cesnimda
5eb9b3cb96
Keep external providers behind server consent, task, and prompt-cost gates while persisting actual provider provenance.
5.1 KiB
5.1 KiB
Application action verification matrix
Updated: 2026-08-02
This is the rolling action-level evidence index. PASS (automated/runtime) is not a browser or production claim.
| Area | Action | Automated/API result | Browser | Production | Evidence |
|---|---|---|---|---|---|
| Origin | reject unknown/malformed production host | PASS | BLOCKED | NOT RUN | sec-001-canonical-origin.md |
| Ingress | production host-port and forwarded-proxy contract | PASS (config) | N/A | NOT RUN | sec-002-ingress-compose.md |
| Microsoft | tenant/issuer validation | PASS | BLOCKED | NOT RUN | sec-003-microsoft-tenant.md |
| Microsoft | canonical link/relink/unlink isolation | PASS | BLOCKED | NOT RUN | sec-004-microsoft-identity.md |
| Sessions | logout/reset/recovery revocation | PASS | BLOCKED | NOT RUN | sec-005a-session-revocation.md |
| register/verify/pending-change ownership | PASS | BLOCKED | NOT RUN | sec-005b-email-ownership.md |
|
| Career/API | SQLite variants/runs/usage/history/workspace | PASS | BLOCKED | NOT RUN | core-001-sqlite-provider-parity.md |
| Application workspace | timeline/interview board/generated brief routes and owner isolation | PASS | BLOCKED | NOT RUN | core-002-route-uniqueness.md |
| Attachments | upload/list/download | PASS | BLOCKED | NOT RUN | sec-008-attachment-consistency.md |
| Attachments | metadata rename/purpose/AI flag | PASS | BLOCKED | NOT RUN | sec-008-attachment-consistency.md |
| Attachments | delete/restart recovery/two-user denial | PASS | BLOCKED | NOT RUN | sec-008-attachment-consistency.md |
| Workers | two-owner rules, export, reminders and enrichment | PASS (real SQLite; fake email/AI) | BLOCKED pending notification UI | NOT RUN; switches off | bg-001-tenant-workers.md |
| Durable operations | idempotent create/claim/lease/retry/cancel/complete | PASS (real SQLite) | NOT APPLICABLE until API/UI slice | NOT RUN | ops-001a-durable-operations.md |
| Notifications | atomic terminal record, owner list/read/dismiss | PASS (real SQLite; forced rollback) | NOT APPLICABLE until API/UI slice | NOT RUN | ops-001b-notifications.md |
| Operations UI | owner list/detail/cancel/retry and persistent notification surface | PASS (two-user HTTP + components) | BLOCKED | NOT RUN | ops-001c-operation-ui.md |
| Entitlements | Free direct request to every explicit AI action | PASS (policy/route inventory) | BLOCKED | NOT RUN | pol-001-free-pro-entitlements.md |
| Entitlements | stale Pro claim after downgrade | PASS (live-role policy test) | BLOCKED | NOT RUN | pol-001-free-pro-entitlements.md |
| Entitlements | queued CV and enrichment worker recheck | PASS (fake AI; real SQLite worker scopes) | N/A | NOT RUN; workers off | pol-001-free-pro-entitlements.md |
| Entitlements | Free core job create/detail and deterministic match data | PASS (automated) | BLOCKED | NOT RUN | pol-001-free-pro-entitlements.md |
| Entitlements | Free locked AI Workspace/Career/CV Builder/job-assistance states | PASS (components) | BLOCKED | NOT RUN | pol-001-free-pro-entitlements.md |
| Entitlements | Pro/Admin AI admission | PASS (automated policy) | BLOCKED | NOT RUN | pol-001-free-pro-entitlements.md |
| AI evaluation | synthetic task/category/privacy/constraint fixture coverage | PASS (19 cases; validator) | N/A | N/A | prod-002-ai-evaluation.md |
| AI privacy | disable AI for a current Pro user | PASS (live database policy + worker tests) | BLOCKED | NOT RUN | pol-002-ai-privacy.md |
| AI privacy | external /cv/* without administrator gate or user consent |
PASS — forced local in backend/sidecar tests | BLOCKED | NOT RUN | pol-002-ai-privacy.md |
| AI privacy | approved external route with synthetic payload | PASS (mocked transport only) | BLOCKED | NOT RUN | pol-002-ai-privacy.md |
| Durable AI | Pro admission, idempotent status URL and bounded capacity | PASS (real SQLite + synthetic subject IDs) | BLOCKED until real producer | NOT RUN; worker off | ai-001-durable-ai-queue.md |
| Durable AI | priority/task-filtered atomic claim and owner-scoped success | PASS (fake handler, real operation/notification state) | N/A | NOT RUN | ai-001-durable-ai-queue.md |
| Durable AI | retryable failure, downgrade recheck, lease/cancel/restart recovery | PASS (automated) | BLOCKED until real producer | NOT RUN | ai-001-durable-ai-queue.md |
| AI routing | local primary success and no parallel external call | PASS (fake transports) | N/A | NOT RUN | ai-002-provider-routing.md |
| AI routing | consent/admin/task/config/prompt-cap fallback denial | PASS (backend + sidecar policy tests) | BLOCKED | NOT RUN | ai-002-provider-routing.md |
| AI routing | schema/local-outage/circuit fallback and external failure | PASS (fake transports) | BLOCKED | NOT RUN | ai-002-provider-routing.md |
| AI routing | actual provider/model/route persistence on success/failure | PASS (real SQLite operation/history state; fake provider) | BLOCKED until real producer | NOT RUN | ai-002-provider-routing.md |
Remaining product actions are NOT STARTED in the master plan and will be added as their work packages enter verification. Browser localhost is currently denied by administrator policy; production access is not documented/configured.