cesnimda
0954876295
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
187 lines
8.7 KiB
JSON
187 lines
8.7 KiB
JSON
{
|
|
"ticket": "B04",
|
|
"completedDate": "2026-09-08",
|
|
"baselineCommit": "7d641edc7bca866ccf06012897ba1d107c07e59f",
|
|
"status": "Complete locally; not deployed. B01/B02/B03 preserved; B05 not started.",
|
|
"environment": "Windows, .NET 9 and existing UI dependencies; synthetic local SQLite/API/browser data; external providers disabled",
|
|
"finalMiddlewareBoundary": "Existing CSRF -> authentication -> endpoint authorization -> rate limiting -> B02 session context -> controllers",
|
|
"acceptance": "Account policies use the final authorized principal, independent across accounts and shared across same-account sessions/transports/IPs. IP security policies, B02 provenance and B03 resource admission remain covered.",
|
|
"regressionsAdded": {
|
|
"backendCases": 2,
|
|
"realHttpScenarios": 9,
|
|
"testFixtureCorrection": "Stop signed-in public-CV setup page before cookie removal; no frontend runtime change."
|
|
},
|
|
"countsOverlap": true,
|
|
"runs": [
|
|
{
|
|
"path": ".artifacts/b04/focused.trx",
|
|
"sha256": "DCE64904E7C1921DCC896BF12BCFD1586C5CD77A9D3FC2334ED0FDBE277C18B9",
|
|
"total": 207,
|
|
"passed": 207,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"phase": "Focused auth/rate/B01-B03 backend before final authorization-order refinement"
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/backend-final.trx",
|
|
"sha256": "AD8761B5C2B06D4E286856AF9E9D02E586BD6751276EDC12E6204E6A49CEC09C",
|
|
"total": 877,
|
|
"passed": 877,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"phase": "Final full selected backend",
|
|
"excluded": [
|
|
"JobTrackerApi.Tests.ImapServiceSsrfGuardTests.ConnectAsync_rejects_unresolvable_host_without_leaking_dns_detail"
|
|
],
|
|
"exclusionReason": "Existing test makes external DNS requests; external access not authorized."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/frontend-focused.json",
|
|
"sha256": "273FF523A49CBB533EAF257BFC22A8A3622E457C0B50873881E4F6D4AB97CD86",
|
|
"suites": 4,
|
|
"total": 36,
|
|
"passed": 36,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"phase": "Affected frontend; runtime code unchanged by B04"
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/before.json",
|
|
"sha256": "9D76376030CBBED4A8840434C4AFA44F6855B4EDDF71A14B33C70ADBB29EE4D3",
|
|
"passed": 0,
|
|
"failed": 1,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 7913.539999999999,
|
|
"startedAt": "2026-09-08T21:06:28.266Z",
|
|
"phase": "Before application edits: expected failing safe assertion",
|
|
"observation": "A received 200/200; B on the same IP received 429/429."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/api-initial.json",
|
|
"sha256": "97E4A1AF216F6CB84B8E7D508F6C5C7F739EE47E95260D1052321C50D26402E9",
|
|
"passed": 9,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 11056.037,
|
|
"startedAt": "2026-09-08T21:10:18.256Z",
|
|
"phase": "Initial authentication-only ordering, superseded after self-review",
|
|
"notes": "Original scenarios passed, but endpoint-specific authorization may change the default principal. Final ordering also waits for authorization."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/api-final.json",
|
|
"sha256": "FD0BDEE6F68F7AF6438087732A8F0A6809B7A7EFD6DC7FF9A6BBB3672707026A",
|
|
"passed": 9,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 10464.229000000001,
|
|
"startedAt": "2026-09-08T21:20:33.327Z",
|
|
"phase": "Final HTTP rate-policy regression, including authorization-before-partitioning",
|
|
"scenarios": 9,
|
|
"observations": "Two accounts each admit 2/reject 1 on the same IP in both orders; four concurrent cookie/bearer/session requests succeed, later requests across other IPs remain limited. Invalid credentials are denied before account limiting; anonymous login remains IP-limited."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/browser.json",
|
|
"sha256": "AF984A9F9CB0F8EB1AAE88B724A1B0F718208FA0F6EFD10FA30D71D69049F33D",
|
|
"passed": 17,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 76250.659,
|
|
"startedAt": "2026-09-08T21:13:03.191Z",
|
|
"phase": "Full browser before final authorization-order refinement"
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/browser-final.json",
|
|
"sha256": "D89F4F58561A2B6F161F33BE9223C9A1582E3A1BD34F4985C33C0FEBA20F453C",
|
|
"passed": 16,
|
|
"failed": 1,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 80244.032,
|
|
"startedAt": "2026-09-08T21:22:28.655Z",
|
|
"phase": "First browser run after final authorization-order refinement",
|
|
"diagnosis": "Public CV fixture cleared cookies while signed-in page remained active, triggering B02's correct session-change redirect. Remaining 16 tests passed; fixture subsequently stops that page before cookie removal."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/browser-verified.json",
|
|
"sha256": "9512176BAB16E19E70CEBE9767FBE590CD8EB97308628ED29F46E690ADC77382",
|
|
"passed": 17,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 67434.35999999999,
|
|
"startedAt": "2026-09-08T21:25:36.046Z",
|
|
"phase": "Final full browser after fixture correction",
|
|
"notes": "All 17 passed without retries/flaky outcomes, including account switching and real PDFs."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/pdf-admission-final.json",
|
|
"sha256": "6213EA4CF8B5E713D5FD01D332765979BF10F492F741DE6C33854F64847D5520",
|
|
"passed": 1,
|
|
"failed": 0,
|
|
"skipped": 0,
|
|
"flaky": 0,
|
|
"durationMs": 7616.844999999999,
|
|
"startedAt": "2026-09-08T21:28:50.581Z",
|
|
"phase": "Final unchanged B03 authenticated multi-route admission probe",
|
|
"observations": {
|
|
"configured": 2,
|
|
"admitted": 2,
|
|
"rejected": 10,
|
|
"maximumActualRenders": 2,
|
|
"recoveryStatus": 200
|
|
}
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/build.log",
|
|
"sha256": "97AE4880F122E36BFC2A96184868F509DF76BA7177E9F5851D022ADED6FBB924",
|
|
"phase": "Final Release warnings-as-errors build",
|
|
"exitCode": 0,
|
|
"warnings": 0,
|
|
"errors": 0
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/lint.log",
|
|
"sha256": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
|
|
"phase": "Final targeted ESLint including public CV smoke fixture",
|
|
"exitCode": 0
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/typecheck.log",
|
|
"sha256": "2F9960647ABADEFD054152A9566E4E6557A55383E98627AED742B93EDEBB16DD",
|
|
"phase": "Final standalone TypeScript",
|
|
"exitCode": 1,
|
|
"initialExitCode": 2,
|
|
"diagnostic": "src/interview-prep.test.tsx(120,10): error TS2571: Object is of type 'unknown'.",
|
|
"classification": "Existing R01a only; no suppression or B04 type error."
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/diff-check.log",
|
|
"sha256": "07A41BCFE160D0FA5AA278C009F548C35372FBDDA40BDFC61BBDFF43DDF699DB",
|
|
"phase": "git diff --check",
|
|
"exitCode": 0
|
|
},
|
|
{
|
|
"path": ".artifacts/b04/public-cv-session-race.md",
|
|
"sha256": "118B893EC4CB2472EF8FE7DA309067188A6BF04A8CE9C4A3C78C98D6806A0BB4",
|
|
"phase": "Retained public CV fixture failure context",
|
|
"observation": "Session-change sign-in screen, not a PDF/rate-limit failure."
|
|
}
|
|
],
|
|
"frontendBuild": "B04 changes no frontend runtime source. Affected Jest and full browser checks used B03's previously built static export targeting localhost:5302; no new Next build claimed. This artifact is not for production deployment.",
|
|
"residualLimitations": [
|
|
"Fixed-window counters remain process-local and reset on restart. N instances can provide N times each configured allowance.",
|
|
"Intentional security IP limits remain shared behind NAT; account isolation does not convert every policy to an account limit.",
|
|
"Requests denied by CSRF/authorization do not reach rate limiting. Authorized attempts can consume their own allowance before later B02/controller refusal.",
|
|
"Authentication/session/policy evaluation occurs before rate rejection; this is not global ingress or pre-auth CPU admission.",
|
|
"Production trusted proxy/firewall/direct-ingress proof remains B06; only controlled local proxy behavior was exercised.",
|
|
"Optional external OAuth providers were not contacted. Authorization-before-limiting handles endpoint-specific principal selection using the existing framework.",
|
|
"Known R01a standalone TypeScript failure remains; B03 R04 resource/containment evidence remains open."
|
|
],
|
|
"evidenceRetention": "Original audit/probes preserved. Raw outputs remain local under ignored .artifacts/b04; these hashes and compact observations are retained. Initial passing-but-incomplete ordering and the browser fixture failure are explicitly distinguished from final verification.",
|
|
"recommendedNextTicket": "B05 Spreadsheet-safe CSV fields; requires separate user instruction."
|
|
}
|