jobtrackingapp/docs/global-jobs/00/ACCEPTANCE_MATRIX.md

# Acceptance and evidence matrix

28 October 2026. **All implementation scenarios below are NOT RUN in GJ-00.** This is the proposed acceptance contract, requiring owner approval for quantitative targets. Documentation checks are separately recorded in [Evidence](EVIDENCE.md).

| ID / stage | Required proof | Failure / boundary |
|---|---|---|
| GJ-PREF /01 | NO residence + SE/GB work countries; 0..N choices; second-device persistence; explicit save/default actions | No nationality requirement or silent permanent override |
| GJ-REV /01,06 | Concurrent preference/search writes; stale response preserves draft, expected revision at DB write; deleted account cannot schedule | No acknowledged edit loss, tenant bleed or stale worker notification |
| GJ-LANG /01,05,08 | English/local prominence; native labels, More Languages, Coming Later; independent advert/UI/document language; missing keys/plurals/errors | No enabled unqualified locale or false Swedish/Nynorsk completion |
| GJ-LOC /02 | Whole Warwickshire → Warwick only → Warwick OR Leamington → whole county after clearing towns; parent remains scope; deselect clears descendants | No parent-wide OR after refinement, no auto-child checkboxes or hidden filters |
| GJ-LOC-DATA /02 | Vestfold/Tønsberg/Sandefjord, Vestland/Bergen, Oslo dual type, Stockholm and UK unitary/overlap data; real versioned IDs | No district used as town, no substring precision or old-ID silent broadening |
| GJ-RADIUS /02 | Known point inside/on/outside 10/25/50km, multiple origins, country constraint, absent/coarse coordinate, remote eligibility | No county-centroid false pass, driving-time or worldwide-remote claim |
| GJ-OCC /03 | Ten sector groups × EN/Bokmål/SV queries; aliases, ambiguity, exact/related/free keyword; cancellation and outage | No IT-only vocabulary, lost unknown term or silent broadening |
| GJ-RIGHTS /04 | Deny unapproved capability in API/details/cache/export/notifications; reviewed manifests/grants and source labels | Public documentation/key/fixture cannot stand in for commercial grant |
| GJ-NAV /04 | Complete bootstrap, durable cursor, replay/out-of-order/update/INACTIVE/masking/expiry and changed geography; crash/429/401 | No stale contact exposure, skipped deletion, fake live search or public-token production mode |
| GJ-SE /04 | JobSearch permitted details; JobAd Links truncated text/original link/IDs/daily freshness/window; 404 | No follow-up third-party scrape or exhaustive result count from bounded window |
| GJ-GB /04 | Commercial Adzuna grant + permitted snippet/redirect; NHS/DWP connector only if independently approved | External/manual fallback shown honestly; no trial-based ongoing production |
| GJ-FINN /04 | New discovery and existing preview/import flows perform zero FINN network calls; manual URL/fields work | Plugin/network parsers cannot bypass source-rights denial |
| GJ-DEDUP /04,06 | Same authoritative ID clusters; similar teacher/restaurant vacancies stay distinct; one source withdraws | No false automatic merge or rights borrowed across duplicates |
| GJ-DETAIL /05 | Desktop 3-pane, tablet, mobile full detail/deep link; salary period/currency/prediction/unknown; original completeness/provenance | Missing fact never invented; restricted content absent from API and DOM |
| GJ-ALERT /06 | Initial baseline, daily/weekly/timezone/DST, cross-search dedupe, pause/unsubscribe, restart/duplicate worker, changed search, withdrawn before send | No spam, stale/expired alert or another user's data; ambiguous email retry reported |
| GJ-MATCH /06 | Explicit Career fact/version + advert requirement + ESCO relation; regulated licence absent/unknown, cleaner/no profile | No inferred fluency/authorisation/hiring probability or AI requirement |
| GJ-TRACK /06 | Save versus Track distinction; reviewed idempotent application association and native CV/letter flow | Preserve Job/Application split, revisions/history/null inheritance/frozen packages |
| GJ-ADMIN /07 | Rights/access/health/lag/backlog/quota/expiry, system sync versus owned import, correlation/structured redaction | Server Admin denial on list/detail/stream/export, no fake owner or raw host logs |
| GJ-SEC /04–08 | SSRF DNS/private IP/redirect/credential leakage, malformed oversized compressed payload, unsafe HTML/links/images, injection, pagination loops, tenant IDs | Zero accepted critical data loss, isolation failure, misleading rights/content or secret exposure |
| GJ-PRIV /06–08 | Preferences/bookmarks/subscriptions export+erase, contact minimization, queued alert cancellation, source revocation and restored-backup suppression | Copied provider content not exempted as “user data”; lawful frozen-history policy separately approved |
| GJ-OPS /07–08 | DB cursor/lease failure, worker crash, provider/index outage, bounded fanout/backoff, additive migration and previous-binary rollback | No loss of user records; rollback cannot republish deleted source data |
| GJ-PRESERVE /08 | All57 functionality groups/33 routes, Career/CV/import/application/RD21/letter/package/PDF regressions at frozen integrated source | No weakening old acceptance or replacing manual/provider evidence with fixtures |
| GJ-A11Y /05,08 | Keyboard/screen-reader semantics, focus recovery, reduced motion, themes, 200% zoom, 320/390/768/1440 CSS widths, actual device/native-language review | Automated axe incomplete results stay incomplete; emulation is not physical device acceptance |

## Proposed quantitative qualification protocol

Approve before feature performance/relevance claims; targets here are **not measured**. Use frozen dataset, hardware/runtime/config, warm/cold distinction, 20 concurrent search clients for 10 minutes, source-cached versus upstream latency reported separately, error counts and DB query plans. Suggested capacity corpus: 250k active source ads, 1m lifecycle events, 10k private saved searches; synthetic records cover all countries/sectors, geography precision and deletion rates.

- Autocomplete: warmed local p95 <=200ms for 10 suggestions, UI debounce measured separately. Relevant suggestion precision@5 >=0.90 / recall@5 >=0.80 for every sector/language, frozen/native-reviewed labels.
- Local indexed search: warmed p95 <=500ms for page50; API aggregate p95 <=2s when upstream meets bounded timeout. Do not conceal slow upstream by returning stale/rights-invalid data. Missing upstream results must be partial, not exact-global counts.
- Feed: proposed healthy NAV steady-state lag p95 <=2min after observation availability; local observed withdrawal suppression and queued-alert cancellation <=60s. Provider terms requiring immediate changes take precedence; validate actual polling/lag with NAV and do not call these target windows a permission to delay removal. Stale/outage policy must fail closed.
- Delivery: zero duplicate in-app notification for identical delivery key under retries/crash; proposed per-owner daily digest consolidation and max1 daily email digest unless explicitly chosen weekly. External mail ambiguity remains observable, not “exactly once”.
- Data/security/rights: zero accepted canonical data loss, unauthorized cross-owner access, unlicensed full-content display, fabricated credentials or secret leakage. These do not depend on statistical sample averages.

## Evidence accounting

Every result records test ID/native command/config, source SHA plus dirty/input hashes, fixture/dataset/licence version, environment, timestamp, native exit, discovered/passed/failed/skipped and reason. Keep RED and corrected runs. Full-suite unique membership is primary; focused reruns are references, not extra passes. Staged passes do not establish integrated acceptance.

Separate lanes: local deterministic fixtures; actual MariaDB; hosted isolated CI; authorised live source contracts; human/native-language/device/AT; live-model semantic qualification; deployed identity; production. NOT RUN, BLOCKED and OPEN are not passes. A source needs legal eligibility AND technical tests before enabled capability GO. Production/main remain withheld regardless of development success.