# T65 Complete Cross-Backend Delivery Journey Validation

> - Task: T65 — Prove complete cross-backend execution and idempotency journey - Requirements: VES-BST-001…005, VES-HOF-001…006, VES-VFY-001…006, and VES-INT-001…005 - Commit target: test(e2e): prove cross backend delivery journey - Focused evidence: 14 packaged E2E, fault-injection, and security journey variants - Required minimum: 12 variants - Spec deviations: none

Source: https://github.com/accd/verchestra/blob/main/docs/qualification/t65-validation.md
Content digest: `sha256:953dea540898163d82bb86cff69f5a9a90eeef48cf4a729460d3c9b1bfafe909`

## Scope

- Task: T65 — Prove complete cross-backend execution and idempotency journey
- Requirements: VES-BST-001…005, VES-HOF-001…006, VES-VFY-001…006, and VES-INT-001…005
- Commit target: `test(e2e): prove cross backend delivery journey`
- Focused evidence: 14 packaged E2E, fault-injection, and security journey variants
- Required minimum: 12 variants
- Spec deviations: none

T65 adds no second orchestration runtime. Its packaged fixture composes the already-qualified application, evidence, Effect, Connector, execution, verification, and machine-bootstrap boundaries and carries their real content identities through one journey: Claude/Codex local bootstrap; Grill/TLC discovery evidence; signed backend-neutral Execution Package; remote Handoff; Jira and Confluence projections; OpenCode/Qwen-only receiver bootstrap; fresh local Approval; claim; isolated task; gate and atomic commit; independent verification; and authenticated Human Review.

The fixture uses the production builders and coordinators with bounded mock transports/ports. It deliberately keeps machine profiles outside the shared artifact set and computes the shared-state digest over the full signed package, portable Handoff, Jira record, Confluence page section, and gate result rather than over placeholder labels.

## Deterministic gates

| Command | Result |
| --- | --- |
| `node --test tests/e2e/cross-backend-delivery-journey.test.mjs tests/fault-injection/cross-backend-journey-faults.test.mjs tests/security/cross-backend-journey-security.test.mjs` | PASS — 14 passed, 0 failed/skipped |
| `pnpm lint` | PASS |
| `pnpm typecheck` | PASS |
| `pnpm gate:security` | PASS — format, lint, typecheck/build, unit/property, contract, integration, E2E, architecture, qualification, security, and 176 fault cases |

## Spec-anchored adequacy matrix

| Requirements / done-when criterion | Exact assertion evidence | Spec-defined outcome | Result |
| --- | --- | --- | --- |
| Complete Claude → OpenCode/Qwen journey | `tests/e2e/cross-backend-delivery-journey.test.mjs:6-16` | Package, Handoff, receiver execution, commit, verification, Human Review, and completion form one successful chain | PASS |
| Grill/TLC package under Claude | `tests/e2e/cross-backend-delivery-journey.test.mjs:18-28` | Both skill evidence records are sealed while Claude is a qualified local source Driver | PASS |
| VES-HOF-003/004 semantic portability | `tests/e2e/cross-backend-delivery-journey.test.mjs:30-35` | Semantic obligations and first pending work remain identical after backend/model change | PASS |
| VES-INT-001/002 exact projections | `tests/e2e/cross-backend-delivery-journey.test.mjs:37-44` | Jira and Confluence reference the exact signed package and Handoff digests | PASS |
| VES-BST-004 / VES-HOF-005 idempotency | `tests/e2e/cross-backend-delivery-journey.test.mjs:46-65`; `tests/e2e/cross-backend-delivery-journey.test.mjs:75-83` | Repeated bootstrap, package/Handoff operations, projections, claim, Capsule, commit, report, and review remain singular | PASS |
| VES-HOF-001/002 fresh receiver authority | `tests/e2e/cross-backend-delivery-journey.test.mjs:67-73` | Source Approval is absent and a new receiver-local Execution Approval is required | PASS |
| VES-INT-005 unknown Connector outcomes | `tests/fault-injection/cross-backend-journey-faults.test.mjs:6-20` | Jira and Confluence create acknowledgement loss reconcile to one remote object with no blind duplicate | PASS |
| VES-VFY-001/002 task/gate/commit recovery | `tests/fault-injection/cross-backend-journey-faults.test.mjs:22-29` | A resumed task produces one Tool request and one gated atomic commit | PASS |
| VES-BST-001/002 local/shared separation | `tests/security/cross-backend-journey-security.test.mjs:6-12`; `tests/security/cross-backend-journey-security.test.mjs:22-32` | Backend/session/transcript/profile/credential material is absent from portable and shared artifacts; local profile changes do not change shared digest | PASS |
| VES-VFY-003/004/006 independent verification and Human Review | `tests/security/cross-backend-journey-security.test.mjs:14-20` | Verifier differs from author; PASS stops at Human Review; only a human review completes | PASS |

## Independent discrimination sensor

The standalone TLC Verifier copied the complete uncommitted T65 diff into a detached disposable worktree, installed the locked graph offline, committed an isolated verifier baseline, injected one journey-level behavior fault at a time, restored after every run, reran all 14 focused variants, and removed the scratch tree. The active implementation worktree was never mutated.

| Mutation | Behavior fault | Result |
| --- | --- | --- |
| M1 | Replace the OpenCode/Qwen receiver profile with Claude | KILLED |
| M2 | Remove TLC evidence from the signed package | KILLED |
| M3 | Change semantic obligations at Handoff package verification | KILLED |
| M4 | Ignore the requested Jira acknowledgement-loss injection | KILLED |
| M5 | Insert the receiver machine profile into shared artifacts | KILLED |

Sensor depth is P0/full manual behavior mutation: 5/5 killed, 0 survived. Standalone independent validation was used because agent delegation is prohibited in this environment.

## Non-shallow checks

- The journey builds and verifies a real Ed25519-sealed Execution Package; it does not substitute a fixture digest for package construction.
- Grill and TLC appear as content-addressed discovery evidence, while source and receiver model identities stay machine-local.
- Portable Handoff preparation consumes the exact package and source-state digests and independently validates semantic obligations.
- Jira and Confluence use their production plan builders, Effect intents, adapters, brokers, receipts, and reconciliation paths.
- OpenCode/Qwen bootstrap uses a qualified local Passport and may degrade role independence without altering portable artifacts.
- Acceptance discards source Approval, rebinds local Passports/secrets/integrations, reevaluates policy, and acquires a new claim before continuation.
- Task execution resumes from a durable checkpoint inside one authorized worktree and emits one mediated Tool request.
- Gate evidence covers the task requirements and leads to one atomic commit, cleanup, and writer release.
- Verification uses a distinct actor, independently derived evidence/mutations, and stops at Human Review before human completion.
- Repeated stable operations and acknowledgement-loss recovery preserve one observable effect at every externally visible surface.
- Shared-state identity covers full artifact content before and after local profile repetition; local profiles are separate objects and are never serialized into shared artifacts.

## Verdict

PASS for T65. The complete delivery chain preserves signed semantic obligations across Claude and OpenCode/Qwen environments, keeps backend and credential state local, publishes exact Jira/Confluence views without making them canonical, creates one gated commit, requires independent verification and Human Review, and converges to one observable logical effect under retries and Connector acknowledgement loss.