{
  "ticket": "B04",
  "completedDate": "2026-09-08",
  "baselineCommit": "7d641edc7bca866ccf06012897ba1d107c07e59f",
  "status": "Complete locally; not deployed. B01/B02/B03 preserved; B05 not started.",
  "environment": "Windows, .NET 9 and existing UI dependencies; synthetic local SQLite/API/browser data; external providers disabled",
  "finalMiddlewareBoundary": "Existing CSRF -> authentication -> endpoint authorization -> rate limiting -> B02 session context -> controllers",
  "acceptance": "Account policies use the final authorized principal, independent across accounts and shared across same-account sessions/transports/IPs. IP security policies, B02 provenance and B03 resource admission remain covered.",
  "regressionsAdded": {
    "backendCases": 2,
    "realHttpScenarios": 9,
    "testFixtureCorrection": "Stop signed-in public-CV setup page before cookie removal; no frontend runtime change."
  },
  "countsOverlap": true,
  "runs": [
    {
      "path": ".artifacts/b04/focused.trx",
      "sha256": "DCE64904E7C1921DCC896BF12BCFD1586C5CD77A9D3FC2334ED0FDBE277C18B9",
      "total": 207,
      "passed": 207,
      "failed": 0,
      "skipped": 0,
      "phase": "Focused auth/rate/B01-B03 backend before final authorization-order refinement"
    },
    {
      "path": ".artifacts/b04/backend-final.trx",
      "sha256": "AD8761B5C2B06D4E286856AF9E9D02E586BD6751276EDC12E6204E6A49CEC09C",
      "total": 877,
      "passed": 877,
      "failed": 0,
      "skipped": 0,
      "phase": "Final full selected backend",
      "excluded": [
        "JobTrackerApi.Tests.ImapServiceSsrfGuardTests.ConnectAsync_rejects_unresolvable_host_without_leaking_dns_detail"
      ],
      "exclusionReason": "Existing test makes external DNS requests; external access not authorized."
    },
    {
      "path": ".artifacts/b04/frontend-focused.json",
      "sha256": "273FF523A49CBB533EAF257BFC22A8A3622E457C0B50873881E4F6D4AB97CD86",
      "suites": 4,
      "total": 36,
      "passed": 36,
      "failed": 0,
      "skipped": 0,
      "phase": "Affected frontend; runtime code unchanged by B04"
    },
    {
      "path": ".artifacts/b04/before.json",
      "sha256": "9D76376030CBBED4A8840434C4AFA44F6855B4EDDF71A14B33C70ADBB29EE4D3",
      "passed": 0,
      "failed": 1,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 7913.539999999999,
      "startedAt": "2026-09-08T21:06:28.266Z",
      "phase": "Before application edits: expected failing safe assertion",
      "observation": "A received 200/200; B on the same IP received 429/429."
    },
    {
      "path": ".artifacts/b04/api-initial.json",
      "sha256": "97E4A1AF216F6CB84B8E7D508F6C5C7F739EE47E95260D1052321C50D26402E9",
      "passed": 9,
      "failed": 0,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 11056.037,
      "startedAt": "2026-09-08T21:10:18.256Z",
      "phase": "Initial authentication-only ordering, superseded after self-review",
      "notes": "Original scenarios passed, but endpoint-specific authorization may change the default principal. Final ordering also waits for authorization."
    },
    {
      "path": ".artifacts/b04/api-final.json",
      "sha256": "FD0BDEE6F68F7AF6438087732A8F0A6809B7A7EFD6DC7FF9A6BBB3672707026A",
      "passed": 9,
      "failed": 0,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 10464.229000000001,
      "startedAt": "2026-09-08T21:20:33.327Z",
      "phase": "Final HTTP rate-policy regression, including authorization-before-partitioning",
      "scenarios": 9,
      "observations": "Two accounts each admit 2/reject 1 on the same IP in both orders; four concurrent cookie/bearer/session requests succeed, later requests across other IPs remain limited. Invalid credentials are denied before account limiting; anonymous login remains IP-limited."
    },
    {
      "path": ".artifacts/b04/browser.json",
      "sha256": "AF984A9F9CB0F8EB1AAE88B724A1B0F718208FA0F6EFD10FA30D71D69049F33D",
      "passed": 17,
      "failed": 0,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 76250.659,
      "startedAt": "2026-09-08T21:13:03.191Z",
      "phase": "Full browser before final authorization-order refinement"
    },
    {
      "path": ".artifacts/b04/browser-final.json",
      "sha256": "D89F4F58561A2B6F161F33BE9223C9A1582E3A1BD34F4985C33C0FEBA20F453C",
      "passed": 16,
      "failed": 1,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 80244.032,
      "startedAt": "2026-09-08T21:22:28.655Z",
      "phase": "First browser run after final authorization-order refinement",
      "diagnosis": "Public CV fixture cleared cookies while signed-in page remained active, triggering B02's correct session-change redirect. Remaining 16 tests passed; fixture subsequently stops that page before cookie removal."
    },
    {
      "path": ".artifacts/b04/browser-verified.json",
      "sha256": "9512176BAB16E19E70CEBE9767FBE590CD8EB97308628ED29F46E690ADC77382",
      "passed": 17,
      "failed": 0,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 67434.35999999999,
      "startedAt": "2026-09-08T21:25:36.046Z",
      "phase": "Final full browser after fixture correction",
      "notes": "All 17 passed without retries/flaky outcomes, including account switching and real PDFs."
    },
    {
      "path": ".artifacts/b04/pdf-admission-final.json",
      "sha256": "6213EA4CF8B5E713D5FD01D332765979BF10F492F741DE6C33854F64847D5520",
      "passed": 1,
      "failed": 0,
      "skipped": 0,
      "flaky": 0,
      "durationMs": 7616.844999999999,
      "startedAt": "2026-09-08T21:28:50.581Z",
      "phase": "Final unchanged B03 authenticated multi-route admission probe",
      "observations": {
        "configured": 2,
        "admitted": 2,
        "rejected": 10,
        "maximumActualRenders": 2,
        "recoveryStatus": 200
      }
    },
    {
      "path": ".artifacts/b04/build.log",
      "sha256": "97AE4880F122E36BFC2A96184868F509DF76BA7177E9F5851D022ADED6FBB924",
      "phase": "Final Release warnings-as-errors build",
      "exitCode": 0,
      "warnings": 0,
      "errors": 0
    },
    {
      "path": ".artifacts/b04/lint.log",
      "sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
      "phase": "Final targeted ESLint including public CV smoke fixture",
      "exitCode": 0
    },
    {
      "path": ".artifacts/b04/typecheck.log",
      "sha256": "2F9960647ABADEFD054152A9566E4E6557A55383E98627AED742B93EDEBB16DD",
      "phase": "Final standalone TypeScript",
      "exitCode": 1,
      "initialExitCode": 2,
      "diagnostic": "src/interview-prep.test.tsx(120,10): error TS2571: Object is of type 'unknown'.",
      "classification": "Existing R01a only; no suppression or B04 type error."
    },
    {
      "path": ".artifacts/b04/diff-check.log",
      "sha256": "07A41BCFE160D0FA5AA278C009F548C35372FBDDA40BDFC61BBDFF43DDF699DB",
      "phase": "git diff --check",
      "exitCode": 0
    },
    {
      "path": ".artifacts/b04/public-cv-session-race.md",
      "sha256": "118B893EC4CB2472EF8FE7DA309067188A6BF04A8CE9C4A3C78C98D6806A0BB4",
      "phase": "Retained public CV fixture failure context",
      "observation": "Session-change sign-in screen, not a PDF/rate-limit failure."
    }
  ],
  "frontendBuild": "B04 changes no frontend runtime source. Affected Jest and full browser checks used B03's previously built static export targeting localhost:5302; no new Next build claimed. This artifact is not for production deployment.",
  "residualLimitations": [
    "Fixed-window counters remain process-local and reset on restart. N instances can provide N times each configured allowance.",
    "Intentional security IP limits remain shared behind NAT; account isolation does not convert every policy to an account limit.",
    "Requests denied by CSRF/authorization do not reach rate limiting. Authorized attempts can consume their own allowance before later B02/controller refusal.",
    "Authentication/session/policy evaluation occurs before rate rejection; this is not global ingress or pre-auth CPU admission.",
    "Production trusted proxy/firewall/direct-ingress proof remains B06; only controlled local proxy behavior was exercised.",
    "Optional external OAuth providers were not contacted. Authorization-before-limiting handles endpoint-specific principal selection using the existing framework.",
    "Known R01a standalone TypeScript failure remains; B03 R04 resource/containment evidence remains open."
  ],
  "evidenceRetention": "Original audit/probes preserved. Raw outputs remain local under ignored .artifacts/b04; these hashes and compact observations are retained. Initial passing-but-incomplete ordering and the browser fixture failure are explicitly distinguished from final verification.",
  "recommendedNextTicket": "B05 Spreadsheet-safe CSV fields; requires separate user instruction."
}