docs: record v0.7.0 hosted verification

AGENTS.md

@@ -6,10 +6,9 @@ DRIFT is release intelligence for GPU and AI-infrastructure teams. It turns
 primary release notes into cited, confidence-labelled, engineer-ready
 answers: what changed, why it matters, and what to check next.
 
-**Current phase:** `v0.7.0` is the current source release; it hardens evidence
-byte integrity, makes human review notes database-only, and raises the frontend
-briefing limit to ten. Its Railway/Vercel deployment must be verified before it
-is described as the current hosted release. `v0.6.1` is the previously verified
+**Current phase:** `v0.7.0` is the current hosted Railway/Vercel release. It
+hardens evidence byte integrity, makes human review notes database-only, and
+raises the frontend briefing limit to ten. `v0.6.1` is the previously verified
 hosted Railway revision, and `v0.5.1` is historical pre-review-gate evidence. The new local
 guardrail work adds claim-level evidence, a separate verifier, and a human
 publication gate. `DRIFT_MODE=live`
@@ -179,9 +178,11 @@ the Vercel HTML referenced the canonical API-served banner pair. The Swagger
 banner frame follows the same light/dark preference as the canonical banners.
 Railway PostgreSQL is verified at migration `0003` through a public TCP proxy.
 Hosted `/search` and `/chat` were verified provider-backed the same day; this
-is a small, bounded reviewed set, not broad live-release analysis. Deploy and
-verify `v0.7.0` before claiming its review-note redaction or ten-item frontend
-view is hosted.
+is a small, bounded reviewed set, not broad live-release analysis. The
+Git-connected `v0.7.0` deployment was verified through `/health`, `/docs`,
+Vercel CORS, a four-record `/briefing` with no review notes, and the Vercel
+bundle's `top_n=10` request; `/search` and `/chat` were not re-invoked for this
+privacy/frontend-only release.
 
 [`notebooks/drift_manual_run.ipynb`](notebooks/drift_manual_run.ipynb) is the
 local operator path for bounded capture and manual publication. It requires a

CHANGELOG.md

@@ -12,6 +12,15 @@ the annotated `v0.1.0` tag.
 
 ## [0.7.0] - 2026-07-16
 
+### Hosted deployment verification — 2026-07-16
+
+- Verified the Git-connected Railway `v0.7.0` deployment in `DRIFT_MODE=live`:
+  `/health` reports `0.7.0`, `/docs` returns `200`, and a Vercel-origin CORS
+  preflight allows `GET, POST`.
+- Verified that `/briefing?top_n=10` returns the four reviewed Insights without
+  `human_review_notes`, and that `/openapi.json` does not expose that field.
+- Verified the deployed Vercel bundle requests `briefing?top_n=10`.
+
 ### Reviewed-evidence capture and hosted verification — 2026-07-16
 
 - Published four human-reviewed Insights through `publish_verified_insights`

README.md

@@ -255,7 +255,7 @@ the same system light/dark preference as the canonical banner.
 
 | | |
 | --- | --- |
-| **Current hosted API** | `v0.6.1` `live` — `/health`, `/briefing` (four reviewed Insights), `/search`, `/chat`, `/docs`, and Vercel-origin CORS verified provider-backed on 2026-07-16; `v0.7.0` deployment verification remains pending |
+| **Current hosted API** | `v0.7.0` `live` — `/health`, `/briefing` (four reviewed Insights with review notes redacted), `/docs`, and Vercel-origin CORS verified on 2026-07-16; deployed Vercel requests `top_n=10` |
 | **Hosted frontend source** | Vercel HTML references the canonical API-served light/dark banner pair; the browser post-fetch empty-state rendering is not separately recorded |
 | **API docs branding** | The Swagger banner frame and canonical banner pair follow the same system light/dark preference |
 | **Historical evidence** | `v0.5.1` `live` — one unreviewed vLLM Insight served through `/briefing` on 2026-07-15; retained as pre-gate evidence only |
@@ -300,10 +300,10 @@ The Next.js briefing view exposes each record's status label, confidence,
 model/audit label, rationale, bounded action, source links, and—when present—
 claim-type evidence. On 2026-07-16, the hosted UI was verified against the
 review-gated API; reviewed evidence has since been published, so `/briefing`
-now serves four reviewed Insights instead of the intentional empty state. The
-`v0.7.0` source adds review-note redaction and requests all ten available
-briefing items; Railway/Vercel deployment and visual verification are still
-required before those become hosted facts.
+now serves four reviewed Insights instead of the intentional empty state.
+`v0.7.0` deployed the review-note redaction and ten-item briefing request;
+Railway, CORS, public-contract, and Vercel-bundle checks are recorded in the
+changelog. This did not re-run paid provider chat.
 
 ---
 

SECURITY.md

@@ -7,16 +7,16 @@ development baseline while the live pipeline is being implemented.
 
 | Version | Supported |
 | --- | --- |
-| `0.7.0` | ✅ Current source release; deployment verification required before it replaces the hosted revision |
-| `0.6.1` | Previously verified hosted application; it served four human-reviewed Insights as of 2026-07-16 |
+| `0.7.0` | ✅ Current source and hosted application; public review notes are redacted and the frontend requests up to ten briefing records |
+| `0.6.1` | Previously verified hosted application |
 | `0.5.1` | Historical hosted baseline |
 
 Fixture data is synthetic. Local live ingestion and provider-backed generation
 are explicitly operator-enabled and review-gated; the hosted gate returned no
 live evidence until the first human-reviewed capture. As of 2026-07-16 it serves
 four human-reviewed Insights from an eight-source capture (six verifier-passed
-drafts). Version `0.7.0` keeps human review notes database-only; confirm the
-deployed API omits them before treating that redaction as a hosted fact.
+drafts). Version `0.7.0` keeps human review notes database-only; its deployed
+`/briefing` and `/openapi.json` boundaries were verified to omit them.
 
 ## Reporting a vulnerability
 

docs/ARCHITECTURE.md

@@ -329,9 +329,9 @@ with `/health`, `/docs`, and `/openapi.json` exposed publicly. As of
 2026-07-16, its `v0.6.1` live mode, `/docs`, provider-backed
 `/briefing`/`/search`/`/chat` over four reviewed Insights, and Vercel CORS
 configuration are verified. The Vercel HTML references the canonical API-served
-banner pair. The `v0.7.0` source release makes review notes database-only and
-raises the frontend briefing limit to ten; its hosted deployment requires its
-own verification record. See
+banner pair. The `v0.7.0` deployment makes review notes database-only and
+raises the frontend briefing limit to ten; its `/briefing`, `/openapi.json`,
+and Vercel bundle were verified after rollout. See
 [ADR-007](adr/007-vercel-railway-deployment.md).
 
 The browser can consume the hosted API from Vercel. On 2026-07-15, Vercel CORS

docs/BUILD_SEQUENCE.md

@@ -52,6 +52,9 @@ AI-infrastructure release intelligence.
 - [x] Codex: released `v0.6.1` frontend/documentation changes; Railway and
       Vercel source deployment were verified, including the API-docs
       system-theme-aware banner frame
+- [x] Operator: deployed `v0.7.0`; Railway `/health`/`/docs`, Vercel CORS,
+      review-note redaction in `/briefing` and `/openapi.json`, and the deployed
+      frontend's `top_n=10` request were verified
 - [x] No new model calls — the current UI remains presentation-only
 
 ## Day 8 — Final content + docs

docs/CODEX_PROMPTS.md

@@ -20,9 +20,9 @@ later prompts as DRIFT dependencies.
 > `/briefing`; its `0003` schema and hosted `v0.6.1` empty briefing were
 > verified on 2026-07-16; four human-reviewed Insights were then published and
 > hosted `/briefing`, `/search`, and `/chat` verified provider-backed.
-> The later `v0.7.0` source release hardens evidence-byte integrity, review-note
-> redaction, and the results-notebook boundary; deployment verification remains
-> a separate required fact.
+> The later `v0.7.0` release hardens evidence-byte integrity, review-note
+> redaction, and the results-notebook boundary; its Railway/Vercel deployment
+> was verified through the public health, contract, CORS, and frontend signals.
 
 ---
 

docs/INITIATIVES.md

@@ -316,6 +316,8 @@ The `v0.7.0` source release fixes the Windows evidence-manifest newline mismatch
 makes review notes database-only in the public API contract, requests up to ten
 reviewed briefing records in the frontend, and replaces the recorded notebook
 with a Markdown-only results artifact. It is covered by 149 tests at 100%
-backend coverage. Deployment verification is intentionally recorded separately:
-do not claim these source changes are hosted until `/health`, `/briefing`,
-`/openapi.json`, CORS, and the Vercel bundle have been checked.
+backend coverage. The Git-connected deployment was then verified through
+`/health` (`0.7.0`), `/docs`, Vercel CORS, a four-record `/briefing` without
+review notes, `/openapi.json` without the field, and the Vercel bundle's
+`top_n=10` request. Paid chat was not re-invoked for this privacy/frontend-only
+release.

docs/RUNBOOK.md

@@ -86,10 +86,10 @@ This path uses committed example data and makes no external calls.
    CORS checks. After four human-reviewed Insights were published that day,
    hosted `/briefing`, `/search`, and `/chat` were verified provider-backed over
    that reviewed set. The Vercel HTML references the canonical API-served banner
-   pair. The `v0.7.0` source release adds evidence-byte integrity, database-only
-   review notes, and a ten-item frontend request; verify its Railway/Vercel
-   deployment separately before describing those changes as hosted. Scheduled
-   population and a larger reviewed capture remain future work.
+   pair. The `v0.7.0` deployment adds evidence-byte integrity, database-only
+   review notes, and a ten-item frontend request; Railway `/health`/`/docs`,
+   CORS, public redaction, and the Vercel bundle were verified after rollout.
+   Scheduled population and a larger reviewed capture remain future work.
 
 ## Recording order
 

docs/adr/007-vercel-railway-deployment.md

@@ -84,6 +84,10 @@ capacity commitment.
 - As of 2026-07-15, `FRONTEND_ORIGIN=https://dr1ftless.vercel.app` is verified
   through a successful browser CORS preflight.
 - Vercel and Railway have separate logs, deploys, and usage limits to monitor.
+- **2026-07-16 v0.7.0 addendum:** the Git-connected Railway deployment reports
+  `0.7.0`; `/docs` and Vercel CORS remain available, `/briefing` returns four
+  reviewed Insights without `human_review_notes`, and `/openapi.json` omits
+  that private field. The production Vercel bundle requests `top_n=10`.
 - A future alternative may consolidate the frontend and API, but that would
   require a new ADR because it changes operational boundaries.
 

docs/adr/010-claim-evidence-and-review-gate.md

@@ -66,5 +66,5 @@ fail-closed briefing, branded docs/banner routes, and CORS were verified. The
 **2026-07-16 privacy addendum:** `v0.7.0` makes `human_review_notes`
 database-only in the serialized Insight contract and prevents the live-store
 reader from copying them into public records. It also tests the public API and
-OpenAPI boundary. This source change must be deployed and verified before it is
-represented as a hosted mitigation.
+OpenAPI boundary. The Git-connected `v0.7.0` deployment was verified to omit
+the field from `/briefing` and `/openapi.json`.

docs/adr/README.md

@@ -12,7 +12,7 @@ decisions compose.
 | [004](004-local-budget-guard.md) | Local hard budget for live iteration | Accepted |
 | [005](005-postgres-pgvector-live-store.md) | PostgreSQL + pgvector for the live store | Accepted; Railway schema verified; four human-reviewed Insights published 2026-07-16 with hosted `/briefing`/`/search`/`/chat` verified provider-backed |
 | [006](006-ci-quality-gates.md) | CI quality gates and coverage ratchet | Accepted |
-| [007](007-vercel-railway-deployment.md) | Vercel frontend + Railway API and database | Accepted; hosted `v0.6.1` health/docs/CORS and Vercel canonical-banner source verified; reviewed `/briefing`/`/search`/`/chat` verified provider-backed 2026-07-16 |
+| [007](007-vercel-railway-deployment.md) | Vercel frontend + Railway API and database | Accepted; hosted `v0.7.0` health/docs/CORS, review-note redaction, and Vercel `top_n=10` bundle verified; reviewed `/briefing`/`/search`/`/chat` were provider-backed verified on 2026-07-16 |
 | [008](008-live-grounded-chat.md) | Live grounded chat over the fixture store | Accepted |
 | [009](009-bounded-model-resilience-and-locked-delivery.md) | Bounded model resilience and locked delivery | Accepted |
 | [010](010-claim-evidence-and-review-gate.md) | Claim-level evidence, separate verification, and review-first publication | Accepted locally and deployed; four human-reviewed Insights published 2026-07-16 with hosted retrieval/chat verified provider-backed |

submission/NEXT_STEPS.md

@@ -5,12 +5,13 @@
 release and submission work only; do P2 polish by hand where possible.
 **OpenAI API budget (separate from Codex credits):** capture runs and hosted smoke tests draw on the `drift` project key, bounded by `DRIFT_MAX_SPEND_USD=10`. That is enough for several capture runs; do not raise the cap.
 
-Audit verdict: `v0.7.0` source is locally verified (149 tests and 100% backend
+Audit verdict: hosted `v0.7.0` is verified (149 tests and 100% backend
 coverage), including evidence-byte integrity, public review-note redaction, and
-the ten-item frontend request. The currently verified hosted revision remains
-`v0.6.1`; deploy and verify `v0.7.0` before making hosted claims for those
-changes. The reviewed-output blocker is otherwise cleared by the four published
-Insights; the demo video remains the final submission blocker.
+the ten-item frontend request. Railway `/health`/`/docs`, Vercel CORS,
+`/briefing` (four records with no review notes), `/openapi.json` (no review-note
+field), and the deployed Vercel bundle were checked on 2026-07-16. The
+reviewed-output blocker is cleared; the demo video remains the final submission
+blocker.
 
 ---
 
@@ -40,9 +41,9 @@ Insights; the demo video remains the final submission blocker.
 - [x] `frontend/app/page.tsx`: separate **loading**, **empty**, and **error**
       states; local `v0.6.1` also renders canonical light/dark API-served
       banners without frontend SVG copies.
-- [ ] Deploy `v0.7.0` to Railway and Vercel, then verify `/health` reports
-      `0.7.0`, `/briefing` and `/openapi.json` omit `human_review_notes`, CORS
-      still allows Vercel, and the deployed frontend requests `top_n=10`.
+- [x] Deployed `v0.7.0` to Railway and Vercel; `/health` reports `0.7.0`,
+      `/briefing` and `/openapi.json` omit `human_review_notes`, CORS allows
+      Vercel, and the deployed frontend requests `top_n=10`.
 
 ### 3. Record and publish the demo video  *(≤ 3 min, public YouTube, English voiceover)*
 - [ ] Follow `submission/DEMO_SCRIPT.md`, updated for the now-populated hosted app:

submission/SUBMISSION.md

@@ -31,9 +31,9 @@
       via `gpt-5.6-terra` with source citations). Evidence + SHA-256 manifest
       archived to `assets/evidence/2026-07-16-all-sources-reviewed.json`.
 - [x] Provide a judge path: hosted app is available at
-      `https://dr1ftless.vercel.app` with a verified `v0.6.1` Railway API;
-      reviewed live evidence remains an explicit operator gate. Verify the
-      `v0.7.0` release deployment/redaction before updating this hosted version.
+      `https://dr1ftless.vercel.app` with a verified `v0.7.0` Railway API;
+      reviewed live evidence remains an explicit operator gate. Its public
+      `/briefing` and OpenAPI contract omit private human review notes.
 - [ ] Upload a public YouTube video under three minutes with English narration.
 - [ ] Replace the placeholder with the final video URL:
       `https://youtu.be/TBD` (see [`DEMO_SCRIPT.md`](DEMO_SCRIPT.md)).