VERIFICATION.md

Verification record

Latest update: 2026-08-26 (Asia/Qyzylorda)

Safety boundary

• Project root: ome-memoryguard only.
• A separate Git repository was initialized inside that root.
• .env was not present or read; .env.example was replaced with synthetic placeholders.
• Live work is limited to the isolated ome-memoryguard-dev stack in eu-central-1, a separate CockroachDB development database, and synthetic data.
• Secret values, JWTs, and generated passwords were kept out of logs and repository files. Failed smoke attempts deleted their temporary Cognito users; the successful MG-10 synthetic judge user remains active intentionally, with credentials stored only in an owner-only local file.
• A monthly USD 5 AWS budget is configured as an alerting control, not a hard service cap.

Executed checks

Check	Result
Initial python -m unittest discover -s tests -v	PASS, 7 tests
Embedding provider fail-closed RED/GREEN test	PASS; unknown provider rejected without cloud calls
API request-boundary RED/GREEN test	PASS; six invalid search/audit cases rejected with 422
Final python -m unittest discover -s tests -v	PASS, 52 tests
python -m compileall -q ome_memoryguard tests	PASS
.venv\Scripts\python.exe -m pip check	PASS, no broken requirements
.venv\Scripts\python.exe -m pytest -q	PASS, 52 tests; one upstream Starlette deprecation warning
.venv\Scripts\ruff.exe check .	PASS, Ruff 0.16.1
.venv\Scripts\cfn-lint.exe template.yaml	PASS, cfn-lint 1.53.3
scripts\verify.ps1 -WithGitleaks -WithSam	PASS for all local release gates
gitleaks 8.30.1 Git history scan	PASS with a narrow allowlist for one synthetic denial fixture
gitleaks 8.30.1 working-tree scan	PASS; .env, dependencies, caches, and build output excluded
AWS SAM CLI 1.165.0 validate --lint	PASS
AWS SAM CLI 1.165.0 build --no-cached	PASS from isolated ASCII-only staging copy
.env existence check	PASS, absent
UI smoke on 127.0.0.1:8765	PASS, in-memory/deterministic
Browser console warnings/errors	PASS, none

UI scenarios verified

• Safe proposal returned active, risk 15, and was retrievable.
• Synthetic secret/prompt injection returned denied; the synthetic raw value was absent from the decision and audit timeline.
• Confidential proposal returned pending_review, then approved and retrieved with confidential clearance.
• Approval and retrieval events appeared in the audit timeline.

The temporary local server was stopped and port 8765 was verified free after the smoke test.

Live development verification

Check	Result
CockroachDB development database	PASS; separate database/user created and schema.sql applied
Lambda database driver/TLS path	PASS live; psycopg v3 used the packaged certifi CA with verify-full, and the protected audit query reached the separate CockroachDB dev database
AWS SAM stack	PASS; ome-memoryguard-dev is UPDATE_COMPLETE in Frankfurt
Public health/demo	PASS; both return HTTP 200
Protected API without JWT	PASS; returns HTTP 401
Protected API with synthetic JWT	PASS; issuer, audience, token type, tenant, and clearance claims matched; audit query returned HTTP 200 with an items response
Cognito test auth	PASS for isolated smoke setup; the synthetic user was deleted and temporary admin auth was disabled afterward
Browser OAuth + PKCE deployment	PASS; public config is secret-free, OIDC discovery/JWKS return HTTP 200, and Cognito managed login is reachable
CloudWatch logs	PASS; explicit log group with seven-day retention
Evidence S3 bucket	PASS; all public-access blocks enabled, AES256 encryption, versioning enabled
Bedrock-backed proposal	PASS live in us-west-2; one bounded synthetic proposal became active
Bedrock-backed search	PASS live; the exact synthetic memory was returned by tenant/namespace-scoped vector search
Safe failure behavior	PASS live and locally; exhausted provider retries return sanitized HTTP 503; local tests prove failed proposals/searches do not persist
Regional quota preflight	PASS; Titan V2 applied quota in us-west-2 was 60 RPM and 300,000 TPM on 2026-08-26
MG-10 store/retrieve/audit E2E	PASS; proposal and retrieval audit events were observed, temporary admin auth was removed, and judge access was prepared

The public development demo is available at https://acnvju8rb8.execute-api.eu-central-1.amazonaws.com. Its protected actions require a Cognito JWT; the page and health endpoint remain public for review.

Not executed

Check	Reason
Production deployment and real customer data	Outside the isolated synthetic dev boundary
End-to-end browser OAuth callback/sign-out	Interactive browser callback/sign-out was not exercised; the non-interactive synthetic JWT path was verified instead

tests/test_architecture.py provides local static assertions for the SAM route/IAM invariants and CockroachDB vector-index/query alignment. SAM validation/build now covers local packaging, but neither local check replaces live authorization, regional service availability, or integration testing.

MG-10 bounded live judge E2E — 2026-08-26

• The read-only quota gate reported 60 RPM and 300,000 TPM for Titan Text Embeddings V2 in us-west-2.
• The AWS Budget gate reported a USD 5.00 monthly limit, USD 0.00 calculated spend, and a USD 4.90 stop threshold. AWS Budget reporting can lag actual service usage; it remains an alerting control.
• The isolated ome-memoryguard-dev runtime reported cockroachdb storage and bedrock embeddings.
• One fixed synthetic proposal and one synthetic search completed. The proposal became active, the exact memory was retrieved, and both proposal and retrieval audit events were observed.
• The Cognito app client's original auth flows were restored and verified after temporary admin auth. The synthetic judge user is CONFIRMED and belongs to memoryguard-reviewer and memoryguard-auditor.
• The judge credential file is outside the repository under the current user's local application-data directory. Verification checked only its existence and owner-only ACL; its contents were not read.
• Sanitized evidence: assets/live/mg10-live-e2e-20260826T154011811Z-3db8ee5c.json, SHA-256 1BCABFDC5C7BD94DCF1F949C5DCBA5DC3D4A7FE6885A2E3CCA51C227286D10A5.

Bedrock quota recheck — 2026-08-06

The AWS Console was inspected without invoking a model or changing cloud resources:

• ome-memoryguard-dev remained UPDATE_COMPLETE in eu-central-1.
• The USD 5 monthly budget was healthy, with USD 0.00 shown as used.
• Titan Text Embeddings V2 on-demand RPM and TPM applied quotas were both 0 in us-west-2, us-east-1, and eu-west-3 (default values shown by AWS were 6,000 RPM and 300,000 TPM).
• No Bedrock request was attempted because the quota preflight could not pass.

scripts/bedrock-quota-preflight.ps1 added the same fail-fast read-only check through an authenticated AWS CLI session. At that 2026-08-06 checkpoint, live Bedrock E2E remained blocked; the later successful MG-10 result is recorded above.

MG-5 local preparation — 2026-08-06

• Added a read-only AWS Budget preflight that rejects a non-USD budget, a configured limit above USD 5, or actual spend at/above USD 5. It does not create or update budgets.
• Added a future live E2E runner with fixed synthetic content. It runs quota and cost preflights before one proposal and one search, then verifies proposal/retrieval audit events.
• The runner receives a short-lived synthetic Cognito ID token only from the process environment and does not print it, print memory content, export evidence, or read database secrets.
• Improved the local decision UI to show persistence, review, evidence, reason codes, and risk as separate judge-facing signals; sanitized JSON is collapsed by default.
• No live AWS call, CockroachDB write, deployment, or paid action was executed for this MG-5 update.

CockroachDB Managed MCP evidence - 2026-08-08

• The development/operations agent connected to the isolated ome-memoryguard CockroachDB Cloud cluster through the Managed MCP Server in read-only mode.
• Structured get_cluster, list_databases, and list_tables operations confirmed the target cluster, the separate ome_memoryguard database, and its initial table state.
• No mutation operation was requested. No application connection string, OAuth token, database credential, or raw account identifier is stored in this repository.
• The MCP path is documented as an independent operator and judge inspection path. The application runtime continues to use the scoped SQL user and Distributed Vector Indexing described in schema.sql.
• Reproduction steps and public code evidence are in COCKROACHDB_TOOLS.md.