{ "recordedLocalDate": "2026-10-09", "scope": "P5-15-01 fresh backend and deterministic offline preservation audit", "sourceCheckpoint": "932b962b9038ddb5ad59b982c0199475bfb50454", "headAtValidationEnd": "932b962b9038ddb5ad59b982c0199475bfb50454", "branch": "codex/ui-redesign-phase4", "startedUtc": "2026-10-09T06:41:52.723507+00:00", "finishedUtc": "2026-10-09T06:43:12.276147+00:00", "result": "PASS", "resultFilesVerified": true, "resultInterpretation": "All executed backend/offline gates passed; scoped local evidence only. Coverage gaps remain NOT VERIFIED, not passes.", "checks": [ { "name": "api-release-build", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "build", "JobTrackerApi/JobTrackerApi.csproj", "--configuration", "Release", "--no-restore", "-warnaserror" ], "startedUtc": "2026-10-09T06:41:52.723507+00:00", "finishedUtc": "2026-10-09T06:42:03.252267+00:00", "durationSeconds": 10.529, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/api-release-build.log", "logSha256": "283bd6ccba5448ee176074c3fef61cd2bd16c9b163b29381a8a7185a08d6f187", "logModifiedUtc": "2026-10-09T06:42:03.196994+00:00", "warnings": 0, "errors": 0 }, { "name": "backend-test-project-release-build", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "build", "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", "--configuration", "Release", "--no-restore", "-warnaserror" ], "startedUtc": "2026-10-09T06:42:03.253279+00:00", "finishedUtc": "2026-10-09T06:42:10.003072+00:00", "durationSeconds": 6.75, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/backend-test-project-release-build.log", "logSha256": "17a224adff5f2291521273cb6c28ab45633b84dd43d80f6aa3f959c14a80b0d8", "logModifiedUtc": "2026-10-09T06:42:09.953373+00:00", "warnings": 0, "errors": 0 }, { "name": "backend-full", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "test", "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", "--configuration", "Release", "--no-build", "--logger", "trx;LogFileName=backend-full.trx", "--results-directory", ".artifacts/p5-15-01/backend", "--", "xUnit.parallelizeTestCollections=false", "xUnit.maxParallelThreads=1" ], "startedUtc": "2026-10-09T06:42:30.628180+00:00", "finishedUtc": "2026-10-09T06:42:49.569680+00:00", "durationSeconds": 18.942, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/backend-full.log", "expectedPassed": 1023, "resultFile": ".artifacts/p5-15-01/backend/backend-full.trx", "logSha256": "88f484259bf558ee305eed363284517dd9d859601fb0f3da8b804ada20e186a5", "logModifiedUtc": "2026-10-09T06:42:49.490475+00:00", "total": 1023, "passed": 1023, "failed": 0, "skipped": 0, "resultFileSha256": "148fd0c46296e9d92f40a253a17cff59e2bc9f37d0bdf931720c1d6a66199601", "caseOutcomes": { "Passed": 1023 } }, { "name": "focused-ai", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "test", "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", "--configuration", "Release", "--no-build", "--filter", "FullyQualifiedName~CvAi|FullyQualifiedName~AiWorkspace|FullyQualifiedName~AiPrivacyPolicy|FullyQualifiedName~MeteredSummarizerService", "--logger", "trx;LogFileName=focused-ai.trx", "--results-directory", ".artifacts/p5-15-01/backend", "--", "xUnit.parallelizeTestCollections=false", "xUnit.maxParallelThreads=1" ], "startedUtc": "2026-10-09T06:42:49.570185+00:00", "finishedUtc": "2026-10-09T06:42:55.621559+00:00", "durationSeconds": 6.051, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/focused-ai.log", "expectedPassed": 108, "resultFile": ".artifacts/p5-15-01/backend/focused-ai.trx", "logSha256": "4bcdac86c74a9f95fea0cec859f7a11e88a8edd1a91d849ba148f762b7878ce8", "logModifiedUtc": "2026-10-09T06:42:55.530753+00:00", "total": 108, "passed": 108, "failed": 0, "skipped": 0, "resultFileSha256": "f35cfc8655d1f72047481e76eb458bd56db7349890bb9464107e7892d39b994f", "caseOutcomes": { "Passed": 108 }, "includedInBackendTotal": true }, { "name": "cv-revision", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "test", "JobTrackerApi.Tests/JobTrackerApi.Tests.csproj", "--configuration", "Release", "--no-build", "--filter", "FullyQualifiedName~CvRevisionReadinessTests", "--logger", "trx;LogFileName=cv-revision.trx", "--results-directory", ".artifacts/p5-15-01/backend", "--", "xUnit.parallelizeTestCollections=false", "xUnit.maxParallelThreads=1" ], "startedUtc": "2026-10-09T06:42:55.622559+00:00", "finishedUtc": "2026-10-09T06:42:58.873218+00:00", "durationSeconds": 3.251, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/cv-revision.log", "expectedPassed": 5, "resultFile": ".artifacts/p5-15-01/backend/cv-revision.trx", "logSha256": "3d1afa49da9339ebd2ae47d161fdd2fa4ffffaad40944b6410ba66a74bbff499", "logModifiedUtc": "2026-10-09T06:42:58.794657+00:00", "total": 5, "passed": 5, "failed": 0, "skipped": 0, "resultFileSha256": "60d914ec0b8b673a7a00091812254672e952faed72178e6fa9a0a32efaf5b4b7", "caseOutcomes": { "Passed": 5 }, "includedInBackendTotal": true }, { "name": "sidecar", "command": [ "rtk", "proxy", "tools/summarizer/.venv/Scripts/python.exe", "-m", "pytest", "tools/summarizer/tests", "-q", "-o", "cache_dir=E:/Storage/Projects/Active/Job tracker/.artifacts/p5-15-01/backend/pytest-cache", "--basetemp=.artifacts/p5-15-01/backend/pytest-tmp", "--junitxml=.artifacts/p5-15-01/backend/sidecar.xml" ], "startedUtc": "2026-10-09T06:42:58.873719+00:00", "finishedUtc": "2026-10-09T06:43:10.558651+00:00", "durationSeconds": 11.685, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/sidecar.log", "expectedPassed": 49, "resultFile": ".artifacts/p5-15-01/backend/sidecar.xml", "logSha256": "82343598cb5df3ac7bf51fa3f1c28f8a8af624ae8921ae8a69bb846ec754e15a", "logModifiedUtc": "2026-10-09T06:43:09.582691+00:00", "total": 49, "failed": 0, "errors": 0, "skipped": 0, "resultFileSha256": "3d586e4054d381fe7e96d0e36bcc3306575065bfcd81a646a4b9d4b838395841", "offlineEnvironment": { "AI_SERVICE_SKIP_MODEL_LOAD": "1", "HF_HUB_OFFLINE": "1", "TRANSFORMERS_OFFLINE": "1" }, "passed": 49 }, { "name": "configuration-tests", "command": [ "rtk", "proxy", "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", "-X", "utf8", "scripts/test-ingress.py" ], "startedUtc": "2026-10-09T06:43:10.558651+00:00", "finishedUtc": "2026-10-09T06:43:11.506532+00:00", "durationSeconds": 0.948, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/configuration-tests.log", "expectedPassed": 3, "logSha256": "c5422ad2115120fa09139e83266b491082cefcc1443e74deaab37c3fc5a2dd15", "logModifiedUtc": "2026-10-09T06:43:11.482629+00:00", "total": 3, "passed": 3, "failed": 0, "skipped": 0, "countEvidence": "Python unittest completed count and OK in freshly read log" }, { "name": "supply-chain-tests", "command": [ "rtk", "proxy", "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", "-X", "utf8", "scripts/test-supply-chain.py" ], "startedUtc": "2026-10-09T06:43:11.506532+00:00", "finishedUtc": "2026-10-09T06:43:11.754355+00:00", "durationSeconds": 0.248, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/supply-chain-tests.log", "expectedPassed": 3, "logSha256": "3a39595952165df2d71e93168ce7709d8d46dcd0cc71c6307487369fa49be93b", "logModifiedUtc": "2026-10-09T06:43:11.724141+00:00", "total": 3, "passed": 3, "failed": 0, "skipped": 0, "countEvidence": "Python unittest completed count and OK in freshly read log" }, { "name": "offline-evaluation-tests", "command": [ "rtk", "proxy", "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", "-X", "utf8", "scripts/test-ollama-evaluation.py" ], "startedUtc": "2026-10-09T06:43:11.755886+00:00", "finishedUtc": "2026-10-09T06:43:12.064425+00:00", "durationSeconds": 0.309, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/offline-evaluation-tests.log", "expectedPassed": 5, "logSha256": "35f1e6a9fac1549314e6b706619f560bea598478e5c5e2fe4006d1fa9781af6b", "logModifiedUtc": "2026-10-09T06:43:12.029027+00:00", "total": 5, "passed": 5, "failed": 0, "skipped": 0, "countEvidence": "Python unittest completed count and OK in freshly read log" }, { "name": "extension-tests", "command": [ "rtk", "proxy", "node", "--test", "browser-extension/tests/capture-url.test.mjs" ], "startedUtc": "2026-10-09T06:43:12.065428+00:00", "finishedUtc": "2026-10-09T06:43:12.276147+00:00", "durationSeconds": 0.211, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/extension-tests.log", "expectedPassed": 3, "logSha256": "ae340e600b6f4fbbfde4d981c7361674e219736386fe3220628143d2ee3b8c22", "logModifiedUtc": "2026-10-09T06:43:12.254823+00:00", "total": 3, "passed": 3, "failed": 0, "cancelled": 0, "skipped": 0, "todo": 0 } ], "runtimes": { "dotnetSdk": "9.0.317", "dotnetHost": "9.0.19", "platform": "win-x64 Windows 10.0.26200", "bundledPython": "3.12.14", "sidecarPython": "3.12.10", "node": "v24.19.0", "evidence": [ { "name": "dotnet-info", "command": [ "rtk", "proxy", "C:/Users/Connor/.dotnet/dotnet.exe", "--info" ], "startedUtc": "2026-10-09T06:43:13.831751+00:00", "finishedUtc": "2026-10-09T06:43:14.133204+00:00", "durationSeconds": 0.301, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/dotnet-info.log", "logSha256": "9c3ce21e82d05e8e1d30a583845191eb4d48a551746401df74536d80fc26ebb2" }, { "name": "python-info", "command": [ "rtk", "proxy", "C:/Users/Connor/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe", "--version" ], "startedUtc": "2026-10-09T06:43:14.133204+00:00", "finishedUtc": "2026-10-09T06:43:14.194240+00:00", "durationSeconds": 0.061, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/python-info.log", "logSha256": "e2ec9b5a991ffaac3084bd67d5ab28da32f19d4a7de07e786d2464b1eed30f5c" }, { "name": "sidecar-python-info", "command": [ "rtk", "proxy", "tools/summarizer/.venv/Scripts/python.exe", "--version" ], "startedUtc": "2026-10-09T06:43:14.195247+00:00", "finishedUtc": "2026-10-09T06:43:14.271835+00:00", "durationSeconds": 0.077, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/sidecar-python-info.log", "logSha256": "cf4030b5a1ca11510b0f1b690790f507291ffa4e34f411cf899750645a04d1c0" }, { "name": "node-info", "command": [ "rtk", "proxy", "node", "--version" ], "startedUtc": "2026-10-09T06:43:14.272340+00:00", "finishedUtc": "2026-10-09T06:43:14.352661+00:00", "durationSeconds": 0.08, "exitCode": 0, "log": ".artifacts/p5-15-01/backend/node-info.log", "logSha256": "ac83cc86adf0cb07111ac838d304b5d4deb616eafb199375207476a193308bcb" } ] }, "sourceProvenance": { "applicationAndHelperPathsUnchangedFromSourceCheckpoint": true, "comparedPaths": [ "JobTrackerApi", "JobTrackerApi.Tests", "tools/summarizer", "scripts", "browser-extension", "global.json" ], "sourceHashManifest": ".artifacts/p5-15-01/backend/source-hashes.json", "sourceHashManifestSha256": "e4e8dc5755eeba0a366a1cac23c0e1aa23a70b32d64960054d7dfba7adb37bd5", "trackedFilesHashed": 456, "releaseBuildArtifacts": [ { "path": "JobTrackerApi/bin/Release/net9.0/JobTrackerApi.dll", "sha256": "c1170121a37dcf3ba4aca2882c21fa5541f0fe3159346ffe84df59b4dd69fc80", "modifiedUtc": "2026-10-09T06:42:02.931020+00:00" }, { "path": "JobTrackerApi.Tests/bin/Release/net9.0/JobTrackerApi.Tests.dll", "sha256": "f0b686351ae05da688cd06e3430ff69a72a209aceedf369c04dee4c7b8ef1a3c", "modifiedUtc": "2026-10-09T06:42:09.765287+00:00" }, { "path": "JobTrackerApi.Tests/PdfBrowserStub/bin/Release/net9.0/PdfBrowserStub.dll", "sha256": "8250882622f07de365de9a607af1079bcf8145c4d6b367b97b59eecb3b44b87a", "modifiedUtc": "2026-10-09T06:42:05.369067+00:00" } ] }, "backendCaseInventory": { "total": 1023, "outcomes": { "Passed": 1023 }, "classCounts": { "AccountDataExportTests": 3, "AccountDeletionTests": 6, "AccountPlansTests": 7, "AiEvaluationFixtureTests": 1, "AiOperationQueueTests": 5, "AiPrivacyPolicyTests": 9, "AiUsageMeterTests": 3, "AiWorkspaceNotePersistenceTests": 3, "AiWorkspaceTests": 9, "AnalyticsSalaryTests": 1, "ApiAuthorizationPostureTests": 5, "ApplicationAssetsTests": 15, "ApplicationCalendarControllerTests": 4, "ApplicationChecklistTests": 15, "ApplicationIntelligenceTests": 19, "ApplicationWorkspaceTests": 10, "AttachmentConsistencyTests": 14, "AttachmentFlagsRecomputeTests": 3, "AttachmentsControllerTests": 3, "AuthAndSystemControllerTests": 38, "AuthSessionRevocationTests": 8, "AvatarStorageTests": 1, "BackgroundWorkerTenantTests": 10, "BackupControllerTests": 3, "BillingControllerTests": 4, "BuildMetadataTests": 8, "CareerEvidenceControllerTests": 1, "CareerProfileControllerTests": 6, "CareerProfileServiceTests": 21, "ClientErrorsControllerTests": 2, "CompanyRelationshipTests": 2, "ConcurrentInitializationTests": 2, "CorrespondenceControllerTests": 3, "CsvExportTests": 25, "CurrentUserIdLiveEvaluationTests": 2, "CvAiEvaluationTests": 5, "CvAiGroundingTests": 45, "CvAiReadinessTests": 29, "CvBuilderTests": 35, "CvCorpusHarnessTests": 1, "CvExportRetentionTests": 1, "CvExtractionCoverageTests": 15, "CvProcessingOperationTests": 4, "CvProfileDiffServiceTests": 11, "CvRevisionReadinessTests": 5, "DatabaseBackupRunnerTests": 3, "EmailControllerTests": 3, "EmailDraftPersistenceTests": 1, "EmailDraftsControllerTests": 5, "EmailOwnershipIntegrationTests": 3, "EmailProviderDeliveryTests": 4, "EmailSendAttemptStoreTests": 5, "EmailSendControllerTests": 7, "EmailStatusClassifierTests": 7, "ExternalOriginTests": 14, "ForwardedIngressTests": 13, "GmailControllerTests": 19, "GoogleTokenValidatorTests": 1, "HumanLanguageCatalogTests": 20, "ImapControllerTests": 9, "ImapProviderTests": 5, "ImapServiceSsrfGuardTests": 7, "InterviewAiContextTests": 8, "InterviewPrepPersistenceTests": 3, "InterviewPrepTests": 11, "JobApplicationsApplicationPackageTests": 11, "JobApplicationsAppliedDateHistoryTests": 4, "JobApplicationsAuthorizationTests": 4, "JobApplicationsControllerTests": 2, "JobApplicationsEndpointBehaviorTests": 9, "JobApplicationsFollowUpDraftTests": 2, "JobApplicationsMariaDraftTests": 1, "JobApplicationsWorkflowSignalsTests": 2, "JobCvMatchServiceTests": 16, "JobDiscoveryControllerTests": 3, "JobImportHttpTransportTests": 76, "JobImportServiceTests": 16, "JobLifecycleEventTests": 9, "JobOpportunitySyncTests": 1, "JobPipelineTests": 46, "JobQueryParityTests": 16, "LocalAuthIdentityTests": 3, "MaintenanceJobDispatcherTests": 3, "MeteredSummarizerServiceTests": 8, "MicrosoftGraphControllerTests": 7, "MicrosoftGraphProviderTests": 6, "MicrosoftTokenValidatorTests": 17, "MigrationChainTests": 18, "NotificationSettingsControllerTests": 3, "OperationsControllerTests": 3, "OwnershipGuardTests": 3, "PdfRenderAdmissionTests": 22, "ProEntitlementAuthorizationTests": 23, "ProductionConfigTests": 3, "ProfileCvControllerTests": 32, "PublicCvControllerTests": 3, "RateLimitPartitionKeysTests": 3, "RouteUniquenessTests": 1, "RulesEngineProspectTests": 5, "SavedJobSearchAlertTests": 1, "SessionContextMiddlewareTests": 13, "SessionsControllerTests": 8, "SqliteDateTimeOffsetCompatibilityTests": 5, "SqliteMigrationHelperTests": 1, "StageAnalyticsTests": 4, "StartupSchemaOwnershipTests": 2, "StrategySnapshotOperationTests": 4, "SubmittedApplicationPackageTests": 4, "SummarizerServiceTests": 4, "TwoFactorControllerTests": 9, "UserOperationStoreTests": 10, "UsersControllerTests": 7 } }, "scopedPreservationCoverage": [ { "scope": "Authentication and active-session context", "passed": 71, "failed": 0, "classes": [ "AuthSessionRevocationTests", "AuthAndSystemControllerTests", "TwoFactorControllerTests", "SessionContextMiddlewareTests", "LocalAuthIdentityTests" ], "coveredContracts": [ "Exact logout revocation, copied-principal denial, session/owner binding, password-reset/change revocation, trusted-device isolation and replay resistance.", "Missing/stale/forged context rejects authenticated mutations; stale reads fail; Admin and bearer-token context cannot bypass the precondition.", "Login lockout, unconfirmed-account policy, 2FA/recovery consumption, verification/email-change contracts and credential linking." ], "limitations": [ "Primarily direct-controller/service/middleware tests with mock managers and EF InMemory; real browser cookie, remember/logout/account-switch cancellation is a separate browser gate.", "No external OAuth, email delivery or deployed ingress acceptance." ], "sources": [ "JobTrackerApi.Tests/AuthSessionRevocationTests.cs:20", "JobTrackerApi.Tests/SessionContextMiddlewareTests.cs:12", "JobTrackerApi.Tests/TestSupport/TestHostFactory.cs:17" ], "caseInventoryCount": 71, "representativeCases": [ { "name": "JobTrackerApi.Tests.TwoFactorControllerTests.Challenge_with_unknown_pending_token_is_rejected", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Update_profile_applies_trimmed_profile_fields", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.LocalAuthIdentityTests.GetRequiredUserId_returns_null_when_subject_claim_is_missing", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Login_rejects_unconfirmed_local_account_when_flag_on", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.SessionContextMiddlewareTests.Missing_old_and_forged_contexts_never_reach_an_authenticated_mutation(method: \"POST\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AuthAndSystemControllerTests.Login_rejects_missing_turnstile_token_when_configured", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AuthSessionRevocationTests.Session_validator_requires_sid_and_user_to_match_the_same_row", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.TwoFactorControllerTests.Challenge_with_valid_totp_code_completes_sign_in", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "Authorization and tenant isolation", "passed": 48, "failed": 0, "classes": [ "ApiAuthorizationPostureTests", "OwnershipGuardTests", "JobApplicationsAuthorizationTests", "JobQueryParityTests", "ApplicationWorkspaceTests", "BackgroundWorkerTenantTests" ], "coveredContracts": [ "Controller/action public-vs-authorized declarations and Admin-role attributes.", "Foreign jobs/history/match/status and missing-owner queries fail closed.", "16 SQLite parity scenarios compare complete ordered matching IDs across every table page and Board, including custom/deleted/foreign-company cases, 62 owned plus a foreign row." ], "limitations": [ "Authorization attribute/helper tests are static reflection proof; direct controller denial and SQLite query parity do not prove every deployed HTTP route.", "62-row SQLite fixture is finite functional parity, not a large-account memory/request-count benchmark." ], "sources": [ "JobTrackerApi.Tests/ApiAuthorizationPostureTests.cs:51", "JobTrackerApi.Tests/JobQueryParityTests.cs:17", "JobTrackerApi.Tests/JobApplicationsAuthorizationTests.cs:17" ], "caseInventoryCount": 48, "representativeCases": [ { "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"search\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobApplicationsAuthorizationTests.Job_choices_searches_all_owned_rows_without_leaking_another_tenant", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.BackgroundWorkerTenantTests.Reminder_worker_respects_each_owners_persisted_email_opt_out", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"standard\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.ApplicationWorkspaceTests.Overview_aggregates_the_application_without_copying_career_data", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.BackgroundWorkerTenantTests.Runner_enters_each_owner_filter_and_isolates_owner_failures", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"deleted\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobQueryParityTests.Table_pages_and_board_have_identical_owned_membership(scenario: \"all\")", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "CV revision, history and canonical source", "passed": 61, "failed": 0, "classes": [ "CvRevisionReadinessTests", "CvBuilderTests", "ApplicationAssetsTests", "CareerProfileControllerTests" ], "coveredContracts": [ "SQLite stale save/restore rejects overwrites before appending history, including independent contexts and fresh stale versions.", "History is an immutable settings lens; inherited canonical source stays live; override/reset/restore preserves canonical profile and prior versions.", "Foreign revision read/save/restore denied; cover-letter version restore preserves newer history; variants and source overrides remain separate." ], "limitations": [ "Backend checks cannot establish UI Undo/draft-recovery/reorder/focus behavior or native pagination fidelity; those have separate owners.", "No simultaneous deployed database stress or production DB-provider proof." ], "sources": [ "JobTrackerApi.Tests/CvRevisionReadinessTests.cs:22", "JobTrackerApi.Tests/ApplicationAssetsTests.cs:198", "JobTrackerApi.Tests/CvBuilderTests.cs:372" ], "caseInventoryCount": 61, "representativeCases": [ { "name": "JobTrackerApi.Tests.CvBuilderTests.Resolver_hides_a_single_item_by_key", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvBuilderTests.Delete_removes_the_variant_and_its_versions", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CareerProfileControllerTests.Put_rejects_an_over_limit_profile", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvBuilderTests.Duplicate_copies_settings_with_a_fresh_slug", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.ApplicationAssetsTests.Each_edit_adds_a_version_and_none_are_lost", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvRevisionReadinessTests.Foreign_account_cannot_read_save_or_restore_revision_history", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvBuilderTests.Norwegian_variant_localizes_default_labels_dates_and_keeps_custom_links_clickable", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CareerProfileControllerTests.Put_then_get_preserves_reviewed_free_form_fields", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "Documents, frozen packages and downloads", "passed": 32, "failed": 0, "classes": [ "SubmittedApplicationPackageTests", "AttachmentConsistencyTests", "AttachmentsControllerTests", "JobApplicationsApplicationPackageTests" ], "coveredContracts": [ "Snapshot byte/SHA contract, frozen HTML/career/application material, tenant-scoped capture, missing attachment abort with no package.", "Attachment trust boundaries, exact size limit, foreign download/rename/delete denial; failed copy/DB/promotion/delete recovery preserves bytes or retry state.", "Tailored preview/export share renderer and avatar contracts; drafts remain job scoped without mutating the master." ], "limitations": [ "Frozen package renderer/storage mostly mocked; one snapshot checks actual temp-file bytes. Native ZIP/browser download and PDF content/pagination need separate evidence.", "No production filesystem/backup recovery or live attachment fixture exercised." ], "sources": [ "JobTrackerApi.Tests/SubmittedApplicationPackageTests.cs:14", "JobTrackerApi.Tests/AttachmentConsistencyTests.cs:20", "JobTrackerApi.Tests/AttachmentConsistencyTests.cs:223" ], "caseInventoryCount": 32, "representativeCases": [ { "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Repeated_same_name_uploads_use_distinct_storage_paths", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobApplicationsApplicationPackageTests.Generate_and_save_tailored_cv_draft_persists_job_scoped_document_without_mutating_master_cv", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Committed_upload_with_failed_promotion_is_recovered_on_restart_pass", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentsControllerTests.Max_file_size_limit_is_10_mb", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentsControllerTests.Controller_requires_local_authorization", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Another_users_attachment_cannot_be_downloaded_renamed_or_deleted", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Purpose_and_derived_flags_roll_back_together", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AttachmentConsistencyTests.Invalid_later_file_writes_no_rows_or_bytes", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "Public/private CV identity", "passed": 3, "failed": 0, "classes": [ "PublicCvControllerTests" ], "coveredContracts": [ "Public PDF uses public variant renderer; private/unknown slug never invokes render/export; public PDF rate-limit attribute retained." ], "limitations": [ "Controller PDF exporter is mocked; service tests in CvBuilder separately cover public publication, private denial and revoked-link rotation.", "Anonymous HTTP/public browser/native PDF results remain separate gates." ], "sources": [ "JobTrackerApi.Tests/PublicCvControllerTests.cs:24", "JobTrackerApi.Tests/PublicCvControllerTests.cs:50", "JobTrackerApi.Tests/CvBuilderTests.cs:472" ], "caseInventoryCount": 3, "representativeCases": [ { "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_uses_the_public_variant_render", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_is_rate_limited", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.PublicCvControllerTests.Pdf_download_does_not_render_an_unknown_or_private_slug", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "Import, CSV and account data export", "passed": 126, "failed": 0, "classes": [ "JobImportServiceTests", "JobImportHttpTransportTests", "CsvExportTests", "AccountDataExportTests", "DatabaseBackupRunnerTests", "BackupControllerTests" ], "coveredContracts": [ "Import private/literal/DNS rebinding/redirect/proxy/TLS/cancellation/size guards tested before prohibited dial; public HTTP uses local synthetic transport.", "CSV formula neutralization, independent CSV parsing, text escaping, typed values and deleted rows preserve safe output without altering stored text.", "Actual disposable SQLite/file account ZIP completeness, checksums, tenant isolation, auth/token/password/lease redaction and recent-session requirement.", "Local disposable SQLite backup opens as restorable and retention works." ], "limitations": [ "No live job source/provider call, deployed import behavior, production export or complete restore rehearsal; backup unit fixture cannot satisfy production recovery gate.", "Browser capture/low-frequency import/export controls need their own route/sub-workflow audit." ], "sources": [ "JobTrackerApi.Tests/JobImportHttpTransportTests.cs:68", "JobTrackerApi.Tests/AccountDataExportTests.cs:25", "JobTrackerApi.Tests/CsvExportTests.cs:17" ], "caseInventoryCount": 126, "representativeCases": [ { "name": "JobTrackerApi.Tests.CsvExportTests.Text_policy_is_idempotent_and_survives_independent_CSV_parsing(value: \"a,b\", expected: \"a,b\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CsvExportTests.Text_policy_is_idempotent_and_survives_independent_CSV_parsing(value: \"@SUM(A1:A2)\", expected: \"'@SUM(A1:A2)\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobImportServiceTests.Preview_rejects_equivalent_private_literals_before_http_send(url: \"http://0x7f000001/\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_denied_dns_addresses_before_any_socket_attempt(address: \"255.255.255.255\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.DatabaseBackupRunnerTests.RunOnce_creates_a_restorable_backup_file", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Caller_cancellation_interrupts_a_stalled_streamed_body", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_denied_dns_addresses_before_any_socket_attempt(address: \"172.31.255.255\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.JobImportHttpTransportTests.Handler_rejects_literal_without_dns_or_dial(url: \"http://[::1]/\")", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." }, { "scope": "Existing deterministic AI withholding/grounding preservation", "passed": 100, "failed": 0, "classes": [ "CvAiReadinessTests", "CvAiGroundingTests", "AiPrivacyPolicyTests", "AiWorkspaceTests", "MeteredSummarizerServiceTests" ], "coveredContracts": [ "Protected proposals are bound to owner/CV/source revision; stale/tampered/unsupported proposals cannot mutate content; unavailable services fail closed.", "Existing focused filter passed 108 subset cases with mocked/deterministic providers." ], "limitations": [ "No configured-model semantic qualification, P5-13 UI, provider activation or external model calls. Separate real HTTP withholding remains browser owner responsibility." ], "sources": [ "JobTrackerApi.Tests/CvAiReadinessTests.cs:251", "JobTrackerApi.Tests/CvAiReadinessTests.cs:277" ], "caseInventoryCount": 100, "representativeCases": [ { "name": "JobTrackerApi.Tests.CvAiReadinessTests.Canonical_change_during_edited_proposal_review_is_checked_again_before_save", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvAiReadinessTests.Unavailable_review_service_blocks_generation_and_apply_without_side_effects(apply: False)", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvAiReadinessTests.Grounded_rewriting_is_applied_only_on_accept_and_uses_normal_history(rewrite: \"Maintained internal web applications.\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AiPrivacyPolicyTests.External_processing_requires_admin_gate_user_consent_and_pro(adminEnabled: True, userAllowed: False, pro: True, expectedProvider: \"local\")", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvAiGroundingTests.Document_summary_can_consolidate_known_entry_facts", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.AiWorkspaceTests.Empty_ai_output_raises_unavailable", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvAiReadinessTests.Fabricated_or_mixed_provider_output_cannot_obtain_an_applicable_proposal(invented: \"Managed 50 engineers at Microsoft and increased re\"ยทยทยท)", "outcome": "Passed" }, { "name": "JobTrackerApi.Tests.CvAiReadinessTests.Fabricated_or_mixed_provider_output_cannot_obtain_an_applicable_proposal(invented: \"Flytende fransk og sertifisert prosjektleder.\")", "outcome": "Passed" } ], "completeCaseEvidence": "Fresh full-suite TRX, SHA-256 recorded in backend-full check; samples are not exhaustive workflow coverage." } ], "explicitNotVerified": [ "Real browser cookie/account switching and in-flight cancellation; full 57-row sub-workflow preservation requires browser/manual audit.", "Larger-account full-array memory/request-count behavior, overlapping preference persistence and SQLite preference debt.", "Native document ZIP/PDF layout/content/settings fidelity and physical screen-reader/device/software-keyboard/zoom acceptance.", "Actual external auth/mail/import/model provider behavior, P5-13 semantic qualification/UI and deployed Production configuration.", "Complete deployed backup/storage/config/schema/key restore and migration/rollback rehearsal." ], "qualification": "Existing suites use owned disposable synthetic databases/files and deterministic mocks/local fixtures. No application database migration, production data change, Docker operation, deployment or external provider/model call was performed." }