# GLMChat V2.2.1 final validation
UTC 2026-07-22T13:06:58Z

## Baseline/final structure
baseline_files=87
final_files=81
final_unexpected_runtime_outputs:

## PHP syntax
php_files=44 failures=0

## JavaScript syntax
js_files=7 failures=0

## JSON, manifest, SBOM, references and archive path safety
json_files 4 parse_failures 0
[]
manifest_entries 80 set_match True failures []
sbom_components 81 file_inventory_match True missing [] extra []
precache_assets 15 missing []
html_refs 10 missing []
manifest_scope ./ start_url ./ display standalone
manifest_new_chat True

## Fresh and upgrade migration scenarios
baseline-fresh migrations 12 integrity ok foreign_key_violations 0 tables 29
final-fresh migrations 13 integrity ok foreign_key_violations 0 tables 29
upgrade-12-to-13 integrity ok foreign_key_violations 0 app_version 2.2.1 offline_max_age_days 7

## Targeted hardening assertions
PASS preview bypass removed
PASS mock provider test-only
PASS install does not force update activation
PASS explicit update action retained
PASS fetch fallback always resolves Response
PASS normal update notice present
PASS service-worker failure visible
PASS sensitive records use AES-GCM
PASS plaintext migration implemented
PASS PIN rekey does not silently overwrite retained data
PASS offline maximum credential age enforced
PASS lock clears decryption key
PASS closed-app sync claim removed
PASS unhashed helpers no-cache
PASS workbox asset removed
PASS light-only declarations
PASS duplicate public docs removed

## Obvious secret scan
potential_secret_hits 0

## Available-runtime backend preflight (isolated copy)
{"ok":false,"error":{"code":"ENVIRONMENT_INVALID","message":"The server does not meet GLMChat runtime requirements.","request_id":"b7056ecd70c340ea7a8f518b","failures":["Missing PHP extension: sqlite3.","Missing PHP extension: curl.","Missing PHP extension: mbstring.","Missing PHP extension: zip."]}}
## Checks unavailable
Build: Not run — deployment-only bundle contains no package.json, lockfile or build scripts.
Type-check: Not run — source and type-check configuration are absent.
Automated tests: Not run — claimed Node/PHP/browser suites are absent.
Browser runtime: Not run — installed Chromium hung even on a data URL in this container; no page result was claimed.
Live host/provider/device: Not run — requires target LiteSpeed host, Together credentials and physical Android devices.