Фуражир / evidence center
A public register of what can be checked in source, contracts, and reproducible commands—together with what the current version does not provide.
This is an implementation inventory, not a performance metric or evidence that the system is already operating for a real customer.
DEPLOYMENTThe web application, PostgreSQL migrations, and a separate background worker ship as a single-tenant environment for one customer. PostgreSQL remains the source of truth.
platform/package.json · platform/README.md · platform/scriptsACCESSThe current administration boundary uses an admin token, TOTP, server-side sessions, session revocation, and audit history. This wording does not imply a user or role model.
platform/app · platform/lib/auth · platform test suiteAPIThe package includes /api/v1, OpenAPI 3.1, scoped API keys, an exact CORS allow-list, and a dependency-free TypeScript SDK. The public sandbox exposes a separate demo surface.
platform/lib/backend/publicApiV1.ts · packages/sdk-typescriptRUNTIMELiveness, readiness, and worker-heartbeat checks are separate. SMTP and S3-compatible storage have dedicated verification commands; S3 remains optional.
platform/scripts/check-worker-heartbeat.mjs · verify-smtp.ts · verify-s3.tsThese items must not be sold as hidden capabilities, counted as shipped in comparisons, or treated as solved by a single infrastructure setting.
There are no named users, memberships, or separation of duties across operators. The current baseline is designed for one administrative operator.
There are no ready-made policies over resources, rows, or fields. API scopes do not replace administration-panel RBAC.
Corporate identity-provider integration and automated account provisioning are not implemented.
Kubernetes/Helm, application replication, online zero-downtime migrations, and a proven high-availability topology are not included.
Technical controls alone do not prove compliance with a particular law, standard, or regulated operating model.
The license rights, contract documents, payment method, infrastructure, and secure package delivery are agreed for each project before ordering.
The first two checks target the public demo origin. The remaining commands run from the delivered source-package root; quickstart requires Docker and free local ports.
Checks only that the demo process responds. It does not establish the state of a production platform.
curl -fsS https://<demo-origin>/api/demo/v1/healthReturns the OpenAPI 3.1 document for the safe sandbox surface, without production credentials.
curl -fsS https://<demo-origin>/api/demo/v1/openapi.jsonTypes, tests, and lint for the administration platform.
npm ci
npm run platform:checkStarts PostgreSQL, Mailpit, and the application, applies migrations, and runs smoke checks.
npm run platform:quickstartRuns checks for the site, platform, services, SDK, and working-build dependencies. Success applies only to the checked build and does not replace contract or infrastructure acceptance.
npm run check:allRetain the commit SHA, Node/npm versions, stdout/stderr, and exit code. Without a specific commit, a green log is not evidence for a different build.
This page does not turn the presence of code or tests into a commercial, operational, or legal fact.
Documentation covers inventory and contracts; Security covers controls and assumptions; Support and Contact provide the handling rules and a direct channel.