> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/evidence-and-handoff-records/ns-aud-2026-08-21-verification-matrix.md). # 2026-08-21 audit remediation verification matrix This record reconciles the 48 items in the 2026-08-21 engineering/design audit backlog with the repository at the end of the remediation pass. It distinguishes deterministic repository evidence from deployment settings, signed venue campaigns, legal approval and human rehearsal records. A locally implemented control is not treated as live authority. ## Status vocabulary * **Verified locally** means the implementation and its deterministic repository evidence passed on 2026-08-21. * **Verified in hosted CI** means the same deterministic evidence also passed on the pull-request head in GitHub Actions. * **External action pending** means the repository-side control is implemented, but an account, platform setting, credentialed rehearsal or human approval cannot be established from source code. * **Evidence pending** never inherits a readiness badge. The public status matrix and execution gates must remain fail-closed. ## Deterministic verification record | Gate | Result | | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `pnpm test` | Passed all 16 workspace tasks. Web: 231 files and 1,321 tests passed; two PostgreSQL suites were intentionally skipped because no test database was configured. | | `pnpm test:postgres` | Passed both previously skipped suites against a clean loopback PostgreSQL 17 database after all four checksum-verified migrations. Dedicated CI now supplies a digest-pinned PostgreSQL service, so these suites cannot silently skip there. | | `pnpm typecheck` | Passed all 16 workspace build/typecheck tasks. | | `pnpm contracts:check` | Passed; ten committed JSON Schema/OpenAPI artifacts reproduced deterministically. | | `pnpm test:py` | Passed 96 execution-service tests. | | `pnpm lint:py` | Ruff passed without warnings or suppressing test warnings. | | `pnpm test:local` | Passed 168 local runtime, security, backup, release, provider and authority-boundary tests. | | `pnpm test:signer` | Passed the real offline Arcus signer supervision/recovery integration. | | `pnpm test:hl-signer` | Passed real offline Hyperliquid testnet and capped-mainnet signer supervision integrations. No venue or capital action was sent. | | `pnpm test:signer-store` | Passed real migrated SQLite backup, verification and restore integration. | | `pnpm build` | Passed all ten workspaces; Next generated 51 application pages. | | `pnpm test:e2e` | 37 functional cases passed, two desktop-inapplicable mobile cases skipped, then the isolated desktop performance case passed across desktop, 390px and 360px Chromium. This includes explicit deferred-chart and deferred-PAPER loading coverage at every viewport. | | `pnpm test:performance` | Passed landing, command-deck and terminal route budgets. The unchanged ceilings apply to the longest individual task, matching the audit's “none over” requirement; the artifact also retains task count and aggregate duration. | | `pnpm css:check` | Passed route splitting and ceilings. Decoded CSS: landing 77,797 bytes, command deck 53,643, terminal core 77,615, terminal deferred 179,916. | | `pnpm preflight` | Passed. Unconfigured production authorities remained explicit warnings and locked. | | `pnpm smoke:web` | Passed public pages, strict CSP, health, authority-boundary, Arcus, Lighter, Hyperliquid and Robinhood Chain read-path assertions. | | `node .github/scripts/validate-docs.mjs` | Passed all 265 Markdown files and indexed all 116 GitBook pages with valid local targets and no orphaned pages. | | `pnpm handoff:check` | Passed 3,664 source files, 288 required files, secret-pattern checks and semantic safety assertions. Generated `output/` evidence is excluded from source and secret scans. | | [PR #3 hosted checks](https://github.com/Nytshift/nytshift/pull/3) | Commit `35ebea5f7b9683ca0cd52aeef55f909e0bf3a6e7`: docs run `32523699761` passed; CI run `32523699756` passed `execution-python`, `typescript`, `customer-database` and `browser-e2e`. Browser E2E passed 37 functional cases with two intentional skips plus the isolated performance gate. | | [Hosted performance artifact](https://github.com/Nytshift/nytshift/actions/runs/32523699756) | Artifact `9461555972`. Terminal after deferred chart hydration: 489,047 transferred / 1,759,641 decoded script bytes at network idle, 763 DOM nodes, 92,815 decoded CSS bytes, 0.0005 CLS, four long tasks, 320 ms aggregate and a 99 ms maximum individual task against the unchanged 300 ms ceiling. The local compiled first-load route closure is 1,480,551 uncompressed script bytes; the async chart still loads and is asserted at all three viewports. | ## Ticket-by-ticket disposition | Ticket | Disposition | Repository evidence and remaining boundary | | ---------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NS-AUD-001 | Verified locally | `arcus-trading-rules.ts` accepts absent `null` bounds while malformed, non-positive and inverted values remain blocked. Parser tests and the live read-only Arcus smoke passed. | | NS-AUD-002 | External action pending | Deterministic PR CI is implemented and green on commit `35ebea5f7b9683ca0cd52aeef55f909e0bf3a6e7`; the separate scheduled/manual provider canary workflow includes fixed outage/drift/regression classification. GitHub still reports `main` as unprotected with status-check enforcement off, and no provider-canary incident issue or hosted incident artifact was found. | | NS-AUD-003 | Verified locally | Python/Ruff/pytest versions are locked; Ruff and 96 tests pass. Execution failures remain fixed-code, durable and reconcile-only where outcome is unknown. | | NS-AUD-004 | Verified locally | The typed Arcus, Hyperliquid, Lighter and Robinhood Chain capability registry drives public/customer projections and contradiction tests. | | NS-AUD-005 | External action pending | Playwright runs desktop, 390px and 360px production journeys with failure-only artifacts and no signing. The local and hosted matrices passed 37 functional cases with two desktop-inapplicable mobile skips plus the isolated desktop performance case. CI run `32523699756` is green; making the workflow required remains an administrator setting. | | NS-AUD-006 | Verified locally | NYTSHIFT is canonical, AEGIS is consistently the risk engine, and brand/capability-copy tests reject contradictory venue claims. | | NS-AUD-007 | Verified locally | Stable `/app/*` routes, typed safe URL context, refresh and history behavior, and the `/terminal` compatibility surface are implemented and browser-tested. | | NS-AUD-008 | Verified locally | `/ops/*` is a distinct, non-indexed, operator-session-gated control plane. Customer identity does not grant operator authority. | | NS-AUD-009 | Verified locally | Desktop navigation is route-derived, labelled, keyboard ordered and tested at the production viewport. | | NS-AUD-010 | Verified locally | Mobile bottom navigation and the draft/risk/confirm trade sheet are implemented. 390px and 360px PAPER/blocked-state journeys pass. | | NS-AUD-011 | Verified locally | Markets and Orders are dedicated routes with venue/source context, lifecycle grouping, exact deep links and reconcile-only unknown states. | | NS-AUD-012 | Verified locally | Portfolio, Activity and Funds preserve venue-scoped capital, provenance, partial-state language and provider-owned handoff boundaries. | | NS-AUD-013 | Verified locally | Research and Agents distinguish deterministic/model output, proposal/testnet scope and revocation while excluding signer, funding, cancellation and mainnet authority. | | NS-AUD-014 | Verified locally | Operational/body typography floors are tokenized and enforced by computed-style browser assertions. | | NS-AUD-015 | Verified locally | Mobile controls meet the 44px target gate; disabled execution controls use explicit border/tone treatment, not opacity alone. | | NS-AUD-016 | Verified locally | Remaining horizontal regions are focusable and labelled; mobile tables expose visible scroll cues and command-deck mobile data uses responsive cards. | | NS-AUD-017 | Verified locally | Command-deck desktop data is semantic and mobile cards retain venue, market, freshness, rules and dossier actions. Accessibility/coverage tests pass. | | NS-AUD-018 | Verified locally | The shared dialog utility resets scroll, supports deliberate initial focus, traps focus, closes on Escape and restores the trigger. Browser focus restoration passed. | | NS-AUD-019 | Verified locally | Order validation is neutral on first view and becomes error-styled only after interaction/review, with explicit units and accessible announcements. | | NS-AUD-020 | Verified locally | Core ticket fields and protection are primary; ceilings, slippage, fees, TIF and leverage detail are progressively disclosed and remain serialized in review state. | | NS-AUD-021 | Verified locally | Landing is reduced to the six specified chapters with canonical capability language; reduced-motion visibility and route performance pass. | | NS-AUD-022 | Verified locally | Token information lives at `/token`; proposed/configured/deployed states are distinct and cannot imply a launched contract. | | NS-AUD-023 | Verified locally | Chart “View data” exposes context-bound semantic OHLCV plus textual risk/entry/liquidation alternatives. | | NS-AUD-024 | Verified locally | Named layer tokens cover the approved stack and tests reject arbitrary feature z-index values. | | NS-AUD-025 | Verified locally | `terminal-client.tsx` is a bounded wrapper; controller, data/lifecycle/action, state and presentation modules pass architecture budgets and the full parity suite. | | NS-AUD-026 | Verified locally | Arcus and Hyperliquid use typed execution UI transitions; context changes invalidate review, illegal transitions fail and unknown stays reconcile-only. | | NS-AUD-027 | Verified locally | Terminal fetches flow through typed domain clients with validation, timeout, abort, no-store and safe error taxonomy. Browser clients have no signing authority. | | NS-AUD-028 | Verified locally | Source CSS is deterministically split into independently loaded base/landing/command-deck/terminal/identity layers and all route ceilings pass. | | NS-AUD-029 | Verified locally | Preferences use a versioned, bounded parser/migration layer with corruption recovery, cross-tab handling and reset/export UI; sensitive domains are excluded. | | NS-AUD-030 | Verified locally | Python app composition is split into domain, store and Arcus/Hyperliquid/dead-man/audit route modules. Ruff, 96 tests and real backup/restore pass. | | NS-AUD-031 | Verified locally | Contracts are split into core, strategy, execution and platform ownership; consumers use owning subpaths, cycles are rejected and artifacts reproduce. | | NS-AUD-032 | Verified in hosted CI | Machine-readable per-route budgets enforce CSS, decoded/transferred JS, total payload, DOM, CLS and the audit's longest-individual-task ceilings while retaining count and aggregate duration for trend diagnosis. PAPER's 100 KB source module and dependency graph load only after explicit authority selection; the chart is also split from initial hydration behind a geometry-stable boundary and verified to load at every viewport. Hosted artifact `9461555972` passed all routes; terminal's longest task was 99 ms against the unchanged 300 ms ceiling. | | NS-AUD-033 | Verified locally | Canonical origin parsing is allowlisted, production-configured and tested against host, protocol, port, credential, path and forwarded-header spoofing. | | NS-AUD-034 | Verified locally | Actions are immutable-SHA pinned with release comments; Playwright/audit dependencies are exact and Dependabot is configured for reviewed updates. | | NS-AUD-035 | Verified locally | Execution tests use supported HTTPX transport behavior and the 96-test run is warning-free. | | NS-AUD-036 | Evidence pending | Arcus signer isolation, exact scope, idempotency, audit, reconciliation and expiring evidence verifier are deterministic and green. A real signed Arcus testnet lifecycle campaign needs isolated credentials and explicit capital-action authorization. | | NS-AUD-037 | Evidence pending | Hyperliquid rejects master keys and implements API-wallet scope, leverage, bracket, cancellation, dead-man and reconciliation controls. A real signed testnet campaign is still required. | | NS-AUD-038 | Evidence pending | Partial-fill/protection/sibling-cancel state logic is deterministically verified. Venue-behavior proof must be attached to the signed Arcus/Hyperliquid campaigns. | | NS-AUD-039 | Evidence pending | Offline real-process restart recovery and no-duplicate-submit controls pass. The required forced-disconnect-after-venue-I/O evidence awaits signed testnet campaigns. | | NS-AUD-040 | Evidence pending | Fee ceilings, builder accounting, exact-fill deduplication and portfolio reconciliation pass deterministically. Current venue fee/builder/fill evidence awaits Hyperliquid testnet credentials. | | NS-AUD-041 | Verified locally | Lighter is registry-enforced read-only; customer surfaces offer public context/offline planning and tests reject execution claims. | | NS-AUD-042 | Verified locally | Robinhood Chain direct assets expose intelligence and provider-owned handoffs only. No quote/approval/calldata/signature/submission authority is present. | | NS-AUD-043 | Verified locally | Public status separates implementation and release-bound proof, includes observation/expiry/release, rejects sensitive identities and clears missing/stale proof. Current signed venue proof therefore displays unavailable. | | NS-AUD-044 | Verified locally | Public Docs, Status, Security and Help routes exist with capability, provenance, support and accessibility coverage. Local validation checks all 265 Markdown files and indexes all 116 GitBook pages. The public GitBook still serves the older “Welcome to NYTSHIFT” book and does not expose the new guide or verification matrix, so publication remains an account action. | | NS-AUD-045 | External action pending | Dated Privacy, Terms and Risk routes cover the required data/risk boundaries and footer links. Qualified legal-counsel review remains mandatory before production execution. | | NS-AUD-046 | Verified locally | Canonical metadata, public-only sitemap, explicit private/operator robots rules and factual page metadata/social cards are implemented and tested. | | NS-AUD-047 | Verified locally | Fixed-name, coarse telemetry rejects wallets, account/order IDs, proposal content, credentials and raw bodies; retention/consent, release/reason grouping and the operator dashboard are documented and tested. | | NS-AUD-048 | External action pending | Incident command, credential rotation, unknown outcome, provider/alert/reconciliation and exact rollback runbooks exist; backup/restore and signer recovery tests pass. Named human owners and signed rehearsal records require an authorized rehearsal. | ## Original P3 polish checklist All ten P3 observations in the full audit were checked independently of the numbered backlog: the mobile venue selector now uses full names; Arcus uses “Marketable limit” and side-aware maximum/minimum fill-price wording; customer reason codes render as sentences with expandable technical detail; remaining horizontal tables have mobile scroll cues; unavailable controls have a distinct disabled treatment; the first-party 404 remains; first-load skeletons preserve terminal geometry; each venue/mode explains what the user can do; and NYTSHIFT spelling is canonical. Source-level polish tests and the desktop/390px/360px browser matrix passed. ## External evidence and production-readiness register The repository is fail-closed while any item below is absent. These are not source-code defects and were not fabricated during this pass. | External requirement | Current state | Required owner action | | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Remediation commit, review and production release | The explicit ownership boundary is established, the remediation is committed on `agent/nightshift-paper-db-live-readiness`, and [PR #3](https://github.com/Nytshift/nytshift/pull/3) is open, non-draft and mergeable with green hosted docs and CI evidence at `35ebea5f7b9683ca0cd52aeef55f909e0bf3a6e7`. The 2026-08-21 public probe still reports production release `a89100cf2e2772d398de505defca53cd51d3316f`; `/app`, `/docs`, `/status`, `/security`, `/help`, `/token`, `/legal/*`, `/ops`, `robots.txt` and `sitemap.xml` return 404 there. | Review and merge PR #3, build the immutable release, deploy it through the release runbook, then re-run public desktop/mobile plus route/health verification against the new exact commit. | | GitHub required checks | PR #3 has retained green hosted docs and four-job CI evidence. GitHub still reports `main` as `protected: false`, with protection disabled and required-status-check enforcement off. | A repository administrator enables branch protection and requires deterministic CI, database and Playwright checks before merge. | | Provider-canary incident evidence | Workflow and classifier verified locally; no matching GitHub incident issue found | Run the scheduled/manual canary in GitHub and retain its artifact/issue behavior. | | Arcus signed testnet campaign | Missing | Authorized operator supplies isolated testnet credentials and approves the low-notional campaign. | | Hyperliquid signed testnet campaign | Missing | Authorized operator supplies a dedicated API-wallet testnet key and approves the campaign. | | Production identity/operator/Agent entitlements | Unconfigured and locked | Configure exact-app Privy evidence, operator secret, signed Agent Pro/eligibility public material and approved alert endpoints as applicable. | | Hyperliquid revenue configuration | Unconfigured and locked | Configure and verify the builder address/approval only through the documented readiness process. | | Robinhood Chain production topology | Diagnostic only | Add independent HTTPS/WSS/archive-capable providers and generate fresh endpoint-bound attestation evidence. | | Qualified legal review | Missing | Counsel reviews and versions Privacy, Terms and Risk before production execution. | | Human operations rehearsal | Template present; no signed record | Named incident/release owners conduct and sign backup, key-rotation, authority-disable and rollback rehearsals. | | GitBook publication | All 116 local pages validate, but the 2026-08-21 public probe still serves “Welcome to NYTSHIFT \| NYTSHIFT Docs” and exposes neither the audit matrix nor the new guide/navigation | Documentation owner syncs the current source in GitBook, publishes it, and verifies the public desktop/mobile site. | Until those items are complete, signed-testnet and mainnet readiness must remain false even though deterministic implementation gates pass. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/evidence-and-handoff-records/ns-aud-2026-08-21-verification-matrix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.