m2-market/specs/001-market-first-wedge/VERIFICATION.md

Verification — 001-market-first-wedge

Date: 2026-07-02 · Verifier: orchestrator (Claude Fable, factory loop) · State: master c52f968+

Success criteria (spec.md)

SC	Status	Evidence
SC-001 one real paid install between two operators	✅ PASSED	m2bd bought sdjs-operator's lst_mm-pdf-report (40 cr) on m2bd-m2o, 2026-07-02T02:15:53Z. Ledger: m2bd 100→60, sdjs-operator 100→136, platform +4. Grant gr_3697fd… → paying tx 8. Skill applied + entrypoint executable.
SC-002 ≥3 evidence-backed listings	⏸ PARTIAL (2/3)	lst_mm-pdf-report, lst_agent-scaffold published via PR+approve+merge with real evidence. Third BLOCKED on operator (T031: no real competitor-scan evidence exists; email-triage substitute needs owner-initiation + double-scrub).
SC-003 100% installs have tx + grant; zero applies without debit	✅	Live ledger: every apply preceded by /tx/install (409 duplicate-ref guard); property tests (no grant without paying tx); audit snapshots audit/2026-07-02.json in m2/market-registry.
SC-004 derived balances == fold(log)	✅	Hypothesis state machine (50 examples × 25 steps) + live snapshot recomputation. Refund-overdraw recorded as an accepted economic rule (data-model §Transaction).
SC-005 search→installed <10 min	✅	Gate install: 0.88 s wall (plus seconds of search/confirm).
SC-006 Scout v0 ≥1 correct proposal on canary	✅	Scout v0 (Hermes plugin) live on chris-m2o: proposal prp_20260702_chrism2o_b0c4d correctly matched sol_mm-pdf-report (score 0.795) for a matching-intent turn; opt-out suppresses; rate-cap/cooldown state tracked; zero raw-input egress (extractive summary + redaction, unit-tested). Caveat: end-to-end Hermes-dispatched turn blocked by the desktop's m2-gpt 401 (fleet auth issue, not Scout) — hook registration verified in-process.
SC-007 install telemetry queryable as evidence	✅	Gate install outcome in market:evidence (id e87d0516…); CLI now auto-posts (T045, fire-and-forget).

Quickstart scenarios

Scenario	Status	Notes
A publish with evidence (+negative)	✅	PRs #1/#2 → CI validate → approved → merged → discoverable. Negative: evidence-stripped bundle → exit 5 with field-precise error.
B funded install	✅	The SC-001 gate run.
C refusal / idempotency / refund	✅	Unfunded operator → exit 3, no side effects. Re-run → no-op exit 0, no second debit. Refund: live-proven by the first gate attempt (bind-mount guard bug) — compensating pair tx 6/7 restored buyer to 100 before retry.
D ledger audit properties	✅	9 ledger tests green; two committed snapshots (commits bc5e00b, d550f85).
E catalog rebuildability	✅	Fresh-partition rebuild (market:catalog-e2e) from registry returned identical results; runbook documents the switch (memory-api has no delete — as-built amendment recorded).
F Store on canary	✅	M2 Store deployed on chris-m2o (+staged on gunnar): renders live catalog, detail page with evidence/permissions, one-click install executed a REAL purchase (chris-operator 100→60, sdjs 172, platform 8) with a truthful refunded-failure first (root-owned ~/.claude provisioning issue, fixed) then green "Installed."
G Scout on canary	✅	See SC-006. Thresholds calibrated on live scores (min_score 0.60, min_coverage 0.30).

Known gaps / follow-ups

1. T031 third seed — operator decision (email-triage commercialization or alternative).
2. chris-m2o's m2-gpt tenant key gets 401 "User not found" — blocks real LLM turns on that desktop (fleet auth issue, surfaced by Scenario G; Scout hook dispatch itself verified).
3. Scout end-to-end through a REAL Hermes-dispatched turn — pending the 401 fix above.
4. Publish status flow (analyze I2): merge doesn't auto-flip status: published — manual step documented in runbook until automated.
5. memory-api partition CRUD (fedlearn T13 follow-up) unlocks true in-place reindex, listing updates, and delist removal.
6. m2bd-m2o runs the pre-telemetry CLI build; operators get T045 telemetry on next uv tool install --force update.

Verdict

The wedge's commercial loop is CLOSED and verified (SC-001). Remaining work is surface expansion (Store deploy, Scout v0), one operator decision (third seed), and recorded platform follow-ups — none block the gate.