Verified live
- Public architecture, dictionary, and reference resolve
- JWT authentication works
- Anonymous and invalid bearer requests are denied
- Immutable policy and calibration reads work
- 20/20 concurrent configuration reads retain JSON envelopes
Tech-lead decision
Missing adoption outcome
- No 201 adaptive run
- No native QTI delivery session
- No scored advance or deterministic replay
- No scale score or mastered / gap / not-yet map
- No Results, Caliper, or score-recovery receipt
Rollback: bank / integrator_api / implementation. Blueprint’s 2026-07-17 19:25 UTC verification proves a 202/ready create with an owner-issued blueprint id plus real CASE and Content 2xx traces. The older 08:12 UTC Bank alias receipt is historical context only. Bank must now run the corrected immutable spec through Incept, QTI scoring, and Content registration, then publish and read back the terminal qti_adaptive_selection manifest Mastery requires.
External-consumer journey
- AuthenticateReviewer JWT accepted; anonymous and invalid bearer rejected with 401.
- Read immutable inputsSelection policy and scale calibration each returned 200.
- Start diagnosticExpected 201 + native
deliverySessionId; observed 404qti.resolve_adaptive_pool_members. - Deliver and advanceNot reachable; inspect and advance also return 404.
- Complete and reportNo scale score, KC map, platform receipts, or recovery result exists.
Docs-to-wire contract
Active ITD-029 requires the owner-backed success journey from implementation onward and explicitly forbids permanent absent business routes. A truthful error envelope does not turn that missing journey into conformance.
| Probe | Expected | Observed | Verdict |
|---|---|---|---|
| Architecture / dictionary / docs | Public 200 | 200 / 200 / 200 | PASS |
| Anonymous / invalid bearer | 401 / 401 | 401 / 401 | PASS |
| Policy / calibration | 200 / 200 | 200 / 200 | PASS |
| 20-read burst | 20 JSON successes | 20/20; p95 139.2 ms | PASS |
| Start | 201 + QTI session | 404 release gate | FAIL |
| Inspect / advance | Released progression | 404 / 404 | FAIL |
| Score recovery | Recovery receipt | 404 release gate | FAIL |
| Health binding | No workload exchange gate | Advertises platform3.workload_token_exchange | FAIL |
Upstream reality
The external consumer made two authenticated reads to the real Platform3 QTI owner using the provisioned ITD-030 profile—no demo mint or workload exchange. Both returned the same 403 forbidden: the credential lacks qti:read. This proves the auth-walled boundary exists; it does not prove adaptive readiness.
QTI owner reads2
Statuses403 / 403
Stable safe hashyes
Business-route upstream calls0
Demo mintnever used
QTI readinessnot proved
The dated Bank receipt is retained separately and fingerprinted, not relabeled as this run. It records the former alias failure at 08:12 UTC. A newer fingerprinted Blueprint verification at 19:25 UTC supersedes it for routing: owner-issued identity is present and both CASE and Content traces are 2xx. The remaining current gap is the absent terminal Bank manifest.
This run attributes zero Content, CASE, Incept, QTI delivery/scoring, Results, Caliper, or NWEA calls to the failed Mastery business flow.
Security boundary
| Control | Live result | Qualification |
|---|---|---|
| Anonymous request | DENIED (401) | Production API probe |
| Invalid bearer | DENIED (401) | Production API probe |
| Absent resource | HIDDEN (404) | Safe control identifier |
| Cross-tenant learner run | INCONCLUSIVE | No legitimate tenant-owned run can be created until the owner chain succeeds. |
| Learner or tenant data retained | NONE | Only safe status, IDs, hashes, and synthetic request shapes are serialized. |
Evidence and replay
cd loop/mastery_engine/artifacts/integrator_api/integration
# Requires MASTERY_ENGINE_PROD_REVIEWER_JWT, PLATFORM3_JWT, PLATFORM3_TENANT
npm run run
npm run verifyThe runner is an independent HTTP client, not the implementation test suite. Credentials stay in environment variables and memory and are never written to evidence.
Deployment compatibility: this static report shares the module-scoped Vercel project used by the implementation. Its deployment config preserves the documented module-alias routes /health, /v1/*, /problems/*, and /upstream-bindings.json by forwarding them to the stable master-origin implementation and reviewed binding manifest.
Benchmark comparison
Stripe’s testing documentation returned HTTP 200 during this run. Stripe gives integrators a sandbox for both successful and negative end-to-end business outcomes. AlphaTest currently proves only reads, security failures, and its blocked write path; it is worse for adoption until this same client reaches a completed diagnostic.