Observed 2026-07-21 08:04:59 UTC · reports-integrator-api-adaptive-diagnostic-20260721T080459Z
The literal adaptive materialization request returns mastery_gate from both the approved customer-website sandbox and stable Reports origin, but adaptive_diagnostic from the immutable adaptive candidate. Production tenant routes remain absent. The upstream Results production mint is also publicly callable. AcmeTest must not adopt this surface.
The rerunner performs 34 non-mutating contract probes against the approved docs, their published sandbox, stable origin, immutable candidate, and Results. It retains public bodies and allowlisted headers, immediately discards the ephemeral Results token and learner values, hashes the capture, and never writes a learning fact.
REPORT_URL="<this report URL>"
curl -fsS "$REPORT_URL/probe.sh" -o probe.sh
chmod +x probe.sh
./probe.shExit 0 this QC-fail baseline reproduced · 1 drift · 2 a tenant route appeared; full D2/D5 re-audit · 3 missing dependency/target
Frozen run: 34-request matrix · targets/time · SHA-256 manifest · machine verdict.
| Property | Stable / documented surface | Immutable adaptive candidate | Verdict |
|---|---|---|---|
| POST response identity | Requested att_diag_8K2m; returned att_7F3k9 | Returned att_diag_8K2m | FAIL |
| POST response kind | mastery_gate, gate fail, no diagnostic | adaptive_diagnostic, scale 214.6, gate null | FAIL |
| Cache-Control | Stable: private, no-store; documented: public | private, no-store | DOCS FAIL |
| Build receipt | reports-unified-parked-a1-20260721; docs omit receipt | reports-unified-adaptive-a1-20260721 | FAIL |
| GET adaptive detail | adaptive · scale 214.6 · gate null | same bytes | PASS |
| Retry on each origin | stable wrong response | stable correct response | STABLE DIVERGENCE |
| Tenant report routes | detail/history/readiness/materialize all 404 | detail 404 | FAIL-CLOSED |
| Production demo mint | 404 | not mounted | PASS · ABSENT |
| Results production mint | Unauthenticated 200; minted token lists 31,319 demo rows | n/a | SECURITY FAIL |
| Results exact adaptive attempt | n/a | 200, zero exact rows | TRANSPORT ONLY |
Verbatim receipts: documented body · stable body · stable headers · candidate body · candidate headers.
The published POST is sent for att_diag_8K2m, but returns att_7F3k9, mastery_gate, and a binary gate failure. This is a docs-to-runtime contract failure in the earliest approved artifact that owns the runnable example.
Reproduce: run probe.sh; exit 0 means the complete blocked baseline still exists.
The same POST is wrong at the stable origin and correct on the candidate. Unequal build receipts isolate a release-identity failure; identical per-origin retries rule out transient response drift.
Unauthenticated POST /dev/mint?tenantId=demo returns 200. Its ephemeral token authorizes a collection read reporting 31,319 rows whose schema includes learner identifiers. The audit immediately discarded the token and all row values; this is a security failure, not a recommended integration path.
Detail, history, readiness, and materialization all return 404. The exact Results adaptive lookup is empty; test_result_components, adaptive references, and Caliper read-back are absent. Owner status pages receive no runtime credit.
Reports tenant routes and its demo mint are absent, but no same-tenant success or disjoint tenant-A/B fixtures exist. Route absence is fail-closed; it is not evidence of future tenant isolation.
200; explicit release gates, stateless composition ownership, and parked behavior.
200; adaptive scale/KC/evidence fields are specified and synthetic examples are labeled.
The page and CSS return 200 and production status is honest, but its literal adaptive POST returns the mastery fixture.
The immutable adaptive build satisfies ITD-029, but the stable customer origin serves a different POST contract and receipt.
Write granularity ITD-016 · read shape 017 · query 018 · concurrency 019 · idempotency 020 · auth 021 · eventing 022 · error envelope 023 · tenant routing 024 · conformance 025 · privacy/retention 026 · list endpoints 027. Every axis is SHIP or DEFERRED.
The documented sandbox, stable origin, and immutable candidate were driven with the same adaptive POST. Both runtime origins were also driven for adaptive and mastery GET, adaptive/formative history filters, mastery POST, retry stability, release identity, and cache policy. The customer-facing POST leaks mastery semantics; the candidate does not.
Anonymous and reviewer-shaped Reports requests return 404, and the Reports demo mint returns 404. Its sandbox is fixed and tenant-free.
A no-credential mint returned 200 and the minted demo token listed 31,319 tenant records. Cross-tenant isolation was not exercised and remains blocking-inconclusive; a publicly mintable tenant credential already fails the secure-default gate.
| Authority | Fresh evidence | Verdict |
|---|---|---|
| Results | Public production mint → authenticated list of 31,319; exact lookup empty; components/adaptive refs absent | SECURITY FAIL · NO COMPOSITION PROOF |
| Bank | Owner page says adaptive admission closed pending non-null QTI/CASE-reconciled pool | BLOCKED |
| Mastery Engine | Owner page says adaptive runtime release pending | BLOCKED |
| Caliper / QTI / CASE / Content / Administration / OneRoster / Analytics | No end-to-end learner report receipt | UNPROVEN |
Machine-readable proof ledger. No local fixture or copied payload receives upstream-call credit.
The customer website is the earliest approved deliverable whose own runnable adaptive example returns the wrong fixture. Rebuilding it also forces downstream implementation and release validation.
att_diag_8K2m, adaptive_diagnostic, score 214.6, gate null, and private/no-store.reports-unified-adaptive-a1-20260721 atomically to the stable Reports origin.The freshly fetched Qualys SSL Labs assessment was READY on engine 2.4.2 with four A+ endpoints. This audit matches its exact-target component verdicts and one-command reassessment, then adds frozen bodies, allowlisted headers, hashes, semantic API assertions, three-surface comparison, proof-level limits, explicit inconclusives, and machine-readable rollback. Frozen benchmark summary.