GLMCHAT V2.2.1 — ZIP VERIFICATION REPORT
Completed: 29 July 2026 17:22:23 UTC

REQUESTED TASK
Verify the supplied GLMCHAT host-acceptance handover ZIP and its matching direct-deploy ZIP.

INPUT ARCHIVES
1. GLMCHAT_V2.2.1_HOST_ACCEPTANCE_CONTINUED_HANDOVER_29072026135254.zip
   SHA-256: 9dda9a9b2300d269b49d212bcc65fad5e3b1782247319ce7a6ce93dbdd26630a
   Size: 5281518 bytes
2. GLMCHAT_V2.2.1_SERVER_DIRECT_DEPLOY_HOST_ACCEPTANCE_29072026135254.zip
   SHA-256: 0cfab6de8553907c18cd94094aa11df31d2e00d289df8b669e86b3abb4c5d2a2
   Size: 980522 bytes

BASELINE
- Extracted the handover ZIP into a new disposable workspace.
- Captured the complete pre-verification tree and SHA-256 hashes for all 209 files.
- No original file was changed by the verification process.

ARCHIVE INTEGRITY AND SAFETY
- Handover ZIP compressed-data integrity: Passed.
- Direct-deploy ZIP compressed-data integrity: Passed.
- Handover entries: 237; duplicate names: 0; unsafe paths: 0; encrypted entries: 0; symbolic links: 0.
- Direct-deploy entries: 105; duplicate names: 0; unsafe paths: 0; encrypted entries: 0; symbolic links: 0.
- Both archives extracted without CRC errors.
- Both archives contain a single expected layout and no path-traversal entries.

DIRECT-DEPLOY EQUIVALENCE
- Files in extracted app/: 97.
- Files in extracted direct-deploy ZIP: 97.
- Missing files: 0.
- Extra files: 0.
- SHA-256 mismatches: 0.
- Result: the direct-deploy ZIP is byte-for-byte equivalent to app/.

FULL VERIFICATION SUITE
Command: npm run verify
Result: Passed.
Observed checks:
- Deterministic frontend build: Passed; bundle SHA-256 2a06bc602daba6a2b85c58ee23319d3a91eec1d5d0d193b69f03c582ce910542.
- TypeScript compatibility check: Passed.
- Source lint: Passed for 10 files.
- PHP static contracts: 66 passed.
- Node automated tests: 16 passed.
- Python migration contracts: Passed for fresh install, clone, rollback, 13-to-14 upgrade and custom-value preservation.
- Privacy/reset contracts: Passed for 24 export datasets and 25 content tables.
- HTTP environment preflight: Passed; controlled 503 correctly reported missing modules.
- Target-host acceptance status regression tests: Passed.
- PHP syntax: Passed for every shipped PHP file.
- JavaScript syntax: Passed for all checked runtime assets.
- Package, PWA, security, manifest, SBOM and SQLite checks: 295 passed.

POST-VERIFICATION COMPARISON
- Original baseline files: 209.
- Original files changed: 0.
- Original files deleted: 0.
- Verification-only files added: this report and the mandatory CHANGES record.
- Application runtime, routes, schema, migrations, manifest, service worker, caching, storage and user-data handling remain unchanged.

ENVIRONMENTAL LIMITATIONS
The local PHP runtime does not provide sqlite3, curl, mbstring or zip. Consequently:
- PHP remediation/provider integration tests were skipped by their own fail-safe environment guard.
- A healthy database-backed application success path was not executed locally.
- Live LiteSpeed, live Together API, production-data migration and physical Android/accessibility acceptance were not run.
These limitations do not indicate archive corruption, but they remain production-acceptance gates.

VERDICT
- ZIP integrity: Verified.
- Handover structure: Verified.
- Direct-deploy equivalence: Verified.
- Supplied local build/test/package suite: Passed.
- Runtime regression introduced by verification: None.
- Production approval: Not granted; external acceptance gates remain open.