Tutor Collaboration Mini App — public evidence note
Reviewed for this portfolio: 28 October 2026

SOURCE SNAPSHOT
e79e49d692331ea57aad2c0cea58eb2ac836e15d
Only selected application code and existing documentation were inspected.
No Mini Program test, cloud request, deployment, data repair, or payment was executed for this portfolio.

VERIFIED_FROM_CURRENT_SOURCE
- The commission handler permits own-record reads and bounded candidate reconciliation; Tutor financial advancement is rejected with FORBIDDEN before target commission access.
- New candidates begin pending_verification with amount:null and settlementDate:null.
- Parent requests have role/ownership checks, revisions, and a draft/submitted/cancelled lifecycle.
- Institution access checks its own account, role, reciprocal membership, and review state.
- Existing test assertions cover direct financial calls and spoofed input. Their existence is not a fresh passing test result.

USER_REPORTED / HISTORICAL_DOCUMENTATION
- Yi Zhou reports identifying the broader product scope, requesting Parent and Institution roles, operating WeChat Developer Tools, and finding the historical commission-state concern.
- The historical test reached paid with an unknown amount. Yi Zhou explicitly states that no actual money transfer occurred.
- The original vulnerable cloud handler was not located; a complete original-code before/after comparison is unavailable.
- Earlier deployment/device acceptance is reported in project records, not independently repeated here.

VISUAL PROVENANCE
- Three-role overview and pending-review institution: historical offline browser renderings of actual WXML/WXSS with synthetic fixtures, from the curated evidence candidates. Neither proves device behavior or deployment.
- Submitted Parent requirements: phone screenshot supplied by Yi Zhou on 28 October 2026, showing test records, not customer adoption.
- Both offline rendering copies are byte-identical to the reviewed originals. The phone-image public derivative removes EXIF/text metadata only; decoded pixels are identical and the original is retained separately. Captions distinguish their provenance.
- Original recordings containing contact information are not included.

PLANNED / NOT_VERIFIED
The concept includes independent institution-service and university/graduate-student part-time areas. Their full collaborative operation is not established. Institution lead assignment, independent Parent confirmation, Platform/Admin financial approval, and actual payout remain incomplete. No commercial release, revenue, user count, real payment, or complete security audit is claimed.

ATTRIBUTION
Applicant contribution is identified as his account. ChatGPT helped refine requirements; Codex performed substantial implementation and test work. Git metadata does not establish manual code authorship.