YETI PUBLIC VERIFICATION RUN
Date: 2026-09-20
Pull request: https://github.com/SasquatchLabsInc/core/pull/763
Nature: vendor-executed, public-safe summary; not third-party certification

PUBLIC EXPERIENCE AND DISCOVERY GATE
Result: PASS
Commands:
  npm.cmd test
  npm.cmd run build
  YETI_AUDIT_ORIGIN=http://127.0.0.1:4177 npm.cmd run audit:yeti
  npm.cmd audit --audit-level=moderate
Observed results:
  13 of 13 landing tests passed
  Production build passed
  40 routes prerendered
  Browser release audit passed at desktop, tablet, mobile, and small-mobile viewports
  Yeti manifest, verification contract, and well-known discovery JSON parsed
  Sitemap XML parsed
  Dependency audit reported zero vulnerabilities
Boundary:
  This gate validates the public Yeti experience and machine-discovery artifacts.
  It does not prove security-runtime behavior.

YETI LIVE-POSTGRES SAFETY GATE
Result: PASS
Runtime: golang:1.25.8 container
Database: disposable PostgreSQL 16; current 329-file Supabase migration chain applied
Commands:
  LIVE_DB_TEST=<redacted disposable PostgreSQL DSN> go test -count=1 ./internal/yetiagent/
  LIVE_DB_TEST=<redacted disposable PostgreSQL DSN> go test -count=1 ./internal/playbooks/ ./cmd/api/
Observed results:
  github.com/mickymultani/sasquatch/control-plane/internal/yetiagent passed in 9.087s
  github.com/mickymultani/sasquatch/control-plane/internal/playbooks passed in 17.514s
  github.com/mickymultani/sasquatch/control-plane/cmd/api passed in 1.049s
Boundary:
  LIVE_DB_TEST pointed at the disposable database; it was not disabled.
  This exercises the packages' current live-database tests, including agent persistence,
  concurrency, approval-window, run-chain, budget, Warden, mission, playbook claim,
  approval, reliability, and API agent-chain paths selected by those packages.
  It remains vendor-executed repository evidence, not customer-deployment evidence,
  external connector certification, a scale result, or third-party attestation.

REQUIRED CUSTOMER ACCEPTANCE
The customer evaluation must still exercise representative telemetry, known-positive and meaningful-negative detections, a bounded investigation, a historical hunt, parser replay, response dry-run and approval, unauthorized and ambiguous mutation rejection, evidence lineage, reconciliation, and rollback for the selected topology.

Canonical claim boundaries and methods:
https://sasquatchlabs.io/yeti-verification.json