ProofStream

Every scenario DeepQA drove in the browser, in plan order, with the 30 screenshots it captured along the way. A passing scenario is evidence too.

1. S1

   Empty Form Submission Validation

   2 steps, 2 screenshots

   high✓ pass

   

   

   • Loaded the new stream form; the [ CREATE STREAM ] button is disabled and a list of blocking validation reasons is displayed.
   • When required fields (milestone, repo/branch, contributor wallet, budget, duration, per-PR ceiling) are empty, the form displays explicit validation messages listing each blocking reason and keeps the [ CREATE STREAM ] button disabled.
   • Navigated to /new to test empty form submission validation on the Deploy a Stream form.
   • Observed that with empty / zeroed fields, the application explicitly lists validation errors under 'THINGS STOPPING THIS DEPLOY' (milestone cannot be empty, repository must be owner/name, branch required, contributor required, budget > 0, duration > 0, per-unlock cap > 0) and disables the [ CREATE STREAM ] button to prevent invalid deployment.
2. S2

   Contributor Wallet Format Validation

   4 steps, 3 screenshots

   high✕ fail

   

   

   

   • Navigated to /new where the stream creation form is displayed.
   • Entered 'not-an-ethereum-address' into contributor wallet field; no validation error was shown and the checklist item 'Name a contributor' was cleared as satisfied.
   • Navigated to https://app.proofstream.site/new and observed stream creation form.
   • Observed default values for budget (30) and ceilings (30.00).
   • Entered 'not-an-ethereum-address' into the contributor's wallet input field.
   • Verified that no validation error was displayed and the deploy checklist treated the invalid address as a valid contributor.
3. S3

   Logical Constraint: Certification Ceiling Exceeds Budget

   4 steps, 2 screenshots

   high✕ fail

   

   

   • Configured Budget to 100 USDC and Agent ceiling per certification to 200 USDC on /new; no validation error is displayed and the validation list does not prevent or flag the certification ceiling exceeding the total budget.
   • Navigated to /new stream creation page.
   • Entered 100 into Budget and 200 into Agent ceiling per certification.
   • Observed that the form validation and stopping checklist did not flag the certification ceiling exceeding total budget as invalid.
4. S4

   Logical Constraint: Daily Ceiling Exceeds Certification

   5 steps, 2 screenshots

   high✓ pass

   

   

   • Entered 500 into Budget, 100 into Agent ceiling per certification, and 200 into Daily agent ceiling.
   • With Budget=500, Agent ceiling per certification=100, and Daily agent ceiling=200, the deploy button is disabled with validation error 'The per-unlock cap cannot be below the budget'.
   • Navigated to https://app.proofstream.site/new and filled the form with Budget = 500, Agent ceiling per certification = 100, and Daily agent ceiling = 200.
   • The application immediately evaluated the constraints under 'THINGS STOPPING THIS DEPLOY' and disabled the CREATE STREAM button.
   • Validation explicitly flagged: 'The per-unlock cap cannot be below the budget, or the agent could never certify the milestone in full and the remainder would return to you instead of the contributor.'
   • The form prevented submitting the invalid configuration.
5. S5

   Budget Boundary Values

   5 steps, 3 screenshots

   high✓ pass

   

   

   

   • Entered -50 into budget field, which added 'The budget must be greater than zero.' to the blocking validation errors and disabled stream creation.
   • Entered 0 into budget field, which kept 'The budget must be greater than zero.' in the blocking validation errors list and prevented submission with a disabled button.
   • Navigated to /new and inspected the stream creation form.
   • Entering a negative value (-50) in the Budget field produces the validation error 'The budget must be greater than zero.' and disables the Create Stream button.
   • Entering zero (0) in the Budget field maintains the validation error 'The budget must be greater than zero.' and keeps the Create Stream button disabled.
   • Both negative and zero budget inputs are properly rejected before submission.
6. S6

   Payee Mode Toggle Interaction

   4 steps, 3 screenshots

   high✕ fail

   

   

   

   • Navigated to /new and observed the default state showing 'The contributor\'s wallet' with a single address input [ref=e21].
   • Attempted to interact with buttons in the Terms section (including '[ ANYONE — NAME SPECIFIC ACCOUNTS ]' [ref=e137] and checking 'ADVANCED — PAYOUT ADDRESS ▾'); no toggle for payee allowlist mode is functional or rendered.
   • Navigated to https://proofstream.site/new (redirected to https://app.proofstream.site/new).
   • Observed section '3 · THE TERMS' which only presents a single input for 'The contributor's wallet. Only this address can trigger a withdrawal.'
   • Checked all controls and buttons in the payee/terms configuration area: there is no Payee Mode toggle button or functional allowlist mode switcher.
   • Clicking the '[ ANYONE — NAME SPECIFIC ACCOUNTS ]' button had no observable effect on the input fields or mode.
   • 'ADVANCED — PAYOUT ADDRESS ▾' is rendered as non-interactive static text.
7. S7

   GitHub Authentication Flow Initiation

   3 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to /new and observed the 'CONNECT GITHUB' link with target /api/github/login.
   • Clicked 'CONNECT GITHUB' and observed navigation to GitHub OAuth authorization page (https://github.com/login?client_id=Iv23li16ieC0nz4vNGeG&return_to=%2Flogin%2Foauth%2Fauthorize...).
   • Successfully navigated to /new on ProofStream.
   • Observed the '[ CONNECT GITHUB ]' button linking to /api/github/login.
   • Clicking '[ CONNECT GITHUB ]' redirected through /api/github/login to GitHub's OAuth login page with the ProofStream client_id and callback redirect URI configured.
8. S8

   Duration Field Negative Validation

   3 steps, 3 screenshots

   medium✓ pass

   

   

   

   • Navigated to /new and observed the New Stream form with duration input set to 30 minutes by default.
   • Entering -1 into Duration amount immediately triggered validation error 'The duration must be greater than zero.' and prevented form submission with disabled button.
   • Navigated to /new and inspected the stream creation form.
   • Entered '-1' into the Duration amount input field.
   • Observed that the form immediately displayed the validation error 'The duration must be greater than zero.' in the list of blocking conditions.
   • Verified that the '[ CREATE STREAM ]' submission button remained disabled while the duration amount was invalid.
9. S9

   Milestone Prompt Whitespace Rejection

   3 steps, 2 screenshots

   medium✓ pass

   

   

   • Entered only space characters into the milestone prompt textarea; the form validated the input as empty and kept 'The milestone cannot be empty — it is what the agent judges against.' in the blocker list while disabling creation.
   • Navigated to /new and entered whitespace-only characters into the milestone prompt field.
   • The application treated whitespace as empty, displaying the validation error 'The milestone cannot be empty — it is what the agent judges against.' and preventing stream deployment.
   • Verified that entering substantive text cleared this validation message, and replacing it with whitespace immediately restored the validation error.
10. S10

    Stream Directory State Filtering

    5 steps, 3 screenshots

    medium✓ pass

    

    

    

    • Navigated to the streams page, showing filter tabs for ALL (15), ENDED (9), and SETTLED (6).
    • Clicked 'ENDED 9' filter tab and observed the list update to display 9 ended streams.
    • Clicked 'SETTLED 6' filter tab and observed the list update to display 6 settled streams.
    • The streams directory correctly provides filter tabs for ALL (15), ENDED (9), and SETTLED (6).
    • Clicking the ENDED filter immediately updates the list to display the 9 streams matching the ended lifecycle state.
    • Clicking the SETTLED filter immediately updates the list to display the 6 streams matching the settled lifecycle state.
11. S11

    Stream Detail View Rendering

    2 steps, 2 screenshots

    low✓ pass

    

    

    • Navigated to stream 0x11370A9E34E2dcaD4eEb9433Ee8386aF168B696e and observed complete stream details including earned amounts, milestone budget, repository parameters, agent verdicts/spending sections, and human on-chain transactions.
    • Expanded transaction history to display all 4 on-chain actions with explorer links, amounts, and callers correctly rendered.
    • Stream detail view rendered successfully with all contract parameters, milestone details, status indicators, accrual breakdown, and transaction history.
    • No errors or unhandled exceptions occurred while viewing the stream details and interacting with the action history.
12. S12

    Theme Persistence Across Navigation

    4 steps, 3 screenshots

    low✓ pass

    

    

    

    • Loaded /streams page where the theme toggle button reads 'Switch to dark'.
    • Clicked 'Switch to dark' button; the theme changed to dark mode and button updated to 'Switch to light'.
    • Navigated to /docs page and verified the visual theme persisted (theme toggle still displays 'Switch to light').
    • The user's visual theme selection (dark mode) persists across SPA navigation between /streams and /docs.

Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.

highconfirmed ✓functionalF1 · S2

Contributor wallet input field accepts invalid Ethereum address strings without validation

I navigated to /new and entered 'not-an-ethereum-address' in the contributor's wallet field. I observed that no validation error was displayed for the invalid Ethereum address, and the 'Name a contributor' requirement was cleared from the deployment blockers checklist, exactly as reported. The page reported 1 console error during the scenario.

Expected

The application should reject non-hex/invalid Ethereum address strings and display a validation error requiring a valid Ethereum address (0x followed by 40 hexadecimal characters).

Actual

The application accepts 'not-an-ethereum-address' without displaying any format validation error, and clears the 'Name a contributor' requirement from the deployment blockers checklist.

Repro · 3 steps

1. Navigate to https://app.proofstream.site/new
2. Enter 'not-an-ethereum-address' into 'The contributor\'s wallet' field under section 3.
3. Observe field state and validation checklist under section 4.

S2-7.pngS2-9.png

highconfirmed ✓functionalF3 · S6

Payee mode toggle between single wallet and allowlist configuration is missing or non-functional on /new

Navigated to /new and reviewed section '3 · THE TERMS'. The payee configuration only provides a single textbox for the contributor's wallet. There is no toggle available to switch to a Payee allowlist mode, and clicking nearby buttons like '[ ANYONE — NAME SPECIFIC ACCOUNTS ]' has no effect on the payee configuration. The page reported 1 console error during the scenario.

Expected

The UI provides an interactive toggle that switches the payee configuration from a single contributor wallet to a Payee allowlist mode.

Actual

No toggle exists to enable a Payee allowlist mode; only a single wallet input is rendered, and adjacent buttons/advanced text elements have no observable effect.

Repro · 4 steps

1. Navigate to https://app.proofstream.site/new
2. Scroll to section '3 · THE TERMS'
3. Observe the payee configuration inputs under 'The contributor's wallet'
4. Attempt to click any payee mode toggle or '[ ANYONE — NAME SPECIFIC ACCOUNTS ]' / 'ADVANCED — PAYOUT ADDRESS ▾'

S6-2.pngS6-10.pngS6-12.png

mediumwithdrawnfunctionalF2 · S3

Stream creation allows Agent ceiling per certification to exceed total budget without validation

Scenario S4 shows that the application explicitly enforces a rule where the per-unlock cap cannot be below the budget. Therefore, a ceiling exceeding the budget is intended behavior rather than a defect. The page reported 2 console errors during the scenario.

Expected

The application displays a validation error indicating that the ceiling per certification cannot exceed the total budget.

Actual

The application accepts Agent ceiling per certification (200 USDC) exceeding Budget (100 USDC) with no validation error or constraint check in the deployment pre-conditions.

Repro · 4 steps

1. Navigate to https://app.proofstream.site/new
2. Enter '100' into 'Budget'.
3. Enter '200' into 'Agent ceiling per certification'.
4. Observe the form validation and deployment blocker list.

S3-12.png