<!--
  VERIFICATION.md
  Zyquo Cloud Web

  Author: Simon-Pierre Boucher
  Mail: contact@spboucher.ai
-->

# Phase 7 — Verification Report (real keys, real browser)

Run 2026-07-31 against the dev build with the user's real API keys, from an
actual Chromium page driving the app's own provider layer
(`scripts/verify-matrix.mjs`, `scripts/verify-browsers.mjs`,
`scripts/gate-phase2.mjs`, `scripts/gate-phase3.mjs`). Raw per-model JSON:
`/tmp/zyquo-verify.json` (not committed — contains timings only, no keys).

## 1. Provider / model matrix (streaming, token-by-token)

**169 of 170 catalog models verified streaming live — 169 PASS.**
1 model deliberately skipped: `sonar-deep-research` (long-running, per-search
billing; its sibling `sonar-reasoning-pro` covers the code path).

| Provider | Models | Streaming | Non-streaming | Stop/abort | Vision | Reasoning deltas | Citations | CORS |
|---|---|---|---|---|---|---|---|---|
| OpenAI | 27 | 27/27 ✅ | ✅ | ✅ | ✅ gpt-5-nano | n/a (API omits) | — | direct ✅ |
| Anthropic | 11 | 11/11 ✅ | ✅ | ✅ | ✅ haiku-4.5 | n/a (thinking off by default) | — | direct + header ✅ |
| xAI | 5 | 5/5 ✅ | ✅ | ✅ | ✅ | ✅ (grok-4.x) | — | direct ✅ |
| Mistral | 10 | 10/10 ✅ | ✅ | ✅ | ✅ | ✅ (magistral array-content quirk) | — | direct ✅ |
| Gemini | 14 | 14/14 ✅ | ✅ | ✅ | ✅ | n/a | — | direct ✅ |
| Qwen/DashScope | 32 | 32/32 ✅ | ✅ | ✅ | ✅ | ✅ (enable_thinking) | — | direct ✅ |
| DeepSeek | 2 | 2/2 ✅ | ✅ | ✅ | (no vision models) | ✅ | — | direct ✅ |
| Kimi | 12 | 12/12 ✅ | ✅ | ✅ | ✅ | ✅ (K-series) | — | direct ✅ |
| Perplexity | 4 | 3/3 ✅ + 1 skip | ✅ | ✅ | (no vision models) | ✅ | ✅ 19 citations | direct ✅ |
| Together | 16 | 16/16 ✅ | ✅ ¹ | ✅ | (no vision models) | ✅ | — | direct ✅ |
| DeepInfra | 34 | 34/34 ✅ | ✅ | ✅ | ✅ | ✅ | — | direct ✅ |
| Cerebras | 3 | 3/3 ✅ | ✅ ² | ✅ ² | ✅ gemma-4-31b | ✅ | — | direct ✅ |

¹ Together's first non-streaming probe used `Qwen/Qwen3.5-9B` (a
`requiresStreaming` model whose tiny budget went entirely to reasoning);
retested green on `Llama-3.3-70B-Instruct-Turbo`.
² Cerebras first probes used a 16-token budget on a reasoning model (empty
text) and an abort timer slower than Cerebras's ~3000 tok/s (essay finished
first). Retested green with a 512-token budget and a 120 ms abort:
`Generation stopped.`

Notable observations recorded:
- Reasoning content arrives via `reasoning_content`/`reasoning` deltas and,
  for Mistral's magistral, via the array-content thinking chunks — all
  normalized by the ported parser (verified: 103–1291 reasoning chars on
  thinking models).
- Legacy models (gpt-3.5-turbo, moonshot-v1 family, o1…) all still served.
- Perplexity `sonar` returned 19 numbered citations, merged from
  `citations` + `search_results`.

## 2. Persistence

Phase 3 gate (`scripts/gate-phase3.mjs`), real Chromium with a persistent
profile: **13/13 PASS** — keys/settings/conversations survive reload **and a
full browser restart**; export→clear→import restores exactly; passphrase
vault encrypts at rest (AES-GCM), rejects wrong passphrase, unlocks, disables.

## 3. Security / privacy sanity

- **Network audit:** every origin contacted during the full matrix run:
  `localhost` + exactly the 12 provider API origins. Nothing else — no
  analytics, no third parties.
- **CSP:** `fetch('https://example.com')` from the page → blocked by
  `connect-src`; provider origins reachable. No inline/third-party scripts.
- **First-run notice** present and honest (localStorage, BYOK, passphrase
  option).
- **Prod build:** dev harness (`window.__zyquo`) absent; keys never logged;
  keys file `.keys.local.json` gitignored (verified never committed).

## 4. Responsive / cross-browser

`scripts/verify-browsers.mjs`: **15/15 PASS** across **Chromium, WebKit
(Safari engine), Firefox** — app loads, **light theme is the default** (bg
`rgb(250,251,253)`), real streaming completion renders in every engine, no
horizontal overflow at 1240×800 or 390×844, drawer navigation on phone.
Visual review at both widths in light + dark: `docs/PLAN.md` Phase 4.4.

## 5. Phase gates recap

- Phase 2 gate: token-by-token streaming in a real browser (26 incremental
  snapshots) + cancellation — PASS.
- Phase 3 gate: 13/13 persistence checks — PASS.
- Phase 7 matrix: 169/169 tested models streaming, 12/12 providers
  non-streaming + cancel, vision on all 9 providers that have vision models,
  citations, CORS all-direct — PASS.