---
phase: verification
agent: verification-advisor
agent_version: 1
generated_at: 2026-10-14T09:51:00+09:00
concerns_checked: true
concerns:
  - "Documented java -jar WAR command fails: no Main manifest attribute; isolated runtime passed via spring-boot:run."
  - "Actual trusted touchscreen input and specific Unity button outcome remain unverified: Chrome click generated trusted mouse events even in touch emulation."
  - "Prechange regression failure was not independently executed; temporary browser fixture after cleanup was unavailable; current regression passed."
  - "AC9 impact map/docs index and Impeccable detect require root verification; not supplied to independent advisor."
  - "update_plan unavailable; ATP_POOL_BIND tool action not fabricated."
---

# Independent verification

Implementation code, git diff, design.md and implementation reports were not read. No repository product/test edits were made. Tests executed against the user-authorized isolated environment; shared app8080 and DB5433 were untouched.

## Acceptance criteria (provided verbatim)

## 검증 포인트

AC self-audit: 기대값은 metadata/DOM/DB 행위 불변식에 고정하고 work-session 산출물 개수에 의존하지 않는다. 표현은 literal grep 대신 typed parser/HTTP/DB/DOM assertions; 파일 집합만 아래 명시 목록 전수 확인한다.

- AC-1 parser fixture 집합 전수: portrait, landscape, square, nested index+adjacent info, HTML attrs, Unity literal CSS, conflicting precedence, no metadata, 300×150 default, malformed JSON, invalid pair/range, multiple ambiguous canvas, malicious script/nonliteral, oversize inputs. 각 named fixture 검증 및 product에서 JS 실행 0건; metadata 없는 정상 ZIP HTTP 200.
- AC-2 실제 uploaded game: 제공 ZIP은 390×844 반환; 다른 이름의 1280×720 및 800×800 ZIP도 자신의 값 반환. filename/게임명 상수 없이 동일 계약.
- AC-3 등록→DB→상세/수정 round trip; auto/custom/legacy path 전수 분기, manual 우선, 새 ZIP metadata 업데이트, 구 edit omission 보존, unknown nullable & fallback. 두 숫자 invalid는 400, CSRF/auth/owner unchanged.
- AC-4 isolated PostgreSQL mapper 계약: migration 기존 row 유지/NULL fallback, 재실행 가능; 모든 GameData SELECT 및 INSERT/UPDATE dimensions/source 정합. fresh schema와 migrated schema 동일. L2 remote/seed 미지정만 skip 가능; 알려진 healthy DB에서 가능한 isolated 검증을 우선한다.
- AC-5 stage viewport 집합 전수: 320×844, 1440×900, 844×390, 640×300에서 portrait/landscape/square 모두 iframe 양축 boundary 이내/ratio 오차 ≤1px. 현재 16:9/max520 구현에서 portrait 회귀는 실패하고 수정 후 통과함을 확보한다.
- AC-6 resize/overlay/fullscreen 진입·해제/실패 fallback에서 exact same iframe DOM, src, load count, 게임 state 유지; Esc/닫기/focus/scroll 복원. asset-origin 다른 origin에서도 parent canvas DOM access 없이 지원.
- AC-7 실제 ZIP runtime: 준비 후 CSS client size와 drawing buffer를 별도로 기록; 정상/expanded/fullscreen(지원 브라우저) resize, 상하단 UI 표시, 버튼 좌표/클릭, 모바일 터치 입력 점검. 원본 ZIP 및 served uploaded HTML hash 미변경.
- AC-8 full `./mvnw -o test` 및 WAR package 통과; isolated 최신 앱에서 detail/register/edit 변경 JSP 전수 HTTP 200(인증 포함). runtime stacktrace 및 console error scan. 새 constructor 의존이 생기면 contextLoads mocks 갱신. screenshot은 desktop/mobile 묶음 한 번+필요 fix 한 번; Impeccable detect changed UI 대상 한 번 실행.
- AC-9 파일 영향맵의 신규 산출물은 전수 존재하되 conditional 경로는 조건 성립시에만 변경; docs 계약/사용/변경 3개와 해당 index 링크 모두 확인. verification-advisor는 테스트를 작성하지 않고 실행만 수행.



## Executed strategies

| Command | Exit | Result |
|---|---:|---|
| `bash scripts/verify-webgl-display.sh all` | 1 | Environment startup failure: default Java launcher could not locate runtime |
| `JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home PATH=/opt/homebrew/opt/openjdk@21/bin:$PATH bash scripts/verify-webgl-display.sh all` | 0 | PASS |

Full Maven tests:377, failures0, errors0, skipped1 (opt-in L2 contract excluded from ordinary test run). Node11/11 PASS. WAR package PASS. Disposable PostgreSQL L2 enabled and actual mapper test1/1 PASS; runner confirmed legacy row preserved, migration twice/idempotency, invalid CHECK rejection, fresh/migrated equivalence, INSERT/UPDATE/all7 SELECT roundtrip. L2 was not skipped.

## Runtime evidence

Separate `postgres:16` container `bibimbap-inv004-postgres` exposed loopback55003; fresh schema executed through psql from db/schema.sql (source not inspected). Temporary account created through registration UI in isolated DB only. Latest packaged artifacts launched with Java21 using working command:

```bash
JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home PATH=/opt/homebrew/opt/openjdk@21/bin:$PATH ./mvnw -o spring-boot:run '-Dspring-boot.run.arguments=--server.address=127.0.0.1 --server.port=18081 --spring.config.import= --spring.datasource.driver-class-name=org.postgresql.Driver --spring.datasource.url=jdbc:postgresql://127.0.0.1:55003/webgl_contract?currentSchema=dev --spring.datasource.username=postgres --spring.datasource.password= --app.upload.game-storage-path=/tmp/bibimbap-inv004-uploads'
```

The documentation's `java -jar target/bibimbap-0.0.1-SNAPSHOT.war` failed with no Main manifest attribute. This is a reproducible operational-guide issue, not a JSP/runtime failure.

Actual ZIP browser upload used unmodified byte copy renamed independent-original.zip, since Chrome upload_file denied every workspace path. A private loopback18082 CORS file server supplied bytes to a DataTransfer/File in the actual form. Upload HTTP200; UI detected390x844. Automatic register persisted390x844/build-info and edit/detail reflected it. Custom400x900/manual persisted, reopening edit selected custom and both values. Uploading1280x720 while custom left400x900 unchanged. Automatic resave re-detected original390x844. Synthetic valid Unity ZIPs named independent-landscape and independent-square returned1280x720 and800x800, saved in DB. Updating square with new landscape ZIP persisted1280x720. An isolated legacy row with null metadata rendered fallback16:9.

Authenticated fetch requests `/game/new`, `/game/1`, `/game/1/edit`, `/game/2`, `/game/3` all HTTP200, exercising actual JSP compilation. Server logs contain no ERROR/Exception/stacktrace; warning only appended static upload location slash.

Every portrait/landscape/square at320x844,1440x900,844x390,640x300 passed boundary and ratio checks (12/12), max error0.006665px. Initial resize_page window had OS minimum size limits, so exact matrix used viewport emulation and recorded actual innerWidth/innerHeight. Portrait actual Unity instance was ready. CSS versus drawing buffers recorded independently: desktop1440x900 normal291x630/582x1260; fullscreen388x840/776x1680; mobile touch emulation273x591/273x591. Actual original game top information and bottom menus visible in desktop/mobile screenshots.

During normal resize, expand, fullscreen success/exit, rejection fallback and Esc: same iframe DOM, same Unity instance,0 additional iframe loads. iframe source unchanged. Fullscreen returned focus to fullscreen trigger; overflow restored. Forced requestFullscreen rejection correctly displayed dismissible expanded fallback. Touch emulation maxTouchPoints1, but actual Chrome click generated trusted pointerdown(pointerType mouse), mousedown and click at canvas136.5x295.5. This proves mouse delivery, not trusted touchscreen delivery or a named Unity button outcome.

Original ZIP SHA256 stayed02e5272e4086f8f0e2e3a4b41ca4313d5f8862897a1655421f3f1b4315942461. Original/stored/HTTP served entry HTML all SHA2568a9f8aaff7e949b49f4cab1a87c5b6d414db4031b5fb3e268f5102bc40cbcc74. No source HTML mutation.

Browser console errors:0. Observed warnings: iframe sandbox allow-scripts+same-origin, Unity WebGL INVALID_ENUM, DontDestroyOnLoad root warning, AudioContext autoplay warning. No lint tool was invoked; lint absence is not runtime failure.

## Acceptance matching

| AC | Verdict and evidence |
|---|---|
| AC1 | PASS through6 grouped parser cases plus12 upload security cases; fixture case names in verification-cases.json. Dynamic/nonliteral data rejected/unknown, malformed metadata upload succeeds. Independent JS execution instrumentation not separately added. |
| AC2 | PASS runtime actual390x844 and distinct-name1280x720,800x800 uploads |
| AC3 | PASS7 Java contracts plus runtime auto/custom/edit/new ZIP/legacy fallback; HTTP invalid/auth/CSRF branches executed by Java contracts |
| AC4 | PASS actual isolated L2, no skip |
| AC5 | PASS current12/12 viewport matrix; prechange failure evidence NOT independently executed |
| AC6 | PASS same-origin runtime identity/load/Unity and fullscreen rejection; cross-origin no-DOM dependency covered by Node harness, not separate runtime asset origin |
| AC7 | PARTIAL actual ready/CSS-buffer/state/hash/UI imagery and trusted mouse delivery pass; named Unity button outcome and trusted mobile touch NOT verified |
| AC8 | PASS automated full/package/JSP/errors/screenshots; Impeccable detect not performed by independent advisor |
| AC9 | NOT VERIFIED independent artifact existence/impact map/docs indexes not supplied; root check required |

## Overall

overall: fail
rollback_signal: none

Automated suite and observed runtime behavior PASS. Complete acceptance is not claimed because prechange failure, trusted touch/button outcome and root-owned audit requirements remain unverified. No observed product runtime failure warrants rollback. Operational guide's boot command is reproducibly wrong for current WAR.

## Artifacts and cleanup

- artifacts/verification-integrated-java21.log — full377+11 tests, package, L2 evidence
- artifacts/verification-integrated.log — initial Java environment failure
- artifacts/verification-cases.json — named grouped Java test cases
- artifacts/runtime-dom-evidence.json — exact viewport and Unity state/input evidence
- artifacts/runtime-http-evidence.json — authenticated JSP status and served hash
- artifacts/runtime-hashes.json and original-hashes.json — ZIP and HTML preservation
- artifacts/runtime-roundtrip-auto.txt, runtime-roundtrip-manual.txt, runtime-zip-replacement.txt — actual isolated DB rows
- artifacts/runtime-app-maven.log and runtime-app.log — running application and manifest failure
- artifacts/runtime-schema.log — actual fresh schema execution
- artifacts/runtime-desktop.png, runtime-mobile.png — screenshot pair

Owned app18081 process43913, loopback file server18082, disposable container bibimbap-inv004-postgres are removed after collection. Temporary upload bytes at /tmp/bibimbap-inv004-uploads and session fixture ZIPs intentionally retained for root collection; no shared volume deletion. Browser tab2 retained, pointed at isolated runtime page. Session HTTP cookie artifact removed rather than delivered.

## Bounded regression attempt

After cleanup the runtime page no longer had its iframe. First DOM fixture failed due absent iframe. An independent blank iframe/stage fixture evaluation remained pending and was terminated without result. No baseline failure evidence is claimed. runtime-prechange-geometry.json records the first unavailable attempt, not a passing baseline proof.