{
  "schemaVersion": "1.0",
  "product": "Makemake Companion",
  "canonicalEvidenceUrl": "https://makemake.asia/evidence/",
  "publishedAt": "2026-08-24",
  "modifiedAt": "2026-08-24",
  "evidenceClass": "self-reported engineering verification",
  "publiclyReproducible": false,
  "publicReproductionLimitation": "The source repository and full verification output are private. Public readers can inspect this bounded register but cannot independently reproduce the recorded run from the published artifacts alone.",
  "reviewedBaseline": {
    "sourceRevision": "1e775bbe756cb93bf0136526753657efa4b95e86",
    "environment": "Windows release workspace",
    "command": "pnpm run check",
    "result": "passed",
    "automatedTestCases": {
      "web": 14,
      "core": 11,
      "api": 31,
      "worker": 19,
      "total": 75
    },
    "validationStages": [
      "provider policy",
      "secret scan",
      "hosting policy",
      "TypeScript type checks",
      "automated tests",
      "production builds"
    ],
    "qualification": "Two worker cases are Windows-conditional; the 75-case result refers to the dated Windows verification."
  },
  "maturity": {
    "released": [
      "nature-led public Companion presentation",
      "Google identity surface",
      "restrictive Firebase Hosting security headers"
    ],
    "implementedGated": [
      "phone identity code pending Firebase SMS configuration",
      "signed paid-entitlement presentation evaluation pending authoritative ADAR projection",
      "private operational pipeline source implemented; deployment state not asserted by this public register"
    ],
    "inDevelopment": [
      "Makemake for PC",
      "Makemake for Robot",
      "Makemake for TV",
      "Makemake for Drone",
      "Makemake for IoT",
      "Makemake for Mobile",
      "Makemake for Car",
      "cross-device task coordination"
    ]
  },
  "claims": [
    {
      "id": "companion-access-fails-closed",
      "statement": "A role alone cannot unlock Companion; the presentation gate also requires a current signed entitlement window.",
      "status": "implemented-tested",
      "sourceEvidence": [
        "apps/web/src/companionAccess.ts",
        "apps/web/tests/companionAccess.test.ts"
      ],
      "limitation": "This is presentation gating, not a released customer action API or payment authorization."
    },
    {
      "id": "owner-boundary",
      "statement": "Private operations require the configured verified owner identity using Google as the token sign-in provider.",
      "status": "implemented-tested",
      "sourceEvidence": [
        "apps/web/src/auth.ts",
        "apps/api/src/auth.ts",
        "apps/api/tests/auth.test.ts"
      ],
      "limitation": "The matching API hardening requires its own service release."
    },
    {
      "id": "commerce-authority-isolated",
      "statement": "Makemake does not invent a product, price or payment role and accepts configured checkout links only over HTTPS on adar.asia or its subdomains.",
      "status": "implemented-gated",
      "sourceEvidence": [
        "apps/web/src/companionCheckout.ts",
        "apps/web/tests/companionCheckout.test.ts",
        "docs/companion-access.md"
      ],
      "limitation": "No authoritative Makemake Companion checkout offer or signed per-user ADAR projection is live."
    },
    {
      "id": "human-controlled-publication",
      "statement": "Reviewed operational AI output is hash-bound, locally approved, freshly authorized and recorded with a durable receipt before acknowledgement.",
      "status": "implemented-tested-deployment-not-asserted",
      "sourceEvidence": [
        "apps/api/src/repository.ts",
        "apps/worker/src/receipts.ts",
        "apps/worker/tests/workspace.test.ts"
      ],
      "limitation": "This describes reviewed source and tests, not the pipeline's current deployment state, a public customer capability or independent certification."
    },
    {
      "id": "bounded-credential-use",
      "statement": "Operational secrets use authenticated envelopes and signed worker requests bind method, path and body hash within a replay window.",
      "status": "implemented-tested",
      "sourceEvidence": [
        "packages/core/src/security.ts",
        "packages/core/tests/core.test.ts"
      ],
      "limitation": "This is a code-level control claim, not a penetration-test result or a claim of universal security."
    },
    {
      "id": "hosting-policy",
      "statement": "The deployed presentation uses policy-checked security headers and excludes unsafe inline and evaluated script execution.",
      "status": "released-checked",
      "sourceEvidence": [
        "firebase.json",
        "scripts/hosting-policy.mjs"
      ],
      "limitation": "Security headers reduce specific browser risks; they do not establish complete application security."
    }
  ],
  "notClaimed": [
    "released cross-device integrations",
    "live customer Companion actions",
    "live phone joining",
    "live paid checkout",
    "uptime, latency, completion-rate or adoption metrics",
    "independent penetration testing",
    "accessibility certification",
    "SOC 2, ISO 27001, GDPR or PDPA certification",
    "best, leading, most secure or top-recommended status"
  ],
  "contact": "https://makemake.asia/index.php/contactus/"
}