For judgesFor judges
Evidence index
Every claim made on this site, its status, and the committed file or run that backs it.
Status words: PASS, FAIL, IN PROGRESS, SIMULATED. A claim with no committed file says so. File links go to the main branch of the repository.
Real PayPal sandbox gates
| Claim | Status | Evidence |
|---|---|---|
| The sandbox app authenticates and can create an AUTHORIZE order | PASS | Actions run log only: workflow gate-g0, run 41815593520. No file in docs/evidence/. See docs/GATES.md. |
After a final partial capture the authorization reads CAPTURED and a later void answers 422 PREVIOUSLY_CAPTURED (two PayPal-account buyers, one funded by a card) | PASS | docs/evidence/G1: G1-20261104T231047Z.jsonl, G1-20261105T123116Z.jsonl |
| The unused remainder is released | INFERRED | Inferred from the two rows above. No buyer balance was read. |
| A wallet buyer and a guest with a sandbox card are both authorized in the JS SDK v6 | PASS | docs/evidence/G2: G2-20261105T115228Z.jsonl. Authorize only; no capture of a guest card ran. |
| Six real webhooks, including a capture and a void, each verify SUCCESS through PayPal's endpoint | PASS | docs/evidence/G4: G4-20261105T012205Z.jsonl; workflow run 41947655945 |
| Rejection of a tampered webhook | FAKE ONLY | Tested against the fake PayPal. Not run on the sandbox. |
| How long an authorization stays capturable, and whether reauthorize extends it | IN PROGRESS | Gate G3, gate-g3.yml. Day 0 was 7 Nov 2026 03:06 UTC; final reading about 12 Nov 06:17 UTC. No result recorded. |
| Spoken bids are accurate enough to accept without confirmation | PARTIAL | Gate G5, synthetic audio only; fixes chosen on the same clips. Numbers below. |
Gate G5 numbers (24 clips each, synthetic and noise-free)
| Clip set | Provider | n | Exact | Wrong accept (limit 0.05) | Confirm | Missed bid |
|---|---|---|---|---|---|---|
| eSpeak (robotic), noise-free | Deepgram nova-3 | 24 | 1.000 | 0.000 within limit | 0.292 | 0.000 |
| eSpeak (robotic), noise-free | Groq whisper-large-v3-turbo, bid prompt | 24 | 0.923 | 0.000 within limit | 0.333 | 0.000 |
| human-like synthetic voice, noise-free, 24 clips | Deepgram nova-3 | 24 | 1.000 | 0.000 within limit | 0.292 | 0.000 |
| human-like synthetic voice, noise-free, 24 clips | Groq whisper-large-v3-turbo, bid prompt | 24 | 0.923 | 0.000 within limit | 0.333 | 0.000 |
The limit is a wrong-accept rate of 0.05 or less. Every row is within it, but the first run (Deepgram nova-2, Groq without a prompt) was above it at 0.083 to 0.167, and the fixes were chosen on these same clips, so the gate stays PARTIAL. The recorded provider outputs are in packages/voice/fixtures/stt-cache and stt-cache-human; the clips are under packages/voice/fixtures/audio. The human-like set was first recorded by voice-eval run 42342379648; the current recordings come from the option trials of VOI-02. With 24 clips, one clip moves a rate by 0.042, so differences between the two sets are within noise. There is no real-room or noisy-room test.
Settlement, crash recovery and simulation
| Claim | Status | Evidence |
|---|---|---|
| Whole-auction settlement, with many holds, crash and resume | FAKE PAYPAL | Saga tests against the fake PayPal in packages/payments. Not driven through a server. |
| One lot of three holds settled and one in-process crash recovered on the real sandbox | PASS | Nightly specs R7, R8, R10: NIGHTLY-42200708552.json, NIGHTLY-42317068784.json. No real process kill. |
| Eight multi-day scenarios, including 30 simulated days with 100 bidders and random crashes | SIMULATED | docs/evidence/SIM/SIM-MULTIDAY.md, generated by the sim-multiday job. A fake clock and a model of PayPal; it does not replace G3. |
| Hash-chained ledger can be re-verified | Tested | packages/engine/test/public-export.test.ts; verify-ledger in packages/engine/bin |
Latency
| Claim | Status | Evidence |
|---|---|---|
| Sandbox call latency, 10 cycles, 0 failures: order p95 758.5 ms, authorize p95 2268.65 ms, capture p95 2280.66 ms, void p95 1235.96 ms | Measured, not committed | Actions run 42047543821 (measure-sandbox). The raw log is not committed, so this is not independently verifiable. |
| Hammer to CAPTURED within 2.5 s: MISSED, end-to-end p95 3010.04 ms (n=20, 6 holds). Hammer to SETTLED within 6 s: MET, p95 5591.30 ms (same run) | Measured, committed (redacted) | Actions run 42346811713 (measure-sandbox, mode settlement); docs/evidence/measure/measure-settlement.json. One sandbox run. |
Safety and process
| Claim | Status | Evidence |
|---|---|---|
| Security checklist SEC-01 to SEC-18 | OPEN, no sign-off | docs/SECURITY-REVIEW.md. Automated checks exist under packages/e2e/test/security; no reviewer has signed an item. No FAIL is recorded. |
| Evidence files match their recorded sha256, and tokens, buyer emails and payer ids are redacted | Checked | packages/payments/test/gates (see docs/GATES.md, "Run entries"); checklist in docs/SUBMISSION.md |
| What was checked before the repository was public | Checked | docs/PUBLIC-REPO-CHECKLIST.md |
| Fresh clone installs, typechecks and passes unit tests | Weekly CI | clean-clone.yml |
| No real money moves | Design rule | Production mode refuses fake payments (packages/server/src/config.ts); every PayPal call targets the sandbox |
See also the generated gate table and the evidence map.
Edit on GitHub
Last updated on