# Qurmmius external-validation packet

**Prepared:** 2026-09-12 (America/New_York)  
**Scope:** internal evidence capture and reviewer handoff; pilot invitations remain paused.

This packet records checks that can be run safely inside the Qurmmius workspace.
It does **not** certify legal compliance, accessibility conformance, financial
accuracy, vendor approval, medical/safety performance, or production readiness.

## Evidence completed

- Production smoke suite: all configured routes and APIs returned HTTP 200.
- Production policy assertions: provider activation and pilot onboarding remain
  deferred; ClearGrant financial snapshot remains `missing`; GridPulse and
  SkySprout provider traffic remain disabled.
- Security headers: HSTS, frame denial, content-type sniffing protection, and
  the restricted permissions policy were present.
- Internal link scan: 55 internal references checked, 0 broken.
- JavaScript syntax scan: 60 files checked, 0 failures.
- Local golden evaluation: 260/260 metadata-only cases passed.
- Accessibility baseline: 27 HTML pages scanned for image alt text, empty links,
  and unlabeled controls; 0 findings. This is an automated baseline, not a WCAG
  conformance audit.
- Webhook safety: invalid Stripe signature rejected with HTTP 400.
- Authorization safety: unauthenticated QI product-pilot, checkout, provider
  fetch, and RepairTrail backup requests each rejected with HTTP 401.
- Billing safety: test checkout remains inert/disabled; no customer payment was
  created during verification.
- Recovery safety: unauthenticated RepairTrail backup rehearsal rejected with
  HTTP 401; the cloud rehearsal uses synthetic data and deletes its fixture.

## QI hardening state

The live health contract reports signed workspace authentication, tenant
isolation, durable metadata audit, request IDs, rate limits, and usage metadata
enabled. Two-person execution for provider enablement and customer-data access
remains disabled. Live QI checkout is restricted to authorized signed
workspaces and requires policy acknowledgement.

## Recovery rehearsal handoff

RepairTrail reports `synthetic_backup_rehearsal: true`, `cloud_progress: true`,
and `auth_required_for_cloud: true`. A signed workspace owner must run the
authenticated rehearsal and retain its request ID and result. No real passport,
receipt, private note, credential, or customer record may be used.

## Legal and privacy review handoff

The public Privacy Notice, QI Terms, and Refund Policy are live and internally
consistent with the current gated billing state. The wording expressly keeps
non-waivable rights, tax obligations, and signed enterprise agreements intact.
Independent counsel must still review jurisdictional privacy, consumer,
payments, tax, data-processing, and product-specific obligations before any
production claim.

## Accessibility review handoff

The automated baseline passed. An independent reviewer still needs to test
keyboard-only navigation, focus order, screen-reader labels, contrast, reduced
motion, responsive layouts, WebXR fallback behavior, and audio/caption paths
against the target WCAG level on supported browsers and devices.

## Vendor, runtime, and hardware review handoff

The Apex compatibility matrix, console setup guide, and Universal Connectivity
Bridge scope are published. Approval is still required from the relevant wheel,
game, console, SDK, and runtime vendors. Product testing must use real target
hardware and record firmware, OS, game version, adapter version, telemetry
fields, latency, failure behavior, and rollback results. No console memory
access, anti-cheat bypass, MAC-address identification, or silent capture is
authorized.

## Required independent sign-offs

| Gate | Reviewer | Status |
| --- | --- | --- |
| Financial owner attestation | Owner | **Not submitted** |
| Legal/privacy review | Qualified counsel | **Pending** |
| WCAG/accessibility review | Independent accessibility reviewer | **Pending** |
| Disaster-recovery restore rehearsal | Recovery reviewer | **Authenticated run pending** |
| Vendor SDK/runtime approval | Each vendor or license holder | **Pending** |
| Product hardware acceptance | Test owner with target devices | **Pending** |

Until these rows are completed, provider traffic, production claims, and pilot
invitation sends remain disabled by policy.

## Latest readiness recheck

Rechecked 2026-09-12 America/New_York:

- QI authentication required: `true`.
- Durable audit ready: `true`.
- Provider activation: `deferred`.
- Pilot onboarding: `deferred`.
- Production claims: `false`.
- ClearGrant financial snapshot: `missing`.
- GridPulse provider traffic: `false`.
- SkySprout provider traffic: `false`.
- Unauthenticated RepairTrail backup request: correctly rejected with HTTP 401.
- QI session validation: unauthenticated `GET /api/qi-session` returns HTTP 401;
  issued sessions validate successfully, and stale browser tokens are cleared
  before a RepairTrail return redirect.

The authenticated recovery rehearsal and all external review gates remain
pending; no result is being inferred from the unauthenticated check.

## Internal completion pass — 2026-09-13

The follow-up packet at [INTERNAL-ACCEPTANCE-20260913.md](INTERNAL-ACCEPTANCE-20260913.md)
adds product acceptance checklists, privacy/data-path inventory, alerting and
support runbooks, and repeatable scripts. `npm run rehearsal:recovery` passed
request `c654f819-5e98-4754-923f-ac31d45c3186` using synthetic data only.
`npm run acceptance:internal` passed request `c77fcf7e-045c-4458-b1fb-d12c0aeca37f`
against `https://qurmmius.com`. These are internal static/synthetic checks;
they do not replace the independent WCAG, legal, vendor, hardware, or
authenticated production recovery gates listed above.