diff --git a/README.md b/README.md
index 77e422977..e9f9fce80 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ RegEngine is an API-first traceability evidence platform for food supply chains.
Inflow Workbench prepares data with preflight checks, readiness scores, a fix queue, and a commit gate. Optional Jev assistance suggests CSV column mappings and missing event types; deterministic validation and authenticated tenant boundaries remain authoritative.
-[Website](https://regengine.co) · [Public proof](https://regengine.co/proof) · [Verify a bundle](https://regengine.co/verify) · [Product description](docs/PRODUCT_DESCRIPTION.md) · [Python SDK](regengine/README.md)
+[Website](https://regengine.co) · [Verify a bundle](https://regengine.co/verify) · [Product description](docs/PRODUCT_DESCRIPTION.md) · [Python SDK](regengine/README.md)
This is a pre-production application with deployed public proof surfaces. The capability inventory below describes checked-in implementation and release policy, not proof of customer adoption or live configuration.
@@ -381,7 +381,7 @@ RegEngine is proprietary, source-visible software — all rights reserved by Reg
> **Before changing this repository's visibility**, work through [docs/security/PRE_PUBLIC_CHECKLIST.md](docs/security/PRE_PUBLIC_CHECKLIST.md). Confidential business material is currently tracked in-tree, and `git rm` removes it from `HEAD` only — every prior revision stays readable.
-Permissive exceptions — the public verifier tools are **Apache 2.0** (declared in [LICENSE](LICENSE)) so anyone can use, copy, and embed them: the `/proof` Merkle bundle verifier ([frontend/public/sdk/verify_chain.py](frontend/public/sdk/verify_chain.py)) and the `regengine-verify` per-record CLI ([regengine/verify_records.py](regengine/verify_records.py)). [Inflow Lab](https://github.com/regengine/inflow-lab), the integration simulator, is Apache 2.0 in its own repository for the same reason.
+Permissive exceptions — the public verifier tools are **Apache 2.0** (declared in [LICENSE](LICENSE)) so anyone can use, copy, and embed them: the Merkle bundle verifier ([frontend/public/sdk/verify_chain.py](frontend/public/sdk/verify_chain.py)) and the `regengine-verify` per-record CLI ([regengine/verify_records.py](regengine/verify_records.py)). [Inflow Lab](https://github.com/regengine/inflow-lab), the integration simulator, is Apache 2.0 in its own repository for the same reason.
## Contributing
diff --git a/docs/PRODUCT_DESCRIPTION.md b/docs/PRODUCT_DESCRIPTION.md
index 6f4f38df4..a014a8583 100644
--- a/docs/PRODUCT_DESCRIPTION.md
+++ b/docs/PRODUCT_DESCRIPTION.md
@@ -29,7 +29,7 @@ A browser verifier and a downloadable Python bundle verifier let reviewers inspe
| Tenant-scoped records and tamper-evident chains | [Tenant authority](../services/shared/tenant_context.py), [canonical persistence](../services/shared/canonical_persistence/writer.py), [canonical chain verification](../services/shared/canonical_persistence/verification.py), [admin audit integrity](../services/admin/app/audit_integrity.py). See [persistence cutover](persistence/dual-write-cutover.md). |
| FDA-oriented exports and request-response packages | Release-enabled: [FDA export](../services/ingestion/app/fda_export/router.py), [request workflow](../services/ingestion/app/request_workflow_router.py), [auditor API](../services/ingestion/app/auditor_router.py). |
| Readiness assessments and recall reporting | Release-enabled: [readiness](../services/ingestion/app/readiness_router.py), [recall reports](../services/ingestion/app/recall_report.py). |
-| Public proof and recall-drill endpoint | [Proof page](https://regengine.co/proof), [browser verifier](https://regengine.co/verify), [verifier source](../frontend/public/sdk/verify_chain.py). Synthetic verification artifacts; the recall-drill endpoint currently returns no drill data. |
+| Bundle verifier and recall-drill endpoint | [Browser verifier](https://regengine.co/verify), [verifier source](../frontend/public/sdk/verify_chain.py). The recall-drill endpoint currently returns no drill data. |
| Supplier manifest remediation and correction links | Implemented in [remediation](../services/ingestion/app/remediation/) and the [buyer dashboard](../frontend/src/app/remediation/page.tsx); excluded from the production router allowlist. Notification delivery also requires recipient/provider configuration. |
| EPCIS JSON-LD export and broader recall simulations | Implemented in [EPCIS export](../services/ingestion/app/epcis_export.py) and [simulations](../services/ingestion/app/recall_simulations.py); these routers are experimental and excluded from the production allowlist. Public sample EPCIS downloads are a separate proof surface. |
| Inbound email CSV ingestion | [Postmark integration](../services/ingestion/app/email_ingest/); excluded from the production allowlist, with no self-service provisioning UI. See [rollout notes](engineering/EMAIL_INGESTION.md). |
@@ -48,7 +48,7 @@ A browser verifier and a downloadable Python bundle verifier let reviewers inspe
## Talking-track opener
-RegEngine turns supplier and ERP records into traceability evidence for food businesses. Import records, identify missing or inconsistent CTEs and KDEs, resolve issues, and assemble FDA-oriented exports with verifiable audit evidence. Inflow Workbench prepares the data; RegEngine stores and verifies the evidence. Inspect the synthetic examples at [regengine.co/proof](https://regengine.co/proof) and check a bundle at [regengine.co/verify](https://regengine.co/verify).
+RegEngine turns supplier and ERP records into traceability evidence for food businesses. Import records, identify missing or inconsistent CTEs and KDEs, resolve issues, and assemble FDA-oriented exports with verifiable audit evidence. Inflow Workbench prepares the data; RegEngine stores and verifies the evidence. Check a bundle at [regengine.co/verify](https://regengine.co/verify).
## Maintenance rule
diff --git a/docs/security/PRE_PUBLIC_CHECKLIST.md b/docs/security/PRE_PUBLIC_CHECKLIST.md
index 4343aae41..b85acb99d 100644
--- a/docs/security/PRE_PUBLIC_CHECKLIST.md
+++ b/docs/security/PRE_PUBLIC_CHECKLIST.md
@@ -72,6 +72,6 @@ it reactively at flip time.**
- `REPO_PURPOSE.md` — the scope these files fall outside of.
- `SECURITY.md` — reporting and disclosure posture.
-- The public proof surface (`/proof`, `/verify`) already provides
+- The public verifier (`/verify`) already provides
transparency and audit **without** requiring source visibility. It is the
reason the README's public-repository claim sounded plausible.
diff --git a/frontend/README.md b/frontend/README.md
index f126501d7..789d7e4a7 100644
--- a/frontend/README.md
+++ b/frontend/README.md
@@ -15,7 +15,7 @@ See the [product description](../docs/PRODUCT_DESCRIPTION.md) for capability ava
| Buyer manifest remediation and correction actions | [remediation](src/app/remediation/) — requires the remediation API, which is excluded from the production allowlist |
| Recall reporting and audit views | [recall report](src/app/dashboard/recall-report/), [audit](src/app/audit/) |
| Email-code/passkey login, invitations, and API keys | [login](src/app/login/), [invite acceptance](src/app/accept-invite/), [API keys](src/app/api-keys/) |
-| Public synthetic proof, bundle verification, and recall drill | [proof](src/app/proof/), [verify](src/app/verify/) |
+| Bundle verification and recall drill | [verify](src/app/verify/), [recall drills](src/app/dashboard/recall-drills/) |
| Product documentation and developer portal | [docs](src/app/docs/), [developer portal](src/app/developer/portal/) |
Jev assistance is optional. Suggestions are visible for review; automatic application defaults off. See the [Jev guide](../docs/engineering/JEV_HEADER_MAPPING.md) for configuration, evidence, and data-sharing defaults.
diff --git a/frontend/src/__tests__/pages/empty-states-3554.test.ts b/frontend/src/__tests__/pages/empty-states-3554.test.ts
new file mode 100644
index 000000000..957d514cc
--- /dev/null
+++ b/frontend/src/__tests__/pages/empty-states-3554.test.ts
@@ -0,0 +1,66 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { CAPABILITY_REGISTRY, STATUS_LABELS } from '@/lib/customer-readiness';
+
+const read = (p: string) => readFileSync(resolve(process.cwd(), p), 'utf8');
+
+describe('#3554 empty states and hidden sample artifacts', () => {
+ it('export-jobs and integrations show No data yet with CSV upload and JSON events API next steps', () => {
+ for (const page of ['src/app/dashboard/export-jobs/page.tsx', 'src/app/integrations/page.tsx']) {
+ const src = read(page);
+ expect(src).toContain('title={NO_DATA_YET}');
+ expect(src).toMatch(/href="\/ingest"/);
+ expect(src).toMatch(/href="\/docs\/api"/);
+ }
+ });
+
+ it('support pages render Not set for empty channel fields', () => {
+ for (const page of ['src/app/settings/support/page.tsx', 'src/app/trust/support/page.tsx']) {
+ const src = read(page);
+ expect(src).toContain('channel.responseWindow || NOT_SET');
+ expect(src).toContain('channel.notes || NOT_SET');
+ }
+ });
+
+ it('labels the EPCIS capability as Preview', () => {
+ const epcis = CAPABILITY_REGISTRY.find((item) => item.id === 'epcis');
+ expect(epcis?.name).toBe('GS1 EPCIS 2.0 (Preview)');
+ expect(epcis && STATUS_LABELS[epcis.status]).toBe('Preview');
+ });
+
+ it('no longer publishes the made-up proof samples', () => {
+ expect(existsSync(resolve(process.cwd(), 'public/proof/fsma-204-sample.csv'))).toBe(false);
+ expect(existsSync(resolve(process.cwd(), 'public/proof/epcis-sample.jsonld'))).toBe(false);
+ });
+
+ it('hides /proof/transformation and drops every link to it', () => {
+ expect(read('src/app/proof/transformation/page.tsx')).toContain('notFound()');
+ expect(existsSync(resolve(process.cwd(), 'src/app/proof/transformation/opengraph-image.tsx'))).toBe(false);
+ expect(read('src/app/sitemap.ts')).not.toContain('/proof/transformation');
+ expect(read('src/app/walkthrough/page.tsx')).not.toContain('/proof/transformation');
+ });
+
+ it('removes the public proof zips', () => {
+ for (const f of ['public/proof/audit-bundle.zip', 'public/proof/audit-bundle-tampered.zip']) {
+ expect(existsSync(resolve(process.cwd(), f))).toBe(false);
+ }
+ });
+
+ it('security page shows No data yet instead of illustrative verifier output', () => {
+ const src = read('src/app/security/page.tsx');
+ expect(src).not.toContain('Sample · illustrative');
+ expect(src).toContain('title={NO_DATA_YET}');
+ });
+
+ it('CTE pages ask for the user\'s own file, not a sample', () => {
+ const src = read('src/app/fsma-204/[cte]/page.tsx');
+ expect(src).not.toContain('Upload a sample');
+ // After merging main (#3557 retired /sandbox), the closing CTA copy comes from
+ // sandboxCta().blurb, which asks for the user's own records and links /ingest.
+ expect(src).toContain('{cta.blurb}');
+ expect(src).not.toContain('sandbox and get an instant');
+ expect(src).not.toContain('data to the sandbox');
+ expect(src).toMatch(/data to\{" "\}\s*]*>RegEngine<\/Link>/);
+ });
+});
diff --git a/frontend/src/__tests__/pages/pre-revenue-copy.test.ts b/frontend/src/__tests__/pages/pre-revenue-copy.test.ts
index 52a2ae3a7..95eb9275c 100644
--- a/frontend/src/__tests__/pages/pre-revenue-copy.test.ts
+++ b/frontend/src/__tests__/pages/pre-revenue-copy.test.ts
@@ -13,7 +13,6 @@ const PUBLIC_FILES = [
'src/app/compare/repositrak/page.tsx',
'src/app/supplier-compliance/page.tsx',
'src/app/tools/roi-calculator/components/ROICalculatorClient.tsx',
- 'src/app/case-studies/page.tsx',
'src/app/developers/page.tsx',
'src/app/status/page.tsx',
];
@@ -59,10 +58,4 @@ describe('pre-revenue public copy', () => {
expect(page).toContain('Pricing is temporarily unavailable');
expect(page).toContain('What does the Founding rate include?');
});
-
- it('states pre-revenue status plainly on the case study disclosure', () => {
- expect(read('src/app/case-studies/page.tsx')).toContain(
- 'RegEngine is pre-revenue; self-serve access is in staged rollout.',
- );
- });
});
diff --git a/frontend/src/__tests__/pages/proof-trust-copy.test.tsx b/frontend/src/__tests__/pages/proof-trust-copy.test.tsx
index 13d875866..48b94fcd2 100644
--- a/frontend/src/__tests__/pages/proof-trust-copy.test.tsx
+++ b/frontend/src/__tests__/pages/proof-trust-copy.test.tsx
@@ -56,10 +56,10 @@ describe('public proof-bundle trust copy', () => {
}
});
- it('/proof states the checks do not authenticate the issuer', () => {
+ it('/proof shows the empty state instead of artifacts', () => {
const text = renderedText();
- expect(text).toMatch(/do not authenticate the issuer/i);
+ expect(text).toMatch(/no public artifacts are published yet/i);
for (const claim of UNBACKED_AUTHENTICITY_CLAIMS) {
expect(text).not.toMatch(claim);
diff --git a/frontend/src/__tests__/public-site-fixes.test.tsx b/frontend/src/__tests__/public-site-fixes.test.tsx
index c3980f73b..b3311da2a 100644
--- a/frontend/src/__tests__/public-site-fixes.test.tsx
+++ b/frontend/src/__tests__/public-site-fixes.test.tsx
@@ -158,14 +158,7 @@ describe('public site launch-blocker fixes', () => {
});
});
- it('labels synthetic validation honestly in the footer', () => {
- expect(MARKETING_FOOTER_PRODUCT_LINKS).toContainEqual({
- label: 'Product Validation',
- href: '/case-studies',
- });
- expect(MARKETING_FOOTER_PRODUCT_LINKS).not.toContainEqual({
- label: 'Case Studies',
- href: '/case-studies',
- });
+ it('keeps the hidden case-studies route out of the footer', () => {
+ expect(MARKETING_FOOTER_PRODUCT_LINKS.map((link) => link.href)).not.toContain('/case-studies');
});
});
diff --git a/frontend/src/app/admin/page.tsx b/frontend/src/app/admin/page.tsx
index dd24a9583..25f397d28 100644
--- a/frontend/src/app/admin/page.tsx
+++ b/frontend/src/app/admin/page.tsx
@@ -311,7 +311,7 @@ export default function AdminPage() {
title="API Key Created Successfully"
className="mt-4"
>
-
- Ready to implement FSMA 204 traceability in your business? See how RegEngine handles CTE/KDE capture, validation, and EPCIS-oriented export workflows.
+ Ready to implement FSMA 204 traceability in your business? See how RegEngine handles CTE/KDE capture, validation, and EPCIS-oriented export workflows (Preview).
@@ -249,8 +250,18 @@ export default function ExportJobsPage() {
+ Upload a CSV
+
+ }
+ secondaryAction={
+
+ JSON events API docs
+
+ }
/>
{exportPrereqs.map((step) => (
diff --git a/frontend/src/app/dashboard/integrations/page.tsx b/frontend/src/app/dashboard/integrations/page.tsx
index 3a3449785..82b5b538f 100644
--- a/frontend/src/app/dashboard/integrations/page.tsx
+++ b/frontend/src/app/dashboard/integrations/page.tsx
@@ -62,6 +62,7 @@ const STATUS_TONES: Record = {
export_supported: 'info',
file_import_supported: 'info',
pilot: 'warning',
+ preview: 'warning',
design_partner: 'warning',
custom_scoped: 'neutral',
preparation: 'neutral',
diff --git a/frontend/src/app/dashboard/settings/page.tsx b/frontend/src/app/dashboard/settings/page.tsx
index da897ff58..e9077e16f 100644
--- a/frontend/src/app/dashboard/settings/page.tsx
+++ b/frontend/src/app/dashboard/settings/page.tsx
@@ -49,7 +49,7 @@ const INTEGRATIONS = [
{ id: 'netsuite', name: 'Oracle NetSuite', category: 'ERP', status: 'available', desc: 'Cloud ERP and financials' },
{ id: 'walmart', name: 'Walmart GDSN', category: 'Retailer', status: 'coming_soon', desc: 'Global Data Synchronization' },
{ id: 'kroger', name: 'Kroger 84.51\u00b0', category: 'Retailer', status: 'coming_soon', desc: 'Retailer data exchange' },
- { id: 'epcis', name: 'EPCIS 2.0 Gateway', category: 'Standards', status: 'epcis_preview', desc: 'GS1 event format bridge; ingest in Preview' },
+ { id: 'epcis', name: 'EPCIS 2.0 Gateway (Preview)', category: 'Standards', status: 'epcis_preview', desc: 'GS1 event format bridge; ingest in Preview' },
{ id: 'webhook', name: 'Custom Webhooks', category: 'Custom', status: 'preview', desc: 'Push events to your endpoints' },
];
/**
diff --git a/frontend/src/app/docs/api/ApiReferenceClient.tsx b/frontend/src/app/docs/api/ApiReferenceClient.tsx
index 49d0a6870..89fc0b50e 100644
--- a/frontend/src/app/docs/api/ApiReferenceClient.tsx
+++ b/frontend/src/app/docs/api/ApiReferenceClient.tsx
@@ -370,15 +370,15 @@ function EndpointCard({ endpoint }: { endpoint: Endpoint }) {
}
const ERROR_CODES = [
- { code: '400', desc: 'Bad Request - Missing Idempotency-Key or invalid parameters' },
- { code: '401', desc: 'Unauthorized - Missing or invalid API key, or a missing or wrong ingest signature' },
- { code: '402', desc: 'Payment Required - No active subscription for the workspace' },
- { code: '403', desc: 'Forbidden - Key lacks the required scope, or tenant_id / X-Tenant-ID names a different workspace' },
- { code: '404', desc: "Not Found - Resource doesn't exist" },
- { code: '409', desc: 'Conflict - Idempotency-Key reused with different request bytes' },
- { code: '422', desc: 'Unprocessable - Request body failed validation' },
- { code: '429', desc: 'Too Many Requests - Rate limited' },
- { code: '500', desc: 'Internal Error - Contact support' },
+ { code: '400', desc: 'Bad Request: Missing Idempotency-Key or invalid parameters' },
+ { code: '401', desc: 'Unauthorized: Missing or invalid API key, or a missing or wrong ingest signature' },
+ { code: '402', desc: 'Payment Required: No active subscription for the workspace' },
+ { code: '403', desc: 'Forbidden: Key lacks the required scope, or tenant_id / X-Tenant-ID names a different workspace' },
+ { code: '404', desc: "Not Found: Resource doesn't exist" },
+ { code: '409', desc: 'Conflict: Idempotency-Key reused with different request bytes' },
+ { code: '422', desc: 'Unprocessable: Request body failed validation' },
+ { code: '429', desc: 'Too Many Requests: Rate limited' },
+ { code: '500', desc: 'Internal Error: Contact support' },
];
const RATE_LIMIT_HEADERS = [
diff --git a/frontend/src/app/docs/authentication/page.tsx b/frontend/src/app/docs/authentication/page.tsx
index a253ba9f4..8f7746fde 100644
--- a/frontend/src/app/docs/authentication/page.tsx
+++ b/frontend/src/app/docs/authentication/page.tsx
@@ -134,7 +134,7 @@ export default function AuthenticationDocsPage() {
Scopes limit which of the endpoints above a key can call. They are not a read-only guarantee: some other
operations on the RegEngine backend, for example compliance snapshots, SLA request updates, onboarding steps
- and the EPCIS intake endpoint (in Preview), accept any valid tenant key without checking a named scope. Treat every key as
+ and the EPCIS intake endpoint (Preview), accept any valid tenant key without checking a named scope. Treat every key as
read-write for its workspace. Keep it on your server, never in client-side code, and ask RegEngine to
revoke it if it leaks.
- Post a Receiving CTE for a lot that arrived at your facility — the starting anchor for
+ Post a Receiving CTE for a lot that arrived at your facility. It is the starting anchor for
the chain. Fill the skeleton's {''},{' '}
immediate_previous_source, and the other fields with your own values.
diff --git a/frontend/src/app/fsma-204/[cte]/page.tsx b/frontend/src/app/fsma-204/[cte]/page.tsx
index dfade3342..b7c657e10 100644
--- a/frontend/src/app/fsma-204/[cte]/page.tsx
+++ b/frontend/src/app/fsma-204/[cte]/page.tsx
@@ -425,17 +425,9 @@ export default async function CTELandingPage({
title="How RegEngine Helps"
description={
<>
- {cta.enabled ? (
- <>
- Upload your {data.name.toLowerCase()} data to the sandbox and
- RegEngine surfaces these issues before they become audit findings during a §1.1455 records request.
- >
- ) : (
- <>
- RegEngine surfaces these issues in your {data.name.toLowerCase()}{" "}
- data before they become audit findings during a §1.1455 records request.
- >
- )}
+ Upload your {data.name.toLowerCase()} data to{" "}
+ RegEngine and
+ RegEngine surfaces these issues before they become audit findings during a §1.1455 records request.
>
}
>
diff --git a/frontend/src/app/fsma-204/page.tsx b/frontend/src/app/fsma-204/page.tsx
index 3b8e9a9e8..bda6844df 100644
--- a/frontend/src/app/fsma-204/page.tsx
+++ b/frontend/src/app/fsma-204/page.tsx
@@ -372,8 +372,6 @@ export default function FSMA204BusinessGuidePage() {
Try it:{" "}
- /proof
- {" "}→{" "}
/verify.
diff --git a/frontend/src/app/fsma/page.tsx b/frontend/src/app/fsma/page.tsx
index dd599e907..76d748a5d 100644
--- a/frontend/src/app/fsma/page.tsx
+++ b/frontend/src/app/fsma/page.tsx
@@ -95,8 +95,9 @@ function FSMADashboardContent() {
}
};
- const handleStartDrill = async (type: RecallDrillType = 'FORWARD', fallbackTlc = 'TLC1001') => {
- const tlc = activeTlc || fallbackTlc;
+ const handleStartDrill = async (type: RecallDrillType = 'FORWARD') => {
+ const tlc = activeTlc;
+ if (!tlc) return;
try {
await createDrill.mutateAsync({
type,
@@ -157,8 +158,8 @@ function FSMADashboardContent() {
}
>
- Cookie-backed session auth now powers the live FSMA dashboard. Until you sign in,
- demo visualization is shown below.
+ Cookie-backed session auth powers the live FSMA dashboard. Sign in to see
+ your live facilities, lots, and recall readiness below.
)}
@@ -223,14 +224,6 @@ function FSMADashboardContent() {
Trace
EPCIS 2.0 export (Preview)
@@ -588,7 +588,7 @@ HTTP 201
EPCIS 2.0 (Preview) can support trading-partner interoperability. RegEngine treats EPCIS 2.0 as a preview schema where the enabled workflow and source data allow it.
- Verify EPCIS coverage with each vendor; some platforms layer EPCIS over legacy schemas, which can introduce conversion edges.
+ Verify EPCIS (Preview) coverage with each vendor; some platforms layer EPCIS over legacy schemas, which can introduce conversion edges.