Tenant boundaries & roles
Organizations stay isolated. Sessions, roles and CSRF checks control every action on the server.
Inspect 0 checks
No executed checks are included for this source yet.
ENGINEERING EVIDENCE
Six guarantees. Open to inspection.
Explore the working approval flow, then inspect the tests behind it. Every result links to its source. This is an original synthetic portfolio project.
CI evidence not confirmed
No matching verification results in this build
Results appear after verification.Safe retries & concurrent decisions
Repeated commands keep one result. Conflicting decisions and stale updates are rejected.
Inspect 0 checks
No executed checks are included for this source yet.
Audit & database integrity
Changes commit together. Database constraints and a restricted runtime role protect the record.
Inspect 0 checks
No executed checks are included for this source yet.
Worker recovery
Real Redis/BullMQ jobs recover from process crashes, retry bounded failures and retain one persisted report.
Environment: Docker + CI · separate from the online approval flow
Inspect 0 checks
No executed checks are included for this source yet.
Browser workflow & delivery
Desktop and mobile approval journeys, strict types, a Next.js build and the Cloudflare runtime are exercised.
Inspect 0 checks
No executed checks are included for this source yet.
Public deployment & usage limits
The hosted approval flow, database permissions and sampled runtime CPU are checked. Demo admission has a tested daily limit.
Inspect 0 checks
No executed checks are included for this source yet.
What runs where
LIVE ON THIS SITE
Try the approval workflow
Next.js / React, a Cloudflare API and PostgreSQL. Create, submit, approve or reject, switch roles and inspect the saved audit. Each visitor has a private workspace.
Open the demo ↗REPRODUCIBLE IN DOCKER + CI
Inspect the complete backend
Node.js / Fastify, Prisma, PostgreSQL and Redis / BullMQ. Reports run here, including retries, crash recovery and controlled replay.
Run it from the README ↗Verification provenance: commit, environment and source hash
- Tested commit
Not verified- Environment
- Not loaded
- Source SHA-256
Not verified
The build includes saved evidence only when its source hash matches. CI and public deployment observations are collected separately; their exact timestamps and sampled Worker version are in the JSON. Counts refer to evidence entries, not independent test cases.
Scope and limits
Demo identities operate inside an isolated workspace. Production OIDC, PostgreSQL RLS, Next.js SSR and Server Actions are outside this project. Tenant isolation uses server authorization and relational constraints. The public site does not run Redis; its approval flow creates no background jobs. The complete worker environment is exercised in Docker and CI.
Free hosting has quotas and no uptime guarantee. Sampled CPU is a small synthetic observation, not a load test. See the deployment notes for limits and reproducible setup.