> ## Documentation Index
> Fetch the complete documentation index at: https://gora.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Signal lab live invoice browser 2026 09 21

# Signal Lab v0.1.4: live read-only invoice browser check

The independent-origin browser check passed at `2026-09-21T11:08:44.142Z`.
This run used the preserved **Solana CLI owner**, not the Base owner and not
either concurrently tested native owner:

`wallet:solana:25ZfPHFFGUdB9joHrJLU6PdSJWhy3skANkHFHgpJuoh6`

Instance: `795804aeb34748b8144d7f9e7116500cc217701d4b372302afaf8982e38c407c`.
The DID and unchanged WASM artifact binding were checked through the actual UI.

The run served frozen `dist` bytes from `http://127.0.0.1:58070` and made real
cross-origin calls to `https://gora-bridge.74.241.248.103.nip.io`; no API response
was mocked or proxied. The parent rollout had independently byte-matched those
assets against public deployment
`76f6b80fe2da0ff4eeb642e1e9774d236ea4c2812c57d2578f57d450368c7af6`.
This browser run did not perform a deployment or separately resolve its ID.

## Results

Ten checks passed: four existing read-only UI checks and six invoice/scope checks.

| Read | Result |
| - | - |
| App-wide invoice GET through UI `Find original invoices` and the frozen client | 200; exact preserved original quote and credited transaction |
| Original owner's instance invoice GET | 200; same original record |
| Anonymous app-wide invoice GET | 401 |
| Signal Lab session against foreign app invoice GET | 401 |
| Primary owner session against secondary owner's instance invoice GET | 401 |

Every observed API response had `Access-Control-Allow-Origin: *`. Existing
identity, credits, revoked signer, state/history and activity reads also passed.
There were no unexpected blocked requests or browser errors in the completed run.

Original quote:
`d2c6de2737fdf3464aaeef0c62a58faa46de88559a73adc5ade42a538328bfe3`.

Original credited transaction:
`zqvquTydL786udH8ARPfAZpwRtf3dPBwFpn3MSfe6LEHi9tSicQEy9ZetnAW5zHwzDv9KYj3yNz2PAUv6CQL85N`.

The returned full quote matched the preserved CLI record exactly, including its
canonical memo commitment, two AI credits and `2000000000` atomic test-GORA
amount. The credited transaction matched the preserved prior payment receipt.
This was a comparison with authenticated server history and prior evidence, not
a new payment confirmation or fresh chain-RPC verification.

Invoice discovery created no browser-local invoice, restoration or payment.
Across both attempts there were zero chain signatures, new invoices, payment
confirmations, AI calls, funding operations, new instances or deployments.

## Bounded retry and retained evidence

The first attempt consumed its one permitted login-message signature and passed
the live UI/original-invoice check, but the temporary harness mistakenly called
browser `Response.status` as a function during negative checks. It stopped before
the foreign-scope checks; this was a harness failure, not an application failure.
Its evidence remains at:

`/tmp/signal-lab-public-readonly.7bAdh5/extended-report.json`

One additional authentication-message signature was explicitly approved for the
same read-only checks. The successful retry used that one signature. Thus the
total was **two authorized authentication-message signatures**, one per attempt,
and zero chain signatures. Session tokens and private keys were not printed or
persisted by this browser harness.

Successful report:
`/tmp/signal-lab-public-readonly.YQ7dtE/extended-report.json`

Screenshot:
`/tmp/signal-lab-public-readonly.YQ7dtE/independent-origin-live-readonly.png`

Temporary harness:
`/tmp/signal-lab-public-readonly.7bAdh5/check.mjs`

The frozen Signal Lab source/archive and preserved private journals were not
edited. Protected source, build and private-input files were hashed before and
after each run and matched. Archive SHA-256 remains
`b0c5bd2615af2721d2182fe3cb124072130025eb46cc1be9f54015b48474dceb`;
index SHA-256 remains
`0b854b78105929d0871cebaf251a20379debdaa5731fa792e3b66307790a103e`.

These checks do not claim native payment recovery completion, Base-owner browser
acceptance, live Bigman liquidation, or hundreds-of-bots capacity.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.