OwnServa

← Documentation

Verification — 21 October 2026

Browser checks on the running home, login and privacy pages at 1440px and 390px verified one integrated footer, all eight legal/privacy links exactly once, the retained Contact link, loaded logo images, favicon metadata, no horizontal overflow and no browser runtime errors. Screenshots were visually reviewed. All 17 dashboard tests, TypeScript checks and the production build passed. The built-in imagegen workflow and selected assets are documented in branding.

Legal/privacy increment: migration 016

All 17 Node tests and the production Next.js build passed. New tests cover nullable legal-query results, missing migrations, immutable policy versions and checkout consent, one-use signup acceptance, durable privacy-request intake despite SMTP failure, private request queues, protected account exports and cleanup. Interactive browser fixtures passed registration consent, reason-free unauthenticated withdrawal receipts, separate checkout consent and dialog keyboard/focus behavior. Automated axe checks found no violations across 28 static desktop/mobile page fixtures; this is not a full accessibility conformance audit. See compliance review and deployment blockers. The database and external providers have not been configured or accepted in production.

MFA increment: migration 015

All 15 Node tests passed after adding authenticator MFA. The MFA suite also passed independently after extending account-deletion cleanup coverage. It executes production account actions, adapters, Auth.js session masking and challenge SQL against embedded PostgreSQL: RFC 6238 vectors; encryption tamper/account/purpose/key binding; email-proof/session-bound setup; expiry; session revocation; pending identity/API denial; TOTP/recovery replay; committed per-account throttling; verified-only disabling; and deleting an enrolled identity. Full migration-chain tests include 015. API Go tests and vet passed.

TypeScript strict checking and the optimized Next.js build passed with the new dynamic /mfa route. Interactive Chrome fixtures passed enrollment, recovery acknowledgment/hiding, challenge errors, success/logout redirects, no browser errors and desktop/mobile overflow checks. Recovery, settings and challenge screenshots were visually inspected. Responses were simulated; this is not a live OAuth/SMTP/provider acceptance test. See MFA setup and acceptance.

Completion increment: migrations 010-014 and agent 0.7.0

Checked on the Windows development host on 2026-10-21:

  • All 13 Node tests passed, including PostgreSQL/PGlite migration, invitation role/recipient/last-owner checks, session/email/intent-bound security challenge consumption, deleted identity denial, DNS tenant/generation/proof checks, Git delivery deduplication/coalescing, paid-plan dispatch checks and consent/readiness/failure-based backup scheduling.
  • The repository credential additions passed targeted database checks: viewers and unrelated agents cannot read vault rows; the assigned agent can read its app credential. These tests apply all numbered migrations through 014.
  • Go tests and go vet ./... passed in agent, agent-protocol, API, worker and edge modules. New tests exercise DNS record validation, foreign-zone refusal and readback mismatch, raw GitHub signatures, private archive redirect validation and no cross-origin bearer forwarding, plus cold backup lifecycle opt-in and preserving a previously stopped application.
  • TypeScript strict checking and the optimized Next.js build passed. Native Argon2id hashing/verification remains operational. Linux amd64/arm64 agent 0.7.0 bundles and SHA256SUMS were rebuilt with CGO disabled.
  • Account, Team, DNS, Automation/private-source and backup-schedule components rendered from explicitly labeled static query fixtures in Chrome at 1440px and 390px with no horizontal overflow. Account desktop, DNS mobile and Automation mobile screenshots were visually inspected. This verifies layout only, not interactive or provider acceptance.

No live SMTP/OAuth flow, GitHub private repository or webhook endpoint, PowerDNS zone creation/delegation/DNSSEC chain, Redis scheduled dispatch or Ubuntu/restic downtime/restart/recovery drill was exercised. See completion operations and acceptance for upgrade instructions and remaining requirements. No remote server, provider transaction or production database was modified.

Earlier verification

Phase 5/6 checks pass: optimized Next.js/TypeScript build; all ten Node tests, including the full migration chain through 009; Go tests and vet in API, agent, protocol, worker and edge; Linux amd64/arm64 agent bundles at protocol version 0.6.0. The commercial/advanced SQL test also passed independently after the final changes.

New checks cover tenant and platform-admin boundaries, captured checkout prices, idempotent receipts, wrong-amount denial, sandbox/live entitlements, refund review holds, cancellation without verified payment, unpaid grace denial, one in-flight advanced job, worker billing denial, stale jobs, regional fallback/recovery preference, server-scoped custom aliases and expired ownership proofs. Go tests exercise raw-body webhook signatures, monthly provider price mismatch, hosted redirect restrictions, model download inventory verification, private runtime redirect denial, server-scoped immutable recovery payloads, exact Open WebUI authentication settings, archive safety/manifests/byte budgets, and read-only/no-copy backup helpers with foreign-volume rejection.

Billing (including administrator pricing controls), Domains, Marketplace, AI Models, Backups and Monitoring rendered using labeled static query fixtures in headless Chrome at 1440px and 390px, without horizontal overflow. Billing, domain mobile layout and monitoring charts were visually inspected. These fixtures prove layout only; they do not establish live provider behavior.

No merchant credentials, registrar balance, Ubuntu Docker/restic runtime or real regional gateways were available. Sandbox/live merchant transactions, native recurring renewals, refunds, registrar purchases, actual template startup, model downloads, backup/recovery drills and DNS failover remain the acceptance steps in Phase 5 and Phase 6. No payment, domain purchase, deployment or remote server modification was performed.

Earlier Phase 3/4 checks also passed: the dashboard production build, nine Node tests, Go tests and vet across API/agent/protocol/worker/edge, Linux amd64/arm64 agent cross-builds, installer syntax and npm production dependency audit (zero reported vulnerabilities at that check). Database tests exercise deployment/tunnel RLS, release ownership, viewer log restrictions, worker privileges, scoped gateway authorization and revocation. Go tests cover AES-GCM tenant binding/tamper rejection, archive traversal/symlink rejection, constrained Docker creation, release health headers, FRP capability/hostname denial, certificate ask gating, DNS zone scoping/provider readback and TLS-pinned TOML generation. An additional progress retry test covers immutable log batches after buffer growth.

Applications, the deployment wizard and networking were rendered with explicitly labeled static query fixtures at 1440px and 390px in headless Chrome, inspected visually and checked for horizontal overflow. This validates layout, not a live deployment or DNS service. No Ubuntu/Docker, Redis integration, BuildKit runtime, real FRP transport, delegated DNS or ACME issuance was tested. Phase 3/4 operations documents list required acceptance checks and remaining feature limits.

Passed locally:

  • TypeScript strict type check.
  • Next.js optimized production build.
  • Seven Node test cases, including native Argon2id hashing/verification and embedded PostgreSQL (PGlite) migration/lifecycle tests for both phases.
  • PostgreSQL constraints, real RLS denial of foreign-tenant organization reads, refusal of unauthorized updates, unexpired/expired/forged session lookup, single-use reset consumption, session revocation, and unique identities.
  • Go middleware tests (missing/forged/expired sessions, database outage, valid principal) and owner/admin role policy tests.
  • go vet ./....
  • Agent and shared-protocol Go tests: signed requests/body/path tampering, timestamp expiry, server-scoped action validation, strict JSON, pairing attempt limiter, hardware parsers, HTTPS restrictions, corrupt key/journal rejection, and Docker label checks plus verified state transitions with a fake transport.
  • Phase 2 PostgreSQL tests: single-use and expired pairing, RLS-hidden foreign servers/credentials, viewer mutation denials, duplicate in-flight command prevention, persisted nonce uniqueness, at-most-once dispatch, and revoked-key lookup rejection.
  • Linux amd64/arm64 agent cross-builds and generated SHA256SUMS; installer bash -n syntax check.
  • npm dependency audit: zero known vulnerabilities in the resolved lockfile.
  • Chrome desktop/mobile layout and form smoke tests, no horizontal overflow or browser errors, disabled unconfigured OAuth providers, dashboard login redirect, unauthenticated API 401, cross-origin mutation 403, malformed JSON-object input 400.
  • Server-list component desktop/mobile visual checks using an explicitly labeled static fixture, not live server telemetry. No horizontal overflow.

PGlite tests execute the migration with only the unused pgcrypto extension declaration omitted; UUID generation is available in PostgreSQL core. This is not a live Docker/PostgreSQL network test. Middleware tests use a fake session repository and do not prove provider behavior.

Not executed here: Docker Compose startup (Docker is unavailable), live Google/GitHub OAuth (no provider credentials), SMTP delivery and full registration-to-login against deployed PostgreSQL. Follow docs/authentication.md to verify these with configured services. No deployment, purchase, or billing action was performed.

Phase 2 runtime limitations: no Ubuntu distribution/Docker daemon is available on this Windows host, so real hardware sampling, systemd installation/restarts, remote HTTPS pairing, actual Docker socket commands, and a live API-to-agent lifecycle remain Ubuntu acceptance checks in docs/phase-2.md. No customer machine was paired or modified.

22 October 2026 site and administration update

See Platform Admin for migration 017, user visibility, encrypted OAuth configuration, contact intake, consent-based visits and public-page SEO. Single-link server setup serves verified versioned binaries and keeps the pairing secret out of HTTP URLs. Optional analytics are off until consent; policy publication remains an operator review step.

Site release checks

All 20 Node tests pass, including administrator authorization, authenticated encryption/tamper rejection, provider disable precedence, private-table permissions, contact validation/queue/rate limits, consent signals, analytics deduplication and ephemera cleanup. TypeScript and the production Docker build pass. Live HTTPS checks cover all footer destinations, 18 hosted Markdown guides and their local links, sitemap, robots and social image; contact submission appears in the administrator inbox and its status can be updated. Essential-only sends no visit events; opt-in creates the optional secure HttpOnly session cookie, withdrawal clears it, and GPC forces essential-only. Public Contact Us, documentation, privacy and setup pages pass desktop/mobile overflow and WCAG axe checks.

The real generated setup command paired a signed-heartbeat agent in an isolated Ubuntu 24.04 container. The test simulated systemctl and validated the actual generated unit separately; it is not a production-host reboot test. Repeated installation preserved the existing identity and a tampered bootstrap was refused. The temporary agent/server was removed. Actual SMTP delivery, real Google/GitHub credentials, merchant/registrar transactions and customer deployment infrastructure remain untested and disabled until configured. Policy review/publication remains outstanding.