# LayerV demo: recorded deployment verification

These are operator observations from **20 September 2026 (UTC)**, equivalent to the evening of 19 September in US Pacific time. They describe a particular test, not the current visitor’s session or an independent security audit.

## Result

The private report answered through an admitted qURL while direct access to the origin’s application port was refused. Fresh requests returned HTTP 404 after the configured two-minute window. The origin remained healthy, with no container restart, and a new qURL restored access. Together these observations support the intended temporary-access behavior in this run.

The origin did not become publicly reachable when access was granted. LayerV’s gateway supplied the recipient’s route to the outbound qURL Connector.

## Method and observations

Private report revision: `e419484`. Policy: single-use qURL, 60 seconds to open, one session maximum, up to 120 seconds of session access. Health requests used `cache: no-store`, rejected redirects, required the exact harmless health response and had an eight-second timeout. The application container listens on loopback inside its shared Docker network namespace.

| UTC time | Check | Observed result |
| --- | --- | --- |
| 2026-09-20T00:18:33.652Z | direct origin before — Direct IPv4 HTTP GET /healthz on application TCP port 8080; six-second timeout; no redirects | connection refused |
| 2026-09-20T00:21:10Z | host configuration and health before — Docker inspect PortBindings and StartedAt; local HTTP health request inside origin container | both containers had empty port bindings; expected origin health response |
| 2026-09-20T00:23:07.022Z | admitted arrival — Fresh uncached health request through admitted qURL route, exact expected body required | origin answered |
| 2026-09-20T00:23:35.558Z | direct origin during — Same direct IPv4 application-port request as before admission | connection refused |
| 2026-09-20T00:25:08.796Z | after window manual — Fresh uncached health request, 121 seconds after arrival | http error (HTTP 404) |
| 2026-09-20T00:25:17.180Z | after window scheduled — Fresh uncached health request scheduled 130 seconds after page load | http error (HTTP 404) |
| 2026-09-20T00:25:27Z | host health after — Repeat local health and Docker inspection | expected origin health response; empty port bindings; both container start times unchanged |
| 2026-09-20T00:25:54.381Z | fresh invitation recovery — Create and redeem a new qURL; fresh health request on arrival | origin answered |

The host inspection reported empty Docker `PortBindings` for the origin and qURL Connector. Their start times remained unchanged between the two inspections. The local health request returned the expected `everhaven-private-origin` response both times. Temporary qURLs, API keys, cookies and origin identifiers are deliberately omitted from this public record.

## What this does not prove

- Dated operator observations, not a live scan or independent security audit.
- The direct network check covers this origin IPv4 application port only, not all host ports, IPv6, administrative services or every alternate route.
- Connection refused means the tested port rejected a connection; it does not mean the entire host is undetectable.
- HTTP 404 alone does not prove expiry. Timing, healthy origin and fresh-invitation recovery support that interpretation for this session.
- No separate unadmitted-browser test or connector restart was performed in this run.
- LayerV gateway infrastructure remains public; the protected application origin is a different endpoint.
- Downloaded content remains after access ends. Demo sign-in and investor approval are simulated.

## Reproduce the method for your resource

Follow the [LayerV deployment guide](/protect-a-resource/guide.md), starting with signup at [layerv.ai](https://layerv.ai/) and scoped API keys. Use your own application, health response, authorization policy and approved test targets. Verify local health and the listener boundary, test direct access from an outside network, then test admitted access, separate-caller denial, expiry and fresh-link recovery. Keep the origin healthy throughout and record actual outcomes with timestamps. Also test IPv6 and alternate routes where applicable.

The [agent checklist](/protect-a-resource/agent-checklist.md) gives the full acceptance criteria; this one recorded run does not replace them. The report’s **This visit’s connection checks** shows actual requests from each visitor separately.

[Machine-readable JSON record](/protection-evidence.json) · [Deploy LayerV: agent instructions](/agent.md)