Public Convex application receiving review

Reviewed source and test commit: 4223c39a6d5c2b2e2fedb1a7eee3c0052b5e5013. This independent review covers the new public pagination and authenticated app receiving tests, their pinned-source setup, local-backend.ts, and network-gate.ts. It found no adapter defect. This commit changes test and integration setup, dependencies, and documentation, with no shipped production code change.

The reviewer inspected the committed test and setup files and fetched the pinned upstream message functions, schema, auth functions, and permission implementation through GitHub's API. The execution results below are attributed to the authors and root agent. The reviewer did not rerun the backend suites or the production mutants for this review.

Sources and observed evidence

The pagination source is get-convex/convex-demos at 2fac21e360bfcceae6065096f1b81480bd8c6fd5. The actual functions are deployed unchanged from git archive of that commit. The optional local checkout must have that HEAD, and archive reads the pinned object rather than dirty worktree files. The local app shell and SDK dependency are supplied by the test. Upstream declares Convex 1.48, while this fixture intentionally deploys with the package's installed Convex 1.47 SDK/CLI and the CLI-selected local Rust backend release. The binary version was not recorded, so this record does not assign it the SDK's version.

The auth source is get-convex/convex-auth-with-role-based-permissions at 45f08008e1257758560948db4280cc4e7d64e84a. Setup verifies the fetched HEAD and copies the message functions, schema, auth routes, and permission library into an ignored runtime. The one deliberate application adaptation replaces GitHub/Resend providers with Convex Auth's Anonymous provider. The replacement checks the expected pinned source text. Server permission checks and role updates retain upstream behavior. The fixture uses @convex-dev/auth 0.0.90 and @auth/core 0.37.4, rather than the upstream app's older declared 0.0.71 and ^0.34.1. It does not install the upstream lockfile. Fresh signing keys allow a genuine sign-in and JWT without third-party credentials.

Reported execution evidence:

All 17 combined backend tests passed before the final auth history extension. That run included the existing nine backend tests and all eight new public-app histories, six pagination and two authentication.
After the last extension, both auth client histories passed with every role/operation pair, two successful equal-body sends, and two deletions. This is targeted evidence for the final auth changes, not a claim that the reviewer reran the full combined suite at the reviewed commit.
The root agent reported 62 adapter checks, package typecheck, and lint passing for the final source. The author reported all six public pagination histories passing after the continuation control was restored, using default fresh GitHub fetch/archive setup rather than the local-source override.
A stale runtime sentinel was removed by actual auth preparation. This checks the fresh-runtime prerequisite rather than assuming a previous teardown ran.

Calibration evidence is distinguished from successful execution:

Control	Reported result and checkpoint
Disable automatic continuation	With the proper selector mirrors list through, both actual SDK histories failed the immediate ordered select comparison after preload. JavaScript exposed three rows instead of the ledger's 17, React three instead of 34, because successful writes from the earlier selected history remained in the shared backend. These were assertion failures at the named checkpoint, not timeouts or setup errors.
Initial selector containing a literal >	It matched no tests. This was an unreached path and is not counted as a mutant kill.
Bypass upstream role checks in a temporary prototype	The author changed the pinned permission function's final numeric comparison to return true, preserving user/role existence checks, and let the real backend redeploy. The first read/send denial assertion received a resolved null instead of rejection, one failed/one skipped test, with no timeout or setup failure. The original source was restored and both SDK histories passed through their own pinned-source setup. This control used the earlier five-step history; the final expanded history retains that first read/send cell. It was not rerun as a mutant at the frozen commit.

Requirement outcomes

Requirement	Outcome and evidence
ORC-001, authority and limits	Satisfied for these receiving claims. Upstream pagination functions establish newest-first order, indexed author membership, and uppercase body/author-initial transformation. The upstream permission function and message endpoints establish read/write/admin access. The adapter's existing source snapshot and complete eager pagination contracts establish the Collection observations. The tests do not authorize a new provider or adapter behavior. Pins and adaptations are explicit.
ORC-002, independent judgment	Satisfied. Pagination's expected rows come from an authored ledger of successful sends, reversed and optionally filtered/transformed according to the upstream query contract. Expected rows do not come from the adapter, a paged query, or SDK cache. Auth uses a set-valued role policy rather than copying upstream's numeric role comparison, and a body multiset rather than server-generated IDs. Actual IDs are used only to target deletion, not to compute the expected message count.
ORC-003, literate responsibilities	Satisfied. Both files explain the upstream authority, reference computation, authored histories, real SDK/Collection path, public observations, and limitations before mechanics. Comments identify the shared-backend ledger prerequisite, stable keys for transformed rows, role-update adaptation, denied operations, and reconnect cut. Setup and README describe which upstream code is deployed and which authentication provider is substituted.
ORC-004, generated grammar controls	Not applicable, these are fixed authored receiving histories rather than generated properties. Their finite scope is still explicit: both SDKs cross all three pagination query forms at page size three; the auth history crosses all six role/operation cells, demotion, two equal-body successful sends, and deletion of one occurrence at a time. Unique pagination bodies remain unique after uppercase conversion, excluding the transformed-key ambiguity that would make those histories invalid. Arbitrary operation sequences, page sizes, role values, token lifetimes, and malformed protocols are not generated or claimed.
ORC-005, production path and observation	Satisfied. Both drivers use actual SDK clients, actual deployed upstream functions, and real Collections. Pagination compares ordered input to select immediately after initial preload, then compares keyed public rows after source acceptance. Later checkpoints poll for the expected source revision before checking the public Collection. Auth waits for each real mutation outcome, then source acceptance, and compares marker multiplicity after both permitted and denied operations. Unauthenticated Collection preload and invalid-token HTTP query are distinct controls. No concrete missing-input hypothesis remains for the stated cuts.
ORC-006, calibration	Satisfied with the attributed controls above. Disabled continuation fails immediate source-order comparison on both clients. Bypassed server permission checks fail denial observations. The skipped initial selector is excluded from calibration. These controls target two specific wrong designs, they are not an exhaustive mutation campaign.
ORC-007, generated campaigns and replay	Not applicable, there is no generated property or fc.commands history in these new receiving files. Each named query/client history is directly selectable. Pinned source commits and fresh local deployments support reconstruction, but they are not seed/path replay or random campaigns. Existing primary pagination and offline owners retain those generated campaigns.
ORC-008, state minimality	Satisfied for the reference histories. Pagination retains successful messages in insertion order because later queries need their values, author membership, and reverse order, including writes from earlier histories against the shared backend. Counts alone cannot predict those observations. Auth's multiset must retain multiplicity because two identical sends create two rows and deleting one leaves one. Collapsing them to a set predicts the wrong intermediate public snapshot. Server IDs and timestamps are deliberately omitted from the model because the compared projection and legal deletion targets do not require predicting them.
ORC-009, vocabulary and abstraction	Satisfied. Collection rows, source acceptance, public snapshot, and cleanup retain the glossary meanings. The pagination ledger models successful application sends, not provider subscriptions or core sync transactions. Auth bodies abstract away server IDs while preserving the multiplicity that the observations need. TCP gate state is transport availability, not Collection readiness. The invalid-token HTTP control does not establish invalid-token WebSocket behavior.
ORC-010, failure fidelity and cleanup	Satisfied for the exercised harness. Registered Collection, SDK, TCP gate, backend, checkout, and runtime cleanup uses the existing calibrated withTestCleanup instrument. It preserves a primary comparison or setup error while reporting secondary release failures and attempts subsequent releases. The local backend startup catch now preserves the startup cause if stopping fails. Auth records its runtime path before preparation, clears stale contents before copying, and can clean a partial preparation. The runtime is scoped and ignored. This review inspected those paths; it does not claim fault injection at every construction instruction or process-kill cleanup.
ORC-011, independent second formulation	Satisfied for the concrete shared-fault concern motivating these witnesses. Adapter-authored backend functions could reproduce the same assumptions as the adapter and primary numeric range fixture. These tests instead deploy independently maintained public application functions at verified pins and compare them with an authored operation ledger or permission table. Auth's permission table differs structurally from upstream numeric hierarchy. No additional concrete shared semantic fault was identified that requires another model. This is not an exhaustive absence claim.
ORC-012, review evidence	Satisfied by this versioned record tied to the exact source/test commit. It distinguishes independent inspection from author/root execution, records the unreached control, reports the harness/provenance repairs, and retains scope limits. No adapter bug-class closure is claimed by these test-only changes. They receive existing laws at additional application and transport boundaries.
ORC-013, distinguishing boundary witnesses	Satisfied within the fixed cases. Authentication distinguishes no identity, an invalid token, and a genuine signed token accepted by server functions. The role history distinguishes read from write for send, write from admin for delete, and demotion after a successful write; every role/operation cell is exercised. Two equal-body sends followed by single deletions distinguish multiplicity from set membership. Pagination crosses one page into several with 17 initial appends at page size three, and includes another author to distinguish indexed membership from an unfiltered mirror. These fixed witnesses do not establish arbitrary thresholds or workloads.
ORC-014, controlled-premise handoff	Satisfied for the named receiving premises. Both actual SDK clients and a real local backend now supply cursor pagination, query transformation, successful/denied authenticated mutations, and subscribed source updates. A real auth action issues the tested JWT, neither setAdminAuth nor a fabricated identity supplies the tested user. The TCP gate forwards uninterpreted bytes, destroys live connections, and refuses new ones while closed. The test waits for the adapter client's public connection state to become disconnected before an independent direct writer commits. Old rows remain public; later ledger rows must arrive after reopening the gate. This receives real SDK reconnection, without protocol-message simulation. These app-specific ledgers and histories do not literally reuse the primary numeric fixture grammar, they require different expected application fields and auth policy. Their relationship is source snapshot refinement and complete finite acquisition; shared-law drift remains a reason to keep the primary owners and pinned-source review.

Repairs and remaining limits

Review identified setup and evidence gaps, with no adapter defect:

Auth runtime contents needed an ignore rule and a fresh-copy prerequisite. Both are present at the reviewed commit, and the known runtime path is registered before copying so partial setup can be removed.
Local backend startup could lose its original error if stopping also failed. It now uses the existing failure-preserving cleanup instrument.
The first auth model was a set and the history admitted only one successful send. The final history covers the full role/operation table and uses a multiset, so repeated equal-body sends and one-at-a-time deletion are explicit.

The upstream auth demo deliberately lets an authenticated user choose a role. This is its documented demo behavior, not evidence of secure role administration. The test does not establish tenant isolation, sign-out or token revocation, refresh-token rotation, browser auth components, OAuth redirects, email delivery, or production identity infrastructure. Token corruption is tested through HTTP; unauthenticated preload and genuine token use are tested through both WebSocket SDKs. Authenticated reconnect is not exercised. The reconnect witness uses the separate unauthenticated public pagination app.

The pagination observations project author and body; they deliberately omit upstream _id and _creationTime, which the transformed query does not return. Auth compares marked body multiplicity, not complete raw message records or user/author fields. These are business-ledger observations, not full raw-row fidelity. The existing backend owner checks IDs and application fields separately.

Pagination observes complete finite results and live appends, not arbitrary updates/deletes, continuous growth, transport work bounds, bounded lifetime subscriptions, or browser rendering. Transformed rows have stable keys only because the authored bodies are unique, including after case conversion. The ledger assumes a fresh deployment and sequential execution, both supplied by setup and test configuration. Auth compares test-marked messages within the upstream query's latest-100 window, not every application row in an arbitrary large database.

The public applications are deployed locally with the package's installed SDK and backend, with an independently supplied app shell. They are not unchanged full frontend deployments or evidence for their originally declared dependency matrix. GitHub availability, local backend download, and operating-system TCP behavior remain test prerequisites. No production cloud service, third-party OAuth system, power-loss atomicity, or arbitrary network scheduling is proved.