For judgesFor judges
Evidence index
Every claim made on this site, its status, and the committed file or run that backs it.
Status words: PASS, FAIL, IN PROGRESS, SIMULATED. A claim with no committed file says so. File links go to the main branch of the repository.
Real PayPal sandbox gates
| Claim | Status | Evidence |
|---|---|---|
| The app authenticates and can create an AUTHORIZE order | PASS | Evidence file docs/evidence/G0/G0-20261109T031839Z.jsonl (sha256 c85c66f3b2f016fa...), re-run 42555610707 on 9 Nov; earlier run 41815593520. See docs/GATES.md. |
After a final partial the authorization reads CAPTURED and a later void answers 422 PREVIOUSLY_CAPTURED (two PayPal-account buyers, one funded by a card) | PASS | docs/evidence/G1: G1-20261104T231047Z.jsonl, G1-20261105T123116Z.jsonl |
| The unused remainder is released | INFERRED | Inferred from the two rows above. No buyer balance was read: the 9 Nov attempt (run 42567836032) was blocked because the buyer account pages asked for a sign-in again. |
| A wallet buyer and a guest with a sandbox card are both authorized in the JS SDK v6 | PASS | docs/evidence/G2: G2-20261105T115228Z.jsonl. Authorize only; a 1.00 partial capture on the guest card authorization appears in the early G3 probe, docs/evidence/G3-early. |
| Six real , including a capture and a void, each verify SUCCESS through PayPal's endpoint | PASS | docs/evidence/G4: G4-20261105T012205Z.jsonl; workflow run 41947655945 |
| Rejection of a tampered webhook | FAKE ONLY | Tested against the fake PayPal. Not run on the sandbox. |
| How long an authorization stays capturable, and whether reauthorize extends it | IN PROGRESS | Gate , gate-g3.yml. Day 0 was 7 Nov 2026 03:06 UTC; final reading about 12 Nov 06:17 UTC. No result recorded. |
| Spoken bids are accurate enough to accept without confirmation | PARTIAL | Gate , synthetic audio only; fixes chosen on the same clips. Numbers below. |
Gate G5 numbers (24 clips each, synthetic and noise-free)
| Clip set | Provider | n | Exact | Wrong accept (limit 0.05) | Confirm | Missed bid |
|---|---|---|---|---|---|---|
| eSpeak (robotic), noise-free | Deepgram nova-3 | 24 | 1.000 | 0.000 within limit | 0.292 | 0.000 |
| eSpeak (robotic), noise-free | Groq whisper-large-v3-turbo, bid prompt | 24 | 0.923 | 0.000 within limit | 0.333 | 0.000 |
| human-like synthetic voice, noise-free, 24 clips | Deepgram nova-3 | 24 | 1.000 | 0.000 within limit | 0.292 | 0.000 |
| human-like synthetic voice, noise-free, 24 clips | Groq whisper-large-v3-turbo, bid prompt | 24 | 0.923 | 0.000 within limit | 0.333 | 0.000 |
The limit is a wrong-accept rate of 0.05 or less. Every row is within it, but the first run (Deepgram nova-2, Groq without a prompt) was above it at 0.083 to 0.167, and the fixes were chosen on these same clips, so the gate stays PARTIAL. The recorded provider outputs are in packages/voice/fixtures/stt-cache and stt-cache-human; the clips are under packages/voice/fixtures/audio. The human-like set was first recorded by voice-eval run 42342379648; the current recordings come from the option trials of VOI-02. With 24 clips, one clip moves a rate by 0.042, so differences between the two sets are within noise. There is no real-room or noisy-room test.
Settlement, crash recovery and simulation
| Claim | Status | Evidence |
|---|---|---|
| Whole-auction settlement, with many holds, crash and resume | FAKE PAYPAL | Saga tests against the fake PayPal in packages/payments. Not driven through a server. |
| A real server process killed after the capture request, restarted on the same data folder and settled with one capture of 12500 on the real sandbox (CI runner, not the deployed host, one kill point) | PASS | Run 42558021614; docs/evidence/server-kill. |
| One lot of three holds settled and one in-process crash recovered on the real sandbox | PASS | Nightly specs R7, R8, R10: NIGHTLY-42200708552.json, NIGHTLY-42317068784.json. No real process kill. |
| Eight multi-day scenarios, including 30 simulated days with 100 bidders and random crashes | SIMULATED | docs/evidence/SIM/SIM-MULTIDAY.md, generated by the sim-multiday job. A fake clock and a model of PayPal; it does not replace G3. |
| Hash-chained ledger can be re-verified | Tested | packages/engine/test/public-export.test.ts; verify-ledger in packages/engine/bin |
Latency
| Claim | Status | Evidence |
|---|---|---|
| Sandbox call latency, 10 cycles, 0 failures: order 758.5 ms, authorize p95 2268.65 ms, capture p95 2280.66 ms, void p95 1235.96 ms | Measured, not committed | Actions run 42047543821 (measure-sandbox). The raw log is not committed, so this is not independently verifiable. |
| to CAPTURED within 2.5 s: MISSED, end-to-end p95 3766.67 ms (n=49, 6 holds). Hammer to SETTLED within 6 s: MISSED, p95 6927.43 ms (same run, INCOMPLETE: 1 timeout, 3 failed capture calls). The earlier n=20 run (3010.04 ms and 5591.30 ms) is a smaller sample | Measured, committed (redacted) | Actions run 42563147792 (evidence-latency); docs/evidence/latency/. Earlier: run 42346811713, docs/evidence/measure/measure-settlement.json. |
Safety and process
| Claim | Status | Evidence |
|---|---|---|
| Security checklist SEC-01 to SEC-24 | P0 rows PASS; SEC-19 and SEC-20 OPEN; SEC-09, 10, 14, 15 and 21 to 24 PARTIAL; no human sign-off | docs/SECURITY-REVIEW.md. Automated checks exist under packages/e2e/test/security; no human reviewer has signed an item, and SEC-19 to SEC-24 are agent-only reviews. No FAIL is recorded. |
| Evidence files match their recorded sha256, and tokens, buyer emails and payer ids are redacted | Checked | packages/payments/test/gates (see docs/GATES.md, "Run entries"); checklist in docs/SUBMISSION.md |
| What was checked before the repository was public | Checked | docs/PUBLIC-REPO-CHECKLIST.md |
| Fresh clone installs, typechecks and passes unit tests | Weekly CI | clean-clone.yml |
| No real money moves | Design rule | Production mode refuses fake payments (packages/server/src/config.ts); every PayPal call targets the sandbox |
See also the generated gate table and the evidence map.
Edit on GitHub
Last updated on