Permission.
Action.
A receipt.

A real reservation. Clear boundaries.

Controlled adult beta on Alongkind’s deployed username gateway, reported by Ben Dyson. This page summarises the supplied terminal and browser results; the complete live receipt file is not bundled on this page.

Test window closed: Stop restored; temporary tester approval disabled. Account and username ownership matched. Coverage is this receipt beta endpoint, not every Alongkind action.

A live PIN. A Stop. One recovery.

Live guardian beta tested using a synthetic profile. Ben Dyson reproduced the browser flow on the separate deployed guardian beta and supplied terminal verification against the original pinned public key. No real child or family profile was enrolled in this trial. The complete export remains with the operator and is not bundled on this page.

This table selects operations whose reasons were supplied explicitly; it is not a complete listing of all 20 operations. PIN rotation, rejection of the old PIN and acceptance of the replacement PIN were also reported successful in the live browser trial. Their receipt sequences are not individually assessed here.

Closed-beta access checks · 13 October 2026

The supplied browser report records 36 / 36 checks passed between 10:37:18 and 10:37:36 UTC. It used the signed-in owner’s Firebase ID token after tester disable. This report is client-generated test output, not a signed action receipt or independent audit.

Covered collections: profiles, links, PIN-check rates, ledger heads, recovery approvals, Stop controls, request markers, receipts, reviews and tester approvals. The unique write probes were denied; no successful probe write was reported. Unowned-profile-ID rejection is not a separate live guardian-account test.

History survived access closure: the owner’s post-disable export verified as 40 receipts, 20 operations and zero unresolved operations against both the original pinned public key and the separately retained recovery checkpoint. Test actions remained blocked while owner evidence access remained available.

Trial closed: operator output confirmed stopped: true and disabled: true on 13 October 2026. Recovery preserved the protected audience and Stop; it did not silently resume authority. The beta’s child chat, uploads and spending remain disabled.

Scope and outstanding work: this evidence covers the separate synthetic guardian beta. Real parent identity verification, linked child use, additional live guardian-account and alternate-route tests, broader IAM inventory, independent human audit and approval for unsupervised child use remain outstanding. Trusted administrators remain outside the demonstrated agent boundary. These results do not increase the count of fully passed Matrix cells or establish safety certification.

Verified histories. Narrower database access.

The operator supplied the closed exports and deployment records for a software review. The private audit pack preserves the original inputs, verification results and remaining evidence gaps.

The approved permission change restricted the username receipt runtime’s direct Firestore grant to the default database. After permission propagation, its runtime probe could read the default database and was denied access to the guardian database. A temporary default-database write probe was created, read and deleted; its absence was checked. The owner subsequently exported the existing username receipt history, which verified unchanged.

Collected deployed source matched the reviewed runtime files for all four guardian endpoints and both username receipt endpoints. Closure checks recorded Stop active and tester approval disabled for both betas. These are checks at recorded times, not continuous monitoring.

What remains unproven: complete effective IAM and inherited or impersonation routes, administrator-proof evidence storage, fresh successful reservation execution after the permission change, real guardian identity, linked child use and an independent human audit. Other shared runtime permissions were not changed. Child use remains disabled; no safety certification is claimed.

Both histories passed offline signature, chain and operation-pair checks. This software review does not change the Matrix assessment: 0 / 27 fully passed; 27 with partial evidence. Raw exports, account identifiers and the authority inventory remain private.

Cell 2.1.1 — additional staging evidence (16 October 2026)

Partial evidence Application controls demonstrated; runtime confinement incomplete.

In a separate staging project, the receipt gateway recorded six operations: one completed synthetic username reservation and five blocked attempts. All 12 receipt signatures and their hash chain verified offline against the previously recorded public key. The first ten receipts also matched the earlier retained checkpoint, preserving the history across exports.

The blocked cases included wrong-tool and wrong-destination grants, request replay, and Stop. The first Stop attempt used an expired grant and is retained with that qualification. A repeat used a fresh grant that was unexpired at the signed Stop rejection, according to operator-supplied grant timestamps.

Live export tests reported missing/malformed App Check rejection, valid-token acceptance, rejection of reuse of the same token, and rejection of a second registered app. Impersonated-identity probes reported export write and signing-secret access denied, while reservation could write and access its signing secret. Stop remained active during those IAM probes. Tester admission was disabled and test grants revoked after the gateway run, according to operator closure records.

Remaining limitation: reservation still has database-wide write permission. A direct credential probe successfully wrote outside the application's declared collection list. Collection restrictions therefore depend on gateway code and are not enforced by IAM. This is not full least-privilege isolation, administrator-proof receipts, closure of every alternate route, an external checkpoint witness, certification or an independent human audit. Cell 2.1.1 remains partial.

Review. Close. Correct. Reconcile.

Ben reproduced these scenarios against local Auth and Firestore emulators. All six cases passed and the script exited successfully. These results are separate from the deployed username beta above; correction and closure controls are not deployed.

Measured recovery: 60,990 ms, 10 retries. The mid-transaction worker crash required approximately 61 seconds for recovery. The committed state remained intact during the wait. This proves safe delayed recovery in this emulator run, not instant interruption, a recovery-time guarantee or a full database restart.

evidence-emulator/2026-10-11T10-18-02-503Z

Try the control loop.

This demonstration runs entirely in your browser. It generates a temporary signing key and uses a harmless counter. It does not call the deployed gateway or reserve a real username. Browser state can be reset or edited; these demo receipts do not prove server isolation.

No action attempted yet.

The 27 cells, honestly assessed.

Human Authority × Bounded Permission × Stop/Revoke are the three pillars; each has three moments and three proof duties. These control cells are distinct from the Law Bible’s journey × role × control-state design positions.

Why zero fully passed? Every published cell includes a broader obligation than this single endpoint proves. Partial evidence means a narrower check passed while named gaps remain. “Not tested” is not a failure. 23 cells use existing partial evidence; 4 now also have Firestore emulator evidence: 24 local control/recovery tests, 48 access denials, six emulator cases and independent snapshot reconciliation. The 13 verifier failure tests passed in the earlier local run. These candidate controls are not deployed. This is a preliminary assessment, not certification or an independent audit.

Bring the exported evidence.

Import the complete JSON export containing receipts, publicKey and checkpoint. The recorded live run uses a key confirmed against the operator’s original local private key. Retain a trusted key and checkpoint separately from the service you are checking.

Public key (raw Ed25519, base64):
1ru7YLmsdCW2aI0U79BpDfeNvnRng7Yi3/aIs62UCvA=

Retained checkpoint at sequence 4:
e193392399bb1c215d0f5b2128d14f3486abb3226152511cb857736a037b7775

The next deployment gate.

The emulator modules accept trusted test contexts. A server implementation must establish real identities and approvals before using them. This is a proposed design, not a deployed capability.

Review boundary: no production correction endpoint, operator policy or rules change is authorised by viewing this page. A separate reviewed implementation and live acceptance run are required before deployment. Existing beta Stop remains active.