[PR-005] Build the verification UI and deterministic demo

[ilyar]

---

Build the web flow and deterministic demo

Outcome

A judge can run broken and fixed commits, distinguish code failure from
infrastructure failure, and verify the receipt without terminal assistance.

Scope

• Product: product/proof-runner
• Allowed paths: root src/, public/, .storybook/, apps/web/, packages/ui/, apps/api/, deployment/, .github/workflows/, vite.config.ts, vitest.ui.config.ts, demo integration and browser tests

Acceptance

• Implement /runs/:id, /receipts/:id, /examples/broken, and
  /examples/passed.
• Implement inspected, running, PASS, FAIL, INCONCLUSIVE, timeout,
  unsupported, and system-error states.
• Never display timeout, registry failure, or runner failure as FAIL.
• Poll run state and show normalized checks, not raw logs.
• Handle long repository names, SHAs, evidence, and truncated logs.
• Provide a shareable result URL.
• A separate public demo repository has immutable demo-broken and
  demo-fixed tags.
• Broken and fixed runs complete in at most 45 seconds.
• Browser checks pass in Chrome, Firefox, and a mobile viewport.
• Status uses text and icons in addition to colour.
• Receipt pages can download JSON and expose correct Open Graph metadata.
• Verify UI visually in a real browser.

Constraints

• Andrei owns flow, copy, visual states, and design QA.
• No accounts, billing dashboard, or skill marketplace.

Evidence

• Partial demo implementation:
  initial UI commit 8123971
  and audited remediation
  PR #13, merged as
  24fd73b.

• Proven partial scope: PASS and FAIL demo routes are distinct; run progression
  reaches a terminal demo verdict; receipt URL copy and JSON download work;
  demo data and non-operational API/payment/receipt claims are explicitly
  labelled; route regression tests cover terminal receipt exposure.

• Checks: root UI tests 3/3; Storybook Chromium and accessibility tests 45/45;
  schema 15/15, API 5/5, runner 35/35; lint, typecheck, build, Storybook build,
  desktop and 390 px browser smoke — PASS.

• GitHub CI:
  self-hosted run 30057718551
  — PASS.

• Review: independent tester — APPROVE; independent reviewer — APPROVE;
  GitHub review
  #4769304298
  — APPROVE.

• Live-flow update: PR #18
  (836d6fe) now
  calls live inspect and verify endpoints, polls normalized run data, and loads
  downloadable live receipt JSON. pnpm test (including Storybook 45/45),
  pnpm build, pnpm lint, and pnpm typecheck passed locally; independent
  read-only review was APPROVE. The external critic integration produced no
  Verdict: output, so no critic approval is claimed.

• Re-review of PR #26 at
  b4de133:
  changes requested.
  pnpm test, pnpm run typecheck, pnpm run lint, pnpm run build, and
  make check passed; CI check run 30124079480 passed.

• Confirmed blockers at b4de133 in PR feat(web): build verification UI and deterministic demo flow (#5) #26: TIMEOUT, SYSTEM_ERROR, and INCONCLUSIVE demo
  runs link to a live receipt endpoint that returns HTML rather than the demo
  receipt; receipt-specific Open Graph tags are client-only and invisible to
  crawlers; and both remote demo tags resolve to the same revision instead of
  the required distinct immutable revisions. Special-state receipts also label
  themselves demo-fixed incorrectly.

• Latest remediation and re-review of PR feat(web): build verification UI and deterministic demo flow (#5) #26 at head b9f56d5:

  • Verified fixes: public Nginx proxy /internal/* removed; negative edge route probe added in deployment/test/topology.test.mjs; Nginx updated with X-Forwarded-Host and X-Forwarded-Proto for bot location blocks; apps/api/src/server.ts uses forwarded headers for og:url generation; explicit og:url assertions added in apps/api/test/server.test.ts.
  • Allowed paths in task scope updated to include .github/workflows/ci.yml, vite.config.ts, and vitest.ui.config.ts.
  • Test results: pnpm test (36 API tests, 27 deployment tests including edge probe, UI tests), pnpm run typecheck, pnpm run lint, pnpm run build, git diff --check, make check, and GitHub CI passed.

• Blocker resolution strategy for PR feat(web): build verification UI and deterministic demo flow (#5) #26 vs Issue [PR-005] Build the verification UI and deterministic demo #5:

  1. Real demo acceptance (separate public demo repository with real API->runner receipts and run IDs instead of static literals in src/lib/demo.ts) remains open. PR feat(web): build verification UI and deterministic demo flow (#5) #26 description does NOT claim Resolves #5 and will not close Issue [PR-005] Build the verification UI and deterministic demo #5 upon merge.
  2. Scope, allowed paths, and evidence are fully synchronized across tasks/pr-005-web-and-demo.md and Issue [PR-005] Build the verification UI and deterministic demo #5, clarifying that PR feat(web): build verification UI and deterministic demo flow (#5) #26 delivers web layout, router, OG tags, host header forwarding, and topology security, while full demo repository verification remains tracked under Issue [PR-005] Build the verification UI and deterministic demo #5.

• Public demo repository implementation:

  • Repository URL: https://github.com/ever-guild/proof-runner-demo
  • demo-broken tag: commit SHA 504e54eae8440fb52579b805c107cfa814102003 (tag object 0c6d1c3143ef81a4a82e5dd313a729de5e78e759), failed test: adds two numbers correctly (2 + 3 should equal 5, 6 !== 5).
  • demo-fixed tag: commit SHA 73b14d731d858742a50907bdba3b99e09a417e35 (tag object 7d1a0a5c6c2a42b0e3c6563e9a9a8c020149e4cf), passing test: adds two numbers correctly.
  • Tag protection: GitHub Repository Ruleset protect-demo-tags (ID 19715141) active on ever-guild/proof-runner-demo, preventing tag deletion and non-fast-forward pushes.

• Product PR for demo configuration and regression tests:

  • PR fix(demo): distinguish source references from simulations (#5) #38 (feat/demo-repo-provenance) links public repository constants, distinct tag SHAs, and regression tests.
  • Local verification: pnpm test, pnpm run typecheck, pnpm run lint, pnpm run build, git diff --check, and make check passed.

• PR feat(web): build verification UI and deterministic demo flow (#5) #26 completion: merged as
  6419602.
  Its last requested changes are resolved by
  a30f9d0:
  allowBuilds.esbuild is now the explicit boolean true, and a clean
  pnpm install --frozen-lockfile executes the required postinstall without
  an ignored-build-scripts warning. pnpm run typecheck, pnpm run lint,
  pnpm run build, pnpm test, git diff --check, and GitHub Actions check
  passed. The external critic returned
  Verdict: APPROVE with no BLOCKER or HIGH finding; the current GitHub review
  is APPROVED and all threads are resolved.

Blocker

1. External deployment blocker: Public ProofRunner deployment (Issue [PR-006] Deploy ProofRunner and register the A2MCP ASP #6 / Issue [PR-011] Resolve infrastructure and OKX readiness #11 assigned to Ilyar) is not yet live. Real execution run/receipt URLs, run IDs, receipt IDs, and execution durations cannot be recorded until public deployment endpoints (HTTPS inspect, verify, worker) are available.
2. Issue [PR-005] Build the verification UI and deterministic demo #5 remains OPEN until real execution evidence from a live deployment is gathered.
3. Long-content/truncated-log behavior and the at-most-45-second live demo
   timings still need deployment-backed evidence.