Files
jobtrackingapp/docs/audits/2026-09-07/validation/evidence/b03-test-results.json
T
cesnimda 0954876295 fix(security): enforce audited account, network and resource boundaries
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00

208 lines
9.4 KiB
JSON

{
"ticket": "B03",
"completedDate": "2026-09-08",
"baselineCommit": "7d641edc7bca866ccf06012897ba1d107c07e59f",
"environment": "Windows, existing .NET 9 SDK and UI dependencies; synthetic local SQLite/API/browser fixtures, external providers disabled",
"status": "Complete locally; not deployed. B01/B02 preserved; B04 not started.",
"acceptance": "All four expensive PDF routes use one shared admission pool; bounded actual process launches, safe rejection, repeated exception/cancellation/timeout recovery and configuration validation proven.",
"regressionsAdded": {
"backendCases": 22,
"frontendCases": 2,
"authenticatedMultiRouteApiScenarios": 1,
"existingAccountSwitchTest": "Wait for B02 final redirect before a new navigation; application B02 behavior unchanged."
},
"countsOverlap": true,
"runs": [
{
"path": ".artifacts/b03/before.trx",
"sha256": "5317581B7BCF11D1D102AE59CACC211B8E5514DA2DB4AA14D4ABF08B3535123C",
"total": 1,
"passed": 0,
"failed": 1,
"skipped": 0,
"phase": "Before application edits: expected failure reproduces unrestricted launches",
"observation": "Two simultaneous calls through the actual exporter started two held inert child processes; safe assertion failed."
},
{
"path": ".artifacts/b03/focused-verified.trx",
"sha256": "3812F700D223CEC9F6CF7B38CBA16220BC34BFCA07C19BCA17BA5FCAE3F2B714",
"total": 23,
"passed": 23,
"failed": 0,
"skipped": 0,
"phase": "Final focused PDF/admission and existing retention tests"
},
{
"path": ".artifacts/b03/affected.trx",
"sha256": "23943DA4A80D623B6F6DC3F8BFE86FA922C3C670E9A4689F63AAA163813E9E4A",
"total": 208,
"passed": 208,
"failed": 0,
"skipped": 0,
"phase": "Affected backend before the last logging-fault test; superseded by final full backend"
},
{
"path": ".artifacts/b03/backend-verified.trx",
"sha256": "4E4D66EECA8D305923EF9D6198F0B7CACF6A68A7B29BBE076B6277ACCE416289",
"total": 875,
"passed": 875,
"failed": 0,
"skipped": 0,
"phase": "Final broader backend, including all B01/B02/B03 tests",
"excluded": [
"JobTrackerApi.Tests.ImapServiceSsrfGuardTests.ConnectAsync_rejects_unresolvable_host_without_leaking_dns_detail"
],
"exclusionReason": "Existing test performs real external DNS; external access not authorized."
},
{
"path": ".artifacts/b03/frontend-focused.json",
"sha256": "FB2D9A9A76DB165EA9765CDDBCC40799F2A6EB6DE3C6B97BA192CC99DEC23A36",
"suites": 5,
"total": 37,
"passed": 37,
"failed": 0,
"skipped": 0,
"phase": "Focused frontend"
},
{
"path": ".artifacts/b03/frontend.json",
"sha256": "2C7580F8E82F9CFC516B35044BAB452C35F57F389CF0A5377A5876CA7CF37EDD",
"suites": 66,
"total": 296,
"passed": 296,
"failed": 0,
"skipped": 0,
"phase": "Full frontend"
},
{
"path": ".artifacts/b03/adversarial.json",
"sha256": "4D7CCD07EB6195D2AE9C6D12DEFEAC2DB3BA45BA7229AE237D0ACEA769560D80",
"passed": 0,
"failed": 1,
"skipped": 0,
"flaky": 0,
"durationMs": 13734.423999999999,
"startedAt": "2026-09-08T10:46:39.267Z",
"phase": "Initial HTTP fixture run: failed control-directory setup",
"diagnosis": "Runner and worker initially created different stub control directories; corrected test configuration to inherit one directory."
},
{
"path": ".artifacts/b03/adversarial-verified.json",
"sha256": "A43BE3B32215073A25B72A466B37B48A6765B74F10FDF50103B948FC2E2AB26D",
"passed": 1,
"failed": 0,
"skipped": 0,
"flaky": 0,
"durationMs": 17724.545,
"startedAt": "2026-09-08T16:12:27.545Z",
"phase": "Final authenticated multi-route API adversarial regression",
"observations": {
"configured": 2,
"admittedDuringBurst": 2,
"rejected": 10,
"queued": 0,
"maximumActualRenders": 2,
"busyStatus": 503,
"retryAfterSeconds": 3,
"recoveryStatus": 200
}
},
{
"path": ".artifacts/b03/browser.json",
"sha256": "9B334B702DCCF8C5DFAAE7252CC4901558D44223BD5A56EA925379EA6CEF98FF",
"passed": 12,
"failed": 5,
"skipped": 0,
"flaky": 0,
"durationMs": 317668.186,
"startedAt": "2026-09-08T10:53:22.552Z",
"phase": "Initial browser development-server run",
"diagnosis": "Two real PDF timeouts from an introduced explicit Chromium user-data-dir argument, two navigation timeouts and transient API-status-chip axe contrast failures. Superseded by final passing static run."
},
{
"path": ".artifacts/b03/real-pdf-diagnostic.json",
"sha256": "19119A7C91E822F0F66E7FAEE6554EBE73795A75CBE26656E435F90795E9E8E9",
"passed": 0,
"failed": 2,
"skipped": 0,
"flaky": 0,
"durationMs": 178063.123,
"startedAt": "2026-09-08T15:50:26.573Z",
"phase": "Real Chromium diagnostic run",
"diagnosis": "Both PDFs reached the 60-second render timeout. Local CLI control isolated added user-data-dir argument; removed it to preserve original browser invocation."
},
{
"path": ".artifacts/b03/browser-final.json",
"sha256": "4511D084489B4CC857243439E711ABB99F5E4A221B6CB5B3ADB6440A1B6D6F55",
"passed": 15,
"failed": 2,
"skipped": 0,
"flaky": 0,
"durationMs": 142642.293,
"startedAt": "2026-09-08T16:01:38.189Z",
"phase": "First full static-browser run after CLI correction",
"diagnosis": "Account-switch fixture raced B02's final redirect (test wait corrected); separate Code-PDF setup hit existing SQLite Error 5 database is locked in profile/Identity projection before rendering. No database or accessibility changes."
},
{
"path": ".artifacts/b03/browser-verified.json",
"sha256": "A78EB7BB65180AE3427AF692E15E879426A70B7F2F3EBB806DCCF9CAFCB043DF",
"passed": 17,
"failed": 0,
"skipped": 0,
"flaky": 0,
"durationMs": 88765.154,
"startedAt": "2026-09-08T16:05:45.871Z",
"phase": "Final full static browser suite",
"notes": "All 17 pass with no retries/flaky outcomes. Real public and Code PDF renders approximately 1.3/1.4 seconds. This does not prove the existing SQLite projection race resolved."
},
{
"path": ".artifacts/b03/backend-build-verified.log",
"sha256": "640B718E87F7E6E02AEEAE33E00F058751F0C10F66202BFE3BF47B6BB9504402",
"phase": "Final Release warnings-as-errors build",
"exitCode": 0,
"warnings": 0,
"errors": 0
},
{
"path": ".artifacts/b03/frontend-build.log",
"sha256": "635DC750AFBC06B2E936C0F21B5B5406F875B47F7DC3DCA38819B0D552C7ADA1",
"phase": "Next production build",
"exitCode": 0
},
{
"path": ".artifacts/b03/typecheck.log",
"sha256": "2F9960647ABADEFD054152A9566E4E6557A55383E98627AED742B93EDEBB16DD",
"phase": "Standalone TypeScript",
"exitCode": 2,
"diagnostic": "src/interview-prep.test.tsx(120,10): error TS2571: Object is of type 'unknown'.",
"classification": "Pre-existing R01a; no new diagnostic or suppression."
},
{
"path": ".artifacts/b03/lint-verified.log",
"sha256": "33237F0AC9684ACA5331E14FA4337EFC24C4C03D39E589FD0FBCA54F627A9483",
"phase": "Final targeted lint, including account-switch test wait",
"exitCode": 0,
"notes": "Existing Browserslist stale-data advisory; no lint warnings/errors."
},
{
"phase": "Final git diff --check",
"path": ".artifacts/b03/diff-check.log",
"sha256": "C274B72A1428ACB647E415C5582D003F75341E912BA5832D478B8964228C623C",
"exitCode": 0,
"notes": "Repository line-ending normalization retained. Additional explicit trailing-whitespace check passed for 13 new/previously untracked B03 and documentation files."
}
],
"finalSourceTiming": "Last logging-fault refinement covered by final full backend, focused PDF and authenticated API runs. No frontend or browser invocation changes after final passing frontend/browser suites.",
"residualLimitations": [
"Process-local; N rendering instances allow N times configured active renders. Owner allowance is also process-local.",
"R04 still required for production memory/CPU/PID sizing, process-tree containment, browser sandbox and forced-kill Chromium profile cleanup.",
"No FIFO queue or time-window abuse quota; zero waiting. Public requests account to document owner and may occupy multiple owners' allowances, subject to the global limit.",
"Upstream AI/HTML/DB preparation and arbitrary single-document memory/output size are outside render admission.",
"Unconfirmed process termination disables all new renders; operator must inspect/stop remnants before restart.",
"Existing standalone TypeScript R01a failure and observed SQLite profile-projection fixture race remain outside B03.",
"Local browser static export targets localhost:5302 and is not a production deployment artifact."
],
"evidenceRetention": "Original audit/probes retained. Raw local TRX/JSON/logs are ignored under .artifacts/b03; hashes and compact synthetic observations are retained here. Permanent tests are the current executable regression boundary.",
"recommendedNextTicket": "B04 Resolve principal before owner limiting; requires separate user instruction."
}