jobtrackingapp/docs/audits/verification-log.md

# JobTracker verification log

Audit date: 2026-08-02

Only non-destructive commands are run. Commands that restore dependencies may populate local caches or existing build-output directories but do not modify declared dependencies or application source.

| ID | Exact command | Directory | Purpose | Result | Relevant errors or warnings | Failure classification |
|---|---|---|---|---|---|---|
| V-001 | `dotnet --info` | Repository root | Capture .NET toolchain | PASS — SDK 10.0.201; SDK 9.0.200 also installed; target runtime 9.0.2 present | No `global.json`; normal builds therefore selected SDK 10 | N/A |
| V-002 | `node --version; npm --version` | Repository root | Capture frontend toolchain | PASS — Node 22.23.1, npm 10.9.8 | CI/container use Node 20 | N/A |
| V-003 | `python --version; tools\\summarizer\\.venv\\Scripts\\python.exe --version` | Repository root | Capture Python toolchain | PASS — Python 3.12.3 for both | Docker uses floating `python:3.11` | N/A |
| V-004 | `docker version --format '{{.Client.Version}} client / {{.Server.Version}} server'; docker compose version` | Repository root | Capture container tooling | PASS — Docker 29.6.1; Compose 5.2.0 | None | N/A |
| V-005 | `dotnet restore "Job tracker.sln"` | Repository root | Restore declared NuGet dependencies | PASS — all projects up to date | Package cache/`obj` may be refreshed | N/A |
| V-006 | `npm ci --dry-run --ignore-scripts --no-audit --no-fund` | `job-tracker-ui` | Validate npm lock/install plan without replacing current `node_modules` | PASS — dry run resolved the lockfile | Reported 59 platform/optional packages it would add | N/A |
| V-007 | `.\\.venv\\Scripts\\python.exe -m pip install --dry-run -r requirements-dev.txt` | `tools/summarizer` | Validate Python requirement resolution without changes | PASS — runtime requirements satisfied; declared pytest would be restored | Detected pytest version drift | N/A |
| V-008 | `.\\.venv\\Scripts\\python.exe -m pip install -r requirements-dev.txt` | `tools/summarizer` | Restore the declared local test dependency | PASS — project-local ignored venv restored from pytest 9.1.1 to declared 8.3.5 | Local ignored venv changed; no manifest/source change | N/A |
| V-009 | `dotnet build "Job tracker.sln" --configuration Release --no-restore` | Repository root | Release build and compiler/static-analysis baseline | PASS — 0 warnings, 0 errors | None | N/A |
| V-010 | `dotnet test JobTrackerApi.Tests\\JobTrackerApi.Tests.csproj --configuration Release --no-build -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1` | Repository root | Full backend suite, deterministic order | PASS — 462/462, 0 skipped | None | N/A |
| V-011 | `npx tsc --noEmit` | `job-tracker-ui` | Standalone strict TypeScript check including test sources | FAIL | `src/nginx-config.test.ts:7` uses regex `s` flag while target is ES2017 | Application/tooling-related |
| V-012 | `npm test -- --watchAll=false --runInBand` | `job-tracker-ui` | Full frontend Jest/RTL suite | PASS — 43 suites, 148 tests | None | N/A |
| V-013 | `npm run build` | `job-tracker-ui` | Production Next.js static-export build | PASS | Build's TypeScript pass did not catch the failing test-source check | N/A |
| V-014 | `.\\.venv\\Scripts\\python.exe -m pytest -q` | `tools/summarizer` | AI-sidecar test suite | PASS — 17 tests | Five SWIG deprecation warnings | N/A |
| V-015 | `dotnet format "Job tracker.sln" --verify-no-changes --no-restore` | Repository root | Formatting check without rewriting | FAIL — 1,301 whitespace diagnostics across 16 files | Formatting is not enforced in CI | Application/tooling-related |
| V-016 | `docker compose config --no-interpolate --quiet` | Repository root | Validate Compose structure without reading/interpolating secret values | PASS | None | N/A |
| V-017 | `$env:AI_SERVICE_TOKEN='audit-placeholder-not-a-secret'; $env:AUTH_JWT_KEY='audit-placeholder-not-a-secret'; docker compose --env-file .env.example config --quiet` | Repository root | Validate full Compose interpolation using safe placeholders | PASS | External network existence is not checked by `config` | N/A |
| V-018 | `dotnet ef migrations list --no-connect --no-build --configuration Release` | `JobTrackerApi` | List migrations without connecting to or changing a database | PASS — 19 migrations listed | Applied status intentionally unavailable under `--no-connect` | N/A |
| V-019 | `dotnet ef migrations has-pending-model-changes --no-build --configuration Release` | `JobTrackerApi` | Compare current EF model with snapshot without applying migrations | PASS — no pending model changes | Design-time host initialization only | N/A |
| V-020 | `dotnet list "Job tracker.sln" package --vulnerable --include-transitive` | Repository root | NuGet advisory audit | PASS — no known vulnerable packages in either project | Queried NuGet.org | N/A |
| V-021 | `npm audit --audit-level=low` | `job-tracker-ui` | npm production and development advisory audit | FAIL — two moderate vulnerabilities | Documented React Router redirect/SSR advisories; suggested fix is a breaking major change | Application/supply-chain-related |
| V-022 | `pipx run pip-audit -r requirements.txt` | `tools/summarizer` | Python advisory audit in an isolated audit-tool environment | FAIL — 119 advisory records affecting 6 packages | `transformers`, `torch`, `pillow`, `pypdf`, `python-multipart`, and transitive `starlette`; applicability/severity requires path-level assessment | Application/supply-chain-related |
| V-023 | `docker build --check --file JobTrackerApi\\Dockerfile .` | Repository root | Backend Dockerfile static check | PASS — no warnings | Loaded base-image metadata only | N/A |
| V-024 | `docker build --check --file Dockerfile .` | `job-tracker-ui` | Frontend Dockerfile static check | PASS — no warnings | Loaded base-image metadata only | N/A |
| V-025 | `docker build --check --file Dockerfile .` | `tools/summarizer` | AI Dockerfile static check | PASS — no warnings | Loaded base-image metadata only | N/A |
| V-026 | `npm run test:e2e` | `job-tracker-ui` | Isolated Chromium browser smoke suite | PASS — 4/4 | Covered login, saved-job create, Career Workspace load, anonymous public CV/PDF | N/A |
| V-027 | `git status --short --branch` | Repository root | Confirm audit preserved source worktree | PASS | Only pre-existing `.agent.md`/`AGENTS.md` plus `docs/audits/` are visible | N/A |
| V-028 | `dotnet list "Job tracker.sln" package --deprecated --include-transitive` | Repository root | Identify deprecated NuGet packages | WARN — API none; test project xUnit 2.9.2/transitives marked legacy | Migration to xUnit v3 is available but not required for this audit | Maintenance |
| V-029 | `npm outdated --json` | `job-tracker-ui` | Inventory version drift without changing packages | WARN — exited 1 because updates exist | React Router 7, MUI 9, testing-library, Node types, TypeScript, and web-vitals include major updates | Maintenance |
| V-030 | `curl.exe -sS -o NUL -w '%{http_code} %{time_total}' http://127.0.0.1:5402/health` and equivalent frontend request | Repository root | Verify disposable API/UI startup | PASS — API and frontend returned 200 | First development responses were about 2.2 s and 2.5 s; not production startup measurements | N/A |
| V-031 | Bounded `curl.exe -b <synthetic-cookie-jar> -w '%{http_code}'` requests for copied User A job/company/correspondence/attachment/CV/workspace IDs | Repository root | Direct-ID two-user isolation test | PASS/PARTIAL — meaningful job/company/message/attachment/profile/checklist results denied B; CV/AI/workspace/timeline/interview paths partly blocked by 500 defects | Exact status matrix in `evidence/two-user-isolation.md` | Application blockers on partial paths |
| V-032 | Authenticated `curl.exe` requests to `/api/cv/variants`, `/api/profile-cv/runs`, `/api/jobapplications/1/ai/history`, `/api/ai/usage`, `/api/jobapplications/1/workspace`, `/timeline`, and `/interview-prep` | Repository root | Exercise default SQLite career/application workspace APIs | FAIL — listed DateTimeOffset paths and the two ambiguous routes returned 500 | Sibling checklist/analysis/match paths returned 200 | Application-related |
| V-033 | Reset synthetic job fields in disposable SQLite; restart Release API; query row after hosted-service initial delays | Repository root / `JobTrackerApi` | Verify rules/enrichment workers see tenant data | FAIL — old Applied status and null tags/summary remained | Runtime agrees with deny-on-null query-filter execution path | Application-related |
| V-034 | Copy built-in SQLite backup to a new disposable restore path; `PRAGMA integrity_check`; start a second API with restored DB plus copied `Attachments/` and `keys/`; request `/health`, login, job, and attachment | Repository root / `JobTrackerApi` | Safe restoration rehearsal | PASS/PARTIAL — DB integrity/counts and restored application/file access passed | Complete recovery requires files/keys/config outside DB; MariaDB unavailable | Environmental/provider limitation |
| V-035 | Login; copy synthetic cookie jar; POST `/api/auth/logout` with CSRF header; request `/api/auth/me` with cleared and copied jars | Repository root | Verify logout revocation semantics | FAIL — cleared jar 401, copied pre-logout session 200 | Server session was not revoked | Application-related |
| V-036 | Start isolated API with `Auth__RequireEmailVerification=true`; register synthetic user; query stored `EmailConfirmed`; request `/api/auth/me` | Repository root / `JobTrackerApi` | Verify initial verification gate | FAIL — register 200, stored confirmation false, immediate authenticated request 200 | Email sender disabled; no mail sent | Application-related |
| V-037 | Mark only the disposable account confirmed; login; `PUT /api/auth/profile` with a new synthetic email; query identity row | Repository root | Verify email-change verification lifecycle | FAIL — update 204 and new address remained confirmed | No verification challenge | Application-related |
| V-038 | Ten warm `curl.exe` samples for `/health`, paged jobs, and companies; compute mean/p95 | Repository root | Safe local API timing baseline | PASS — 11.3/17.8/6.5 ms means respectively | One-row SQLite dataset; no capacity claim | N/A |
| V-039 | `Get-ChildItem job-tracker-ui\out\_next\static -Recurse -File` and sum `.js`/`.css` lengths | Repository root | Static-export size inventory | PASS — 49 JS chunks, 2,762,618 uncompressed bytes; CSS 293 bytes | Aggregate is not initial-route transfer size | N/A |
| V-040 | Import mandatory `browser-client.mjs` through the skill-required browser runtime | Browser skill runtime | Start interactive browser audit | BLOCKED — module absent from installed plugin bundle | Skill forbids fallback browser automation; no screenshots/manual viewport checks | Environmental/plugin packaging |
| V-041 | `pipx run pip-audit -r requirements.txt -f json` with local summary by package/unique advisory/fix version | `tools/summarizer` | Sceptically validate Python advisory reachability | FAIL — active PDF/image/multipart parsers have numerous crafted-input DoS/memory advisories | Model-loading advisories separated from user-upload reachability | Application/supply-chain-related |
| V-042 | `npm audit --json` with title/range/fix extraction | `job-tracker-ui` | Validate npm advisory scope | FAIL — four moderate advisory entries across two installed packages | Audit fix requires React Router 7.18.2 major for remaining issues | Application/supply-chain-related |
| V-043 | Resolve listeners with `Get-NetTCPConnection`; validate command lines with `Get-CimInstance`; stop exact PIDs; re-run `git status --short --branch` | Repository root | Clean up audit runtime and reconfirm source preservation | PASS — audit ports closed; only pre-existing and audit-report changes visible | Temporary disposable evidence retained outside repository | N/A |
| V-044 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore --filter "FullyQualifiedName~AuthAndSystemControllerTests\|FullyQualifiedName~AuthSessionRevocationTests"` | Repository root | SEC-005B focused registration/email/session checks | PASS — 35/35 | None | N/A |
| V-045 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore` | Repository root | Full backend regression after SEC-005B | PASS — 501/501 | None | N/A |
| V-046 | `npm run build`; `npm test -- --runInBand` | `job-tracker-ui` | Frontend build and full regression after registration/profile/confirmation UI | PASS — build; 43 suites and 151/151 tests | First regression run exposed a stale nginx filename/alias test from SEC-002; test was corrected to the deployed template contract and the complete rerun passed | Application test-maintenance issue resolved |
| V-047 | `dotnet ef migrations script 20260731115022_AddStripeBillingState 20260802205800_AddPendingEmailChange --project JobTrackerApi\JobTrackerApi.csproj --startup-project JobTrackerApi\JobTrackerApi.csproj --no-build` with SQLite and MariaDB design-time configuration; `dotnet ef database update ...` against disposable SQLite | Repository root | Validate SEC-005B migration SQL and safe upgrade | PASS/PARTIAL — provider SQL and upgrade pass; fresh empty migration chain fails before SEC-005B | Pre-existing `AddJobEntityAndProspectStages` expects missing `LastReminderEmailSentAt`; MariaDB execution unavailable | Application CORE-001 / provider limitation |
| V-048 | Isolated `dotnet run --no-build --no-launch-profile --project JobTrackerApi\JobTrackerApi.csproj --urls http://127.0.0.1:5302`; synthetic `Invoke-WebRequest` registration/login with email disabled | Repository root | Runtime verification-required registration boundary | PASS — register 202/typed flag/no `Set-Cookie`/zero cookies; login 403 `email_not_verified`/zero cookies | Synthetic disposable account only; no email sent | N/A |
| V-049 | Browser skill runtime `getForUrl("http://localhost:3100/register")`, new tab and navigation | In-app browser | Real browser registration/profile verification | BLOCKED before navigation | Administrator policy check was unavailable and denied localhost; no browser claim or screenshot made | Environmental/browser policy |
| V-050 | `Get-CimInstance Win32_Process ...`; `Stop-Process -Id 43004,32708`; listener recheck | Repository root | Stop exact isolated API/UI child processes | PASS — 5302/3100 listeners closed; pre-existing Docker services untouched | Recursive cleanup of the verified temp runtime directory was rejected by execution policy | Environmental cleanup limitation |
| V-051 | SEC-004 focused/full backend/frontend tests and dual-provider migration scripts | Repository root | Canonical Microsoft identity regression and migration verification | PASS/PARTIAL — 34 focused, 507 backend, 152 frontend; SQLite upgrade/unique rehearsal and SQLite/MariaDB SQL pass | No real Microsoft token/account, MariaDB execution, browser or production inventory | Provider/environment limitation |
| V-052 | `dotnet test ... --filter "FullyQualifiedName~CvBuilderTests|...|FullyQualifiedName~ApplicationAssetsTests"` | Repository root | CORE-001 focused affected-service regression | PASS — 81/81 | Original audit runtime remains the pre-fix reproduction | N/A |
| V-053 | `dotnet test ... --filter "FullyQualifiedName~SqliteDateTimeOffsetCompatibilityTests"` | Repository root | Execute CORE-001 against real SQLite and generate MariaDB/Pomelo ordering/range SQL | PASS — 3/3; owner-scoped ordering, range, usage, workspace, artifact and isolation paths pass | MariaDB SQL generation only; no server connection | Provider limitation |
| V-054 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore`; `git diff --check` | Repository root | CORE-001 full backend regression and patch hygiene | PASS — 509/509; diff check clean apart from line-ending notices | None | N/A |
| V-055 | Isolated `dotnet run --no-launch-profile ... --environment=Development -- --urls=http://127.0.0.1:5303`; synthetic registration/login and HTTP matrix | Repository root | Fresh default-SQLite startup and affected API/runtime isolation | PASS — empty variants/runs/history/usage 200, missing workspace 404, owner workspace 200, User B workspace 404/variants empty | Browser and MariaDB unavailable; no external calls or real data | Environmental/provider limitation |
| V-056 | Resolve listener with `Get-NetTCPConnection`; inspect exact process; `Stop-Process`; listener recheck | Repository root | Stop CORE-001 isolated API safely | PASS — exact `JobTrackerApi` PID 15400 stopped and port 5303 closed | Exact nested disposable data cleanup rejected by execution policy | Environmental cleanup limitation |
| V-057 | `dotnet test ... --filter "FullyQualifiedName~RouteUniquenessTests|...ApplicationIntelligenceTests|...InterviewPrepTests|...InterviewPrepPersistenceTests"` | Repository root | CORE-002 route uniqueness and focused behavior | PASS — 31/31 | None | N/A |
| V-058 | `npm test -- --runInBand src/application-route-contracts.test.ts src/application-intelligence.test.tsx src/interview-prep.test.tsx` | `job-tracker-ui` | Verify distinct frontend timeline/board/brief contracts | PASS — 21/21 | Static brief-route contract complements existing rendered board/timeline tests | N/A |
| V-059 | Full backend and frontend suites; frontend production build | Repository root / `job-tracker-ui` | CORE-002 regression | PASS — backend 511/511; frontend 45 suites/153 tests; build passes | Browser unavailable | Environmental browser limitation |
| V-060 | Isolated SQLite API on 5304; synthetic owner/User B/anonymous GET matrix for timeline, interview board and brief; exact listener shutdown | Repository root | Prove ambiguity removal and authorization at runtime | PASS — each owner 200, other user 404, anonymous 401; exact PID 23904 stopped and port closed | No browser, MariaDB or production smoke | Environmental/provider limitation |
| V-061 | `dotnet test ... --filter "FullyQualifiedName~AttachmentConsistencyTests|FullyQualifiedName~AttachmentFlagsRecomputeTests|FullyQualifiedName~AttachmentsControllerTests"` | Repository root | SEC-008 failure-boundary and storage-invariant regression | PASS — 20/20 | Symlink creation unavailable on this host | Environmental capability limitation |
| V-062 | `dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-restore`; `git diff --check` | Repository root | SEC-008 full backend regression and patch hygiene | PASS — 525/525; no whitespace errors | Repository line-ending notices only | N/A |
| V-063 | Isolated SQLite API on 5305; synthetic User A upload/list/download/rename/delete and User B direct-ID denial; exact listener shutdown | Repository root | SEC-008 runtime and tenant isolation | PASS — owner operations 200/204, User B 404, final owner list empty; exact PID 4592 stopped and port closed | Browser, MariaDB and production inventory unavailable | Environmental/provider limitation |
| V-064 | Disposable local symbolic-link capability probe using .NET filesystem APIs | System temporary directory | Determine whether child reparse escape can be executed safely | BLOCKED — host denied symbolic-link creation with `RuntimeException`; temporary directories removed | Refusal branch code-inspected; traversal/outside-root test passes | Environmental capability limitation |
| V-065 | `dotnet test ... --filter "FullyQualifiedName~BackgroundWorkerTenantTests|FullyQualifiedName~CurrentUserIdLiveEvaluationTests|FullyQualifiedName~RulesEngineTests"` | Repository root | BG-001 owner scope, switches and fake side-effect integration | PASS — 9/9 after final trust-boundary assertion | No real email/AI invoked | N/A |
| V-066 | `dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --no-restore` | Repository root | BG-001 full backend regression | PASS — 532/532 after final trust-boundary test | None | N/A |
| V-067 | `docker compose config --quiet`; `git diff --check` | Repository root | Default-off production configuration and patch hygiene | PASS — Compose valid; no whitespace errors | Unset optional/local environment warnings and line-ending notices only | N/A |
| V-068 | Isolated API on 5306 with disposable SQLite data and all four worker switches false; health/no-export check; exact PID shutdown | Repository root | BG-001 safe startup without worker side effects | PASS — health 200, no export directory, exact PID 44980 stopped, port closed | No browser, production canary, SMTP or AI provider | Environmental/provider limitation |
| V-069 | `dotnet test ... --filter "FullyQualifiedName~UserOperationStoreTests"`; full backend suite | Repository root | OPS-001A state, concurrency, owner and regression checks | PASS — focused 7/7; full 539/539 | No handler/UI yet | N/A |
| V-070 | `dotnet ef migrations has-pending-model-changes`; generated SQLite/MariaDB migration up/down scripts | Repository root | OPS-001A model/migration parity | PASS — snapshot current; both providers create/drop; MariaDB has bounded types/eight `datetime(6)` and no unbounded text | MariaDB generation only | Provider limitation |
| V-071 | Disposable existing SQLite `database update`, downgrade and re-upgrade | Repository root | OPS-001A upgrade/rollback rehearsal | PASS | Synthetic local database only | N/A |
| V-072 | Fresh isolated application startup on 5307; health; EF update no-op; exact process shutdown | Repository root | Reconciler/migration startup order with EF-only new table | PASS — health 200; database already current; exact PID 37276 stopped and port closed | No MariaDB/production runtime | Provider limitation |
| V-073 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore --filter FullyQualifiedName~UserOperationStoreTests` | Repository root | OPS-001B terminal notification, owner-state and rollback checks | PASS — 9/9 | Real file-backed SQLite; no email/worker | N/A |
| V-074 | `dotnet ef migrations script 20260802224646_AddUserOperations 20260802225941_AddUserNotifications ...` and reverse for SQLite/MariaDB | Repository root | OPS-001B provider-safe up/down SQL | PASS after correction — bounded MariaDB/SQLite create/drop scripts retained | First MariaDB attempt used the wrong connection-string key and emitted SQLite SQL; invalid output was overwritten and not treated as evidence; MariaDB not executed | Verification setup corrected / provider limitation |
| V-075 | Disposable SQLite notification upgrade, downgrade and re-upgrade; `dotnet ef migrations has-pending-model-changes ... --no-build` | Repository root | OPS-001B safe additive migration and model parity | PASS — all transitions succeeded; no pending model changes | Synthetic copy of OPS-001A evidence database only | N/A |
| V-076 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore`; `git diff --check` | Repository root | OPS-001B backend regression and patch hygiene | PASS — 541/541; no whitespace errors | Line-ending notices only | N/A |
| V-077 | Focused operation controller/store tests; full backend suite | Repository root | OPS-001C owner APIs, safe DTOs, mutations and regressions | PASS — 12/12 focused; 544/544 full | Direct controller tests use real SQLite | N/A |
| V-078 | Focused operations/shell Jest; full Jest; `npm run build` | `job-tracker-ui` | OPS-001C states, action lock, bell accessibility, regression and TypeScript build | PASS — 3/3 focused; 47/47 suites and 156/156 full; build pass | First full npm invocation used repository root and failed for missing root `package.json`; corrected working directory passed | Verification command corrected |
| V-079 | Isolated API on 5310; two disposable users; synthetic SQLite operation/notification rows; authenticated/anonymous direct HTTP matrix | Repository root | OPS-001C runtime authorization, CSRF and lifecycle | PASS — owner detail/cancel/read/dismiss/retry 200/204; four copied cross-owner paths 404; anonymous 401; listener stopped | Initial launch inherited local connection; exact synthetic users/sessions were removed with zero-count proof. Lowercase raw GUID seed was replaced before the passing matrix | Verification setup corrected |
| V-080 | Evidence tree/key inspection; exact generated Data Protection key deletion; listener and local synthetic-account count checks | Repository root | Prevent secret/test-data leakage and confirm cleanup | PASS — key absent; no 5308/5309/5310 listeners; local pre-existing DB has zero synthetic accounts | Disposable synthetic SQLite evidence/backups retained | N/A |
| V-081 | `rg`/bounded `Get-Content` inventory of `AccountPlans`, billing/auth DTOs, every `ISummarizerService` call, controller route, worker and frontend caller | Repository root | Trace POL-001 end to end before enforcement | PASS — all current model-call paths classified in `pol-001-free-pro-entitlements.md` | Usage accounting is complete only for AI Workspace; landing-page claims remain PRODUCT-001 | Application gap/dependency |
| V-082 | `dotnet build JobTrackerApi.sln --no-restore`; `npm run build` | Repository root | Initial POL-001 build attempt | FAIL — solution filename and npm working directory were wrong | Corrected immediately to the actual project/UI paths; no files or dependencies changed | Command/operator-related |
| V-083 | `dotnet build JobTrackerApi/JobTrackerApi.csproj --no-restore`; `npm run build` | Repository root / `job-tracker-ui` | Compile backend and production frontend after policy/UI changes | PASS — backend 0 warnings/errors; frontend TypeScript/static build passed | Frontend build repeated after final changes in V-086 | N/A |
| V-084 | `dotnet test ... --filter "...AccountPlansTests|...ProEntitlementAuthorizationTests|...BackgroundWorkerTenantTests|...ProfileCvControllerTests|...JobApplicationsEndpointBehaviorTests"` | Repository root | Free/Pro/Admin/downgrade, stable 403, worker recheck and core behavior | PASS — 74/74 final | Interim runs exposed a missing test `using`, absent role services and an outdated SQLite expectation; fixtures were corrected without weakening behavior | Test-fixture maintenance resolved |
| V-085 | `npm test -- --runInBand ai-workspace-panel.test.tsx ai-usage-card.test.tsx job-details-generated-drafts.test.tsx profile-page.test.tsx quick-capture.test.tsx` | `job-tracker-ui` | Locked state, no false generation, usage and unaffected job/CV flows | PASS — 5 suites, 22/22 tests | Component tests; not a browser claim | N/A |
| V-086 | Full backend `dotnet test`; full frontend `npm test -- --runInBand`; `npm run build`; `git diff --check` | Repository root / `job-tracker-ui` | POL-001 regression and patch hygiene | PASS — backend 568/568; frontend 47/47 suites, 157/157; build passed; no whitespace errors | First backend full run had one outdated direct-controller expectation; corrected to Pro because the test targets SQLite aggregation, then full rerun passed. Line-ending notices only | Test expectation resolved |
| V-087 | Bounded source/route/provider inventory plus `dotnet test ... --filter "FullyQualifiedName~AiEvaluationFixtureTests"` | Repository root | PROD-002 workload classification and synthetic fixture safety/coverage | PASS — 19 synthetic cases; 1/1 validator | First validator run showed the email regex retained sentence punctuation; regex boundary corrected and rerun passed | Test validator corrected |
| V-088 | Full backend `dotnet test`; full frontend `npm test -- --runInBand`; `npm run build` | Repository root / `job-tracker-ui` | PROD-002 wider regression after final entitlement contract and fixture | PASS — backend 569/569; frontend 47/47 suites, 157/157; build passed | No model/provider/internet/real data used | N/A |
| V-089 | Bounded `rg`/`Get-Content` of POL-002 source, account/settings/authorization/workers, named AI client, sidecar router, Compose and tests | Repository root | Revalidate privacy and provider execution paths | PASS — global `AI_PROVIDER` reached full `/cv/*` payloads without per-user consent; `/summarize` remained local | Background queued calls have no HTTP identity and therefore need later operation policy snapshots | Confirmed implementation gap |
| V-090 | `dotnet build JobTrackerApi.csproj --no-restore`; `dotnet ef migrations add AddAiPrivacyPreferences ... --no-build` | `JobTrackerApi` | Compile policy/API and create additive preference migration | PASS — build 0 warnings/errors; migration created | First migration attempt exposed a misplaced fluent `AddHttpMessageHandler`; corrected at the named client and rebuilt | Implementation error resolved |
| V-091 | Focused backend policy/entitlement/worker/CV tests; final `AiPrivacyPolicyTests|ProEntitlementAuthorizationTests` rerun | Repository root | Verify live opt-out, Pro/admin/user gates and backend permission header | PASS — 72/72 then final policy 28/28 | Interim test used a nonexistent framework overload and misplaced a `using`; test construction corrected without weakening policy | Test-code errors resolved |
| V-092 | `.\.venv\Scripts\python.exe -m pytest -q` | `tools/summarizer` | Verify sidecar requires administrator gate plus backend consent header and remains local otherwise | PASS — 18/18 | Five existing SWIG deprecation warnings | N/A |
| V-093 | Focused UI `npm test -- --runInBand --runTestsByPath ...`; rerun after fixture correction | `job-tracker-ui` | Verify server-backed privacy controls and default local-only disclosure | PASS — 3 suites, 8/8 final | First run failed because the expanded settings test lacked an `/ai/usage` fixture; fixture added, production code unchanged | Test-fixture error resolved |
| V-094 | `dotnet ef migrations has-pending-model-changes`; migration script; disposable clean `dotnet ef database update` | `JobTrackerApi` | Validate model/migration defaults and clean application path | PARTIAL — no pending model changes; new SQLite SQL correctly uses AI enabled `1` and external consent `0`; clean chain failed before the new migration | SQLite idempotent scripts are unsupported; historical `AddJobEntityAndProspectStages` expects a reconciler-added column (pre-existing EF-only blank-chain defect) | Existing application-related migration-chain limitation |
| V-095 | Full backend `dotnet test`; full frontend `npm test -- --runInBand`; `npm run build`; `docker compose config --quiet`; `git diff --check` | Repository root / `job-tracker-ui` | POL-002 regression, production build, deployment syntax and patch hygiene | PASS — backend 576/576; frontend 47 suites/158 tests; build/config/diff pass | Expected unset optional Compose variables and line-ending notices only. Temporary API launch command was rejected before execution by policy; no service started | Runtime/browser/production verification blocked |
| V-096 | Source re-read plus `dotnet test ... --filter "...AiOperationQueueTests|...UserOperationStoreTests|...OperationsControllerTests"` | Repository root | AI-001 admission, capacity, priority, claim, owner execution, policy recheck and existing state/API regression | PASS — 17/17 final | Initial 15/15 and 16/16 passes preceded priority and retry/downgrade additions | N/A |
| V-097 | Full `dotnet test`; `docker compose config --quiet`; `git diff --check` | Repository root | AI-001 full backend regression and deployment/patch syntax | PASS — backend 581/581; config/diff pass | Expected unset optional Compose variables and line-ending notices only; worker remains default-off with no real task handler | Browser/provider/production verification pending later feature packages |
| V-098 | Bounded `rg`/`Get-Content` of every `/summarize`, `/extract-text`, `/cv/*`, `ISummarizerService`, privacy-header, operation-worker, provider-config, Compose and test path | Repository root | Revalidate AI-002 route convergence and existing mitigations before design | PASS — deterministic and summarize/extract paths remain local; all generative CV paths converge in the sidecar; configured external provider was direct rather than fallback; actual provider/failure provenance was lost | Browser/provider behavior was not inferred from source; route matrix records code-inspected status | Confirmed implementation gap |
| V-099 | `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore --filter "FullyQualifiedName~AiOperationQueueTests\|FullyQualifiedName~AiPrivacyPolicyTests\|FullyQualifiedName~SummarizerServiceTests\|FullyQualifiedName~AiWorkspaceTests"`; `python -m pytest -q` | Repository root / `tools/summarizer` | Verify local-first order, policy/task propagation, schema/circuit/cost/failure routing and actual provenance | PASS — backend 26/26; sidecar 22/22 | First sidecar run passed 15/18 and correctly failed three obsolete external-first expectations; tests were updated to the new approved policy, then extended. No network/provider call occurred | Expected test-contract transition resolved |
| V-100 | Full `dotnet test JobTrackerApi.Tests\JobTrackerApi.Tests.csproj --no-restore`; `python -m pytest -q`; synthetic-token `docker compose config --quiet`; `git diff --check` | Repository root / `tools/summarizer` | AI-002 wider regression, deployment syntax and patch hygiene | PASS — backend 588/588; sidecar 22/22; Compose/diff pass | Five existing SWIG deprecation warnings; Docker config-file access and unset optional-variable warnings; line-ending notices only. Worker/external gate remain off | Browser, MariaDB, selected-model, real-provider and production checks remain blocked |

## Secret-scan commands

The tracked-tree scan read only paths returned by `git ls-files`, skipped binary/large files, and applied high-confidence regular expressions for private-key headers, JWTs, common cloud tokens, and Stripe secrets. It emitted only secret type, path, and line number; never matched values. Result: one JWT-like token at `docs/_archive/artifacts/s06-acceptance/.dev-auth-token.txt:1`.

The JWT was decoded locally without printing claims or token text. It is an expired HS256 local-app token (expired 2026-03-27), has no current required session ID, and cannot pass current session validation.

The history scan used:

```powershell
$pattern='-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----|eyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}|(AKIA|ASIA)[A-Z0-9]{16}|AIza[0-9A-Za-z_-]{35}|gh[pousr]_[A-Za-z0-9]{30,}|(sk|rk)_(live|test)_[A-Za-z0-9]{16,}|whsec_[A-Za-z0-9]{16,}'
foreach($commit in (git rev-list --all)) { git grep -I -l -E -e $pattern $commit -- }
```

Output was reduced to filenames and commit counts. The token artifact appears under its current and former paths across history. A filename-only history check also found two historical ASP.NET Data Protection XML key files; no key material was printed. Current documentation states those production keys were rotated on 2026-08-02; that operational claim was not independently verified against production.

## Checks not available/configured

- No repository lint script or ESLint configuration is present.
- `gitleaks`, `trivy`, and `hadolint` are not installed; equivalent bounded checks were performed as described above, but no container CVE scan was available.
- Dependency audit results are advisory matches, not proof that every advisory is reachable or exploitable.

## Continued verification commands

| ID | Exact command | Directory | Purpose | Result | Relevant errors or warnings | Failure classification |
|---|---|---|---|---|---|---|
| V-104 | Bounded `rg`/`Get-Content` of `ProfileCvController` partials, `CvProcessingQueue`, extraction models/registration, Profile UI polling/tests and proxy timeout configuration | Repository root | Revalidate AI-004 upload/queue/restart/review path before design | PASS/PARTIAL — upload is synchronous through parser and multiple model-capable stages; reprocess/rebuild/improve persist runs and return 202, but an unbounded process channel supplies wakeups and no AI-001 operation/provenance/cancellation contract exists. Startup scans queued/running runs | No browser/private CV/parser payload/model/MariaDB/production execution; 504 origin not live-reproduced | Confirmed code-path gap plus environmental blockers |
| V-105 | `dotnet restore --packages C:\Users\Cesnimda\.nuget\packages --ignore-failed-sources`; `dotnet build --no-restore -p:UseAppHost=false` | `JobTrackerApi` | Recover the sandbox-rewritten assets file from the existing local package cache and compile AI-004 without downloading/upgrading dependencies | PASS — local-cache-only restore and build; 0 warnings/errors | Initial default restore failed because sandbox NuGet path was empty/network blocked; no dependency version or declaration changed | Environmental command path corrected |
| V-106 | `dotnet test --no-restore --filter "FullyQualifiedName~CvProcessingOperationTests|FullyQualifiedName~ProfileCvControllerTests|FullyQualifiedName~SqliteDateTimeOffsetCompatibilityTests|FullyQualifiedName~AiOperationQueueTests"`; `npm.cmd test -- --runInBand --forceExit src/profile-page.test.tsx`; `npm.cmd run build` | Backend tests / `job-tracker-ui` | Verify 202/dedup/owner/retry/provenance/review gate and durable Career Profile UI | PASS — backend 40/40; frontend 10/10; production build | Synthetic CV and fake provider only; Jest existing force-exit/open-handle notice | N/A |
| V-107 | Full `dotnet test --no-restore`; full `npm.cmd test -- --runInBand --forceExit`; `git diff --check`; implementation commit/push | Repository root / `job-tracker-ui` | AI-004 full regression, patch hygiene and remote checkpoint | PASS — backend 594/594; frontend 47/47 suites and 161/161 tests; no whitespace errors; `c3c5af8` pushed | Browser/private CV/parser isolation/MariaDB/model/restart/production checks not run; line-ending notices only | Environmental/dependency gates remain |
| V-101 | Bounded `rg`/`Get-Content` trace of Strategy button, Focus Plan tab/cache, controller/model calls, owner filters, proxy/queue/routing configuration and tests | Repository root | Revalidate AI-003 complete execution path before design | PASS — one UI action could start candidate fit plus four sequential synchronous focus-plan model calls; Pro and owner filters existed, durable state did not | Live timeout reproduction blocked; this is code-path evidence | Application-related |
| V-102 | `dotnet test ... --filter "...StrategySnapshotOperationTests|...AiWorkspaceNotePersistenceTests|...AiOperationQueueTests|...ProEntitlementAuthorizationTests"`; `npm.cmd test -- job-details-generated-drafts.test.tsx --runInBand --forceExit` | Repository root / `job-tracker-ui` | Focused 202/handler/cache/tenant/provider-shape and queued/cancel/fail/retry UI checks | PASS — backend 34/34; frontend 6/6 | Fake model only; Jest reports the existing force-exit/open-handle notice | N/A |
| V-103 | Full `dotnet test ... --no-restore`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | Repository root / `job-tracker-ui` | AI-003 regression, TypeScript production build and patch hygiene | PASS — backend 592/592; frontend 47/47 suites, 160/160; build; no whitespace errors | Initial sandboxed build attempted blocked NuGet restore; previously approved build path restored from existing cache and passed. Line-ending notices only | Environmental command path corrected |
| V-108 | Bounded source trace of `LoginPage`, Google/Microsoft account cards, auth API/config, translations and login tests | Repository root | Revalidate UX-001 local/provider execution and identity boundaries | PASS — backend already accepts username or email; UI imposed email-only validation and separate provider tabs; provider exchange and account-link endpoints are distinct | No identity/config/schema behavior changed | N/A |
| V-109 | `npm.cmd test -- --runInBand --forceExit src/login-page.test.tsx`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify unified form, invalid credentials, provider cancellation/return, full regression, TypeScript and patch hygiene | PASS — focused 13/13; full 47/47 suites and 166/166 tests; production build; no whitespace errors | Jest reports its existing force-exit/open-handle notice; provider tokens are synthetic mocks | N/A |
| V-110 | In-app browser at `http://localhost:3000/login`; dark-theme viewport/DOM checks and screenshots at 375×812, 768×900, 1440×1000 | Local frontend | Verify running local form, accessible names and responsive layout | PASS/PARTIAL — local form readable; viewport and document widths match with no overflow; evidence captured | API config service absent, so provider alternatives were mocked only; light/System and real-provider paths not run. Full-page screenshot mode produced an artifact and was discarded | Environmental/provider limitation |
| V-111 | Complete trace of `themePrefs`, auth user-key transitions, App provider/router lifecycle, Settings selector, Next layout/bootstrap and existing tests | Repository root | Reproduce UX-002 precedence and delayed switch path | PASS — login stored the resolved user key without a theme notification, so anonymous mode remained until refresh; provider key/router dependency remounted app state; no cross-tab listener or pre-paint bootstrap existed | Confirmed source execution path; no backend/identity behavior implicated | Application-related |
| V-112 | `npm.cmd test -- --runInBand --forceExit src/theme-state.test.tsx`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify precedence, login/logout events, System behavior, pre-paint bootstrap, in-place provider state, regressions and TypeScript | PASS — focused 6/6; full 48/48 suites and 172/172 tests; production build and patch hygiene pass | Initial build found unsupported `noSsr` prop and was corrected; Jest retains existing force-exit/open-handle notice | Application issue corrected before commit |
| V-113 | In-app browser Settings: Light → Dashboard → refresh; Dark; System; second-tab Dark → Light sync; 375/768/1440 measurements/screenshots; console inspection | Local frontend | Verify actual theme transitions, persistence, cross-tab behavior and responsive access | PASS/PARTIAL — expected scheme at every transition, first tab updated without reload, no final console warnings/errors, no horizontal overflow after scrollable Settings tabs | Authenticated two-user, host OS preference flip and production not run; transient HMR messages occurred while editing and clean build passes | Environmental/deployment limitation |
| V-114 | Complete trace of import HTML cleanup/language/tagging, deterministic matcher, analysis endpoint/UI, match endpoint/UI, learning-item sync and storage/cache behavior | Repository root | Reproduce QA-001 low-information term path and version implications | PASS — visible terms come from English-only single-token ranking in `JobCvMatchService`; imported HTML is cleaned earlier but manual text may not be; result is on-demand and has no historical analysis cache; AI is not involved | Confirmed source execution path | Application-related |
| V-115 | `dotnet test ... --filter "...JobCvMatchServiceTests|...ApplicationIntelligenceTests|...JobApplicationsEndpointBehaviorTests|...ApplicationChecklist"`; `npm.cmd test ... match-score-panel.test.tsx application-intelligence.test.tsx`; final matcher/UI focused rerun | Repository root / `job-tracker-ui` | Verify seven required fixtures, affected endpoints/learning lifecycle and honest label | PASS — affected backend 54/54; affected UI 13/13; final matcher 15/15 and label 3/3 | Synthetic job/CV text only; no model/provider/browser | N/A |
| V-116 | Full `dotnet test ... --no-restore`; full `npm.cmd test -- --runInBand --forceExit`; `npm.cmd run build`; `git diff --check` | Repository root / `job-tracker-ui` | QA-001 full regression, TypeScript/build and patch hygiene | PASS — backend 601/601; frontend 48/48 suites and 172/172 tests; production build; no whitespace errors | Jest existing force-exit/open-handle notice; browser/production presentation not run | Environmental/deployment limitation |