cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(qa): qualify route matrix and document stale-write failure

Browse Source
This commit is contained in:
cesnimda
2026-10-22 22:27:51 +02:00
parent 322b025350
commit 82be698dcf
69 changed files with 41364 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/redesign/phase-9/p9-04/README.md
+15
View File
@@ -0,0 +1,15 @@
# P9-04 — Data integrity, providers and security
**PARTIAL overall; RD21 stale-write safety FAIL; MariaDB runtime NOT TESTED.** These dispositions are independent from passing security guards and CV/Dashboard revision contracts.
The complete backend run passed **1,084/1,084**, no failures/skips, on unchanged backend source. [Exact per-case results](../p9-00/backend-cases.json) retain migration-chain/startup/schema ownership, SQLite WAL/held-reader/parallel writes, dashboard owner-and-revision comparisons, unsafe/future-schema/body-limit guards, CV revision/restore, account isolation, session revocation/context/CSRF, admin/last-admin/self guards, document ownership, attachment validation, import URL/transport protections, account export/deletion and sidecar admission contracts. Test-host authentication and SQLite are identified as such; test names do not certify a deployed endpoint.
The 33-route native identity census and separate AI, auth-recovery, rate-limit, ingress and PDF admission lanes belong to the final regression record. Their actual completed counts, rather than expected baseline totals, determine acceptance. Ordinary browser cookies/session context/CSRF exercise local HTTP; local SMTP and inert PDF/AI fixtures are not external-provider/model/native-output acceptance.
The new two-client [RD21 observation](rd21.json) reproduces loss of acknowledged Career and generic job edits. Both stale requests are accepted (200/204) and restore old fields. [Separate issue and exact reproduction](RD21_CONCURRENCY_ISSUE.md) define affected callers and closure proof. CV/Dashboard conflict rejection does not close this. Creation-intent idempotency and the canonical-write/later-Identity partial-commit concern remain separate uncompleted requirements.
Provider availability was checked without installing/restarting services: Docker fails to connect to `dockerDesktopLinuxEngine`; `mariadbd`/`mysqld` are absent from PATH. The existing MariaDB SQL-generation case passes, but no MariaDB server ran. Actual provider startup/migrations/CRUD/constraints/concurrency/restart therefore remain NOT TESTED. No live database, production migration, schema cutover or destructive reset was used.
Offline security gates passed: tracked-secret scan, supply-chain helpers 3, Ollama evaluation helpers 5, browser-runtime helpers 6, ingress helpers 3, Node dependency-policy/SMTP contracts 15 and extension URL contracts 3; SBOM generated from the lockfiles. Exact command exit codes/log hashes are retained in `validation.json` / `.artifacts/phase9/offline.json`. These are bounded tests/static checks, not a penetration-test or blanket security certification.
No manifests, lockfiles, database models/migrations, auth grants, upload limits or inference configuration changed. Live advisories, real provider grants/delivery, enabled-worker recovery, deployment ingress, retention policy, restore/rollback and actual release identity remain [open gates](../RISKS.md). No live external content or model inference was fetched to replace missing evidence.