# Phase 7 — Verification Report (real keys, real browser)

Run 2026-07-31 against the dev build with the user's real API keys, from an actual Chromium page driving the app's own provider layer (scripts/verify-matrix.mjs, scripts/verify-browsers.mjs, scripts/gate-phase2.mjs, scripts/gate-phase3.mjs). Raw per-model JSON: /tmp/zyquo-verify.json (not committed — contains timings only, no keys).

# 1. Provider / model matrix (streaming, token-by-token)

169 of 170 catalog models verified streaming live — 169 PASS. 1 model deliberately skipped: sonar-deep-research (long-running, per-search billing; its sibling sonar-reasoning-pro covers the code path).

Provider	Models	Streaming	Non-streaming	Stop/abort	Vision	Reasoning deltas	Citations	CORS
OpenAI	27	27/27 ✅	✅	✅	✅ gpt-5-nano	n/a (API omits)	—	direct ✅
Anthropic	11	11/11 ✅	✅	✅	✅ haiku-4.5	n/a (thinking off by default)	—	direct + header ✅
xAI	5	5/5 ✅	✅	✅	✅	✅ (grok-4.x)	—	direct ✅
Mistral	10	10/10 ✅	✅	✅	✅	✅ (magistral array-content quirk)	—	direct ✅
Gemini	14	14/14 ✅	✅	✅	✅	n/a	—	direct ✅
Qwen/DashScope	32	32/32 ✅	✅	✅	✅	✅ (enable_thinking)	—	direct ✅
DeepSeek	2	2/2 ✅	✅	✅	(no vision models)	✅	—	direct ✅
Kimi	12	12/12 ✅	✅	✅	✅	✅ (K-series)	—	direct ✅
Perplexity	4	3/3 ✅ + 1 skip	✅	✅	(no vision models)	✅	✅ 19 citations	direct ✅
Together	16	16/16 ✅	✅ ¹	✅	(no vision models)	✅	—	direct ✅
DeepInfra	34	34/34 ✅	✅	✅	✅	✅	—	direct ✅
Cerebras	3	3/3 ✅	✅ ²	✅ ²	✅ gemma-4-31b	✅	—	direct ✅

¹ Together's first non-streaming probe used Qwen/Qwen3.5-9B (a requiresStreaming model whose tiny budget went entirely to reasoning); retested green on Llama-3.3-70B-Instruct-Turbo. ² Cerebras first probes used a 16-token budget on a reasoning model (empty text) and an abort timer slower than Cerebras's ~3000 tok/s (essay finished first). Retested green with a 512-token budget and a 120 ms abort: Generation stopped.

Notable observations recorded:

Reasoning content arrives via reasoning_content/reasoning deltas and, for Mistral's magistral, via the array-content thinking chunks — all normalized by the ported parser (verified: 103–1291 reasoning chars on thinking models).
Legacy models (gpt-3.5-turbo, moonshot-v1 family, o1…) all still served.
Perplexity sonar returned 19 numbered citations, merged from citations + search_results.

# 2. Persistence

Phase 3 gate (scripts/gate-phase3.mjs), real Chromium with a persistent profile: 13/13 PASS — keys/settings/conversations survive reload and a full browser restart; export→clear→import restores exactly; passphrase vault encrypts at rest (AES-GCM), rejects wrong passphrase, unlocks, disables.

# 3. Security / privacy sanity

Network audit: every origin contacted during the full matrix run: localhost + exactly the 12 provider API origins. Nothing else — no analytics, no third parties.
CSP: fetch('https://example.com') from the page → blocked by connect-src; provider origins reachable. No inline/third-party scripts.
First-run notice present and honest (localStorage, BYOK, passphrase option).
Prod build: dev harness (window.__zyquo) absent; keys never logged; keys file .keys.local.json gitignored (verified never committed).

# 4. Responsive / cross-browser

scripts/verify-browsers.mjs: 15/15 PASS across Chromium, WebKit (Safari engine), Firefox — app loads, light theme is the default (bg rgb(250,251,253)), real streaming completion renders in every engine, no horizontal overflow at 1240×800 or 390×844, drawer navigation on phone. Visual review at both widths in light + dark: docs/PLAN.md Phase 4.4.

# 5. Phase gates recap

Phase 2 gate: token-by-token streaming in a real browser (26 incremental snapshots) + cancellation — PASS.
Phase 3 gate: 13/13 persistence checks — PASS.
Phase 7 matrix: 169/169 tested models streaming, 12/12 providers non-streaming + cancel, vision on all 9 providers that have vision models, citations, CORS all-direct — PASS.