jobtrackingapp/docs/redesign/phase-9/p9-sec-02/FINDINGS.md

# P9-SEC-02 finding register

All inherited criteria, sources, evidence, severity, dependencies, owners and closure requirements remain in [findings.json](findings.json). Separate gates are retained; one finding may affect several gates. Manual/provider/production facts remain untested.

| ID | Current disposition | Owner / required closure |
| --- | --- | --- |
| RD01 | OPEN; local static/loopback ingress contracts only | Release operator: actual TLS/IPv6/firewall/topology/trusted peer and deployed auth evidence |
| RD02 | NOT TESTED: independently verified off-disk complete backup/restore | Release operator: isolated restore of DB/files/CVs/keys/tombstones, hashes and recovery rehearsal |
| RD03 | Current actual MariaDB lane and bounded sustained-workload results are in validation.json. Runtime/provider scope only; no hosted execution, capacity SLA, production migration or restart claim. | Database owner: actual approved MariaDB migration, restart, CRUD/constraints/concurrency and effective configuration proof |
| RD04 | NOT TESTED: intended Linux rollback | Release operator: isolated failure/rollback rehearsal using complete prior images/configuration/recovery set |
| RD05 | BLOCKED: dedicated label queued/unassigned in observed metadata; effective current runner isolation/lifecycle unverified;0 hosted MariaDB cases. | CI/operator owner: prove isolated private service execution and lifecycle without host socket/privileges/public ports/production coupling, then successful exact hosted TRX and cleanup. Keep workflow BLOCKED while isolation cannot be proven. Separate deployed runner/storage/release identity remains unqualified. |
| RD06 | PARTIAL: finite axe/DOM/keyboard evidence; human checks open | Accessibility tester: [M09-01–06](../p9-03/MANUAL_CHECKLIST.md), contextual contrast/reader evidence; triage every applicable incomplete |
| RD07 | NOT TESTED: physical input/AT/alternate browsers/forced colors | Product/accessibility owners: actual supported devices/browser/input versions and complete workflows |
| RD08 | DEFERRED; no new model qualification or activation | Separate AI qualification owner: production-equivalent identity/inference, original 366-call protocol, independent human semantics, review UI/integration evidence |
| RD09 | Local withheld-operation contract retained; deployed withholding NOT TESTED | Release/AI owners: keep 503/no-provider/no-write guards, verify actual deployment independently |
| RD10 | PASS within current original Linux24 and supplemental2 scope; Windows results separate; no physical-print/human qualification. | Document owner: intended Linux/fonts/photo/crop/print and alternate-browser proof, original bytes/geometry |
| RD11 | Scoped SQLite bootstrap/WAL mechanism repaired before entry; broad reliability remains PARTIAL | Database owner: retain held-reader/write proof, distinguish old reproduced mechanism from unproven provider/contention cases |
| RD12 | PARTIAL: notification draft/failure recovery and SQLite tests; complete contention/provider behavior unqualified | Database/settings owners: intended-provider overlapping writes and failure/reload recovery with no data loss |
| RD13 | Historical Rules 500 mechanism remains UNCONFIRMED | Rules/API owners: original failure trace plus controlled causal reproduction and successor regression; passing retry alone insufficient |
| RD14 | Historical command/dialog focus incident remains UNCONFIRMED; settled drawer proof is a separate finite result | Shared UI owner: preserve original observations, reproduce affected modal transitions and actual reader/trap/return behavior |
| RD15 | Historical intermittent CV section expansion cause unproven | CV owner: retain failed observation and reproduce causally before closing; do not weaken expansion assertions |
| RD16 | Scoped company-error repair retained; wider reader/dialog/date contract PARTIAL | Company/UI owners: native failed-save → retained draft → successful retry plus human dialogue checks |
| RD17 | Current actual MariaDB lane and bounded sustained-workload results are in validation.json. Runtime/provider scope only; no hosted execution, capacity SLA, production migration or restart claim. | Jobs owner: agreed budget, bounded sustained profile and CPU/frame attribution before optimization; preserve full membership |
| RD18 | NOT TESTED: physical drag/drop/cancel/browser variants | Input/device tester: real Board/CV selection and named alternatives, no hidden result cap |
| RD19 | DEFERRED: reviewed `followMode` consumer | Product/mail owner: separate explicit mode→review/action/fallback design; no auto-send or uncertain resend |
| RD20 | Optional P5-05 quick preview DEFERRED; Phase 8 Dashboard scope was delivered separately | Product owner: explicit separate brief; retain existing full workspace and all routes |
| RD21 | RESOLVED within original tested save/concurrency scope; current backend/MariaDB/recovery companions in validation.json; creation idempotency is separate. | Domain/API/UI owners: separate bounded contract issue covering both callers, server compare-and-swap/transaction semantics, conflict recovery and backward compatibility; characterization is not safety acceptance |
| RD22 | NOT TESTED: enabled-worker outage recovery/durability | Worker owner: isolated enabled-producer failure/restart/recovery, no-loss/no-duplicate proof before activation |
| RD23 | OPEN: actual calendar offset/DST/date-only semantics | Calendar owner: dedicated boundary/DST/provider proof in authorised sandbox before semantic changes |
| RD24 | NOT TESTED: billing/deletion/retention/provider cleanup policy and configuration | Product/security/operator owners: approved policy, explicit destructive-action authority, isolated recovery/cleanup proof |
| RD25 | PARTIAL: local SMTP/HTTP/provider contracts; actual OAuth/Turnstile/mail/calendar/model unavailable | Approved provider/human tester: sandbox consent/revoke/reconnect/origin/state/delivery/uncertain-attempt proof |
| RD26 | Legacy Job/Application cutover OPEN | Migration owner: expand/verify/contract, restore/rollback and all readers/writers/aliases before removal |
| RD27 | NOT TESTED: actual monitoring/alert/recovery coverage | Operations owner: effective sink, alert trigger, responder/runbook and recovery observations |
| RD28 | Ongoing evidence/provenance obligation | QA owner: exact source hashes/counts, original failures, no retries/skips/assertion relaxation; separate characterization from safe behavior |
| P9-OPS-01 | Previously reported EXT4/Docker storage errors UNRECHECKED | Production operator only: independent storage-health/repair and recovery qualification under separate authority |
| P9-SEC-01 | CONDITIONAL PASS: original109 dispositions99 fixed/version-verified and10 scoped not affected; separate pytest advisory fixed; actual model and final scan evidence in current package. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
| P9-PUB-01 | Normal checkpoint pushes22ef8d0/30e251a verified. Final evidence commit/remote/clean-tree/main receipt required and recorded in publication ledger/final delivery; no force push or merge. | QA: retain failed attempts and verify each subsequent normal push; no force push |
| P9-T01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | QA; `.artifacts/phase9/sidecar-entry-failed.*`, `sidecar-fixture-red.*`, `sidecar-fixture-green.*`, `sidecar.xml` |
| P9-L01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Frontend; `admin-users-page.test.tsx`, `AdminUsersPage.tsx`; retained RED/GREEN logs/JSON |
| P9-V01 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Frontend; `LandingPage.tsx`, new `landing-presentation.spec.ts`; `landing-red`, `landing-qualified`, `landing-accepted` raw reports |
| P9-V02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | Frontend/QA: preserve existing LandingPage lineHeight1.4 and exact CTA+heading geometry assertions; qualify fresh complete landing and ordinary successors on frozen source, retain original RED/GREEN evidence and native-width images |
| P9-L02 | RETAINED low development debt | UI/localisation owner; separately map known event enums with unknown-value fallback and history/audit tests; human wording review |
| P9-T02 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | QA; `phase7-admin-users.spec.ts`; original shard report/trace and `admin-grid-green` retained. Other English-name callers belong to the separate English JobTable owner and remain unchanged. |
| P9-PERF-01 | RETAINED low development debt | Shared reminder read owner; measured benefit and independent shell/dashboard failure/loading tests before consolidation. |
| P9-T03 | RESOLVED within mapped automated scope; fresh complete regression PASS; manual qualifications unchanged. | QA: retain failed run, unchanged no-write assertions, fixture config delta and fresh full successor |
| M09-01 | NOT TESTED | accessibility tester: Names, roles, values, selected state, headings, reading order and errors are understandable; retain reader/version and spoken observations. No hidden background content is announced. |
| M09-02 | NOT TESTED | accessibility tester: Visible focus, logical order, genuine traps only while modal, Escape and focus restoration; no off-screen/hidden tab stops. Record any transition-specific failure. |
| M09-03 | NOT TESTED | accessibility tester: Each action/position/save/error announces once and agrees with visible DOM order; pointer drag has an equivalent keyboard route. |
| M09-04 | NOT TESTED | accessibility tester: Applicable normal text ≥4.5:1, large text ≥3:1 and necessary UI boundaries/focus ≥3:1. Record sampled colors/ratios/state. An axe incomplete is not sufficient to close the row. |
| M09-05 | NOT TESTED | accessibility tester: Invisible zero badge is absent from announcements; live unread count remains meaningful; closed drawer is neither read nor tabbable. Runtime DOM checks cover only the tested states. |
| M09-06 | NOT TESTED | accessibility tester: Essential controls remain reachable/readable, no lost content or focus; distinguish intentional table/document scrollers from root clipping. Preserve fixed A4/Letter geometry. |
| M09-07 | NOT TESTED | product owner with physical devices: No keyboard-obscured primary action/data loss; reachable touch targets, no accidental destructive action; record device/input mode. Emulated touch does not close this. |
| M09-08 | NOT TESTED | Bokmål reviewer: Natural professional Bokmål, consistent established terms, meaningful messages. Separate authored English content, technical names and provider strings from untranslated application copy. |
| M09-09 | NOT TESTED | document reviewer: Legible fonts, intact glyphs/diacritics, margins, page boundaries, searchable text, photo/crop, correct language/date output and no missing/duplicated content. Retain original bytes, renderer/font versions and print observations. |
| M09-10 | NOT TESTED | approved provider tester: Correlated origin/state, explicit confirmation, no accidental resend, correct ownership/timezone. Local SMTP/HTTP fixtures do not close external-provider qualification. |
| P9-AX-01 | Requires manual inspection | Accessibility tester: Shared Dashboard drawer settled predicate, Escape focus and24Tab proof pass. Original Analytics transition cause is not proven; human reader/transition qualification remains. |
| P9-AX-02 | Requires manual inspection | Accessibility tester: Contextual foreground/background measurement remains required. |
| P9-AX-03 | Requires manual inspection | Accessibility tester: Contextual foreground/background measurement remains required. |
| P9-AX-04 | Not applicable in tested settled hidden state | Accessibility tester: Four current native EN/NB theme vectors: aria-hidden=true and zero area. Actual reader/live unread-state remains separate. |
| P9-REQUAL-SEC01 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | Dependency/QA owner: Direct compatible package override System.Security.Cryptography.Pkcs8.0.2; retain MimeKit4.17.0 ownership. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC02 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | Dependency/QA owner: Pin Next and eslint-config-next exactly16.4.1. Existing static export, unoptimized images and Sharp0.35.5 mitigate the image-serving path; they do not close every package advisory. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC03 | LOCALLY REMEDIATED; post-pin audits zero and complete affected frozen-source successors PASS; production NOT DEPLOYED. | Dependency/QA owner: Use compatible existing ^4 dependency range via Zod4.6.6 override; do not add runtime functionality. Retain before/after advisory paths, raw hashes and exact lock/pin delta; complete frontend/browser and required full successors, then bind all reports to final source. Production deployed dependencies/exposure remain independent. |
| P9-REQUAL-SEC04 | CONDITIONAL PASS: original109 dispositions99 fixed/version-verified and10 scoped not affected; separate pytest advisory fixed; actual model and final scan evidence in current package. | Security/sidecar owners: complete narrowly scoped filelock cache/protocol compatibility work, select a patched compatible CPU Torch/Transformers graph, verify immutable model/checkpoint identities and startup/inference/extraction contracts in an approved environment; serious residual risk requires explicit owner disposition. No automatic waiver, model change/download or production action. |
| P9-REQUAL-DB01 | LOCALLY REPAIRED at2b26953; three real RED/GREEN cases, full35 MariaDB/1123 backend and complete successor browser/workload PASS. | API DocumentsIndexService owner: narrow read-only projection fix, actual MariaDB regression including tenant/search/data preservation, fresh affected full successors |
| P9-REQUAL-PDF01 | PASS within current original Linux24 and supplemental2 scope; Windows results separate; no physical-print/human qualification. | Document/QA owners: bind final frozen-source Linux and Windows24-fixture results to unchanged oracle/content/geometry checks, review intentional portable font replacement and retained historical bytes; human/physical printing remains M09-09, not automated closure. |
| P9-REMED-PTR01 | RESOLVED within tested scope: focused unitRED/46GREEN and native6GREEN retained; final complete935 frontend/362 ordinary browser PASS with no retries/skips. Source review found no remaining Important issue. | Frontend/QA owners: retain direct-region focus scrolling/mobile-pane selection while preventing descendant-control target movement; bind unit46/46 plus held-pointer4/4 and stale-draft/admin6/6 focused proof to final935 frontend/362 browser successors. No blanket timeout increase or assertion weakening. |
| P9-SEC02-MODEL | PASS | Development QA/security owner: actual pinned trained-model and smaller-format/cache/OCR evidence |
| P9-SEC02-PYTEST | Fixed and verified at pytest9.0.3;59-case actual Linux suite and final scan separately recorded | Development owner: maintain exact test lock and compatible test layer |
| P9-SEC02-CLEANUP | Independent review Important fixed; negative/timeout guards and actual model successors verify positive absence | QA harness owner: keep unknown cleanup as failure and preserve bounded ownership checks |
| P9-SEC02-OAUTH | Successor PASS with original88-case shard retained | Browser QA owner: retain source/origin/owner/read-count assertions and actual destination/disposal prerequisite |

A: Phase9 mandatory local functional/security criteria are evaluated in verdicts.json. B: CV-UX needs its own issue/scope/entry decision. C: Phase10 needs candidate-specific unused-code/route/test/inventory proof. D: production alone retains live recovery/security/deployed/provider/human gates. E: duplicate reminder reads, creation-intent idempotency and optional deferred work remain visible in their inherited records; none is silently folded into RD21 closure.