Collect ASI CI, test, security and QA assessment evidence

Sub-tickets

Activity

• coder03-mba-l-ca created · 11h ago
  parent=#4648
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Identify or restore the GitLab/Tekton jobs after migration. Gather unit/integration/acceptance/performance coverage, code quality, SAST, DAST and dependency scan results required by ES0901, with remediation decisions. Reference existing MOVILBA-477 rather than duplicate its secret-scanner decision. Done when ASI records candidate assessment and blocking findings are resolved or formally accepted.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Collect release-specific CI, test, security and QA assessment evidence for ASI. Apply ES0901 v6.4 acceptance criteria, including at least 80% unit-test coverage and zero critical/major findings and zero urgent/high-priority open issues where the standard requires them; record any formal ASI exception rather than assuming a pass. Include reproducible build/test results, static/dynamic/OWASP evidence, QA assessment artifact, version/tag identity and responsible signoff. This is evidence for MOVILBA-825, not a DEV-pod health check.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Collect release-specific CI, test, security and QA assessment evidence for ASI. Apply ES0901 v6.4 acceptance criteria, including at least 80% unit-test coverage and zero critical/major findings and zero urgent/high-priority open issues where the standard requires them; record any formal ASI exception rather than assuming a pass. Include reproducible build/test results, static/dynamic/OWASP evidence, QA assessment artifact, version/tag identity and responsible signoff. Link existing MOVILBA-477 scanner decision rather than duplicate it. This is evidence for MOVILBA-825, not a DEV-pod health check.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Collect release-specific CI, test, security and QA assessment evidence for ASI. Apply ES0901 v6.4 criteria, including at least 80% unit coverage and zero critical/major findings and zero urgent/high-priority open issues where required; document formal exceptions. Include reproducible build/tests, JMeter core-flow plan/results, static/dynamic/OWASP evidence, ES0902 checks, fresh QA assessment artifact, candidate version/tag and named signoff. Link MOVILBA-477 rather than duplicate its scanner decision. Evidence feeds MOVILBA-825; DEV-pod health alone is insufficient.
• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART. HEAD 18da596f + package fab1b245 / runner 7a7b0858 exact pins. Tool suite, typecheck, targeted Node-aware ESLint, diff-check and negative controls. No ASI/DB/browser/deploy; not formal QA assessment. Node24.22.0 vs declared24.14.1.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART. HEAD 18da596f + package fab1b245 / runner 7a7b0858 exact pins. Tool suite, typecheck, targeted Node-aware ESLint, diff-check and negative controls. No ASI/DB/browser/deploy; not formal QA assessment. Node24.22.0 vs declared24.14.1.","outcome":"pass","evidence":"15 discovered files exactly match prior glob census. pnpm test:tools rc0:113 tests,111 pass,2 DB-dependent skips,0 fail. Missing/empty tools/tests each rc1. Isolated real failing test via tsx rc1 with intended failure visible: child failure propagates. pnpm typecheck rc0. Default ESLint ignores tools; explicit --no-ignore exposed missing Node ambient globals, then --no-ignore --global process --global console rc0. git diff --check clean, pins unchanged. No source-suite rerun; scoped runner change only. PASS does not certify sanitized package test availability, exact declared Node runtime, ASI assessment or all of MOVILBA-827.","reportRef":null}

• coder03-mba-l-ca commit · 9h ago
  Source candidate commit ae3f279cc948286fb8f426c79f9ac33d70e4c189 contains only audited package.json fab1b245 and tools/run-tool-tests.mjs 7a7b0858; release clone clean. No remote push, tag or QA deploy. This fixes false-green zero-test gate, not full 827 completion.
• coder03-mba-l-ca progress · 9h ago
  Dependency triage on offline QA draft a20ca849: npm audit measured 6 moderate/8 high affected package entries (including propagated parents), no critical; no concrete exploitable app path demonstrated by static review, but no security clearance. Next.js 16.3.7 and source-map-js need a scoped patched-version assessment; react-quill and xlsx2csv appear unused and need usage confirmation before removal. Avoid npm audit fix --force. Tooling-only issues require documented disposition for ASI assessment. Audit result tag audit-mba-l-ca-mvb3vh4w5bst; no dependency edit yet.
• coder03-mba-l-ca progress · 9h ago
  New release-gate issue: pnpm lint:strict rc1 with 8096 errors in unchanged vendored Scalar JS/scripts during MOVILBA-823 sanitizer audit. Need scoped baseline diagnosis/config correction and exact candidate lint gate before QA tag readiness; do not attribute those errors to the two-file sanitizer delta.
• audit-mba-l-ca audited · 9h ago
  audit pass: Exact eslint.config.mjs ce36b793 on bb03646e: strict lint, typecheck, diff-check, in-memory preimage/config controls. No package rebuild, DB, browser, tag, push or deploy. No QA-readiness verdict.
  payload

  {"scope":"Exact eslint.config.mjs ce36b793 on bb03646e: strict lint, typecheck, diff-check, in-memory preimage/config controls. No package rebuild, DB, browser, tag, push or deploy. No QA-readiness verdict.","outcome":"pass","evidence":"audit-mba-l-ca | 2026-10-16 ART. pnpm lint:strict rc0; pnpm typecheck rc0; diff-check clean. Sole modified path/hash reverified. ESLint API confirms exact Scalar asset ignored, neighboring vendor filename not ignored, owned check-lockfile-consistency.mjs not ignored and console readonly. Injected undefined identifier in owned script detected by no-undef. In-memory preimage removing only two new config entries reproduces 8092 errors on Scalar and four no-undef console errors on owned script. This closes measured 8096-error lint gate for these bytes without disabling lint for owned script. Node24.22.0 vs pinned24.14.1 warning remains. Prior artifact/dependency/QA-baseline limitations unaffected.","reportRef":null}

• coder03-mba-l-ca verified · 9h ago
  Focused lint config PASS on eslint.config.mjs SHA256 ce36b7930b652dbabab2a782a4b87b2cd38c4e5392fc901ed3acc964ee2cea3f at source bb03646e. pnpm lint:strict and typecheck rc0. In-memory preimage reproduces 8092 Scalar asset errors plus 4 owned script console errors; new config ignores only exact served Scalar asset and keeps owned script linted. Local commit requested; QA tag readiness and dependency assessment remain separate. Audit tag audit-mba-l-ca-mvb476d7iql3.