cesnimda
6.6 KiB
A3-IM09 Account and administration validation
3 November 2026. Owner explicitly approved "Approve IM08 and A3-IM09". Isolated codex/a3-ui-09 starts at published/remotely verified IM08 acceptance receipt f0c8c6d321a70b4d477e99c7b9557246b6361cdf. This is a presentation increment, not final authentication/security/release acceptance.
Changes and preservation
- Account overview adds named navigation to identity, sign-in/connections and password/security groups. Keyboard actions focus and scroll existing groups. Forms remain mounted: changing sections does not reset an unsaved identity draft. Existing account avatar, local/external restrictions, password, 2FA, trusted-device, provider and session controls remain with their existing owners. Career Profile is still canonical and separate.
- The account data link enters existing Settings Backup controls through
/settings?section=data. Only this exact initial query selects section3; unsupported queries retain General. Existing sections, lifecycle availability, recent-sign-in export requirement, deletion phrase and confirmation writers remain unchanged. - Processing monitor has named filter/result targets and keyboard jump/return actions. No filter submission, reads, polling or mutations occur merely from moving focus. Visual inspection then found native-select labels overlapping the selected All value and a long failure chip squeezing Duration. Four labels now shrink above the value; failure chips wrap and the duration column retains readable width. An affected browser rerun exposed intermittent detail focus loss: the animation-frame callback could execute before React committed the heading ref. A failing scheduling regression reproduced it. Requested focus now runs after commit with the existing owner/session guards. Existing identity cancellation, permission failures, bounded events, pause/resume and owner-permitted job links remain. Existing admin users/audit/system components are retained and qualified alongside these changes.
No API, schema, migration, dependency, worker/provider/model configuration or physical renderer change. Rollback reverts this UI increment; no database rollback required. The IM08 granular Ghosted pause and mounted AI-entitlement refresh gaps remain OPEN.
Verification
| Check | Result and scope |
|---|---|
| Frontend | 143 distinct cases PASSED across11 suites. Initial stable application-source run142 passed, zero failed/skipped. Final processing successor19 passed, replacing the18 processing cases in142 and adding one scheduling regression:142−18+19=143. Profile/account security/presentation/providers/data export, admin users/audit/system/processing, Settings and translation catalogue. Native reports under evidence/account-admin/frontend. Intermediate18-case visual rerun overlaps these totals. |
| Red contracts | Four expected failures before implementation, one supported-default case passed;65 filtered cases NOT RUN. Focused successor five passed; these overlap142. |
| Initial broad attempt | EARLY-MIXED.json:135 passed/two new-contract failures across137 cases. Regression tests were added while the command ran, so this is not a clean baseline and provides no acceptance count. Superseded by the stable application-source142-case run. |
| Backend | 69 PASSED, zero failed/skipped. Users/last-admin, 2FA, session revocation/controller, processing, account export and API authorization posture. Native TRX under evidence/account-admin/backend. Local mock/InMemory/temp SQLite fixtures; no production accounts or providers. |
| Static checks | Typecheck, full ESLint, static-export build, scoped verifier ESLint/syntax and diff check PASSED. Initial build/typecheck rejected unsupported test-query exact options; removed without changing product behavior. System dotnet could not resolve the SDK; existing user SDK/DOTNET_ROOT succeeded without config changes. |
| Browser | Full16 controlled journeys/128 scans passed across EN/NB, light/dark,320/390/768/1440; evidence/account-admin/browser/BROWSER.json, with16 intercepted export denials and no mutations. Processing visual/focus corrections passed the affected16-configuration successor under PROCESSING.json. Final distinct coverage remains128 (112 unchanged states plus16 processing), not an additional full pass. Geometric checks verify native labels above selected text and Duration width. Pilot overlaps, not extra cases. Representative phone account and final desktop NB/dark processing captures were visually inspected. |
| Review/graph | Independent source/verifier review, including the visual and postcommit focus fixes, found no actionable issues. No extra test reruns counted. Final AST-only update passed:18,858 nodes/46,544 edges/1,109 communities. Optional SQL parser absent and144 files yielded no symbols; generated graph remains local. |
Browser journeys exercise unsaved identity drafts across keyboard section jumps, cancelled session-revocation and account-deletion confirmations, an explicit export request rejected by a fixture403, disconnected-provider presentation, disabled last-admin deletion/demotion, empty audit, unavailable system reads and paused processing drill-down with a non-openable linked job. The verifier blocks external origins and unexpected writes; all API responses are synthetic. No credential change, reset, account deletion, provider connect/disconnect, model or production operation is executed. System normal-state actions and detailed audit action scenarios are covered by selected unit tests, not the browser's unavailable/empty captures. The first geometry-check selector matched both Task and the search label; the failed followup is retained and the selector now uses the control's actual label association. The saved diagnostic image shows the visual defect that axe did not detect; it is not an accepted final capture.
NOT RUN: real authentication/OAuth/email/2FA delivery, MariaDB/hosted CI, native device/screen-reader, live security attack simulation, complete European native-language review, integrated recovery/restore or release qualification. Reused physical-PDF acceptance is unaffected; no PDF rerun was justified.
Next gate
After final browser evidence, source/evidence reconciliation, publication and independent remote readback, request Gate F for IM09 and progression to IM10: cross-application consistency, secondary-route preservation, responsive/localisation/accessibility and combined affected regression. The approved proposal requires owner milestone review before the next increment. Do not infer IM10 approval from the earlier IM09 answer. Full Phase10, Global Jobs dependencies and final integrated security/release gates remain separate.