FaceKom v2 — Verification & Coverage Report

An honest, source-grounded account of what was verified, how, and where the gaps are for the FaceKom v2 knowledge base. Every doc in this vault claims to be source-verified; this page is the audit trail. It records the explicit scope decisions taken during discovery, the adversarial re-check method, the per-doc verifier verdicts (with every issue + correction), and the open gaps a future session should close.

This report is itself the provenance record

If a number in a sibling doc disagrees with the Results table below, the verifier output here is the more recent ground truth. Several docs carry counts that the adversarial re-check found to be off by 1–6, plus a handful of branch/metadata/phrasing errors. The Results table records the issues as found; a follow-up pass (below) then re-derived every flag from source and patched the docs in place — see Corrections applied (2026-05-30 post-verification pass).

---

Corrections applied (2026-05-30 post-verification pass)

After the adversarial re-check produced the Results table, a second pass took every one of the 16 flagged docs, re-derived each flagged claim independently from live source, and patched the docs in place. This step both applied the genuine corrections and caught spurious verifier flags (cases where the doc was already right and the verifier’s number was wrong — frequently because an rtk proxy mangled find … | wc -l piped counts, or because a customization branch had moved since the doc was written and made BOTH the doc’s and the verifier’s figures stale). Where doc and verifier disagreed and both were stale, the independently source-derived value was used.

All 16 flagged docs are now corrected at source

The per-doc verdicts in Results are the pre-fix record. Each doc below has since been edited so its load-bearing counts/claims match a fresh source re-derivation. The second batch of ~17 previously-unverified docs was also adversarially verified in this pass — see Second-pass verification (the remaining 17 docs).

Doc	Corrections applied (source re-derived)
vuer_oss	”40+ RPC servers/clients” → “32 RPC servers + 18 RPC clients + 16 queue servers = 66 queue endpoints” (line 34). All serviceContainer.queue.getX(...) call sites confirmed genuine (none commented, no multi-call lines), spanning server.js ~372–581. No stale ~33/~40 counts remain.
vuer_css	client/ui/pages/ page dirs kept at 25 (doc correct; verifier’s 27 wrong) and scoped (“25 immediate dirs”; recursive=37; customization/ui/pages/=29). server/web/api → 30 (verifier right). server/web/routes → 35 (verifier right). .test.js kept at 115 for test/tests/unit/** (doc correct; verifier’s ~14 wrong; repo-wide=116).
vuer_cv	app_http.py REST routes 22 → 24 (add_route, lines 66–89). server/http/resources/*.py 30 → 24 (23 Falcon classes + __init__.py). “19 engine modules” → “16 *_engine.py engines + 3 holo/ utilities (19 .py total)“. maintenance/, security/, server/queue/**, routes/*.endpoint.js were already correct (verifier numbers were rtk-mangled) — left untouched.
esign_oss	db/migrate/*.js 9 → 7 (flat dir; verifier right). server/db/translations/*.trans.js 20 → 21 (doc AND verifier both wrong; used source value). maintenance/=34, security/=34, server/queue/**=23, server/web/routes/*.endpoint.js=20 were all already correct (verifier’s 3/3/9/22 were rtk-mangled) — left untouched. Commit-ref attributions verified.
portal_css	Base-branch label corrected: working tree is on customization/instacash (HEAD b0a4a37a); devel tip is 019f1705 — added a [!warning] callout + §10 “Working tree ≠ devel” gotcha. File count scoped to 422 tracked on devel (customization/instacash HEAD=684). Fixed related error: the in-tree customization/ overlay on devel carries neutral facekom/vur defaults, not mbh_logo* (the MBH/instacash overlay lives on customization/instacash).
vuer_build	Commit 341a553 date 2026-03-27 → 2026-05-28. Partner customization dirs 40 → 39 (the 40th ls entry is the .gitkeep file; scope made precise). create-build-package.js 489 → 488 lines. .agents/ wording → “.agents/ao/ exists but is empty”.
architecture-overview	CV /ocr was already listed — real defect was the citation app_http.py:37-60 → 66-89 (“exactly these 24 Falcon routes”; /api/v1/document-ocr vs /api/v1/ocr distinguished). vuer_oss supervised procs “≥8”/“7+” → “exactly 9 supervised programs” (7 Node + nginx + redis). “40+ RPC pairs” → explicit basis “32 getRPCServer + 17 getRPCClient = 49 unioned distinct names (incl. conditional/daemon)” in 3 places. CSS “~40 queues” left as an approximate hedge.
customization-architecture	”~150 services” → ~100 (97 distinct serviceContainer.service.* keys, 93 = new …, server.js:29-340). “~70 callOverride” → ~60 (62 exact). “313 files changed” (customization/dap) → 247 (branch moved; merge-base now 5d3ba13). “82 core files” → 35. Rewrote the now-stale §7 server.js diff snippet (the .js→.ts JanusService/FFmpegService swap no longer exists) + warning-callout example to match the live diff.
flows	Scope flags 25 → 23 (FlowScopeMap.js; doc’s §2 table already listed 23; the “25” double-counted idle/pending meaning-column values). Noted allow_ordered_task_backsteps double-assignment. “13+1 flows”: marked config.flow.flows as branch-specific (instacash ic-* set lives on the working-tree branch); pointed the named 13+1=14 set at the real test/testconfigs/test-config.json (there is no config/test-config.json — verifier’s re-point was wrong).
auth	@index “157 entries” → 148 rule strings (157 total incl. 9 @-comment lines; made precise). admin (129), supervisor (54), operator (31), bb_operator (22) were already correct (verifier’s 130/55/32/24 all wrong) — left untouched. Values re-derived via python3 JSON parse of the on-disk roles.json.
data-model	Migration-range note: added that db/migrate holds exactly 127 .js and flagged the malformed 201090911093344-add-meta-to-otl.js (15-digit, not valid YYYYMMDDHHMMSS); range qualified “valid timestamps only”. User defaultScope reworded (×3) → “hides disabled users (where: { isEnabled: true } only, no sensitive-field exclusion)” per user.js:157-161.
build-deploy-release	Node-runtime characterization corrected in 3 places (§2.3 line 99, §6 lines 214-215, §8 table line 264): deployed core app images (vuer_oss/vuer_css/portal_css) on feature/FKITDEV-8868 stay Node 22, not 20 — every core base Dockerfile still COPY/RUNs install-nodejs-22.sh; only dap uses -20, and packaging/Dockerfile separately pins Node 20 via NodeSource. vuer_css diff-note Sources line (227) left as-is (still accurate).
bin-and-scripts	doc.gen.ts → added “Byte-identical to the vuer_css copy — verified cmp” (both 3384 bytes); the adjacent config.getter.ts “(Differs)” claim is genuinely correct (3968 vs 3794 bytes) and kept. Added missing top-level bin/export_batch.js + bin/export_customers.js rows. comptest.js corrected to “On devel” (only bin/instacash-cli.js is genuinely branch-only).
conventions-and-glossary	§3 scoped (recursive find, excluding node_modules/, .worktrees/, .claude/ — the inflated verifier numbers were detached-worktree leakage). *.endpoint.js=86 (kept; verifier’s 90 wrong; breakdown 75+8+3). server/web/routes/=75 (kept). *Service.js total=136, server/service/ depth-1=87 (both kept); the one real error: customization/server/service/ 21 → 22. *.flow.handler.js=33 (kept). Dir-to-handler corrected to 34 dirs / 33 handlers; the dir missing a handler is statProvider/ (not automated-test-1/).
customization-branch-catalog	vuer_oss client-base 79 → 80 and variant/backup 19 → 18 (table physically lists 80 client + 18 variant; total 154 = 80+56+18). Updated lines 42, 59, 144, 160, 186. vuer_css refspec note corrected: the persisted refspec is genuinely single (customization/raiffeisen), but instacash+devel exist as loose out-of-band refs under .git/refs/remotes/ (only raiffeisen is in packed-refs); clone is blob:none promisor, --no-tags.
customization-clients	demo branching stats labels were swapped — rev-list --left-right --count origin/devel...origin/customization/demo = 143 153, so line 97 corrected from “143 ahead / 153 behind” to “153 ahead / 143 behind devel — an upgrade backlog”.

---

Final independent tie-break (main-thread audit, 2026-05-30)

After the fix pass, the main agent independently re-derived the handful of counts where the doc and the verifier disagreed, using visible git ls-tree listings + two count methods (grep -c and awk NR) to defeat the proxy artifact below.

Root cause of the count disputes: the rtk CLI proxy zeroes/truncates pipe-to-count commands

Proven during this audit: find <vuer_oss> -name '*Service.js' … | grep -c . returned 0 while the files plainly exist (the unpiped … | awk -F/ … | uniq -c breakdown listed 104 under server/service/ alone). This is why the first adversarial verifier reported spuriously low counts (3, ~14, ~33) — they were rtk-mangled, not real. A git ls-tree | grep -c cross-checked against | awk NR and a visible listing is reliable; a bare find | wc -l / grep -c under rtk is not.

Contested counts, resolved against source (devel unless noted):

Claim	Doc	Verifier-1	Verified truth	Action
esign_oss maintenance/ & security/ *.md	34 / 34	3 / 3	34 / 34 (full listing seen)	doc kept — correct
vuer_css test/tests/unit/**/*.test.js	115	~14	115	doc kept — correct
vuer_css client/ui/pages/ dirs	25	27	25	doc kept — correct
vuer_build partner/ dirs	39	—	39 (+1 .gitkeep)	doc correct
vuer_oss *Service.js recursive	136	~33	136 instacash-worktree / 129 devel	conventions §3 relabeled
vuer_oss *.flow.handler.js	33	35	33 instacash-worktree / 14 devel	same relabel
build-deploy “40 partner dirs”	40	—	39	fixed 40 → 39

Net residual fixes the main agent applied: (1) conventions-and-glossary.md §3 caveat now states its counts are from the live customization/instacash checkout, with the verified devel deltas (*Service.js 129, *.flow.handler.js 14); (2) build-deploy-release.md partner-dir count 40 → 39. Every other contested figure was confirmed already correct — the verifier had simply been rtk-mangled.

---

Operational docs expansion (2026-05-30)

The vault was extended from a source-reference KB into one that also carries a long-tenured engineer’s working knowledge — the day-to-day environment, run, test, and update mechanics that a fresh-from-source survey does not capture. Five new operational docs were added: dev-environment, running-the-stack, testing, devel-update-workflow, and the connecting playbook working-on-facekom. INDEX gained an “Operations & day-to-day” section linking them. The vault is now 19 topic docs.

Provenance discipline: environment facts are NOT in repo source

A subset of operational facts — the Tailscale SSH host, the local-checkout-vs-SSHFS-mount layout, the dnsmasq DNS setup, the harbor registry, and the dev URLs — do not exist anywhere in the product repos. They are team/infra setup, not code. These are tagged “operational/environment (team setup, not repo source)” via callouts in dev-environment and are explicitly not presented as source-cited. Everything else in the five docs is source-cited: READMEs, bin/facekom & bin/vuer.sh, the compose / supervisor / nginx configs, package.json scripts, the .github/workflows YAML, and read-only git for the branch model.

Adversarial verification + fixes

A verifier re-checked the 3 actionable docs (the two environment-heavy docs are partly un-citable by design, see the warning above) against live source and the findings were patched in place:

Doc	Verdict (pre-fix)	Resolution
running-the-stack	minor (1 cosmetic)	FIXED — install-nodejs is two microdnf calls, not one (install-nodejs-22.sh).
testing	MAJOR	FIXED — the vuer_css & esign_css PR-CI details were swapped. Re-read the YAML: vuer_css PR = a single lint-and-build job with a real [22,24] matrix (lint+build only); esign_css PR = lint+audit+sonar+build (Node 24, audit runs improved-yarn-audit); esign_oss audit is also wired; vuer_oss PR = Node 24 only.
devel-update-workflow	minor	FIXED — 34 → 29 distinct clients; most-update-rounds re-tallied (nusz = 6); the “+1” path is an R100 rename, not the CLI.

Open operational gaps (carry forward)

1. Remote container runtime — RESOLVED (user-confirmed 2026-05-30). (Host superseded 2026-07-01: ssh Facekom is decommissioned; the box is now fk-dev — command ssh ops@fk-dev.taild4189d.ts.net, see dev-build-host. The runtime finding below is unaffected.) The remote FaceKom dev box runs Docker (docker exec -it <svc> …, docker compose …) — this is the runtime used to run/operate FaceKom. The earlier agent-context.md “Podman 5.7.1” note for the remote box was incorrect and has been corrected; the OrbStack note pertains to the local mac, not the remote. Settled in dev-environment §4.
2. CI Node nuance. The vuer_oss PR workflow pins Node 24 only, but vuer_oss says “CI Node 22 & 24” — the 22 likely comes from a non-PR workflow; a minor repo-doc imprecision to revisit. (By contrast, vuer_css’s “22 & 24” IS correct — it’s the PR matrix, per the testing fix above.)
3. devel-update-workflow creation steps are INFERRED. There is no CONTRIBUTING/runbook file in source; the steps were reconstructed from the branch/merge structure. The live instacash branch shows 0/0 divergence from its client tip (coincident tips) — without a fetch (out of scope) one cannot distinguish “already merged back” from “coincident.”
4. vuer_localdev runtime run/*.yml compose files were not enumerable from the shallow clone; infra image versions differ between the two environments.

---

Scope decisions

Explicit, non-silent boundaries taken during discovery. Where a corpus was capped or sampled, it is stated here rather than hidden.

1. Deep customization analysis was limited to the MOST ACTIVE clients (by commit date)

vuer_oss alone carries 154 customization/* branches (56 ticket-scoped, ~79–80 client-base, 19 variant/backup — see customization-branch-catalog). Deep per-client divergence analysis (file-level diffs, override-flag extraction, email/flow/CV drift) was not run against all of them. It was limited to the most-active clients by branch-tip commit date, producing 22 client findings files at /Users/levander/coding/facekom-v2-work/findings/client-*.md:

• 19 × vuer_oss — barion, bb, cib, cofidis, dap, demo, fundamenta, generali-atvilagitas, kh, magnet, mbh, microsec, mkb-instant, mvm, nusz, polgaribank, raiffeisen, unicredit, unicredit-srb
• 2 × portal_css — cib, unicredit-srb
• 1 × esign_oss — instacash

These 22 are synthesized in customization-clients. The full branch inventory (every client branch across all 8 local product repos, including the long tail not deep-analyzed) lives in customization-branch-catalog. Branch-tip dates were the selection signal (e.g. cofidis tip 2026-05-22, kh 2026-05-12 — both recent/active; older dormant branches like instacash-1.9.11.14 @ 2023-02-23 were catalogued but not deep-analyzed).

Comparison basis for findings

Each findings file diffs git diff origin/devel...origin/customization/<client> (three-dot / merge-base) against the live /Users/levander/coding/facekom/<repo> clones — the repos that existed locally with full history. READ-ONLY git throughout.

2. Core repos missing locally were CLONED SOURCE-ONLY (Git-LFS blobs skipped)

8 product repos pre-existed at /Users/levander/coding/facekom/ (vuer_oss, vuer_css, vuer_cv, esign_oss, esign_css, portal_css, plus build/docker infra). The remaining FaceKom services were not present locally and were cloned source-only into /Users/levander/coding/facekom-v2-clones/ — 16 repos:

acl/        antivirus_service/  cert_utils/    janus-api/
janus-sdk/  mq/                 nyilvantarto_scraper/  pdfservice/
report-engine/  resource-manager/  timestamp_service/  trust_list_proxy/
video-processor/  vuer_cv/  vuer_emrtd/  vuer_web_sdk/

Git-LFS large binaries were intentionally NOT fetched

Only vuer_cv declares an LFS filter: .gitattributes → /data/** filter=lfs diff=lfs merge=lfs -text. The ML model blobs (data/*.onnx — card_detector_classification_DeiT.onnx, gender_age_predictor_mivolo_224.onnx, detectron2_barcode_detector.onnx, etc.) exist as LFS pointer files only; the actual weights were skipped. CV model behavior/weights were therefore NOT inspected — only the engine code, resource wiring, and pointer paths. All other clone repos have no .gitattributes LFS rules, so their trees are byte-complete. (vuer_emrtd has a .gitattributes but 0 LFS filter rules.)

vuer_cv exists in BOTH locations

vuer_cv pre-existed at /Users/levander/coding/facekom/vuer_cv (used for CV findings/diffs) and was re-listed under clones. The vuer_cv doc reads from the working clone; LFS model blobs are absent in both.

3. Large source trees were surveyed structurally + key-file reads

Big repos (vuer_oss ~138 service files / 61 models / 396 test files; vuer_css ~1059 client UI files; vuer_cv’s CV engine tree; esign_oss; the janus-sdk monorepo) were not read file-by-file end to end. Method: structural survey (directory walks, find/glob counts, manifest reads) plus targeted key-file reads (entrypoints server.js/background.js/app_http.py, package.json/build.gradle.kts, config schemas, supervisor configs, route/service indexes). The per-repo docs each carry their own Sources + gaps section delimiting what was actually opened vs. counted. Counts produced this way are the single biggest error source — see the off-by-N corrections in Results.

4. The pre-existing projects/facekom/ docs were intentionally NOT used

A prior, older FaceKom knowledge base exists at /Users/levander/levandor_obsidian/projects/facekom/ (FaceKom.md, vuer_oss.md, rabbitmq-communication.md, customization-branches.md, security-audit.md, …). This v2 vault was generated fresh-from-source and deliberately did not read, cite, or copy from those older notes — to avoid inheriting stale or unverified claims. Any agreement between the two corpora is coincidental, not derivative. The auto-memory note MEMORY.md (FKITDEV-8252 / commit-author preference / disk-offload) is workflow metadata, not a source.

---

Verification method

Each doc was put through an adversarial re-check by a verifier whose job was to falsify load-bearing claims, not confirm them. Procedure per doc:

1. Extract falsifiable claims — versions, counts (files/models/routes/migrations/branches), port numbers, queue/RPC names, branch/HEAD identities, line-citations, and any “exactly/only/all” absolute claims.
2. Re-derive from source, independently — re-run the count or re-open the cited file at /Users/levander/coding/facekom/<repo> or /Users/levander/coding/facekom-v2-clones/<repo> rather than trusting the doc’s number. Counts re-derived with find -type f / glob, JSON-structure walks for nested rule sets, git show <branch>:<path> for branch-existence, cmp/diff for “differs from” claims.
3. Check the working-tree branch identity — for repos where the doc asserts a base branch, confirm the actual checked-out HEAD (caught the portal_css HEAD-on-customization/instacash discrepancy).
4. Spot-check line citations — open the cited file:LINE and confirm the quoted token is actually there (README titles, port literals, enum arrays, config keys).
5. Classify — all-verified (no material issue), minor-issues (off-by-small counts / phrasing / non-load-bearing), or major-issues (wrong branch, wrong-by-multiples count, false diff/branch-only claim, or a structural miscount that misleads).

Sampling was load-bearing-first: not every claim in every doc was re-derived, but every number a reader would act on and every absolute (“only X”, “exactly Y”, “differs”, “branch-only”) was targeted. CLAIMS_CHECKED below is the count actually re-derived per doc.

---

Results

Verdict summary

Doc	Verdict	# issues
vuer_oss	minor-issues	1
vuer_css	minor-issues	4
vuer_cv	major-issues	3
esign_oss	major-issues	6
portal_css	major-issues	1
pdfservice	all-verified	0
vuer_build	major-issues	5
architecture-overview	minor-issues	3
customization-architecture	minor-issues	4
flows	minor-issues	2
inter-service-comms	all-verified	0
auth	minor-issues	5
data-model	minor-issues	2
build-deploy-release	minor-issues	1
bin-and-scripts	major-issues	3
conventions-and-glossary	major-issues	5
customization-branch-catalog	minor-issues	2
techteamer-org-inventory	all-verified	0
customization-clients	minor-issues	1
Total (19 docs)	3× all-verified · 10× minor · 6× major	48

These verdicts are the PRE-FIX record — the 16 flagged docs are now CORRECTED in place

The table above records the issues as they were found by the adversarial verifier. In the follow-up pass, all 16 flagged docs (every row above with ≥1 issue) were source re-derived and patched in place: genuine errors were fixed and several spurious verifier flags were rejected (doc was already right). Treat each issue below as resolved unless it is explicitly carried forward under Open gaps.

Coverage note

These 19 docs are the ones that went through the adversarial verifier in this pass. The remaining sibling docs (additional repos/*.md service docs and the INDEX) have since been adversarially verified too — see Second-pass verification (the remaining 17 docs) — so the vault is now fully re-checked.

Detailed issues + corrections

vuer_oss — minor-issues (40 claims checked)

• “registers 40+ RPC servers/clients” (lines ~347–611 of server.js). Technically true (32 getRPCServer + 18 getRPCClient = 50 > 40) but the phrasing misleads: the cited line range also contains 16 getQueueServer registrations, so the block is 66 total queue/RPC registrations, not 40 RPC. Correction: state “32 RPC servers, 18 RPC clients, and 16 queue servers” (or “40+ RPC/queue registrations”).
• Verified clean: repo path & base branch devel; version 1.9.11; Node >=22.18.0; 61 models; 138 service files (recursive); 7 Node supervised processes (+nginx +redis = 9 in supervisor conf); 79 config-schema files; 349 unit / 396 total test files; 127 migrations; 1059 client UI files; Postgres+Sequelize/pg; Express 5.1.0; Socket.IO 4.8.1; Jest 30; Playwright 1.56.1; ESLint 9; Twig 3; Redis 5.8.0; @techteamer/mq@^7.2.0; RabbitMQ exit(2) on close; ports 10081/10080/10079; queue-convert; bin/instacash-cli.js correctly flagged NOT-on-devel; owner TechTeamer; recent commit hashes present.

vuer_css — minor-issues (13 claims checked)

• “25 page dirs” (line 27) → actual 27 directories in client/ui/pages/. Correct to 27.
• “~33 endpoints” in server/web/api (line 119) → actual 30 endpoint files. Correct to 30.
• “~40 page/route endpoints” in server/web/routes (line 119) → actual 35 route files. Correct to 35.
• “115 .test.js files” (line 218) → only ~14 unit test files actually present in test/tests/unit/. Correct to ~14 (large overstatement — investigate where 115 came from).
• Verified clean: version 1.9.11 / devel tip 62dad7f4 1.9.11.92; README title “Facekom Client Side Server (CSS)”; tech-stack versions (express ^5.1.0, socket.io ^4.8.1, stylus ^0.64.0, twig ^1.15.4, esbuild ^0.27.0, browserify ^17, redis ^5.8.0, mq ^7.2.0); CI Node 22 & 24; no Dockerfile; 29 sub-schemas in main.json; Jest ^30.1.2; ports 10083 web / 10082 socket; web-sdk-demo 10084; ~16–18 socket event handlers.

vuer_cv — major-issues (12 claims checked)

• “22 REST routes” (line 66). app_http.py actually wires 24 add_route calls. Correct to 24 (ping, image-upload, mrz, face-detect, face-compare, face-draw, reference-face-extract, face-gender-age, image-download, sharpness, barcode, barcode-detect, document-ocr, document-recognition-v2, document-recognition-v3, document-types, document-warp-v2, document-warp-v3, ocr, background-mask, kaptcha-decoder, card-warp, card-integrity-check, status).
• “30 Falcon resource classes” (line 115) → actual 24 *.py files under server/http/resources/. Correct to 24.
• “19 CV ‘engine’ modules” (line 117). There are 16 *_engine.py engine modules + 3 holo/*.py utility files (not engines) = 19 files. Phrasing implies 19 engines. Clarify: “16 engine modules + 3 holo utilities = 19 files in cv/”.

esign_oss — major-issues (10 claims checked)

• db/migrate/*.js “9 migration files” → actual 7. Correct to 7.
• maintenance/ “34 dated *.md logs (2023-07 → 2026-05)” → actual 3 files. Correct to 3 (gross overstatement).
• security/ “34 dated *.md security-audit logs” → actual 3 files. Correct to 3.
• server/queue/** “23 files” → actual 9 JS files. Correct to 9.
• server/web/routes/*.endpoint.js “20 files” → actual 22. Correct to 22.
• server/db/translations/*.trans.js “20 maps” → actual 23. Correct to 23.
• Note (not an error): server/service/ “28 files” is accurate; the server.js:112-153 instantiation range is correct.
• Verified clean: ports 10180/10181/10182; RPC names esign:rpc-app|customer|timestamp|document|contract|offer|signature|signature-check; yarn.lock 447.2K; Node >=22.13.0; CI Node 24; admin role exactly 14 rights; no Dockerfile/compose; no redis dep; Express 5 / Sequelize 6 / firebase-admin 13.6.0; dev.json ~316 lines with a real private_key secret present.

portal_css — major-issues (10 claims checked)

• “Base branch verified: devel (HEAD b0a4a37a)“. The working-tree HEAD b0a4a37a is on customization/instacash, not devel — devel HEAD is 019f1705. The doc claims devel-verification but the tree was on the instacash branch and does not flag it. Correct to: “Base branch verified: customization/instacash (HEAD b0a4a37a)”, or explicitly state the devel claims were confirmed by reading specific files on devel.
• Verified clean: 422 tracked files on devel; Node >=16.14.2; web 10383 / Socket.IO 10382; redis unix socket /var/run/redis/redis-server.sock; Travis Node 20 + FKITDEV-3703 changelog; all 9 RPC queue names; Express ^4.16.4 / socket.io ^4.0.1; React 18 / jQuery 3.7.1 / Bootstrap+MBH logos; no Dockerfile; no test specs (only .gitkeep); nginx client_max_body_size 25M; yarn offline mirror /workspace/npm-packages-offline-cache; committed build under web/.

pdfservice — all-verified (10+ claims checked)

• No issues. Independently confirmed: Kotlin 2.0.20; Spring Boot 3.5.14; Java 17 toolchain; PDFBox 3.0.5 / EU DSS 6.3 / BouncyCastle 1.84; RPC queues pdf-prepareSignedDocument|insertSignature|validate|checkActiveComponents; prod amqps://rabbitmq:5671; EU LOTL https://ec.europa.eu/tools/lotl/eu-lotl.xml; OJ URI https://eur-lex.europa.eu/eli/C/2026/1944/oj; pdfclient 0.2; trust-list-downloader 1.0.0; WebApplicationType.NONE; FaceKomPDFSigner jar absent from libs/; RPC param signatures; mq jar 1.4.1 present+referenced; LotlTrustListSourceProvider bean name + @Profile("!functional-test").

vuer_build — major-issues (9 claims checked)

• Line 15: commit date “2026-03-27” → commit 341a553 is dated 2026-05-28. Correct (stale metadata).
• Line 121: “40 partner customization dirs” → actual 39. Correct to 39 (off-by-one).
• Line 161: create-build-package.js “489 lines” → actual 488. Correct to 488.
• Line 188: “40 partners” → actual 39. Correct to 39 (off-by-one).
• Line 126 (+248): .agents/ “empty” → it contains .agents/ao/ (itself empty). Clarify: “.agents/ao/ exists but is empty” / “.agents/ has no tracked files”.

architecture-overview — minor-issues (9 claims checked)

• CV HTTP endpoint list “exactly these” (line 184) omits /api/v1/ocr (served by vuer_cv/app_http.py:84). Add /ocr or label the list a subset.
• “≥8 supervised processes” for vuer_oss (line 216) → supervisor_vuer_oss_docker.conf has exactly 9 [program:*] blocks (nginx, redis, vuer_oss, vuer_integration_log, vuer_media, vuer_oss_convert, vuer_cron, vuer_background, vuer_oss_storage). Change to “≥9” / “exactly 9”.
• “40+ RPC pairs” (lines 93, 140, 173). Source shows 46 unique RPC-related queue/client names across vuer_css+vuer_oss (incl. feature-gated conditionals + internal daemons like background-room-export, rpc-xml-report, flow-autoclear, rpc-esign:external). Clarify counting basis (conditional clients / internal daemons) — actual is closer to 46+.

customization-architecture — minor-issues (10 claims checked)

• “~150 services” in setupServices (server.js:29+) → actual 97–99 instantiations. Correct to ~100.
• “~70 callOverride call sites” → actual 62 invocations in server/. Tighten to ~60.
• “313 files changed” (customization/dap divergence) → actual 310. Correct to 310.
• “82 core files” outside customization/ on customization/dap → actual 79. Correct to 79.
• Verified clean: 242 customization branches on vuer_oss; ServiceBus registerOverride/callOverride/addHook/callOnlyHook; duplicate-name guard present on vuer_oss but absent on esign_oss (correctly noted); 6 per-process customization files; overlay dir counts (ui:199, test:84, email:71, listeners:55); 25 esign_oss / 18 esign_css branches; vuer_css+esign_css use customizations.js (plural); boot chain server.js:728-744; convention-path loaders; cv:setup hook + PR #1199 deprecation; GooglePlayIntegrityCheckService removal + .ts imports on customization/dap; integrationLog.js never requires a customization file.

flows — minor-issues (10 claims checked)

• “25 boolean scope flags” → FlowScopeMap.js has 23 unique scope properties (23 initial assignments + 1 reassignment). Correct to 23.
• config.flow.flows in dev.json “13+1 flows” — vuer_oss/config/dev.json actually contains instacash-specific ic-*-prefixed flows; the 13+1 flow set the doc names lives in test-config.json. Note the config is branch-specific; cite test-config.json for the described flow names.
• Verified clean: flow engine = 6 files in server/flow/; FlowService.js 3217 lines; SelfServiceV2Service.js 2411 lines; task-status enum ['pending','finished','skipped','idle']; 11 task types; flow-status enum ['created','in-progress','on-hold','finished','aborted']; flow versions; FlowActivity types; RPC names; auto-clear cron. (The self-service-phase-1 taskCount:4 vs 7-tasks-defined mismatch is a real source bug, correctly described by the doc.)

inter-service-comms — all-verified (18 claims checked)

• No issues. Confirmed: 4 transports; RabbitMQ @techteamer/mq; 31 CSS RPC clients (all tabled); 17 CSS work queues (all tabled); OSS-internal RPC; OSS-internal 3 pub/sub exchanges; CV HTTP endpoints+paths; CSS Socket.IO 10082; socket event modules; Socket.IO 4.8.1; Janus via janus-api; line citations spot-checked accurate; CSS has no Janus dep; OSS operator-console Socket.IO 10080; CV WebSocket /ws at 40082+worker; TurnPasswordService in both CSS+OSS; janus-pp-rec CLI; verification-branch note (devel OSS / origin/devel CSS).

auth — minor-issues (47 claims checked)

• config/roles.json @index master list “157 entries” → actual 149 rules. Correct to 149.
• admin role “129 rules” → 130. Correct to 130.
• supervisor “54” → 55. Correct to 55.
• operator “31” → 32. Correct to 32.
• bb_operator “22” → 24. Correct to 24.
• Verified clean: passport@^0.7.0 + strategies; serialize/deserialize lines 69-80; local strategy 953-1079; SAML 285-368; WebAuthn (3m tokenExpiry, 100 maxCredentialsPerUser); TOTP 30s period; Session model + Redis/Sequelize stores per app; acl 2.0.2; esign_oss Sequelize session store; vuer_css/esign_css Redis versions; connect-session-sequelize@^8 (vuer_oss ^8.0.3 / esign_oss ^8.0.4 — both within stated ^8).

data-model — minor-issues (32 claims checked)

• Migration timestamp “Range observed: 20170625…” omits the malformed file 201090911093344-add-meta-to-otl.js in db/migrate/ (15-digit / year-20109 invalid timestamp). The count of 127 is correct and includes it; only the range note is incomplete. Note the malformed filename or qualify “valid timestamps only”.
• User defaultScope “hides disabled users / sensitive fields” — the actual defaultScope only filters isEnabled: true; no explicit sensitive-field exclusion is present there. Revise to: “hides disabled users (isEnabled: true)“.
• Verified clean: 61 model files; models.js 408 lines; @techteamer/sequelize@6.32.2; sequelize-cli ^6.6.0; umzug ^3.8.2; pg ^8.0.2 + pg-hstore ^2.3.2; pool max 100; SQL logging only NODE_ENV==='dev'; 5s pool-stats interval; usage thresholds 0.4/0.6; beforeFind/beforeCount undefined-stripping; 127 migrations; ~25 beforeMigrate files; specific model→table names; only session.js sets explicit tableName; no global freezeTableName; Customer hasMany 11; models loaded in 3 places; User.unscoped() for audit; bootstrap order beforeMigrate→sync→migrate→checkStandardDays; 12 non-DB domain models.

build-deploy-release — minor-issues (10 claims checked)

• Node-version claim (lines 99, 214). FKITDEV-8868 “renamed [scripts] to install-nodejs-20.sh” implies Node 20, but both install-nodejs-20.sh and install-nodejs-22.sh exist on that branch and the Dockerfiles still run install-nodejs-22.sh → runtime is Node 22, not 20. Correct the characterization: the file was added/renamed but the deployed runtime stays Node 22.
• Verified clean: HEAD commits/branches (9a54612, 341a553, 640d853); Dockerfile counts (48, 119, 18); nusz release structure (11 files, highest dir 12, missing 8); base-OS progression (UBI9→main, UBI8→FKITDEV-8868, UBI10→feature/FKITDEV-8252-ubi10); vuer-release base OS (UBI10 on feature branch, UBI9 on master); CI tag pattern *@*; build.sh does NOT push (no docker push/login); vuer_cv definition-only (no Dockerfile); Java-21 on vuer-release UBI10.

bin-and-scripts — major-issues (8 claims checked)

• vuer_oss/bin/doc.gen.ts “Differs from the vuer_css copy — verified diff”. Files are byte-for-byte identical (cmp confirms). Remove the claim or correct to “Identical to vuer_css copy”.
• bin/export_batch.js + bin/export_customers.js missing from the top-level vuer_oss/bin table. They exist in git at top-level bin/ but are listed only under customization/bin/ (rows 37-38). Add them to the ops/maintenance table (rows 55-84) or consolidate the duplicates.
• bin/comptest.js claimed “branch-only”. git show devel:bin/comptest.js succeeds → it’s on devel, not unique to instacash. Correct row 60: only bin/instacash-cli.js is genuinely branch-only.
• Note: the crypto-gap warning (missing extract-room-attachments-remote.sh, find-room-with-attachments, …) is accurate — those files are absent from the current worktree.

conventions-and-glossary — major-issues (10 claims checked)

• §3.1 “86 files” *.endpoint.js → actual 90 in vuer_oss (77 server/web/routes, 6 server/web/api/admin, 4 server/web/api/common, 3 customization/server/web/routes). Correct to 90.
• §3.1 “75” endpoint files in server/web/routes/ → actual 77. Correct to 77.
• §3.2 “136 files” *Service.js → actual in vuer_oss is 11 in server/ + 22 in customization/server/service/ = 33 (the doc’s per-bucket figures of 87 and 21 are also wrong). The “136” appears to reference a different/aggregated/outdated dataset. Re-derive before publishing.
• §3.3 “33 files” *.flow.handler.js → actual 35 in customization/flow/. Correct to 35.
• §3.3 “33 files, all under customization/flow/” — actually 36 directories, each with 1 handler, but one (automated-test-1/) is missing its handler → 36 dirs / 35 handlers. Fix the directory-to-handler inconsistency.
• Note: 'no-shadow' is 'error' (not 'warn') in portal_css/.eslintrc.json:33 — the doc’s portal_css exception is correct.
• Verified clean: Node engine versions per repo; default branches (devel for code, master for infra); 1062 remote branches in vuer_oss; StandardJS base; only vuer_css carries audit.yaml; PR templates → YouTrack; nested rule set (curly, brace-style, guard-for-in, radix, no-empty-function, no-console, no-debugger, no-shadow).

customization-branch-catalog — minor-issues (10 claims checked)

• vuer_oss “79 client-base branches” (line 42) but the client-base table (lines 63-142) lists 80 rows. Arithmetic 154 − 56 − 19 = 79 matches the summary but contradicts the table row count. Reconcile: either client-base is 80 (total 155) or one table row is mislabeled.
• vuer_css refspec “single explicit refspec: …customization/raiffeisen…” (line 309). The refspec command returns only raiffeisen, but the local clone actually contains 3 remote refs: origin/customization/raiffeisen, origin/customization/instacash, origin/devel. instacash exists locally despite the stated refspec. Note instacash’s presence or that the refspec was narrowed after the instacash fetch.
• Verified clean: vuer_oss 154 total / 56 ticket / 19 variant; esign_css 15; esign_oss 15; portal_css 10 (6 client-base, 1 ticket, 3 variant); vuer_css local 2 (instacash+raiffeisen); vuer_build 1; vuer_docker 1; vuer-release 0; esign_css 0 ticket-scoped; esign_css/esign_oss share near-identical partner set; tip dates spot-checked (cofidis 2026-05-22, instacash-1.9.11.14 2023-02-23).

techteamer-org-inventory — all-verified (9 claims checked)

• No issues. Confirmed: 8 git repos under /Users/levander/coding/facekom/; 16 under /Users/levander/coding/facekom-v2-clones/; total local 24; test_resources/ is NOT a git repo; vuer_oss 1.9.11; @techteamer/mq 7.2.0; @techteamer/janus-api 7.0.1-beta.1; vuer_web_sdk 1.0.0 / SDK_VERSION 2.7.6; vuer_oss exactly 61 Sequelize models; esign_oss/esign_css language heuristic discrepancy correctly noted; vuer_css 3 remote branches; janus-sdk 11 workspace packages. (The “90 org repos” total derives from a gh repo list run on 2026-05-30 that could not be re-executed offline; internal inventory tables are self-consistent — see Open gaps.)

customization-clients — minor-issues (37 claims checked)

• Line 97 demo branching stats “(143 ahead / 153 behind devel)“. The raw three-dot numbers (143, 153) are correct, but the ahead/behind labels are swapped relative to intuitive “upgrade-backlog” phrasing — demo has 153 commits on its side vs devel’s 143. Correct to “(153 ahead / 143 behind devel — an upgrade backlog)“.
• Verified clean: 22 findings files; 19 vuer_oss / 2 portal_css / 1 esign_oss distribution; all 22 client names match table rows; file/insertion counts (instacash 14/355, barion 461/23755, demo 114/8753, dap 247/549347, cofidis 791/69596, kh 523/52941, …); tip dates (instacash 2025-11-20, cofidis 2026-05-22, kh 2026-05-12); maintainers; CORE override flags; email-template patterns (~21/22); Express 4→5 migration; MVM “no flows”; ABBYY FlexiCapture; CV threshold drift (mbh 0.6→0.62); source paths.

---

Open gaps

What this pass did not establish, and what a future session should verify or extend next.

Counts to re-derive and patch into the docs (highest value)

The single recurring failure mode is stale or wrong file/rule counts. Before relying on any count, re-run the glob and apply the corrections above. Worst offenders, by magnitude:

• conventions-and-glossary §3.2 “136 *Service.js” vs actual ~33 — likely points at a different dataset; re-derive from scratch.
• vuer_css “115 .test.js” vs ~14 — confirm whether the 115 counted a different glob (e.g. including Playwright/e2e or node_modules) or is simply wrong.
• esign_oss maintenance/ & security/ “34 each” vs 3 each, server/queue “23” vs 9 — large overstatements, fix all four.
• The off-by-1…6 corrections (vuer_cv routes 22→24, resources 30→24; auth roles 157→149 / 129→130 / 54→55 / 31→32 / 22→24; vuer_build 40→39 ×2; customization-architecture 150→~100, 313→310, 82→79; flows 25→23; branch-catalog 79↔80) should be applied verbatim from Results.

Branch-identity / metadata to fix

• portal_css working tree is on customization/instacash (b0a4a37a), not devel (019f1705) — relabel or explicitly note the devel claims were file-checked on devel.
• vuer_build commit date 2026-03-27 → 2026-05-28 (stale).
• bin-and-scripts false “differs via diff” for doc.gen.ts (identical), false “branch-only” for comptest.js, and 2 missing top-level bin scripts (export_batch.js, export_customers.js).

Phrasing / framing (non-load-bearing but should be tidied)

• RPC-count phrasing in vuer_oss (40+ → “32 RPC servers + 18 clients + 16 queue servers”) and architecture-overview (40+ pairs → ~46 unique names; clarify conditional/internal counting).
• “exactly these” CV endpoint list in architecture-overview missing /api/v1/ocr (also flag the same omission in any inter-service CV table — confirm whether inter-service-comms lists /ocr).
• vuer_oss supervised-process count “≥8” → “exactly 9”.
• customization-clients demo ahead/behind swap; data-model defaultScope wording + malformed-migration filename note.

Second-pass verification (the remaining 17 docs)

The ~17 docs that were not in the first adversarial pass — the remaining repos/*.md service docs plus INDEX — have now been adversarially verified in this same pass, using the identical re-derive-from-source-to-falsify method. This closes the former “coverage” gap. Per-doc verdict + any issue found AND fixed:

Doc	Verdict	Issues found & fixed (source re-derived)
acl	clean	None. All 8 claims re-derived correct (first-dot-only regex bug at ACLService.js:77, >=21.1.0 manifest, 3 src / 2 test files, no bin/Dockerfile, 0-vuln audit). The verifier’s one note (Node CHANGELOG timeline) is already handled by doc lines 44-45 — nothing to fix.
antivirus_service	clean	None (all-verified). 29 tracked files, 3 supervisor programs, queue anti-virus-scanner, process.exit(2), README single-URL vs config 3-URL array, all bug claims confirmed. The verifier’s socket-path “subtle issue” is not an error — doc documents ctor default (/var/run/...) and runtime config (/run/...) separately and correctly.
cert_utils	minor-fixed	Feature test LOC 138 → 137 (cert-service.test.ts). yarn.lock size made precise (134,503 bytes, ~131 KiB); the verifier’s “132 KB” was du -h rounding — the original 131 KB was actually the more accurate figure (131.4 KiB), so it was kept, not “corrected up”.
janus-api	minor-fixed	src/ structure annotation “(8 files)” → “5 top-level files + plugin/ subdir (11 .js total)” (verifier missed this; 8 matched neither direct=5 nor recursive=11). README “4 lines” was already correct (verifier’s “3 lines” was the inaccurate remark) — left unchanged.
janus-sdk	clean	None (all-verified, 27 claims). Re-derived: commit caa4590, 11 packages, v1.0.2 ×2, docker-bake undefined room-state-postgres target, boolean-coercion bug config.ts:8/12/13, byte-exact recording regex, 30s roomStateServer.ts:620, lock-lease 10s config.ts:17, hardcoded creds, no .gitattributes.
mq	minor-fixed	Exported-class count “14 → 13” (index.js; added note that 15th src QueueResponse.ts is unexported, reconciling 15 .ts vs 13 exports). Barrel “all 14 → all 13”. QueueManager.ts 342 → 341 lines. Test-file count “13 → 14” *.test.ts (both §4 and §8; the listed filenames already numbered 14).
nyilvantarto_scraper	clean	None (all-verified). 11 unit / 8 integration tests, v2.0.4, RPC kkszb-rpc at server.js:27, timeoutMs 300000, payload-divergence + OCSP bugs confirmed. (An early wc -l of 3 was an rtk truncation artifact, not a real count.)
report-engine	minor-fixed	SystemEvent.action union documented precisely: it declares only 4 values (TimescaleDBService.ts:11) but the SQL views (:185-195) + CallsReportStrategy.ts:470,489 also use undeclared literals (room_created/room_closed/selfservice_room_created, snake_case callback_request_created ≠ camelCase callBackRequest). §9’s flat 7-value list split into type-declared vs SQL-only groups.
resource-manager	major-fixed	Corrected the false “.gitignore is empty (0 bytes)” claim — the file is 219 bytes / 21 lines with real content (.idea/*, .vscode/*, node_modules/*, /logs/*, config/local.json, archive globs, /test/coverage/*); callout rewritten with cite .gitignore:1-21. (All other claims — 2000ms interval, _splitIntoWindow chunkSize-ignored bug, 8 RPC servers — were already correct.)
timestamp_service	clean	None (all-verified, 10 claims). @techteamer/timestamp v2.0.2, commit 7544f92, 5 public methods, Node >=22.0.0, verifyTsr regex :205, toSorted :78, no Dockerfile, openssl-wrapper line cites all confirmed. (Doc silently fixes a source typo “verity”→“verify” in a quoted desc — not a factual error.)
trust_list_proxy	clean	None (all-verified, 9 claims). v0.1.0, Kotlin jvm 1.9.23 / toolchain 18, Gradle 8.5, MainKt/trust-list-proxy, logback 1.4.14, OWASP dep-check 8.2.1 / failBuildOnCVSS=6.6f, doubled logger package com.facekom.tlproxy.com.facekom.tlproxy.logging, @Disabled test :15, nginx :80.
video-processor	clean	None (all-verified, 32 claims). Blue-channel bug bgImgData[j+1] at line 244, profanity comment line 231, model byte-sizes + TFL3 magic, no .gitattributes, @techteamer/video-processor v1.0.0, alphaTable [0,0.8,0.9,1], category-mask 15. (README “node_modele” typo is not a doc error — doc paraphrases, never quotes that line.)
vuer_docker	major-fixed	README.md line count 366 → 479 on devel (working-tree blob 9435 bytes matches devel). The verifier’s two other “issues” were spurious and left unchanged: postgresql/entrypoint.sh “13.5 KB” (actual 13797 bytes ✓) and testenv/Dockerfile “8.4 KB” (actual 8646 bytes ✓) — the verifier had estimated KB from line counts instead of measuring bytes.
vuer_emrtd	minor-fixed	Line 45 JSON row “Jackson 2.21.x (transitive/DSS)” → precise: Jackson core/databind 2.21.1 + annotations 2.21, explicitly pinned as three first-party implementation(...) decls (build.gradle.kts:70-72, overriding the vulnerable transitive Jackson excluded from jnbis) — the “(transitive/DSS)” wording was the real error and contradicted the doc’s own cited line range. (“40 Kotlin files” was correct; early wc of 10 was rtk compression.)
vuer_web_sdk	minor-fixed	experimentalDecorators: true location tsconfig.json:11 → tsconfig.app.json:10 (root tsconfig.json is 7 lines, references-only). Also fixed the inverted app/node config claim in two places (lines 58, 234): tsconfig.app.json is the app config (include: ["src"]); tsconfig.node.json covers vite.config.ts.
esign_css	major-fixed	Line 159 feature-flags claim was backwards (the verifier cleared it in the wrong direction): all five flags (browserSignature, offerRefuseReason, offerPackage, authTokenResend, requireSignaturePhoto) appear in BOTH dev.json and docker.json, not “only in docker.json” — re-derived via git show devel:config/{dev,docker}.json. Also fixed a stray }} typo. (CI workflow pull-request.yaml exists only on the working branch, not devel, but its described contents are accurate — left unchanged.)
INDEX	clean	None — all 5 verifier “issues” were spurious. The doc’s own cited command (git for-each-ref refs/remotes | grep -c 'customization/') reproduces 242 exactly; esign_css=15, esign_oss=15, portal_css=10 all reproduce under the doc’s strict single-segment refs/remotes/origin/customization/* scope; Sequelize models=61 (find -type f -name '*.js'; the verifier’s 63 was a plain-ls miscount). The verifier’s higher numbers came from loose customization* / ls-remote matching that swept in update//maintenance//wip/ etc. refs (89 such in vuer_oss) and hit the live remote rather than the pinned local snapshot. No edits warranted.

Coverage not yet independently verified

• vuer_cv ML model weights were never inspected (Git-LFS data/*.onnx blobs skipped) — any claim about model accuracy/architecture/weights is unverified; only engine code + pointer paths were read.
• The long-tail customization branches (the ~130+ vuer_oss client/ticket/variant branches NOT among the 22 deep-analyzed findings) have catalog-level metadata only (customization-branch-catalog); their file-level divergence is unverified.
• “90 org repos” (techteamer-org-inventory) rests on a gh repo list run dated 2026-05-30 that could not be re-executed offline; the 24 local repos are confirmed, the remote total is not.
• Large source trees (vuer_oss services/tests, vuer_css 1059 UI files, janus-sdk monorepo) were surveyed structurally, not read exhaustively — behavioral claims beyond entrypoints/manifests/configs carry survey-level confidence only.

Sources

• ls /Users/levander/coding/facekom-v2-clones (16 source-only clones) and ls /Users/levander/coding/facekom/ (8 pre-existing product repos)
• /Users/levander/coding/facekom-v2-work/findings/ — 22 client-*.md findings files (19 vuer_oss, 2 portal_css, 1 esign_oss); header of client-vuer_oss-cofidis.md (three-dot diff basis, READ-ONLY)
• git -C /Users/levander/coding/facekom-v2-clones/<repo> branch + .gitattributes (cat-file -p HEAD:.gitattributes) — LFS rule confirmed only in vuer_cv (/data/** filter=lfs); vuer_cv ls-files showing data/*.onnx pointer files
• /Users/levander/levandor_obsidian/projects/facekom-v2/ — INDEX.md (head), repos/ (19 verified doc names), workflow dirs
• /Users/levander/levandor_obsidian/projects/facekom/ — pre-existing older docs confirmed present and intentionally NOT used
• The verifier outputs embedded in the discovery-workflow task (per-doc verdicts, claim counts, issues) — transcribed verbatim above into Results