DEMO — SAMPLE DATA; NOT CONNECTED; NO PERSISTENCEChanges are temporary. Reload or leave the preview to discard.
CCH.TRANSFORMATIONAL
PROGRAMME ARCHITECT
THE PROGRAMME STUDIO / Fictional coach workspaceSC

ADMINISTRATOR / DESIGN PREVIEW

Carefully governed access.

This public demo is not an administrator console and grants no privileges.

Database administrator

bimal@bimalraj.com

Verified and activated in database · owner-reported

Pre-invitation readiness

Demo checklist

Owner-reported installed artifacts are not runtime-tested security or release approval. This preview reads no backend.

  • Agreement records structure in the dedicated backend — structurally owner-verified

    Structure and access lockdown verified. Behaviour tests with real records not yet run.

    Owner-verified
  • Counsel-approved coach agreement and signing release — outstanding

    Draft only. No live agreement may be signed.

    Outstanding
  • Database administrator verified and activated — structurally owner-verified

    Owner readback confirms one verified administrator and one atomic bootstrap audit. No administrator access is provided by this demo.

    Owner-verified
  • Live admin UI and app sign-in — outstanding

    Not built or connected. The administrator previously signed in to the dedicated service; app sign-in settings remain unverified here.

    Outstanding
  • Private invitation and acceptance endpoints — outstanding

    Invitation RPCs and Edge code deployed / test-only, NOT RELEASED. Acceptance endpoint not built. Three guarded SQL negatives passed per owner; independent HTTP denial suite not run; environment flag not independently verified.

    Outstanding
  • A3-S2 session and rate-limit installation — structurally owner-verified

    Owner-verified v0.2 installed test-only, NOT LIVE RELEASED. Sequential rollback assertions and committed claim threshold verified separately. Overlapping transaction race, real revoked-session and HTTP JWT tests NOT RUN; release flag value unverified. Historical v0.1 failure did not install protection.

    Owner-verified
  • Cross-tenant and bypass denial tests — outstanding

    Not run.

    Outstanding
  • Separate consent notices (four purposes) — outstanding

    Legal wording pending.

    Outstanding

Disabled: outstanding items above must be completed and approved. This page grants no administrator access.

Backend security checklist

NOT RELEASED

Owner-reported advisor: 16 RLS INFO notices · 0 WARN · 0 ERROR in latest supplied advisor result. Auth leaked-password warning CLEARED by advisor. No independent backend checks performed here.

Application address — selected, not deployed

Planned origin
https://tpa.cchub.in
Planned callback — not built
https://tpa.cchub.in/auth/callback
Proposed login — not built
https://tpa.cchub.in/login

Address selection only. Domain ownership is owner-reported; DNS, hosting binding, SSL and Auth URL configuration are unverified. Hostname not deployed; no resolution check performed. No sign-in, publication or live release authorised.

Controlled test-only QA matrix

No execution / no live release

Owner-reported database checks: 3/3 passed without writes. Existing sessions: 1; limiter rows: 0; invitations: 0. Not real revocation, rate limiter or HTTP verification.

  • Existing verified actor and matching existing session

    PASSED — expected TRUE, returned TRUE

  • Same verified actor and nonexistent session

    PASSED — expected FALSE, returned FALSE

  • Unknown mismatched actor and existing session

    PASSED — expected FALSE, returned FALSE

Sequential limiter — rollback-only PASS

Owner-authorised BEGIN / DO assertions / ROLLBACK / SELECT. Exactly 3 transient rows; invalid user/action/parameter combinations returned FALSE. Assertions and full rollback passed; separate independent read-only query confirmed unchanged state. Not a no-write test.

  • issue

    10/10 allowed · attempt 11 denied · transient counter 11

  • claim

    8/8 allowed · attempt 9 denied · transient counter 9

  • revoke

    10/10 allowed · attempt 11 denied · transient counter 11

Post-rollback: counters 0 · invitations 0 · Auth users 1 · projects 0 · audits 1 · admins 1.

This rollback-only run does not prove committed persistence or overlapping transaction safety. The later committed claim test is reported separately below. Live HTTP, actual logout/revocation and deployed environment flag remain unverified. Invitation release blocked.

Committed claim threshold — VERIFIED narrowly

Owner-approved 12 separate SQL requests · 8 TRUE / 4 FALSE / 0 errors · max 8 per 900 seconds. Pretest counters 0; committed row count 1, attempt_count 12, window 06:15–06:30 UTC.

Executed 06:27:11–06:27:41 UTC, approximately 30 seconds total. Concurrent promises are NOT proof of overlapping SQL transactions or simultaneous-write race safety. True contention UNTESTED.

Exact-record guarded DELETE removed 1 row; independent second query confirmed counters 0. Post-cleanup: Auth users 1 · sessions 1 · active admins 1 · invitations 0 · coach projects 0 · audits 1 · agreement versions 0. Six migrations; Edge v2 verify_jwt true unchanged. Owner-supplied results, not rerun here; no live release.

Read-only connector probe — overlap UNVERIFIED

Owner-reported 2 pg_sleep(1) reads launched together; completion gap approximately 2.68 seconds, elapsed 5.93 seconds. No writes. Connector serialisation does not demonstrate simultaneous PostgreSQL execution or row-lock contention.

Standalone out-of-band test source/specification: PROPOSED ONLY / NOT EXECUTED. Separate exact human approval, isolated actor scope, actual lock-wait evidence and guarded cleanup required. No connections or execution from this preview; invitation release blocked.

  • Three no-write database session checks

    VERIFIED · owner-reported database scope only

    Owner-reported matching session TRUE; nonexistent session FALSE; mismatched actor FALSE. Database scope only, no session identifiers exposed. No real revocation, limiter or HTTP verification.

  • Secure release-flag inspection

    PROPOSED · exact owner approval required

    Determine whether an authorised secure read can inspect the deployed flag without disclosing secrets. Record only verification outcome. Actual value remains unverified; no flag changes or live invite enablement.

  • Rollback-controlled counter test

    VERIFIED · owner-reported database scope only

    Owner-authorised sequential assertions PASSED: issue 10 allowed / 11th denied; claim 8 / 9th; revoke 10 / 11th. Three rows reached threshold+1 within transaction; invalid combinations FALSE. Full rollback and separate independent read-only query confirmed counters 0. Transient writes, NOT persistence/concurrency/HTTP verification. Any repeat needs new exact approval.

  • Committed threshold

    VERIFIED · owner-reported database scope only

    Owner-approved 12 separate SQL requests: claim max 8 / 900 seconds, 8 TRUE / 4 FALSE / 0 errors. One committed row read back, attempt_count 12, window 06:15–06:30 UTC. Exact-record guarded DELETE removed 1; independent query confirmed counters 0. Executions spanned 06:27:11–06:27:41 UTC; committed persistence and threshold ONLY, not overlapping transaction proof.

  • Overlapping transaction race

    UNVERIFIED · exact owner approval required

    Earlier 12 requests spanned approximately 30 seconds. Latest two read-only pg_sleep(1) connector calls launched via Promise.all completed approximately 2.68 seconds apart, wall time 5.93 seconds, no writes. This path does not demonstrate simultaneous PostgreSQL execution; connector serialisation cannot prove row-lock contention. Out-of-band independent-connection harness source/specification PROPOSED ONLY / NOT EXECUTED: exact approval, isolated actor scope, observed database blocking, ordered commits and exact guarded cleanup required. True overlapping concurrency remains UNVERIFIED; no live release.

  • Controlled deployed HTTP tests

    BLOCKED · exact owner approval required

    Requires exact owner-approved endpoint, methods, request cases, limits and side effects, plus secure environment verification. No real coach invite, legal version or live enablement.

  • Disposable logout or expiry denial

    BLOCKED · exact owner approval required

    Requires separate approval for a disposable test account/session and cleanup. NEVER log out, expire or revoke the owner’s only admin session. No real revoked-session test has run.

No execution or approvals issued here. Test writes, HTTP requests and disposable sessions need separate exact owner approval. The owner’s only admin session must remain untouched.

Guarded SQL negative tests — narrow scope only

Owner-executed and reported PASSED: each DO block asserted the exception and aborted on a wrong result. Not independent HTTP endpoint or production security tests.

  • Active administrator: fictional invitation issue

    PASSED — rejected with TPA_AGREEMENT_UNAVAILABLE

  • Unknown Auth identity: token claim

    PASSED — rejected with TPA_INVITE_INVALID

  • Unknown Auth identity: invitation revoke

    PASSED — rejected with TPA_FORBIDDEN

  • A3-S2 v0.1 — historical failed attempt

    SQL COMPILATION FAILED / ROLLED BACKv0.1 NOT INSTALLED

    Prior exact-scope v0.1 approval ended in compilation failure and rollback. That attempt did not install protection or transfer approval; subsequent separately owner-approved v0.2 installation is reported below.

  • A3-S2 v0.2 — structural test-only installation

    INSTALLED / STRUCTURALLY VERIFIEDEDGE V2 ACTIVE — TEST-ONLYNOT LIVE RELEASED

    Owner-verified 15 Nov 2026: migration 20261115055215 applied successfully after exact v0.2 approval. Six migrations and 16 RLS+FORCE tables; new limiter has zero policies, browser SELECT grants or rows. Two service-role-only SECURITY DEFINER session/counter RPCs have empty search_path and denied anon/authenticated EXECUTE. Existing three invitation RPCs unchanged. Sole tpa-invite-control Edge is version 2 ACTIVE with verify_jwt true, source fail-closed flag check, server session RPC and atomic actor/action counters: 10 issue / 8 claim / 10 revoke attempts per 900 seconds. No raw IP/email/token counter data. Owner inspected approved ZIP source; not retrieved or independently inspected here. ACTIVE is deployment status, not invitation activation; flag VALUE not independently readable. No live release approval.

  • Read-only session RPC negative spot checks

    nonexistent identity: falsenull input: falseNOT a real revocation test

    Owner reports session RPC returned false for nonexistent identity or null inputs. These narrow read-only spot checks do not verify a real actor/session, session expiry, revoked-session denial, live HTTP JWT integration or persistent limiter runtime/concurrency. Those tests NOT RUN.

  • Three no-write database session checks

    3/3 PASSED — DATABASE ONLYNO WRITESNOT revocation or limiter verification

    06:00 UTC owner readback: exactly one existing session. Matching existing actor/session TRUE; same actor with nonexistent session FALSE; mismatched unknown actor with existing session FALSE. Limiter and invitations remain zero rows. No session IDs exposed, new records, live HTTP, limiter concurrency or real logout/expiry tests. Reported results not rerun by this frontend.

  • Administrator and post-test records

    owner-verified

    One verified active administrator; zero invitations, coach projects and approved agreement versions; one existing bootstrap audit event after tests, per owner readback. This preview reads no accounts and grants no access.

  • Installed invitation server code

    deployed / test-onlystructurally verifiedNOT RELEASED

    Three unchanged invitation RPCs plus two session/counter RPCs installed with service-only privileges and empty search_path. Sole Edge v2 ACTIVE, verify_jwt true; static identity/session/counter/flag/origin source checks are not independent runtime verification or release approval.

  • Independent offline mocked Edge-source checks

    17/17 PASSED — OFFLINE ONLYowner-reported independent rundeployed HTTP NOT TESTED

    Independent offline harness executed actual reviewed Edge source against fake Deno/Auth/RPC: 17/17 behavior denial checks passed. Covers CORS, feature flag, method, identity, input, generic database error only. No network, credentials or DB writes; not rerun here. Does not verify deployed environment variables, actual HTTP endpoint, real tokens, revoked sessions, persistent rate limits or races. No backend change or invitation approval.

  • Auth leaked-password warning

    CLEARED by advisorowner-supplied advisor readback

    15 Nov 2026: latest advisor returns ONLY 16 INFO rls_enabled_no_policy notices for intentionally deny-all tables. Previous auth_leaked_password_protection WARN no longer appears. This is not an independent Auth configuration inspection or production security clearance.

  • (a) Secrets and feature flag verification

    verification pendingowner approval required

    Deployed active flag and allowed-origin values cannot be independently read. Verify secrets/feature flag securely; no actual invitation before exact owner approval. No secret values inspected by this preview.

  • (b) Persistent rate limiting

    sequential rollback assertions PASSEDcommitted claim threshold VERIFIEDoverlapping transaction race UNVERIFIEDrelease blocker

    Prior rollback-only issue 10/11, claim 8/9, revoke 10/11 assertions remain separate. New owner-approved committed claim test: 12 separate SQL requests, 8 TRUE / 4 FALSE / 0 errors; one persisted row with attempt_count 12. Exact-record DELETE removed 1; independent readback counters 0. Executions spaced across 06:27:11–06:27:41 UTC do NOT prove overlapping SQL transactions, simultaneous-write race safety or true contention. Window rollover, live HTTP, real revocation and deployed flag verification remain untested/unverified; release blocked.

  • (c) Server revoked-session checks

    installed structurallyreal revoked-session test NOT RUNrelease blocker

    Edge v2 calls the installed server session RPC after getUser and validated-token session_id extraction, checking auth.sessions actor/session identity and not_after expiry. Three no-write matching/nonexistent/mismatched database checks passed per owner, not real logout/expiry denial. Future revocation tests must use separately approved disposable sessions, NEVER the owner’s only admin session.

  • (d) Auth signup and redirect configuration

    signup disabled: USER CONFIRMEDserver configuration unverifiedlocalhost redirect fix pending

    Owner confirms public signup disabled; connector cannot independently inspect that setting. Independent server signup-setting verification and Auth redirect localhost fix remain pending.

  • (e) Legally reviewed agreement and evidence receipt

    legal pendingimplementation pending

    Final lawyer-reviewed responsibility agreement, trusted acceptance evidence and private receipt required. Zero approved agreement versions; separate lawful purpose consents remain required. Signing is disabled.

  • (f) Independent true HTTP denial and authorization tests

    NOT RUN

    17 offline mocked-source checks and three guarded database-RPC negatives are not deployed Edge endpoint HTTP denial or authorization tests. Real tokens, replay, rate limits, revoked sessions, concurrency, cross-tenant and production security remain unverified. No release approval.

Invitation lifecycle design

01

Issued

Admin-only issuance, bound to a verified email.

02

Accepted

One-time redemption; same locked entitlement and project.

03

Expired

Seven calendar days; expired invitations cannot be accepted.

04

Revoked

Revoked or reused invitations cannot be redeemed.

No invitation records connected.

No users, accounts or emails are accessed by this preview.

Private coach content is not available.

Future support access must be legitimate, project-scoped, least-privilege and audited. The database administrator is active, but this public preview grants no administrator session or access to coach content.