Exhibit 002 / Authentication workflows / 2025

CIPHER

Historical product code documents photo submission, PayPal checkout, authenticator review, verdicts, and certificate identifiers. The surviving flow evolves from tiered turnaround pricing to a $3 / 24-hour offer; original implementation does not prove completed payments or certificate fulfillment.

Archived / retiredPartial evidence corpus

#002

Founder-recalled sequence

22 AUG 2025

First explicit / Kenneth identity

14

Surviving commits · supplied audit

11

Original byte assets · matched

Repository shell created: 2025-08-22T06:53:38Z.

Architecture / historical source-level workflow

A real workflow architecture, with fulfillment still unproven.

Account
3+ item photographs
PayPal order / capture
Authenticator verdict
Certificate identifier · delivery unproven

Diagram is an archive reconstruction from source and commit records, not an original product screenshot or proof of runtime success.

Source-supported implementation

What was actually built.

Source implements photo submission, PayPal order creation/capture, authenticator review, verdicts and certificate identifiers.

The historical offer moved from tiered pricing (3h/$12, 6h/$9, 12h/$6, 24h/$3) to a $3 / 24-hour flow with at least three images. These are retired product terms, not a current offer.

Gaps / claims / unverified results

Where the evidence stops.

Dashboard certificate links have no matching routes in the preserved React router. Separate external services are not established by this corpus.

The thank-you page does not itself verify payment. Capture logic is not evidence of an actual paid transaction.

Verdict names differ between an early schema and the review UI. This is a compatibility question, not a confirmed runtime failure without the full applied migration state.

Customer counts, turnaround guarantees and AI accuracy are historical marketing claims; no independent outcome evidence is supplied.

Engineering interpretation / not an operational metric

CIPHER exposes the difference between implementing a plausible flow and closing every delivery boundary. The preserved code supports a submission-and-review architecture; it does not prove end-to-end payments or certificate fulfillment.

Cipher is not StyleScope/FashionScan; keep that separate. Do not treat advertising claims of user numbers or product reliability as verified outcomes.

Git history / dates from supplied reconstruction

The surviving commit trail.

Commit titles are original historical statements, not findings that every claimed change worked. Short IDs identify supplied records; private repositories are not linked publicly.

REPOSITORY EVIDENCE

Use tech stack vite_react_shadcn_ts_20250728_minor

Commit record from the supplied reconstruction; not a runtime verification.

9f84e155241e

REPOSITORY EVIDENCE

Add Cipher Auth App

Commit record from the supplied reconstruction; not a runtime verification.

8042eb1360d2

REPOSITORY EVIDENCE

Connect to Supabase project

Commit record from the supplied reconstruction; not a runtime verification.

c31f5bc77e84

REPOSITORY EVIDENCE

feat: Implement PayPal and S3 integrations

Commit record from the supplied reconstruction; not a runtime verification.

2b2f8b136b41

REPOSITORY EVIDENCE

Configure PayPal sandbox and update upload requirements

Commit record from the supplied reconstruction; not a runtime verification.

bbc9b72b3f80

REPOSITORY EVIDENCE

Fix upload to payment flow

Commit record from the supplied reconstruction; not a runtime verification.

6599918b80fe

REPOSITORY EVIDENCE

Add PayPal secrets

Commit record from the supplied reconstruction; not a runtime verification.

7f3a56747278

REPOSITORY EVIDENCE

Fix processing stuck issue

Commit record from the supplied reconstruction; not a runtime verification.

874e1b310f6d

REPOSITORY EVIDENCE

Fix: Stuck on processing

Commit record from the supplied reconstruction; not a runtime verification.

a84910a97127

REPOSITORY EVIDENCE

Convert auth to Supabase

Commit record from the supplied reconstruction; not a runtime verification.

35eb512b9207

REPOSITORY EVIDENCE

Update Supabase schema

Commit record from the supplied reconstruction; not a runtime verification.

c2bc5d7e54d2

REPOSITORY EVIDENCE

Fix: Resolve CSS build error

Commit record from the supplied reconstruction; not a runtime verification.

955a6291ad1e

REPOSITORY EVIDENCE

Fix CSS build error

Commit record from the supplied reconstruction; not a runtime verification.

afd770dbba5e

REPOSITORY EVIDENCE

Fix payment screen and simplify flow

Commit record from the supplied reconstruction; not a runtime verification.

757a83e0bc68

Originals / selected display excerpts

The evidence cabinet.

Full evidence index →

Review original hashes, source types and selected safe previews. Documents, code and artwork are distinct from the archive’s reconstructed diagrams. Downloads await individual approval.

Technical documentation · supplied reconstruction

Evidence and attribution

# What is proven

## Very high confidence
- The surviving repo is `SweetKenneth/luxe-certify`.
- The repo's first explicit project commit is `Add Cipher Auth App` at 2025-08-22T06:47:22Z.
- Cipher is an explicit product identity in source code, not merely founder recollection.
- The product was designed around item/luxury authentication.
- The repo implements customer uploads, payment integration, an authenticator role, review verdicts, and certificate identifiers.
- Initial source presents tiered turnaround pricing: 3h/$12, 6h/$9, 12h/$6, 24h/$3.
- Later source simplifies the offer to $3 with a 24-hour due date.
- FashionScan/StyleScope is a distinct fashion-identification/resale-intelligence application.

## Founder chronology
The founder remembers VirtualArc as the start of the overall project story. Cipher's surviving Git evidence carries an earlier August date, but evidence date and conceptual/founder order remain separate fields.

## Not yet proven
- Whether Cipher conceptually preceded VirtualArc despite the surviving date.
- Whether Cipher directly donated code or architecture into VirtualArc.
- Whether the product processed real paid customer volume at the scale claimed in marketing copy.
- Whether the AI/expert authentication claims were independently validated.

Implementation limits

# Cipher: actual routes, payment state and schema contradictions

Code pinned to final surviving commit `757a83e0bc6810eb6a0383a85fd64decd80d8055`:

1. `src/App.tsx` registers `/`, `/auth`, `/upload`, `/dashboard`, `/authenticator`, `/thank-you`. **It does not register `/cert/:slug`**.
2. `CipherDashboard.tsx` generates links to `/cert/${cert_slug}` and `/api/cert/${submission.id}` when a verdict exists. **Neither route is present in the preserved React router.** This does not rule out separately deployed API services, but the current evidence does not prove PDF certificate delivery.
3. `Authenticator.tsx` allows `AUTHENTIC`, `REPLICA`, `NOT_IN_DB`, while the earliest SQL migration's verdict CHECK allows `AUTHENTIC`, `FAKE`, `UNKNOWN`. Later migrations need to be applied/inspected before declaring this a confirmed runtime error.
4. `ThankYou.tsx` presents a successful-payment message but itself does not validate the transaction; server `cipher-paypal-capture` code contains payment-capture logic, not proof of a completed real-world payment.

**Conclusion:** The code establishes a real product workflow architecture with gaps. Do not market this historical version as proven end-to-end payments and certificates.

A permanent record of retired software. Evidence preservation is not proof of product success.

The architect’s dossier