# Enterprise Pilot validation - 2026-10-30

Release 0.3.0-pilot.2. Windows x64 build host; Node 24.16.0 and Electron 45.1.0. No real API keys, account tokens, server master keys or user workspace data are included in the delivery.

Branding release 0.3.0-pilot.2: the full 55-test suite, TypeScript checks, compiled server smoke and Windows installer build were repeated after the name/icon changes. The historical TLS check below is identified separately. Native upgrade behavior has not been verified.

## Automated checks

- 55 automated tests passed with zero failures/skips; strict TypeScript checking passed.
- Existing 38 Beta checks cover role/effort settings, graph scheduling, parallelism, conditions/joins, retries, cancellation, approvals, saved state, restart recovery, providers, Codex protocol fixtures and React DOM interactions.
- Pilot checks cover token hashes, encrypted/redacted provider keys, server-side permission enforcement, separate-person version/output reviews, immutable versions, stale-edit conflicts, idempotent submissions, queue persistence, quotas across retries, output ceilings, member revocation/rotation, last-admin protection, provider policies and audit tamper/tail-deletion detection.
- Edge cases include terminal branches being skipped and members being demoted to Viewer after creating previews.
- HTTP tests exercise authentication, forbidden role actions, browser-origin rejection, content types and body limits. Desktop client tests verify session-only token handling, HTTPS requirements and redirect rejection.
- A React DOM test submits a team version and executes/approves its preview through the actual service/database. UI tests use jsdom; they do not validate native window rendering.

## Standalone service checks

The compiled server passed a separate process-level smoke check: bootstrap configuration and overwrite protection, health/token authentication, member creation, version submission, queued preview execution, approval, persisted history after restart, offline administrator recovery, old-token invalidation and audit verification. It used temporary data and zero model calls.

In the preceding 0.3.0-pilot.1 release, HTTPS was exercised against the compiled service with a temporary generated localhost certificate. A client trusting that test CA succeeded, and an untrusted client was rejected. Certificate verification was not disabled. This checks the TLS serving path; it does not validate an organization's certificate provisioning or renewal.

## Remaining verification gaps

The native Electron GUI smoke test is blocked before app initialization by this host's Windows sandbox/runtime access check. Installation, native rendering/dialogs, OS credential encryption roundtrip and graphical upgrade behavior remain unverified on an ordinary Windows user session. No sandbox-disabling flags were used.

Real provider inference, live Codex file editing and browser sign-in were not exercised. The installed Codex handshake succeeded during Alpha verification but reported no signed-in account in that launched process. Pilot tests retain mocked Codex protocol coverage; shared server execution intentionally excludes Codex.

Mac builds, Keychain behavior, signing/notarization, GitHub Actions and Docker deployment have not been run. The container files are deployment examples. No load, penetration, disaster-recovery exercise or independent security assessment was performed. The service is one workspace and one worker; it is not a multi-tenant enterprise platform.

The Windows NSIS installer and ZIP archives are checked during packaging; SHA-256 checksums accompany the delivery. Packaging success does not establish successful native launch.

## Reproduce

From full source:

```sh
npm ci
npm run typecheck
npm test
npm run pilot:smoke
npm run smoke
```

The standalone server ZIP needs only Node 24 or later and can run `npm run pilot:smoke` without installing dependencies. That check creates/deletes isolated temporary data, starts a loopback service, and never calls a model.

The desktop smoke command launches a hidden native window with isolated data under .smoke-data/. Missing reports/nonzero exits are failures. See ENTERPRISE-PILOT.md for operational acceptance and deployment limits.