# Verification — SHIRE Marketing Forge Easy v1.3.0

Verified on 18 July 2026.

## Static checks

- `node --check core.js` — PASS
- `node --check app.js` — PASS
- `node --check server.js` — PASS
- Local server `/api/health` reports version `1.3.0` and boundary `SHIRE3D_ONLY` — PASS
- Local static application delivery — PASS
- OAuth status endpoint redacts App IDs and secrets — PASS
- Unconfigured OAuth start returns safely to Accounts instead of exposing a secret or crashing — PASS
- Headless Chromium deterministic render of Prepare and Accounts screens — PASS
- Prepare render showed 18/18 live products, no product selector and no product-mode control — PASS
- Accounts render showed all five official OAuth cards with no browser console errors — PASS

## Full-catalogue behaviour

- Prepare screen contains no product selector — PASS
- Prepare screen explicitly locks coverage to every marketable product — PASS
- `generateCampaign` ignores a caller attempting `productMode: single` or a single `productId` — PASS
- Every live product receives at least one post before repeats — PASS
- Post count expands when product count exceeds the chosen pace — PASS
- Less-promoted products rank before overexposed products — PASS
- Sold-out, paused, unavailable, discontinued and demo products are skipped — PASS
- Customer captions exclude the blocked internal engineering and approval phrases — PASS
- Private campaign direction is not pasted into customer captions — PASS
- YouTube Shorts is included in the supported platform rotation — PASS

## Approval and queue safety

- Existing campaign generation and approval safety — PASS
- Exact-version freezing — PASS
- Edit-after-approval invalidation — PASS
- Queue cancellation and reapproval — PASS
- Sandbox publication and duplicate prevention — PASS
- Kitchen Hero JSON import blocking — PASS

## Product autopilot

- Three default product sources due on a fresh workspace — PASS
- Website product creation — PASS
- Existing product update without duplication — PASS
- Equivalent direct-store and Etsy product grouping — PASS
- Direct-store source priority over Etsy — PASS
- Unknown source rejection — PASS
- Kitchen Hero-shaped website payload rejection — PASS
- JSON-LD product parsing — PASS
- Product-link parsing — PASS
- Parser deduplication — PASS

## OAuth bridge safety

- Five providers are declared: Facebook, Instagram, LinkedIn, TikTok and YouTube Shorts — PASS
- Provider status exposes no Client ID or client secret — PASS
- CSRF state tokens are generated and validated server-side — PASS
- OAuth state records expire — PASS
- TikTok Desktop PKCE verifier/challenge support — PASS
- OAuth tokens remain server-memory-only — PASS
- Disconnect removes the in-memory platform session — PASS
- Missing developer configuration returns a controlled setup message — PASS
- Server binds to localhost only — PASS

## Old-version protection

- Windows launcher checks `/api/health` for the exact expected version — PASS by source inspection
- Windows launcher stops an older listener before starting v1.3.0 — PASS by source inspection
- Sidebar visibly identifies `v1.3.0` — PASS
- Service worker uses a new cache name, `skipWaiting`, `clients.claim` and network-first loading — PASS by source inspection

## Known verification limits

The visual checks used the packaged CSS and JavaScript in an isolated browser fixture because the build environment blocks browser navigation to localhost. A complete external OAuth login cannot be performed in the build container because it would require Ray's private developer applications, secrets, account consent and—in some cases—platform review. The implementation was therefore tested for provider construction, callbacks, state/PKCE safeguards, redaction, local status, safe failure and token-storage boundaries.

Real posting API calls are intentionally absent from v1.3.0. Queue actions remain deterministic sandbox records so the artifact cannot accidentally publish while platform permissions are unfinished.
