[Upd4ting]

Why

Antony wants every Clean AntelopeJS repo to carry its V5 verification skill on campaign/integration. This adds .agents/skills/verify-dms-api, driven by the dms-control bin of @antelopejs/dms, for the API console (health verdict, request logs, routes, tester, settings, retention). No product code changes.

What changed

• .agents/skills/verify-dms-api/: SKILL.md, verify.config.ts (doors block), a playground (the module from the checkout, a fixture module serving /fx/* routes, a member route), 11 features, 53 journeys, one coverage/ table per feature (every documented behaviour pinned by an asserting check, or a Not driven row with its reason), 11 seeded breaks, 6 seeded doors.
• AGENTS.md gets the line antelopejs-sync writes once a verify skill exists. .gitignore ignores the skill's build output, un-ignores its coverage/ folder (the repo ignores coverage), and the line that lost its newline in round 1 is repaired.
• The committed playground/node_modules symlink is gone (the prepare step recreates it).
• No new SAFETY comment, lint directive or suppression.

Round 2 (verifier round 1 at d53f243: FAIL, new breaks n1 to n4 MISSED)

• n1 to n8 and four more own breaks are pinned by new journeys: the 5-minute Down window (traffic seeded 10 minutes old), the bar length of five past ranges, the 7-day documentation window (a 6-day-old and an 8-day-old call), the Tester leaving the documentation unchanged, the comparison beyond the statistics horizon, no Use default on retentions, the /modules/api redirect, proxy-authorization and the other credential headers refused.
• n4 as given (fromTester(log) || true) is an equivalent mutant: the contract queries already pass apiTrafficOnly, which drops every request that has a source, so the fromTester filters are dead code. The same patch plus apiTrafficOnly: false (n4b) is CAUGHT.
• The weak checks the verifier listed are replaced with exact field assertions. More documented behaviour is driven: the edges of Needs attention (19 calls / 20 calls at 5% / 25 calls at 4%), the hero's four signals, the 24-hour judgement whatever the period, the module header of a module route, the Tester's form (header, Send with my session, Ctrl+Enter, History of 25), the ?since=&until= link, the confirmation before lowering a retention.
• The statistics, retention and contract journeys wait out the 15 s aggregate cache before reading again (a read inside it returns the earlier answer).

Proofs (head f0f6637a562dda5146eae863b3733add68c8f2e4)

• Battery (fresh up --prepare, TZ=UTC): 53 journeys, 51 PASS, 2 FAIL (the two proven findings below). Two journeys needed a count fixed after I added a fixture route and passed on a rerun; the settings and retention features were rerun on the final split.
• seeded, one run per feature, each started below load 32: 11 of 11 CAUGHT (smoke, capture, overview, logs, routes, tester, settings, retention, access, package, automation).
• Verifier breaks: n1, n2, n3, n5, n6, n7, n8 CAUGHT; n4 equivalent mutant (above), n4b CAUGHT. Own breaks: o1 (History size 25 to 20), o2 (client-error edge 5% to 6%), o3 (the since bound ignored), o4 (retention impact rounds down): 4 of 4 CAUGHT; round 1's 7 own breaks stay CAUGHT.
• dms-control doors: all 6 kinds named. dms-control map: clean. antelopejs-sync --check: in sync.
• GITHUB_BASE_REF=campaign/integration pnpm run checks: Checks: 8 passed, 0 failed. The suppression budget is unchanged. api-diff cannot run (the @/ alias breaks its emit); hand proof: the diff against campaign/integration lists only .agents/skills/verify-dms-api/**, AGENTS.md and .gitignore.
• agent-skills eval (scratch copy of main 625e0db, --min-catch 1.0 --min-door-catch 1.0 --jobs 3, claude-sonnet-5-5, TZ=UTC and DMS_CONTROL_MONGOD passed): breaks 10 of 11 then 11 of 11 (the single miss, break-capture, was a verifier that stopped before its journeys ran; rerun alone: caught), doors 6/6, unpatched head PASS+NOTES, $1.88 over 19 cases. The command exits 1 only because the harness reports leftover processes in three cases, which I killed by PID.
• Time zone: the scratch host reports an unknown zone, and the dashboard answers 500 "Invalid time zone specified" under it. Every battery, seeded run and eval of this round ran with TZ=UTC; SKILL.md says so.

Rounds 3 and 4 (verifier FAIL at f0f6637: m2; at 6821f41: p5)

• The 121-bar assertion is back to the documented bound: a-past-range-draws-at-most-120-bars FAILS on purpose (121 bars for two ranges; issue draft dms-api-past-range-121-bars, to be filed). The histogram journey keeps the exact bar lengths and a lower bound only.
• New journeys: redaction in query values, form bodies, arrays, nested arrays, the depth limit and unstored bodies; combined filters; sort by duration; slow labels in s and ms; grouped counts and All time; per-block 403 ids; the drawer's Summary facts; the hero's duration, tooltip and clock; an unknown comparison; every "vs" figure against seeded previous-period data (Traffic, Error share, Slowest routes, status classes, the route Statistics in points); optional body fields not required; the Tester History after a reload, in a second tab and per route, restore of the older entry, a typed Authorization over the session, headers for all routes kept while credentials are not, and the replay's hand-filled values and cut body; the Live or Pause choice across pages and the scope across a restart.
• Verifier breaks m1 to m7, n1, n2, n5 and p1 to p7 are CAUGHT at 2dba88a (n4 is an equivalent mutant, accepted; n4b CAUGHT). The full gate set (battery, all seeded, doors, eval, checks) is still to run once, after the owner's own breaks.

Findings

• dms-api#101: the published @antelopejs/api builds proto handlers, the module reads controller (the skill patches a copy of the package).
• dms-api#102: the docs read J as previous and K as next in the drawer; it steps the other way (the journey asserts the behaviour the page announces).
• dms-api#103 (failing journey settings/a-log-retention-of-no-day-is-refused-at-start): requestLogRetention: 0 starts the module.
• dms-api#104 (failing journey access/a-role-opens-the-blocks-it-holds-and-no-others): per-block role permissions are never granted.
• New: the docs and the Tester tab name the header x-dms-api-source, the code sends x-antelopejs-api-source (docs mismatch; draft pending filing, pinned in coverage/tester.md).
• Past ranges of 5 and 10 days draw 121 bars where the docs say 50 to 120 (the closing bar); the journey allows 121.

Attention

• GitGuardian incident 39489504: the flagged value was the variable secret at journeys/capture.mjs:161 (key names, not credentials). It is renamed at this head. Older commits keep the string and I do not force-push, so the incident needs a dashboard false-positive mark. The squash merge drops it.
• Not driven (SKILL.md and coverage/): clipboard buttons, the automation nodes (the playground loads no dms-automation), the Live read intervals, hidden-tab pause, L, /, ?, pointer drag, a typed Authorization header replacing the session, History restore, the Tester's query and body editors, multi-instance secret sharing.
• The hourly prune journey moves the backend's clock ahead through a --require shim (clock.cjs).
• up --prepare needs the npm registry once; it was retried when a just-published dependency 404ed.

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
39489504	Triggered	Generic Password	a6294c3	.agents/skills/verify-dms-api/journeys/capture.mjs	View secret
39538590	Triggered	Generic Password	bab6d92	.agents/skills/verify-dms-api/journeys/capture.mjs	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}