docs(redesign): record Analytics authentication repair acceptance

2026-10-10 15:03:56 +02:00
parent 6843767176
commit cf847e9b25
16 changed files with 1892 additions and 68 deletions
@@ -27,4 +27,88 @@ Existing session/account invalidation intentionally disposes the previous page/p

 Final application changes have fresh **1,033/1,033 backend**, **490/490 frontend**, **31/31 focused Login**, the unchanged original native AUTH-01 **1/1**, and new native return/security journeys **5/5** passing. TypeScript, lint and both builds pass. The case-insensitive login-loop gap also has separate RED evidence before correction: two failures, two selected passes and27 not selected; final31 cases pass. External identity callbacks/two-factor are component fixtures, not live provider acceptance.

-The complete browser/security/fidelity reconciliation is still running. Current checkpoint status: **IN PROGRESS**, with the demonstrated AUTH-01 repaired but no final acceptance claim yet. P5-15-02 and production are not cleared. Broader human/device/font qualification, historical preference500 causes, the CV Unsaved intermittent observation and P5-13 deferral remain open.
+At the separately pushed code checkpoint, full browser/security/fidelity reconciliation was still pending and no final acceptance was claimed. The final evidence below now establishes the bounded repair result. P5-15-02 is not started or automatically authorized; production remains NO-GO. Broader human/device/font qualification, historical preference500 causes, the CV Unsaved intermittent observation and P5-13 deferral remain open.
+
+## Return-path and security contract
+
+The existing route state remains the single transport: protected location → landing → Login → authenticated destination, using replacement navigation at the existing boundaries. No destination is persisted in localStorage, sent to an identity provider, placed in a token URL or copied into the CV/API domains. Search and fragment are preserved literally, including correctly encoded values. Analytics still interprets only `months`, with6/24 supported alternatives and12 as the established default. Multiple independent report parameters do not exist; a fragment is navigation state, not another reporting filter.
+
+Before every completion callback, the shared helper requires a relative same-origin path, validates encoding and decoded path meaning, rejects external/protocol-relative paths, controls/backslashes and normalized `/`, `/login` or `/register` returns, and selects `/dashboard` on rejection. Repeated decoding detects nested unsafe path encodings without rewriting an accepted URL's query/fragment. Only the existing nested Jobs `from` and positive safe-integer `focusJobId` are replayed; arbitrary client state is dropped. Backend authentication/ownership remains authoritative even for a valid path containing a foreign resource ID.
+
+Deliberate account/session disposal is distinct from an expired cookie. The existing `/login?sessionChanged=1` path abandons the old destination and context. Cookie expiry followed by reload captures the currently requested safe deep link; it does not revive another account's retained editing state. No extra history push or second concurrency/save model is introduced.
+
+## Native journeys and evidence boundaries
+
+| Journey | Executed assertion and result |
+|---|---|
+| Original AUTH-01 | Unchanged anonymous census fails before repair at `/analytics`, then passes with exact `/analytics?months=6` after real local authentication |
+| Reporting parameters | Exact24, encoded `%36`→6, explicit12 and invalid3→12 survive sign-in; actual Analytics API requests return200 and selected controls match effective periods |
+| Default/failure/recovery | No query→12; incorrect password401 stays at Login with error, retry restores intended destination; no premature success |
+| Browser history |6→24→Back6→Back default12→Forward6; reload retains6; authenticated direct24#activity stays signed in |
+| Session lifecycle | Expired `jobtracker_auth` cookie is absent and `/auth/me` returns401; reload/sign-in restores24#activity. Explicit logout204→sessionChanged→login returns dashboard |
+| Other protected deep link | Owned Job Documents query/fragment survives sign-in and refresh; region is visible, preserving existing section routes |
+| Account/resource isolation | A new account receives404 for both foreign workspace and Job API read, sees no private Job title, while original owner readback is unchanged |
+| Client tampering | Protocol-relative and encoded protocol-relative router state falls back to dashboard after real sign-in; fourteen component target variants also fail closed |
+| Existing methods | Local sign-in native; existing two-factor and Google/Microsoft completion/cancellation paths use deterministic component fixtures. Real provider/2FA infrastructure is not qualified |
+
+Five new ordinary browser cases use the actual disposable SQLite API, cookies, CSRF/session context, synthetic accounts and supported page actions. They do not mock successful report/ownership/authentication responses. Non-local requests are blocked. Three saved-search and four Rules repair cases remain separate existing requirements in the full run. P2-D01 remains an ordinary passing requirement, never an expected failure.
+
+The initial focused browser attempt contained four passes and one strict-locator harness failure: the toast and framework announcer both matched `role=alert`. The correction narrows the assertion to the existing Unauthorized feedback; it does not weaken the expected401/retry behavior. That attempt remains retained separately. The final focused run is5/5 with zero retries, skipped or flaky cases. The first full frontend488/488 run preceded the final two case-variant regressions; it is historical, not the final490/490 evidence.
+
+## Preservation traceability
+
+| Contract | Existing behavior → bounded change → regression evidence | Remaining qualification |
+|---|---|---|
+| PRES-E02 | Local/challenge sign-in return → full validated internal destination → original AUTH-01,31 Login cases and native retry/expiry | Real external challenge/email/reset/Turnstile combinations and broader human acceptance |
+| PRES-E03 | Google/Microsoft entry/callbacks → same shared validated return → existing callback/cancellation fixtures strengthened for query/hash | Real providers, credentials, cancellation/network/redirect infrastructure |
+| PRES-E04 | Existing two-factor completion → same complete destination → pending challenge fixture restores24#activity | Human/native authenticator workflows and full security-settings acceptance |
+| PRES-E07 | Existing route/shell continuity → keep query/hash through guard → native Analytics and Job section, history and refresh | All manual names/focus/device and complete long-tail navigation obligations |
+| PRES-E09 | Private account/session disposal and ownership → sessionChanged fallback, restricted context replay → native logout/foreign404 plus account-isolation suites | Production/assistive-technology/BFCache combinations beyond recorded fixtures |
+| PRES-W01 / J05 | Job section URLs and Jobs list return context → validated existing `from`/focus replay → component context assertion, owned Documents deep link and retained Jobs/Back/filter suites | Full workspace/provider/device and long-tail Jobs list interaction qualifications |
+| PRES-J02 (supporting) | Saved discovery search persistence/ownership → implementation untouched → three existing native saved-search repair cases remain passing | Scheduler/alert delivery, live source providers and human/device acceptance |
+
+No original PRES contract, API authorization, Analytics metric/query model, provider integration, saved-search or Rules implementation is changed. E02 moves FAIL→PARTIAL for the repaired defect; the group is not granted PASS. The current reconciliation is **PASS0 / PARTIAL56 / FAIL0 / DEFERRED1 / BLOCKED0 / NOT VERIFIED0 =57**. Only E02 changes from the preceding R-02 column. Historical00/01/R-01/R-02 columns remain intact. All32 route patterns pass finite entry/refresh/read assertions:192 observations,98 selected reads and no500. Full-route acceptance remains32PARTIAL/0FAIL because long-tail/provider/human obligations are not replaced by this finite census.
+
+## Visual and accessibility evidence
+
+The four native captures cover EN/light1440, Bokmål/dark390, EN/dark768 and Bokmål/light320. The agent inspected their actual report headings, wrapping and selected period states; no screen reader, physical touchscreen, software keyboard or independent human review was used. The existing transient sign-in toast appears over report content in captures; broad overlay/reflow acceptance is not closed by this routing repair. This checkpoint introduces no user-facing text or visual redesign.
+
+[Native API/URL proof, source RED results and screenshot fingerprints](evidence/auth-proof.json), [complete fresh validation](evidence/validation.json) and [repository/static checks](evidence/repository-validation.json) retain exact commands/times/result hashes and limits. Captures: [EN/light desktop](evidence/analytics-auth-en-light-1440.png), [Bokmål/dark phone](evidence/analytics-auth-nb-dark-390.png), [EN/dark tablet](evidence/analytics-auth-en-dark-768.png), [Bokmål/light narrow phone](evidence/analytics-auth-nb-light-320.png).
+
+Full267axe scans report0violations and **2,041incomplete node occurrences**: color-contrast1,769; aria-hidden-focus41; aria-prohibited-attr209; aria-valid-attr-value18; th-has-data-cells4. These are occurrences across scans, not2,041 independently confirmed defects. Classification and human/manual acceptance stay assigned to the later accessibility audit; this checkpoint neither removes incompletes nor certifies spoken names/announcements. Zero automated violations cannot close those obligations.
+
+## Fresh validation and count reconciliation
+
+These results are fresh after the last application change on2026-10-10. [Portable command/report fingerprints](evidence/validation.json) distinguish original RED, intermediate harness/full-suite attempts, final GREEN and independent/subset lanes. The complete ordinary run finished at12:54:24UTC; independent security/diagnostics completed at12:55:17UTC, with zero retries, skips, unexpected or flaky outcomes in final runs.
+
+| Gate | Fresh result | Count explanation |
+|---|---|---|
+| Backend |1,033/1,033 | Unchanged; no backend code/tests added |
+| Frontend |490/490,82 suites |472→490:18 new Login cases, comprising14 unsafe-target variants and4 valid-context/disposal cases; two existing provider/2FA assertions strengthened |
+| Focused Login |31/31 | Subset of490, not additional tests |
+| Original AUTH-01 |1/1 GREEN after0/1 RED | Same original desired-state assertion, not a replacement or expected failure |
+| New native auth cases |5/5 | Included in134 ordinary browser cases, not added twice |
+| Complete ordinary browser |134/134,0fail |129 declared cases before repair→134 with five new cases;128pass/1fail→134pass/0fail includes the former failure becoming an actual pass |
+| Separate diagnostics |2/2,0fail | Two declared existing preference/Rules diagnostic cases, outside ordinary browser totals |
+| Sidecar |49/49 | Unchanged deterministic/offline suite, not configured-model qualification |
+| Focused AI / revision |108/108 /5/5 | Unchanged subsets of1,033 backend tests |
+| Real-HTTP / rate-limit / ingress / PDF admission |2/2 /9/9 /6/6 /1/1 | Existing independent suites; local contracts, not production evidence |
+| Configuration |3/3 | Existing offline checks; production configuration remains unverified |
+| Standard fidelity |16/16,36=36 pages | Exact page count/membership; unchanged0.5mm page dimension,2mm position,0.5pt font and1/255 RGB tolerances |
+| Settings exports |8/8,24=24 pages | Same tolerances and fixture contents; native exports from the full browser run |
+| Extra offline helpers | Supply-chain3 / evaluation5 / extension3 | Existing independent fixtures, not live provider/production calls |
+| Static/build/hygiene | TypeScript, lint, frontend production and API Release builds pass; final E2E TypeScript/secret/link/whitespace proof in repository manifest | Raw logs and actual command exits are retained separately from runtime totals |
+
+Standard/settings measurement passes were completed at12:42UTC against the final native exported files. No renderer geometry, pagination, typography, revision, canonical profile, override, frozen package, save/conflict or AI withholding implementation is changed. The original CV Unsaved intermittent observation remains OPEN despite current passing runs; this repair neither investigates nor establishes its cause.
+
+## Immediate commit/push ledger
+
+1. `c37cab560afa2d94cc4244c09dfa7aa720563bbf` — reproducing regression tests and initial evidence, committed/pushed before production-code changes.
+2. `68437671762aa9a4d93036a23a06810f1f47dd57` — bounded App/auth/Login repair,18 additional Login cases, five browser cases and verified intermediate record; committed/pushed after final application-level validation.
+3. Final acceptance evidence/documentation — this independently reviewable checkpoint; immediately commit/push after repository verification. Its exact hash, remote equality and clean-tree result are reported after creation rather than inventing a self-referential hash here.
+
+Development remote equality is verified after each push. Local/remote production `main` remains `27657f31131cd95d42f0e1290853ec9c9b3959a4`. No production merge/push/deployment, P5-15-02, P5-13 qualification/UI, Docker recovery, B07 or unrelated repair occurs. F04/current backup+restore/production configuration-schema-secrets/tested rollback remain release blockers. P5-13 stays deferred/unqualified/Production-withheld with0/366 calls,0 human reviews and no review UI. The historical CV Unsaved intermittent observation, preference500 causes, Board scale/native touch, followMode UI and human/device/font/photo acceptance remain explicitly open.
+
+## Decision
+
+**P5-15-01R-03: GO for the bounded Analytics authentication redirect repair.** AUTH-01 is fixed; all required current automated/native preservation lanes are green. Existing saved-search and Rules fixes remain green, and no new major security/data-preservation regression is observed. This is not full Phase5, actual provider/human/device or production acceptance. Stop before P5-15-02, P5-13, B07 and production deployment.
@@ -0,0 +1,241 @@
+{
+  "sourceCheckpoint": "339e3ba591c91dcd3590d4cbc451ad31268f1aec",
+  "reproducerCheckpoint": "c37cab560afa2d94cc4244c09dfa7aa720563bbf",
+  "codeCheckpoint": "68437671762aa9a4d93036a23a06810f1f47dd57",
+  "originalRed": {
+    "passed": 0,
+    "failed": 1,
+    "requested": "/analytics?months=6",
+    "returned": "/analytics",
+    "case": "[P5-15-01 E02 E07 A01] all 32 routes retain native entry, refresh and anonymous permissions",
+    "error": "Expected pattern: /\\/analytics\\?months=6$/\nReceived string:  \"http://localhost:3300/analytics\"\nTimeout: 5000ms",
+    "report": {
+      "path": ".artifacts/p5-15-01R-03/browser/auth-original-red.json",
+      "sha256": "19c33361fecea68fbec97e47e754c36e3efe9ac62dbe284e6722775d3bb42172"
+    }
+  },
+  "loginComponentRed": {
+    "passed": 17,
+    "failed": 12,
+    "notSelected": 0,
+    "declared": 29,
+    "failedCases": [
+      "LoginPage uses the safe fallback for the untrusted return target \"/\\t/evil.example\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/%2f%2fevil.example\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/%252f%252fevil.example\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/%5cevil.example\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/analytics?months=%ZZ\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/jobs/../login\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/%6cogin\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/register\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/analytics%0a\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/analytics?months=6\\n\"",
+      "LoginPage restores valid owned-workspace navigation context separately from the sign-in destination",
+      "LoginPage abandons prior return context on the established account/session disposal entry"
+    ],
+    "result": {
+      "path": ".artifacts/p5-15-01R-03/frontend/login-red.json",
+      "sha256": "190a11b979354cbc5ca1af1e2e43532f384ff32aadf85baaad25671fd2c6c487"
+    }
+  },
+  "caseNormalizationRed": {
+    "passed": 2,
+    "failed": 2,
+    "notSelected": 27,
+    "declared": 31,
+    "failedCases": [
+      "LoginPage uses the safe fallback for the untrusted return target \"/LOGIN\"",
+      "LoginPage uses the safe fallback for the untrusted return target \"/%4cOGIN\""
+    ],
+    "result": {
+      "path": ".artifacts/p5-15-01R-03/frontend/case-loop-red.json",
+      "sha256": "e8ec49ada6336b67047c9d093835c110ad80608d3b77a43068a6b43ed5552998"
+    }
+  },
+  "nativeReturn": {
+    "requested": "/analytics?months=6",
+    "returned": "/analytics?months=6"
+  },
+  "periodMatrix": [
+    {
+      "requested": "/analytics?months=24#activity",
+      "returned": "/analytics?months=24#activity",
+      "effectiveMonths": 24,
+      "language": "en",
+      "mode": "light",
+      "width": 1440
+    },
+    {
+      "requested": "/analytics?months=%36#rapport",
+      "returned": "/analytics?months=%36#rapport",
+      "effectiveMonths": 6,
+      "language": "nb",
+      "mode": "dark",
+      "width": 390
+    },
+    {
+      "requested": "/analytics?months=12",
+      "returned": "/analytics?months=12",
+      "effectiveMonths": 12,
+      "language": "en",
+      "mode": "dark",
+      "width": 768
+    },
+    {
+      "requested": "/analytics?months=3#rapport",
+      "returned": "/analytics?months=3#rapport",
+      "effectiveMonths": 12,
+      "language": "nb",
+      "mode": "light",
+      "width": 320
+    }
+  ],
+  "historyAndAuthentication": {
+    "failedLogin": 401,
+    "retryDefault": 12,
+    "backPeriods": [
+      6,
+      12
+    ],
+    "forwardAndRefresh": 6,
+    "authenticatedDirect": 24
+  },
+  "expiryAndLogout": {
+    "expiredCookieMe": 401,
+    "expiryReturn": "/analytics?months=24#activity",
+    "logout": 204,
+    "logoutSubsequentLogin": "/dashboard"
+  },
+  "ownershipAndUnsafeReturnState": {
+    "ownedDestination": "/jobs/1?section=documents#documents",
+    "foreignResource": 404,
+    "foreignWorkspace": 404,
+    "ownerReadbackUnchanged": true,
+    "rejectedTargets": [
+      "//outside.example.test/analytics",
+      "/%2f%2foutside.example.test/analytics"
+    ],
+    "fallback": "/dashboard"
+  },
+  "focusedBrowser": {
+    "startTime": "2026-10-10T12:27:51.075Z",
+    "duration": 28486.097,
+    "expected": 5,
+    "skipped": 0,
+    "unexpected": 0,
+    "flaky": 0
+  },
+  "originalGreen": {
+    "startTime": "2026-10-10T12:26:44.366Z",
+    "duration": 36464.388,
+    "expected": 1,
+    "skipped": 0,
+    "unexpected": 0,
+    "flaky": 0
+  },
+  "nativeContract": "Real authenticated local Development/SQLite API for login, Analytics reads, account disposal and owned/foreign resources; no provider/API schema/report aggregation change.",
+  "supportedAnalyticsQuery": "months=6 or24 selects that period; absent/other values retain existing12-month default. Search encoding and fragment survive unchanged.",
+  "screenshots": [
+    {
+      "name": "analytics-auth-en-light-1440",
+      "file": "analytics-auth-en-light-1440.png",
+      "path": ".artifacts/p5-15-01R-03/browser/auth-focused-results/analytics-auth-repair--P5--c5c4a-gn-in-across-locales-themes-chromium/attachments/analytics-auth-en-light-1440-38e97c90033b4d77b5d231d23bf2ca23bd63f19f.png",
+      "sha256": "21cef8b34577795744e6868c3086edc471decb61b76b0d4ee61590e51e0a7724"
+    },
+    {
+      "name": "analytics-auth-nb-dark-390",
+      "file": "analytics-auth-nb-dark-390.png",
+      "path": ".artifacts/p5-15-01R-03/browser/auth-focused-results/analytics-auth-repair--P5--c5c4a-gn-in-across-locales-themes-chromium/attachments/analytics-auth-nb-dark-390-21d1e32701491e996c99b1c4c86814d0f566c563.png",
+      "sha256": "5abc521581bcf406a48566f9bd7c1f66c4e955b852d5fb042a23a119315e05aa"
+    },
+    {
+      "name": "analytics-auth-en-dark-768",
+      "file": "analytics-auth-en-dark-768.png",
+      "path": ".artifacts/p5-15-01R-03/browser/auth-focused-results/analytics-auth-repair--P5--c5c4a-gn-in-across-locales-themes-chromium/attachments/analytics-auth-en-dark-768-1e41ab7c1b87b0da507de99b71e0e00fd9acfe11.png",
+      "sha256": "5b30de0bd4291eed11f71741e328c16ef2e4766fc854e7f49beb17e45c50bcc8"
+    },
+    {
+      "name": "analytics-auth-nb-light-320",
+      "file": "analytics-auth-nb-light-320.png",
+      "path": ".artifacts/p5-15-01R-03/browser/auth-focused-results/analytics-auth-repair--P5--c5c4a-gn-in-across-locales-themes-chromium/attachments/analytics-auth-nb-light-320-cd3d311cb5e473ef05069561c0d0c52529c1f8a9.png",
+      "sha256": "329ea5665112ef15d2dfd4b29086e47a59b5d8abca26d7fed0dd6c6109d5f072"
+    }
+  ],
+  "visualInspection": {
+    "type": "Coding-agent screenshot inspection only; not independent human or assistive-technology acceptance.",
+    "reviewed": [
+      "analytics-auth-en-light-1440",
+      "analytics-auth-nb-dark-390",
+      "analytics-auth-en-dark-768",
+      "analytics-auth-nb-light-320"
+    ],
+    "status": "Recorded reviewed screenshots"
+  },
+  "rawEvidence": [
+    {
+      "path": ".artifacts/p5-15-01R-03/frontend/login-red.json",
+      "sha256": "190a11b979354cbc5ca1af1e2e43532f384ff32aadf85baaad25671fd2c6c487"
+    },
+    {
+      "path": ".artifacts/p5-15-01R-03/frontend/case-loop-red.json",
+      "sha256": "e8ec49ada6336b67047c9d093835c110ad80608d3b77a43068a6b43ed5552998"
+    },
+    {
+      "path": ".artifacts/p5-15-01R-03/browser/auth-focused.json",
+      "sha256": "ba69aad3d0c27e6b532abafc496928a51a4b575eb4dd782f5e503e349f1fd7a3"
+    },
+    {
+      "path": ".artifacts/p5-15-01R-03/browser/auth-original-green.json",
+      "sha256": "f28698a236d9ea82d9691e62d44df7391ffe48c912661aa9885bea4906bd2558"
+    }
+  ],
+  "intermediateAttempts": [
+    {
+      "label": "Retained focused-browser harness attempt; Unauthorized toast/announcer selector ambiguity, corrected without changing401/retry assertions.",
+      "file": {
+        "path": ".artifacts/p5-15-01R-03/browser/attempt1-auth-focused.json",
+        "sha256": "36b6431e61415e19bb11ea38a1bd09939ee79e683609e0233e068559ded1cb97"
+      },
+      "log": {
+        "path": ".artifacts/p5-15-01R-03/browser/attempt1-auth-focused.log",
+        "sha256": "a86a91be2dbe58d0058039c9953d8c3908c9a4a7c0fb7f9eaef84f968fb05cd2"
+      },
+      "counts": {
+        "startTime": "2026-10-10T12:26:12.986Z",
+        "duration": 30801.587,
+        "expected": 4,
+        "skipped": 0,
+        "unexpected": 1,
+        "flaky": 0
+      }
+    },
+    {
+      "label": "Retained intermediate attempt; not final acceptance evidence.",
+      "file": {
+        "path": ".artifacts/p5-15-01R-03/frontend/attempt1-jest.json",
+        "sha256": "491288c010df227f78caf9ee90a468085b0e31e81da5627ccbe8012723e28c09"
+      },
+      "counts": {
+        "numPassedTests": 488,
+        "numFailedTests": 0,
+        "numPendingTests": 0,
+        "numTotalTests": 488
+      }
+    },
+    {
+      "label": "Retained intermediate attempt; not final acceptance evidence.",
+      "file": {
+        "path": ".artifacts/p5-15-01R-03/frontend/attempt1-summary.json",
+        "sha256": "7d5ae5f3e0c352e27a60bb6471a253e60995f9d544b7e0a1266bbd91f64daead"
+      },
+      "counts": {}
+    }
+  ],
+  "limits": [
+    "No real Google/Microsoft provider authentication; existing provider return/cancellation paths have deterministic component fixtures only.",
+    "No human screen-reader, physical touch/software keyboard, or production font/photo qualification.",
+    "P5-13 remains deferred, unqualified and Production-withheld; zero qualification calls/UI activation.",
+    "F04, current complete backup/restore, production configuration/schema and tested rollback remain release blockers.",
+    "Historical preference500 causes and unexplained CV Unsaved intermittent assertion remain open."
+  ]
+}
@@ -0,0 +1,292 @@
+{
+  "status": "PASS for repository/static/document checks; no production or complete Phase5 acceptance.",
+  "sourceCheckpoint": "339e3ba591c91dcd3590d4cbc451ad31268f1aec",
+  "codeCheckpoint": "68437671762aa9a4d93036a23a06810f1f47dd57",
+  "finalDocumentCommit": "This record; final commit/push/tree equality is verified afterward and reported to owner.",
+  "productionMain": "27657f31131cd95d42f0e1290853ec9c9b3959a4",
+  "productionChanged": false,
+  "checks": [
+    {
+      "name": "e2e-typescript",
+      "command": [
+        "rtk",
+        "proxy",
+        "node",
+        "job-tracker-ui/node_modules/typescript/bin/tsc",
+        "--project",
+        ".artifacts/p5-15-01/e2e-tsconfig.json",
+        "--noEmit",
+        "--incremental",
+        "false"
+      ],
+      "startedUtc": "2026-10-10T13:03:38.885179+00:00",
+      "finishedUtc": "2026-10-10T13:03:41.193863+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/e2e-typescript.log",
+      "logSha256": "a4ed4c2c830adf807283a578ea7ee8b2f659416a86da69815d6147237e7d7f36"
+    },
+    {
+      "name": "document-links",
+      "command": [
+        "rtk",
+        "proxy",
+        "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe",
+        "-X",
+        "utf8",
+        ".artifacts/p4-04-check-doc-links.py"
+      ],
+      "startedUtc": "2026-10-10T13:03:41.194362+00:00",
+      "finishedUtc": "2026-10-10T13:03:41.872415+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/document-links.log",
+      "logSha256": "ccdc000ff4b5d0eb9fb5762359fb6a7c4716dc6b9641c378c4506d80e18221cc"
+    },
+    {
+      "name": "secret-scan",
+      "command": [
+        "rtk",
+        "proxy",
+        "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe",
+        "-X",
+        "utf8",
+        "scripts/supply-chain.py",
+        "scan-secrets"
+      ],
+      "startedUtc": "2026-10-10T13:03:41.872915+00:00",
+      "finishedUtc": "2026-10-10T13:03:43.711682+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/secret-scan.log",
+      "logSha256": "da6efdc7fe0b34b8658c000c05ed2eaa8fdaf0dd62756adf51f7a770d5a4485f"
+    },
+    {
+      "name": "working-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "--check"
+      ],
+      "startedUtc": "2026-10-10T13:03:43.711682+00:00",
+      "finishedUtc": "2026-10-10T13:03:43.811370+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/working-whitespace.log",
+      "logSha256": "a2671a8fe8421cd6b0dd53d8b4d460271309557e5f0fc80de3d2204e468e93a7"
+    },
+    {
+      "name": "staged-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "--cached",
+        "--check"
+      ],
+      "startedUtc": "2026-10-10T13:03:43.811871+00:00",
+      "finishedUtc": "2026-10-10T13:03:43.890250+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/staged-whitespace.log",
+      "logSha256": "a4ed4c2c830adf807283a578ea7ee8b2f659416a86da69815d6147237e7d7f36"
+    },
+    {
+      "name": "checkpoint-whitespace",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "339e3ba591c91dcd3590d4cbc451ad31268f1aec",
+        "--check"
+      ],
+      "startedUtc": "2026-10-10T13:03:43.890764+00:00",
+      "finishedUtc": "2026-10-10T13:03:43.991084+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/checkpoint-whitespace.log",
+      "logSha256": "a2671a8fe8421cd6b0dd53d8b4d460271309557e5f0fc80de3d2204e468e93a7"
+    },
+    {
+      "name": "checkpoint-files",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "339e3ba591c91dcd3590d4cbc451ad31268f1aec",
+        "--name-only"
+      ],
+      "startedUtc": "2026-10-10T13:03:43.991084+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.083847+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/checkpoint-files.log",
+      "logSha256": "2ab03ee5e62c936723adc1675072881fce68b5935e832b92acea6034111dcb51"
+    },
+    {
+      "name": "untracked-files",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "ls-files",
+        "--others",
+        "--exclude-standard"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.084347+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.180872+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/untracked-files.log",
+      "logSha256": "aede1cd454baa249798554e2eef09a52ede7bbdda29ac0dca34c0961f51cf468"
+    },
+    {
+      "name": "original-contracts-unchanged",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "diff",
+        "339e3ba591c91dcd3590d4cbc451ad31268f1aec",
+        "--",
+        "docs/redesign/phase-2",
+        "docs/redesign/audit/ROUTE_MAP.md"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.181383+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.258887+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/original-contracts-unchanged.log",
+      "logSha256": "a4ed4c2c830adf807283a578ea7ee8b2f659416a86da69815d6147237e7d7f36"
+    },
+    {
+      "name": "development-branch",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "branch",
+        "--show-current"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.259891+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.333341+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/development-branch.log",
+      "logSha256": "b6bdec29438bc83c44fd5e3e8c1a0e3379bb3b7bea701966b24ad7df2091c7b2"
+    },
+    {
+      "name": "main-revision",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "rev-parse",
+        "main"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.334332+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.404849+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/main-revision.log",
+      "logSha256": "897066df123bc63e82a45f42fe9b6dbc9dd0aeff602dd814ffdf3ffd8de8ec2c"
+    },
+    {
+      "name": "code-head",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "rev-parse",
+        "HEAD"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.405348+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.474005+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/code-head.log",
+      "logSha256": "c3b1798598a94ab2a1fcc87b6f50348014b9fa4c70358d92f6fba2f035811caf"
+    },
+    {
+      "name": "remote-branches",
+      "command": [
+        "rtk",
+        "proxy",
+        "git",
+        "ls-remote",
+        "origin",
+        "refs/heads/main",
+        "refs/heads/codex/ui-redesign-phase4"
+      ],
+      "startedUtc": "2026-10-10T13:03:44.474005+00:00",
+      "finishedUtc": "2026-10-10T13:03:44.705606+00:00",
+      "exitCode": 0,
+      "logPath": ".artifacts/p5-15-01R-03/hygiene/remote-branches.log",
+      "logSha256": "ebdd583b225748390c82cdc34b8f053993a513cfd1f2226ecde3a56b604b6ab3"
+    }
+  ],
+  "changedTrackedFiles": [
+    "docs/redesign/phase-5/p5-15/PRESERVATION_ACCEPTANCE.md",
+    "docs/redesign/phase-5/p5-15/README.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/DEFECTS.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/INTERMITTENT_FAILURES.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/PRES_RESULTS.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/README.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/ROUTE_RESULTS.md",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/README.md",
+    "docs/roadmap/todo.md",
+    "job-tracker-ui/e2e/analytics-auth-repair.spec.ts",
+    "job-tracker-ui/src/App.tsx",
+    "job-tracker-ui/src/auth.ts",
+    "job-tracker-ui/src/login-page.test.tsx",
+    "job-tracker-ui/src/views/LoginPage.tsx"
+  ],
+  "untrackedFilesWithinScope": [
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/analytics-auth-en-dark-768.png",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/analytics-auth-en-light-1440.png",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/analytics-auth-nb-dark-390.png",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/analytics-auth-nb-light-320.png",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/auth-proof.json",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/repository-validation.json",
+    "docs/redesign/phase-5/p5-15/p5-15-01/analytics-auth-repair/evidence/validation.json"
+  ],
+  "applicationFiles": [
+    "job-tracker-ui/src/App.tsx",
+    "job-tracker-ui/src/auth.ts",
+    "job-tracker-ui/src/views/LoginPage.tsx"
+  ],
+  "preservation": {
+    "total": 57,
+    "before": {
+      "PARTIAL": 56,
+      "DEFERRED": 1
+    },
+    "audit": {
+      "PARTIAL": 53,
+      "FAIL": 3,
+      "DEFERRED": 1
+    },
+    "R01": {
+      "PARTIAL": 54,
+      "FAIL": 2,
+      "DEFERRED": 1
+    },
+    "R02": {
+      "PARTIAL": 55,
+      "FAIL": 1,
+      "DEFERRED": 1
+    },
+    "current": {
+      "PARTIAL": 56,
+      "DEFERRED": 1
+    },
+    "originalIdsUnchanged": true,
+    "onlyE02StatusChanged": true
+  },
+  "routes": {
+    "patterns": 32,
+    "original": 31,
+    "analyticsAdded": 1,
+    "sourceDeclarationsReconciled": true
+  },
+  "balancedMarkdown": true,
+  "evidenceFingerprintReferencesVerified": 104,
+  "limits": [
+    "No real external-provider authentication, human AT/physical-device or production acceptance.",
+    "CV Unsaved intermittent cause and historical preference500 causes remain open.",
+    "No P5-15-02/P5-13/Docker/B07 work or production branch mutation."
+  ]
+}