cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

docs(roadmap): record admin security and launch checkpoints

Browse Source
This commit is contained in:
cesnimda
2026-11-10 12:49:02 +01:00
parent 6f57a37abb
commit cabafa5299
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/direct-roadmap/LATEST_CHECKPOINT.md
+19
View File
@@ -1,5 +1,24 @@
# Direct execution continuation
## 10 November continuation and owner addendum
Owner authorised `E:/Storage/Projects/Active/temp docs/final/additional`. Read the full A3 refinement and EUROPE-READY-01 prompt, SHA-256 `5aaefea0e2fde342fd78917d0b9d9eb38c873d902095bdaa4389c9bb6d83397d`, and inspected the three supplied screenshots. The authoritative addition is mapped in `docs/ui-modernisation/REFINEMENT_AND_EUROPE.md` on the integration branch. The `0bb722672520f2fea79d42fe3412bb58de104945` coverage companion uses the same 59 I18N candidate codes and records separate geography, map, provider, locale and release dispositions. No country or extra locale qualified for release.
- **Phase 10** published full local receipt `6f57a37abbd1748484473ff9178ba9991e82eaef` on `feature/phase10-cleanup`, independently read back. Passed 1,448 backend and 1,031 frontend cases (112 suites), separately. Both raw hashes and compressed reports are in P10-05. Independent audit, full preservation closure and source-defined environment/human gates remain open. No additional removal approved.
- **Security** published `ecadc29bbee69d097ef425715b2007bac825fe11` on `codex/security-offline-preflight`, independently read back. Source/test commit `d4c486681ad51424bfd33545d518e87193ffbc56` omits imported reply subjects from Admin Audit while preserving the owner's stored event and operational metadata. Red HTTP fixture reproduced disclosure. Final 62 cases passed, including A/B notification reads/counts/foreign writes and role enforcement. The exact controller and test delta is also published on A3 at `2033aea31b4ffc90db8c9d28471355fff7b26b65` with 57 selected backend tests. These runs overlap. No permission expansion, live access or formal scan. `MFA_RECOVERY_PROPOSAL.md` contains the source findings and approval-gated design.
- **A3** published through `bd34a3504f7e849c41b48db444f0e1f16324a16f` on `codex/a3-ui-10`, independently read back. Earlier same-branch receipts: `e585561a` follow-up/agenda, `71c927b1` Admin heading hierarchy, `f79024df` mail review/409, `2af15025` audit timestamp/density, `91e5a6bf` EN/NB Gmail count wording, `511945b4` Settings privacy recovery. Source-bound scope, individual counts and exclusions are in the IM10 visual-correction reports. No owner acceptance promoted.
- **Launch** current public root rendered baseline is in `bd34a350` on the integration branch. 12 navigation fixtures at phone/tablet/desktop in EN/NB and themes passed. All 12 show landmark best-practice findings, no raw hero/canonical/hreflang, and 24 anonymous language writes were rejected. The dashboard mockup address was anonymised in the captured fixture only. The final visual/claims design remains separate.
- **Discover search-first** published at `99a2b6f4f641b5828e6309112eeb39489c0c015f` and independently read back. Runtime `0540e84ff6d5106946b481a2e24484d0b0898583`. 26 native cases, type-check, lint, build and 108 rendered states across 36 configurations passed. The exact query/municipality request and keyboard disclosure were checked. Existing provider matches title/company and a location string. No canonical country, map, skill search or new provider capability added.
- **Applications** published `252759f420d35a97696873432751bc3884565cd7`. Title-first layout, explicit selection and EN/NB preparation label passed 57 tests, types, lint, build and 72 captures/scans. Secondary actions remain open.
- **Admin Users alignment** published `d6e5a45ba2243141b4aec79c76d33c4adc524ba5`. 12 selected tests and 36 responsive states passed. The maximum desktop offset dropped from 14 to 0.5 px.
- **System Status** published `13c9c65352b0fabc56efdbb4cec7c4ad7e34c3a3`. 20 selected tests and 108 captures/scans passed. The last successful browser read remains visible on a failed refresh. The isolated diagnostic suite design is recorded separately. Existing production benchmark dispatch was never invoked.
- **Admin Users account status** published `2717c6afaf6375e2e1abd7d63cbfa613a802ce83`. 7 backend and 14 frontend tests, lint, build and 36 responsive states passed. Admin-only status is read-only and an older response shows unavailable. Recovery actions remain protected. A Git local maintenance warning reported long Codex ref paths. Commit verification and independent remote readback succeeded.
- **Launch audit** published `98483b804a2d327ca6ca6d1e5cd17669bb968b05` on `feature/launch-site-redesign`. It reconciles the 12 previously executed rendered states with the design-neutral launch record. The four high-fidelity concept pairs and final visual approval remain open.
- **Support access** proposal `4328edbdae53106ba20ac07e0aa7fa6e366cd451` was published and read back on `codex/security-offline-preflight`. Consent-based access is still a design proposal, with no expanded access.
All branch receipts above were independently read back. Next, continue the remaining compact user/application actions, audit usability and launch concept inputs. Preserve the separate decisions for MFA recovery, private support access, new provider activation, diagnostics execution, bookmarklet retirement, final A3, integrated security and release acceptance. The orchestrator remains paused. No main merge or deployment.
**P10-05 full local backend and frontend lanes passed at source `39aac4f404cc19bead83b719fbf372de87f965ff`.** Backend passed 1,448 of 1,448 in Release with pinned SDK 9.0.317. Frontend passed 1,031 of 1,031 across 112 suites. Both native runs exited 0. Exact native receipts and scope in [P10-05](../redesign/phase-10/P10-05.md). Live AI/corpus, device/human, hosted and recovery qualification remain separate. Phase 10 acceptance and independent audit remain open.
**Published A3-IM10 checkpoint `71c927b15bdea7c41d76dee084baf05af6f703cd`**, independently matched on `codex/a3-ui-10`. Runtime `c7e8627ca782b37ed553299a1db93af192e420e4` removes duplicate headings across four Admin routes. 66 targeted Jest tests, type-checking, lint, build, 36 controlled configurations and 324 browser captures/axe scans passed. No writes, export requests, page errors or axe violations. The 144 intentional System 503s and 216 unavailable company reads are recorded separately. 1,472 committed/source/export checks passed. See `ADMIN_HEADINGS_REVIEW.md`. The 768 px Bokmål audit screenshot exposed separate timestamp wrapping, tracked as V25. Remaining Admin action/error/permission states are open.