{
  "schema": "jarca-ledger.auth-evidence/v2",
  "issue": 6,
  "pull_request": 7,
  "source_review": 44,
  "verified_at_utc": "2026-10-02T03:03:47Z",
  "source_revision": "7bb959859a84f1d1293afd1f0270cca18f4cd576",
  "source_tree_clean_before_evidence_write": true,
  "transport": "HTTPS browser origin terminating to a loopback-only Uvicorn test server",
  "browser_runner": {
    "interface": "Playwright MCP",
    "engine": "Chromium 154",
    "architecture": "arm",
    "bitness": "64",
    "platform": "Linux",
    "secure_context": true
  },
  "environment": {
    "synthetic_database": true,
    "operating_ledger_used": false,
    "credentials": "synthetic test-only values; not recorded",
    "signing_secret": "synthetic test-only value; not recorded",
    "temporary_https_ingress": true
  },
  "local_checks": [
    {
      "command": "uv run --extra dashboard --extra dev pytest -q",
      "exit_code": 0,
      "result": "111 passed, 4 skipped"
    },
    {
      "command": "uv run --extra dashboard --extra dev ruff check dashboard tests scripts",
      "exit_code": 0,
      "result": "All checks passed"
    },
    {
      "command": "uv run --extra dashboard --extra dev python -m compileall -q dashboard scripts tests",
      "exit_code": 0,
      "result": "passed"
    }
  ],
  "browser_results": {
    "initial_login_page_visible": true,
    "login": {
      "status": 303,
      "location": "/",
      "cookie_name": "__Host-jarca_dashboard_auth",
      "cookie_value": "[REDACTED]",
      "secure": true,
      "http_only": true,
      "same_site": "Lax",
      "path": "/",
      "domain_attribute_absent": true,
      "max_age_seconds": 2592000,
      "document_cookie_exposed_auth_cookie": false
    },
    "restoration": {
      "new_tab": true,
      "query_page": "Import",
      "authenticated_page_visible": true,
      "login_page_visible": false
    },
    "invalid_cookie_cleanup": {
      "injected_value": "[REDACTED TEST SENTINEL]",
      "cleanup_status": 303,
      "location": "/",
      "matching_cookie_deletion": true,
      "max_age_seconds": 0,
      "cookie_count_after_cleanup": 0,
      "unauthenticated_page_visible": true
    },
    "logout": {
      "status": 303,
      "location": "/",
      "matching_cookie_deletion": true,
      "max_age_seconds": 0,
      "cookie_count_after_logout": 0,
      "unauthenticated_page_visible": true,
      "document_cookie_exposed_auth_cookie": false
    }
  },
  "hashes_sha256": {
    "scripts/persistent_auth_http_evidence.py": "403bfcd7e281d4b1750841a969a18548a580a5f3f5116abeaf83e71e81832844",
    "dashboard/authentication.py": "63df2e33ef10859039c9b8140e92cbf0c7c8c9fe2d19cfcedbf16637c8cc2596",
    "dashboard/auth_server.py": "d986e10d3489938c559d4f11ae20a43a448b39aae8a27978571f193f9df0e8ca",
    "dashboard/server.py": "633c7fd9ae8a41c656a734be641de7f1733a1636216a9dbe2e50db885ff6ec6e",
    "pyproject.toml": "64100d3aa1c2272df2e2139ed435724901f7215ea72e48bee9d73f95e7e53a8d"
  },
  "notes": [
    "The evidence artifact is an evidence-only descendant of source_revision; application, test, and configuration paths were not changed after source_revision verification.",
    "Credentials, signing material, token values, raw cookie values, request bodies, and raw Set-Cookie values were not recorded.",
    "The actual ARM64 Chromium browser performed login, HttpOnly storage, new-tab restoration, invalid-cookie cleanup, and logout deletion."
  ]
}