# Local verification

Verified on macOS, Node 26, Google Chrome, and the existing lab services. No real purchases or Alexa device registrations were performed.

- **17 tests passed:** reconciliation idempotency, exact stock/reorder math, sales consistency, order validation/deduplication, reset/day rollover, approval parsing, SQLite reopen persistence, tenant isolation, safe bound filtering, and strict reorder thresholds.
- **TypeScript and browser JavaScript checks passed.**
- **Authenticated MCP smoke passed:** all four tools via the official client over Streamable HTTP, approximately 2–4 ms local round trips after SQLite integration, under the 500 ms target. Public HTTPS/tunnel latency is not measured.
- **Live Gemma + MCP flow passed:** actual configured model, authenticated tools, SQLite data, exact $882 draft, fresh owner yes, simulated order `SP-LITTLE-INDIA-20261021-001`. The local workflow can summarize verified tool results if model JSON is malformed. Claude's SDK branch is typechecked but not live-tested because no Anthropic key was provided.
- **Speech integration passed:** real Kokoro WAV through the simulator, then real Whisper transcription. Both lab services remain healthy.
- **Simulator browser check passed:** full demo, five MCP traces, grocery cards, SQL metadata, visible order confirmation, inventory, settings, fullscreen, reset, responsive mobile, no uncaught JS errors.
- **Feedback browser check passed:** spoken acknowledgement, synthesized hold music, music stops/audio context closes when answer audio is ready, final answer playback.
- **Duplex browser check passed:** synthetic microphone generates two utterances without re-tapping, mic remains live during real Kokoro audio playback, speech interrupts, next turn is handled, mic-off releases tracks. Transcription/model replies are mocked for this focused UI check. Physical microphone sensitivity/room echo needs the owner's real-browser check.
- **Admin console browser check passed:** login/logout, metrics, real SQL inspection, store filter, scoped key issuance/revocation, mobile sizing, no JS errors.
- **Authentication integration passed:** unauthenticated MCP and admin denied, tenant isolation, real SQL metadata, read-only scope enforcement, SDK schema/unknown-tool errors audited, full keys and hashes omitted from overview responses, revoked keys and disabled stores denied. Intentional failed calls remain visible in the audit history for the disabled integration-test store.
- **Confirmation safety passed:** no draft/no order; fresh yes approves the exact basket; no cancels; another session cannot approve; repeat yes has no effect; invalid input and cross-origin reset rejected; internal reset protected.
- SQLite and audit metrics survive process restart. The simulator opens no database connection. Its ordinary data operations depend only on authenticated MCP HTTP.
- Docker targets and two-service Compose are provided. The Docker daemon is stopped on this machine, so image builds are not verified.
- Private store Bearer authentication and a separate OAuth-only public ingress are implemented. Live Alexa account/device onboarding and physical Echo Show MCP Apps visuals remain unverified and are not claimed.

The three-minute video in [current demo](pitch-v4/README.md) uses actual sanitized screenshots and local metric evidence. Its narrated presentation distinguishes seeded data, simulated orders, local measurements, and remaining Alexa+ integration work.

## Judge landing and launcher

- The marketing landing page at `/` links to `/simulator`, the separate MCP console, the new embedded 144-second pitch MP4, download, original technical walkthrough, source, and technical notes. Browser checks passed on desktop/mobile, including real video playback and HTTP byte-range seeking.
- `./manage.sh setup` passed with `npm ci`, preserved existing `.env` and SQLite data, and generated private launcher settings. `start`, idempotent process detection, graceful `restart`, `status`, and `log --no-follow` were exercised with both services healthy. The executable script is self-contained Bash/Node; judges do not need FFmpeg or Python to use the app.
- Managed starts enable a preconfigured judge-admin dropdown. Browser checks passed for default profile selection, server-side demo login, logout, and switching to custom-key authentication. The real admin key is never prepopulated in browser content.
- A separate isolated server with `MCP_DEMO_LOGIN=false` rejected the judge-demo login and returned no enabled demo profile. This explicitly enabled convenience mode is intended for the seeded judge instance; store Bearer authentication remains required.
- Existing simulator browser demo and all 17 tests passed after the route change.

## Pitch and spoken controls

- Welcome on mic activation and explicit spoken stop matching have unit coverage. The browser duplex check verifies welcome playback, interruption, continuous turns, and spoken stop releasing every microphone track without an extra agent call.
- A continuous actual application recording also passed with real Whisper, Kokoro, configured model, authenticated MCP tools and SQLite. Prerecorded voice inputs requested reconciliation/restock, approved the exact basket, and stopped listening. Two agent requests and five successful tool calls completed; stop was handled locally after transcription. Current capture evidence is in `pitch-v4/evidence.json`; earlier evidence is preserved in the ignored local archive.
- The new judge-focused pitch preserves the original technical video and includes this real recording, English narration and timed captions. The experience is labeled an Alexa+ web simulation with seeded data and simulated orders.

## OAuth and Rocky deployment

- The isolated OAuth HTTP integration check passed: discovery, exact callback validation, CSRF-protected store consent, PKCE, resource binding, one-use codes, scoped bearer tokens, refresh rotation/replay detection, token-family revocation and parent-key revocation. Private API keys are rejected by the public ingress; private console/reset/identity/simulator routes return 404 there.
- Rocky Linux 9.6 deployment passed using app-specific Node 22.23.4, Linux dependency installation, manage.sh setup/restart/status, and healthy STT/TTS/LLM/MCP probes. The deployment script preserves server secrets and SQLite data. Public DNS, HTTPS/certificates and actual Alexa account/mobile testing remain manual next steps.
- The original technical video was recorded before the OAuth addition and describes that earlier state. The new pitch remains accurate about the simulated experience.

- After the operator applied LAN-only firewalld rules for ports 3100–3101 from `192.168.86.0/24`, direct laptop access to the deployed simulator status endpoint succeeded. All model/speech/MCP health probes passed. Port 3102 remains bound to loopback.

## Owner app, reporting and video correction

- Owner HTTP integration passed with actual password authentication, CSRF, shared web/MCP stock updates, stale-edit rejection, review-before-confirm ordering, report preview, fixed recipients, cooldown and logout. Python SMTP was exercised against an isolated test inbox; no external mail is sent by that test.
- Owner Chrome checks passed for login, stock edit/restore, search, draft review/confirmation, reports preview, mobile layout and logout.
- Pitch export was regenerated after detecting a video start timestamp of 20.833 seconds. The new picture and audio both start at 0.000, contain all 3456 video frames (144 seconds at 24 fps), and have no subtitle stream. A full decode passed, and the first frame was visually checked.

- POS domain checks passed: atomic stock/revenue updates, receipt-level transaction counts, retry deduplication, changed-basket rejection, overselling rollback, reconciliation stability and tenant isolation. V3 recorded an actual $87 checkout before the real voice conversation, which reported the resulting $1,122 revenue and updated stock. V2 preservation checksum passed.