docs/review_gate.md

# ProofFrame Review Gate

Date: 2026-06-27 Asia/Shanghai  
Reviewer: proofframe-hackathon-reviewer  
Scope: security, compliance, submission risk, Devpost/B2/Genblaze blockers, and public claim boundaries.

## Verdict

**HOLD for final Devpost submission.**

The repo is directionally safe for continued MVP work: no obvious committed secrets were found, `.env.example` is blank, `.gitignore` excludes local secrets and generated runtime folders, and the current implementation is honest about local/mock infrastructure versus final live sponsor proof.

It is **not ready for final submission** because the mandatory Backblaze B2 and Genblaze paths are implemented but not verified with live credentials yet, the Devpost project submission remains incomplete, and the final demo video/evidence package is not ready.

## Blocking Risks

1. **Backblaze B2 requirement is not satisfied yet.** The repo now includes a B2 S3-compatible storage backend and fake-client tests, but `tasks.json` still lists `T020` as doing because no live B2 bucket/key proof has been captured. Do not claim a working B2-backed run until an asset and manifest are stored in a dedicated B2 bucket using environment-only credentials.

2. **Genblaze proof is captured through the credential-free local Pipeline provider.** The repo includes Genblaze provider paths for GMICloud, OpenAI, and local Pipeline execution around the official Pipeline API. `T021` is done with sanitized final evidence, while public video, final audit, and Devpost receipt remain gated before the final submission can be called complete.

3. **Devpost registration is complete, but submission is not.** `T040` is done and `T042` is todo. The final project page should not be submitted until live B2/Genblaze proof, final audit, and final secret scan pass.

4. **Final submission assets are incomplete.** The public mock app URL, screenshots, repo URL, setup README, Devpost draft, and evidence package exist. The final package still needs live B2/Genblaze evidence, the final provider/model list, a demo video under the event limit, and clear B2/Genblaze usage explanation based only on verified live runs.

5. **Draft pitch can overclaim if final-gate wording is used too early.** `docs/devpost_draft.md` separates safe-before-live wording from safe-after-live wording. Until T020/T021 are complete, public copy must keep saying "local mock mode", "B2-compatible adapter", and "Genblaze provider path" rather than claiming live B2 storage or live Genblaze generation.

## Non-Blocking Risks

1. **Deadline and prize facts were recently corrected.** Current docs align with the scout report's Eastern Time / Beijing 05:00 deadline and $7,000 / $2,000 / $1,000 prize split. Recheck the official Devpost rules before final submission because these are public factual claims.

2. **Participant count is dynamic.** Avoid using an exact participant count as a current competitive claim unless it is freshly checked on Devpost.

3. **System Python is not a valid verification environment.** `python3 -m pytest` failed because the system interpreter has no `pytest` module, while the project venv passed. Final gates should use the project venv or Docker image.

4. **Public repo vs private repo remains a tradeoff.** The current repo is public for judge friction reduction. Keep using environment variables and the evidence safety gate so live B2/Genblaze credentials never enter public history.

5. **Generated sample media needs IP review.** Demo assets should avoid trademarks, copyrighted characters, private likenesses, copyrighted music, or brand-confusing prompts unless rights are explicit.

## Recommended Gates

1. **Gate A: B2 proof.** Create a dedicated B2 bucket and least-privilege application key. Run one end-to-end storage flow that uploads media and manifest, records sanitized object keys/checksums, and fails closed when B2 env vars are absent.

2. **Gate B: Genblaze proof.** Run one real Genblaze or Genblaze-compatible generation flow, capture provider/model/request metadata in the manifest, and document the fallback path when credits or remote provider access are unavailable.

3. **Gate C: Claim freeze.** Before recording the video or publishing Devpost text, grep all public docs for future-tense integration claims and update them to match verified behavior only.

4. **Gate D: Submission evidence.** Prepare English Devpost text, public demo video, screenshots, working app URL or Docker instructions, repo URL, AI provider/model list, and explicit "How we use Backblaze B2 and Genblaze" section.

5. **Gate E: Verification.** Run unit tests, API smoke, browser happy-path smoke, Docker build/run, secret scan, evidence safety gate, and final `git status --short --branch` before submission.

6. **Gate F: Manual Devpost check.** Confirm registration, eligibility, team representative, final deadline timezone, rules language, app access requirements, and repo access requirements in the official Devpost UI.

## Secret Hygiene Checklist

- [x] `.env.example` contains placeholder keys only.
- [x] `.gitignore` excludes `.env`, `.env.*`, `.venv/`, cache directories, `var/`, build outputs, and `node_modules/`.
- [x] Repo scan found no obvious committed API keys, B2 credentials, Devpost cookies, bearer tokens, or application keys.
- [ ] Use only least-privilege B2 application keys for demo/deployment.
- [ ] Keep B2, Genblaze, provider, Devpost, and judge-account credentials in environment variables or the hosting secret store only.
- [x] `scripts/api_smoke.py --evidence-out` refuses secret-like keys, bearer tokens, signed URL parameters, and GMI-style key values before writing evidence JSON.
- [ ] Do not print full signed URLs, application keys, access keys, bearer tokens, cookies, or private bucket paths in logs, screenshots, demo video, or exported manifests.
- [ ] Redact or hash sensitive object identifiers if public screenshots show storage details.
- [ ] Ensure `var/`, generated private media, downloaded credentials, local SQLite files, and browser session artifacts are never force-added.
- [ ] Rotate demo credentials after public judging if they were exposed to a deployment, test account, or shared judge environment.
- [ ] Run a final secret scan immediately before the submission/release commit.

## Checks Performed

- Confirmed working directory with `pwd`.
- Confirmed branch/status with `git status --short --branch`.
- Ran `git pull --ff-only`; repository was already up to date.
- Read `AGENTS.md`, `README.md`, `docs/research.md`, `docs/prd.md`, `docs/spec.md`, `docs/submission.md`, `docs/devpost_draft.md`, `docs/evidence_package.md`, and `tasks.json`.
- Also read `docs/scout_report.md`, `.env.example`, `.gitignore`, and current implementation files relevant to B2/Genblaze/storage claims.
- Ran repository file listing and secret-pattern search.
- Current local gate includes `ruff check .`, `pytest`, `scripts/secret_scan.py`, and public/local API smoke checks.
- Latest full test pass after task/evidence safety improvements: 18 passed.