# Packaged-release verification

**Camp Commons kit v0.1.0 · checked October 28, 2026**

The release was extracted into a new folder, installed with its own newly created Python environment and npm packages, and run against its own newly created SQLite database. Existing development instances and their data were not used for these checks.

Test environment: Apple Silicon arm64, macOS 26.5.1, Python 3.14.3, Node.js 24.14.0 and npm 11.9.0. The verification server used loopback port 8781 to avoid existing development instances; the delivered launcher defaults to port 8765.

## Executed checks

| Check | Result |
|---|---|
| Fresh archive extraction and per-file SHA-256 checks | Passed for every delivered source file. |
| README installation command, `bash setup.sh` | Passed. Installed the pinned Python and npm dependencies, built the frontend, applied migrations and created a new fictional camp. |
| Fictional seed | 72 campers, 12 staff, six groups, eight activities and 24 Monday group sessions. |
| Backend, solver and adversarial tests | 69 passed. |
| Independent audit fixtures | 16 passed. These fixtures do not import the backend solver or validator. |
| Frontend unit tests | 12 passed. |
| Production frontend build | Passed; 2,418 modules transformed. Bundle-size advisory described below. |
| Django system check | No issues. |
| Migration drift check | No changes detected. |
| Python dependency consistency | `pip check` found no broken requirements. |
| npm dependency audit | Zero known vulnerabilities reported at the time of this check. This is an advisory-database result, not a security guarantee. |
| Actual HTTP health and app | Health returned `{"ok":true}`; app HTML and both referenced JavaScript/CSS assets returned HTTP 200. |
| Five-day schedule preview and apply | Preview produced 120 group sessions, left the stored workspace unchanged, and applied 120 sessions. The seeded locked assignment remained unchanged. |
| Elective preview and apply | Preview left the stored workspace unchanged. Apply placed all 72 campers across eight offerings. |
| Independent persisted-data audit | Passed on 128 sessions and 72 elective assignments, with no reported issues. |
| Stop and restart | The same workspace version, 72 campers, 128 sessions and 72 elective assignments remained after a full server stop/restart. Seeding did not duplicate or replace records. |
| Source preservation | Application source, lockfiles and launch scripts match the tested Kimi application candidate `1fac7e4`. Packaging changed documentation and added the source archive builder and allowlist. |
| Archive contents | Exact allowlist: 61 project files plus generated `SHA256SUMS`. No database, secrets, local logs, screenshots, provider harness, installed packages, generated frontend or Git metadata. |
| Package integrity | ZIP CRC check, extraction checksums and repeat-build SHA-256 equality passed. Executable modes are retained for the three launch/install scripts. |

## How the checks relate to prior reviews

Fable's earlier read-only review and the Kimi interface revision informed this candidate. The sanitized product findings are in REVIEW_SUMMARY.md. The broader development verification included browser workflows and phone layouts. This packaged-release pass reran the executable checks and actual HTTP workflows listed above; it did not repeat a visual browser review or a macOS double-click/Gatekeeper test.

The complete application source in the archive is unchanged from the candidate that received those prior checks. The fresh install uses the README's Terminal commands. No third-party compiled assets are distributed in this kit; setup obtains them from package registries.

## Known limits and warnings

The build's main JavaScript bundle is approximately 1.28 MB, or 400 KB gzip, and Vite reports its over-500-KB advisory. The build completed and the asset was served successfully. Code splitting remains a future improvement.

No release-blocking failure was observed in this verification. These checks do not establish performance at large-camp scale, production security, accessibility conformance, staffing adequacy, medical or allergy safety, or complete operational correctness. The independent data audit checks existing assignment constraints, not schedule completeness, optimality or safety.

This release remains a local, single-operator prototype with fictional sample data. It has no production user authorization, tenant isolation or hosted backend. Windows, Linux, Intel Macs and other runtime versions were not tested. The remaining product gaps are stated in README.md and REVIEW_SUMMARY.md.

The download contains a readable verification report rather than local execution logs. Local logs, test databases and provider transcripts are excluded from the release.