# G3 localhost closure report

Date: 2026-08-09

Verdict: **PASS for the Phase 3 localhost milestone; HOLD for an external-user
pilot.** M9-M12 meet their repository definitions of done without cloud,
deployment, billing, accounts, subscriptions, or committed secrets. The hold is
intentional: the product still requires an explicit DimensionGraph, real-scan
dimensional truth is absent, independent human usability is untested, and live
reader provider cost and latency are unmeasured.

## Measured closure

| Evidence | Result |
|---|---:|
| Blind Reader v2 protocol | 20/20 compliant, 0 observed violations |
| Scored synthetic blind recall | 87/97 (89.7%) |
| Blind accepted-value accuracy | 87/87 (100.0%) |
| Blind end-to-end green drawings | 9/10 |
| Scored silent errors | 0 |
| Licensed-real drawings | 10 source-only, unscored |
| M6 deterministic set | 54/60 scored synthetic pass; 10 real source-only |
| M7 false rejects | 0/54 (0.0%) |
| M7 named guard decisions | 14/14 |
| M8 deterministic duration | 84.22 ms max; 74.65 ms P95 |
| M9 localhost service jobs | 54/54 |
| Service/CLI artifact identity | 270/270 |
| Uploaded PNG byte identity | 54/54 |
| M10 browser journeys | 2 success, 1 named rejection |
| M10 console warnings/errors | 0 |
| M11 concurrent uploads | 20/20 complete |
| M11 active model-worker peak | 4/4 |
| M11 stress traffic | 320 green, 0 yellow, 0 red |
| M11 closure duration | 514.5 ms |
| M11 restart and sequence recovery | pass |
| M11 anonymous metric records | 21/21 |
| Fresh one-command configure/build/install | pass |
| Installed package | 57 files, 45,247,321 bytes, 24 DLLs |
| Installed localhost demo | 1/1; 16 green, 0 yellow, 0 red |
| Installed demo artifacts | 8/8 nonempty; source PNG SHA-256 match |
| Packaged CLI artifacts | 5/5 nonempty |
| M12 package contract | 33/33 assertions |
| Full engine suite | 54 cases, 2697 assertions |
| CTest | 4/4 |

Recall and silent-error claims apply only to the ten scored synthetic drawings
with pinned ground truth. The ten licensed-real scans have provenance and source
handling evidence but no independently verified dimensional models, so they do
not contribute recall, accuracy, or silent-error counts.

## Product path proved

The shipped service binds a non-configurable `127.0.0.1` host, accepts an
unchanged DimensionGraph v0 plus PNG, queues work, runs four model workers,
persists every state transition atomically, restores terminal results after
restart, and exposes named status/result/artifact endpoints. The same-origin web
page covers upload, progress, source/model overlay, traffic rows with source-box
zoom, named rejection text, and STEP/report download. Its assets are local and
its Content Security Policy has no remote script, style, font, frame, analytics,
or connection allowance.

The package installs both executables, app-local runtime DLLs, web assets, a
local-only demo, sample inputs, API/G3 documents, and dependency notices. The
one-command source entrypoint configures, builds, installs, verifies, and starts
the loopback service. The demo refuses non-loopback URLs and fails on a rejected
job, failed deterministic validation, a red traffic row, or an empty artifact.

## Evidence boundary

A service traffic row is green only when the submitted graph confidence is at
least 0.8 and the deterministic solve, construction, STEP reload, and validation
path succeeds. It does **not** independently prove that the submitted graph
matches the PNG. M5-R separately proves a blind reader path on the fixed 10+10
set, but that reader is not silently embedded in the M9-M12 upload product. A
user must explicitly provide the graph; missing pixel-to-graph integration is a
visible product boundary, not a fallback.

## Known limits and residual risks

| Priority | Limit or risk | Required before external pilot |
|---|---|---|
| High | No integrated, attested PNG-to-DimensionGraph reader in the localhost product | Add the reader behind the same red/yellow/green contract and rerun a fresh blind gate |
| High | Real scans lack independently verified dimensional ground truth | Produce reviewed truth models and report real-only recall and silent errors |
| High | API/provider cost and end-to-end reader latency are unmeasured | Measure with the selected provider and keep credentials outside the repository |
| High | M10 usability evidence is browser automation, not an unaided human study | Run the Phase 4 workshop pilot with nontechnical users |
| Medium | Abrupt process kill during an active OCCT call was not fault-injected | Add crash injection; verify queued/running replay and JSONL tail handling |
| Medium | Local inputs, models, and metrics persist until manually removed | Define retention, deletion, backup, and local privacy guidance |
| Medium | One process owns a jobs directory; no multi-process lock or user isolation | Keep one local instance or add an explicit ownership lock before expanding scope |
| Medium | Packaging is Windows x64 because PDFium is pinned to that platform | Build and validate separate licensed packages before claiming another OS |
| Low | The M11 20-job stress uses one repeated plate fixture | Add long-duration, mixed-size soak and resource-exhaustion tests |

Phase 4 remains human work. This report authorizes an audit of the localhost
closure, not deployment, cloud accounts, billing work, or an external pilot.

## Audit map

| Area | Files |
|---|---|
| Binding and blind gate | `engine/src/deterministic_binding.cpp`, `engine/src/agent_v2_evaluation.cpp`, `engine/tests/m5_agent_evaluation_tests.cpp` |
| Blind metrics and G2 | `docs/metrics_agent.md`, `docs/g2_report.md`, `testdata/agent/m5r/m5r-round-001/` |
| Dataset, guard, input | `docs/failure_taxonomy.md`, `docs/guard_metrics.md`, `docs/metrics_m8.md` |
| Local API and engine | `docs/local_api_v1.md`, `engine/src/local_service.cpp`, `engine/tests/m9_service_tests.cpp` |
| Web evidence | `web/`, `engine/tests/m10_web_tests.cpp`, `docs/metrics_m10.md` |
| Durability and telemetry | `engine/tests/m11_durability_tests.cpp`, `docs/metrics_m11.md` |
| Packaging and demo | `tools/run_local.ps1`, `tools/demo_local.ps1`, `cmake/CadePackaging.cmake`, `README.md`, `docs/metrics_m12.md` |
| Scope and current state | `CLAUDE.md`, `STATUS.md`, `.agents/cade-m5-m12-flow.md` |
