OpsProof 0.5 onboarding and voluntary pilot — 7 October 2026 New first-use guidance preserves existing browser work and points learners to one requirement, the browser rollout lab and explicit export selection. Reviewers can open the worked example. The landing page now links to the optional pilot. Five learners and three reviewers are recruitment targets, not observed results. The separate pilot page supports consented interest and feedback submissions, optional separately consented contact, clearly labelled local drafts, and private receipts for withdrawal. Form fields stay in memory until a deliberate action. No workspace or attachment is automatically sent. No follow-up messages are sent. Storage uses new OpsProof tables and one function in the existing user-approved Supabase project. RLS and revoked public/client grants prevent direct reads or writes. The function validates bounded inputs and acknowledges only after an insert. Withdrawal requires the receipt ID and random secret token; only the token hash is stored. Its response does not disclose whether a record matched. Network-address hints are salted-hashed for request limits. Expired counters are cleared on later requests; provider logs follow provider policies. Pilot records remain until withdrawn or removed by the owner. No automatic deletion date. Release verification: - 140 JavaScript tests passed, including 7 onboarding, 12 pilot UI and 12 backend tests. The existing deterministic rollout and export tests remain green. - 19 local-server tests passed; 1 Windows symlink test skipped. - 226 public local references resolved; private-file/sentinel checks passed. - Browser guide preserved an unsaved requirement through navigation, reflected a confirmed saved requirement, and remembered dismissal after reload. - Actual browser synthetic feedback required collection consent, persisted with a receipt, and was withdrawn. SQL confirmed that test row was absent afterward. - Contact without separate permission was blocked; a local invitation draft excluded contact and was explicitly marked not sent. - Live backend synthetic tests verified persistence, wrong-token non-deletion, correct-token deletion, anonymous table/RPC denial and atomic request caps. - Independent source review found two issues that were fixed and rechecked: multilingual payload capacity and native form submission if JavaScript fails. CSP blocks native form navigation; submit buttons stay disabled until bound. - Guide and pilot forms had no horizontal overflow at 390px. No console errors or warnings were observed in the tested local browser flow. Not a full audit. Limits: anonymous/public submissions remain unverified, even if described as a human session. Synthetic QA is not user research. No human recruitment or pilot results, hiring benefit, demand validation or production competence is claimed. Public app credentials and request caps do not verify people or guarantee abuse prevention. Existing shared-project quotas apply. Losing a receipt loses the self-service withdrawal capability. Data already shared elsewhere is separate. Production verification: eleven changed public routes returned 200 without authentication and matched local SHA-256/byte sizes. The live workbench displayed 0.5 and the first-pack guide. A production synthetic interest submission returned a receipt; its actual downloaded JSON was verified. Initial withdrawal returned a storage 503, a single manual retry succeeded, and SQL confirmed deletion. The exact transient cause is unresolved; private operation/status-only diagnostics were added for future failures. No test records remain and no automatic retry is used. Input and permission checks passed on the updated collector. Previous release evidence follows; it describes the unchanged rollout/export workflow tested in 0.4, not a newly repeated independent human study. OpsProof 0.4 reproducible rollout release — 7 October 2026 The hosted workbench includes a browser-run deterministic rollout simulation. Users execute the broken baseline, change settings, run checks, explain the connection to a confirmed requirement, and disclose assistance. Saving creates an artifact and eight replay files. Failed attempts can be saved without being relabeled as passing. Editing settings blocks saving until the checks run again. The same JavaScript engine runs in the browser and in the offline Node replay. The ZIP contains the engine, runner, baseline/final config and report, README instructions and provenance. Node 20+ is required to replay; no npm installation, cloud account or network is required. Native browser authoring needs no Node. Read source links now show source text directly without another disclosure click. Verification completed: - 109 JavaScript tests passed, including the 128-configuration model matrix, browser/Node parity, report tampering, atomic eight-file storage, invalid input, private field projection, save races and old workspace regressions. - 19 local-server tests passed; 1 symlink test skipped because this Windows host lacks symlink creation permission. Unchanged Python lab suites were not rerun. - Actual browser workflow: baseline failed all three checks; readiness-only change passed its probe but failed capacity/recovery; final change passed. - Invalid reruns clear earlier success output; edited settings disabled save; missing explanation was rejected. Eight files and the artifact/claim persisted after reload. Export selection remained manual. - Actual downloaded ZIP CRC passed; all 18 manifest payload hashes and sizes matched. Private location/requirement test notes were excluded. - A fresh AI agent received only the downloaded ZIP, followed its instructions and reproduced both reports on Node v24.19.0. Replay exit 0, empty stderr. Baseline MATCH/FAIL; final MATCH/PASS. A separately copied and altered report was detected as MISMATCH with exit 1. Original evidence remained untouched. - Browser lab at 390px had no page overflow. Desktop/mobile layouts inspected; no console errors/warnings observed. This is not a full accessibility audit. Interpretation: replay establishes consistency with the supplied deterministic model, not independent validation of that model against production. No real cloud, Kubernetes, concurrency, network probes or production traffic are modeled. No human participant, verified authorship, hiring benefit or demand validation. The intermediate readiness-only trial was observed in browser QA, but was not included as a separate report in the exported baseline/final pack. Workspace text and files are separate localStorage/IndexedDB records, not a cross-storage transaction. File batches commit atomically. If text persistence fails, the UI reports it and keeps the in-memory record available for export. JSON workspace backups exclude file bytes; keep source originals. Browser cleanup can remove local data. No hosted workspace API or cloud runner is used. The browser fetches public first-party runner sources when saving lab evidence. Selected text attachments: 2 MB each, 10 MB combined, 100 files. Filename and private-key checks are not a complete secret scanner. Inspect files before sharing. Hashes are not a signature or proof of ownership. The lab engine was developed with AI assistance; user assistance statements remain self-reported.