Run authenticated GEM Verify production pilot acceptance

[support371]

Objective

Complete one controlled, synthetic, authenticated GEM Verify case on canonical production and record evidence that role separation, workflow transitions, audit history, and readiness reporting behave correctly.

Production baseline

• Canonical Vercel project: support371-gem-enterprise
• Project ID: prj_VDGqnA7wZt2E65LLvT94ZOpnYc2Z
• Production deployment: dpl_H9EoHUEV7pDZCr8G1j45n6m75Lv5
• Production commit: c35f2a85bc2dc1f5c3614a4120887122bd0de1cd
• Production domain: https://www.gemcybersecurityassist.com
• Agent-first baseline commit contained: 217cbc89f9dfa386ef5e29a11080a49472be429e

Preflight evidence completed

• production deployment is READY
• canonical domain responds successfully
• /app/admin/verification-pilot redirects unauthenticated users to /client-login while preserving the destination
• /api/verify/pilot-readiness returns 401 Unauthorized without an administrator session
• /api/admin/users returns 401 Unauthorized without an administrator session
• no Vercel runtime errors found in the last 24 hours
• connected Supabase projects were checked and do not contain the production Prisma tables; no writes were made to them

Required controlled identities

Use company-controlled test mailboxes only. Do not put passwords in this issue.

• administrator account: existing production administrator or newly bootstrapped account through the approved environment-driven seed path
• analyst account: active, email-verified account designated through /app/admin/users
• applicant/client account: active, email-verified synthetic account

All passwords must meet the production strength policy and must be delivered through an approved secret channel, never GitHub comments.

Acceptance procedure

1. Sign in as administrator.
2. Open /app/admin/verification-pilot and capture the initial read-only readiness report.
3. Open /app/admin/users and confirm the three controlled identities exist, are active, and are email verified.
4. Designate the reviewer account as analyst using:
   • exact target-email confirmation
   • a reason of at least 10 characters
   • mandatory reauthentication after the role change
5. Sign out and sign back in as the analyst; confirm routing to /review/verification.
6. Sign in as the applicant and create one synthetic individual application using clearly fictional, non-sensitive data.
7. Record consent and submit the application.
8. Confirm the analyst can view and assign the case.
9. Issue one information request; confirm the applicant can view and respond.
10. Record one controlled decision and verify the applicant status page updates correctly.
11. Verify append-only review and audit history for login, role change, submission, review actions, and decision.
12. Confirm cross-role access is rejected:
    • applicant cannot access analyst/admin routes
    • analyst cannot access admin-only routes
    • unauthenticated requests remain 401 or redirect to login
13. Re-run /app/admin/verification-pilot and capture the final readiness report.
14. Check Vercel runtime errors and relevant route logs after the exercise.

Data rules

• Use synthetic names and non-sensitive data only.
• Do not upload identity documents while secure document upload remains disabled.
• Do not use real SSNs, passport numbers, bank details, addresses, or client records.
• Do not place passwords, session cookies, tokens, or database URLs in GitHub.

Completion criteria

• administrator session verified
• analyst designation completed and audited
• applicant account verified
• one full synthetic case completed
• information-request round trip completed
• decision and status transition verified
• append-only history verified
• unauthorized cross-role access rejected
• final pilot-readiness report reviewed
• no new production runtime errors
• evidence summary added to this issue without secrets

Current blocker

The connected tools do not expose the canonical production PostgreSQL connection or an authenticated administrator session. Therefore test identities were not created and no production records were mutated during preflight. Resume from Step 1 using an approved administrator login or the environment-driven seed bootstrap.

[support371]

Automated evidence infrastructure progress

PR #178 now provides the guarded, read-only evidence layer for this acceptance exercise.

Completed:

• administrator-only evidence API and screen;
• explicit gem-verify-phase-1b synthetic marker and naming guard;
• evaluator for controlled identities, login audits, analyst designation, consent, two submissions, assignment, two review starts, information request, final decision, role separation, ordered history, and zero documents;
• isolated production Supabase gateway gem-pilot-evidence-read-v3, ACTIVE with JWT verification;
• production/local login audit normalization (auth and user resource shapes);
• sanitized response boundary with no names, emails, form fields, notes, document metadata, credentials, tokens, or connection strings;
• evaluator and route safety tests committed.

No synthetic production identity or case has been created, and no production data row or schema has been modified during this implementation.

Remaining before using the report in the controlled pilot:

1. canonical Vercel build for exact PR head 2801b0c77d72b61156f992ce3bdb21cd99f5f0d6;
2. approved administrator, analyst, and applicant sessions;
3. execution of the controlled synthetic workflow;
4. cross-role denial checks and final runtime-error review.

[support371]

Production evidence tooling is live

PR #178 is merged at 774787397d5abe5316ec0cb6fe0d92cfd9f17b8e and canonical deployment dpl_75LCB2yeYvA6nFRg36mxRw84tfvz is READY on both production domains.

Verification completed:

• Prisma generation passed.
• ESLint passed with zero warnings.
• TypeScript passed.
• 40 test files and 302 tests passed.
• Next.js production compilation passed.
• 269 pages generated.
• The evidence page redirects unauthenticated visitors to login.
• The evidence API returns 401 Unauthorized without an administrator session and uses Cache-Control: no-store.
• No production error or fatal logs were found after release.

Read-only production readiness counts:

• active verified administrator-level identities: 1
• eligible analysts: 0
• eligible applicants: 0
• verification applications: 0
• Phase 1B synthetic applications: 0

Issue #152 remains open because the authenticated pilot itself has not been run. Remaining work is to approve one analyst identity and one synthetic applicant identity, complete the controlled workflow, verify cross-role denials, and review the final evidence report. No production row was changed during these readiness checks.