Gate P5: frontend acceptance

[kapustazh]

Summary

Implements Gate P5 by composing the reviewed A05, B05, and C05 slices in the operator shell and exposing persisted Recovery Agent, deterministic-core, and Graph evidence through the additive frozen API.

Scope and acceptance criteria

• The change is limited to the stated milestone or issue.
• Acceptance criteria are listed and satisfied.
• No unrelated cleanup is included.
• Create/replay/conflict, denial, committed, UNKNOWN, Graph degradation, service failure, keyboard, responsive, memory-only token, and no-force-pay paths are covered by Playwright.
• Circle Agent Stack remains future work in the plan.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

Recovery remains read-only and settlement_permission is always NEVER. UNKNOWN requires reconciliation and cannot trigger blind repayment. The Graph and Recovery Agent remain advisory; OneShot's deterministic core is authoritative. No production settlement path changed.

Validation

Commands and results:

pnpm format:check: PASS
pnpm lint: PASS
pnpm typecheck: PASS
pnpm test: PASS (58 files, 904 tests)
pnpm --filter @oneshot/web test: PASS (31 tests)
pnpm --filter @oneshot/web test:browser: PASS (4/4 Chromium)
pnpm build:frontend: PASS
pnpm exec wrangler deploy --dry-run: PASS
pnpm check:generated: PASS
pnpm validate:fixtures: PASS (9 contracts-v1, 7 ui-v1)
git diff --check: PASS
Cloud Run /health/ready: HTTP 200

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 779c6cf77796f4f6773a7959b1e2b5257b64de99

• Candidate tree SHA: 698726b0aa59f86d6b5f38cb079bc81dab5d2093

• Candidate commit SHA: 7adac3f71817532c047615c4ebc8a877656bda43

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: PostgreSQL projection integration awaits CI because Docker is unavailable locally; remaining label, browser-support, and test-typecheck notes are non-blocking.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: Gate P5: frontend acceptance #50 - Gate P5: frontend acceptance #50

• Remote head commit SHA: 7adac3f71817532c047615c4ebc8a877656bda43

• Remote head tree SHA: 698726b0aa59f86d6b5f38cb079bc81dab5d2093

• Reviewer tool: free-pi-cli

• Reviewer model: not exposed by platform

• Verdict: VERDICT: PASS

• Findings or residual risks: Non-blocking tab a11y, modern-browser CSS @scope, and projection shape notes; no blocking findings. Ready for human review.

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: live Recovery/Graph provenance projection depends on the persisted command-pack shape; PostgreSQL coverage runs in CI. CSS @scope requires the supported modern-browser fleet.
• Rollback or recovery plan: revert 7adac3f71817532c047615c4ebc8a877656bda43; the API additions are optional and backward-compatible.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	7adac3f	Sep 09 2026, 11:43 AM