SessionVault
Core workflow checkedAuthenticated search and history retrieval worked during the review.
Scope limit: Broader access controls, uptime and customer-scale use were outside this check.
Explore projectEngineering notes / checked October 15, 2026
Built, checked,
and documented.
A working demo is a starting point. I want to know which workflow works, what evidence supports it, and where the limits are.
This is the process used to review my products and supporting tools, with AI assistance. The results below are a dated snapshot of specific checks, not an independent certification or a guarantee about every feature.
Fifth verification pass / October 15, 2026
Broader tests passed. Release gaps surfaced.
BoxAI passed its full 161-test suite. These include the earlier 15 selected checks. The suite uses mock services and local fixtures; live phone inference remains separate.
APK signature verification passed for nine installed test-phone packages and four public downloads. Six installed APKs and three public downloads carry the standard Android Debug certificate. Signature integrity and release signing are different checks.
What the public install page actually serves
| Public download | Version | Signature | Certificate |
|---|---|---|---|
| RingBlast-Twilio | 1.0.0 (build 1) | Valid | Android Debug |
| RingBlast-SMS | 1.0.0 (build 1) | Valid | Android Debug |
| Sown | 1.0.3 (build 4) | Valid | Other certificate; identity not audited |
| Dispatch | 1.3.1 (build 14) | Valid | Android Debug |
Each public build above is older than its counterpart measured on the designated test phone. The install page labels them release builds; compilation mode does not establish production signing. Release-signing provenance and download-version alignment need review.
The four downloads were inspected without installation or execution. APK verification does not establish safety, signer ownership, store approval or working application behavior. BoxAI, Sown and Office installed APKs used other certificates; those identities were not audited. Other installed APKs inspected—JoySpark, Dispatch, MicBlast, both RingBlast variants and PostMaster—used Android Debug certificates.
Earlier source, Office roundtrip and Session Loop hook results remain on the product cards. Device workflows and authenticated integrations still need the explicitly listed checks.
13public pages returned successful HTTP responses
229archived files matched their recorded checksums
18package manifests checked, with no listed files missing
Those measurements cover the URLs and archive files checked on October 15. They do not count customers, revenue, production applications, or every file in every project.
The verification process
Start with a claim. Finish with evidence.
Identify the product
Separate a product from its variants, internal components and concepts. Record the source, build and date before assigning a release label.
Check the artifact
Locate the files, compare recorded checksums and inspect relevant build markers. An intact package proves the archived bytes match, not that the application is correct or securely signed.
Exercise a workflow
Use a small, repeatable input with an expected result. Observe the output, then change an input when recalculation or persistence is part of the claim.
Record the boundary
Capture the result and its scope. Mark prior test reports separately from fresh checks, and describe the next test needed before making a stronger claim.
Evidence levels: a page response establishes availability; an artifact check establishes archive integrity; a workflow check establishes the tested behavior. Prior records and concepts remain labeled as such. No one level substitutes for the others.
An example from this review
Importing a value is different from preserving a formula.
The sample spreadsheet contained SUM(B1:C1), with inputs 7 and 11 and a result of 18. GXT Office imported those displayed values. After B1 changed to 9, B2 still showed 18 instead of the expected 20.
Result: text and numeric-value import passed for the sample; formula-preserving XLSX import did not. The same sample also lost its original sheet name. The project description now distinguishes these capabilities.
DOCX paragraph import and PPTX text import also passed with small synthetic files. These checks do not establish complex formatting, image preservation, or full Office-format compatibility.
Project results
What the checks established.
These summaries cover customer-facing products and selected prototypes. Related variants are grouped; internal workflows and concepts are not presented as additional production applications.
GXT Office
Workspace roundtrip and native formula checkedThe exported JSON workspace was inspected and reopened after replacing the document with a temporary synthetic marker; the original two DOCX paragraphs returned. Spreadsheet values and PPTX text were present. A native SUM(B1:C1) formula survived reload and recalculated from 20 to 21 after B1 changed from 9 to 10.
Scope limit: Native workspace persistence is distinct from XLSX import: the earlier XLSX formula and sheet-name loss remains unresolved. Sample text/value roundtrip does not establish complex formatting, all formulas, Android file opening or cross-device compatibility.
Explore projectPlayPage
Interactive workflow checkedThe demo loaded, its arcade overlay opened, and switching to Barrel Run displayed the game controls and state.
Scope limit: Score persistence, feedback submission and integration on other sites were not tested.
Explore projectPostMaster
Backend health; debug-signed pilotBackend health previously reported version 1.3.0, an empty queue and a healthy eBay connection. The installed Android 2.4.15 build 33 APK passed signature verification and carries an Android Debug certificate.
Scope limit: Backend health is not a listing readback. No fresh capture-to-marketplace journey was performed. Release signing, marketplace holds and end-to-end completion remain open.
Explore projectBoxAI
161 existing tests passedBoxAI is a local AI application that uses multiple local LLMs and keeps your data local. Product architecture clarified by the founder October 16, 2026.
The complete existing suite passed all 161 tests with fake services, mocked clients and local loopback fixtures. Coverage includes capture, voice, layouts, routing, operator requests and SessionVault handling. The installed 1.3.0 build 6 APK also passed signature verification and did not use the standard Android Debug certificate.
Scope limit: The earlier 15 checks are included in these 161, not additional tests. The suite uses mocks and local fixtures; live phone inference and signing-owner identity were not verified. The product description is distinct from an independent data-flow or privacy audit.
Explore projectRingBlast
Decision tests and APK signatures checkedSix decision-logic tests passed previously. Installed calling and SMS APKs passed signature verification but carry Android Debug certificates. Public calling 1.0.0 build 1 and SMS 1.0.0 build 1 also verify with Android Debug certificates; test-phone versions were calling 1.0.13 build 17 and SMS 1.0.0 build 2.
Scope limit: A valid signature is not release signing or legal compliance. Public binaries differ from test-phone versions. No calls, SMS, delivery, approval or store availability was tested.
Explore projectGXT Office Mail
Health and rejection controls checkedThe missing smoke entry point was restored. Running the advertised command passed four assertions: HTTP 200, expected service identity, healthy status and SMTP ready. The local service reported version 0.1.0.
Scope limit: Four additional live rejection checks returned the expected 401 for missing/invalid bearer tokens, 403 for an unapproved origin and 404 for an unsupported method. Health/SMTP verification and negative requests only; no message was sent. Authenticated IMAP reads, draft/attachment handling, recipient enforcement and successful delivery remain unverified.
Explore projectSession Keeper
6 classifier + 8 simulated recovery checks passedThe shipped classifier passed synthetic checks for login redirect query strings, HTTP 401, HTTP 403, ambiguous HTTP 200, known authenticated URLs and tab login precedence.
Scope limit: Eight additional checks exercised the shipped cookie/storage functions with synthetic Chrome APIs, covering missing/stale vaults, snapshots, prior versions, cookie flags, host-only cookies, expiry and empty snapshots. Real browser recovery, monitoring and installation were not exercised. The public page describes an unpacked staging extension.
Explore projectSession Loop
4 isolated startup-hook checks passedThe original v0.1.0 package was located. Its actual SessionStart command passed four checks under Git Bash with a disposable custom memory folder: missing-index onboarding, existing-index loading, observing an updated index in a new process and leaving the index unchanged.
Scope limit: This exercises the packaged hook outside Cowork. Plugin installation, automatic host invocation and the add/show/next/update conversational workflows remain unverified. The public acquisition path still requires an email handoff.
Explore projectEasySell
Setup boundary checkedThe public site is a family setup guide linking to Tailscale and instructing users to install the app package when ready.
Scope limit: No direct EasySell package download or browser capture flow was offered on the inspected page. Package delivery and capture-to-queue handoff remain unverified.
Explore projectSown
3 tests and APK signatures checkedThree source/widget tests passed previously. Installed 1.0.3 build 5 and public 1.0.3 build 4 APKs passed signature verification; neither used the standard Android Debug certificate.
Scope limit: A different certificate does not establish signing-owner identity or store readiness. Public and test-phone builds differ. Real planner persistence, parent controls and sharing remain unverified.
Explore projectDispatch
18 tests; signing gap identifiedAll 18 mock/widget tests passed previously. Installed 1.4.0 build 16 and public 1.3.1 build 14 APKs both passed signature verification and both use Android Debug certificates.
Scope limit: Mocked transport is not live delivery. Public download is older than the inspected test-phone build; release signing and version alignment need review before a customer-ready release claim.
JoySpark
5 engine tests; debug-signed pilotFive local-engine tests passed previously. The installed 1.0.0 build 2 APK passed signature verification and carries an Android Debug certificate.
Scope limit: Current device interaction, persistence, production release signing and store distribution remain unverified.
Explore projectMicBlast
3 metadata tests; debug-signed prototypeThree recording-metadata/helper tests passed previously. The installed 1.0.0 build 1 APK passed signature verification and carries an Android Debug certificate.
Scope limit: Tests use mocked preferences. Real microphone capture, audio-file persistence, playback, release signing and live delivery remain unverified.
FieldPilot
9 deterministic source tests passedRestoring exact locked dependencies allowed all nine existing pricing-engine tests to pass, covering pay-path selection, distance tiers, trip-charge behavior and fail-loud guards.
Scope limit: The tests run the deterministic engine in code. No live work order, offer or counter was created. Current field-service UI, mobile deployment and marketplace integration remain unverified.
Explore projectWhat happens next
Each stronger claim needs a stronger test: mobile core flows on the current build, authenticated integrations, persistence after restart, and complete operator handoffs. A later build or deployment can change these results, so the check date and limitations travel with the evidence.