feat: eShop holdout witness GREEN both lanes — parity, determinism, mutation-red, locality

T024 u6 (freeze 27741d9c intact, verified): surface decision measured from the
app's own bytes — declared same-origin loopback projection (purchaseUrl:'' makes
catalog.service.ts's own URL concatenation resolve same-origin; both bundles
carry zero external runtime URLs, so no mocked seams exist to declare; one
projection factory serves both lanes). Five journey legs with real interactions
(catalog render, genuine wheel scroll on real overflow, server-paged
Next/Previous, type filter, stacked brand filter), pins measured not assumed
(native select type-ahead vs ArrowDown; the "null" facet id). Results: parity
digest 585ae9ec across all 4 runs; per-lane pass-twice determinism; mutation at
byte offset 391975 red -> byte-identical restore reproducing parity;
successfulNonLoopback 0; 0 console errors / failed requests. Honest surface
records: identity/basket/orders/campaigns out-of-surface, SignalR not-reached,
text-entry/drag not-tested. Suite green; no canonical publish (next unit).

Claude-Session: https://claude.ai/code/session_01HEVhWgWk9AXTiFMysQNB5r

Author: thejackshelton

evidence/runs/angular-eshop-webspa/receipt.json

@@ -0,0 +1,54 @@
+# eShop WebSPA holdout — browser-parity Witness
+
+- Result: pass
+- Unit: lrapr-t024/u6-eshop-witness-journeys
+- Fixture: angular-eshop-webspa-netcore2-2
+- Source: dotnet-architecture/eShopOnContainers@a387f21029f0b2d49614d165d5384717d2398f8e
+- Adapter composite: 27741d9c8bfac1b6bb0b330423b1cf258fcde722f548ecb9cf8b389cc98e4234
+- Behavior parity digest: 585ae9ecdf637ace7031624b00750a3c03c7f8f900e60017c55b8ee4f973a363
+- Canonical digest: 92fa51439620c5801ad9c14edd6883fa3b387f08f9de56f7acdebca50b214449
+
+## Lanes
+
+| Lane | Output | Files | Inventory sha256 | Semantic digest |
+| --- | --- | --- | --- | --- |
+| baseline | .versionless/work/angular-eshop-webspa/build-run1 | 25 | 73e265d981f0a1cca5c339ecb331c28dd41572d43855bc392f28532290325158 | 6dc103f894d5675893cc3b7d21f8c9fd573c10c35e1313d00cda8979c98cfc0c |
+| migrated | .versionless/work/angular-eshop-webspa/target/app/wwwroot | 25 | 3b859e5b508c1e3fada6dea2addc0d42120861a2364cb0cd13fa79187fc5ecad | ed7ee72271f55ea09cebf4b1ed0240faa40312a0e4488d404553980db4a9cec7 |
+
+## Declared same-origin projection
+
+- Label: synthetic-fixture-evidence-data
+- Transport: same-origin-bounded-loopback-api
+- Behavior digest: 747dc5258b30703c9b29f3c0087e1728e93fc160f1cbf3c53f9589ee09aad849
+- Seed: fixtures/angular-eshop-webspa/witness-projection-seed.json (0331b52060f5d9e3cba94108536ed5e854f98c3e4652dffcb7c78aceacdeac08)
+- Ledger: 8 served, 0 refused-unknown, 0 refused-unprojected, 18 declined-non-api
+- Identical across both lanes: yes
+
+## Surface limits
+
+- **identity** (out-of-surface) — SecurityService.Authorize() navigates the document to an IdentityServer '/connect/authorize' endpoint; no identity provider is projected, so Login is never exercised and nothing behind it is claimed.
+- **basket** (out-of-surface) — the add-to-cart control renders disabled for an anonymous visitor and esh-basket-status is not rendered at all, so no basket behavior is exercised or claimed.
+- **orders** (out-of-surface) — the orders routes are reachable only from the authenticated identity menu.
+- **campaigns** (out-of-surface) — campaigns are gated behind both identity and the configuration switch, which the declared payload leaves off.
+- **signalr** (not-reached) — SignalrService.init() returns before building a hub connection unless the visitor is authorized, so the anonymous run opens no socket.
+- **text-entry** (not-tested) — the anonymous catalog surface has no text input; the journey drives clicks, keyboard selection and a genuine wheel scroll, and claims no typing coverage.
+- **drag** (not-tested) — the anonymous catalog surface has no drag affordance.
+
+## Mutation
+
+- Seam: ` products - Page ` in main.f02d2dbc7ec47246.js
+- Before: d8338270edad07a2f37828def4369e9325f761c787b992c68dd03177a7f710bf
+- Mutated: 65f40188b0b7641632ecbdde6e29147c468a23c029695213bd6733459bbf4588
+- After restore: d8338270edad07a2f37828def4369e9325f761c787b992c68dd03177a7f710bf
+- Restored run: pass
+
+## Non-claims
+
+- This is one Angular holdout under direct Witness. It does not establish generic Angular support, a designated pilot, or readiness beyond this exact lineage cell, and it is not counted in any lineage numerator.
+- The API this journey talks to is a frozen synthetic same-origin loopback projection authored for this fixture, NOT the eShopOnContainers .NET microservices. No captured production payload, no real catalogue, no real account and no real user data are involved, and nothing here is evidence about those services.
+- The synthetic catalogue deliberately does not reproduce the upstream seed data, so nothing here should be read as evidence about the real catalog service or its contents.
+- Identity is out of surface. No IdentityServer is projected, Login is never exercised, and every surface behind it — basket, orders, campaigns, the SignalR hub — is unproven rather than proven absent.
+- Text entry and drag are not tested, because the anonymous catalog surface offers neither.
+- The application's own test suites were not run; this is a browser proof of the journeys named above, not a substitute for the upstream suite.
+- Locality is process-scoped and does not establish operating-system-wide isolation.
+- Receipts prove reproducibility and hash integrity, not certification, authenticity, signer identity, compliance, or an earned SLSA level.

evidence/runs/angular-eshop-webspa/receipt.md

@@ -0,0 +1 @@
+{"afterRestoreSha256":"d8338270edad07a2f37828def4369e9325f761c787b992c68dd03177a7f710bf","beforeSha256":"d8338270edad07a2f37828def4369e9325f761c787b992c68dd03177a7f710bf","failure":"witness-semantic-assertion","intendedFailure":true,"lane":"migrated","mutatedSha256":"65f40188b0b7641632ecbdde6e29147c468a23c029695213bd6733459bbf4588","offset":391975,"path":"main.f02d2dbc7ec47246.js","restoredBehaviorDigest":"585ae9ecdf637ace7031624b00750a3c03c7f8f900e60017c55b8ee4f973a363","restoredByteIdentically":true,"restoredRun":"pass","seam":" products - Page "}

evidence/runs/angular-eshop-webspa/witness-journeys.json

@@ -0,0 +1 @@
+{"behaviorDigest":"747dc5258b30703c9b29f3c0087e1728e93fc160f1cbf3c53f9589ee09aad849","label":"synthetic-fixture-evidence-data","lane":"baseline","note":"the ordered ledger the first run wrote; the receipt digests the same records tallied by identity, because the application fires several of its mount requests concurrently and the ORDER is a property of the event loop rather than of the application","pass":1,"pinnedCommit":"a387f21029f0b2d49614d165d5384717d2398f8e","records":[{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":0,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/styles.46f5cd1d7bb315d9bfa5.css","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":1,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/runtime.06daa30a2963fa413676.js","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":2,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/polyfills.9c13d4b8715c4c91719d.js","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":3,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/main.8806b64b40dd575952be.js","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":4,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/Montserrat-Regular.4889ec5f0aca42530472.woff","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":5,"status":null},{"decision":"served","endpoint":"home.configuration","method":"GET","pathname":"/Home/Configuration","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"ba2508b6c64bf3a19c1baca78420ed8504171c6698f3b213d7064d0ac76f36a4","search":"","sequence":6,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":7,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand_dark.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":8,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/main_footer_text.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":9,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/arrow-right.svg","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":10,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/main_banner.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":11,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/arrow-down.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":12,"status":null},{"decision":"served","endpoint":"catalog.brands","method":"GET","pathname":"/api/v1/c/catalog/catalogbrands","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"5033f785dc96c17e17ccb2ae8b743b76eec073822909d7ff5aa6cbf09bae8828","search":"","sequence":13,"status":200},{"decision":"served","endpoint":"catalog.items","method":"GET","pathname":"/api/v1/c/catalog/items","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"4058815de5b55d915a3c7a998752579275df7371cd3c4f6aaf9bda875643b211","search":"?pageIndex=0&pageSize=10","sequence":14,"status":200},{"decision":"served","endpoint":"catalog.types","method":"GET","pathname":"/api/v1/c/catalog/catalogtypes","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"776a8825bce91ff3c9d2e398f6840a02772919cd9d0f1a065cb823f2dd6419e6","search":"","sequence":15,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":16,"status":null},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/Montserrat-Bold.57f17c74bfbb64a9df24.woff","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":17,"status":null},{"decision":"served","endpoint":"catalog.items","method":"GET","pathname":"/api/v1/c/catalog/items","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"d91e1697aa676de80fb9d9b0ea2040552a8cc4292666e35fcbbe2de8c222ac68","search":"?pageIndex=1&pageSize=10","sequence":18,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":19,"status":null},{"decision":"served","endpoint":"catalog.items","method":"GET","pathname":"/api/v1/c/catalog/items","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"4058815de5b55d915a3c7a998752579275df7371cd3c4f6aaf9bda875643b211","search":"?pageIndex=0&pageSize=10","sequence":20,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":21,"status":null},{"decision":"served","endpoint":"catalog.items.filtered","method":"GET","pathname":"/api/v1/c/catalog/items/type/1/brand/","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"5294830c3befb34629aaec292644c76a43c9519b396924a5afb456fb779f467f","search":"?pageIndex=0&pageSize=10","sequence":22,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":23,"status":null},{"decision":"served","endpoint":"catalog.items.filtered","method":"GET","pathname":"/api/v1/c/catalog/items/type/1/brand/2","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":"060df5f9eb8b0e8948c2e4a566bbe6aaa26173cab52e96f6682f364b68d737c9","search":"?pageIndex=0&pageSize=10","sequence":24,"status":200},{"decision":"declined-non-api","endpoint":null,"method":"GET","pathname":"/assets/images/brand.png","requestSha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","responseSha256":null,"search":"","sequence":25,"status":null}],"seedFixture":"fixtures/angular-eshop-webspa/witness-projection-seed.json","seedSha256":"0331b52060f5d9e3cba94108536ed5e854f98c3e4652dffcb7c78aceacdeac08","surfaceLimits":[{"reason":"SecurityService.Authorize() navigates the document to an IdentityServer '/connect/authorize' endpoint; no identity provider is projected, so Login is never exercised and nothing behind it is claimed.","state":"out-of-surface","surface":"identity"},{"reason":"the add-to-cart control renders disabled for an anonymous visitor and esh-basket-status is not rendered at all, so no basket behavior is exercised or claimed.","state":"out-of-surface","surface":"basket"},{"reason":"the orders routes are reachable only from the authenticated identity menu.","state":"out-of-surface","surface":"orders"},{"reason":"campaigns are gated behind both identity and the configuration switch, which the declared payload leaves off.","state":"out-of-surface","surface":"campaigns"},{"reason":"SignalrService.init() returns before building a hub connection unless the visitor is authorized, so the anonymous run opens no socket.","state":"not-reached","surface":"signalr"},{"reason":"the anonymous catalog surface has no text input; the journey drives clicks, keyboard selection and a genuine wheel scroll, and claims no typing coverage.","state":"not-tested","surface":"text-entry"},{"reason":"the anonymous catalog surface has no drag affordance.","state":"not-tested","surface":"drag"}]}

evidence/runs/angular-eshop-webspa/witness-mutation.json

@@ -0,0 +1 @@
+{"brands":[{"brand":"Contoso Cloud","id":1},{"brand":"Northwind Labs","id":2},{"brand":"Fabrikam Works","id":3},{"brand":"Adventure Supply","id":4},{"brand":"Tailspin Gear","id":5}],"configuration":{"activateCampaignDetailFunction":false,"identityUrl":"","marketingUrl":"","purchaseUrl":"","signalrHubUrl":""},"items":[{"catalogBrand":"Contoso Cloud","catalogBrandId":1,"catalogType":"Mug","catalogTypeId":1,"description":"Synthetic evidence catalogue entry 1.","id":"1","name":"Contoso Cloud Mug","pictureUri":"assets/images/brand.png","price":1.5,"units":0},{"catalogBrand":"Contoso Cloud","catalogBrandId":1,"catalogType":"Tee","catalogTypeId":2,"description":"Synthetic evidence catalogue entry 2.","id":"2","name":"Contoso Cloud Tee","pictureUri":"assets/images/brand.png","price":2.5,"units":0},{"catalogBrand":"Contoso Cloud","catalogBrandId":1,"catalogType":"Poster","catalogTypeId":3,"description":"Synthetic evidence catalogue entry 3.","id":"3","name":"Contoso Cloud Poster","pictureUri":"assets/images/brand.png","price":3.5,"units":0},{"catalogBrand":"Contoso Cloud","catalogBrandId":1,"catalogType":"Sticker Pack","catalogTypeId":4,"description":"Synthetic evidence catalogue entry 4.","id":"4","name":"Contoso Cloud Sticker Pack","pictureUri":"assets/images/brand.png","price":4.5,"units":0},{"catalogBrand":"Northwind Labs","catalogBrandId":2,"catalogType":"Mug","catalogTypeId":1,"description":"Synthetic evidence catalogue entry 5.","id":"5","name":"Northwind Labs Mug","pictureUri":"assets/images/brand.png","price":5.5,"units":0},{"catalogBrand":"Northwind Labs","catalogBrandId":2,"catalogType":"Tee","catalogTypeId":2,"description":"Synthetic evidence catalogue entry 6.","id":"6","name":"Northwind Labs Tee","pictureUri":"assets/images/brand.png","price":6.5,"units":0},{"catalogBrand":"Northwind Labs","catalogBrandId":2,"catalogType":"Poster","catalogTypeId":3,"description":"Synthetic evidence catalogue entry 7.","id":"7","name":"Northwind Labs Poster","pictureUri":"assets/images/brand.png","price":7.5,"units":0},{"catalogBrand":"Northwind Labs","catalogBrandId":2,"catalogType":"Sticker Pack","catalogTypeId":4,"description":"Synthetic evidence catalogue entry 8.","id":"8","name":"Northwind Labs Sticker Pack","pictureUri":"assets/images/brand.png","price":8.5,"units":0},{"catalogBrand":"Fabrikam Works","catalogBrandId":3,"catalogType":"Mug","catalogTypeId":1,"description":"Synthetic evidence catalogue entry 9.","id":"9","name":"Fabrikam Works Mug","pictureUri":"assets/images/brand.png","price":9.5,"units":0},{"catalogBrand":"Fabrikam Works","catalogBrandId":3,"catalogType":"Tee","catalogTypeId":2,"description":"Synthetic evidence catalogue entry 10.","id":"10","name":"Fabrikam Works Tee","pictureUri":"assets/images/brand.png","price":10.5,"units":0},{"catalogBrand":"Fabrikam Works","catalogBrandId":3,"catalogType":"Poster","catalogTypeId":3,"description":"Synthetic evidence catalogue entry 11.","id":"11","name":"Fabrikam Works Poster","pictureUri":"assets/images/brand.png","price":11.5,"units":0},{"catalogBrand":"Fabrikam Works","catalogBrandId":3,"catalogType":"Sticker Pack","catalogTypeId":4,"description":"Synthetic evidence catalogue entry 12.","id":"12","name":"Fabrikam Works Sticker Pack","pictureUri":"assets/images/brand.png","price":12.5,"units":0},{"catalogBrand":"Adventure Supply","catalogBrandId":4,"catalogType":"Mug","catalogTypeId":1,"description":"Synthetic evidence catalogue entry 13.","id":"13","name":"Adventure Supply Mug","pictureUri":"assets/images/brand.png","price":13.5,"units":0},{"catalogBrand":"Adventure Supply","catalogBrandId":4,"catalogType":"Tee","catalogTypeId":2,"description":"Synthetic evidence catalogue entry 14.","id":"14","name":"Adventure Supply Tee","pictureUri":"assets/images/brand.png","price":14.5,"units":0},{"catalogBrand":"Adventure Supply","catalogBrandId":4,"catalogType":"Poster","catalogTypeId":3,"description":"Synthetic evidence catalogue entry 15.","id":"15","name":"Adventure Supply Poster","pictureUri":"assets/images/brand.png","price":15.5,"units":0},{"catalogBrand":"Adventure Supply","catalogBrandId":4,"catalogType":"Sticker Pack","catalogTypeId":4,"description":"Synthetic evidence catalogue entry 16.","id":"16","name":"Adventure Supply Sticker Pack","pictureUri":"assets/images/brand.png","price":16.5,"units":0},{"catalogBrand":"Tailspin Gear","catalogBrandId":5,"catalogType":"Mug","catalogTypeId":1,"description":"Synthetic evidence catalogue entry 17.","id":"17","name":"Tailspin Gear Mug","pictureUri":"assets/images/brand.png","price":17.5,"units":0},{"catalogBrand":"Tailspin Gear","catalogBrandId":5,"catalogType":"Tee","catalogTypeId":2,"description":"Synthetic evidence catalogue entry 18.","id":"18","name":"Tailspin Gear Tee","pictureUri":"assets/images/brand.png","price":18.5,"units":0},{"catalogBrand":"Tailspin Gear","catalogBrandId":5,"catalogType":"Poster","catalogTypeId":3,"description":"Synthetic evidence catalogue entry 19.","id":"19","name":"Tailspin Gear Poster","pictureUri":"assets/images/brand.png","price":19.5,"units":0},{"catalogBrand":"Tailspin Gear","catalogBrandId":5,"catalogType":"Sticker Pack","catalogTypeId":4,"description":"Synthetic evidence catalogue entry 20.","id":"20","name":"Tailspin Gear Sticker Pack","pictureUri":"assets/images/brand.png","price":20.5,"units":0}],"sha256":"0331b52060f5d9e3cba94108536ed5e854f98c3e4652dffcb7c78aceacdeac08","types":[{"id":1,"type":"Mug"},{"id":2,"type":"Tee"},{"id":3,"type":"Poster"},{"id":4,"type":"Sticker Pack"}]}