# S4 verification evidence

Date: 2026-10-28. Status: repository implementation and local container verification
passed; operational Gitea acceptance remains pending. S4 is **not complete**.

## Verified locally

- Gitea reports version 1.25.4; repository `wanjakrah/agiledancers` has Actions
  enabled and uses `main` as its default branch.
- Docker Desktop was started on the existing Linux x86_64 mini-PC. Its Docker
  daemon reports `linux/x86_64` (`linux/amd64`). This is not evidence of the
  Synology's architecture.
- `mvn clean verify` passed, including all 20 backend tests and architecture tests.
- `npm ci`, all 14 frontend unit tests with JUnit output, and the production build
  passed in the full verification script.
- Both runtime images built successfully with the `prebuilt` targets. The images
  package the same outputs that passed verification.
- Both existing Playwright tests passed (2/2) using the built frontend and backend
  containers, the frontend `/api/` proxy and Chromium in the version-matched
  Playwright container. No Angular development server was used.
- The full `ci/verify.sh` execution exited successfully; its trap removed all three
  temporary test containers and the run network.
- Eleven isolated CI tests pass: failed verification removes its success marker,
  feature branches do not publish, unverified commits cannot publish, reruns
  preserve commit tags, partial publication is recoverable, authentication and
  pull failures block publication, older commits do not move `main`, platform
  mismatches fail, and daemon configuration preserves existing settings.
- Shell syntax, Python compilation, workflow YAML parsing and the changed files'
  whitespace checks passed.
- Runner v0.2.13 was downloaded from the official source, SHA-256 checked, and
  installed with its user-service configuration using `--prepare-only`.
  The runner was subsequently registered and its user service started using the
  supplied repository administration credentials.
- The internal registry was merged into Docker Desktop's daemon configuration,
  preserving existing settings and a backup. Docker Desktop was restarted and
  the running daemon confirmed that `192.168.2.28:3000` is an active HTTP registry.

Local outputs are in `ci/artifacts/` (ignored by Git): verify log, backend test
reports, frontend unit JUnit report, Playwright JUnit/HTML report and container
logs. These are local files, not yet artifacts uploaded by a real Gitea run.
The unit JUnit report uses a separate directory so Playwright output cleanup
cannot delete it.

The local test used working-tree changes on base commit
`e3e362c2ac30d6b365f752f3da6c8b0250c019db`, with run ID `s4local`. These local
images are test outputs, not published release images for that commit.

Local image IDs (not registry digests):

- Backend: `sha256:bd77a46e3dbdcaea9662d21c608098999fe17dfdf241cd28a24a935f47401f61`.
- Frontend: `sha256:ce8e6ab21fb8f9cbee280ac2c4d7b4ca24a30e899a457382f1e45c6baf99dfb6`.

## Remaining operational acceptance

- [x] Synology architecture confirmed by the maintainer: `x86_64`,
      `linux/amd64`; repository variable `TARGET_PLATFORM=linux/amd64` configured.
- [x] Activate and verify the Docker Desktop HTTP-registry setting.
- [x] Repository `REGISTRY_USER`/`REGISTRY_TOKEN` secrets configured using the
      supplied token files. Registry access is verified by actual publication below.
- [ ] Obtain a repository runner registration token and register/start the
      installed mini-PC runner; verify it is online in Gitea.
- [ ] Confirm server settings permit every branchpush (including messages with
      skip strings) and retain uploaded diagnostic artifacts for fourteen days.
- [ ] Real feature-branch run: record URL/run ID, successful container-E2E and
      absence of publication.
- [ ] Real intentionally failing test/build run: record URL/run ID, blocked
      publication and downloadable failure artifacts.
- [ ] Real main run: record URL/run ID, both full-SHA images, successful pullback,
      registry digests and the two `main` aliases.
- [ ] Real rerun/partial-publication recovery and stale-main evidence: record
      run IDs and unchanged existing commit digests.

The isolated publication tests provide automated control-flow coverage; they do
not substitute for real authenticated registry/Gitea acceptance runs. No application
images have been published and no application has been deployed by this work.