# Fresh skeleton verification

Recorded on 30 September 2026 for the replacement built from main `8046ea0f1`.
The active runtime foundations derive from the multilingual reference workspace
at `7f8d8ab`; infrastructure conventions derive from `architecture-reset`
at `b228782dd` in this repository.

| Lane | Result | Evidence and scope |
| --- | --- | --- |
| `pnpm verify` | Passed | All three Go modules: formatting, race tests, vet and executable builds. Python: frozen install, Ruff, strict Mypy and pytest. Web: types and static production build. Architecture/security fixtures, large-file review, Kubernetes renders/configuration/credential boundaries and Ansible syntax with pinned collections. |
| Archive integrity | Passed | All 1,432 tracked main files retain their exact Git blobs and executable/symlink modes under `legacy/`. Archive contents are excluded from active builds and workspaces. |
| `pnpm test:integration` | Passed | Real disposable PostgreSQL and RabbitMQ: atomic receipts/state/outbox/realtime bytes, conflicting retries, optimistic concurrency, single-root guards, restricted credentials, lease fencing, typed confirmed delivery and retry. Empty migration histories apply twice successfully. |
| Runtime images | Passed | Themelio, Beto, Metallo, API, realtime gateway and Web were built and started using configuration derived from the local Kubernetes overlay, with real session Valkey, separate history Valkey and Centrifugo. |
| Browser | Passed | Chromium authenticated two independent sessions across three windows, connected using Protobuf, revoked the shared session in another window, reconnected the still-valid session, and checked the mobile layout. |
| Contract regeneration | Passed | `pnpm generate:contracts` followed by `git diff --exit-code -- contracts services` produced no changes. |
| Minikube rollout | Not run | Minikube is not installed in the verification environment. The overlay rendered; actual rollout, NetworkPolicy enforcement and PVC restart/recovery remain unqualified. |
| k3s bootstrap/rollout | Not run | No dedicated target host or private inventory was supplied. Ansible syntax and the k3s overlay passed local checks. |
| Remote GitHub CI/image publication | Not run | Workflow sources and action pins were checked locally. No remote workflow, image push, signing or cluster activation was performed. |
| Business/operator UAT | Not run | No business contexts or UAT scenarios exist in the skeleton. Browser technical-session evidence is recorded separately. |
| Production deployment/provider qualification | Not run | This branch is a development skeleton with no production configuration or populated provider integrations. |

Disposable Docker projects created for these checks were removed. The original
working checkout and its uncommitted files were preserved. The `fresh` branch is
intended to replace the active main tree when merged into the existing repository.