# Validation status — 4 November 2026

## Implemented

- Automatic GitHub polling with attempt-specific job/log acquisition, token/App authentication and bounded artifact redirects.
- Private one-time repository policy/setup, pinned Docker recipe and explicit trusted-local backend.
- Durable task checkpoints, leases, fencing, retries and connection health.
- Automatic reproduction against a supported test inventory; protected tracked inputs.
- Structured repair-model adapter and bounded source-only patches.
- Automatic candidate verification, deterministic PR publication, native auto-merge requests and original/merged-commit CI reconciliation.
- Live dashboard and synchronized product website with accurate setup/support boundaries.
- Backward-compatible manual import/inspection/verification for ad hoc use.

## Verified in this session

**62 tests passed**, including all three Chromium workflows (local application/website, unattended automation dashboard, and standalone static website). Syntax checks and the static website build passed.

The product website and dashboard display **BuildMender**, while existing runtime identifiers remain `ci-resolve`. Website checks cover generated links and fragments, approved guide routes, Markdown rendering, output ownership, symlink rejection, private-data exclusion, and operation without an application backend. Desktop/mobile layouts, accessible tab navigation, workflow stages, menu/FAQ interactions and guide downloads were browser-verified. See [website operations](WEBSITE_GUIDE.md).

The unattended integration test uses a real Git repository and an actual failing Node test. The worker reproduces the failure, consumes a simulated structured model repair, applies it to a disposable candidate, runs the protected original tests, and proceeds through simulated provider PR/check/merge results to durable automatic resolution. Original registered source files remain unchanged.

Other checks cover restart recovery, duplicate-PR reconciliation after an ambiguous remote response, stale source/repair heads, incorrect and protected-test patches, missing test evidence, worker fencing, provider pagination, credential stripping on storage redirects, input/output bounds, structured response validation, and the local/automatic resolution boundary.

Desktop/mobile screenshots of the automatic dashboard and product website were generated and visually reviewed. Browser checks cover automatic stages, PR links, verification ownership, overflow, manual fallback, notes, filters, redaction, XSS escaping and navigation.

## Not yet verified externally

- A live GitHub account/installation and its permission/branch-policy combinations.
- Live repair-model inference and its success rate on real customer failures.
- Actual Docker runtime execution: the Docker socket is inaccessible in this session. Docker invocation policy is implemented; real local-process execution is tested.
- Production hosting, tenant isolation, private fleet operation, paid demand, or the full enterprise research scope.

The configured GitHub remote is `https://github.com/subash-thiruppathi/BuildMender.git`. Repository pushes are left to the owner as requested. No remote publication or production deployment is claimed.

## Reproduce

Run `npm test` and `npm run check`. Configure Python Playwright/Chromium with `CI_RESOLVE_BROWSER_PYTHON` or `.private/browser-python` to include browser tests. Without that configuration the three browser tests skip explicitly.

`npm start` automatically starts workers when `.private/automation.json` exists and loads credentials from `.private/automation.env`. Ordinary long-running socket listeners may be restricted in this agent environment; HTTP/browser integration runs through the authorized test runner. No account credentials were created or fabricated.