docs/review_gate.md

ProofFrame Review Gate

Date: 2026-06-27 Asia/Shanghai
Reviewer: proofframe-hackathon-reviewer
Scope: security, compliance, submission risk, Devpost/B2/Genblaze blockers, and public claim boundaries.

Verdict

HOLD for final Devpost submission.

The repo is directionally safe for continued MVP work: no obvious committed secrets were found, .env.example is blank, .gitignore excludes local secrets and generated runtime folders, and the current implementation is honest about local/mock infrastructure versus final live sponsor proof.

It is not ready for final submission because the mandatory Backblaze B2 and Genblaze paths are implemented but not verified with live credentials yet, the Devpost project submission remains incomplete, and the final demo video/evidence package is not ready.

Blocking Risks

1. Backblaze B2 requirement is not satisfied yet. The repo now includes a B2 S3-compatible storage backend and fake-client tests, but tasks.json still lists T020 as doing because no live B2 bucket/key proof has been captured. Do not claim a working B2-backed run until an asset and manifest are stored in a dedicated B2 bucket using environment-only credentials.

2. Genblaze proof is captured through the credential-free local Pipeline provider. The repo includes Genblaze provider paths for GMICloud, OpenAI, and local Pipeline execution around the official Pipeline API. T021 is done with sanitized final evidence, while public video, final audit, and Devpost receipt remain gated before the final submission can be called complete.

3. Devpost registration is complete, but submission is not. T040 is done and T042 is todo. The final project page should not be submitted until live B2/Genblaze proof, final audit, and final secret scan pass.

4. Final submission assets are incomplete. The public mock app URL, screenshots, repo URL, setup README, Devpost draft, and evidence package exist. The final package still needs live B2/Genblaze evidence, the final provider/model list, a demo video under the event limit, and clear B2/Genblaze usage explanation based only on verified live runs.

5. Draft pitch can overclaim if final-gate wording is used too early. docs/devpost_draft.md separates safe-before-live wording from safe-after-live wording. Until T020/T021 are complete, public copy must keep saying "local mock mode", "B2-compatible adapter", and "Genblaze provider path" rather than claiming live B2 storage or live Genblaze generation.

Non-Blocking Risks

1. Deadline and prize facts were recently corrected. Current docs align with the scout report's Eastern Time / Beijing 05:00 deadline and $7,000 / $2,000 / $1,000 prize split. Recheck the official Devpost rules before final submission because these are public factual claims.

2. Participant count is dynamic. Avoid using an exact participant count as a current competitive claim unless it is freshly checked on Devpost.

3. System Python is not a valid verification environment. python3 -m pytest failed because the system interpreter has no pytest module, while the project venv passed. Final gates should use the project venv or Docker image.

4. Public repo vs private repo remains a tradeoff. The current repo is public for judge friction reduction. Keep using environment variables and the evidence safety gate so live B2/Genblaze credentials never enter public history.

5. Generated sample media needs IP review. Demo assets should avoid trademarks, copyrighted characters, private likenesses, copyrighted music, or brand-confusing prompts unless rights are explicit.

Recommended Gates

1. Gate A: B2 proof. Create a dedicated B2 bucket and least-privilege application key. Run one end-to-end storage flow that uploads media and manifest, records sanitized object keys/checksums, and fails closed when B2 env vars are absent.

2. Gate B: Genblaze proof. Run one real Genblaze or Genblaze-compatible generation flow, capture provider/model/request metadata in the manifest, and document the fallback path when credits or remote provider access are unavailable.

3. Gate C: Claim freeze. Before recording the video or publishing Devpost text, grep all public docs for future-tense integration claims and update them to match verified behavior only.

4. Gate D: Submission evidence. Prepare English Devpost text, public demo video, screenshots, working app URL or Docker instructions, repo URL, AI provider/model list, and explicit "How we use Backblaze B2 and Genblaze" section.

5. Gate E: Verification. Run unit tests, API smoke, browser happy-path smoke, Docker build/run, secret scan, evidence safety gate, and final git status --short --branch before submission.

6. Gate F: Manual Devpost check. Confirm registration, eligibility, team representative, final deadline timezone, rules language, app access requirements, and repo access requirements in the official Devpost UI.

Secret Hygiene Checklist

• .env.example contains placeholder keys only.
• .gitignore excludes .env, .env.*, .venv/, cache directories, var/, build outputs, and node_modules/.
• Repo scan found no obvious committed API keys, B2 credentials, Devpost cookies, bearer tokens, or application keys.
• Use only least-privilege B2 application keys for demo/deployment.
• Keep B2, Genblaze, provider, Devpost, and judge-account credentials in environment variables or the hosting secret store only.
• scripts/api_smoke.py --evidence-out refuses secret-like keys, bearer tokens, signed URL parameters, and GMI-style key values before writing evidence JSON.
• Do not print full signed URLs, application keys, access keys, bearer tokens, cookies, or private bucket paths in logs, screenshots, demo video, or exported manifests.
• Redact or hash sensitive object identifiers if public screenshots show storage details.
• Ensure var/, generated private media, downloaded credentials, local SQLite files, and browser session artifacts are never force-added.
• Rotate demo credentials after public judging if they were exposed to a deployment, test account, or shared judge environment.
• Run a final secret scan immediately before the submission/release commit.

Checks Performed

• Confirmed working directory with pwd.
• Confirmed branch/status with git status --short --branch.
• Ran git pull --ff-only; repository was already up to date.
• Read AGENTS.md, README.md, docs/research.md, docs/prd.md, docs/spec.md, docs/submission.md, docs/devpost_draft.md, docs/evidence_package.md, and tasks.json.
• Also read docs/scout_report.md, .env.example, .gitignore, and current implementation files relevant to B2/Genblaze/storage claims.
• Ran repository file listing and secret-pattern search.
• Current local gate includes ruff check ., pytest, scripts/secret_scan.py, and public/local API smoke checks.
• Latest full test pass after task/evidence safety improvements: 18 passed.