build_verify
ACCEPTANCE TEST of your app's running PREVIEW (after build_deploy, before build_go_live). Where build_audit reads the code, build_verify USES the deployed preview like a buyer would, with throwaway test accounts (verify-@example.com, deleted afterwards): health (serves, app.js = the published version, boots, API reachable); accounts (sign-up, login right after sign-up, login, forgot-password reachable); the role permission matrix (per end-user role x schema: the declared policy holds, server-owned fields such as status/totals/payment state cannot be written by the user, fulfilment records cannot be minted, another user's records cannot be read); commerce (the server prices checkout even when the client price/amount is tampered; a success-URL visit without payment changes nothing; Stripe TEST mode only, otherwise refused); event-bound workflows reach COMPLETED with the verified recipient (no real email is ever sent); capacity is enforced; draft/hidden rows stay out of public reads; launch basics (terms/privacy, meta, viewport, gzip, headers). Returns a score and pass/fail/skip per check with evidence and the exact fix. Only the caller's own project PREVIEW, never the live app or other projects. ~1-3 min, rate-limited; dry_run=true lists the planned checks. Flow: build_audit -> build_publish -> build_deploy -> build_verify -> fix -> build_go_live (which reports the latest build_verify result).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Always 'preview' (default). The live app is never tested. | |
| dry_run | No | true: list the planned checks for the published bundle without touching the preview. | |
| budget_s | No | Total time budget in seconds (30-180, default 180). Partial results are returned when it runs out. | |
| project_uuid | Yes | Your project (its running preview is tested). |