jobtrackingapp/automation/prompts/global-jobs-planning/ACCEPTANCE_MATRIX.md

Acceptance and evidence matrix

28 October 2026. All implementation scenarios below are NOT RUN in GJ-00. This is the proposed acceptance contract, requiring owner approval for quantitative targets. Documentation checks are separately recorded in Evidence.

ID / stage	Required proof	Failure / boundary
GJ-PREF /01	NO residence + SE/GB work countries; 0..N choices; second-device persistence; explicit save/default actions	No nationality requirement or silent permanent override
GJ-REV /01,06	Concurrent preference/search writes; stale response preserves draft, expected revision at DB write; deleted account cannot schedule	No acknowledged edit loss, tenant bleed or stale worker notification
GJ-LANG /01,05,08	English/local prominence; native labels, More Languages, Coming Later; independent advert/UI/document language; missing keys/plurals/errors	No enabled unqualified locale or false Swedish/Nynorsk completion
GJ-LOC /02	Whole Warwickshire → Warwick only → Warwick OR Leamington → whole county after clearing towns; parent remains scope; deselect clears descendants	No parent-wide OR after refinement, no auto-child checkboxes or hidden filters
GJ-LOC-DATA /02	Vestfold/Tønsberg/Sandefjord, Vestland/Bergen, Oslo dual type, Stockholm and UK unitary/overlap data; real versioned IDs	No district used as town, no substring precision or old-ID silent broadening
GJ-RADIUS /02	Known point inside/on/outside 10/25/50km, multiple origins, country constraint, absent/coarse coordinate, remote eligibility	No county-centroid false pass, driving-time or worldwide-remote claim
GJ-OCC /03	Ten sector groups × EN/Bokmål/SV queries; aliases, ambiguity, exact/related/free keyword; cancellation and outage	No IT-only vocabulary, lost unknown term or silent broadening
GJ-RIGHTS /04	Deny unapproved capability in API/details/cache/export/notifications; reviewed manifests/grants and source labels	Public documentation/key/fixture cannot stand in for commercial grant
GJ-NAV /04	Complete bootstrap, durable cursor, replay/out-of-order/update/INACTIVE/masking/expiry and changed geography; crash/429/401	No stale contact exposure, skipped deletion, fake live search or public-token production mode
GJ-SE /04	JobSearch permitted details; JobAd Links truncated text/original link/IDs/daily freshness/window; 404	No follow-up third-party scrape or exhaustive result count from bounded window
GJ-GB /04	Commercial Adzuna grant + permitted snippet/redirect; NHS/DWP connector only if independently approved	External/manual fallback shown honestly; no trial-based ongoing production
GJ-FINN /04	New discovery and existing preview/import flows perform zero FINN network calls; manual URL/fields work	Plugin/network parsers cannot bypass source-rights denial
GJ-DEDUP /04,06	Same authoritative ID clusters; similar teacher/restaurant vacancies stay distinct; one source withdraws	No false automatic merge or rights borrowed across duplicates
GJ-DETAIL /05	Desktop 3-pane, tablet, mobile full detail/deep link; salary period/currency/prediction/unknown; original completeness/provenance	Missing fact never invented; restricted content absent from API and DOM
GJ-ALERT /06	Initial baseline, daily/weekly/timezone/DST, cross-search dedupe, pause/unsubscribe, restart/duplicate worker, changed search, withdrawn before send	No spam, stale/expired alert or another user's data; ambiguous email retry reported
GJ-MATCH /06	Explicit Career fact/version + advert requirement + ESCO relation; regulated licence absent/unknown, cleaner/no profile	No inferred fluency/authorisation/hiring probability or AI requirement
GJ-TRACK /06	Save versus Track distinction; reviewed idempotent application association and native CV/letter flow	Preserve Job/Application split, revisions/history/null inheritance/frozen packages
GJ-ADMIN /07	Rights/access/health/lag/backlog/quota/expiry, system sync versus owned import, correlation/structured redaction	Server Admin denial on list/detail/stream/export, no fake owner or raw host logs
GJ-SEC /04–08	SSRF DNS/private IP/redirect/credential leakage, malformed oversized compressed payload, unsafe HTML/links/images, injection, pagination loops, tenant IDs	Zero accepted critical data loss, isolation failure, misleading rights/content or secret exposure
GJ-PRIV /06–08	Preferences/bookmarks/subscriptions export+erase, contact minimization, queued alert cancellation, source revocation and restored-backup suppression	Copied provider content not exempted as “user data”; lawful frozen-history policy separately approved
GJ-OPS /07–08	DB cursor/lease failure, worker crash, provider/index outage, bounded fanout/backoff, additive migration and previous-binary rollback	No loss of user records; rollback cannot republish deleted source data
GJ-PRESERVE /08	All57 functionality groups/33 routes, Career/CV/import/application/RD21/letter/package/PDF regressions at frozen integrated source	No weakening old acceptance or replacing manual/provider evidence with fixtures
GJ-A11Y /05,08	Keyboard/screen-reader semantics, focus recovery, reduced motion, themes, 200% zoom, 320/390/768/1440 CSS widths, actual device/native-language review	Automated axe incomplete results stay incomplete; emulation is not physical device acceptance

Proposed quantitative qualification protocol

Approve before feature performance/relevance claims; targets here are not measured. Use frozen dataset, hardware/runtime/config, warm/cold distinction, 20 concurrent search clients for 10 minutes, source-cached versus upstream latency reported separately, error counts and DB query plans. Suggested capacity corpus: 250k active source ads, 1m lifecycle events, 10k private saved searches; synthetic records cover all countries/sectors, geography precision and deletion rates.

• Autocomplete: warmed local p95 <=200ms for 10 suggestions, UI debounce measured separately. Relevant suggestion precision@5 >=0.90 / recall@5 >=0.80 for every sector/language, frozen/native-reviewed labels.
• Local indexed search: warmed p95 <=500ms for page50; API aggregate p95 <=2s when upstream meets bounded timeout. Do not conceal slow upstream by returning stale/rights-invalid data. Missing upstream results must be partial, not exact-global counts.
• Feed: proposed healthy NAV steady-state lag p95 <=2min after observation availability; local observed withdrawal suppression and queued-alert cancellation <=60s. Provider terms requiring immediate changes take precedence; validate actual polling/lag with NAV and do not call these target windows a permission to delay removal. Stale/outage policy must fail closed.
• Delivery: zero duplicate in-app notification for identical delivery key under retries/crash; proposed per-owner daily digest consolidation and max1 daily email digest unless explicitly chosen weekly. External mail ambiguity remains observable, not “exactly once”.
• Data/security/rights: zero accepted canonical data loss, unauthorized cross-owner access, unlicensed full-content display, fabricated credentials or secret leakage. These do not depend on statistical sample averages.

Evidence accounting

Every result records test ID/native command/config, source SHA plus dirty/input hashes, fixture/dataset/licence version, environment, timestamp, native exit, discovered/passed/failed/skipped and reason. Keep RED and corrected runs. Full-suite unique membership is primary; focused reruns are references, not extra passes. Staged passes do not establish integrated acceptance.

Separate lanes: local deterministic fixtures; actual MariaDB; hosted isolated CI; authorised live source contracts; human/native-language/device/AT; live-model semantic qualification; deployed identity; production. NOT RUN, BLOCKED and OPEN are not passes. A source needs legal eligibility AND technical tests before enabled capability GO. Production/main remain withheld regardless of development success.