spb/zyquo-cloud-web Public MIT

1<!--2  VERIFICATION.md3  Zyquo Cloud Web45  Author: Simon-Pierre Boucher6  Mail: contact@spboucher.ai7-->89# Phase 7 — Verification Report (real keys, real browser)1011Run 2026-07-31 against the dev build with the user's real API keys, from an12actual Chromium page driving the app's own provider layer13(`scripts/verify-matrix.mjs`, `scripts/verify-browsers.mjs`,14`scripts/gate-phase2.mjs`, `scripts/gate-phase3.mjs`). Raw per-model JSON:15`/tmp/zyquo-verify.json` (not committed — contains timings only, no keys).1617## 1. Provider / model matrix (streaming, token-by-token)1819**169 of 170 catalog models verified streaming live — 169 PASS.**201 model deliberately skipped: `sonar-deep-research` (long-running, per-search21billing; its sibling `sonar-reasoning-pro` covers the code path).2223| Provider | Models | Streaming | Non-streaming | Stop/abort | Vision | Reasoning deltas | Citations | CORS |24|---|---|---|---|---|---|---|---|---|25| OpenAI | 27 | 27/27 ✅ | ✅ | ✅ | ✅ gpt-5-nano | n/a (API omits) | — | direct ✅ |26| Anthropic | 11 | 11/11 ✅ | ✅ | ✅ | ✅ haiku-4.5 | n/a (thinking off by default) | — | direct + header ✅ |27| xAI | 5 | 5/5 ✅ | ✅ | ✅ | ✅ | ✅ (grok-4.x) | — | direct ✅ |28| Mistral | 10 | 10/10 ✅ | ✅ | ✅ | ✅ | ✅ (magistral array-content quirk) | — | direct ✅ |29| Gemini | 14 | 14/14 ✅ | ✅ | ✅ | ✅ | n/a | — | direct ✅ |30| Qwen/DashScope | 32 | 32/32 ✅ | ✅ | ✅ | ✅ | ✅ (enable_thinking) | — | direct ✅ |31| DeepSeek | 2 | 2/2 ✅ | ✅ | ✅ | (no vision models) | ✅ | — | direct ✅ |32| Kimi | 12 | 12/12 ✅ | ✅ | ✅ | ✅ | ✅ (K-series) | — | direct ✅ |33| Perplexity | 4 | 3/3 ✅ + 1 skip | ✅ | ✅ | (no vision models) | ✅ | ✅ 19 citations | direct ✅ |34| Together | 16 | 16/16 ✅ | ✅ ¹ | ✅ | (no vision models) | ✅ | — | direct ✅ |35| DeepInfra | 34 | 34/34 ✅ | ✅ | ✅ | ✅ | ✅ | — | direct ✅ |36| Cerebras | 3 | 3/3 ✅ | ✅ ² | ✅ ² | ✅ gemma-4-31b | ✅ | — | direct ✅ |3738¹ Together's first non-streaming probe used `Qwen/Qwen3.5-9B` (a39`requiresStreaming` model whose tiny budget went entirely to reasoning);40retested green on `Llama-3.3-70B-Instruct-Turbo`.41² Cerebras first probes used a 16-token budget on a reasoning model (empty42text) and an abort timer slower than Cerebras's ~3000 tok/s (essay finished43first). Retested green with a 512-token budget and a 120 ms abort:44`Generation stopped.`4546Notable observations recorded:47- Reasoning content arrives via `reasoning_content`/`reasoning` deltas and,48  for Mistral's magistral, via the array-content thinking chunks — all49  normalized by the ported parser (verified: 103–1291 reasoning chars on50  thinking models).51- Legacy models (gpt-3.5-turbo, moonshot-v1 family, o1…) all still served.52- Perplexity `sonar` returned 19 numbered citations, merged from53  `citations` + `search_results`.5455## 2. Persistence5657Phase 3 gate (`scripts/gate-phase3.mjs`), real Chromium with a persistent58profile: **13/13 PASS** — keys/settings/conversations survive reload **and a59full browser restart**; export→clear→import restores exactly; passphrase60vault encrypts at rest (AES-GCM), rejects wrong passphrase, unlocks, disables.6162## 3. Security / privacy sanity6364- **Network audit:** every origin contacted during the full matrix run:65  `localhost` + exactly the 12 provider API origins. Nothing else — no66  analytics, no third parties.67- **CSP:** `fetch('https://example.com')` from the page → blocked by68  `connect-src`; provider origins reachable. No inline/third-party scripts.69- **First-run notice** present and honest (localStorage, BYOK, passphrase70  option).71- **Prod build:** dev harness (`window.__zyquo`) absent; keys never logged;72  keys file `.keys.local.json` gitignored (verified never committed).7374## 4. Responsive / cross-browser7576`scripts/verify-browsers.mjs`: **15/15 PASS** across **Chromium, WebKit77(Safari engine), Firefox** — app loads, **light theme is the default** (bg78`rgb(250,251,253)`), real streaming completion renders in every engine, no79horizontal overflow at 1240×800 or 390×844, drawer navigation on phone.80Visual review at both widths in light + dark: `docs/PLAN.md` Phase 4.4.8182## 5. Phase gates recap8384- Phase 2 gate: token-by-token streaming in a real browser (26 incremental85  snapshots) + cancellation — PASS.86- Phase 3 gate: 13/13 persistence checks — PASS.87- Phase 7 matrix: 169/169 tested models streaming, 12/12 providers88  non-streaming + cancel, vision on all 9 providers that have vision models,89  citations, CORS all-direct — PASS.90