Testing Evidence

Detailed evidence is maintained in the root source document docs/iot-gateway-module-testing.md. This page gives the short review version.

Build And Unit Tests

Area	Command	Result
Shared command registry	pnpm generate:edge-command-registry	Passed
Worker TypeScript	cd apps/worker && pnpm exec tsc --noEmit	Passed
Web frontend	cd apps/web && VITE_API_URL=https://scsapi.itms.solutions/trpc VITE_APP_URL=https://scs.itms.solutions pnpm build	Passed
Gateway agent focused tests	cd gateway-agent && go test ./internal/agent	Passed
Gateway agent full tests	cd gateway-agent && go test ./...	Passed

Cloudflare Verification

Check	Result
SCS account	wrangler whoami resolved account deb292b6d2679dd8de3edbb858a4daf3
API root	https://scsapi.itms.solutions/ returned HTTP/2 200
Portal routes	Gateway, camera, and NVR dashboard routes returned HTTP/2 200
D1 migrations	Remote SCS D1 reported no pending migrations
Worker secrets	Only JWT_SECRET is configured

Auth Verification

• Anonymous gateway/sensor inventory reads now return 401 No token provided.
• Anonymous operational inventory, map, storage, and reporting reads return 401 No token provided.
• Legacy traffic/image write surfaces now require device X-API-Key.
• Invalid device key returns 401 Invalid or revoked X-API-Key.
• Valid hashed test keys successfully ingested for direct sensor and parent-gateway child-device paths.
• Signed tRPC ingest succeeded.
• Replaying the same signed nonce returned 401.
• Unsigned valid-key compatibility ingest still succeeded.

NVR Verification

• get_recording_jobs, search_recordings, and get_replay_uri are accepted by the deployed command enum and still require authenticated operators.
• export_recording_clip is accepted by the deployed command enum and still requires authenticated operators.
• Remote artifact smoke verified:
  • signed nvr-clip upload
  • tokenized artifact URL
  • video/mp4 metadata
  • checksum match on download
  • R2 object deletion
  • post-delete 404
  • cleanup of temporary D1 sensor, command, and nonce rows

GitNexus Checks

Before the latest docs commit, staged change detection reported low risk with docs-only changes and no affected execution flows. The GitNexus index was refreshed after commit.