From a7c6b5bf527a6fa3013e89b85f810343272e27bc Mon Sep 17 00:00:00 2001 From: cesnimda Date: Fri, 9 Oct 2026 08:47:41 +0200 Subject: [PATCH] docs(redesign): record fresh P5-15-01 backend evidence --- .../p5-15-01/evidence/backend-summary.json | 946 ++++++++++++++++++ 1 file changed, 946 insertions(+) create mode 100644 docs/redesign/phase-5/p5-15/p5-15-01/evidence/backend-summary.json diff --git a/docs/redesign/phase-5/p5-15/p5-15-01/evidence/backend-summary.json b/docs/redesign/phase-5/p5-15/p5-15-01/evidence/backend-summary.json new file mode 100644 index 0000000..e0d7cdf --- /dev/null +++ b/docs/redesign/phase-5/p5-15/p5-15-01/evidence/backend-summary.json @@ -0,0 +1,946 @@ +{ + "recordedLocalDate": "2026-10-09", + "scope": "P5-15-01 fresh backend and deterministic offline preservation audit", + "sourceCheckpoint": "932b962b9038ddb5ad59b982c0199475bfb50454", + "headAtValidationEnd": "932b962b9038ddb5ad59b982c0199475bfb50454", + "branch": "codex/ui-redesign-phase4", + "startedUtc": "2026-10-09T06:41:52.723507+00:00", + "finishedUtc": "2026-10-09T06:43:12.276147+00:00", + "result": "PASS", + "resultFilesVerified": true, + "resultInterpretation": "All executed backend/offline gates passed; scoped local evidence only. Coverage gaps remain NOT VERIFIED, not passes.", + "checks": [ + { + "name": "api-release-build", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "build", + "JobTrackerApi/JobTrackerApi.csproj", + "--configuration", + "Release", + "--no-restore", + "-warnaserror" + ], + "startedUtc": "2026-10-09T06:41:52.723507+00:00", + "finishedUtc": "2026-10-09T06:42:03.252267+00:00", + "durationSeconds": 10.529, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/api-release-build.log", + "logSha256": "283bd6ccba5448ee176074c3fef61cd2bd16c9b163b29381a8a7185a08d6f187", + "logModifiedUtc": "2026-10-09T06:42:03.196994+00:00", + "warnings": 0, + "errors": 0 + }, + { + "name": "backend-test-project-release-build", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "build", + "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", + "--configuration", + "Release", + "--no-restore", + "-warnaserror" + ], + "startedUtc": "2026-10-09T06:42:03.253279+00:00", + "finishedUtc": "2026-10-09T06:42:10.003072+00:00", + "durationSeconds": 6.75, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/backend-test-project-release-build.log", + "logSha256": "17a224adff5f2291521273cb6c28ab45633b84dd43d80f6aa3f959c14a80b0d8", + "logModifiedUtc": "2026-10-09T06:42:09.953373+00:00", + "warnings": 0, + "errors": 0 + }, + { + "name": "backend-full", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "test", + "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", + "--configuration", + "Release", + "--no-build", + "--logger", + "trx;LogFileName=backend-full.trx", + "--results-directory", + ".artifacts/p5-15-01/backend", + "--", + "xUnit.parallelizeTestCollections=false", + "xUnit.maxParallelThreads=1" + ], + "startedUtc": "2026-10-09T06:42:30.628180+00:00", + "finishedUtc": "2026-10-09T06:42:49.569680+00:00", + "durationSeconds": 18.942, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/backend-full.log", + "expectedPassed": 1023, + "resultFile": ".artifacts/p5-15-01/backend/backend-full.trx", + "logSha256": "88f484259bf558ee305eed363284517dd9d859601fb0f3da8b804ada20e186a5", + "logModifiedUtc": "2026-10-09T06:42:49.490475+00:00", + "total": 1023, + "passed": 1023, + "failed": 0, + "skipped": 0, + "resultFileSha256": "148fd0c46296e9d92f40a253a17cff59e2bc9f37d0bdf931720c1d6a66199601", + "caseOutcomes": { + "Passed": 1023 + } + }, + { + "name": "focused-ai", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "test", + "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", + "--configuration", + "Release", + "--no-build", + "--filter", + "FullyQualifiedName~CvAi|FullyQualifiedName~AiWorkspace|FullyQualifiedName~AiPrivacyPolicy|FullyQualifiedName~MeteredSummarizerService", + "--logger", + "trx;LogFileName=focused-ai.trx", + "--results-directory", + ".artifacts/p5-15-01/backend", + "--", + "xUnit.parallelizeTestCollections=false", + "xUnit.maxParallelThreads=1" + ], + "startedUtc": "2026-10-09T06:42:49.570185+00:00", + "finishedUtc": "2026-10-09T06:42:55.621559+00:00", + "durationSeconds": 6.051, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/focused-ai.log", + "expectedPassed": 108, + "resultFile": ".artifacts/p5-15-01/backend/focused-ai.trx", + "logSha256": "4bcdac86c74a9f95fea0cec859f7a11e88a8edd1a91d849ba148f762b7878ce8", + "logModifiedUtc": "2026-10-09T06:42:55.530753+00:00", + "total": 108, + "passed": 108, + "failed": 0, + "skipped": 0, + "resultFileSha256": "f35cfc8655d1f72047481e76eb458bd56db7349890bb9464107e7892d39b994f", + "caseOutcomes": { + "Passed": 108 + }, + "includedInBackendTotal": true + }, + { + "name": "cv-revision", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "test", + "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", + "--configuration", + "Release", + "--no-build", + "--filter", + "FullyQualifiedName~CvRevisionReadinessTests", + "--logger", + "trx;LogFileName=cv-revision.trx", + "--results-directory", + ".artifacts/p5-15-01/backend", + "--", + "xUnit.parallelizeTestCollections=false", + "xUnit.maxParallelThreads=1" + ], + "startedUtc": "2026-10-09T06:42:55.622559+00:00", + "finishedUtc": "2026-10-09T06:42:58.873218+00:00", + "durationSeconds": 3.251, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/cv-revision.log", + "expectedPassed": 5, + "resultFile": ".artifacts/p5-15-01/backend/cv-revision.trx", + "logSha256": "3d1afa49da9339ebd2ae47d161fdd2fa4ffffaad40944b6410ba66a74bbff499", + "logModifiedUtc": "2026-10-09T06:42:58.794657+00:00", + "total": 5, + "passed": 5, + "failed": 0, + "skipped": 0, + "resultFileSha256": "60d914ec0b8b673a7a00091812254672e952faed72178e6fa9a0a32efaf5b4b7", + "caseOutcomes": { + "Passed": 5 + }, + "includedInBackendTotal": true + }, + { + "name": "sidecar", + "command": [ + "rtk", + "proxy", + "tools/summarizer/.venv/Scripts/python.exe", + "-m", + "pytest", + "tools/summarizer/tests", + "-q", + "-o", + "cache_dir=E:/Storage/Projects/Active/Job tracker/.artifacts/p5-15-01/backend/pytest-cache", + "--basetemp=.artifacts/p5-15-01/backend/pytest-tmp", + "--junitxml=.artifacts/p5-15-01/backend/sidecar.xml" + ], + "startedUtc": "2026-10-09T06:42:58.873719+00:00", + "finishedUtc": "2026-10-09T06:43:10.558651+00:00", + "durationSeconds": 11.685, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/sidecar.log", + "expectedPassed": 49, + "resultFile": ".artifacts/p5-15-01/backend/sidecar.xml", + "logSha256": "82343598cb5df3ac7bf51fa3f1c28f8a8af624ae8921ae8a69bb846ec754e15a", + "logModifiedUtc": "2026-10-09T06:43:09.582691+00:00", + "total": 49, + "failed": 0, + "errors": 0, + "skipped": 0, + "resultFileSha256": "3d586e4054d381fe7e96d0e36bcc3306575065bfcd81a646a4b9d4b838395841", + "offlineEnvironment": { + "AI_SERVICE_SKIP_MODEL_LOAD": "1", + "HF_HUB_OFFLINE": "1", + "TRANSFORMERS_OFFLINE": "1" + }, + "passed": 49 + }, + { + "name": "configuration-tests", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", + "-X", + "utf8", + "scripts/test-ingress.py" + ], + "startedUtc": "2026-10-09T06:43:10.558651+00:00", + "finishedUtc": "2026-10-09T06:43:11.506532+00:00", + "durationSeconds": 0.948, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/configuration-tests.log", + "expectedPassed": 3, + "logSha256": "c5422ad2115120fa09139e83266b491082cefcc1443e74deaab37c3fc5a2dd15", + "logModifiedUtc": "2026-10-09T06:43:11.482629+00:00", + "total": 3, + "passed": 3, + "failed": 0, + "skipped": 0, + "countEvidence": "Python unittest completed count and OK in freshly read log" + }, + { + "name": "supply-chain-tests", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", + "-X", + "utf8", + "scripts/test-supply-chain.py" + ], + "startedUtc": "2026-10-09T06:43:11.506532+00:00", + "finishedUtc": "2026-10-09T06:43:11.754355+00:00", + "durationSeconds": 0.248, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/supply-chain-tests.log", + "expectedPassed": 3, + "logSha256": "3a39595952165df2d71e93168ce7709d8d46dcd0cc71c6307487369fa49be93b", + "logModifiedUtc": "2026-10-09T06:43:11.724141+00:00", + "total": 3, + "passed": 3, + "failed": 0, + "skipped": 0, + "countEvidence": "Python unittest completed count and OK in freshly read log" + }, + { + "name": "offline-evaluation-tests", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", + "-X", + "utf8", + "scripts/test-ollama-evaluation.py" + ], + "startedUtc": "2026-10-09T06:43:11.755886+00:00", + "finishedUtc": "2026-10-09T06:43:12.064425+00:00", + "durationSeconds": 0.309, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/offline-evaluation-tests.log", + "expectedPassed": 5, + "logSha256": "35f1e6a9fac1549314e6b706619f560bea598478e5c5e2fe4006d1fa9781af6b", + "logModifiedUtc": "2026-10-09T06:43:12.029027+00:00", + "total": 5, + "passed": 5, + "failed": 0, + "skipped": 0, + "countEvidence": "Python unittest completed count and OK in freshly read log" + }, + { + "name": "extension-tests", + "command": [ + "rtk", + "proxy", + "node", + "--test", + "browser-extension/tests/capture-url.test.mjs" + ], + "startedUtc": "2026-10-09T06:43:12.065428+00:00", + "finishedUtc": "2026-10-09T06:43:12.276147+00:00", + "durationSeconds": 0.211, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/extension-tests.log", + "expectedPassed": 3, + "logSha256": "ae340e600b6f4fbbfde4d981c7361674e219736386fe3220628143d2ee3b8c22", + "logModifiedUtc": "2026-10-09T06:43:12.254823+00:00", + "total": 3, + "passed": 3, + "failed": 0, + "cancelled": 0, + "skipped": 0, + "todo": 0 + } + ], + "runtimes": { + "dotnetSdk": "9.0.317", + "dotnetHost": "9.0.19", + "platform": "win-x64 Windows 10.0.26200", + "bundledPython": "3.12.14", + "sidecarPython": "3.12.10", + "node": "v24.19.0", + "evidence": [ + { + "name": "dotnet-info", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.dotnet/dotnet.exe", + "--info" + ], + "startedUtc": "2026-10-09T06:43:13.831751+00:00", + "finishedUtc": "2026-10-09T06:43:14.133204+00:00", + "durationSeconds": 0.301, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/dotnet-info.log", + "logSha256": "9c3ce21e82d05e8e1d30a583845191eb4d48a551746401df74536d80fc26ebb2" + }, + { + "name": "python-info", + "command": [ + "rtk", + "proxy", + "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", + "--version" + ], + "startedUtc": "2026-10-09T06:43:14.133204+00:00", + "finishedUtc": "2026-10-09T06:43:14.194240+00:00", + "durationSeconds": 0.061, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/python-info.log", + "logSha256": "e2ec9b5a991ffaac3084bd67d5ab28da32f19d4a7de07e786d2464b1eed30f5c" + }, + { + "name": "sidecar-python-info", + "command": [ + "rtk", + "proxy", + "tools/summarizer/.venv/Scripts/python.exe", + "--version" + ], + "startedUtc": "2026-10-09T06:43:14.195247+00:00", + "finishedUtc": "2026-10-09T06:43:14.271835+00:00", + "durationSeconds": 0.077, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/sidecar-python-info.log", + "logSha256": "cf4030b5a1ca11510b0f1b690790f507291ffa4e34f411cf899750645a04d1c0" + }, + { + "name": "node-info", + "command": [ + "rtk", + "proxy", + "node", + "--version" + ], + "startedUtc": "2026-10-09T06:43:14.272340+00:00", + "finishedUtc": "2026-10-09T06:43:14.352661+00:00", + "durationSeconds": 0.08, + "exitCode": 0, + "log": ".artifacts/p5-15-01/backend/node-info.log", + "logSha256": "ac83cc86adf0cb07111ac838d304b5d4deb616eafb199375207476a193308bcb" + } + ] + }, + "sourceProvenance": { + "applicationAndHelperPathsUnchangedFromSourceCheckpoint": true, + "comparedPaths": [ + "JobTrackerApi", + "JobTrackerApi.Tests", + "tools/summarizer", + "scripts", + "browser-extension", + "global.json" + ], + "sourceHashManifest": ".artifacts/p5-15-01/backend/source-hashes.json", + "sourceHashManifestSha256": "e4e8dc5755eeba0a366a1cac23c0e1aa23a70b32d64960054d7dfba7adb37bd5", + "trackedFilesHashed": 456, + "releaseBuildArtifacts": [ + { + "path": "JobTrackerApi/bin/Release/net9.0/JobTrackerApi.dll", + "sha256": "c1170121a37dcf3ba4aca2882c21fa5541f0fe3159346ffe84df59b4dd69fc80", + "modifiedUtc": "2026-10-09T06:42:02.931020+00:00" + }, + { + "path": "JobTrackerApi.Tests/bin/Release/net9.0/JobTrackerApi.Tests.dll", + "sha256": "f0b686351ae05da688cd06e3430ff69a72a209aceedf369c04dee4c7b8ef1a3c", + "modifiedUtc": "2026-10-09T06:42:09.765287+00:00" + }, + { + "path": "JobTrackerApi.Tests/PdfBrowserStub/bin/Release/net9.0/PdfBrowserStub.dll", + "sha256": "8250882622f07de365de9a607af1079bcf8145c4d6b367b97b59eecb3b44b87a", + "modifiedUtc": "2026-10-09T06:42:05.369067+00:00" + } + ] + }, + "backendCaseInventory": { + "total": 1023, + "outcomes": { + "Passed": 1023 + }, + "classCounts": { + "AccountDataExportTests": 3, + "AccountDeletionTests": 6, + "AccountPlansTests": 7, + "AiEvaluationFixtureTests": 1, + "AiOperationQueueTests": 5, + "AiPrivacyPolicyTests": 9, + "AiUsageMeterTests": 3, + "AiWorkspaceNotePersistenceTests": 3, + "AiWorkspaceTests": 9, + "AnalyticsSalaryTests": 1, + "ApiAuthorizationPostureTests": 5, + "ApplicationAssetsTests": 15, + "ApplicationCalendarControllerTests": 4, + "ApplicationChecklistTests": 15, + "ApplicationIntelligenceTests": 19, + "ApplicationWorkspaceTests": 10, + "AttachmentConsistencyTests": 14, + "AttachmentFlagsRecomputeTests": 3, + "AttachmentsControllerTests": 3, + "AuthAndSystemControllerTests": 38, + "AuthSessionRevocationTests": 8, + "AvatarStorageTests": 1, + "BackgroundWorkerTenantTests": 10, + "BackupControllerTests": 3, + "BillingControllerTests": 4, + "BuildMetadataTests": 8, + "CareerEvidenceControllerTests": 1, + "CareerProfileControllerTests": 6, + "CareerProfileServiceTests": 21, + "ClientErrorsControllerTests": 2, + "CompanyRelationshipTests": 2, + "ConcurrentInitializationTests": 2, + "CorrespondenceControllerTests": 3, + "CsvExportTests": 25, + "CurrentUserIdLiveEvaluationTests": 2, + "CvAiEvaluationTests": 5, + "CvAiGroundingTests": 45, + "CvAiReadinessTests": 29, + "CvBuilderTests": 35, + "CvCorpusHarnessTests": 1, + "CvExportRetentionTests": 1, + "CvExtractionCoverageTests": 15, + "CvProcessingOperationTests": 4, + "CvProfileDiffServiceTests": 11, + "CvRevisionReadinessTests": 5, + "DatabaseBackupRunnerTests": 3, + "EmailControllerTests": 3, + "EmailDraftPersistenceTests": 1, + "EmailDraftsControllerTests": 5, + "EmailOwnershipIntegrationTests": 3, + "EmailProviderDeliveryTests": 4, + "EmailSendAttemptStoreTests": 5, + "EmailSendControllerTests": 7, + "EmailStatusClassifierTests": 7, + "ExternalOriginTests": 14, + "ForwardedIngressTests": 13, + "GmailControllerTests": 19, + "GoogleTokenValidatorTests": 1, + "HumanLanguageCatalogTests": 20, + "ImapControllerTests": 9, + "ImapProviderTests": 5, + "ImapServiceSsrfGuardTests": 7, + "InterviewAiContextTests": 8, + "InterviewPrepPersistenceTests": 3, + "InterviewPrepTests": 11, + "JobApplicationsApplicationPackageTests": 11, + "JobApplicationsAppliedDateHistoryTests": 4, + "JobApplicationsAuthorizationTests": 4, + "JobApplicationsControllerTests": 2, + "JobApplicationsEndpointBehaviorTests": 9, + "JobApplicationsFollowUpDraftTests": 2, + "JobApplicationsMariaDraftTests": 1, + "JobApplicationsWorkflowSignalsTests": 2, + "JobCvMatchServiceTests": 16, + "JobDiscoveryControllerTests": 3, + "JobImportHttpTransportTests": 76, + "JobImportServiceTests": 16, + "JobLifecycleEventTests": 9, + "JobOpportunitySyncTests": 1, + "JobPipelineTests": 46, + "JobQueryParityTests": 16, + "LocalAuthIdentityTests": 3, + "MaintenanceJobDispatcherTests": 3, + "MeteredSummarizerServiceTests": 8, + "MicrosoftGraphControllerTests": 7, + "MicrosoftGraphProviderTests": 6, + "MicrosoftTokenValidatorTests": 17, + "MigrationChainTests": 18, + "NotificationSettingsControllerTests": 3, + "OperationsControllerTests": 3, + "OwnershipGuardTests": 3, + "PdfRenderAdmissionTests": 22, + "ProEntitlementAuthorizationTests": 23, + "ProductionConfigTests": 3, + "ProfileCvControllerTests": 32, + "PublicCvControllerTests": 3, + "RateLimitPartitionKeysTests": 3, + "RouteUniquenessTests": 1, + "RulesEngineProspectTests": 5, + "SavedJobSearchAlertTests": 1, + "SessionContextMiddlewareTests": 13, + "SessionsControllerTests": 8, + "SqliteDateTimeOffsetCompatibilityTests": 5, + "SqliteMigrationHelperTests": 1, + "StageAnalyticsTests": 4, + "StartupSchemaOwnershipTests": 2, + "StrategySnapshotOperationTests": 4, + "SubmittedApplicationPackageTests": 4, + "SummarizerServiceTests": 4, + "TwoFactorControllerTests": 9, + "UserOperationStoreTests": 10, + "UsersControllerTests": 7 + } + }, + "scopedPreservationCoverage": [ + { + "scope": "Authentication and active-session context", + "passed": 71, + "failed": 0, + "classes": [ + "AuthSessionRevocationTests", + "AuthAndSystemControllerTests", + "TwoFactorControllerTests", + "SessionContextMiddlewareTests", + "LocalAuthIdentityTests" + ], + "coveredContracts": [ + "Exact logout revocation, copied-principal denial, session/owner binding, password-reset/change revocation, trusted-device isolation and replay resistance.", + "Missing/stale/forged context rejects authenticated mutations; stale reads fail; Admin and bearer-token context cannot bypass the precondition.", + "Login lockout, unconfirmed-account policy, 2FA/recovery consumption, verification/email-change contracts and credential linking." + ], + "limitations": [ + "Primarily direct-controller/service/middleware tests with mock managers and EF InMemory; real browser cookie, remember/logout/account-switch cancellation is a separate browser gate.", + "No external OAuth, email delivery or deployed ingress acceptance." + ], + "sources": [ + "JobTrackerApi.Tests/AuthSessionRevocationTests.cs:20", + "JobTrackerApi.Tests/SessionContextMiddlewareTests.cs:12", + "JobTrackerApi.Tests/TestSupport/TestHostFactory.cs:17" + ], + "caseInventoryCount": 71, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.TwoFactorControllerTests.Challenge_with_unknown_pending_token_is_rejected", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Update_profile_applies_trimmed_profile_fields", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.LocalAuthIdentityTests.GetRequiredUserId_returns_null_when_subject_claim_is_missing", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Login_rejects_unconfirmed_local_account_when_flag_on", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.SessionContextMiddlewareTests.Missing_old_and_forged_contexts_never_reach_an_authenticated_mutation(method: \"POST\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Login_rejects_missing_turnstile_token_when_configured", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AuthSessionRevocationTests.Session_validator_requires_sid_and_user_to_match_the_same_row", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.TwoFactorControllerTests.Challenge_with_valid_totp_code_completes_sign_in", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "Authorization and tenant isolation", + "passed": 48, + "failed": 0, + "classes": [ + "ApiAuthorizationPostureTests", + "OwnershipGuardTests", + "JobApplicationsAuthorizationTests", + "JobQueryParityTests", + "ApplicationWorkspaceTests", + "BackgroundWorkerTenantTests" + ], + "coveredContracts": [ + "Controller/action public-vs-authorized declarations and Admin-role attributes.", + "Foreign jobs/history/match/status and missing-owner queries fail closed.", + "16 SQLite parity scenarios compare complete ordered matching IDs across every table page and Board, including custom/deleted/foreign-company cases, 62 owned plus a foreign row." + ], + "limitations": [ + "Authorization attribute/helper tests are static reflection proof; direct controller denial and SQLite query parity do not prove every deployed HTTP route.", + "62-row SQLite fixture is finite functional parity, not a large-account memory/request-count benchmark." + ], + "sources": [ + "JobTrackerApi.Tests/ApiAuthorizationPostureTests.cs:51", + "JobTrackerApi.Tests/JobQueryParityTests.cs:17", + "JobTrackerApi.Tests/JobApplicationsAuthorizationTests.cs:17" + ], + "caseInventoryCount": 48, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"search\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobApplicationsAuthorizationTests.Job_choices_searches_all_owned_rows_without_leaking_another_tenant", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.BackgroundWorkerTenantTests.Reminder_worker_respects_each_owners_persisted_email_opt_out", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"standard\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.ApplicationWorkspaceTests.Overview_aggregates_the_application_without_copying_career_data", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.BackgroundWorkerTenantTests.Runner_enters_each_owner_filter_and_isolates_owner_failures", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"deleted\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"all\")", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "CV revision, history and canonical source", + "passed": 61, + "failed": 0, + "classes": [ + "CvRevisionReadinessTests", + "CvBuilderTests", + "ApplicationAssetsTests", + "CareerProfileControllerTests" + ], + "coveredContracts": [ + "SQLite stale save/restore rejects overwrites before appending history, including independent contexts and fresh stale versions.", + "History is an immutable settings lens; inherited canonical source stays live; override/reset/restore preserves canonical profile and prior versions.", + "Foreign revision read/save/restore denied; cover-letter version restore preserves newer history; variants and source overrides remain separate." + ], + "limitations": [ + "Backend checks cannot establish UI Undo/draft-recovery/reorder/focus behavior or native pagination fidelity; those have separate owners.", + "No simultaneous deployed database stress or production DB-provider proof." + ], + "sources": [ + "JobTrackerApi.Tests/CvRevisionReadinessTests.cs:22", + "JobTrackerApi.Tests/ApplicationAssetsTests.cs:198", + "JobTrackerApi.Tests/CvBuilderTests.cs:372" + ], + "caseInventoryCount": 61, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.CvBuilderTests.Resolver_hides_a_single_item_by_key", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvBuilderTests.Delete_removes_the_variant_and_its_versions", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CareerProfileControllerTests.Put_rejects_an_over_limit_profile", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvBuilderTests.Duplicate_copies_settings_with_a_fresh_slug", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.ApplicationAssetsTests.Each_edit_adds_a_version_and_none_are_lost", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvRevisionReadinessTests.Foreign_account_cannot_read_save_or_restore_revision_history", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvBuilderTests.Norwegian_variant_localizes_default_labels_dates_and_keeps_custom_links_clickable", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CareerProfileControllerTests.Put_then_get_preserves_reviewed_free_form_fields", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "Documents, frozen packages and downloads", + "passed": 32, + "failed": 0, + "classes": [ + "SubmittedApplicationPackageTests", + "AttachmentConsistencyTests", + "AttachmentsControllerTests", + "JobApplicationsApplicationPackageTests" + ], + "coveredContracts": [ + "Snapshot byte/SHA contract, frozen HTML/career/application material, tenant-scoped capture, missing attachment abort with no package.", + "Attachment trust boundaries, exact size limit, foreign download/rename/delete denial; failed copy/DB/promotion/delete recovery preserves bytes or retry state.", + "Tailored preview/export share renderer and avatar contracts; drafts remain job scoped without mutating the master." + ], + "limitations": [ + "Frozen package renderer/storage mostly mocked; one snapshot checks actual temp-file bytes. Native ZIP/browser download and PDF content/pagination need separate evidence.", + "No production filesystem/backup recovery or live attachment fixture exercised." + ], + "sources": [ + "JobTrackerApi.Tests/SubmittedApplicationPackageTests.cs:14", + "JobTrackerApi.Tests/AttachmentConsistencyTests.cs:20", + "JobTrackerApi.Tests/AttachmentConsistencyTests.cs:223" + ], + "caseInventoryCount": 32, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Repeated_same_name_uploads_use_distinct_storage_paths", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobApplicationsApplicationPackageTests.Generate_and_save_tailored_cv_draft_persists_job_scoped_document_without_mutating_master_cv", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Committed_upload_with_failed_promotion_is_recovered_on_restart_pass", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentsControllerTests.Max_file_size_limit_is_10_mb", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentsControllerTests.Controller_requires_local_authorization", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Another_users_attachment_cannot_be_downloaded_renamed_or_deleted", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Purpose_and_derived_flags_roll_back_together", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Invalid_later_file_writes_no_rows_or_bytes", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "Public/private CV identity", + "passed": 3, + "failed": 0, + "classes": [ + "PublicCvControllerTests" + ], + "coveredContracts": [ + "Public PDF uses public variant renderer; private/unknown slug never invokes render/export; public PDF rate-limit attribute retained." + ], + "limitations": [ + "Controller PDF exporter is mocked; service tests in CvBuilder separately cover public publication, private denial and revoked-link rotation.", + "Anonymous HTTP/public browser/native PDF results remain separate gates." + ], + "sources": [ + "JobTrackerApi.Tests/PublicCvControllerTests.cs:24", + "JobTrackerApi.Tests/PublicCvControllerTests.cs:50", + "JobTrackerApi.Tests/CvBuilderTests.cs:472" + ], + "caseInventoryCount": 3, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_uses_the_public_variant_render", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_is_rate_limited", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_does_not_render_an_unknown_or_private_slug", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "Import, CSV and account data export", + "passed": 126, + "failed": 0, + "classes": [ + "JobImportServiceTests", + "JobImportHttpTransportTests", + "CsvExportTests", + "AccountDataExportTests", + "DatabaseBackupRunnerTests", + "BackupControllerTests" + ], + "coveredContracts": [ + "Import private/literal/DNS rebinding/redirect/proxy/TLS/cancellation/size guards tested before prohibited dial; public HTTP uses local synthetic transport.", + "CSV formula neutralization, independent CSV parsing, text escaping, typed values and deleted rows preserve safe output without altering stored text.", + "Actual disposable SQLite/file account ZIP completeness, checksums, tenant isolation, auth/token/password/lease redaction and recent-session requirement.", + "Local disposable SQLite backup opens as restorable and retention works." + ], + "limitations": [ + "No live job source/provider call, deployed import behavior, production export or complete restore rehearsal; backup unit fixture cannot satisfy production recovery gate.", + "Browser capture/low-frequency import/export controls need their own route/sub-workflow audit." + ], + "sources": [ + "JobTrackerApi.Tests/JobImportHttpTransportTests.cs:68", + "JobTrackerApi.Tests/AccountDataExportTests.cs:25", + "JobTrackerApi.Tests/CsvExportTests.cs:17" + ], + "caseInventoryCount": 126, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.CsvExportTests.Text_policy_is_idempotent_and_survives_independent_CSV_parsing(value: \"a,b\", expected: \"a,b\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CsvExportTests.Text_policy_is_idempotent_and_survives_independent_CSV_parsing(value: \"@SUM(A1:A2)\", expected: \"'@SUM(A1:A2)\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobImportServiceTests.Preview_rejects_equivalent_private_literals_before_http_send(url: \"http://0x7f000001/\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_denied_dns_addresses_before_any_socket_attempt(address: \"255.255.255.255\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.DatabaseBackupRunnerTests.RunOnce_creates_a_restorable_backup_file", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Caller_cancellation_interrupts_a_stalled_streamed_body", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_denied_dns_addresses_before_any_socket_attempt(address: \"172.31.255.255\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_literal_without_dns_or_dial(url: \"http://[::1]/\")", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + }, + { + "scope": "Existing deterministic AI withholding/grounding preservation", + "passed": 100, + "failed": 0, + "classes": [ + "CvAiReadinessTests", + "CvAiGroundingTests", + "AiPrivacyPolicyTests", + "AiWorkspaceTests", + "MeteredSummarizerServiceTests" + ], + "coveredContracts": [ + "Protected proposals are bound to owner/CV/source revision; stale/tampered/unsupported proposals cannot mutate content; unavailable services fail closed.", + "Existing focused filter passed 108 subset cases with mocked/deterministic providers." + ], + "limitations": [ + "No configured-model semantic qualification, P5-13 UI, provider activation or external model calls. Separate real HTTP withholding remains browser owner responsibility." + ], + "sources": [ + "JobTrackerApi.Tests/CvAiReadinessTests.cs:251", + "JobTrackerApi.Tests/CvAiReadinessTests.cs:277" + ], + "caseInventoryCount": 100, + "representativeCases": [ + { + "name": "JobTrackerApi.Tests.CvAiReadinessTests.Canonical_change_during_edited_proposal_review_is_checked_again_before_save", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvAiReadinessTests.Unavailable_review_service_blocks_generation_and_apply_without_side_effects(apply: False)", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvAiReadinessTests.Grounded_rewriting_is_applied_only_on_accept_and_uses_normal_history(rewrite: \"Maintained internal web applications.\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AiPrivacyPolicyTests.External_processing_requires_admin_gate_user_consent_and_pro(adminEnabled: True, userAllowed: False, pro: True, expectedProvider: \"local\")", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvAiGroundingTests.Document_summary_can_consolidate_known_entry_facts", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.AiWorkspaceTests.Empty_ai_output_raises_unavailable", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvAiReadinessTests.Fabricated_or_mixed_provider_output_cannot_obtain_an_applicable_proposal(invented: \"Managed 50 engineers at Microsoft and increased re\"ยทยทยท)", + "outcome": "Passed" + }, + { + "name": "JobTrackerApi.Tests.CvAiReadinessTests.Fabricated_or_mixed_provider_output_cannot_obtain_an_applicable_proposal(invented: \"Flytende fransk og sertifisert prosjektleder.\")", + "outcome": "Passed" + } + ], + "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." + } + ], + "explicitNotVerified": [ + "Real browser cookie/account switching and in-flight cancellation; full 57-row sub-workflow preservation requires browser/manual audit.", + "Larger-account full-array memory/request-count behavior, overlapping preference persistence and SQLite preference debt.", + "Native document ZIP/PDF layout/content/settings fidelity and physical screen-reader/device/software-keyboard/zoom acceptance.", + "Actual external auth/mail/import/model provider behavior, P5-13 semantic qualification/UI and deployed Production configuration.", + "Complete deployed backup/storage/config/schema/key restore and migration/rollback rehearsal." + ], + "qualification": "Existing suites use owned disposable synthetic databases/files and deterministic mocks/local fixtures. No application database migration, production data change, Docker operation, deployment or external provider/model call was performed." +}