# DOTFLY / Sureka Store / YR — integration acceptance

Audit date: 28 October 2026. **Overall: PARTIAL.** Source compatibility is demonstrated for the existing Store→YR TEST ticket contract. Production end-to-end operation and new DOTFLY product-data interconnection are not accepted.

## Freeze and baseline
- DOTFLY baseline: 40 tests passed; 9 database-writing tests intentionally skipped. File SHA-256 baselines recorded before new acceptance tests for 135 DOTFLY, 305 Store and 184 YR source/assets/config files (no environment files or credentials).
- Read-only snapshots: Store `5e1b6429`; YR `efda211c`. A snapshot is not a deployed-version assertion.
- No auth identities provisioned, private records read, database/schema changed, ticket submitted, points awarded, wallet operation invoked, order executed, secret rotated, callback changed, QR redirected or application published.
- Existing DOTFLY UI, PRV1 engine, APIs, database and discovery-disabled gate are unchanged. Only acceptance tests and documentation added. External source/assets remain unchanged.

## Exact three-system integration matrix

| System / interface | Contract / identifiers | Authentication / signature | Owner and acceptance |
|---|---|---|---|
| Store `GET /dotfly/sku/$id` | SKU or slug fallback; 301 to `/dotfly/$slug`. EASIS `7800718` → `easis-soft-bar-caramel-milk-chocolate` | Public navigation | Store owns existing QR destination. PASS: source; HTTP 301 observed. Not a JSON API. |
| Store `GET /dotfly/$slug` | Rendered `buildDotflyProfile`; A Little Bit/More/Fun. Internal `Product` has slug, optional SKU and ingredient references | Public page | Store owns consumer product understanding. Source exists; not an authorized/versioned product-data API. |
| Store ingredient routes `/ingredient/$slug`, `/ingredient-solutions/...`, `/ingredient-solutions.sugar-replacement/$sku` | Library slugs, declaration wording, reference name/URL | Public pages | Store owns product/library records. No stable public ingredient JSON contract found. |
| Store `submitDiscoveryAnswer` | TanStack POST RPC `{slug, optionId}`; quiz `dotfly-quiz-v1`; server answer key; may return signed handoff URL | Public RPC with schema validation and client-hash limits; server signing secret | Store owns Little Discovery and ticket issuance. Source PASS; not called under freeze. Not a raw REST URL. |
| Store `GET /api/public/dotfly/jwks.json` | `{keys:[public JWK]}`; OKP/Ed25519, `kid`, `alg:EdDSA`, `use:sig`; public cache 300s | Public verification key; never signing authority | Source PASS; public HTTP 200, JSON with one key observed. Does not prove private signing configuration or YR consumption. |
| Store→YR `/yrpoints/claim#ticket=<JWS>` | Three-part compact JWS. `iss:sureka.store`, `aud:yourradiant.se`, `sub:dotfly-discovery`, `typ:dotfly-discovery+jwt`; `sku,slug,quiz_version,jti,iat,nbf,exp,correct:true,points:2,env:test|live` | Store Ed25519 signature. Issuer TTL 900s; receiver maximum 1800s, leeway 30s | Existing signed integration on BOTH sides. PASS: real source signer→real source verifier in isolated memory. No claim URL constructed for a real user or submitted. |
| YR `GET /yrpoints/claim`; `claimDotflyDiscovery` | Browser takes fragment, stashes ticket for sign-in; POST RPC `{token}` max 4096; verified fields passed to `yr_discovery_claim` | YR user session required; fixed Store production/preview JWKS; preview keys cannot authorize live | YR owns receipt and authenticated claim. Public page HTTP 200 observed without ticket. Production credit unverified. |
| YR SQL `yr_discovery_claim(uuid,text,text,text,text,text,timestamptz)` | Authenticated user, SKU/slug/quiz allowlist, JTI, mode, expiry. `7800718` maps to `prd_easis_7800718` | EXECUTE service-role only; user ID from verified server context; per-account lock and unique JTI | YR owns single-use and credits. Test claims use separate table; live branch writes ledger. Source only: applied migration/grants/live eligibility unverified. Not called. |
| YR Points RPCs `getPoints` → `yr_points_state`; `claimPoints` → `yr_points_claim`; legacy `claimDiscovery` → `yr_points_discover` | YR account wallet and canonical product/reward IDs | Authenticated YR session; SQL account scope | YR owns Points ledger. No cross-system public wallet REST endpoint evidenced. No account/wallet read performed. Legacy answer-based `yr_points_discover` is disabled by migration 0010; never revive it. |
| YR Moment RPCs `yr_wallet_access`, `yr_wallet_my`, `yr_wallet_review(text)` | Separate TEST Moment entitlement balances and tokens, not Points. Review read-only; `/wallet` redirects to `/fika-card` | Authenticated session; tester/admin for wallet; verified test staff for review | YR owns TEST wallets. Source permissions inspected; not deployed-permission acceptance. |
| YR `yr_wallet_test_purchase`, `yr_wallet_new_token`, `yr_wallet_redeem`; active `fika_test_*` RPCs | Simulated packages, short-lived single-use tokens; redemption decrements entitlement/card visits | Tester/admin or verified test partner staff; RPC checks and locks | Mutating, prohibited here even in TEST. No evidence that TEST wallet equates to Points-funded commercial Moment redemption. |
| DOTFLY `GET /api/public/v1/openapi.json` | Static MVP OpenAPI paths | Public | DOTFLY owns independent API docs. Source PASS; incomplete response schemas/server-RPC documentation. |
| DOTFLY `GET /api/public/v1/products/{slug}` | Latest active immutable publication: slug, version, rules_version, published_at, engine output | Public; slug validation | DOTFLY owns its publications and PRV1 versions. Not the Store catalogue. No existing SKU→tenant/product UUID mapping proven. |
| DOTFLY `GET /api/public/v1/tenant/products` | Tenant UUID product IDs, slug, name, category, status, demo flag | `Authorization: Bearer dfk_test_…/dfk_live_…`; hashed key, revoked check and tenant scope | Independent tenant API. **GET has writes** to rate-limit state and key last-used timestamp: deliberately not called with a valid key under freeze. |
| DOTFLY `POST /api/public/v1/claims/redeem` | `{token}`; two-part HMAC-SHA256 claim, issuer `dotfly`, partner-slug audience, `tid,pid` UUIDs, 300s TTL | Partner bearer `dfp_test_…/dfp_live_…`; hash lookup; HMAC, audience, tenant/environment and `redeem_claim` | Existing legacy DOTFLY functionality preserved. BLOCKED for Store→YR interoperability: wrong protocol and identity. No forwarding or translation. |
| DOTFLY `getPublicPage`, `recordEngagement`, `submitQuiz`; professional supply RPCs | Own publication/tenant data; own legacy quiz/claim and request-only supply | Public RPC validation; protected professional functions use user middleware, membership/role checks and RLS | Frozen. No duplication or expansion. Isolated `/discover/7800718` and its quiz remain unconditionally disabled. |

Server-function names are RPC contracts, not stable REST paths; do not call inferred `/_serverFn` URLs or manually post JSON to them.

## Compatibility and risks
1. **Identity gap:** Store's SKU-or-slug, DOTFLY's tenant/product UUID+slug, and YR's canonical reward product ID are different namespaces. YR migration source maps EASIS; no standalone DOTFLY database mapping was confirmed. Never infer it from product names.
2. **Facts/provenance gap:** Store profile reports `independentlyVerified:false`; records may carry `sourceUrl`, `sourceLabel`, `needsReview`. There is no common dataset revision, verified ingredient function/amount contract or immutable provenance snapshot API. Brand-page matching is not independent verification. Never silently promote these into PRV1 verified inputs.
3. **Wrong-protocol risk:** DOTFLY HMAC query-parameter claims are NOT Store Ed25519 fragment tickets. YR correctly rejected a synthetic DOTFLY HMAC credential in sandbox. No adapter should re-sign, convert or redeem it.
4. **Live acceptance gap:** Public JWKS and claim-page availability do not prove migrations applied, authenticated live receipt, point credit or commercial Moment redemption. Source `live_enabled` values are not production permission verification.
5. **Keys/transport:** Store exposes one current JWKS key, with 5-minute caches and no rotation-overlap contract. Do not rotate keys. Fragment tickets are held in YR browser storage during sign-in; review retention/XSS assumptions separately. Legacy DOTFLY query-token transport has exposure risks; frozen here.
6. **Replay:** YR SQL consumes JTI before `already`/daily-limit outcomes; confirm semantics during separately approved acceptance. The pure sandbox replay check uses Store's reference in-memory consume callback, NOT the production SQL.
7. **Permission boundaries:** DOTFLY partner/product route association and test/live segregation deserve a separate audit before activating its adapters. Existing handler source alone does not attest deployed RLS. No corrective legacy business/schema changes made under freeze.
8. **No Points→Moment equivalence:** YR's TEST Moment wallet and Fika TEST cards are separate from Points. A full buy/redeem commercial flow cannot be claimed from those RPCs.

## Safe-adapter decision / minimal external proposal
**BLOCKED — no runtime integration adapter added.** The missing stable Store product/ingredient API makes a factual import unsafe; adding a ticket adapter would duplicate an already compatible Store→YR flow. Existing placeholder adapters stay OFF. No external change was made.

If a machine-readable Store read is required, the minimal proposed Store patch for separate approval is **one new** `GET /api/public/dotfly/v1/products/$id` handler plus focused tests. Resolve existing published `productByDotflyId`, reuse `buildDotflyProfile`, return an explicit allowlisted DTO `{contract_version,id_kind,id,sku,slug,source_revision,profile,source_status}` with 404 for unpublished/unknown identifiers. Exclude prices, wholesale terms, correct answers, user data and signing material. Keep `independently_verified:false` and review status truthful; no ingredient function/amount verification inferred. Declare content type, cache/version semantics and approved public read/CORS policy. Existing QR/page routes and records remain untouched. **This endpoint is proposed, not implemented or approved.** Precise factual ingredient DTO requires owner agreement on the evidence/version schema before implementation.

No YR patch is required for the source-level Store ticket contract tested here. No independent DOTFLY signing authority should be added to YR's trust list. Production configuration/migration acceptance and user-consented test-account flow need a separate non-frozen approval; this task does not authorize point credit even for acceptance.

## Acceptance evidence
| Check | Result | Evidence / limit |
|---|---|---|
| Baseline legacy regression | PASS | 40 tests; 9 mutating DB tests skipped |
| New non-mutating permissions | PASS | 5 tests: invalid tenant key, unauthenticated redemption, invalid slug reject before DB; role creation/review/reopen policy |
| Actual Store→YR cryptographic contract | PASS | 12 sandbox checks with temporary random keys, TEST ticket, no network/DB; valid, tampered, expired, audience/version/points mismatch, preview-live denial, no-key failure, reference replay, HMAC incompatibility, role checks |
| Existing YR verifier tests | PASS | 13 tests across discovery-token, mocked JWKS fetch and stash expiry; 31 assertions; no network/DB |
| Public availability | PARTIAL | Store JWKS 200 JSON/1 public key; Store SKU 301; YR claim and homepage 200. Never submitted token or opened wallet |
| Deployed RLS / authenticated ledger / SQL concurrency | BLOCKED | Freeze prohibits fixture users, claim/RPC writes; source grants inspected only |
| Store factual API and DOTFLY read adapter | BLOCKED | Stable product/ingredient HTTP contract and source revision/provenance interface missing |
| Production signed receipt → points → Moment | BLOCKED | No real-user flow, points award or redemption authorized/performed |
| Existing assets integrity | PASS | Final SHA-256 comparison: zero changed baseline files in DOTFLY (135), Store (305) and YR (184); only new DOTFLY acceptance tests/docs added |

Temporary sandbox script/results and hashes are retained under `/tmp/integration-audit`; they contain no production credentials or issued user tickets. Acceptance tests remain in DOTFLY at `src/test/integration-freeze.test.ts`. No implementation, schema, routes, callback, DNS or deployment changes were made.

Final DOTFLY regression: **45 passed, 9 mutating database tests skipped**. No runtime adapter added because the Store factual read interface is blocked. All new tests mock database boundaries or use pure policy functions; no live permission assertion is made.

## Architecture clarification — discovery content nodes and secure scans

**Documentation only, 28 October 2026.** DOTFLY scanning should be able to discover content nodes, not only products. The user identifies YR's existing Local Makers/Artisans and Moment categories — Fika, Tea, Vintage, Care and boutique experiences — as intended discovery content. This clarification does not independently verify their deployed catalogue, identifiers, public URLs or API availability, and does not change the acceptance evidence above.

### Two separate scan purposes

| Purpose | Intended result | Ownership and security boundary |
|---|---|---|
| **PUBLIC DISCOVERY SCAN** | Resolve a non-secret content reference to approved information: who made it, a verified maker story, why materials/ingredients were chosen, and the Moment's context. Link to existing owner-controlled experiences where authorized. | YR remains the source of truth for its makers, stories, Moments and categories; Store remains the source of truth for its product understanding and Little Discovery. DOTFLY explains/resolves approved content through future authorized read-only adapters, default OFF until approval. Public discovery grants no purchase, wallet, Points or redemption authority. |
| **SECURE PURCHASE/REDEMPTION SCAN** | Enter YR's existing purchase or entitlement-redemption flow, with its existing authentication, staff permissions, eligibility, expiry and single-use controls as applicable. | Entirely YR-owned. A redeemable token, signed Discovery Ticket, wallet credential or purchase authorization must never be embedded in, exposed by, logged with or reused as a public discovery QR. A public content identifier must never be accepted as redemption authority. No new secure QR or purchase/redemption flow is proposed here. |

Existing QR destinations stay unchanged. This is a future resolution boundary, not permission to create QR codes, redirect scans, issue tickets or submit claims. Public discovery and secure redemption references must remain distinct even when they concern the same Moment.

### Identifier and content contract requirements

The following are **proposed logical identifier types**, not verified YR field names, routes or new records. Use the owner's actual stable identifiers once documented; never infer identity from a title or fabricate deep links.

| Logical type | Required mapping / meaning | Current evidence or gap |
|---|---|---|
| Product | Owner namespace + existing SKU/slug; explicit mapping to a product record | Store EASIS SKU `7800718` is evidenced above. Standalone DOTFLY UUID mapping remains unconfirmed. |
| Ingredient / material | Owner namespace + stable ingredient/material ID, explicitly linked to a product or story | Store ingredient pages exist; authorized structured ingredient API and YR material contract are not established. |
| Maker / artisan | YR namespace + stable maker ID; approved public story revision and explicit content relationships | User-specified existing content domain; exact IDs and read API not audited/accepted here. No inferred maker ownership or endorsements. |
| Moment / boutique experience | YR namespace + stable experience ID, with separate category references and approved public destination | Exact public content API, stable experience IDs and category schema remain unverified. Category names alone are not unique experience IDs. |
| Discovery reference | Non-secret owner-scoped reference identifying content type and canonical ID; resolution returns only approved public content | No accepted cross-system resolver contract exists. It must not carry a bearer capability or resolve to secret entitlement details. |
| Purchase / redemption reference | Existing YR-owned transaction, entitlement or single-use credential namespace | Secure mechanisms are source-inspected as described above, not production-accepted. These references are excluded from public discovery DTOs and adapters. |

Any approved read contract must distinguish content type, owner namespace, canonical ID, linked IDs, public destination, content revision, provenance/review status and visibility. Category membership, maker attribution and ingredient/material relationships must come from explicit owner records, not DOTFLY inference.

### Provenance, consent and permissions

- **No invented claims:** show only owner-authorized facts with attributable sources, evidence/revision and review status. “Why chosen” requires a documented maker/brand statement; label that attribution rather than treating it as independently verified. Do not infer benefits, sustainability, health effects or provenance from a category or material name. Unverified or absent details must be identified as such or omitted; never label an unsupported maker story “verified.”
- **Publication rights:** maker identity, biography, photos and stories require the owner's authorization, applicable maker consent and asset-reuse rights. Public discoverability does not imply permission to copy content or imagery. Respect withdrawal/unpublication and revision/cache invalidation rules; retain no private contact or account information.
- **Consumer privacy:** public discovery needs no consumer login and must not expose YR account, wallet, purchase or redemption state. Any later identity sharing requires explicit, purpose-specific consent and a separately approved contract; this clarification authorizes no tracking or data handoff.
- **Least privilege:** future DOTFLY adapters may read only explicitly approved public fields using an authorized read-only contract. No private maker records, member data, tokens, answer keys or signing material. YR retains secure-flow permissions; DOTFLY gains no wallet, Points, purchase, staff-redemption or order-execution privileges.

### Missing interfaces and approval gates

1. **YR public discovery contract:** owner-confirmed read endpoints for makers/artisans, approved stories, Moments, categories and their relationships; exact paths, IDs, visibility rules and public destination URLs are not established by this audit. No guessed endpoint is accepted.
2. **Evidence and rights contract:** field-level provenance, verification/review criteria, maker consent, publication/asset licenses, revision and removal semantics. The ability to retrieve a story is not verification of its claims.
3. **Safe transport contract:** documented anonymous-public versus scoped read authentication, response allowlist, origin/CORS policy if browser reads are intended, rate limits and caching. No redemption credentials or signing-key exchange is needed or authorized for a discovery read adapter.
4. **Resolution and separation contract:** explicit content-type/namespace mappings, approved public URLs, unknown/private-ID rejection and a guarantee that public discovery cannot reveal or consume a redeemable credential. The Store product/ingredient read gap above remains separate and unresolved.
5. **Separate acceptance:** after approval, test adapters with synthetic public-content fixtures first, then authorized read-only sandbox data. Check identifier collisions, private/unpublished rejection, missing provenance, consent withdrawal, stale revisions and exclusion of secure tokens. These checks are requirements, **not tests performed in this clarification**.

If YR or Store needs a new endpoint or field, **STOP**: request approval for the exact minimal allowlisted read-only patch and tests once the owner contract is known. No external patch is implemented or implicitly approved. Reuse existing data and flows; do not recreate Little Discovery, Points, Moments, purchases or redemption in DOTFLY.

### PRV1 boundary and clarification acceptance

PRV1 product/composition normalization, deterministic functional mapping, mandatory trade-offs, provenance, progressive non-normative understanding and role-restricted professional supply remain the preserved technical core. **Moment context and Maker/Artisan storytelling are application-layer extensions; they are not automatically covered by PRV1 claims.** A shared scan entry or diagram does not establish patent-claim coverage. Any product-composition data entering the core still requires its existing validation and provenance rules; narrative content is not automatically a verified engine input.

**PASS — documentation boundary clarified. PARTIAL — existing domains are user-specified, with secure-flow source evidence limited to the earlier audit. BLOCKED — discovery API activation and production acceptance await exact authorized contracts, rights/consent evidence and explicit approval.** Overall integration acceptance remains PARTIAL. This addition changes only this report; no code, tests, features, database, QR, external application, credentials or deployment are changed, and no new runtime or production verification is claimed.