# Validation record — 25 October 2026

Environment: Linux amd64, rootless Podman 5.8.6, Docker Compose 5.6.1 through
Podman's Docker-compatible API, Python 3.14.8. Shell scripts invoked Compose
through a local command adapter because Docker Engine was not installed on this
test host. The adapter is not part of this download.

Pinned official image references:

- CouchDB 3.5.3:
  docker.io/library/couchdb@sha256:4e8e0a366208a87d5059b0f4fcbefff13c32401a655d4629c19be6288ea77675
- Caddy 2.11.7:
  docker.io/library/caddy@sha256:04913b1da43339a40ad1ea87827d70a576ac5aa6cf674c6e24fdca675887533a

Tests performed against isolated local containers and disposable data:

1. Compose configuration parsed and its CouchDB service started successfully.
2. Fresh initialization passed; a second initialization preserved credentials
   and passed again.
3. Anonymous and incorrect-password vault access returned 401; the restricted
   user authenticated without roles and read its vault.
4. The restricted user could not access the server configuration API or create
   another database. A database-membership mutation did not succeed and an admin
   read confirmed membership remained unchanged. That mutation returned HTTP 500
   with `no_majority` on this single-node build, rather than the expected 403;
   do not treat an arbitrary 500 response as proof of authorization correctness.
5. CORS preflights allowed app://obsidian.md, capacitor://localhost and
   http://localhost with exact origins and credentials=true. An unlisted web
   origin received no allow-origin header.
6. The restricted user created, read, updated and deleted disposable documents.
   A retained test document included a base64 text attachment.
7. After a Compose restart, the retained document and attachment SHA-256 matched.
8. backup.sh cleanly stopped the source, archived its volume, created a checksum
   and restarted the source. restore.sh checked the checksum, extracted into a
   separate project/volume on another loopback port and passed init/check.
   The recovered document's updated field and attachment SHA-256 matched.
9. The pinned Caddy image validated the production Caddyfile syntax/configuration.
   Python compilation and POSIX shell syntax checks passed.

Not exercised: Docker Engine on an Ubuntu Lightsail instance, public DNS/ACME
issuance, external port reachability, host failure, encrypted off-host retention,
real Markdown vault reconstruction, LiveSync E2EE, or desktop/iOS/Android plugin
end-to-end synchronization. Use the article's acceptance checklist for those.

The tests demonstrate reference behavior, not future compatibility or a guarantee
for an existing vault. No existing personal vault or cloud resource was changed.