jobtrackingapp/docs/audits/2026-09-07/validation/evidence.md

Independent verification evidence

Application source baseline: 7d641edc7bca866ccf06012897ba1d107c07e59f, Windows/Europe-Paris, 2026-09-07. Existing .NET SDK under C:\Users\Connor\.dotnet, Node, UI dependencies and Playwright Chromium were used. Application code was not changed. The original audit's working-tree docs were already present and have been preserved.

Subsequent evidence, 2026-09-08: B01 implementation and regression results, with a separate test manifest. The original observations below and retained probes are unchanged historical reproductions. Re-running them against the B01 fix will no longer reproduce its mapped-address bypass.

B02 subsequent evidence, 2026-09-08: Account/session isolation completion, before/after observations and test manifest. The permanent regression reproduced the original 200/B-profile overwrite before application edits; it now returns 409 with both profiles unchanged. API ownership, frontend session disposal and legitimate same-account controls pass. Original probes and observations remain preserved.

B03 subsequent evidence, 2026-09-08: Shared PDF admission completion, before/after observations and test manifest. Before application edits, two real-exporter calls launched two held inert child processes. After the fix, authenticated multi-route traffic with limit two admitted two and rejected ten; actual concurrent renders never exceeded two, and later generation succeeded. Normal exceptions, cancellation and timeouts preserve capacity. All 17 browser tests pass, including real Chromium downloads. Failed intermediate fixture/browser runs and their diagnoses are recorded separately; original audit evidence is preserved. This is local admission proof, not R04 production sizing/containment evidence.

Fresh results and limits

B06 runtime follow-up, 2026-09-09: Report and operator handoff. Implementation complete; full runtime/production verification incomplete; F04 open. Fresh 166 focused backend, 3 Compose, 6 Production HTTP and 9 B04 HTTP checks pass. Public DNS/valid HTTPS are now observed; direct ports 3000/5202/8080 are unreachable from this workstation, without proof of the rejecting layer. HTTP redirects to unreachable HTTPS port 444. Docker's inference socket failure still blocks actual Compose/Traefik/nginx tests; production peers, backend client IP and host/provider firewall remain unverified. No SSH alias/user was found in permitted non-secret sources. B01–B05 preserved; B07 not started.

B06 retained observations and test manifest distinguish repository/API proof from unavailable container/production evidence. Original observations below are preserved.

B06 runtime follow-up: public/Docker/DNS observations, fresh tests and hashes, sanitized effective Compose and bounded public probe source. Public endpoint observations do not certify the internal proxy chain; no running local/container topology was obtained.

B05 subsequent evidence, 2026-09-09: CSV completion and policy, test manifest, before Excel observation and after Excel observations. Before edits, the permanent regression failed and actual Excel evaluated the exported =1+1 title to 2. Afterward it is literal apostrophe-prefixed text; every cell in the mixed fixture reports no formula, genuine decimals remain numeric and Norwegian text decodes correctly with the BOM. Twenty-five new backend cases, two frontend cases and one real HTTP/browser-download scenario pass. Broader 902 backend / 298 frontend / 18 browser tests, nine unchanged B04 HTTP scenarios and B03's unchanged admission probe pass; release builds/lint pass and existing R01a TS2571 remains. Historical observations below are preserved, including the original validation's absence of a spreadsheet-open test.

B04 subsequent evidence, 2026-09-08: Account rate-limit completion and policy inventory, before/after observations and test manifest. Before edits, real API exports produced A 200/200 and B 429/429 on the same IP. After authentication-before-limiting, both accounts retain two permits; sessions, auth transport, client IDs and B02 headers cannot select another owner. Nine permanent HTTP scenarios cover concurrent/shared-IP, invalid credentials and trusted/untrusted proxies. Original audit evidence remains unchanged below.

Check	Fresh result	Retained evidence / limit
Backend audit-focused subset	70 passed, no failures/skips	.artifacts/audit-validation/validation.trx; covers billing/deletion/CV/ownership/calendar/import/queue/backup/public CV/rate keys/startup schema.
Backend security/identity subset	79 passed, no failures/skips	.artifacts/audit-validation/security-validation.trx; disjoint from the 70-test set. Includes auth posture/session revocation/email ownership/job authorization/Pro entitlement/AI privacy/IMAP guards/local identity/migration chain.
Interview Jest suite	13 passed, one suite	.artifacts/audit-validation/interview-jest.json. Babel/Jest execution does not type-check the TypeScript program.
Standalone TypeScript	Failed: TS2571 at test line 120	Exact diagnostic in test manifest; no fix applied.
Independent HTTP/browser harness	Completed with observations; defects intentionally recorded	observations.json. Synthetic API on 5402 and UI on 3400; last retained run has no probe failure.
Independent .NET boundary harness	Completed with observations	boundary-results.json. Fake HTTP transport, real EF SQLite contexts, actual exporter with inert child processes, real hosted worker with a synthetic one-shot command fault.

The test manifest retains counts, timestamps and SHA-256 hashes of the local test outputs. Large TRX/SQL/API logs remain ignored under .artifacts; the stable observations are copied into this validation directory. They contain synthetic data only. The original full 753-backend/279-frontend/13-browser/37-parser results and production build remain separately attributed to the original verification. No claim that those full suites ran again is made.

The static UI export was built during the original audit against the same unchanged frontend source, with http://localhost:5402/api. The independent pass exercised that artifact and inspected the current source. It did not produce a new production-configured frontend build. The local export must not be used as a production release artifact; normal release configuration/build gates still apply.

Key observations

Probe	Observed	What it does not establish
Stale HTTP CV save	Revision 1 request accepted after a newer save; stale name persisted with 200.	Exhaustive job/profile mutation coverage.
Two preloaded SQLite contexts	Writer B wins, current revision 2, history [1,2,2].	MariaDB concurrency behavior or a safe duplicate-history migration.
Wrong-owner document access	Variant and preview 404; PDF request 404; versions 200 with [].	Every document endpoint/platform combination; no data is leaked by this empty list.
Two job creations, same header	Two different job IDs despite the same Idempotency-Key.	A promised API key contract, automatic client retry, or a reason to prohibit legitimate repeat applications.
CSV	Harmless arithmetic text exported unneutralized.	Spreadsheet command execution or exfiltration. No spreadsheet opened.
Account export rate	Account A 200/200, first B request 429 from the same IP.	All policies' deployed proxy/IP behavior.
Account switch	Actual sign-out/login in second tab; first tab saves A draft into B with 200; independent API confirms B changed/A unchanged.	Server-side direct-object-reference bypass. The cookie principal is B at save time.
Calendar controls	Non-UTC offsets lost after SQLite reload; UTC 07:00Z preserved; date-only becomes timed midnightZ.	Production timezone/provider configuration or a promised timed scheduling product.
Import address normalization	Ordinary private/link-local IPv4 blocked; mapped representations invoke the fake HTTP handler.	Real metadata/private-host access. The fake opens no socket.
PDF exporter	Three real exporter calls start three inert child processes before any is released.	Host exhaustion threshold, browser exploit or safe production renderer capacity.
AI worker, concurrency 1	One DB timeout faults worker and stops a real host.	HTTP endpoint behavior during a production DB outage.
AI worker, concurrency 2	One loop fails; host/combined task remain running during the observation window.	Long-term recovery. Source Task.WhenAll explains why the surviving indefinite loop masks completion.
Builder, loaded content	Light/dark contrast failures at desktop/mobile; scroll violation after mobile→desktop transition.	Full manual accessibility or every page/locale/zoom state.

For the scroll finding, the fresh offending element was a DIV, tabIndex=-1, overflow=auto, one preview page/iframe, scrollHeight=868; its client height was 860 at viewport height 1000 and 774 at height 900. This maps to the preview region with maxHeight: 86vh, not an arbitrary editor input. The test transition matters: initial desktop samples did not all reproduce it. The final fresh run covers EN, light/dark, 1440×1000, 1440×900 and 375×900. Bokmål evidence in the original audit remains historical; the independent pass did not repeat a full EN/NB matrix.

Reproduction commands

Use a development checkout and existing local dependencies. These commands do not authorize external dependency downloads, production operations or modifications to a user's existing database. The HTTP/browser fixture refuses an already-answering test port; it creates a unique temp data root, starts only its own child services, and stops its own process trees in finally. It does not delete existing development data. Do not run the original and independent browser harnesses concurrently because both use 5402/3400.

Repository root, PowerShell:

& C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --filter 'FullyQualifiedName~BillingControllerTests|FullyQualifiedName~AccountDeletionTests|FullyQualifiedName~CvBuilderTests|FullyQualifiedName~OwnershipGuardTests|FullyQualifiedName~ApplicationCalendarControllerTests|FullyQualifiedName~JobImportServiceTests|FullyQualifiedName~AiOperationQueueTests|FullyQualifiedName~DatabaseBackupRunnerTests|FullyQualifiedName~PublicCvControllerTests|FullyQualifiedName~RateLimitPartitionKeysTests|FullyQualifiedName~StartupSchemaOwnershipTests' --logger 'trx;LogFileName=validation.trx' --results-directory .artifacts/audit-validation -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1

& C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore --filter 'FullyQualifiedName~ApiAuthorizationPostureTests|FullyQualifiedName~AuthSessionRevocationTests|FullyQualifiedName~EmailOwnershipIntegrationTests|FullyQualifiedName~JobApplicationsAuthorizationTests|FullyQualifiedName~ProEntitlementAuthorizationTests|FullyQualifiedName~AiPrivacyPolicyTests|FullyQualifiedName~ImapServiceSsrfGuardTests|FullyQualifiedName~LocalAuthIdentityTests|FullyQualifiedName~MigrationChainTests' --logger 'trx;LogFileName=security-validation.trx' --results-directory .artifacts/audit-validation -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1

node docs/audits/2026-09-07/validation/probes.mjs

UI directory, PowerShell:

node node_modules/typescript/bin/tsc --noEmit --pretty false
node node_modules/jest/bin/jest.js src/interview-prep.test.tsx --runInBand --watchAll=false --json --outputFile=../.artifacts/audit-validation/interview-jest.json

The retained C# probe is built through an ignored scratch project, so it is not part of the application/test product build. The project template uses paths relative to the scratch directory below. Restore used only the existing package cache and an empty local source, with NuGet advisory network lookup disabled; no new package was downloaded. From the root:

New-Item -ItemType Directory -Force .artifacts/audit-validation/probe | Out-Null
New-Item -ItemType Directory -Force .artifacts/audit-validation/empty-feed | Out-Null
Copy-Item -LiteralPath docs/audits/2026-09-07/validation/probe-project.xml -Destination .artifacts/audit-validation/probe/Probe.csproj
& C:/Users/Connor/.dotnet/dotnet.exe restore .artifacts/audit-validation/probe/Probe.csproj --source .artifacts/audit-validation/empty-feed --ignore-failed-sources -p:NuGetAudit=false
& C:/Users/Connor/.dotnet/dotnet.exe run --project .artifacts/audit-validation/probe/Probe.csproj --configuration Release --no-restore

If packages or the intended local UI artifact are missing, stop and report the missing prerequisite instead of connecting to external services. This harness is tailored to the recorded Windows workspace/runtime, not a portable CI runner. The fake PDF subprocess uses the compiled probe apphost; it writes a synthetic %PDF marker solely so the actual exporter completes its lifecycle. It renders no HTML, launches no Chromium, and does not validate PDF format/layout.

Probe development corrections

Earlier probe iterations had fixture errors: a wrong profile route, a worker test owner scope that was not neutral, and a transient iframe document body accessed before it existed. Those were corrected in the validation probes only and are not product findings. The browser matrix was expanded to check loaded preview content, viewport changes and the actual overflowing region. Only the final successful observations are retained as evidence. Repeated fixture runs are not a flake-rate measurement or repeated independent production certification.

Boundaries still open

• Production proxy/firewall/IP evidence, environment inputs, container privileges/resources and current host/secrets controls.
• A coordinated restored recovery set, off-site custody, provider-token/key recovery, previous-image schema compatibility and measured operator recovery time.
• Stripe sandbox purchase/entitlement/deletion, live email/OAuth/provider behavior and enabled AI quality/failure behavior.
• MariaDB reproductions of the new revision/timezone probes; existing SQLite/test coverage cannot certify provider equivalence.
• Full keyboard/screen-reader/forced-color/reflow/mobile accessibility and loaded Bokmål coverage.
• Current dependency advisories/licenses/runtime support and Git-history/runtime-secret review. No internet lookup or external service call was performed.

These are named missing proofs. Do not convert them into invented incidents, and do not close them with a source-only assertion.