From 9bc64699cb22380b3557ab5c41952017a21ccc69 Mon Sep 17 00:00:00 2001
From: gitea-impl-agent <gitea-impl-agent@mail.jsfamily.quest>
Date: Fri, 2 Oct 2026 03:04:24 +0000
Subject: [PATCH] docs(evidence): bind persistent auth browser run

---
 .../issue-6-persistent-auth-https.json        | 111 ++++++++++++++----
 1 file changed, 88 insertions(+), 23 deletions(-)

diff --git a/docs/evidence/issue-6-persistent-auth-https.json b/docs/evidence/issue-6-persistent-auth-https.json
index 4b3d99b..c03677f 100644
--- a/docs/evidence/issue-6-persistent-auth-https.json
+++ b/docs/evidence/issue-6-persistent-auth-https.json
@@ -1,29 +1,94 @@
 {
-  "schema": "jarca-ledger.auth-evidence/v1",
+  "schema": "jarca-ledger.auth-evidence/v2",
   "issue": 6,
-  "verified_at_utc": "2026-10-01T13:51:52Z",
-  "source_revision": "7bea8b368e02e98afd4b2dc463fb270b0e6eb297",
-  "transport": "loopback HTTPS with self-signed test certificate",
-  "client": "HTTP plus Streamlit WebSocket protocol client",
-  "synthetic_database": true,
-  "results": {
-    "login_status": 303,
-    "cookie_name": "__Host-jarca_dashboard_auth",
-    "cookie_value": "[REDACTED]",
-    "secure": true,
-    "http_only": true,
-    "same_site": "lax",
-    "path": "/",
-    "remember_me_max_age_seconds": 2592000,
-    "reconnect_status": 200,
-    "streamlit_websocket_authenticated": true,
-    "streamlit_messages": 53,
-    "logout_status": 303,
-    "logout_max_age_seconds": 0
+  "pull_request": 7,
+  "source_review": 44,
+  "verified_at_utc": "2026-10-02T03:03:47Z",
+  "source_revision": "7bb959859a84f1d1293afd1f0270cca18f4cd576",
+  "source_tree_clean_before_evidence_write": true,
+  "transport": "HTTPS browser origin terminating to a loopback-only Uvicorn test server",
+  "browser_runner": {
+    "interface": "Playwright MCP",
+    "engine": "Chromium 154",
+    "architecture": "arm",
+    "bitness": "64",
+    "platform": "Linux",
+    "secure_context": true
+  },
+  "environment": {
+    "synthetic_database": true,
+    "operating_ledger_used": false,
+    "credentials": "synthetic test-only values; not recorded",
+    "signing_secret": "synthetic test-only value; not recorded",
+    "temporary_https_ingress": true
+  },
+  "local_checks": [
+    {
+      "command": "uv run --extra dashboard --extra dev pytest -q",
+      "exit_code": 0,
+      "result": "111 passed, 4 skipped"
+    },
+    {
+      "command": "uv run --extra dashboard --extra dev ruff check dashboard tests scripts",
+      "exit_code": 0,
+      "result": "All checks passed"
+    },
+    {
+      "command": "uv run --extra dashboard --extra dev python -m compileall -q dashboard scripts tests",
+      "exit_code": 0,
+      "result": "passed"
+    }
+  ],
+  "browser_results": {
+    "initial_login_page_visible": true,
+    "login": {
+      "status": 303,
+      "location": "/",
+      "cookie_name": "__Host-jarca_dashboard_auth",
+      "cookie_value": "[REDACTED]",
+      "secure": true,
+      "http_only": true,
+      "same_site": "Lax",
+      "path": "/",
+      "domain_attribute_absent": true,
+      "max_age_seconds": 2592000,
+      "document_cookie_exposed_auth_cookie": false
+    },
+    "restoration": {
+      "new_tab": true,
+      "query_page": "Import",
+      "authenticated_page_visible": true,
+      "login_page_visible": false
+    },
+    "invalid_cookie_cleanup": {
+      "injected_value": "[REDACTED TEST SENTINEL]",
+      "cleanup_status": 303,
+      "location": "/",
+      "matching_cookie_deletion": true,
+      "max_age_seconds": 0,
+      "cookie_count_after_cleanup": 0,
+      "unauthenticated_page_visible": true
+    },
+    "logout": {
+      "status": 303,
+      "location": "/",
+      "matching_cookie_deletion": true,
+      "max_age_seconds": 0,
+      "cookie_count_after_logout": 0,
+      "unauthenticated_page_visible": true,
+      "document_cookie_exposed_auth_cookie": false
+    }
+  },
+  "hashes_sha256": {
+    "scripts/persistent_auth_http_evidence.py": "403bfcd7e281d4b1750841a969a18548a580a5f3f5116abeaf83e71e81832844",
+    "dashboard/authentication.py": "63df2e33ef10859039c9b8140e92cbf0c7c8c9fe2d19cfcedbf16637c8cc2596",
+    "dashboard/auth_server.py": "d986e10d3489938c559d4f11ae20a43a448b39aae8a27978571f193f9df0e8ca",
+    "dashboard/server.py": "633c7fd9ae8a41c656a734be641de7f1733a1636216a9dbe2e50db885ff6ec6e",
+    "pyproject.toml": "64100d3aa1c2272df2e2139ed435724901f7215ea72e48bee9d73f95e7e53a8d"
   },
-  "command": "uv run --extra dashboard --extra dev python scripts/persistent_auth_http_evidence.py --base-url https://127.0.0.1:18506",
   "notes": [
-    "Credentials, signing material, and cookie values were not recorded.",
-    "This artifact records actual HTTPS and Streamlit WebSocket protocol evidence; it is not a Chromium screenshot artifact."
+    "The evidence artifact is an evidence-only descendant of source_revision; application, test, and configuration paths were not changed after source_revision verification.",
+    "Credentials, signing material, token values, raw cookie values, request bodies, and raw Set-Cookie values were not recorded.",
+    "The actual ARM64 Chromium browser performed login, HttpOnly storage, new-tab restoration, invalid-cookie cleanup, and logout deletion."
   ]
 }