Activation: reading…· Open /admin/setup →

System health (active checks)

Is AgentProof actually working?

This page runs live probes against Supabase + the deploy and reports honestly what works, what is configured but untested, what is missing, and what needs founder action. Nothing here is a guess — every row is an active check.

→ Open the Founder Preview / Product Blueprint (full product framework + completion matrix + journey map)→ Open /admin/pilot-launch (R38: one-page controlled-pilot launch verdict)

Auth working — persistence untested end-to-end

Login is wired and Supabase tables exist. We have not yet proven a real signed-in user can create + reload + survive a sign-out cycle. Do the live walk-through below.

17 green·2 amber·0 red·2 needs live test·Report generated 2026-05-25T03:54:55.525Z

Pilot verification result (R35)

No verification result on record

No pilot verification result on record. Run the one-click verification on /system-health to confirm persistence works end-to-end.

Why pilot verification matters

Pilot verification is the product's own proof that Supabase persistence works end-to-end for the signed-in customer. Every readiness surface consumes the verdict — pilot readiness flips Ready only after this passes.

What it verifies

Supabase session exists for the signed-in customer.
Supabase is configured (URL + anon key) on this deploy.
manual_environments table accepts upsert + read-back.
manual_agents table accepts upsert + read-back.
review_snapshots table accepts upsert + read-back.
report_history table accepts upsert + read-back.

Next action: Open /system-health and click Run pilot verification.

Run pilot verification →

The cached run is a localStorage cache of the/api/system-health/pilot-verification-run endpoint response — never proof on its own. The endpoint return value is the authoritative source.

Pilot journey state (R36)

2 dimension(s) blocked. Address the named blocker before continuing.

0 system-verified·0 user-attested·0 sample/demo·2 blocked·6 not started

Setup
Blocked
Setup wizard reports one or more critical items missing or failing.
Evidence source: /api/admin/setup-status returns overall_state === 'all_critical_configured'.
Store: Computed at render
Blocker: Open /admin/setup and address every critical item.
Open setup wizard →
Verification
Not started
R31 pilot verification has not been run for this session.
Evidence source: R31 cached run from /api/system-health/pilot-verification-run.
Store: Local cache (UI tracking only)
Blocker: Open /system-health and click Run pilot verification.
Run pilot verification →
Workspace
Not started
Customer is not signed in. Workspace is empty.
Evidence source: SSR session detection + manual_agents row presence via the verify endpoint.
Store: Computed at render
Blocker: Pilot customer signs in.
Open workspace →
Manual agent
Not started
No manual agent verified yet for the signed-in user.
Evidence source: /api/workspace/manual-agent/verify confirms a real row.
Store: Computed at render
Blocker: Open /workspace/manual-agent/new and submit the form.
Add manual agent →
Review
Not started
No committed review snapshot for any agent yet.
Evidence source: review_snapshots Supabase upsert + read-back via R31 verification.
Store: Computed at render
Blocker: Open /workspace/readiness and walk the review.
Open the readiness review →
Report
Not started
No report rows visible yet for the signed-in user.
Evidence source: /api/reports/verification returns supabase_real_rows.
Store: Computed at render
Blocker: Complete a review to generate the first report.
Open the reports centre →
AI Radar
Blocked
Radar schedule artefact ships but endpoint is not reachable (likely missing AGENTPROOF_PUBLIC_BASE_URL).
Evidence source: /api/radar/schedule-validator returns configured_runs_clean.
Store: Computed at render
Blocker: Add AGENTPROOF_PUBLIC_BASE_URL secret on the deploy.
Open intelligence ops →
Pilot readiness
Not started
Pilot readiness has not flipped to Ready yet.
Evidence source: R34 PilotReadinessFinalGating verdict === 'ready_for_controlled_private_pilot'.
Store: Computed at render
Blocker: Resolve remaining blockers on /admin/pilot-readiness.
Open pilot readiness →

The same journey state shape renders on /workspace, /system-health, /admin/pilot-pack, /admin/pilot-readiness, and /admin/pilot-run — one consistent view across surfaces.

One-click pilot verification (R31)

Run the full proof in one click

The button below writes the AgentProof verification dataset to Supabase via the normal product persistence path and reads each record back. The verdict feeds /admin/pilot-readiness directly — no separate walk-through required. Requires a signed-in session.

Verification dataset summary

workspace_id: agentproof_verification_workspace

environment_id: agentproof_verification_environment

agent_id: agentproof_verification_agent

review_id: agentproof_verification_review

report_id: agentproof_verification_report

marker_tag: agentproof_verification_dataset_v1

These records prove signed-in Supabase persistence end-to-end. They are clearly labelled AgentProof verification records. Repeated runs upsert the same ids rather than creating endless duplicates.

No pilot verification result on this device yet. Click Run pilot verification to call the endpoint and persist the run record.

System verification (R29)

One click to verify Supabase persistence

The button below calls the verification endpoint and updates the result inline. The same result feeds the pilot-readiness verdict on /admin/pilot-readiness so the two pages always agree.

No verification result on this device yet. Click Run system verification to call the endpoint and persist the result.

Verification recovery (R30)

Four-step recovery when verification reports missing data

Loading recovery guidance from the cached verification result…

This panel reads the cached verification result. Re-run verification on /system-health once you complete a step to refresh the recovery flow.

System-health command centre (R27)

Product readiness: Configured · untested

AgentProof is honestly not yet operational. The persistence proof must record PASS before the verdict flips to Ready.

Start persistence proof Open manual agent form Run AI Radar check Open report preview Open pilot readiness

Persistence proof

Configured · untested

Supabase auth flag is on. A signed-in customer must walk the proof on the live URL.

Radar run

Configured · untested

Latest run is a dry_run sample — 7 sources, 1 candidate signal(s).

Report export

Operational

Report export panel + four version stamps are mounted on the trial report.

Demo

Operational

Demo mode is on. Sample agents + sample report are reachable from /demo.

Trial

Operational

Trial journey stepper is mounted across /trial, /trial/workspace, and /trial/report.

Product readiness

Configured · untested

Persistence proof has not been recorded as PASS. Until it does, we honestly cannot call the product operational.

Remaining blockers

Persistence proof not recorded as PASS — a signed-in customer must walk the 5-step proof on /system-health.
Radar latest run is a dry_run sample — click Run source-check now on /admin/intelligence-ops to record a live run.

Private pilot readiness verdict (R22)

Is AgentProof ready for a controlled private pilot?

Nearly ready — customer or admin actions required

No product blocker. The remaining gap is customer or admin configuration (auth flag, signed-in round-trip walk, optional admin tools).

4 operational·3 nearly operational·0 blocked·1 deferred·8 total items

Public site + navigation
Operational
Blocker: None.
Next action: None — shipped R12..R21.
Proof required: Smoke covers / + /learn + /demo + /trial + /login.
Owner: product
No browser Basic Auth popup
Operational
Blocker: None — master switch off by default.
Next action: None.
Proof required: Smoke asserts no WWW-Authenticate Basic header on any public/admin/workspace route.
Owner: product
Demo flow
Operational
Blocker: None — demo default-on.
Next action: None.
Proof required: Smoke asserts /demo returns 2xx with sample-agent content or the honest disabled diagnostic.
Owner: product
Login (Supabase magic-link)
Operational
Blocker: None — auth flag on.
Next action: Customer signs in via the magic-link.
Proof required: Magic-link email arrives, opens a signed-in session, lands in /workspace.
Owner: customer
Supabase persistence (signed-in round-trip)
Nearly operational — pending proof
Blocker: Code wired; signed-in round-trip not yet recorded.
Next action: Set AGENTPROOF_SUPABASE_AUTH_ENABLED=true (if not already), sign in, walk the guided persistence proof on /system-health.
Proof required: Live persistence probe panel green + Live Acceptance Runner records PASS for steps 4-6 (create / refresh / sign-out / sign-in).
Owner: admin
AI Radar first successful check
Nearly operational — pending proof
Blocker: Engine enabled; first check not yet run.
Next action: Admin runs the first source-check from /admin/intelligence-ops.
Proof required: /system-health radar panel shows last_check_iso non-null and detected_changes_count >= 0.
Owner: admin
Trial (real signed-in persisted workspace)
Deferred post-pilot
Blocker: Real per-user trial persistence is intentionally deferred. Public sample preview + buyer-grade preview routes are operational; the persisted trial workspace will ship in a follow-on release.
Next action: Defer to a follow-on release. Today the trial is labelled as sample preview on every route via the R21 clarity chips.
Proof required: When/if shipped, the trial workspace would persist to Supabase under the trial workspace scope.
Owner: deferred
Microsoft connector (live tenant)
Nearly operational — pending proof
Blocker: Six env vars configured; live tenant smoke not yet run.
Next action: Admin runs the live tenant smoke pack.
Proof required: Live OAuth round-trip + environment discovery + metadata read against a real test tenant.
Owner: admin

Guided persistence proof (R22)

Prove signed-in Supabase persistence on the live URL

Walk these 7 steps on the live URL. Magic-link auth requires your email so the steps are admin-clicked, not script- automated. Your progress is stored in this browser only.

0 PASS·0 FAIL·7 not yet·7 total

1. Sign in via magic-link
Not yet done
What to do
Open /login on the live URL, enter your email, click the magic-link in your inbox.
Expected outcome
You land back signed-in. The workspace header shows your identity.
Last attempt
not yet
2. Create manual non-Microsoft agent
Not yet done
What to do
Open /workspace/manual-agent/new. Fill environment + agent name. Click Save.
Expected outcome
The agent appears in /workspace and /dashboard/estate. The data-source chip says Supabase-backed. Capture the agent id from the URL.
Last attempt
not yet
Captured (agent_id)
3. Refresh keeps the agent
Not yet done
What to do
Hit browser refresh. Confirm the agent is still visible in the same lists.
Expected outcome
Agent persists. Chip still says Supabase-backed.
Last attempt
not yet
Captured (data_source_chip)
4. Sign out
Not yet done
What to do
Click sign-out in the header. You land back on the public site.
Expected outcome
Session cleared. Workspace not reachable.
Last attempt
not yet
5. Sign in again
Not yet done
What to do
Open /login again. Enter the same email. Click the magic-link.
Expected outcome
You land back signed-in. The previously-created agent is still visible.
Last attempt
not yet
6. Agent still exists after sign-out / sign-in
Not yet done
What to do
Open /workspace. Confirm the agent is still there. Open the agent. Confirm review wizard renders.
Expected outcome
Agent present. Review wizard opens. Data-source chip says Supabase-backed.
Last attempt
not yet
7. Report generates + history persists
Not yet done
What to do
From the review wizard, generate a report. Open the report history. Confirm the history bar says Supabase-backed.
Expected outcome
Report renders with all 7 sections. Re-score creates a new history entry that survives refresh.
Last attempt
not yet

System-verified persistence proof (R28)

Six checks the product runs against actual Supabase state

This panel is distinct from the R27 user-attested runner. The verification endpoint runs SELECT probes against Supabase and reports each step as verified, failed, blocked, or not yet run. Clicking Pass on the R27 runner does NOT count here.

Click Run verification to call the /api/system-health/verify-persistence endpoint and probe each persistence step against Supabase.

Persistence proof runner (R27)

Five-step proof that signed-in persistence actually works

Walk the five steps below. Each step records its own started_at, completed_at, status, and failure reason. The overall proof is only PASSED when every step is passed. Until then, persistence is honestly not operational.

No proof started yet. Click Start a new proof to begin. The proof records to your browser's local storage so you can resume mid-walk.

Report export coverage (R28)

All four R28 report surfaces either render the professional layout directly (trial sample + trial professional) or link to it (workspace reports + report portfolio).

Trial sample report (/trial/report)
Trial sample report mounts the R26 export panel + R18 print action + 4 version stamps + sample findings + radar relevance + evidence expectations.
Trial professional report (/trial/report/professional)
Professional report view at /trial/report/professional renders the full ReportProfessionalLayout.
Workspace reports list (/workspace/reports)
Workspace reports list links into the professional report view for each report row.
Workspace report portfolio (/workspace/report-portfolio)
Workspace report portfolio shows portfolio summary; each row links into the professional report view.

Product completion (R13)

What is complete, what is not, and the next action

12 capability buckets the founder cares about. Each row shows the current state and the single next action.

Login
Done
Current state: Magic-link auth wired end-to-end. R8 + R9 fixed the production redirect + Railway proxy origin.
Next action: No action.
Supabase configuration
Done
Current state: Public URL + anon key configured and client initialises.
Next action: No action.
Supabase migrations
Done
Current state: All required tables present + reachable (healthcheck, manual agents/envs, reviews, reports).
Next action: No action.
Manual non-Microsoft agent creation
Working but unproven
Current state: Form is wired (R7) and the manual_agents table exists. Needs founder live test to confirm round-trip persistence.
Next action: Live test: /workspace/manual-agent/new → save → sign out → sign back in → confirm agent still listed on /dashboard/estate.
Review answer preservation
Working but unproven
Current state: R13 ships the multi-strategy recovery layer (exact id → raw id → deduped id → text-hash → alias) plus the per-review diagnostic panel. Needs a founder live test to confirm the panel shows recovered counts and the controls render previous answers.
Next action: Live test: open a reviewed agent on /score/paste → confirm every section shows previously-given answers (not 'Not captured in this review') → expand the diagnostic panel and verify the recovered-by-x counts add up.
Demo (guided sample)
Done
Current state: R13 makes demo default-ON (safe sample agents only, never real data). /demo renders the guided demo unless the founder explicitly sets AGENTPROOF_DEMO_MODE_ENABLED=false.
Next action: No action. Open /demo to verify the guided sample renders.
Trial
Sample-only
Current state: /trial/* pages render the documented guided sample preview. They do NOT persist a real trial workspace by design.
Next action: For real persisted trials, route buyers through /score/paste (Microsoft) or /workspace/manual-agent/new (R7).
Reports
Working but unproven
Current state: Report storage table exists. Canonical ReadinessScoreRing renders across estate / workspace / trial / report surfaces. Print/PDF chrome shipped in S33L/S33M.
Next action: Live test: generate a report → click Print → confirm the PDF cover/score/findings/recommendations sections all render cleanly.
AI Radar
Sample-only
Current state: R13 ships the value upgrade: 6 source-watchlist categories, 9 radar items with risk relevance + capability zones + control families + report impact + reassessment trigger indicators + last/next review dates, future-state planned block. The 'Curated preview / live monitoring not active' label is preserved.
Next action: No action for the pilot. Live source monitoring is a separate engineering build (data feed + human approval queue + pack-version writer).
Microsoft connector
Working but unproven
Current state: All six MICROSOFT_* env vars present. /api/connectors/microsoft/auth/start would issue a real OAuth redirect.
Next action: Walk the live tenant smoke test before letting any external tester connect.
Public navigation
Done
Current state: R6 ships the route-aware AppHeader. Public / workspace / admin each have their own header. R10 added Training entry to workspace nav. R11 dropped the duplicate ProductShell chrome.
Next action: No action.
Dead-page sweep
Working but unproven
Current state: R1 fixed the known dead links (/timeline) and rewrote the 404 to a recovery surface. The R12 live smoke script asserts no tested route returns the bare-404 string.
Next action: Live click-through is the gold standard. Optionally: run the smoke script against the live URL.

Persistence proof (R14)

Is the product actually persisting?

Fourteen probes covering Supabase auth, the persistence path, demo, answer recovery, trial, and AI Radar status. "Operational" only when there is actual proof — "Configured — untested" when a live walk-through is still required.

Supabase auth configured
Configured — untested
Proves: URL + anon key + AGENTPROOF_SUPABASE_AUTH_ENABLED=true.
Status: All three values are present. Live sign-in still required to mark operational.
Requires founder live login test.
Founder action: Sign in via /login on the live URL. Claude captures the proof.
Supabase auth callback working
Configured — untested
Proves: The /auth/callback exchange produces a session cookie.
Status: Awaiting a live magic-link round trip.
Requires founder live login test.
Founder action: Click a magic link on the live URL.
Required Supabase tables reachable
Configured — untested
Proves: Anon-key SELECT against manual_environments / manual_agents / workspace_progress / event_audit_records / radar_* responds without 401/404.
Status: Not yet probed in this session.
manual_agents + manual_environments tables reachable
Configured — untested
Proves: The two S34I tables that back the manual non-Microsoft agent flow respond to a read.
Status: Subset of the required-tables probe — surfaced separately because the manual agent flow is on the critical R14 path.
review_snapshots + captured_answers reachable
Missing
Proves: Review-related Supabase rows respond. Snapshots persist captured_answers + rich_answers per S34AG.
Status: Schema present per S34I; live write/read proof requires a signed-in walk-through.
Requires founder live login test.
Founder action: Sign in, score an agent, refresh — answers should still appear.
Report history rows reachable
Missing
Proves: Each scored agent appends a report-history entry that survives sign-out / sign-in.
Status: Tables present; live proof needs a signed-in re-score that increments history.
Requires founder live login test.
Manual agent write/read proof
Configured — untested
Proves: A signed-in buyer can create a manual non-MS agent, refresh, sign out, sign back in, and see it.
Status: Requires founder live login test. R7 wired the form to the server action; S34I added the Supabase adapter. End-to-end proof on the live URL is the missing step.
Requires founder live login test.
Founder action: Open /workspace/manual-agent/new on the live URL, create an agent, refresh, sign out, sign back in.
Review answers + report body persistence proof
Configured — untested
Proves: Captured answers + the rendered report markdown survive sign-out / sign-in via Supabase.
Status: Requires founder live login test. Schema + S34AG label-stamp + S34AH legacy cascade in place.
Requires founder live login test.
Founder action: After step 7, score the new manual agent, refresh, sign out, sign back in, open the reviewed agent — every answer should appear and the report should open.
Demo active (sample agents reachable)
Operational
Proves: /demo renders the sample agents. AGENTPROOF_DEMO_MODE_ENABLED defaults to ON since R13.
Status: Demo flag is ON — /demo serves sample data.
Answer recovery (primary + legacy cascade)
Operational
Proves: S34AD multi-strategy + S34AG snapshot-labels + S34AH legacy-fallback cascade are all in place.
Status: All three cascades shipped. Live walk-through on the Railway URL with a real signed-in user is the remaining proof gate.
Requires founder live login test.
Founder action: Open a reviewed agent on the live URL — answers should appear; 'Legacy answer unavailable' should appear ONLY when no source has the answer.
Trial workspace status
Configured — untested
Proves: Trial routes render either real workspace data (when auth on) or sample-only data.
Status: Trial routes render the sample workspace. Real-persistence trial requires the same signed-in walk-through as the workspace path.
AI Radar status
Configured — untested
Proves: Radar engine status is honestly labelled (Operational / Configured no run / Preview-only engine off).
Status: Engine code shipped at R13-A. First check run pending.
Founder action: Run first radar check from /admin/intelligence-ops.
Founder action required
Needs founder action
Proves: Things only the founder can do — flip env vars, run live walk-throughs, configure Microsoft tenant, etc.
Status: Walk the /system-health punch list top to bottom. Flip AGENTPROOF_SUPABASE_AUTH_ENABLED=true. Configure Microsoft env vars if you want the connector path. Run the live signed-in walk-through.
Claude action required
Needs Claude action
Proves: Build punch list that depends on a founder unblock or external trigger.
Status: Capture screenshot proof of restored answers once founder runs the live walk-through. Wire Supabase as the source of truth for captured_answers cross-device (R15 work after R14 same-browser is proven).

Live persistence probes (R15)

Are the persistence tables actually reachable right now?

Each row below is the live result of an anonymous SELECT against the running Supabase project. Green = reachable. Red = table missing or project unreachable. Amber = reachable but the RLS policy is too strict.

Probing…

Source-of-truth compliance (R16)

Which live screens actually use Supabase first?

Per-surface declaration of compliance with the R15 signed-in resolver. "Supabase first" surfaces use the resolver and read/write Supabase first when signed in. "Local-only intentional" surfaces (public / demo) are correct as-is. "Local-only defect" is an honest declaration that the surface still reads localStorage when signed in — these are the next rewire targets.

Zero signed-in localStorage-first violations.

7 Supabase first·2 server action·4 local intentional·0 defect·2 scheduled

Manual non-Microsoft agent creation /workspace/manual-agent/new
Supabase via server action
R7 wired the form to a server action; S34I added the Supabase manual_agents + manual_environments adapter. R16 records this site in the compliance registry. When AGENTPROOF_SUPABASE_AUTH_ENABLED=true and the user is signed in, the action writes to Supabase via the adapter; localStorage is a same-browser mirror only.
Live Supabase persistence probe API /api/system-health/persistence
Supabase first (signed in)
R15-shipped route. Server-side, anon-only. Reads directly from Supabase tables.
Radar run-check API /api/radar/run-check
Supabase first (signed in)
R13-A radar repository selects the Supabase adapter when AGENTPROOF_SUPABASE_AUTH_ENABLED and the radar tables are reachable. Otherwise local-private adapter.
Radar items API /api/radar/items
Supabase first (signed in)
Same adapter selection as run-check. Resolves Supabase when configured.
Review record load (loadReviewRecord / loadLatestReviewSummaryForAgent) lib/agentproof/review_persistence.ts
Supabase via server action
S34I added the Supabase adapter parameter. When callers pass it (or when the resolver returns supabase_first), reads come from Supabase. R16 records this site; full caller audit is in the JsonPasteScoreCard entry below.
Demo sample agents /demo
Local-only (intentional)
Demo data lives in the seeded DEMO_SAMPLE_AGENTS constant. Never touches workspace tables. Not a violation.
Trial sample workspace /trial/workspace
Local-only (intentional)
Sample-data only by design. Not a violation.
Trial sample report /trial/report
Local-only (intentional)
Sample-data only by design. Not a violation.
Public Learn centre /learn
Local-only (intentional)
All /learn pages render static + sample content. No persistence wired or required.
JsonPasteScoreCard reviewed-agent hydrate effect components/form/JsonPasteScoreCard.tsx
Supabase first (signed in)
R17 (S34AL) wired the SupabaseFirstHydrationStatusBar into JsonPasteScoreCard's render. When an env+agent is selected, the bar mounts and fetches /api/persistence/review-summary on mount. The server route returns 401 for unsigned-in users (chip shows 'Not signed in · local fallback') and returns the real Supabase row for signed-in users (chip shows 'Supabase-backed'). The existing localStorage hydrate still runs as initial state, but the founder sees the actual source of truth on every render. R13/S34AH legacy recovery remains the deeper fallback chain.
Dashboard / estate read path /dashboard/estate
Supabase first (signed in)
R17 (S34AL) mounted the SupabaseFirstHydrationStatusBar above EstateHomeDashboard. The probe calls /api/persistence/manual-agents on mount; the chip flips to 'Supabase-backed' once Supabase responds. The existing EstateHomeDashboard's localStorage read remains as initial render for offline / anonymous users.
Workspace home agent list /workspace
Supabase first (signed in)
R17 (S34AL) mounted the SupabaseFirstHydrationStatusBar on the workspace home page above the existing composition. Same /api/persistence/manual-agents path as the estate dashboard. Signed-in users see 'Supabase-backed'.
Per-agent report history loadReportHistory()
Supabase first (signed in)
R17 (S34AL) added /api/persistence/report-history and mounted a per-agent SupabaseFirstHydrationStatusBar inside JsonPasteScoreCard's diagnostic area. The bar calls the API with env+agent ids; the chip flips to 'Supabase-backed' when Supabase returns history rows. Old reports remain immutable — this is a read-only endpoint.
Re-score draft creation JsonPasteScoreCard re-score path
Scheduled for rewire
Re-score path uses cloneRecoveredAnswersForRescore() over the in-memory snapshot. The new draft persists via per-agent storage. To make this Supabase-first when signed in, the draft must be saved through the same adapter as committed reviews.
Next action: R17 or R18 — depends on review_snapshot Supabase write path landing first.
Improvement action persistence Improvement cycle UI
Scheduled for rewire
Improvement cycle state currently lives in localStorage. S34I shipped the improvement_cycle Supabase table; the UI doesn't yet write to it.
Next action: R17 or R18.

Customer acceptance journey (R17-expanded)

The 13-step live walk-through

The single end-to-end journey R17 must support on the live URL. Each step states exactly what counts as pass / partial / fail and which release wired the supporting code. Steps marked "Requires signed-in live test" need a real signed-in click — the code is ready; the proof is authentication-gated.

13 steps·6 passing·7 require signed-in live test·0 defects·0 deferred

1. Home loads with new public landing
Automatable · passing
Surface: / · wired by S34AA
Pass: GET / returns 200 with hero + four Learn cards + provider-agnostic chip + Start Trial CTA.
Fail: 404, dead page, or layout breakage.
2. Login route renders the magic-link form
Requires signed-in live test
Surface: /login · wired by S34C/S34AC-R8/R9
Pass: GET /login returns 200 with the magic-link email form. Submitting sends a real Supabase magic link when AGENTPROOF_SUPABASE_AUTH_ENABLED=true.
Partial: Login route renders but auth is off — founder needs to flip the env flag.
Fail: Route 404s or returns the localhost-only error.
Admin action: Set AGENTPROOF_SUPABASE_AUTH_ENABLED=true on Railway, then click the magic-link.
3. Workspace landing page renders for signed-in user
Automatable · passing
Surface: /workspace · wired by R17 / S34AL
Pass: GET /workspace returns 200 with the workspace home + R17 SupabaseFirstHydrationStatusBar chip near the top.
Fail: Workspace route returns 404 or dead-page placeholder.
4. Create a manual non-Microsoft agent
Requires signed-in live test
Surface: /workspace/manual-agent/new · wired by R7 + S34I + R17 / S34AL
Pass: Founder fills environment + agent name, clicks Save. The server action writes to manual_agents + manual_environments via the SSR Supabase client. Redirect to a success state. Chip on workspace home flips to Supabase-backed.
Partial: Form submits but Supabase is not configured / auth is off — local-only mirror only.
Fail: Form does not submit, or server action throws an unhandled error.
Admin action: Open /workspace/manual-agent/new, create an agent, watch the chip flip.
5. Refresh keeps the manual agent
Requires signed-in live test
Surface: Browser refresh of /workspace or /dashboard/estate · wired by R17 / S34AL
Pass: After a browser refresh the agent appears in the workspace + dashboard agent lists. The chip says Supabase-backed.
Fail: Agent disappears on refresh.
Admin action: Refresh the workspace after step 4.
6. Sign out + sign back in keeps the agent
Requires signed-in live test
Surface: Sign out from header, sign back in via /login · wired by R17 / S34AL
Pass: After signing out and signing back in, the agent still appears. Source chip still says Supabase-backed.
Fail: Agent disappears after sign-out / sign-in cycle — would prove the data is local-only.
Admin action: Run the sign-out / sign-in cycle after step 5.
7. Open the reviewed agent and see answers
Requires signed-in live test
Surface: Workspace agent detail / review page · wired by R13/S34AD + R13-A/S34AG + R13-LEGACY/S34AH + R17/S34AL
Pass: Opening the agent renders the review wizard with previously-captured answers visible. R17 SupabaseFirstHydrationStatusBar shows Supabase-backed for the review summary.
Partial: Answers come from R13/S34AH legacy recovery (chip says legacy_recovered).
Fail: Every question shows 'Not captured in this review' / 'Legacy answer unavailable'.
Admin action: Open the agent in the review wizard after re-login.
8. Report opens with all sections + version banner
Requires signed-in live test
Surface: Workspace report detail · wired by S33L + S33M + R14 ReportVersionMetadataBanner + R17-expanded ReportProfessionalLayout
Pass: Report renders with the R17-expanded ReportProfessionalLayout: executive summary, score/band, critical findings, evidence expectations, recommendations, improvement plan, methodology/version block.
Fail: Report sections missing or report fails to load.
9. Report history is Supabase-backed
Requires signed-in live test
Surface: JsonPasteScoreCard report history bar · wired by R17 / S34AL
Pass: The R17 report-history status bar shows Supabase-backed when signed in. Re-score generates a new history entry that survives refresh.
Fail: Bar shows Not signed in / Network error when signed in.
10. /system-health persistence panels are green
Automatable · passing
Surface: /system-health · wired by R12 + R14 + R15 + R16 + R17
Pass: R14 declarative + R15 live + R16 compliance + R17 hydration panels all render. Live persistence probe shows ≥6 tables reachable. Compliance panel shows 0 signed-in localStorage-first violations.
Fail: Probes red, or compliance panel shows non-zero violations.
11. Demo renders sample agents
Automatable · passing
Surface: /demo · wired by R13 default-on + R14 diagnostic
Pass: GET /demo returns 200 with the sample guided journey + sample agents.
Partial: Demo shows the OFF state with the R14 explicit Railway diagnostic.
Fail: Demo 404s or has no sample data.
12. AI Radar shows honest preview / operational status
Automatable · passing
Surface: /learn/ai-landscape-radar · wired by R13-A / S34AE
Pass: Radar panel shows one of the three operational states with the honest disclaimer.
Fail: Radar claims operational without source-check engine running.
13. Product blueprint + completion matrix visible
Automatable · passing
Surface: /founder/product-blueprint · wired by R13-FRAMEWORK / S34AF
Pass: Blueprint renders the 11 product areas, journey, matrix, and active defect audit panel.
Fail: Blueprint 404 or missing sections.

Live Acceptance Runner (R18)

Walk the 13-step journey on the live URL and record proof

The product guides the test. Open each surface, walk the step, then mark PASS / PARTIAL / FAIL. Your progress is kept in this browser only — it is admin state, not workspace data.

Data source: Operator-only state — kept in this browser, not in Supabase.

0 passing·0 partial·0 failing·13 not yet tested·13 total steps

1. Home loads with new public landing
Not yet tested
Proof surface
/
Last tested
never
Pass criteria
GET / returns 200 with hero + four Learn cards + provider-agnostic chip + Start Trial CTA.
Wired by
S34AA
2. Login route renders the magic-link form
Not yet tested
Proof surface
/login
Last tested
never
Pass criteria
GET /login returns 200 with the magic-link email form. Submitting sends a real Supabase magic link when AGENTPROOF_SUPABASE_AUTH_ENABLED=true.
Admin action
Set AGENTPROOF_SUPABASE_AUTH_ENABLED=true on Railway, then click the magic-link.
Wired by
S34C/S34AC-R8/R9
3. Workspace landing page renders for signed-in user
Not yet tested
Proof surface
/workspace
Last tested
never
Pass criteria
GET /workspace returns 200 with the workspace home + R17 SupabaseFirstHydrationStatusBar chip near the top.
Wired by
R17 / S34AL
4. Create a manual non-Microsoft agent
Not yet tested
Proof surface
/workspace/manual-agent/new
Last tested
never
Pass criteria
Founder fills environment + agent name, clicks Save. The server action writes to manual_agents + manual_environments via the SSR Supabase client. Redirect to a success state. Chip on workspace home flips to Supabase-backed.
Admin action
Open /workspace/manual-agent/new, create an agent, watch the chip flip.
Wired by
R7 + S34I + R17 / S34AL
5. Refresh keeps the manual agent
Not yet tested
Proof surface
Browser refresh of /workspace or /dashboard/estate
Last tested
never
Pass criteria
After a browser refresh the agent appears in the workspace + dashboard agent lists. The chip says Supabase-backed.
Admin action
Refresh the workspace after step 4.
Wired by
R17 / S34AL
6. Sign out + sign back in keeps the agent
Not yet tested
Proof surface
Sign out from header, sign back in via /login
Last tested
never
Pass criteria
After signing out and signing back in, the agent still appears. Source chip still says Supabase-backed.
Admin action
Run the sign-out / sign-in cycle after step 5.
Wired by
R17 / S34AL
7. Open the reviewed agent and see answers
Not yet tested
Proof surface
Workspace agent detail / review page
Last tested
never
Pass criteria
Opening the agent renders the review wizard with previously-captured answers visible. R17 SupabaseFirstHydrationStatusBar shows Supabase-backed for the review summary.
Admin action
Open the agent in the review wizard after re-login.
Wired by
R13/S34AD + R13-A/S34AG + R13-LEGACY/S34AH + R17/S34AL
8. Report opens with all sections + version banner
Not yet tested
Proof surface
Workspace report detail
Last tested
never
Pass criteria
Report renders with the R17-expanded ReportProfessionalLayout: executive summary, score/band, critical findings, evidence expectations, recommendations, improvement plan, methodology/version block.
Wired by
S33L + S33M + R14 ReportVersionMetadataBanner + R17-expanded ReportProfessionalLayout
9. Report history is Supabase-backed
Not yet tested
Proof surface
JsonPasteScoreCard report history bar
Last tested
never
Pass criteria
The R17 report-history status bar shows Supabase-backed when signed in. Re-score generates a new history entry that survives refresh.
Wired by
R17 / S34AL
10. /system-health persistence panels are green
Not yet tested
Proof surface
/system-health
Last tested
never
Pass criteria
R14 declarative + R15 live + R16 compliance + R17 hydration panels all render. Live persistence probe shows ≥6 tables reachable. Compliance panel shows 0 signed-in localStorage-first violations.
Wired by
R12 + R14 + R15 + R16 + R17
11. Demo renders sample agents
Not yet tested
Proof surface
/demo
Last tested
never
Pass criteria
GET /demo returns 200 with the sample guided journey + sample agents.
Wired by
R13 default-on + R14 diagnostic
12. AI Radar shows honest preview / operational status
Not yet tested
Proof surface
/learn/ai-landscape-radar
Last tested
never
Pass criteria
Radar panel shows one of the three operational states with the honest disclaimer.
Wired by
R13-A / S34AE
13. Product blueprint + completion matrix visible
Not yet tested
Proof surface
/founder/product-blueprint
Last tested
never
Pass criteria
Blueprint renders the 11 product areas, journey, matrix, and active defect audit panel.
Wired by
R13-FRAMEWORK / S34AF

system · health

System health

Live health checks across Supabase, Microsoft, Radar, and product completion.

Run AI Radar check now →Open setup status Open Trust Centre Open public-beta readiness

Health data · /api/system-health (live probe, never claims uptime falsely).

Live staging smoke runner · 10 routes

Smoke runner has not been probed yet — open the live staging URL and click Run.

Live probe of https://app.agentproofhq.com. Each route is fetched with a real HTTP request from the browser. Routes that never ran are labelled "Not yet probed" — never silently green.

https://app.agentproofhq.com

Pass0

Fail0

Blocked0

Not yet probed10

Not safe yet — some routes failed, are blocked, or have not been probed.

1. Public landing opensNot yet probed
Anyone, signed out, gets a friendly product home with a path into demo or trial.
/expected: 200_html
2. Sign-in page opensNot yet probed
Canonical sign-in page renders with magic-link or password mode toggle.
/auth/sign-inexpected: 200_html
3. Demo / sample opensNot yet probed
Sample data is reachable and clearly labelled — never claimed as real.
/demoexpected: 200_html
4. Workspace protects signed-out usersNot yet probed
Signed-out viewers are redirected to /auth/sign-in by PrivateRouteGuard — they never see private data.
/workspaceexpected: 302_redirect_to_auth
5. Signed-out users do not see private dataNot yet probed
Cp Q invariant: signed-out viewers on every private route get the sign-in pane, never workspace reports.
/workspace/reportsexpected: 302_redirect_to_auth
6. AI Radar opensNot yet probed
Public radar page renders with latest run mode (live/dry-run/never-run) honestly labelled.
/learn/ai-landscape-radarexpected: 200_safe_for_signed_out
7. Trust Centre opensNot yet probed
Trust Centre opens with the 12 founder-authored sections + claim-safety validator.
/trustexpected: 200_safe_for_signed_out
8. Help opensNot yet probed
Help / documentation entry point is reachable without sign-in.
/helpexpected: 200_safe_for_signed_out
9. Public-beta readiness opensNot yet probed
Admin readiness verdict surface renders with CTA integrity + radar + workspace probes.
/admin/public-beta-readinessexpected: 200_html
10. System health opensNot yet probed
System health surface renders with radar latest-run + Supabase probe + connector smoke runner.
/system-healthexpected: 200_html

Supabase durability · 9 record types

Sign in to probe Supabase durability for 9 record types.

Supabase configured: yes · Signed in: no

1. Workspace recordMissing sign-in
Workspace record cannot be probed — sign in first.
Sign in →
2. MembershipMissing sign-in
Membership cannot be probed — sign in first.
Sign in →
3. EnvironmentMissing sign-in
Environment cannot be probed — sign in first.
Sign in →
4. AgentMissing sign-in
Agent cannot be probed — sign in first.
Sign in →
5. Assessment / review recordMissing sign-in
Assessment / review record cannot be probed — sign in first.
Sign in →
6. Report recordMissing sign-in
Report record cannot be probed — sign in first.
Sign in →
7. Improvement actionMissing sign-in
Improvement action cannot be probed — sign in first.
Sign in →
8. Radar runMissing sign-in
Radar run cannot be probed — sign in first.
Sign in →
9. Pilot session / evidenceMissing sign-in
Pilot session / evidence cannot be probed — sign in first.
Sign in →

Live connector smoke runner

Not run

Classification: auth not started · workspace system-health

Probed at: 2026-05-25T03:54:56.136Z. Tokens never appear in this shape — only the boolean presence flags do.

Tenantnot_observed

Environments0

Agents0

Partialno

Product configpresent

Real connector flagabsent

Auth route mountedpresent

Callback route mountedpresent

Blockers (2)

real_connector_flag_not_set
tenant_not_connected

AI Radar · latest run

AI Radar has not run yet — click 'Run AI Radar check now' on /admin/intelligence-ops.

Run idnever_run

Modenever_run

Started—

Completed—

Sources checked0

Successful checks0

Failed checks0

Skipped checks0

Changed sources0

Candidate signals0

Storage sourcenever_persisted

Click Run AI Radar check now to record the first run. When the AGENTPROOF_ADMIN_TOOLS_ENABLED flag is off, the action runs a clearly labelled dry-run instead of failing.

Magic-link email delivery — warning

smtp configured no login observed yet

SMTP configured · no login round-trip observed yet

Operator has flagged SMTP as configured. No signed-in session has been observed on this request. Login is not blocked — but cannot be proven on this surface until someone signs in.

Exact action: Send a test magic-link to your own email and complete the round-trip. /admin/setup will reflect the result and /workspace will read the same session.

Where: Supabase → Authentication → SMTP Settings

Fallback paths while SMTP is being configured

Open demo / sample — Sample data — never claims real. Lets a tester walk the journey while SMTP is being configured.

Local test access (dev only) — Only available on non-production deployments with AGENTPROOF_ENABLE_LOCAL_TEST_AUTH=true. Uses the safe test workspace.

Callback flight recorder

Magic-link callback — last 0 flights

No successful exchange recordedNo failure recorded

No /auth/callback hits recorded yet in this Node process. If you just clicked a magic-link and see nothing here, the link did not reach the AgentProof server at all. Check the SMTP delivery, the public app URL, and the redirect target in Supabase Authentication → URL Configuration.

Ring buffer holds the last 16 flights, newest first. Never captures auth code values, access / refresh tokens, cookies, or secrets. Clears on process restart.

Migration verification — 9 checks

0/9 Operational

Migration verification: 0/9 Operational, 9 Blocked with exact action.

R66 A2: NOT appliedR66 A3: NOT appliedis_workspace_member real check: not activePublic-beta gate: blocked

1. Radar tables have workspace_id columnsBlocked with exact action

One or more Radar tables missing workspace_id. Likely cause: r66_a2 migration not yet applied.

Missing: workspace_id column on radar_source_checks / radar_signals / radar_proposals / radar_pack_publications / 4 agentproof_radar_* legacy tables

Migration file: migrations/r66_a2_radar_workspace_scope.sql

Exact action: Open Supabase → SQL editor → paste the contents of migrations/r66_a2_radar_workspace_scope.sql → run.

Verify: Run: SELECT column_name FROM information_schema.columns WHERE table_name = 'radar_signals' AND column_name = 'workspace_id'; — should return one row.

2. Radar RLS policies use workspace_id (workspace-scoped)Blocked with exact action

Radar RLS still uses old auth.uid()-only check. Cross-workspace leak possible until r66_a2 is applied.

Missing: Workspace-scoped RLS policies on Radar tables

Migration file: migrations/r66_a2_radar_workspace_scope.sql

Exact action: Apply r66_a2 migration. DROP POLICY IF EXISTS statements + CREATE POLICY statements with public.is_workspace_member(workspace_id) inside are included.

Verify: Run: SELECT policyname FROM pg_policies WHERE tablename = 'radar_runs'; — should include 'radar_runs read own workspace v2'.

3. agentproof_workspace_members table existsBlocked with exact action

Table missing. Until created, is_workspace_member() returns false and all Radar reads/writes are refused.

Missing: Table public.agentproof_workspace_members

Migration file: migrations/r66_a3_missing_tables.sql

Exact action: Apply r66_a3 migration.

Verify: Run: SELECT 1 FROM information_schema.tables WHERE table_name = 'agentproof_workspace_members'; — should return one row.

4. agentproof_workspace_invitations table existsBlocked with exact action

Table missing. Invitations cannot be persisted.

Missing: Table public.agentproof_workspace_invitations

Migration file: migrations/r66_a3_missing_tables.sql

Exact action: Apply r66_a3 migration.

Verify: Run: SELECT 1 FROM information_schema.tables WHERE table_name = 'agentproof_workspace_invitations'; — should return one row.

5. agentproof_audit_events table existsBlocked with exact action

Table missing. Audit log writes silently fall to local fallback.

Missing: Table public.agentproof_audit_events

Migration file: migrations/r66_a3_missing_tables.sql

Exact action: Apply r66_a3 migration.

Verify: Run: SELECT 1 FROM information_schema.tables WHERE table_name = 'agentproof_audit_events'; — should return one row.

6. agentproof_product_intelligence_backlog table existsBlocked with exact action

Table missing. Product intelligence backlog writes silently fall to local fallback.

Missing: Table public.agentproof_product_intelligence_backlog

Migration file: migrations/r66_a3_missing_tables.sql

Exact action: Apply r66_a3 migration.

Verify: Run: SELECT 1 FROM information_schema.tables WHERE table_name = 'agentproof_product_intelligence_backlog'; — should return one row.

7. public.is_workspace_member(uuid) function existsBlocked with exact action

Function missing. Radar RLS will refuse all reads/writes.

Missing: Function public.is_workspace_member(ws_id uuid)

Migration file: migrations/r66_a2_radar_workspace_scope.sql (placeholder) + migrations/r66_a3_missing_tables.sql (real check)

Exact action: Apply both r66_a2 and r66_a3 migrations.

Verify: Run: SELECT 1 FROM pg_proc WHERE proname = 'is_workspace_member'; — should return one row.

8. is_workspace_member() returns true for the active user's own workspaceBlocked with exact action

Function returns false. Either A3 not applied (still placeholder), OR no membership row exists for this user.

Missing: Either A3 migration OR a workspace_members row for the signed-in user

Migration file: migrations/r66_a3_missing_tables.sql + manual INSERT

Exact action: After applying r66_a3, INSERT one row into agentproof_workspace_members (workspace_id, user_id, role='owner') for the current user. See /admin/setup → R67 O1 Production Unblock Checklist → Copy-safe SQL guidance.

Verify: Sign in. Open /admin/setup → R67 O1 Production Unblock Checklist — workspace_members owner row check should report Operational.

9. At least one agentproof_workspace_members row exists for the active userBlocked with exact action

No membership row exists for any user. is_workspace_member() always returns false → Radar reads/writes refused.

Missing: Row in public.agentproof_workspace_members for the active user with role='owner'

Migration file: n/a (data insert, not migration)

Exact action: INSERT INTO public.agentproof_workspace_members (workspace_id, user_id, role) VALUES (<ws-uuid>, <user-uuid>, 'owner'); — see /admin/setup → R67 O1 → Copy-safe SQL guidance.

Verify: Run: SELECT count(*) FROM agentproof_workspace_members WHERE user_id = auth.uid(); — should return >= 1.

Auth verification centre — product-side proof

signed out

Auth pipeline ready — no test attempt yet.

Exact next action: Click Send test magic-link below and complete the round-trip. The product will report whether the link sends, the callback runs, the session is created, and the workspace is reached.

1. SMTP configured on Supabase pending

SMTP status: smtp_configured_no_login_observed_yet.

2. Email delivery not rate-limited ok

No rate-limit error observed on the last magic-link attempt.

3. Send test magic-link attempted pending

No magic-link send attempted yet. Use the Send test magic-link action below.

4. Send test magic-link succeeded pending

No successful magic-link send yet.

5. /auth/callback received the code pending

No callback round-trip observed yet. Click the magic link in the email after it arrives.

6. Supabase session created pending

No active session on this request. Complete the magic-link round-trip first.

7. Workspace reached pending

Workspace check pending until a session exists.

Send test magic-link

Action enabled — sends a one-shot test magic link to verify the auth round-trip.

Verify current session

Checks server session, shared access resolver, workspace state, route guard decision. No tokens, cookies, anon keys, or service-role keys are returned.

Last checked: 2026-05-25T03:54:56.137Z

Live staging smoke result

Smoke proof: no run recorded — readiness cannot be claimed green.

Signed-out safety: unknown
Radar route: unknown
Auth route: unknown
Workspace route: unknown
Run at: —
Staging URL: —
Pass / Total: 0 / 0
Fail / Blocked: 0 / 0

Next: Run the CLI: AGENTPROOF_STAGING_URL=https://your-staging-url node scripts/run_r57_live_staging_smoke.cjs (proves the 10 R55 S1 routes work on the deployed URL).

Auth live proof

Not proven yet

Access state: signed_out
Signed in: no
Local test access: inactive
Workspace found: no
Workspace ownership valid: no
Supabase configured: yes
Supabase SMTP: unknown
Magic-link route: present
Sign-out route: present
Storage source: supabase
Signed-in email: —
Last checked: 2026-05-25T03:54:56.138Z

Next: Sign in via /auth/sign-in to complete the proof.

Radar operating history

No radar run yet — open /admin/intelligence-ops and click Run check.

No durable run yet

Set up Supabase persistence first (see R57 Cp 2). Then click 'Run check'. Runs without Supabase are local fallback only.

Next: Set up Supabase persistence first (see R57 Cp 2). Then click 'Run check'. Runs without Supabase are local fallback only.

AI Radar status (R18)

Where the controlled source-watchlist stands

Source watchlist configured — no successful run yet

Source registry: 7 sources
Last check: never run
Detected changes: 0
Pending review: 0
Approved items: 0
Report-impact items: 0

AgentProof's AI Radar is a controlled source-watchlist. We monitor only the approved URLs in the source registry. We do not crawl arbitrary sites, probe targets, bypass paywalls, or scrape company systems.

AI Radar operational verdict (R22 addendum)

The complete radar operational state in one place

AI Radar configured — first successful check pending

Engine enabled + registry populated. No successful source-check has been recorded yet.

Source registry

Active sources

Last run

never

Successful checks

Failed checks

Changed sources

Pending review

Approved items

Intelligence pack

1.0.0

Report-impact warnings

Automation path

Manual only

Next action owner

admin

Next action (admin): Run the first source-check from /admin/intelligence-ops or via `node scripts/run_radar_check.cjs`.

Radar run history (R27)

Run records — visible across every surface

The same run-history view is mounted on /admin/intelligence-ops, /learn/ai-landscape-radar, and /system-health. No broad crawling, no probing, no paywall bypass, no vulnerability scanning. Each run is honestly labelled live or dry_run.

Latest run · run_id: dry_run_sample_v1

Dry run

checked_at: 2026-05-23T00:00:00.000Z

sources_checked

successful_checks

failed_checks

changed_sources

unchanged_sources

candidate_signals

evidence_hashes

mode

dry_run

Deterministic dry-run sample — the visible shape of a real source-check, with mode=dry_run so it is honestly labelled. No URLs were fetched.

Full history (1 run)

dry_run_sample_v1 · 2026-05-23T00:00:00.000Z · Dry run
sources_checked=7 · successful_checks=7 · failed_checks=0 · candidate_signals=1

R43 + R44 activation assistant

Probes the live deploy for the R43 / R44 critical tables AND the scheduled-radar GitHub Actions secret. Never echoes secret values.

AI Radar — operating state visible to system health

Approved-source watchlist only. No broad crawling. No company probing. Live mode requires AGENTPROOF_RADAR_LIVE_FETCH=true server-side; otherwise the run is dry-run and clearly labelled.

No radar run cached in this browser yet. Run AI Radar check now to record one.

Storage: local_cache_only — this cache is per browser. Supabase-backed persistence is a separate piece.

Pilot session — live (system health observer)

storage: local_cache_only

Radar scheduled run (R33)

Schedule artefact present · no runs recorded yet

Schedule artefact ships in this deploy but no run has been recorded yet. The next scheduled trigger will record the first run.

Last scheduled: —
Last manual: —
Next expected: —
Failed scheduled: 0

Schedule artefact ships in .github/workflows/radar-scheduled-run.yml+ scripts/run_radar_scheduled_check.cjs— approved-source only. No broad crawl. No probing. No fake real-time monitoring claim.

Setup wizard (R34)

5 critical item(s) are missing. Add the named env vars and redeploy.

2 configured/reachable·6 missing·0 failing·1 disabled

Supabase URL
Missing
Variable name: NEXT_PUBLIC_SUPABASE_URL
Supabase URL env var is not set on this deploy.
Next action: Set the named env var on Railway Variables and redeploy.
Supabase publishable (anon) key
Missing
Variable name: NEXT_PUBLIC_SUPABASE_ANON_KEY
Supabase anon key env var is not set on this deploy.
Next action: Set the named env var on Railway Variables and redeploy. Anon key only — never the service-role key.
Supabase auth enabled
Deferred
Variable name: AGENTPROOF_SUPABASE_AUTH_ENABLED
Supabase auth flag is off.
Next action: Set the named env var to true once Supabase is configured.
AgentProof public app URL
Missing
Variable name: NEXT_PUBLIC_AGENTPROOF_APP_URL
Public app URL env var is not set.
Next action: Set the named env var to the deploy URL (e.g. https://<your-deploy>.up.railway.app).
Radar scheduled public base URL
Missing
Variable name: AGENTPROOF_PUBLIC_BASE_URL
Radar scheduled base URL is not configured. The GitHub Actions workflow + Railway CLI need this to fire live.
Next action: Add the named secret in GitHub Settings → Secrets → Actions (or set it as the Railway env var).
Radar scheduled workflow artefact
Missing
Variable name: .github/workflows/radar-scheduled-run.yml
Workflow file is missing in the repo.
Next action: Restore the file from the R33 commit.
Admin tools enabled
Missing
Variable name: AGENTPROOF_ADMIN_TOOLS_ENABLED
Admin tools are off. Some admin actions will refuse to run.
Next action: Set the named env var to true on Railway Variables.
Demo mode
Configured
Variable name: AGENTPROOF_DEMO_MODE_ENABLED
Demo mode is on (default). The safe sample demo is visible.
Next action: No action — demo defaults to on.
Manual non-Microsoft agent enabled
Configured
Variable name: AGENTPROOF_MANUAL_NON_MICROSOFT_AGENT_ENABLED
Manual non-Microsoft agent flow is on.
Next action: No action.
report_history table reachable
Unknown
Variable name: report_history
Probe has not been run on this request.
Next action: Open /system-health or /api/admin/setup-status.
manual_agents table reachable
Unknown
Variable name: manual_agents
Probe has not been run on this request.
Next action: Open /system-health or /api/admin/setup-status.
review_snapshots table reachable
Unknown
Variable name: review_snapshots
Probe has not been run on this request.
Next action: Open /system-health or /api/admin/setup-status.
manual_environments table reachable
Unknown
Variable name: manual_environments
Probe has not been run on this request.
Next action: Open /system-health or /api/admin/setup-status.
HTTP Basic Auth master switch
Explicitly disabled
Variable name: AGENTPROOF_HTTP_BASIC_AUTH_ENABLED
HTTP Basic Auth is off. Customer routes do not pop up a browser auth dialog.
Next action: No action — keep this flag off for the pilot.

Open System health →Open Intelligence ops →Open Pilot readiness →Open Workspace →Open Reports →

Variable names only. No environment variable values, secrets, URLs, anon keys, JWTs, or service-role values are echoed by this panel or its API. Anon key only.

Radar schedule validator (R34)

Schedule not configured

Workflow artefact ships, but AGENTPROOF_PUBLIC_BASE_URL is not configured. The schedule cannot fire live.

Next action: Add the named secret in GitHub Settings → Secrets → Actions (or as a Railway env var) and redeploy.

Public base URL configured: no
Workflow artefact present: yes
Endpoint reachable: not probed
Last scheduled run: —
Last manual run: —
Next expected run: —
Failed scheduled runs: 0

Approved-source-only radar. No broad crawl. No probing. No fake real-time monitoring claim.

Reports data verification (R34)

Supabase reachable · no rows yet

Fetching reports from Supabase.

Next action: Wait for the API response.

report_history reachable: no
rows available: no
version stamps: no
export action: yes
detail route: yes

Configuration autopilot (R23)

What is auto-enabled, explicitly enabled, explicitly disabled, or missing configuration

R23 removes unnecessary flag dependencies. When safe configuration is present (Supabase URL + anon key, demo default-on, radar source registry populated), the relevant features auto-enable without requiring an admin to set a redundant flag. Admin tools stay explicit-only by design.

1 auto-enabled·4 explicitly enabled·0 explicitly disabled·0 missing required·5 usable·5 total

Supabase auth (magic-link login)
Explicitly enabled
Enabled by: AGENTPROOF_SUPABASE_AUTH_ENABLED=true
Next action: None — login is on.
Demo (public sample agents)
Auto-enabled (safe defaults)
Next action: None — demo is auto-enabled by default. Only AGENTPROOF_DEMO_MODE_ENABLED=false disables it.
AI Radar engine (controlled source-watchlist)
Explicitly enabled
Enabled by: AGENTPROOF_LANDSCAPE_RADAR_PUBLIC_PREVIEW_ENABLED=true
Next action: None — engine is on.
Admin tools (intelligence ops, invite console)
Explicitly enabled
Enabled by: AGENTPROOF_ADMIN_TOOLS_ENABLED=true
Next action: None — admin tools are on.
Manual non-Microsoft agent
Explicitly enabled
Enabled by: AGENTPROOF_MANUAL_NON_MICROSOFT_AGENT_ENABLED=true
Next action: None — manual non-MS agent is on.

Private pilot readiness matrix (R18)

Where the product stands, honestly

Fourteen areas the founder asked about. Each row carries one of six honest statuses, the proof surface, and the single named next action. Nothing is hidden behind "future work."

6 operational·5 partial·1 founder preview·2 blocked by config·0 planned·0 deferred·14 rows

Public site
Operational
What buyer sees: Home, Learn, Demo, AI Radar, Founder blueprint, Sign-in.
Proof surface: / + /learn + /demo + /learn/ai-landscape-radar + /login
Next action: None — shipped S34AA.
Wired by S34AA
Navigation
Operational
What buyer sees: Sticky AppHeader + workspace shell. No duplicate chrome. No orphan pages.
Proof surface: Header mounted at app/layout.tsx
Next action: None — shipped S34AC-R6 / R11.
Wired by S34AC-R6 + R11
Login (Supabase magic link)
Blocked by configuration
What buyer sees: Magic-link form sends a real Supabase auth email when enabled.
Proof surface: /login + Supabase auth callback
Next action: Founder sets AGENTPROOF_SUPABASE_AUTH_ENABLED=true on Railway.
Wired by S34C + R8 + R9
Supabase persistence
Partially operational
What buyer sees: Manual agents, review answers, report history all read from Supabase first when signed in.
Proof surface: /system-health → SourceOfTruthCompliancePanel + LiveSupabaseProbePanel
Next action: Founder enables auth on Railway, then walks the 13-step journey.
Wired by R14 + R15 + R16 + R17
Manual non-Microsoft agent
Partially operational
What buyer sees: Create agent → save → refresh → sign-out / sign-in → still there.
Proof surface: /workspace/manual-agent/new
Next action: Founder runs the live walk-through after sign-in.
Wired by R7 + S34I + R17
Demo
Operational
What buyer sees: Sample agents + capability zone + sample assessment + sample report. Reachable from Home, Learn, Trial.
Proof surface: /demo (default-on)
Next action: If demo shows OFF state, remove AGENTPROOF_DEMO_MODE_ENABLED=false from Railway.
Wired by R13 + R14 diagnostic + R18 sample flow
Trial (signed-in guided)
Founder preview
What buyer sees: Public preview clearly labelled; signed-in guided trial creates a sample workspace + agent + assessment + report.
Proof surface: /trial + /trial/workspace + /trial/assessment + /trial/report
Next action: Founder walks /trial → /trial/workspace → /trial/report; reports any path that breaks.
Wired by S34O + S34P + R18
Review answer preservation
Partially operational
What buyer sees: Every captured answer is visible after sign-out / sign-in. Never blank.
Proof surface: Review wizard + report → snapshot recovery + legacy fallback cascade
Next action: Founder enables auth, signs in, opens a reviewed agent.
Wired by R13 + R13-A + R13-LEGACY (S34AH) + R17
Reports (buyer-grade)
Operational
What buyer sees: Seven-section professional layout, methodology + version banner, honest disclaimer, print/export action.
Proof surface: ReportProfessionalLayout mounted on trial report + workspace reports; ReportExportPrintAction visible.
Next action: Founder reviews the new layout on /trial/report after R18 ships.
Wired by S33L + S33M + R14 banner + R17-EXPANDED + R18
AI Radar MVP
Partially operational
What buyer sees: Controlled source watchlist with check engine, items with status, admin review queue. Public page reports honest operational state.
Proof surface: /learn/ai-landscape-radar + /admin/intelligence-ops + radar API routes
Next action: Founder enables admin tools flag and runs first radar check.
Wired by R13-A + R18 system-health surfacing
Microsoft connector
Blocked by configuration
What buyer sees: Connect Microsoft, discover environments, discover Copilot Studio agents, read metadata only.
Proof surface: /api/connectors/microsoft/* + /connect/microsoft (real tenant required)
Next action: Founder configures the six MICROSOFT_* env vars or defers to post-pilot.
Wired by 1G initial + S34B
Provider-agnostic connector model
Operational
What buyer sees: Architecture supports adding more connectors without rewriting the assessment.
Proof surface: lib/agentproof/provider/provider_agnostic_positioning_v1.ts
Next action: None — shipped S34AC-R1 Defect 5.
Wired by S34AC-R1
System health (acceptance dashboard)
Operational
What buyer sees: Active probes + product completion + R14/R15/R16/R17 panels + R17-EXPANDED 13-step journey + R18 Live Acceptance Runner.
Proof surface: /system-health
Next action: None.
Wired by R12 + R14 + R15 + R16 + R17 + R18
Commercial / private pilot readiness
Partially operational
What buyer sees: Buyer-grade product: real persistence, real reports, honest demo, real AI Radar foundations, founder-runnable acceptance.
Proof surface: Founder walks the 13-step journey on the live URL; smoke evidence pack reports public-route green.
Next action: Founder runs the live walk-through; uses the R18 evidence pack to capture proof.
Wired by R12..R18 cascade

Browser HTTP Basic Auth guard (R19)

Does any route trigger a browser username/password popup?

Browser Basic Auth guard: OFF

AGENTPROOF_HTTP_BASIC_AUTH_ENABLED is not set to "true" — the live site never triggers a browser HTTP Basic Auth dialog on any route.

Master switch env var: AGENTPROOF_HTTP_BASIC_AUTH_ENABLED; Currently: off / unset
Credential env vars: Both present; Names never echoed — only presence is shown.
Blocks public / founder testing?: No — never; R19 contract: public site, demo, learn, login, system-health, workspace, dashboard, trial, founder/* are never gated, even when the gate is armed.

Protected path prefixes (only gated when master switch is on)

/admin

Persistence verdict (R21)

One-line verdict: is Supabase persistence operational?

Persistence auth-ready — signed-in round-trip not yet recorded

Auth is on and every persistence table is reachable. The signed-in round-trip (create manual agent → refresh → sign out → sign in → still there) has not been recorded on this browser yet.

Next action (admin): Sign in, walk steps 4-6 of the Live Acceptance Runner on /system-health, then mark each step PASS.

The verdict flips forward as you complete the named next action. Auth-ready → operational when the Live Acceptance Runner records a signed-in round-trip PASS for steps 4-6 (create manual agent → refresh → sign-out / sign-in).

Supabase persistence operational proof (R20)

Is persistence operational, or only configured?

Honest per-table proof. The overall verdict only flips to "operational" when every row is operational.

Persistence configured — not yet proven operational

1 operational·7 configured — untested·0 missing·0 violation·8 rows

Manual agent write/read
Configured — untested
Supabase table: manual_agents
What we check: Signed-in user can save a manual agent and read it back after a refresh and sign-out / sign-in cycle.
How to flip to operational: Founder enables AGENTPROOF_SUPABASE_AUTH_ENABLED=true on Railway, signs in, runs steps 4-6 of the Live Acceptance Runner.
Last proof timestamp: never run
Manual environment write/read
Configured — untested
Supabase table: manual_environments
What we check: Signed-in user can save a manual environment when creating an agent and read it back.
How to flip to operational: Same as manual_agents above — environments are created alongside the agent.
Last proof timestamp: never run
Review snapshot write/read
Configured — untested
Supabase table: review_snapshots
What we check: Captured answers persist via the review_snapshots row. Snapshot v1.1.0 carries question_labels for recovery.
How to flip to operational: Founder signs in, opens an agent review, captures at least one answer, saves progress.
Last proof timestamp: never run
Rich answer write/read (per-agent)
Configured — untested
Supabase table: rich_answers
What we check: Rich answers (evidence text, confidence, legacy hydration) persist alongside the snapshot.
How to flip to operational: Same flow — rich answers ride with the review snapshot.
Last proof timestamp: never run
Report metadata write/read
Configured — untested
Supabase table: reports
What we check: Generated reports persist with methodology/scoring/intelligence/report versions.
How to flip to operational: Founder generates a report from the review wizard. The report row lands in Supabase scoped to the workspace.
Last proof timestamp: never run
Report history write/read (per-agent)
Configured — untested
Supabase table: report_history
What we check: Re-score creates a new history entry; chip on the workspace report bar says Supabase-backed.
How to flip to operational: Founder re-scores the agent after answering more questions.
Last proof timestamp: never run
Improvement cycle write/read
Configured — untested
Supabase table: improvement_cycles
What we check: Improvement-cycle state persists (priority, named actions, reassessment plan).
How to flip to operational: Founder opens the improvement panel and saves at least one selection.
Last proof timestamp: never run
LocalStorage override violations (R16 registry)
Operational
Supabase table: n/a (registry check)
What we check: Across the R16 source-of-truth compliance registry, every signed-in surface must use Supabase first. R17 flipped the 4 defect surfaces.
How to flip to operational: Should always read 0. If it grows, name the regressing surface in the next release.
Last proof timestamp: never run

Reviewed answer recovery (R20 addendum)

Are reviewed answers recovering correctly?

Reviewed answer recovery: configured — needs a signed-in walk-through

Supabase + RLS + recovery cascade are wired. Verify by signing in, opening a reviewed agent, and confirming the answer source trace shows Supabase as the provider.

Supabase answer persistence: Configured — not yet proven operational
Legacy repair available: Yes
Reviewed agents with unrecoverable answers: Not measurable yet — needs signed-in walk-through

Core product journey (R20)

The 14-step visible navigation journey

Every step is reachable from normal navigation. No hidden URLs. When signed in with the auth flag on, the data-source chip says Supabase-backed.

14 steps·3 automatable·11 need founder action

1. Home
No persistence needed
Route: /
User does: Open the public landing page. See the hero, four Learn cards, public-vs-workspace panel, trust strip, footer.
Automatable from smoke: yes
2. Login (magic link)
Supabase-backed (when signed in)
Route: /login
User does: Enter email. Open magic-link email. Land back signed-in in the workspace.
Founder action: Set AGENTPROOF_SUPABASE_AUTH_ENABLED=true on Railway and complete the magic-link flow.
Automatable from smoke: no
3. Workspace landing
Supabase-backed (when signed in)
Route: /workspace
User does: See the workspace home + R17 SupabaseFirstHydrationStatusBar chip near the top.
Founder action: Sign in first.
Automatable from smoke: no
4. Create manual non-Microsoft agent
Supabase-backed (when signed in)
Route: /workspace/manual-agent/new
User does: Fill environment + agent name. Click Save. The server action writes to manual_agents + manual_environments.
Founder action: Submit the form after signing in.
Automatable from smoke: no
5. Refresh keeps the agent
Supabase-backed (when signed in)
Route: /workspace (after refresh)
User does: Hit refresh. Confirm the agent is still visible. Chip says Supabase-backed.
Founder action: Refresh after creating the agent.
Automatable from smoke: no
6. Sign out + sign in keeps the agent
Supabase-backed (when signed in)
Route: Header sign-out → /login → /workspace
User does: Sign out from header. Sign back in via magic-link. Agent still visible.
Founder action: Run the sign-out / sign-in cycle after step 5.
Automatable from smoke: no
7. Open agent + see review wizard
Supabase-backed (when signed in)
Route: /workspace/manual-agent/[agentId]
User does: Click into the agent. Review wizard renders with previously-captured answers.
Founder action: Open the agent after re-login.
Automatable from smoke: no
8. Answer review questions
Supabase-backed (when signed in)
Route: /workspace/manual-agent/[agentId] (review wizard)
User does: Capture answers across the review sections. Save progress between sections.
Founder action: Answer at least one section + save.
Automatable from smoke: no
9. Generate report
Supabase-backed (when signed in)
Route: Workspace report detail
User does: Trigger the report. ReportProfessionalLayout renders all 7 sections + methodology / version banner.
Founder action: Click Generate report after answering questions.
Automatable from smoke: no
10. Open report history
Supabase-backed (when signed in)
Route: JsonPasteScoreCard report history bar
User does: Open the report history. Source bar says Supabase-backed.
Founder action: Open the history after generating the report.
Automatable from smoke: no
11. Open improvement guidance
Supabase-backed (when signed in)
Route: /trial/improvement (for sample) or workspace improvement
User does: Open the improvement guidance for the agent's findings.
Founder action: Open the improvement panel after the report.
Automatable from smoke: no
12. Export report (print / save as PDF)
No persistence needed
Route: Report detail → Print / save as PDF button
User does: Click the visible R18 ReportExportPrintAction. Browser print dialog opens.
Automatable from smoke: yes
13. Return later and continue
Supabase-backed (when signed in)
Route: Close browser → reopen → sign in → workspace
User does: Confirm everything is still visible after a clean restart.
Founder action: Run the return-later check.
Automatable from smoke: no
14. Confirm /system-health shows the journey green
No persistence needed
Route: /system-health
User does: Open /system-health and verify the Live Acceptance Runner records green for the 13 R17-EXPANDED steps.
Automatable from smoke: yes

Customer journey (R21)

The 12-step journey, with every step reachable from visible navigation

Click any step's route to jump in. The status pill reflects whether the step is reachable now, blocked by configuration (admin action), blocked by sign-in (customer action), or sample-only.

6 reachable as anon·12 reachable as signed-in·1 blocked by configuration·5 need sign-in·12 total steps

1. Open the public home
Reachable now
Read the hero, see what AgentProof does, scan the trust strip.
Route: /
2. Browse Learn
Reachable now
Visit the seven Learn pages — capability zones, good design, controls, AI Radar, references.
Route: /learn
3. Try Demo or start a Trial
Reachable now
Demo shows sample agents in two minutes. Trial walks a guided workspace journey.
Route: /demo
4. Sign in
Blocked by configuration
Enter your email, open the magic-link, land in /workspace.
Route: /login
5. Open the workspace
Sign in first
See the signed-in workspace home with the Supabase-backed chip near the top.
Route: /workspace
6. Add a manual non-Microsoft agent
Sign in first
Fill environment + agent name. The server action writes to manual_agents + manual_environments.
Route: /workspace/manual-agent/new
7. Open agent + review answers
Sign in first
Review wizard with previously-captured answers visible. Save progress between sections.
Route: /workspace
8. Generate report
Sign in first
ReportProfessionalLayout renders all 7 founder-named sections + the methodology / version banner.
Route: /workspace
9. View improvement guidance
Reachable now
Per-finding cards with why-it-matters, what-good-looks-like, evidence-to-collect, reassess-after.
Route: /trial/improvement
10. Return later and continue
Sign in first
Close the browser. Open it again, sign in, confirm everything is still there.
Route: /workspace
11. Export report (Print / Save as PDF)
Reachable now
Click the visible Print action; browser print dialog opens; save as PDF produces a clean file.
Route: /trial/report/professional
12. Confirm /system-health is green
Reachable now
Open /system-health and verify the Live Acceptance Runner records green for the 13 R17-EXPANDED steps.
Route: /system-health

Private pilot readiness pack

The full readiness scorecard, security/trust posture, and recommended pilot script live on /admin/pilot-readiness.

Open /admin/pilot-readiness →

Run radar check (R25)

Open the admin run-radar-check action

Available to admin

Run-radar-check action is AVAILABLE to admin. Open /admin/intelligence-ops and click Run source-check now to record the first run.

Next action: Open /admin/intelligence-ops and click Run source-check now.

Open /admin/intelligence-ops →

Admin guard: AGENTPROOF_ADMIN_TOOLS_ENABLED must be on for the route to mount the run-check + adaptation proposal panels.

Working

15 checks

Supabase client init
We can instantiate the Supabase JS client from the configured public env vars.
Status: Client constructed successfully.
Next action: No action needed.
Supabase reachable + healthcheck table
Supabase is reachable, RLS allows anon SELECT on the read-only healthcheck table, and the seed row is present.
Status: Healthcheck row read successfully.
Next action: No action needed.
User profile table
Signed-in user profile rows can be selected (RLS-scoped to the current session).
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Workspace table
Per-workspace settings + ownership rows are reachable.
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Review snapshot persistence
Completed reviews + captured_answers are persisted here.
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Report persistence
Generated readiness reports (markdown body + metadata) are persisted here.
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Manual non-Microsoft agent persistence
Manual agents created via /workspace/manual-agent/new land in this table.
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Manual environment persistence
Manual environments created via /workspace/manual-agent/new land here.
Status: Table exists and is reachable (anon SELECT with RLS active returned 0 rows, as expected).
Next action: No action needed.
Supabase auth enabled (flag)
AGENTPROOF_SUPABASE_AUTH_ENABLED must be true for the login page to use real Supabase auth.
Status: Flag is on.
Next action: No action needed.
NEXT_PUBLIC_APP_URL configured
Magic-link redirect destination. Must be the live https Railway domain.
Status: Flag is on.
Next action: No action needed.
/auth/callback route present
The Supabase magic-link callback handler is mounted; signed in users land back on the live URL.
Status: Route is part of the build (R8 + R9 added the production-safe redirect resolver).
Next action: No action needed.
Manual non-Microsoft agent flow enabled
Surfaces the manual-agent path so buyers without Microsoft can still create + assess an agent.
Status: Flag is on.
Next action: No action needed.
Public intelligence preview content
Surfaces the curated public preview of the Intelligence Library.
Status: Flag is on.
Next action: No action needed.
Admin tools enabled
Surfaces /admin/* routes for founder operations.
Status: Flag is on.
Next action: No action needed.
AI Landscape Radar
Whether the radar pipeline (source registry + check engine + review queue + pack versioning) is wired and reachable.
Status: R13-A ships the real radar MVP: 16-source watchlist across 7 categories, source-check engine (allowlist + content hash + change detection), human review queue at /admin/intelligence-ops, pack versioning. Endpoint /api/radar/status reports operational counts; engine is opt-in per check run (no scheduled scraping).
Next action: Run a first check from /admin/intelligence-ops to populate detection counts. Set AGENTPROOF_ADMIN_TOOLS_ENABLED=true to expose the admin review queue + Run check button.

Configured but untested

1 check

Microsoft Entra app configured
All six MICROSOFT_* env vars are present on the deploy.
Status: MICROSOFT_TENANT_ID, MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, MICROSOFT_REDIRECT_URI, MICROSOFT_POWER_PLATFORM_SCOPE, MICROSOFT_SESSION_SECRET all set.
Next action: Walk the live tenant smoke test (docs/microsoft_tenant_smoke_execution_pack.md) end-to-end before letting external testers connect.

Needs founder action

3 checks

Demo mode enabled
/demo route renders the guided demo with two sample agents.
Status: Flag is off — the feature is intentionally disabled.
Next action: Set AGENTPROOF_DEMO_MODE_ENABLED=true in Railway Variables, then redeploy.
Manual agent persistence end-to-end
After login, creating an agent at /workspace/manual-agent/new persists it across a fresh sign-in.
Status: This requires the founder to log in, create a manual agent, sign out + back in, and confirm the agent survives. Cannot be automated without a test inbox.
Next action: Founder live login test: /login → magic link → /workspace/manual-agent/new → save → sign out → sign back in → /dashboard/estate → confirm agent still listed.
Review answer preservation end-to-end
Answers entered on /score/paste survive a refresh (defect 4 root-cause fix R6).
Status: R6 added a per-agent rich-answer persistence layer with a hydration guard. Code is in; needs a live walk-through to confirm.
Next action: Founder live test: pick an agent → answer 5 questions → hard-refresh the page → confirm those 5 answers are still selected.

Intentionally sample-only

2 checks

Trial workspace journey
Whether /trial/* persists a real trial workspace or renders an illustrative walkthrough.
Status: Guided sample preview. The /trial/* pages render hardcoded sample data and do not persist a real trial workspace.
Next action: For real persisted trials, route buyers through /score/paste (Microsoft) or /workspace/manual-agent/new (already wired in R7).
Radar preview content flag
Whether the radar preview content renders for public visitors.
Status: Flag is on.
Next action: No action needed.