{
  "testedAt": "2026-09-20T14:13:07.843Z",
  "revision": "99a5d1986ff1212b82377b444382da9a9cdd373f",
  "environment": "Local development API and PostgreSQL with generated fixture records",
  "method": "Public HTTP requests without account credentials; real database and product controllers. Revocation invoked through a local Fastify harness. No customer files or external services used.",
  "scope": "These checks verify review API behavior and account defaults. They do not verify production deployment, uploads, playback, browser timestamp seeking, signup completion, YouTube publishing, performance improvements, or customer outcomes.",
  "checks": [
    {
      "id": "free-storage",
      "claim": "New accounts start on Free with 10 GB of base storage.",
      "observation": "A new user record defaulted to Free and resolved to 10 GB, with no subscription or payment record created. This checks the account defaults, not the complete signup flow."
    },
    {
      "id": "guest-access",
      "claim": "A recipient can open an active review link without an account.",
      "observation": "The running public API returned the shared version with HTTP 200 to a request with no cookies or Authorization header. Video playback was not part of this API check."
    },
    {
      "id": "timestamped-comments",
      "claim": "Guests can post timestamped feedback when guest comments are enabled.",
      "observation": "A request with no account credentials saved a comment at 18 seconds, returned HTTP 201, and the comment list returned the same timestamp. The guest received an assigned name and avatar."
    },
    {
      "id": "guest-identity",
      "claim": "Guests receive an assigned identity rather than entering a name.",
      "observation": "Two comments with the same visitor identifier on one version received the same assigned guest name. The request supplied no name or email. A visitor identifier is stored, so this is not a claim of untraceable anonymity."
    },
    {
      "id": "comment-permission",
      "claim": "Guest commenting is optional and off by default.",
      "observation": "A link created with the default setting opened successfully but rejected a guest comment with HTTP 403. It could still read the version’s existing comments; disabling guest posting does not hide feedback."
    },
    {
      "id": "version-history",
      "claim": "Each review link and its feedback belong to a specific version.",
      "observation": "With v1 and v2 in the same project, the original link still returned v1. The v2 link returned v2 with no v1 comments. A second link to v1 could read v1’s existing comments."
    },
    {
      "id": "revocation",
      "claim": "Revoking a link blocks later requests through that link.",
      "observation": "After invoking the product’s revoke handler, the running public API rejected version access (410), comment reads (404), and new comments (404). Another link remained active. This does not test media URLs, already-open sessions, downloads, or the owner authorization layer."
    }
  ]
}