docs: record v0.8.0 hosted verification

AGENTS.md

@@ -6,13 +6,15 @@ DRIFT is release intelligence for GPU and AI-infrastructure teams. It turns
 primary release notes into cited, confidence-labelled, engineer-ready
 answers: what changed, why it matters, and what to check next.
 
-**Current phase:** `v0.8.0` is the current source release. It adds a grounded
-frontend chat box and makes the no-key fixture evidence inspectable against
-checked-in synthetic source files; hosted deployment verification is pending.
-`v0.7.0` is the current verified Railway/Vercel release: it hardens evidence
-byte integrity, makes human review notes database-only, and raises the frontend
-briefing limit to ten. `v0.6.1` is the previously verified hosted Railway
-revision, and `v0.5.1` is historical pre-review-gate evidence. The new local
+**Current phase:** `v0.8.0` is the current verified Railway/Vercel release. It
+adds a grounded frontend chat box and makes the no-key fixture evidence
+inspectable against checked-in synthetic source files. On 2026-07-17, Railway
+`/health` reported live `0.8.0`, `/docs` returned `200`, the public Vercel page
+rendered **Ask DRIFT**, and Vercel-origin CORS passed. `v0.7.0` is the prior
+verified release: it hardens evidence byte integrity, makes human review notes
+database-only, and raises the frontend briefing limit to ten. `v0.6.1` is the
+previously verified hosted Railway revision, and `v0.5.1` is historical
+pre-review-gate evidence. The new local
 guardrail work adds claim-level evidence, a separate verifier, and a human
 publication gate. `DRIFT_MODE=live`
 can make a bounded `backend.pipeline` **draft** capture: persist/reload source
@@ -180,8 +182,10 @@ Railway FastAPI service built from the repository root with `Dockerfile` and
 `railway.json`. The public frontend is
 `https://dr1ftless.vercel.app` and the API is
 `https://drift-api-prod.up.railway.app`. The current verified hosted application
-is `v0.7.0` in `DRIFT_MODE=live`, with the Vercel origin advertised through CORS;
-`v0.6.1` was the prior verified revision. On 2026-07-16, `/health` reported
+is `v0.8.0` in `DRIFT_MODE=live`. On 2026-07-17, Railway `/health` reported
+`0.8.0`, `/docs` returned `200`, the public Vercel page rendered Ask DRIFT, and
+a Vercel-origin CORS preflight allowed `GET, POST`. `v0.7.0` is the prior
+verified release; `v0.6.1` was the revision before that. On 2026-07-16, `/health` reported
 `v0.6.1`, `/briefing` returned the four
 human-reviewed Insights published that day, `/docs` returned `200`, and
 the Vercel HTML referenced the canonical API-served banner pair. The Swagger
@@ -192,7 +196,9 @@ is a small, bounded reviewed set, not broad live-release analysis. The
 Git-connected `v0.7.0` deployment was verified through `/health`, `/docs`,
 Vercel CORS, a four-record `/briefing` with no review notes, and the Vercel
 bundle's `top_n=10` request; `/search` and `/chat` were not re-invoked for this
-privacy/frontend-only release.
+privacy/frontend-only release. The Git-connected `v0.8.0` rollout was verified
+through `/health`, `/docs`, the public Ask DRIFT UI, Vercel CORS, and a
+tag-pinned fixture-source link; paid `/search` and `/chat` were not re-invoked.
 
 [`notebooks/drift_manual_run.ipynb`](notebooks/drift_manual_run.ipynb) is the
 local operator path for bounded capture and manual publication. It requires a

CHANGELOG.md

@@ -13,8 +13,16 @@ the annotated `v0.1.0` tag.
 ### Codex session record
 
 - Carried `019f6a78-6fa2-7121-9059-85ac8ceb9904` from reviewed-evidence release
-  hardening and `v0.7.0` hosted verification through this `v0.8.0` source
-  release.
+  hardening and `v0.7.0` hosted verification through this `v0.8.0` source and
+  hosted release.
+
+### Hosted deployment verification — 2026-07-17
+
+- Verified the Git-connected Railway `v0.8.0` deployment in `DRIFT_MODE=live`:
+  `/health` reports `0.8.0` and `/docs` returns `200`.
+- Verified the public Vercel page renders Ask DRIFT, a Vercel-origin CORS
+  preflight allows `GET, POST`, and immutable `v0.8.0` fixture-source links
+  resolve. Paid `/search` and `/chat` were intentionally not re-invoked.
 
 ### Added
 

README.md

@@ -199,7 +199,7 @@ the bounded local capture path.
 | Bounded capture, provenance, and status cleanup | `019f66b4-78b8-7943-a41d-91e836d28f00` | One-shot persisted capture, all-call budget/retry controls, live briefing adapter, evidence UI, and documentation synchronization |
 | Grounding guardrails and capture readiness | `019f6773-0e96-7363-9657-0e0531c3d594` | Claim spans/hashes, separate verifier, review-gated publication, cross-references, calibration cases, manual notebook, and all-source capture preflight |
 | Submission audit and frontend evidence presentation | `019f6a46-e3eb-7de2-81b1-91515ae80043` | Handwritten-next-step audit, explicit briefing states, system-theme presentation, canonical API-served banners, and status synchronization |
-| Reviewed-evidence release hardening, hosted verification, and v0.8.0 source release | `019f6a78-6fa2-7121-9059-85ac8ceb9904` | Evidence-byte integrity, database-only review notes, display-only results artifact, `v0.7.0` hosted verification, and the `v0.8.0` grounded-chat / verifiable-fixture source release |
+| Reviewed-evidence release hardening and hosted verification | `019f6a78-6fa2-7121-9059-85ac8ceb9904` | Evidence-byte integrity, database-only review notes, display-only results artifact, `v0.7.0` hosted verification, and the `v0.8.0` grounded-chat / verifiable-fixture hosted release |
 
 See the full [project initiative record](docs/INITIATIVES.md).
 
@@ -216,7 +216,7 @@ the Day 3/Day 4 Insight implementation session is
 capture-readiness follow-up is `019f6773-0e96-7363-9657-0e0531c3d594`; and the
 submission-audit/frontend-presentation follow-up is
 `019f6a46-e3eb-7de2-81b1-91515ae80043`; the reviewed-evidence hardening,
-hosted-verification, and `v0.8.0` source-release session is
+hosted-verification, and `v0.8.0` release session is
 `019f6a78-6fa2-7121-9059-85ac8ceb9904`.
 
 GPT-5.6 is used only when an operator explicitly enables `DRIFT_MODE=live` and
@@ -310,13 +310,13 @@ that frozen lockfile. JavaScript dependencies are locked in
 
 ## Deployment status
 
-Both tiers are live and were verified on 2026-07-16 — the live links live up top
+Both tiers are live and `v0.8.0` was verified on 2026-07-17 — the live links live up top
 in [Try DRIFT in 60 Seconds](#try-drift-in-60-seconds):
 
 | Surface | Status |
 | --- | --- |
-| **Current source release** | `v0.8.0` — grounded Ask DRIFT UI and verifiable synthetic fixture evidence; source tag published, hosted deployment verification pending |
-| **Hosted API** | `v0.7.0` `live` — `/health`, `/briefing` (four reviewed Insights, review notes redacted), `/docs`, `/openapi.json`, and Vercel-origin CORS verified; the deployed Vercel bundle requests `top_n=10` |
+| **Current hosted release** | `v0.8.0` `live` — `/health` reports `0.8.0`, `/docs` returns `200`, the public Vercel page renders Ask DRIFT, and Vercel-origin CORS allows `GET, POST` |
+| **Prior hosted release** | `v0.7.0` `live` — `/briefing` (four reviewed Insights, review notes redacted), `/openapi.json`, and the deployed Vercel bundle's `top_n=10` request were verified |
 | **Grounded retrieval** | `/briefing`, `/search`, and `/chat` verified provider-backed from an eight-source capture — six verifier-passed drafts, four published after human review |
 | **Database schema** | Railway PostgreSQL at `0003_claim_evidence_review_gate`, verified through its public TCP proxy |
 | **Branding** | Swagger banner frame and canonical API-served banner pair follow the same system light/dark preference |
@@ -344,7 +344,9 @@ review-gated API; reviewed evidence has since been published, so `/briefing`
 now serves four reviewed Insights instead of the intentional empty state.
 `v0.7.0` deployed the review-note redaction and ten-item briefing request;
 Railway, CORS, public-contract, and Vercel-bundle checks are recorded in the
-changelog. This did not re-run paid provider chat.
+changelog. `v0.8.0` deployed the grounded Ask DRIFT UI and tag-pinned synthetic
+fixture evidence; Railway health/docs, the public UI, and CORS were verified.
+Neither rollout re-ran paid provider chat.
 
 The branded Swagger contract and the themed architecture assets are also
 available as visual evidence:

SECURITY.md

@@ -7,8 +7,8 @@ development baseline while the live pipeline is being implemented.
 
 | Version | Supported |
 | --- | --- |
-| `0.8.0` | ✅ Current source release; grounded frontend chat and verifiable synthetic fixture evidence, awaiting hosted deployment verification |
-| `0.7.0` | Current verified hosted application; public review notes are redacted and the frontend requests up to ten briefing records |
+| `0.8.0` | ✅ Current hosted application; Railway `/health` reports `0.8.0`, `/docs` returns `200`, the public Vercel page renders Ask DRIFT, and Vercel CORS is verified |
+| `0.7.0` | Prior verified hosted application; public review notes are redacted and the frontend requests up to ten briefing records |
 | `0.6.1` | Previously verified hosted application |
 | `0.5.1` | Historical hosted baseline |
 

docs/ARCHITECTURE.md

@@ -347,7 +347,10 @@ with `/health`, `/docs`, and `/openapi.json` exposed publicly. As of
 configuration are verified. The Vercel HTML references the canonical API-served
 banner pair. The `v0.7.0` deployment makes review notes database-only and
 raises the frontend briefing limit to ten; its `/briefing`, `/openapi.json`,
-and Vercel bundle were verified after rollout. See
+and Vercel bundle were verified after rollout. On 2026-07-17, the
+Git-connected `v0.8.0` rollout verified Railway `/health` (`0.8.0`) and
+`/docs`, the public Ask DRIFT UI, and Vercel CORS; paid `/search` and `/chat`
+were not re-invoked. See
 [ADR-007](adr/007-vercel-railway-deployment.md).
 
 The browser can consume the hosted API from Vercel. On 2026-07-15, Vercel CORS

docs/BUILD_SEQUENCE.md

@@ -55,10 +55,11 @@ AI-infrastructure release intelligence.
 - [x] Operator: deployed `v0.7.0`; Railway `/health`/`/docs`, Vercel CORS,
       review-note redaction in `/briefing` and `/openapi.json`, and the deployed
       frontend's `top_n=10` request were verified
-- [x] Codex: released `v0.8.0` source changes — Ask DRIFT validates the public
+- [x] Codex: released and hosted-verified `v0.8.0` — Ask DRIFT validates the public
       `/chat` boundary, and no-key fixture claims point to checked-in synthetic
-      source text with verified offsets and hashes; hosted verification remains
-      a separate required observation
+      source text with verified offsets and hashes; Railway `/health` reported
+      `0.8.0`, `/docs` returned `200`, the public Vercel page rendered Ask DRIFT,
+      and Vercel CORS passed (paid `/search` and `/chat` were not re-invoked)
 - [x] No new model calls — the current UI remains presentation-only
 
 ## Day 8 — Final content + docs
@@ -143,7 +144,7 @@ implementation follow-ups are supported by ten project initiatives:
   `019f6773-0e96-7363-9657-0e0531c3d594`
 - Submission audit and frontend evidence presentation —
   `019f6a46-e3eb-7de2-81b1-91515ae80043`
-- Reviewed-evidence hardening, hosted verification, and `v0.8.0` source release —
+- Reviewed-evidence hardening and `v0.8.0` hosted verification —
   `019f6a78-6fa2-7121-9059-85ac8ceb9904`
 
 See [`INITIATIVES.md`](INITIATIVES.md) for scope and submission usage.

docs/CODEX_PROMPTS.md

@@ -222,7 +222,7 @@ changes:
    - `019f6a46-e3eb-7de2-81b1-91515ae80043` — submission audit and frontend
      evidence presentation
    - `019f6a78-6fa2-7121-9059-85ac8ceb9904` — reviewed-evidence hardening,
-     hosted verification, and `v0.8.0` source release
+     hosted verification, and `v0.8.0` hosted release
 
 4. Leave the Demo video line as-is (placeholder) — recording is a human
    task, not a Codex task.

docs/INITIATIVES.md

@@ -297,7 +297,7 @@ health, docs, CORS, and Vercel banner source were verified, and a later
 `/briefing`, `/search`, and `/chat` verified provider-backed. The amended
 `v0.6.1` release also makes the API-docs banner frame system-theme-aware.
 
-## Initiative 10 — Reviewed-evidence hardening, hosted verification, and v0.8.0 source release
+## Initiative 10 — Reviewed-evidence hardening and v0.8.0 hosted verification
 
 **Codex Session ID:** `019f6a78-6fa2-7121-9059-85ac8ceb9904`
 
@@ -312,10 +312,14 @@ This initiative audited and completed the reviewed-evidence release boundary:
 - verified Railway `v0.7.0`, public redaction, Vercel CORS, and the deployed
   ten-item briefing request; and
 - synchronized release, architecture, ADR, runbook, and submission records;
-- carried the same work through the `v0.8.0` source release: corrected no-key
+- carried the same work through the `v0.8.0` release: corrected no-key
   fixture claims to use explicitly synthetic, checked-in source text with
   byte-exact hashes/spans, aligned the Ask DRIFT UI with the `/chat` contract,
-  added the regression test, and performed the final status/version sweep.
+  added the regression test, and performed the final status/version sweep; and
+- verified the Git-connected `v0.8.0` rollout: Railway `/health` reported
+  `0.8.0`, `/docs` returned `200`, the public Vercel page rendered Ask DRIFT,
+  Vercel CORS passed, and a tag-pinned fixture source resolved. Paid `/search`
+  and `/chat` were not re-invoked.
 
 ## Submission usage
 
@@ -328,6 +332,6 @@ Day 3/Day 4 Insight implementation record, and Initiative 07 is the bounded
 capture/provenance and cleanup record. Initiative 08 is the additive grounding
 guardrail and capture-readiness record, Initiative 09 is the additive
 submission-audit/frontend-presentation record, and Initiative 10 is the
-reviewed-evidence hardening, hosted-verification, and `v0.8.0` source-release
+reviewed-evidence hardening and `v0.8.0` hosted-verification
 record; the earlier sessions remain the foundation, publication, and hosted-demo
 follow-up initiatives.

docs/RUNBOOK.md

@@ -91,6 +91,9 @@ This path uses committed example data and makes no external calls.
    pair. The `v0.7.0` deployment adds evidence-byte integrity, database-only
    review notes, and a ten-item frontend request; Railway `/health`/`/docs`,
    CORS, public redaction, and the Vercel bundle were verified after rollout.
+   On 2026-07-17, `v0.8.0` Railway `/health` reported `0.8.0`, `/docs` returned
+   `200`, the public Vercel page rendered Ask DRIFT, and Vercel CORS passed.
+   Paid `/search` and `/chat` were not re-invoked for this rollout.
    Scheduled population and a larger reviewed capture remain future work.
 
 ## Recording order
@@ -125,5 +128,5 @@ are listed in
   `019f6773-0e96-7363-9657-0e0531c3d594`
 - Submission audit and frontend evidence presentation:
   `019f6a46-e3eb-7de2-81b1-91515ae80043`
-- Reviewed-evidence hardening, hosted verification, and `v0.8.0` source release:
+- Reviewed-evidence hardening and `v0.8.0` hosted verification:
   `019f6a78-6fa2-7121-9059-85ac8ceb9904`

docs/adr/007-vercel-railway-deployment.md

@@ -88,6 +88,10 @@ capacity commitment.
   `0.7.0`; `/docs` and Vercel CORS remain available, `/briefing` returns four
   reviewed Insights without `human_review_notes`, and `/openapi.json` omits
   that private field. The production Vercel bundle requests `top_n=10`.
+- **2026-07-17 v0.8.0 addendum:** the Git-connected Railway deployment reports
+  `0.8.0` at `/health` and serves `/docs` with `200`; the public Vercel page
+  renders Ask DRIFT and a Vercel-origin CORS preflight allows `GET, POST`.
+  Paid `/search` and `/chat` were not re-invoked for this rollout.
 - A future alternative may consolidate the frontend and API, but that would
   require a new ADR because it changes operational boundaries.
 

docs/adr/010-claim-evidence-and-review-gate.md

@@ -73,5 +73,8 @@ the field from `/briefing` and `/openapi.json`.
 to the same evidence contract without representing synthetic text as an
 upstream release. Each fixture evidence reference resolves to a checked-in,
 explicitly synthetic source file; the full-file SHA-256, exact excerpt, offsets,
-source URL, and raw-item relationship are asserted by a regression test. This
-is source-release behavior only until a hosted deployment is observed.
+source URL, and raw-item relationship are asserted by a regression test. The
+Git-connected hosted deployment was observed later that day: `/health` reported
+`0.8.0`, a tag-pinned fixture-source link resolved, and the public Vercel page
+rendered Ask DRIFT. This observation does not imply an additional paid
+`/search` or `/chat` invocation.

docs/adr/README.md

@@ -12,10 +12,10 @@ decisions compose.
 | [004](004-local-budget-guard.md) | Local hard budget for live iteration | Accepted |
 | [005](005-postgres-pgvector-live-store.md) | PostgreSQL + pgvector for the live store | Accepted; Railway schema verified; four human-reviewed Insights published 2026-07-16 with hosted `/briefing`/`/search`/`/chat` verified provider-backed |
 | [006](006-ci-quality-gates.md) | CI quality gates and coverage ratchet | Accepted |
-| [007](007-vercel-railway-deployment.md) | Vercel frontend + Railway API and database | Accepted; hosted `v0.7.0` health/docs/CORS, review-note redaction, and Vercel `top_n=10` bundle verified; reviewed `/briefing`/`/search`/`/chat` were provider-backed verified on 2026-07-16 |
+| [007](007-vercel-railway-deployment.md) | Vercel frontend + Railway API and database | Accepted; hosted `v0.8.0` health/docs, public Ask DRIFT UI, and CORS verified 2026-07-17; `v0.7.0` redaction/`top_n=10` and reviewed `/briefing`/`/search`/`/chat` verification remain historical |
 | [008](008-live-grounded-chat.md) | Live grounded chat over the fixture store | Accepted |
 | [009](009-bounded-model-resilience-and-locked-delivery.md) | Bounded model resilience and locked delivery | Accepted |
-| [010](010-claim-evidence-and-review-gate.md) | Claim-level evidence, separate verification, and review-first publication | Accepted; `v0.8.0` source makes synthetic fixture evidence verifiable without implying upstream provenance, while four human-reviewed Insights remain the bounded hosted set verified 2026-07-16 |
+| [010](010-claim-evidence-and-review-gate.md) | Claim-level evidence, separate verification, and review-first publication | Accepted; hosted `v0.8.0` makes synthetic fixture evidence verifiable without implying upstream provenance, while four human-reviewed Insights remain the bounded hosted set verified 2026-07-16 |
 
 When implementation invalidates a decision, amend the original record or add a
 new ADR. Do not silently rewrite the decision history in code comments or