# KIMU 5.2.0 Chat Foundation — Verification Report

**Build type:** New application build  
**Verification date:** 29 July 2026  
**Scope:** Usable private chat foundation

## Verified in this environment

- Python syntax and byte-code compilation: PASS.
- SQLite schema creation, WAL mode and integrity check: PASS.
- Password hashing and verification: PASS after explicit scrypt memory-limit hardening.
- K2.6 model contract: PASS.
- K2.7 Code forced-thinking and preserved-reasoning contract: PASS.
- Model-aware preference normalisation: PASS.
- Together payload generation and SSE parsing: PASS.
- Frontend offline deterministic build using vendored React 19.2.7 and TypeScript 5.8.3: PASS.
- Frontend model-behaviour unit tests: 2/2 PASS.
- Core backend unit tests: 6/6 PASS.
- JavaScript syntax: PASS.
- Shell syntax: PASS.
- ZIP source tree contains compiled static PWA assets: PASS.

## Included installation-time verification

After Python dependencies are installed, `install.sh` runs three Flask test-client workflows:

1. Owner setup, model discovery and model-specific settings.
2. Complete fake-provider chat run with persisted user/reasoning/assistant content.
3. CSRF rejection for unauthorised authenticated mutations.

## Environment limitations

- Flask/Gunicorn could not be installed inside the build container because its package mirror did not expose all requested packages and public DNS was blocked. The Flask HTTP-flow tests therefore skip during container-only static verification, but are executed by `install.sh` after dependency installation on the target machine.
- Headless Chromium did not complete in this container because its system D-Bus/zygote environment stalled. Browser source, bundle and syntax checks passed; physical Android PWA acceptance remains a target-host/device check.
- No live Together API key or paid K2.7 dedicated endpoint was used. Live-provider verification is intentionally not claimed.

## Verdict

**CHAT-FOUNDATION RELEASE CANDIDATE.** The packaged build is suitable for installation and fake-provider workflow testing. Real K2.6 use requires a Together API key. K2.7 Code additionally requires the exact Together model or dedicated endpoint identifier and explicit enablement.