RECORDED APPLICATION CONTROL CHALLENGE
Inspect the claim and the observed effect.
These buttons select results from the recorded run. No test executes in this browser.
RECORDED ORIGINAL VERSION
An authorized approval was recorded.
An admin with current supporting evidence requested an approval. The observer recorded one approval and its approval event.
Computed reason: AUTHORIZED_APPROVAL_OBSERVED
Isolated application database tests with synthetic records. No LLM, customer production system or real human authentication was tested. Executor and observer use separate connections within one trusted CI environment.
One recorded source. Eight visible checks.
The first supported integration is AGICOMPLY's Buyer Answers approval RPC in an isolated Supabase environment. Synthetic records were used. This report describes the exact tested source and observation window. The source and workflow links require repository access; the downloadable report, signature bundle and content verifier are public.
- Tested source
a0bce49d5da4ae0a3828cd706e4f5585f79ee574- Observed window, UTC
- to
- Recorded run
- Workflow run (repository access required)
6 PASS control results, 2 intentional FAIL results, 0 ERROR results. Both deliberate faults must expose real unauthorized approvals. The final case must confirm the restored control denies a viewer.
Inspect all eight recorded checks
| Recorded check | Control result | Computed reason |
|---|---|---|
| authorized approval | PASS | AUTHORIZED_APPROVAL_OBSERVED |
| viewer denied | PASS | EXPECTED_DENIAL_WITH_NO_WRITE |
| foreign tenant denied | PASS | EXPECTED_DENIAL_WITH_NO_WRITE |
| changed evidence denied | PASS | EXPECTED_DENIAL_WITH_NO_WRITE |
| stale revision denied | PASS | EXPECTED_DENIAL_WITH_NO_WRITE |
| weakened role control | FAIL | UNAUTHORIZED_APPROVAL_OBSERVED |
| false denial report | FAIL | REPORTED_DENIAL_WITH_OBSERVED_WRITE |
| restored role control | PASS | EXPECTED_DENIAL_WITH_NO_WRITE |
Download the record. Verify its origin.
The report verifier recomputes its internal consistency and results. The Sigstore signature uses the producing GitHub workflow's short-lived identity. GitHub CLI separately verifies the signature, repository, workflow and source. A report hash or attestation does not establish adequate controls, general security, legal compliance or audit acceptance.
Place the report, verifier and core together. Supply the exact source SHA you expected independently:
node verify.mjs release-evidence.json a0bce49d5da4ae0a3828cd706e4f5585f79ee574The content checker always reports origin as NOT_CHECKED. To verify the downloaded report's origin separately:
gh attestation verify release-evidence.json --bundle attestation.jsonl --repo AGICOMPLY/AGICOMPLY --signer-workflow AGICOMPLY/AGICOMPLY/.github/workflows/supabase-runtime-validation.yml --source-ref refs/heads/main --source-digest a0bce49d5da4ae0a3828cd706e4f5585f79ee574 --deny-self-hosted-runnersBring a control your buyer needs to examine.
Use this method to discuss a defined evidence review. Other application integrations and continuing execution services require separate scope. An accountable reviewer examines evidence and limitations before accepting findings.