cesnimda
1614 lines
76 KiB
JSON
1614 lines
76 KiB
JSON
{
|
||
"schemaVersion": 1,
|
||
"reportDate": "2026-10-24",
|
||
"baselineCommit": "549b2cba5a791862ba3f854312ea819a86dc42a0",
|
||
"branch": "fix/p9-ci-and-requalification",
|
||
"scope": "source-based register; historical evidence distinguished from fresh execution; final decisions owned by root acceptance addendum",
|
||
"freshExecution": "PENDING root-owned validation ledger; this register does not run or attest tests",
|
||
"gateRules": {
|
||
"phase9": "REQUEST §§6,13,18: classify each item independently; unfinished genuine human checks remain release gates. No production-only condition automatically vetoes local functional QA. Remaining mandatory functional criteria require evidence.",
|
||
"phase10": "IMPLEMENTATION_PLAN.md:164-170: no route uses removed code + tests pass + functionality inventory satisfied. REQUEST prohibits automatically starting Phase10. No blanket conditional deletion eligibility.",
|
||
"production": "REQUEST §16 independent release/operator/provider/manual gates; no operations authorized",
|
||
"debt": "accepted optional or low debt remains visible, never relabelled a pass"
|
||
},
|
||
"findings": [
|
||
{
|
||
"id": "RD01",
|
||
"aliases": [
|
||
"F04"
|
||
],
|
||
"criterion": "OPEN; local static/loopback ingress contracts only",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 9
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: wrong client identity or exposed ingress",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence",
|
||
"status": "OPEN; local static/loopback ingress contracts only",
|
||
"gates": {
|
||
"phase9": "operator release gate",
|
||
"phase10": "candidate-specific ingress compatibility proof",
|
||
"production": "BLOCKED pending actual ingress identity",
|
||
"debt": "open operational qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD02",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: independently verified off-disk complete backup/restore",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 10
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Critical if recovery needed: irreversible loss",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal",
|
||
"status": "NOT TESTED: independently verified off-disk complete backup/restore",
|
||
"gates": {
|
||
"phase9": "no independent veto of isolated functional QA",
|
||
"phase10": "candidate restore dependency",
|
||
"production": "BLOCKED backup/restore",
|
||
"debt": "open operational qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD03",
|
||
"aliases": [
|
||
"F19"
|
||
],
|
||
"criterion": "PARTIAL: SQLite and generated MariaDB SQL; MariaDB runtime unavailable",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 11
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
},
|
||
{
|
||
"path": "docs/database/mariadb-standardisation/ACCEPTANCE.md",
|
||
"kind": "historical superseding bounded provider evidence"
|
||
},
|
||
{
|
||
"path": "docs/database/mariadb-standardisation/validation.json",
|
||
"kind": "historical raw result index"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: schema/provider/startup disagreement",
|
||
"dependency": "Production; provider acceptance",
|
||
"ownerAndRequiredClosure": "Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof",
|
||
"status": "MariaDB 12.2.2 RD21 runtime scope verified historically (32 provider cases, 1 native journey); broader provider/deployment parity still PARTIAL",
|
||
"gates": {
|
||
"phase9": "bounded provider save qualification historical PASS; full fresh matrix pending",
|
||
"phase10": "provider migration proof per candidate",
|
||
"production": "BLOCKED exact deployed parity/migrations",
|
||
"debt": "partial broad provider qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD04",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: intended Linux rollback",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 12
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: failed release cannot be reversed",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set",
|
||
"status": "NOT TESTED: intended Linux rollback",
|
||
"gates": {
|
||
"phase9": "no independent veto of isolated functional QA",
|
||
"phase10": "rollback proof per candidate",
|
||
"production": "BLOCKED actual rollback",
|
||
"debt": "open operational qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD05",
|
||
"aliases": [],
|
||
"criterion": "OPEN: old runner crashes/deployed identity not superseded",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 13
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
},
|
||
{
|
||
"kind": "current root-reported hosted investigation; final evidence pending root CI report",
|
||
"detail": "Merged host Docker socket binding found. No privileged socket fallback or production host access authorized; explicit blocked workflow gate retained."
|
||
}
|
||
],
|
||
"severityAndImpact": "High: healthy endpoint may serve wrong release",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "CI/operator owner: prove isolated private service execution and lifecycle without host socket/privileges/public ports/production coupling, then successful exact hosted TRX and cleanup. Keep workflow BLOCKED while isolation cannot be proven. Separate deployed runner/storage/release identity remains unqualified.",
|
||
"status": "Hosted database lane BLOCKED: root investigation found merged runner host Docker socket binding; private service isolation/lifecycle unknown. Local historical MariaDB proof is independent.",
|
||
"gates": {
|
||
"phase9": "fresh required CI pending root evidence",
|
||
"phase10": "testpass criterion pending root evidence",
|
||
"production": "BLOCKED deployed identity and operator diagnosis",
|
||
"debt": "open CI/release qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD06",
|
||
"aliases": [],
|
||
"criterion": "PARTIAL: finite axe/DOM/keyboard evidence; human checks open",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 14
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High accessibility impact",
|
||
"dependency": "Acceptance qualification; production",
|
||
"ownerAndRequiredClosure": "Accessibility tester: [M09-01–06](p9-03/MANUAL_CHECKLIST.md), contextual contrast/reader evidence; triage every applicable incomplete",
|
||
"status": "PARTIAL: finite axe/DOM/keyboard evidence; human checks open",
|
||
"gates": {
|
||
"phase9": "manual carry-forward allowed only as explicit release qualification (REQUEST §6), no human PASS",
|
||
"phase10": "affected functionality must remain satisfied; no deletion permission",
|
||
"production": "BLOCKED applicable human accessibility",
|
||
"debt": "open human qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD07",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: physical input/AT/alternate browsers/forced colors",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 15
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium/High usability exclusion",
|
||
"dependency": "Acceptance qualification; production",
|
||
"ownerAndRequiredClosure": "Product/accessibility owners: actual supported devices/browser/input versions and complete workflows",
|
||
"status": "NOT TESTED: physical input/AT/alternate browsers/forced colors",
|
||
"gates": {
|
||
"phase9": "manual carry-forward release qualification; no physical/AT PASS",
|
||
"phase10": "affected functionality proof still required",
|
||
"production": "BLOCKED supported device/browser/input acceptance",
|
||
"debt": "open human qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD08",
|
||
"aliases": [
|
||
"C11",
|
||
"P5-13"
|
||
],
|
||
"criterion": "DEFERRED; no new model qualification or activation",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 16
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: unqualified proposal semantics",
|
||
"dependency": "AI activation; production",
|
||
"ownerAndRequiredClosure": "Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence",
|
||
"status": "DEFERRED; no new model qualification or activation",
|
||
"gates": {
|
||
"phase9": "C11 explicitly withheld; separate scope",
|
||
"phase10": "no activation/deletion eligibility",
|
||
"production": "BLOCKED AI activation unless separately qualified",
|
||
"debt": "DEFERRED product/model scope"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD09",
|
||
"aliases": [],
|
||
"criterion": "Local withheld-operation contract retained; deployed withholding NOT TESTED",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 17
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: unreviewed AI write/external request",
|
||
"dependency": "Production / AI",
|
||
"ownerAndRequiredClosure": "Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently",
|
||
"status": "Local withheld-operation contract retained; deployed withholding NOT TESTED",
|
||
"gates": {
|
||
"phase9": "local withholding contract needs fresh successor",
|
||
"phase10": "retain withholding and callers",
|
||
"production": "BLOCKED deployed withholding untested",
|
||
"debt": "open deployment qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD10",
|
||
"aliases": [],
|
||
"criterion": "PARTIAL: native local PDF corpus and visual sheets; deployed fonts/photo/print absent",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 18
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium/High document reliability",
|
||
"dependency": "Acceptance qualification; production",
|
||
"ownerAndRequiredClosure": "Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry",
|
||
"status": "PARTIAL: native local PDF corpus and visual sheets; deployed fonts/photo/print absent",
|
||
"gates": {
|
||
"phase9": "finite output qualification; human/Linux/print not passed",
|
||
"phase10": "affected rendering must preserve output contracts",
|
||
"production": "BLOCKED intended output environment",
|
||
"debt": "open output qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD11",
|
||
"aliases": [],
|
||
"criterion": "Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 19
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High if preference save fails",
|
||
"dependency": "Reliability qualification",
|
||
"ownerAndRequiredClosure": "Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases",
|
||
"status": "Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL",
|
||
"gates": {
|
||
"phase9": "scoped WAL repair retained; broad reliability qualification open",
|
||
"phase10": "retain provider/concurrency safeguards",
|
||
"production": "provider contention remains qualified",
|
||
"debt": "retained broader reliability"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD12",
|
||
"aliases": [],
|
||
"criterion": "PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 20
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: settings may not persist",
|
||
"dependency": "Reliability qualification",
|
||
"ownerAndRequiredClosure": "Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss",
|
||
"status": "PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified",
|
||
"gates": {
|
||
"phase9": "no newly established failure; provider overlap remains qualification",
|
||
"phase10": "candidate must preserve drafts and recovery",
|
||
"production": "intended-provider qualification open",
|
||
"debt": "retained reliability"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD13",
|
||
"aliases": [],
|
||
"criterion": "Historical Rules 500 mechanism remains UNCONFIRMED",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 21
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: failed save/draft retention",
|
||
"dependency": "Reliability qualification",
|
||
"ownerAndRequiredClosure": "Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient",
|
||
"status": "Historical Rules 500 mechanism remains UNCONFIRMED",
|
||
"gates": {
|
||
"phase9": "historical causal mechanism UNCONFIRMED; not relabelled resolved",
|
||
"phase10": "candidate must preserve Rules recovery",
|
||
"production": "no complete reliability claim",
|
||
"debt": "unconfirmed historical observation"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD14",
|
||
"aliases": [],
|
||
"criterion": "Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 22
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium/High keyboard access",
|
||
"dependency": "Accessibility qualification",
|
||
"ownerAndRequiredClosure": "Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior",
|
||
"status": "Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result",
|
||
"gates": {
|
||
"phase9": "historical causal mechanism UNCONFIRMED; human focus qualification",
|
||
"phase10": "candidate must preserve trap/return/error states",
|
||
"production": "applicable human checks open",
|
||
"debt": "unconfirmed historical observation"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD15",
|
||
"aliases": [],
|
||
"criterion": "Historical intermittent CV section expansion cause unproven",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 23
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: editing disrupted",
|
||
"dependency": "Reliability qualification",
|
||
"ownerAndRequiredClosure": "CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions",
|
||
"status": "Historical intermittent CV section expansion cause unproven",
|
||
"gates": {
|
||
"phase9": "historical cause UNCONFIRMED; no invented current defect",
|
||
"phase10": "candidate must preserve expansion state",
|
||
"production": "broader reliability qualification",
|
||
"debt": "unconfirmed historical observation"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD16",
|
||
"aliases": [],
|
||
"criterion": "Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 24
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: recovery/access",
|
||
"dependency": "Preservation qualification",
|
||
"ownerAndRequiredClosure": "Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks",
|
||
"status": "Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL",
|
||
"gates": {
|
||
"phase9": "scoped repair historical PASS; broader human contract open",
|
||
"phase10": "candidate-specific recovery proof",
|
||
"production": "human/provider qualification open",
|
||
"debt": "partial preserved contract"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD17",
|
||
"aliases": [],
|
||
"criterion": "Board remains O(N); 200/1,000-job and new bounded 250-job observations are finite",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 25
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: growing rendering cost",
|
||
"dependency": "Performance qualification",
|
||
"ownerAndRequiredClosure": "Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership",
|
||
"status": "Board remains O(N); 200/1,000-job and new bounded 250-job observations are finite",
|
||
"gates": {
|
||
"phase9": "finite capacity evidence; fresh sustained lane pending",
|
||
"phase10": "measured bottleneck and full membership before optimization",
|
||
"production": "no production capacity/SLA claim",
|
||
"debt": "O(N) known design limit"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD18",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: physical drag/drop/cancel/browser variants",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 26
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium access/workflow risk",
|
||
"dependency": "Human/device qualification",
|
||
"ownerAndRequiredClosure": "Input/device tester: real Board/CV selection and named alternatives, no hidden result cap",
|
||
"status": "NOT TESTED: physical drag/drop/cancel/browser variants",
|
||
"gates": {
|
||
"phase9": "manual carry-forward release qualification; physical behavior not passed",
|
||
"phase10": "retain accessible reorder alternatives",
|
||
"production": "BLOCKED physical input variants",
|
||
"debt": "open device qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD19",
|
||
"aliases": [],
|
||
"criterion": "DEFERRED: reviewed `followMode` consumer",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 27
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium workflow limitation",
|
||
"dependency": "Deferred scope; not silently completed",
|
||
"ownerAndRequiredClosure": "Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend",
|
||
"status": "DEFERRED: reviewed `followMode` consumer",
|
||
"gates": {
|
||
"phase9": "accepted deferred reviewed consumer; no activation",
|
||
"phase10": "ineligible to remove metadata/paths",
|
||
"production": "separate activation gate",
|
||
"debt": "DEFERRED product scope"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD20",
|
||
"aliases": [],
|
||
"criterion": "Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 28
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Low optional scope",
|
||
"dependency": "Deferred scope",
|
||
"ownerAndRequiredClosure": "Product owner: explicit separate brief; retain existing full workspace and all routes",
|
||
"status": "Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately",
|
||
"gates": {
|
||
"phase9": "optional preview DEFERRED; full workspace retained",
|
||
"phase10": "no deletion of full workspace/aliases",
|
||
"production": "no independent veto while optional scope remains deferred",
|
||
"debt": "DEFERRED optional scope"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD21",
|
||
"aliases": [],
|
||
"criterion": "OPEN: canonical Career/generic job revision contract and creation-intent idempotency",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 29
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
},
|
||
{
|
||
"path": "docs/database/mariadb-standardisation/ACCEPTANCE.md",
|
||
"kind": "historical superseding bounded provider evidence"
|
||
},
|
||
{
|
||
"path": "docs/database/mariadb-standardisation/validation.json",
|
||
"kind": "historical raw result index"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: stale editor can overwrite acknowledged edits",
|
||
"dependency": "Data-integrity acceptance; production",
|
||
"ownerAndRequiredClosure": "Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance",
|
||
"status": "RESOLVED within qualified MariaDB 12.2.2 save/concurrency scope; current branch successor qualification pending root ledger; creation-intent idempotency remains separate OPEN debt",
|
||
"gates": {
|
||
"phase9": "bounded save/concurrency resolved historically; fresh full successor pending; creation idempotency separate",
|
||
"phase10": "no compatibility removal without all-caller/rollback proof",
|
||
"production": "BLOCKED deployment/rollback parity; no historical recovery claim",
|
||
"debt": "creation-intent idempotency OPEN, separate concern"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD22",
|
||
"aliases": [
|
||
"F20"
|
||
],
|
||
"criterion": "NOT TESTED: enabled-worker outage recovery/durability",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 30
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High: duplicate/lost async work",
|
||
"dependency": "Production / enabled producer",
|
||
"ownerAndRequiredClosure": "Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation",
|
||
"status": "NOT TESTED: enabled-worker outage recovery/durability",
|
||
"gates": {
|
||
"phase9": "isolated fixtures do not accept enabled producer",
|
||
"phase10": "retain stable IDs and recovery paths",
|
||
"production": "BLOCKED enabled-worker recovery",
|
||
"debt": "open operational qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD23",
|
||
"aliases": [
|
||
"F21"
|
||
],
|
||
"criterion": "OPEN: actual calendar offset/DST/date-only semantics",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 31
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium: wrong event time",
|
||
"dependency": "Calendar qualification",
|
||
"ownerAndRequiredClosure": "Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes",
|
||
"status": "OPEN: actual calendar offset/DST/date-only semantics",
|
||
"gates": {
|
||
"phase9": "actual offset/DST/date-only unqualified",
|
||
"phase10": "retain calendar semantics until dedicated proof",
|
||
"production": "BLOCKED calendar activation qualification",
|
||
"debt": "open provider semantics"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD24",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 32
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High privacy/lifecycle impact",
|
||
"dependency": "Production / lifecycle activation",
|
||
"ownerAndRequiredClosure": "Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof",
|
||
"status": "NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration",
|
||
"gates": {
|
||
"phase9": "policy and destructive lifecycle outside functional proof",
|
||
"phase10": "no removal without approved lifecycle policy",
|
||
"production": "BLOCKED policy/restore/provider cleanup",
|
||
"debt": "open policy qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD25",
|
||
"aliases": [],
|
||
"criterion": "PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 33
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High identity/privacy/delivery impact",
|
||
"dependency": "Provider acceptance; production",
|
||
"ownerAndRequiredClosure": "Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof",
|
||
"status": "PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable",
|
||
"gates": {
|
||
"phase9": "sandbox/provider qualifications remain; fixtures do not pass them",
|
||
"phase10": "candidate must preserve auth/delivery contracts",
|
||
"production": "BLOCKED applicable real provider evidence",
|
||
"debt": "open provider qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD26",
|
||
"aliases": [],
|
||
"criterion": "Legacy Job/Application cutover OPEN",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 34
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High compatibility/data loss if removed",
|
||
"dependency": "Phase 10 deletion eligibility; production",
|
||
"ownerAndRequiredClosure": "Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal",
|
||
"status": "Legacy Job/Application cutover OPEN",
|
||
"gates": {
|
||
"phase9": "no legacy cutover authorized",
|
||
"phase10": "BLOCKED deletion until expand/verify/contract and all readers/writers",
|
||
"production": "BLOCKED unqualified cutover",
|
||
"debt": "open migration scope"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD27",
|
||
"aliases": [],
|
||
"criterion": "NOT TESTED: actual monitoring/alert/recovery coverage",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 35
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High operational detection risk",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Operations owner: effective sink, alert trigger, responder/runbook and recovery observations",
|
||
"status": "NOT TESTED: actual monitoring/alert/recovery coverage",
|
||
"gates": {
|
||
"phase9": "no independent veto of isolated functional QA",
|
||
"phase10": "candidate observability proof where affected",
|
||
"production": "BLOCKED actual alert/recovery",
|
||
"debt": "open operational qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "RD28",
|
||
"aliases": [],
|
||
"criterion": "Ongoing evidence/provenance obligation",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 36
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "High if failures are misrepresented",
|
||
"dependency": "Every decision",
|
||
"ownerAndRequiredClosure": "QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior",
|
||
"status": "Ongoing evidence/provenance obligation",
|
||
"gates": {
|
||
"phase9": "fresh exact evidence and source binding required",
|
||
"phase10": "required exact candidate evidence",
|
||
"production": "required exact deployment evidence",
|
||
"debt": "ongoing obligation"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-OPS-01",
|
||
"aliases": [],
|
||
"criterion": "Previously reported EXT4/Docker storage errors UNRECHECKED",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 37
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Critical if disk faults persist",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Production operator only: independent storage-health/repair and recovery qualification under separate authority",
|
||
"status": "Previously reported EXT4/Docker storage errors UNRECHECKED",
|
||
"gates": {
|
||
"phase9": "not a standalone functional defect; retain stated qualification",
|
||
"phase10": "no permission to delete; affected-candidate proof",
|
||
"production": "BLOCKED until stated operator closure",
|
||
"debt": "retained gate"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-SEC-01",
|
||
"aliases": [],
|
||
"criterion": "Live advisories NOT REFRESHED; inherited NuGet Pkcs high/moderate retained. Local dev-only GHSA-vfj7-8cjw-p6xm policy expires at2026-11-01 00:00UTC (after31October), verified in source23October",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 38
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
},
|
||
{
|
||
"kind": "current root-reported authorized advisory review; final raw ledger pending",
|
||
"detail": "Root-reported live audits: System.Security.Cryptography.Pkcs8.0.1 transitively via MimeKit4.17.0, high/moderate advisories fixed8.0.2 (exact identifiers/raw audit pending final root ledger); Next16.3.8 now has three critical advisories, existing Sharp0.35.5 SVG mitigation covers one only and UI is statically exported; dev-transitive Zod4.5.4 GHSA-mrhx-c7xc-m3w5 fixed4.6.6."
|
||
},
|
||
{
|
||
"kind": "current requalification observation, not a rewrite of inherited history",
|
||
"detail": "P9-REQUAL-SEC01–03 carry new stable IDs, original RED security-before-pins evidence and post-pin zero-findings audit paths; root will bind raw hashes in final validation."
|
||
},
|
||
{
|
||
"kind": "fresh Python risk observation",
|
||
"detail": "P9-REQUAL-SEC04 retains locked Python critical/high provider labels and incomplete query coverage; post-pin NuGet/npm zero audits do not establish blanket security PASS."
|
||
}
|
||
],
|
||
"severityAndImpact": "High dependency risk until assessed",
|
||
"dependency": "Production",
|
||
"ownerAndRequiredClosure": "Dependency owner: retain exact live audit paths/identifiers/severities and reachability analysis, minimally update compatible pins, run complete affected and full successors on frozen source, refresh raw advisories, retain actual residuals. Offline policy pass cannot clear live advisories or prove production repaired.",
|
||
"status": "Inherited advisory/review gate retained. Fresh live audit observations linked as P9-REQUAL-SEC01–03; compatible local pins and post-pin audits zero, full final-source successors pending. No production deployment or app-reachable exploit claimed. Fresh locked Python advisory finding P9-REQUAL-SEC04 is OPEN with INCOMPLETE coverage; no blanket security PASS.",
|
||
"gates": {
|
||
"phase9": "local dependency fixes and post-pin zero audits recorded; complete frozen successors pending",
|
||
"phase10": "testpass criterion pending final dependency source",
|
||
"production": "BLOCKED independent deployed versions, exposure and release gates; no production fix claimed",
|
||
"debt": "inherited live-advisory gate retained; three new observations independently tracked"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-PUB-01",
|
||
"aliases": [],
|
||
"criterion": "Initial HTTP502 blockage recovered on23October; all checkpoint ancestors published in normal push; direct feature equality verified at `0fb108bd673ea91749f6fa057295e5b6d15d557f`",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/RISKS.md",
|
||
"line": 39
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical assessment"
|
||
}
|
||
],
|
||
"severityAndImpact": "Resolved for published checkpoint; final commit still needs its own direct equality proof",
|
||
"dependency": "Final publication / handoff completeness",
|
||
"ownerAndRequiredClosure": "QA: retain failed attempts and verify each subsequent normal push; no force push",
|
||
"status": "Initial HTTP502 blockage recovered on23October; all checkpoint ancestors published in normal push; direct feature equality verified at `0fb108bd673ea91749f6fa057295e5b6d15d557f`",
|
||
"gates": {
|
||
"phase9": "not a standalone functional defect; retain stated qualification",
|
||
"phase10": "no permission to delete; affected-candidate proof",
|
||
"production": "BLOCKED until stated operator closure",
|
||
"debt": "retained gate"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-T01",
|
||
"criterion": "Medium test reliability: parser descendant test could time out before it had a descendant",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-T01"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "Entry sidecar 55 pass/1 fail (missing PID); isolated run passes; explicit slow startup reproduces the race. Fixture now waits for its child PID before the unchanged 200 ms deadline. Real process-tree kill and HTTP 504 assertions retained. Focused green and full 56/56 successor. No parser product change."
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium test reliability: parser descendant test could time out before it had a descendant",
|
||
"dependency": "Resolved in tested Windows environment; Linux run remains separate.",
|
||
"ownerAndRequiredClosure": "QA; `.artifacts/phase9/sidecar-entry-failed.*`, `sidecar-fixture-red.*`, `sidecar-fixture-green.*`, `sidecar.xml`",
|
||
"status": "RESOLVED within historical tested scope; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh affected regression required",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Resolved in tested Windows environment; Linux run remains separate."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-L01",
|
||
"criterion": "Low localisation defect: Admin grid vendor controls appear in English in Bokmål",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-L01"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "Sole DataGrid owner omitted localeText. New English desktop test passes while Bokmål fails to find “Rader per side:”. Reuse installed `nbNO` locale in AdminUsersPage. Focused 12/12 green; first integrated Jest919/104 and native desktop matrix green; final complete successors recorded in validation.json."
|
||
}
|
||
],
|
||
"severityAndImpact": "Low localisation defect: Admin grid vendor controls appear in English in Bokmål",
|
||
"dependency": "Resolved in observed local integration; no authorisation, pagination or data contract change.",
|
||
"ownerAndRequiredClosure": "Frontend; `admin-users-page.test.tsx`, `AdminUsersPage.tsx`; retained RED/GREEN logs/JSON",
|
||
"status": "RESOLVED within historical tested scope; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh affected regression required",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Resolved in observed local integration; no authorisation, pagination or data contract change."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-V01",
|
||
"criterion": "Medium visual defect: wrapped public h2 lines overlap at320px in EN/NB",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-V01"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "Four larger h2 owners inherited a fixed body line height. Original native geometry2/2 RED; explicit lineHeight1.4 now2/2 GREEN across16 width/theme/locale vectors; independent EN/light and NB/dark PNG inspection confirms separation. Intermediate1.2 still failed unchanged geometry assertions and was superseded."
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium visual defect: wrapped public h2 lines overlap at320px in EN/NB",
|
||
"dependency": "Bounded fix verified by native geometry/build; the complete final 362-case ordinary successor also passed.",
|
||
"ownerAndRequiredClosure": "Frontend; `LandingPage.tsx`, new `landing-presentation.spec.ts`; `landing-red`, `landing-qualified`, `landing-accepted` raw reports",
|
||
"status": "RESOLVED within historical tested scope; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh affected regression required",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Bounded fix verified by native geometry/build; the complete final 362-case ordinary successor also passed."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-V02",
|
||
"criterion": "Wrapped bottom CTA title must keep separate readable lines across EN/NB, themes and narrow widths",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"line": 51,
|
||
"anchor": "P9-V02"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical separate bottom CTA repair and complete 362-case ordinary successor",
|
||
"detail": "Existing bottom CTA owner inherited fixed body line height; explicit1.4 repair retains exact translated CTA plus all four h2s in both native landing cases. Both languages failed before and passed after. Original-width inspection of all four320px green images retained."
|
||
}
|
||
],
|
||
"severityAndImpact": "Medium visual defect: wrapped bottom CTA title lines overlapped",
|
||
"dependency": "LandingPage bottom CTA owner and landing-presentation.spec.ts; exact EN/NB, theme/width geometry and original image evidence",
|
||
"ownerAndRequiredClosure": "Frontend/QA: preserve existing LandingPage lineHeight1.4 and exact CTA+heading geometry assertions; qualify fresh complete landing and ordinary successors on frozen source, retain original RED/GREEN evidence and native-width images",
|
||
"status": "RESOLVED within historical tested scope; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh affected regression required",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "bounded CTA repair separate from P9-V01 four-h2 repair"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-L02",
|
||
"criterion": "Low linguistic residual: stored event type `Created` appears in Bokmål job history/audit",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-L02"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "Rendered route comparison detects18 occurrences across the matrix; raw stored metadata is not a missing translation key. Do not translate authored/provider content indiscriminately."
|
||
}
|
||
],
|
||
"severityAndImpact": "Low linguistic residual: stored event type `Created` appears in Bokmål job history/audit",
|
||
"dependency": "Retained nonblocking development qualification; no data mutation proposed.",
|
||
"ownerAndRequiredClosure": "UI/localisation owner; separately map known event enums with unknown-value fallback and history/audit tests; human wording review",
|
||
"status": "RETAINED low development debt",
|
||
"gates": {
|
||
"phase9": "nonblocking development debt with visible limit",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Retained nonblocking development qualification; no data mutation proposed."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-T02",
|
||
"criterion": "Low test compatibility: existing Admin pagination fixture hard-coded the English vendor accessible name in Bokmål mode",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-T02"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "First native shard97pass/1fail: no button named “Go to next page” in NB. The installed locale exposes “Gå til neste side”. Locator now uses installed enUS/nbNO pagination names; the six original width/locale/theme, long-identity, page-change, focus/reachability and no-write assertions remain. Focused 1/1 green; the final isolated 98-case shard and complete 362-case successor passed."
|
||
}
|
||
],
|
||
"severityAndImpact": "Low test compatibility: existing Admin pagination fixture hard-coded the English vendor accessible name in Bokmål mode",
|
||
"dependency": "Test-only repair; no product or authorisation change.",
|
||
"ownerAndRequiredClosure": "QA; `phase7-admin-users.spec.ts`; original shard report/trace and `admin-grid-green` retained. Other English-name callers belong to the separate English JobTable owner and remain unchanged.",
|
||
"status": "RESOLVED within historical tested scope; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh affected regression required",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Test-only repair; no product or authorisation change."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-PERF-01",
|
||
"criterion": "Low duplicate report work: shell and Dashboard each initially read reminders",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"anchor": "P9-PERF-01"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-06/DEFECTS.md",
|
||
"kind": "historical defect/reproduction/closure record",
|
||
"detail": "Phase 8 source/network diagnosis retained. Phase 9 request-count evidence must distinguish initial duplicate reads from additional reads during editing."
|
||
}
|
||
],
|
||
"severityAndImpact": "Low duplicate report work: shell and Dashboard each initially read reminders",
|
||
"dependency": "Accepted existing development debt; no Phase 10 implementation here.",
|
||
"ownerAndRequiredClosure": "Shared reminder read owner; measured benefit and independent shell/dashboard failure/loading tests before consolidation.",
|
||
"status": "RETAINED low development debt",
|
||
"gates": {
|
||
"phase9": "nonblocking development debt with visible limit",
|
||
"phase10": "candidate proof only; no cleanup authority",
|
||
"production": "does not clear independent release gates",
|
||
"debt": "Accepted existing development debt; no Phase 10 implementation here."
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-T03",
|
||
"criterion": "Provider-worker isolation must prevent server-originated NAV changes in preservation fixtures",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"anchor": "P9-T03"
|
||
},
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-00/worker-isolation-delta.json"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-07/FINAL_ACCEPTANCE.md",
|
||
"kind": "historical 87 pass/1 fail then full corrected successor"
|
||
}
|
||
],
|
||
"severityAndImpact": "High test isolation",
|
||
"dependency": "controlled native fixture; production worker unchanged",
|
||
"ownerAndRequiredClosure": "QA: retain failed run, unchanged no-write assertions, fixture config delta and fresh full successor",
|
||
"status": "RESOLVED historical fixture; fresh successor pending",
|
||
"gates": {
|
||
"phase9": "fresh exact fixture/case successor",
|
||
"phase10": "preserve isolation and assertions",
|
||
"production": "not enabled-worker acceptance",
|
||
"debt": "no product fix inferred"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-01",
|
||
"criterion": "With NVDA + supported desktop browser, traverse login, Jobs, job details, Career, CV editor, Documents and Settings using headings/landmarks/forms. Repeat equivalent VoiceOver/Safari journeys.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-01 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Names, roles, values, selected state, headings, reading order and errors are understandable; retain reader/version and spoken observations. No hidden background content is announced.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-02",
|
||
"criterion": "Keyboard-only: skip link → navigation → commands → add/edit dialogs → job sections → CV preview/history. Open/close the mobile drawer, confirmation, select and menu repeatedly, including after errors.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-02 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Visible focus, logical order, genuine traps only while modal, Escape and focus restoration; no off-screen/hidden tab stops. Record any transition-specific failure.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-03",
|
||
"criterion": "Dashboard: hide/show, Earlier/Later, size, Cancel, Reset-confirm/cancel, failed Save, stale conflict/reload, saved empty layout recovery. Listen with a reader.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-03 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Each action/position/save/error announces once and agrees with visible DOM order; pointer drag has an equivalent keyboard route.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-04",
|
||
"criterion": "Inspect P9-AX-02/03 backgrounds in light/dark, focused/hover/disabled, open native select, scrolled editor and fixed chrome. Measure actual foreground/background paint.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-04 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Applicable normal text ≥4.5:1, large text ≥3:1 and necessary UI boundaries/focus ≥3:1. Record sampled colors/ratios/state. An axe incomplete is not sufficient to close the row.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-05",
|
||
"criterion": "Inspect zero badges and both open/settled-closed drawer states with the accessibility tree and actual reader.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-05 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Invisible zero badge is absent from announcements; live unread count remains meaningful; closed drawer is neither read nor tabbable. Runtime DOM checks cover only the tested states.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-06",
|
||
"criterion": "Use actual browser 100/200/400% zoom and text-only enlargement, increased text spacing and forced colors across all significant forms, grid pagination, job sections and CV controls.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-06 / accessibility tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "High accessibility qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "accessibility tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Essential controls remain reachable/readable, no lost content or focus; distinguish intentional table/document scrollers from root clipping. Preserve fixed A4/Letter geometry.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-07",
|
||
"criterion": "On actual phone/tablet in portrait/landscape, edit long text with software keyboard, open drawers/dialogs/selects, reorder Dashboard and Board via supported alternatives, scroll CV preview and download PDF.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-07 / product owner with physical devices"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "Medium/High human/provider/output qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "product owner with physical devices",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "No keyboard-obscured primary action/data loss; reachable touch targets, no accidental destructive action; record device/input mode. Emulated touch does not close this.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-08",
|
||
"criterion": "Read registration/recovery, validation/errors, onboarding, Dashboard editing, Jobs/Board, Career/import, CV/library, documents/mail, notifications, Settings and Admin in Bokmål. Include long names, singular/plural, dates/numbers and accessible names.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-08 / Bokmål reviewer"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "Medium/High human/provider/output qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "Bokmål reviewer",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Natural professional Bokmål, consistent established terms, meaningful messages. Separate authored English content, technical names and provider strings from untranslated application copy.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-09",
|
||
"criterion": "Compare preview and downloaded one-/multi-page EN/NB CVs, long words, optional/photo sections and all supported templates on intended Linux/font environment and another supported browser; print representative PDFs.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-09 / document reviewer"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "Medium/High human/provider/output qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "document reviewer",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Legible fonts, intact glyphs/diacritics, margins, page boundaries, searchable text, photo/crop, correct language/date output and no missing/duplicated content. Retain original bytes, renderer/font versions and print observations.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "M09-10",
|
||
"criterion": "In authorised sandboxes test Google/Microsoft/Turnstile, verification/reset mail delivery, mailbox reconnect/revocation, uncertain send and actual calendar timezone/DST.",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/MANUAL_CHECKLIST.md",
|
||
"anchor": "M09-10 / approved provider tester"
|
||
}
|
||
],
|
||
"evidence": [],
|
||
"severityAndImpact": "Medium/High human/provider/output qualification",
|
||
"dependency": "Human qualified tester; exact build/environment and synthetic data; see MANUAL_ACCEPTANCE.md",
|
||
"owner": "approved provider tester",
|
||
"status": "NOT TESTED",
|
||
"requiredClosure": "Correlated origin/state, explicit confirmation, no accidental resend, correct ownership/timezone. Local SMTP/HTTP fixtures do not close external-provider qualification.",
|
||
"gates": {
|
||
"phase9": "explicit carry-forward qualification under REQUEST §6; no human result inferred",
|
||
"phase10": "affected functionality proof required; no deletion authority",
|
||
"production": "BLOCKED until applicable genuine human/provider evidence",
|
||
"debt": "open qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-AX-01",
|
||
"criterion": "aria-hidden-focus: drawer/focus",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/inherited-axe-triage.json",
|
||
"anchor": "P9-AX-01"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/README.md",
|
||
"kind": "historical finite scans and original inherited triage",
|
||
"occurrences": 1
|
||
}
|
||
],
|
||
"severityAndImpact": "Accessibility qualification; incomplete is not a confirmed violation",
|
||
"dependency": "M09-01/02/04/05 as applicable",
|
||
"owner": "Accessibility tester",
|
||
"status": "Requires manual inspection",
|
||
"requiredClosure": "Shared Dashboard drawer settled predicate, Escape focus and24Tab proof pass. Original Analytics transition cause is not proven; human reader/transition qualification remains.",
|
||
"gates": {
|
||
"phase9": "carry exact applicable manual qualification; no violation or human PASS inferred",
|
||
"phase10": "retain accessible functionality; affected-candidate proof required",
|
||
"production": "applicable manual evidence required",
|
||
"debt": "human qualification; do not count repeated occurrences as unique defects"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-AX-02",
|
||
"criterion": "color-contrast: dashboard size selector",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/inherited-axe-triage.json",
|
||
"anchor": "P9-AX-02"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/README.md",
|
||
"kind": "historical finite scans and original inherited triage",
|
||
"occurrences": 48
|
||
}
|
||
],
|
||
"severityAndImpact": "Accessibility qualification; incomplete is not a confirmed violation",
|
||
"dependency": "M09-01/02/04/05 as applicable",
|
||
"owner": "Accessibility tester",
|
||
"status": "Requires manual inspection",
|
||
"requiredClosure": "Contextual foreground/background measurement remains required.",
|
||
"gates": {
|
||
"phase9": "carry exact applicable manual qualification; no violation or human PASS inferred",
|
||
"phase10": "retain accessible functionality; affected-candidate proof required",
|
||
"production": "applicable manual evidence required",
|
||
"debt": "human qualification; do not count repeated occurrences as unique defects"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-AX-03",
|
||
"criterion": "color-contrast: text/control with obscured background",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/inherited-axe-triage.json",
|
||
"anchor": "P9-AX-03"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/README.md",
|
||
"kind": "historical finite scans and original inherited triage",
|
||
"occurrences": 5
|
||
}
|
||
],
|
||
"severityAndImpact": "Accessibility qualification; incomplete is not a confirmed violation",
|
||
"dependency": "M09-01/02/04/05 as applicable",
|
||
"owner": "Accessibility tester",
|
||
"status": "Requires manual inspection",
|
||
"requiredClosure": "Contextual foreground/background measurement remains required.",
|
||
"gates": {
|
||
"phase9": "carry exact applicable manual qualification; no violation or human PASS inferred",
|
||
"phase10": "retain accessible functionality; affected-candidate proof required",
|
||
"production": "applicable manual evidence required",
|
||
"debt": "human qualification; do not count repeated occurrences as unique defects"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-AX-04",
|
||
"criterion": "color-contrast: hidden badge",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/inherited-axe-triage.json",
|
||
"anchor": "P9-AX-04"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": "docs/redesign/phase-9/p9-03/README.md",
|
||
"kind": "historical finite scans and original inherited triage",
|
||
"occurrences": 10
|
||
}
|
||
],
|
||
"severityAndImpact": "Accessibility qualification; incomplete is not a confirmed violation",
|
||
"dependency": "M09-05 actual reader/positive count",
|
||
"owner": "Accessibility tester",
|
||
"status": "Not applicable in tested settled hidden state",
|
||
"requiredClosure": "Four current native EN/NB theme vectors: aria-hidden=true and zero area. Actual reader/live unread-state remains separate.",
|
||
"gates": {
|
||
"phase9": "carry exact applicable manual qualification; no violation or human PASS inferred",
|
||
"phase10": "retain accessible functionality; affected-candidate proof required",
|
||
"production": "historical zero-state not applicable; live reader state still open",
|
||
"debt": "human qualification; do not count repeated occurrences as unique defects"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-REQUAL-SEC01",
|
||
"reviewId": "P9-REQUAL-SEC01",
|
||
"criterion": "System.Security.Cryptography.Pkcs8.0.1 transitive lock via MimeKit4.17.0 contains published high/moderate advisories",
|
||
"source": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security-before-pins/",
|
||
"kind": "original RED live audit artifacts; exact report hashes owned by root validation ledger"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/nuget-advisories.log",
|
||
"kind": "actual post-pin audit; root verified, hashes pending final ledger"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/nuget-advisories.log",
|
||
"kind": "post-pin live NuGet audit: zero findings"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/frontend-audit.json",
|
||
"kind": "post-pin npm audit: zero vulnerabilities"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/npm-advisories.log",
|
||
"kind": "post-pin npm audit process log"
|
||
},
|
||
{
|
||
"kind": "root-reported post-pin checks",
|
||
"detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
|
||
}
|
||
],
|
||
"severityAndImpact": "High GHSA-846f-f764-76mx SignedCms CPU exhaustion; Moderate GHSA-2fmv-rv2c-59x7 Windows EnvelopedCms behavior. Vulnerable package presence established; application reachability/exploit not claimed.",
|
||
"dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
|
||
"ownerAndRequiredClosure": "Dependency/QA owner: Direct compatible package override System.Security.Cryptography.Pkcs8.0.2; retain MimeKit4.17.0 ownership. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
|
||
"status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
|
||
"gates": {
|
||
"phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
|
||
"phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
|
||
"production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
|
||
"debt": "published vulnerable package version repaired locally; remaining evidence qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-REQUAL-SEC02",
|
||
"reviewId": "P9-REQUAL-SEC02",
|
||
"criterion": "Next16.3.8 locked package now has three published critical advisories",
|
||
"source": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security-before-pins/",
|
||
"kind": "original RED live audit artifacts; exact report hashes owned by root validation ledger"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/frontend-audit.json",
|
||
"kind": "actual post-pin audit; root verified, hashes pending final ledger"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/nuget-advisories.log",
|
||
"kind": "post-pin live NuGet audit: zero findings"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/frontend-audit.json",
|
||
"kind": "post-pin npm audit: zero vulnerabilities"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/npm-advisories.log",
|
||
"kind": "post-pin npm audit process log"
|
||
},
|
||
{
|
||
"kind": "root-reported post-pin checks",
|
||
"detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
|
||
}
|
||
],
|
||
"severityAndImpact": "Critical package advisories GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r and GHSA-673q-mjm6-r5xr. Vulnerable package presence is distinct from reachable deployed paths; no application exploit claimed.",
|
||
"dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
|
||
"ownerAndRequiredClosure": "Dependency/QA owner: Pin Next and eslint-config-next exactly16.4.1. Existing static export, unoptimized images and Sharp0.35.5 mitigate the image-serving path; they do not close every package advisory. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
|
||
"status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
|
||
"gates": {
|
||
"phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
|
||
"phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
|
||
"production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
|
||
"debt": "published vulnerable package version repaired locally; remaining evidence qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-REQUAL-SEC03",
|
||
"reviewId": "P9-REQUAL-SEC03",
|
||
"criterion": "Dev-transitive Zod4.5.4 via eslint-plugin-react-hooks is within a vulnerable published range",
|
||
"source": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security-before-pins/",
|
||
"kind": "original RED live audit artifacts; exact report hashes owned by root validation ledger"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/npm-advisories.log",
|
||
"kind": "actual post-pin audit; root verified, hashes pending final ledger"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/nuget-advisories.log",
|
||
"kind": "post-pin live NuGet audit: zero findings"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/frontend-audit.json",
|
||
"kind": "post-pin npm audit: zero vulnerabilities"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/npm-advisories.log",
|
||
"kind": "post-pin npm audit process log"
|
||
},
|
||
{
|
||
"kind": "root-reported post-pin checks",
|
||
"detail": "Backend1123/1123, MariaDB32/32, build/types/lint pass. Frontend and full browser successors pending. Do not add repeated/focused counts or qualify final source with pre-pin frontend934."
|
||
}
|
||
],
|
||
"severityAndImpact": "High GHSA-mrhx-c7xc-m3w5 in development dependency graph. No production application reachability/exploit claimed.",
|
||
"dependency": "compatible locked dependency correction plus complete affected/frozen-source successor qualification",
|
||
"ownerAndRequiredClosure": "Dependency/QA owner: Use compatible existing ^4 dependency range via Zod4.6.6 override; do not add runtime functionality. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent.",
|
||
"status": "LOCALLY REMEDIATED; post-pin audits zero; complete final-source successor validation PENDING; production NOT DEPLOYED",
|
||
"gates": {
|
||
"phase9": "bounded dependency remediation observed locally; full frozen successor qualification pending",
|
||
"phase10": "testpass and functionality-inventory criteria still require final complete evidence; no cleanup authority",
|
||
"production": "NOT DEPLOYED; no deployed fix or app-reachable exploit claim; independent release gates retained",
|
||
"debt": "published vulnerable package version repaired locally; remaining evidence qualification"
|
||
}
|
||
},
|
||
{
|
||
"id": "P9-REQUAL-SEC04",
|
||
"reviewId": "P9-REQUAL-SEC04",
|
||
"criterion": "REQUEST §9 requires explicit review and disposition of live security/dependency risk; fresh locked Python sidecar advisory findings remain unclosed",
|
||
"source": [
|
||
{
|
||
"path": "docs/redesign/phase-9/REQUEST.md",
|
||
"anchor": "9. Security and privacy"
|
||
},
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/python-locked/",
|
||
"kind": "fresh exact locked Python provider query evidence; root/CI-owned tracked summary pending"
|
||
}
|
||
],
|
||
"evidence": [
|
||
{
|
||
"path": ".artifacts/p9-requal-01/security/python-locked/",
|
||
"kind": "root-reported fresh locked dependency queries",
|
||
"detail": "49 pins,98 provider queries,97 successful and1 PyPI404 for torch2.6.0+cpu; exact OSV lookup succeeds.249 provider records deduplicate into109 alias groups across8 packages:certifi,filelock,pillow,pypdf,setuptools,torch,transformers,urllib3. Critical/high among provider severity labels;109 alias groups are not109 independent CVEs. Exploitability/application reachability not assessed.",
|
||
"lockedFileSha256": "36f2912965d183e59f2d8320f3817ca8dd0fee6d76e05cfd63ac92defe6c6031"
|
||
},
|
||
{
|
||
"kind": "pending tracked evidence packaging",
|
||
"detail": "CI agent preparing python-advisories.json and PYTHON_SECURITY.md; exact paths/final report hashes owned by root/CI ledger. No completed tracked summary claimed by this register."
|
||
}
|
||
],
|
||
"severityAndImpact": "Critical/high provider-labelled advisories among locked packages; exploitability not assessed; coverage INCOMPLETE due one provider query404",
|
||
"dependency": "Security/sidecar review of exact locked versions, alias groups, applicability and provider query gap; separately validated scope for ML/parser dependency transition",
|
||
"ownerAndRequiredClosure": "Security/sidecar owners: preserve exact lock hash and raw provider records, resolve/document PyPI torch+cpu query gap while retaining successful exact OSV evidence, assess applicability/reachability and supported fixes, propose bounded separately validated ML/parser dependency transition with affected regression and model/parser compatibility evidence. No automatic dependency rewrite, model activation or production action.",
|
||
"status": "OPEN; locked Python advisory coverage INCOMPLETE; critical/high provider labels retained; exploitability NOT ASSESSED",
|
||
"gates": {
|
||
"phase9": "REQUEST §9 explicit security risk review required and NOT CLOSED; zero NuGet/npm findings cannot clear Python findings",
|
||
"phase10": "entry security uncertainty remains inherited and UNWAIVED; no cleanup authority",
|
||
"production": "RELEASE BLOCKER pending security/sidecar disposition and qualified remediation; no production fix/deployment claimed",
|
||
"debt": "open locked Python security findings and coverage gap; major ML/parser transition requires separate validated scope"
|
||
}
|
||
}
|
||
]
|
||
}
|