# Validation Report — Secured Release 1.9.1

Date: 2026-09-20

## Passed in the audit environment

- `gofmt` completed for all modified Go files.
- `node --check` passed for production preflight/build scripts.
- The standalone SSRF/public-IP transport and privacy fingerprint helper compile successfully when tested outside the project's Go toolchain requirement.
- `npm run test:release`: 3 of 4 tests passed.
- The release archive passed `unzip -t` with no corrupt entries.

## Blocked by the audit environment

### Go

The project requires Go 1.25.8. The audit environment provides Go 1.23.2. Automatic download of Go 1.25.8 was attempted but failed because the environment cannot resolve/reach `proxy.golang.org`.

Therefore the full commands below have **not** been claimed as passed:

```bash
go test ./backend/...
go vet ./backend/...
govulncheck ./...
```

### Frontend

The project declares Node 22.12+ and the installed runtime is Node 22.16.0. However, the provided frontend `node_modules` tree is incomplete (`vite` and `@types/node` are missing). `npm ci` could not finish inside the audit environment because dependency downloads timed out.

Therefore `npm --prefix frontend run build` is not claimed as passed here.

### Release package test

The release test suite produced:

- PASS: fresh-install secrets
- PASS: existing/LMS credentials preservation
- PASS: weak-template/symlink protection
- BLOCKED: member-package test because root dependency `yauzl` was not installed

This is an environment/dependency failure, not evidence of a failing package assertion.

## Required final gate on the deployment/build server

Run:

```bash
npm run setup
npm run preflight:production
npm --prefix frontend run build
go test ./backend/...
go vet ./backend/...
```

Then install `govulncheck` for the selected Go toolchain and run:

```bash
govulncheck ./...
```

Finally:

```bash
npm run build:production
```

and smoke-test `/api/healthz`, login, WhatsApp connect/reconnect, API key, media, webhook, AI, scheduler, broadcast and recovery before switching production traffic.