{
 "blueprint": "employee-onboarding",
 "builder": "Claude, following the phase prompts in order (a fresh subagent per phase that saw only the spec and the build folder)",
 "testedSpecSha256": "ffef1ff39d1c9de6010140bb1913ede799399958cac7b98fd2f3eb86e07da10d",
 "reviewDate": "2026-11-02",
 "reviewMethod": "Playwright scripts (Chromium) clicked through the build as the named seed people and asserted on what was on screen, with direct requests where a check says the server must refuse something; outbox emails were read on Admin: Outbox, the scheduled job was run from the development \"Run scheduled job now\" control with the development clock, and the Tasks CSV was downloaded and parsed. The run below is the single final run on a fresh database after all spec gaps were fixed, resetting to the seed before each phase's checks. Earlier per-phase runs found the gaps and are not counted. Results are final post-fix checks, not first-attempt success rates or an independent human audit.",
 "automatedTests": {
  "passed": 109,
  "total": 109,
  "command": "npm test",
  "rerunDuringReview": true
 },
 "gapsFixed": 44,
 "runs": [
  {
   "startedAt": "2026-11-02T09:56:46.620Z",
   "finishedAt": "2026-11-02T09:56:58.981Z",
   "phases": [
    1,
    2,
    3,
    4
   ],
   "passed": 20,
   "total": 20,
   "items": [
    {
     "phase": 1,
     "text": "Signed in as Dana, Templates shows Standard with 14 tasks and the Sales and Design add-ons, with each task's role and offset.",
     "status": "pass",
     "evidence": "Standard (Base template, \"14 tasks\"): Send welcome email and first-week schedule (Manager, -10 days); Order laptop (IT, -7 days); Create Google Workspace and Slack accounts (IT, -5 days); Add to payroll and benefits (People team, -5 days); Pick a buddy and introduce them (Manager, -3 days); Prepare desk or ship equipment (IT, -1 day); Welcome meeting and tour (Manager, 0 (start date)); Sign in and read the handbook (New hire, 0 (start date)); Coffee with your buddy (Buddy, 0 (start date)); Set 30-60-90 day goals (Manager, +4 days); Complete security training (New hire, +4 days); 30-day check-in (Manager, +30 days); 60-day check-in (Manager, +60 days); 90-day review (Manager, +90 days). Add-ons: Sales: Shadow three sales calls (Buddy, +2 days); CRM training (New hire, +10 days); Design: Design system walkthrough (Buddy, +2 days)."
    },
    {
     "phase": 1,
     "text": "Signed in as Ben, Templates says \"Only the people team can open this page.\" and a direct request to edit a template is refused.",
     "status": "pass",
     "evidence": "/templates as Ben: \"Not allowed Only the people team can open this page. Back to home\". Direct POST /templates/tpl_standard (rename to \"Hacked by Ben\") as Ben: HTTP 403 \"Only the people team can do this.\"; direct POST to edit task \"Order laptop\": HTTP 403. Signed in as Dana afterwards: template still \"Standard\", task 2 still \"Order laptop\"."
    },
    {
     "phase": 1,
     "text": "Signing in as Priya Nair is refused with \"Your account opens on\" followed by her start date.",
     "status": "pass",
     "evidence": "Admin: People shows Priya Nair's start date Mon Nov 16. Sign in as Priya Nair: \"Sign in Your account opens on Mon Nov 16.\"; header does not show her as signed in."
    },
    {
     "phase": 1,
     "text": "Deactivating Ben Cho is refused with a message naming his open tasks.",
     "status": "pass",
     "evidence": "Deactivate on Ben Cho as Dana: \"Reassign Ben Cho's 6 open tasks first: Order laptop (Priya Nair); Create Google Workspace and Slack accounts (Priya Nair); Prepare desk or ship equipment (Priya Nair); Order laptop (Kai Brooks); Create Google Workspace and Slack accounts (Kai Brooks); Prepare desk or ship equipment (Kai Brooks). Ben Cho is the IT owner in Admin: Settings. Choose another IT owner first.\". Admin: People still shows Ben Cho Active."
    },
    {
     "phase": 2,
     "text": "Creating an onboarding for a new person starting Monday Oct 26, 2026 with the Standard template and Ana Lima as buddy shows the due dates in section 6, including \"Prepare desk or ship equipment\" on Fri Oct 23 and \"90-day review\" on Fri Jan 22, 2027.",
     "status": "pass",
     "evidence": "Rosa Diaz (new person, start 2026-10-26, Standard, buddy Ana Lima): the preview listed every section 6 date, and the created onboarding (14 tasks) shows Send welcome email and first-week schedule: Fri Oct 16; Order laptop: Mon Oct 19; Create Google Workspace and Slack accounts: Wed Oct 21; Prepare desk or ship equipment: Fri Oct 23; Welcome meeting and tour: Mon Oct 26; Set 30-60-90 day goals: Fri Oct 30; 30-day check-in: Wed Nov 25; 60-day check-in: Fri Dec 25; 90-day review: Fri Jan 22, 2027."
    },
    {
     "phase": 2,
     "text": "Creating an onboarding with the Sales add-on and no buddy is refused with a message saying how many tasks are for the buddy.",
     "status": "pass",
     "evidence": "Standard + Sales, no buddy, for Tom Reyes: refused with \"Choose a buddy: 2 tasks are for the buddy.\". Onboardings still lists 4 (no Tom Reyes)."
    },
    {
     "phase": 2,
     "text": "Moving Priya Nair's start date one week later moves every open task by 7 days, keeps \"Send welcome email\" (done) on its date, and logs the old and new start dates.",
     "status": "pass",
     "evidence": "Start date Mon Nov 16 -> Mon Nov 23. 15 open tasks moved by 7 days (e.g. Order laptop Mon Nov 9 -> Mon Nov 16; 90-day review Fri Feb 12, 2027 -> Fri Feb 19, 2027); \"Send welcome email and first-week schedule\" (Done) stayed Fri Nov 6. Activity: \"Mon Nov 2, 08:00 Dana Ruiz moved the start date from Mon Nov 16 to Mon Nov 23 (15 open tasks moved).\"."
    },
    {
     "phase": 2,
     "text": "Signed in as Ben, My tasks shows \"Order laptop\" for Priya Nair; completing it marks it done with his name and time.",
     "status": "pass",
     "evidence": "Ben's My tasks listed \"Order laptop\" for Priya Nair Starts Mon Nov 23. After Done (clock Mon Nov 2, 2026 08:00) it left My tasks, and Priya Nair's onboarding shows \"Done by Ben Cho, Mon Nov 2, 08:00\"."
    },
    {
     "phase": 2,
     "text": "Signed in as Ana Lima, opening Leo Grant's onboarding returns Not found, while Priya Nair's onboarding (where she is the buddy) opens.",
     "status": "pass",
     "evidence": "As Ana Lima: /onboardings/onb_leo -> HTTP 404 \"Not found Not found Back to home\"; /onboardings/onb_priya -> HTTP 200 with her buddy task \"Shadow three sales calls\"; Onboardings lists Priya Nair and not Leo Grant."
    },
    {
     "phase": 2,
     "text": "Skipping a task without a reason is refused; skipping \"Prepare desk or ship equipment\" with \"Fully remote\" counts it in progress as done or skipped.",
     "status": "pass",
     "evidence": "Skip with an empty reason: \"Give a reason for skipping (3 to 200 characters).\" (direct POST: HTTP 422); task stayed Open. Skip with \"Fully remote\": \"Skipped by Dana Ruiz, Mon Nov 2, 08:00 Reason: Fully remote\"; progress 2 of 16 done or skipped -> 3 of 16 done or skipped."
    },
    {
     "phase": 2,
     "text": "Completing the 30-day check-in without a note is refused; with a note, the note is visible to Maya and Dana but not to Jo Park (Leo's buddy).",
     "status": "pass",
     "evidence": "Complete check-in with no note (Maya): \"A check-in needs a note of 5 to 2,000 characters. Only the manager and the people team can read it.\"; direct POST: HTTP 422. With a note: Maya and Dana see \"Leo is settling in well; wants more time with the design system.\" on Leo Grant's onboarding; Jo Park opens it (HTTP 200), sees the 30-day check-in as \"Done by Maya Chen, Mon Nov 2, 08:00\", and the note text is not in the page HTML."
    },
    {
     "phase": 2,
     "text": "Cancelling Kai Brooks's onboarding requires a reason, makes it read-only, and emails everyone with open tasks without including the reason.",
     "status": "pass",
     "evidence": "Cancel with no reason: \"Give a reason for cancelling (3 to 200 characters).\". With \"Kai accepted another offer\": header \"Kai Brooks Cancelled\", no task buttons or Move start date, direct Done on a Kai task: HTTP 422 \"This onboarding is cancelled, so its tasks cannot change.\". Outbox: 3 \"Onboarding cancelled: Kai Brooks\" emails to Ben Cho, Dana Ruiz, Jo Park (every owner of an open task except Kai Brooks, the new hire), none containing the reason."
    },
    {
     "phase": 3,
     "text": "Signed in as Leo Grant, My first weeks shows his manager Maya Chen and buddy Jo Park, his own tasks, and \"What others are doing for you\" with titles, first names and done or not.",
     "status": "pass",
     "evidence": "Heading \"My first weeks\"; welcome: \"Welcome to Fernway, Leo! Your manager is Maya Chen and your buddy is Jo Park. You started on Mon Oct 26 as Product Designer.\". His own tasks: Complete security training (overdue), Sign in and read the handbook (done). \"What others are doing for you\": 13 rows with only Task, Who, Done, e.g. \"Order laptop | Ben | Done\", \"Set 30-60-90 day goals | Maya | Not yet\"; names used: Maya, Ben, Dana, Jo."
    },
    {
     "phase": 3,
     "text": "Leo completes \"Complete security training\" and it disappears from his overdue list.",
     "status": "pass",
     "evidence": "Before: Overdue listed \"Complete security training\". After Done: Overdue section \"Overdue 0\" is empty and the task is under Done."
    },
    {
     "phase": 3,
     "text": "Signed in as Maya, completing Leo's 30-day check-in with a note works. Signed in as Leo again, he cannot see that note or any skip reason, and a direct request for his onboarding's check-in note is refused.",
     "status": "pass",
     "evidence": "Maya completed the 30-day check-in with \"Leo is settling in well; wants more time with the design system.\" (\"Done by Maya Chen, Mon Nov 2, 08:00\") and skipped \"Set 30-60-90 day goals\" with \"Goals already set in the design team plan\". As Leo: My first weeks HTML and GET /api/my-first-weeks (HTTP 200) contain neither text; GET /api/tasks/tsk_leo_12/check-in-note -> HTTP 403 \"Check-in notes are private to the manager and the people team.\"; GET /onboardings/onb_leo -> HTTP 403 \"Your own checklist is on My first weeks, your home page.\"."
    },
    {
     "phase": 3,
     "text": "Leo opening Priya Nair's onboarding URL returns Not found.",
     "status": "pass",
     "evidence": "As Leo Grant: /onboardings/onb_priya -> HTTP 404 \"Not found Not found Back to home\"; no Priya Nair details on the page."
    },
    {
     "phase": 4,
     "text": "Running the job at 08:00 sends Jo Park no digest and sends Leo Grant one listing \"Complete security training\" as overdue; running it again the same day sends nothing new.",
     "status": "pass",
     "evidence": "Clock Mon Nov 2, 2026 08:00. Run 1: \"Last run: Scheduled job ran at Mon Nov 2 08:00 team time: 0 onboardings moved to in progress; 0 pre-start emails; 2 digests (Leo Grant, Maya Chen); 0 failed emails retried.\"; outbox 0 -> 2; digests to Maya Chen, Leo Grant (none to Jo Park). Leo Grant's digest \"Your onboarding tasks for Mon Nov 2\": \"Hi Leo, You have 1 onboarding task due today or overdue. Overdue (1): - Complete security training (your onboarding, due Fri Oct 30) Open My first weeks: /my-first-weeks\". Run 2 the same day: \"Last run: Scheduled job ran at Mon Nov 2 08:00 team time: 0 onboardings moved to in progress; 0 pre-start emails; 0 digests; 0 failed emails retried.\"; outbox still 2."
    },
    {
     "phase": 4,
     "text": "Moving the clock to 3 days before Priya Nair's start date and running the job emails Sam and Dana \"Priya Nair starts in 3 days\" with the open pre-start tasks, once.",
     "status": "pass",
     "evidence": "Priya Nair starts Mon Nov 16; clock set to Fri Nov 13, 2026 08:00. Run: \"Last run: Scheduled job ran at Fri Nov 13 08:00 team time: 0 onboardings moved to in progress; 2 pre-start emails (Priya Nair); 5 digests (Ben Cho, Dana Ruiz, L\". Outbox: \"Priya Nair starts in 3 days: 5 tasks still open\" to Dana Ruiz and Sam Okafor, each listing the 5 open pre-start tasks (Order laptop; Create Google Workspace and Slack accounts; Add to payroll and benefits; Pick a buddy and introduce them; Prepare desk or ship equipment) and not the done \"Send welcome email and first-week schedule\". Running again: still 2 pre-start emails."
    },
    {
     "phase": 4,
     "text": "Moving the clock to Priya Nair's start date and running the job changes her onboarding to In progress, and she can now sign in.",
     "status": "pass",
     "evidence": "Before: \"Priya Nair Upcoming\". Clock Mon Nov 16, 2026 08:00; run: \"Last run: Scheduled job ran at Mon Nov 16 08:00 team time: 1 onboarding moved to in progress (Priya Nair); 0 pre-start emails; 7 digests (An\". Onboardings shows Priya Nair \"In progress\". Sign in as Priya Nair works: header \"Fernway Onboarding My first weeks Priya Nair Sign out\", home \"My first weeks\" (\"Welcome to Fernway, Priya! Your manager is Sam Okafor and your buddy is Ana Lima. You started on Mon Nov 16 as\")."
    },
    {
     "phase": 4,
     "text": "After Maya completes Leo's 30-day check-in with a note, the tasks CSV lists every task with its owner and due date and does not contain that note.",
     "status": "pass",
     "evidence": "Maya completed Leo's 30-day check-in with \"Leo is settling in well; wants more time with the design system.\". Dana's Tasks CSV (tasks-2026-11-16.csv): columns Onboarding ID, Onboarding, Title, Owner, Due date, Status, Done date; 45 rows = every task on the 3 onboardings, each matching the owner and due date on its onboarding page (e.g. \"onb_leo,Leo Grant,30-day check-in,Maya Chen,2026-11-25,Done,2026-11-16\"). The note text does not appear in the file."
    }
   ]
  }
 ],
 "notTested": [
  "Production sign-in: a trusted-email-header path for a sign-in proxy, limited to the company email domain, was built, but every check used the development \"sign in as\" switcher.",
  "Real email delivery: creation, reassignment, cancellation, pre-start and digest emails were written to the outbox and logged, not sent; no email provider was configured.",
  "The hourly job on a real scheduler: it ran from \"Run scheduled job now\" with the development clock, and POST /api/jobs/hourly was called directly without the secret and with a wrong one (both 401).",
  "Daylight saving and other time zones: every check ran in America/New_York on dates in November 2026.",
  "Spec fixes that no acceptance check covers (status codes, retries, CSV formula escaping, production's first person) were written after the build; the test build handles these through its own choices.",
  "Hosting: the build ran on SQLite on one server."
 ]
}