failed because the permission checkbox reverted during its asynchronous save. A draft display fixes this while success remains tied to the committed server result. The second run failed because decorative arrows entered exact accessible button names. Decorative symbols are now hidden from accessible names. Final browser tests pass, including the complete primary journey using only the keyboard. Rule review also corrected reporting completeness so it is independent of an optional check-in, verified through unit and persisted API tests.

No public URL, VPS configuration, live importer, wearable integration, lifecycle controls, activity correction/deletion, aggregate dashboard or real message delivery is claimed. Full-POC tests for those features remain not executed. Formal WCAG certification, independent human functional sign-off and native-speaker Dutch review were not performed; automated and agent visual/wording checks are recorded at their actual scope. These do not establish production or clinical acceptance.

14 October 2026: Refused local connection recovery

Neither localhost:3000 nor PostgreSQL:55432 was listening when the user reported ERR_CONNECTION_REFUSED. Previous startup logs contained no application failure explaining the stop. Replaced the agent-child-only preview launch with scripts/preview.ps1, a hidden WMI-owned host independent of the launching terminal. The host starts the existing PostgreSQL cluster and the existing production build. Avoided wrapping daemon startup in a PowerShell output pipeline, and used an explicit process exit-code check for pg_ctl status. Normal dev/start/integration/e2e commands also start PostgreSQL.

Actual checks: /en/demo returned 200; POST /api/v1/demo/start returned 201, confirming a PostgreSQL-backed session. A completed second launcher invocation returned Preview ready and did not duplicate the app. The application remained accessible after the invoking launcher ended. No firewall/proxy changes, scheduled task, login autostart, VPS access, database reset or credential change was performed.

Launcher reference: Microsoft Invoke-CimMethod. These are operational launcher changes; the earlier 21 application tests remain the recorded application baseline and were not repeated for this fix.

The current source after the launcher fix is identified separately in the recovery manifest. The earlier source-manifest.json remains the 21-test application baseline; the recovery manifest includes the operational helper changes verified by the live HTTP and repeated-launch checks above.

15 October 2026: Public HTTPS deployment

The Portfolio R1 demo is now publicly available at https://ebp.humanlearning.ai. The previous statements about no public URL describe earlier local-only milestones. This release uses Caddy, one Next.js standalone process managed by systemd, and localhost PostgreSQL with separate migration and runtime roles. Nine unit tests, production compilation and TypeScript checks passed on the VPS. All three existing Chromium journeys passed against the public HTTPS URL, covering keyboard-only completion, the member/coach/member/analyst journey, locale preservation, mobile missing-data handling and visitor isolation. Verified trusted TLS, Secure/HttpOnly/SameSite=Lax cookies, database session/state endpoints and rejection of cross-origin writes. A PostgreSQL backup was restored successfully into a separate verification database and then removed. Update and reboot results are tracked in deployment.md. This is a fictional public demo; it does not establish production or clinical acceptance.

Public deployment completion: the documented update and application rollback succeeded. An actual VPS reboot confirmed automatic service/timer startup and persisted visitor role/revision. All three public Chromium journeys passed again after reboot (18.2 seconds), along with HTTPS redirects, trusted TLS, cookie flags, database session/state and cross-origin checks. No failed systemd units were reported. Full results: deployment runbook and deployment evidence.