Skip to content

docs(evidence): fresh deploy lag — merged PR #43 AI-search evidence is on main but not live (past 5864e39) #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nish3451 merged 2 commits into from
Aug 12, 2026
Merged

docs(evidence): fresh deploy lag — merged PR #43 AI-search evidence is on main but not live (past 5864e39) #153

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f2cdd30
docs(evidence): record fresh PR #43 deploy lag past 5864e39 — live /a…
nish3451 Aug 12, 2026
d245aad
Merge branch 'main' into lane1/self-directed-20260812
nish3451 Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
118 changes: 118 additions & 0 deletions docs/evidence/ai-search-evidence-lag-2026-08-12.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,118 @@
# PR #43 AI-search evidence on /audit — fresh deploy lag past 5864e39

Date: 2026-08-12
Scope: fresh live-delivery finding in the same class as the closed
`676/703/716/742/934/953/994` ship items. Merged PR #43
(`fix/ai-search-rerun-entity-offer`, "evidence(ai-search): re-run the
controlled entity-and-offer questions after the llms/offer mirror went live")
is on origin/main but is **not** live: the deployed site still embeds the
2026-08-06 evidence artifact whose q5 ground truth teaches the retired
self-serve Agent Desk as what tinystudio.io is. This receipt records the gap
against the current origin/main head and the deployed site, names the
deployment blocker, and gives the release pipeline a receipt to act on when
credentials are restored. It is behavior evidence, not a source check, and it
does not claim anything about ranking, traffic, or search results.

## What was measured

Merged PR #43 carries two commits that rewrite the AI-search evidence the
`/audit` page embeds in `public/audit.html`:

- `8606b0c` — "evidence(ai-search): re-run the controlled entity-and-offer
questions after the llms/offer mirror went live" (2026-08-12T08:17:32+05:30):
the embedded artifact advances from `testedOn: 2026-08-06` to
`testedOn: 2026-08-09` with nine fresh captured runs.
- `ed62202` — "fix(evidence): align AI-search q5 ground truth with the current
offer, not the retired Agent Desk" (2026-08-12T08:19:45+05:30): q5's truth
changes from "the leak audit, plus the Agent Desk behind it" (retired
product) to "the free leak audit of high-ticket service homepages, and the
human-reviewed desk that closes what the audit finds" (current offer).

The gap's acceptance criteria (this class's pattern, from the prior ship
items):

- fleet-release (or equivalent `wrangler deploy`) ships `origin/main` ≥ `ad9cee3`;
- live `/audit` embedded artifact matches source (`testedOn: 2026-08-09`, q5
truth naming the human-reviewed desk);
- `release-state-tinystudio-io.json` sha advances past `5864e39`;
- `npm run check` on the shipped revision.

## Environment

- Live target: `https://tinystudio.io/audit`, served by the deployed
Cloudflare Worker's ASSETS binding (`src/worker.js` serves the static
`public/audit.html` verbatim).
- Release state: `/home/nish/workspaces/agent-state/lanes/release-state-tinystudio-io.json`
(fleet-release's last-successful-release record).
- Source baseline: `origin/main` at `ad9cee3` ("Merge pull request #43",
2026-08-12T08:24:14+05:30), fetched fresh via `git fetch origin`; live bytes
were fetched over HTTPS and compared against `public/audit.html` on that
head.

## Results (2026-08-12)

1. Main carries the fix and the pinned release does not:
`git merge-base --is-ancestor 8606b0c origin/main` and
`git merge-base --is-ancestor ed62202 origin/main` both confirm PR #43's
commits are ancestors of the origin/main head `ad9cee3`. The only commits
in `5864e39..origin/main` touching `public/` or `src/` are exactly those
two. `release-state-tinystudio-io.json` pins
`sha 5864e39274c830440ebc3dbd0a26f03865c8961d` (2026-08-12T06:37:42) —
deployed ~1h47m **before** PR #43 merged (08:24:14+05:30).
Comment on lines +60 to +61

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Add the timezone to the release timestamp.

2026-08-12T06:37:42 has no timezone, while the merge timestamp uses +05:30. The stated ~1h47m interval is not reproducible until both timestamps use the same timezone.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/evidence/ai-search-evidence-lag-2026-08-12.md` around lines 60 - 61,
Update the release timestamp in the evidence entry for sha
5864e39274c830440ebc3dbd0a26f03865c8961d to include its timezone offset, using
the same timezone basis as the PR `#43` merge timestamp so the stated interval is
reproducible.


2. Live `/audit` is byte-identical to the pinned release and still teaches
the retired Agent Desk:

| Check | Result |
|---|---|
| md5 of live `https://tinystudio.io/audit` | `4018721f9f657c1400a5b38048e9a7c3` |
| md5 of `public/audit.html` at `5864e39` | `4018721f9f657c1400a5b38048e9a7c3` (identical) |
| md5 of `public/audit.html` at `origin/main` (`ad9cee3`) | `72116e4a6daa6a26280b647e8ad171be` |
Comment on lines +63 to +70

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Use reproducible, collision-resistant artifact comparisons.

The receipt uses MD5 to support “byte-identical” claims. MD5 is not collision-resistant. The other listed pages also have no recorded digest or direct comparison result. Use SHA-256 or record direct byte-comparison output for every URL/source pair.

Also applies to: 78-83

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/evidence/ai-search-evidence-lag-2026-08-12.md` around lines 63 - 70,
Update the evidence section’s artifact comparison table to replace MD5 hashes
with SHA-256 digests, or record reproducible direct byte-comparison output for
each URL/source pair. Add comparison results for every listed page, including
the additional entries referenced by the review, while preserving the
pinned-release and origin/main comparisons.

| embedded `testedOn` live | `2026-08-06` |
| embedded q5 truth live | `tinystudio.io is TinyStudio's own site: the leak audit, plus the Agent Desk behind it.` |
| embedded `testedOn` on `origin/main` | `2026-08-09` |
| embedded q5 truth on `origin/main` | `tinystudio.io is TinyStudio's own site: the free leak audit of high-ticket service homepages, and the human-reviewed desk that closes what the audit finds.` |

The live page therefore still presents the retired self-serve Agent Desk
as part of the current offer — the exact parity failure merged PR #43
fixes in source — while live `llms.txt` and `offer.md` (verified
byte-identical to origin/main this run) already teach the human-reviewed
desk. Live `/audit` is the only public page that differs from origin/main:
`/`, `/agents`, `/pricing`, `/specimen`, `/brief-requested`,
`/agent-desk`, `llms.txt`, and `offer.md` all match their `public/`
sources byte-for-byte (fresh HTTPS fetches, 2026-08-12).

3. No open PR carries this ship. Open ship-verify PRs #140 (past `b004c11`,
structured data) and the merged #141 (past `fa8d83c`, App Store citation)
cover older SHAs; #139 covers the `#28/#30` fleet-release item at
`18128e8`; #146 closes the PR #42+#43 serial-merge review item (both
merged) without verifying live deployment of #43's content. Nothing open
mentions `5864e39` or `ad9cee3`.
Comment on lines +85 to +90

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Separate the open and merged PR statuses.

“Open ship-verify PRs #140 ... and the merged #141” is ambiguous and can make PR #141 appear open. Use “Open ship-verify PR #140 ...; merged PR #141 ...” instead.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/evidence/ai-search-evidence-lag-2026-08-12.md` around lines 85 - 90,
Revise the status sentence in the evidence document to clearly separate the
statuses: identify `#140` as the open ship-verify PR, then separately identify
`#141` as merged, while preserving the existing SHA and citation details.


4. Source checks on the to-be-shipped revision: `npm run check` passes
("TinyStudio.io checks passed.") on a clean checkout of origin/main
`ad9cee3`; the full `npm test` suite passes — headings 6/6, sitemap 7/7,
worker 55, ui 16, contract 8 (92 tests, 0 failures). The browser walk
(desktop 1280x900 + mobile 390x844, all seven pages) shows no overflow and
no console errors beyond the known `/brief-requested` placeholder-gtag CSP
violation owned by PR #136.

## Deployment blocker (Nish-reserved)

The gap cannot be closed from a worker lane: the fleet release pipeline is
blocked on an expired Cloudflare credential. `fleet-release.log` records
`2026-08-12T08:54:07 NOTIFY: tinystudio-io: CANNOT RELEASE: wrangler is not
authenticated (login expired?) - run wrangler login or set
CLOUDFLARE_API_TOKEN where this timer runs; nothing can deploy until then`,
and the local `wrangler whoami` confirms `You are not authenticated`.
Restoring the wrangler login / `CLOUDFLARE_API_TOKEN` (Nish-reserved) is the
only remaining action; the next fleet-release tick then ships `origin/main`
≥ `ad9cee3` automatically and this item's acceptance becomes verifiable
live.

## Closeout status

Open — acceptance not yet met against the live site (live `/audit` still
serves the 2026-08-06 artifact). The receipt above pins the exact gap so the
item can be re-verified the moment the credential is restored. No product
code change is proposed: the fix is merged and merely undelivered.
Loading