A system intelligence platform: it reads what your observations mean together, and nothing it proposes happens until governance says it can. This page records what the build produced, what passed, what failed on the way, and what is still open.
The interactive demo on the proof page is read-only and runs entirely in your browser on simulated data. It does not connect to a running STΛRDΛNCΞR, and nothing you do in it is saved. The results on this page come from the real build: its tests, gates and reports.
Open the read-only demo → ← Back to proof ← GalleryVersion 0.1.7, a follow-up to 0.1.6, which shipped on 14 October 2026. It was tagged on 15 October. Every machine-checked invariant passes, no after-the-fact reviews are pending, and the approval queue is empty.
Each gate's outcome as recorded in the build's reports. A gate that failed and was fixed is listed with its fix.
| Gate | Result | What it recorded |
|---|---|---|
| Research | Pass | Go decision, 2026-10-12. 30 RESEARCH.md fields reconciled into the build: 27 applied, 2 resolved by the design template, 1 applied with a residual. |
| Checkpoints CP-1 to CP-8 | Pass | Typecheck, lint and formatting clean at each checkpoint. Schema diff 0. Only the specified routes exist. |
| Security Audit (2 passes) | Remediated | Pass 1 found 1 high, 3 medium and 6 low, and fixed the high and medium items, including an open redirect and a missing per-user stream cap. Pass 2 found one more medium (an unbounded entity listing), which was fixed. Seven low items are deferred with reasons. |
| COMPLIANCE.md | 23 pass | Of 26 spec and web rows: 23 implemented and clean, 3 with a documented note, 0 gaps. |
| Frontend audit | 99 / 99 cells | Accessibility, landmarks and viewport checks pass on every screen. Lighthouse on mobile: accessibility and best practices 100 on both pages; SEO 100 on the landing page (the signed-in overview is not indexed by design, so it is not scored). |
| Performance (INV-55) | Pass | Failed first: the build halted here with the landing at 72 and the overview at 71 against a bar of 80, after the overview's LCP had already been cut from 6.6 s to 2.0 s. A speed pass fixed it: preloaded Latin-only fonts, about 100 KB of validation code removed from both pages, and no background link prefetching. In 0.1.6 the scores were landing 83 and overview 81. At the 0.1.7 build they are landing 91 and overview 81, with LCP about 1.4 s on both. |
| Reviewer (4 rounds) | Pass | Round 1 failed on five items, which were fixed. Rounds 2, 3 and 4 passed. Round 4 reviewed 0.1.6 and its five small findings were fixed in 0.1.7. One was medium: server-rendered reads shared a single rate-limit bucket. All after-the-fact reviews are resolved. |
| Smoke test | 52 / 52 | Automated run passes at the release build. Manual checklist covers sign-up, sign-in, CRUD, unhappy paths, a database outage and missing environment variables. |
Items not verified automatically: live Stripe billing (no keys in the build environment; simulated billing mode is covered) and email delivery (the product has none by design).
Findings from the two-pass audit. Remediated items were fixed in the build; deferred items are accepted with the reason recorded.
| ID | Severity | Finding | Disposition |
|---|---|---|---|
S-1 | High | Production dependency audit showed 4 high-severity issues in the Prisma CLI chain. | Remediated moved to dev dependencies, with pinned overrides. |
S-2 | Medium | Open redirect after login, confirmed live. | Remediated control characters and backslashes refused. |
S-3 | Medium | Baseline fixture seeded a public reset token for the baseline owner. | Remediated reset targets a throwaway account. Residual: low. |
S-4 | Medium | No per-user cap on live-update streams; one member could hold every org slot. | Remediated six streams per user per replica. |
N-1 | Medium | Entity listing scanned a whole org per request with no cost limit. | Remediated per-org budget with 429 responses. |
S-5, S-10 | Low | Export rate limit did not match the spec; placeholder secrets passed validation. | Remediated |
S-6 to S-9, N-2 | Low | Redis without authentication (internal network only), root vendor containers, no email verification (no outbound mail in v1), per-batch retry cost. | Deferred each with a recorded reason. |
Result after pass 2: 0 critical, 0 high, 0 medium and 7 low residual items, all deferred with reasons.