{ "blueprint": "knowledge-base", "builder": "Claude, following the phase prompts in order (a fresh subagent per phase that saw only the spec and the build folder)", "testedSpecSha256": "b8c78cd9d618becd3bd2e6fd62ef1d4006f9990a6ec1aae16f7ea5a415aecbdb", "reviewDate": "2026-11-01", "reviewMethod": "Playwright scripts (Chromium) clicked through the build as the named seed people and asserted on what was on screen, with direct requests where a check says the server must refuse something; the Cards CSV was downloaded and parsed, and Slack commands were sent as real signed requests through the development tester. The run below is the single final run on a fresh database after all spec gaps were fixed, resetting to the seed before each phase's checks. Earlier per-phase runs found the gaps and are not counted. Results are final post-fix checks, not first-attempt success rates or an independent human audit.", "automatedTests": { "passed": 155, "total": 155, "command": "npm test", "rerunDuringReview": true }, "gapsFixed": 30, "runs": [ { "startedAt": "2026-11-01T09:00:32.635Z", "finishedAt": "2026-11-01T09:00:55.042Z", "phases": [ 1, 2, 3, 4 ], "passed": 31, "total": 31, "items": [ { "phase": 1, "text": "Signed in as Dana, Admin → People lists 11 people: 10 active and Kai Brooks inactive, with the teams from section 15, Dana Ruiz and Ben Cho as admins, and Maya Chen's Slack shown as \"not linked\".", "status": "pass", "evidence": "11 rows (10 active, Kai Brooks inactive); teams match section 15; admins: Ben Cho, Dana Ruiz; Maya Chen Slack: \"not linked\"" }, { "phase": 1, "text": "Signed in as Jo, Admin → People shows \"Admins only\" (also when opened by URL) and a direct request to save a person is refused.", "status": "pass", "evidence": "Nav for Jo: \"Search Collections My cards\". /admin/people by URL shows \"Admins only\". Direct POST /admin/people/a6ef9052-5d69-5202-aee3-6b6aeea62f9e as Jo: HTTP 403 \"Admins only Ask an admin if you need something changed here.\"; Tom Bennett unchanged (name, not admin)." }, { "phase": 1, "text": "Admin → Collections lists IT & Accounts (everyone; Ben Cho, Sam Okafor, Kai Brooks (inactive)), People & Policies (everyone; Ana Lima, Dana Ruiz), Sales playbook (Sales; Rosa Quinn, Lee Park) and Finance (Operations; Ana Lima).", "status": "pass", "evidence": "Finance (Operations; Ana Lima) | IT & Accounts (everyone; Ben Cho, Sam Okafor, Kai Brooks (inactive)) | People & Policies (everyone; Ana Lima, Dana Ruiz) | Sales playbook (Sales; Rosa Quinn, Lee Park)" }, { "phase": 1, "text": "Adding Jo Park as an editor of Sales playbook is refused with \"Jo Park can't see Sales playbook, so they can't edit it.\" Changing Finance to be visible to Sales only is refused with \"Ana Lima edits Finance and couldn't see it any more. Remove them as an editor first.\"", "status": "pass", "evidence": "Add Jo Park to Sales playbook: \"Jo Park can't see Sales playbook, so they can't edit it.\" (editors still: Rosa Quinn Remove Lee Park Remove). Finance → Sales only: \"Ana Lima edits Finance and couldn't see it any more. Remove them as an editor first.\"; Finance still visible to Operations." }, { "phase": 1, "text": "Deleting the Sales team is refused with \"Sales has 2 people and is used by 1 collection, so it can't be deleted.\", and deleting IT & Accounts with \"IT & Accounts has 6 cards, so it can't be deleted.\"", "status": "pass", "evidence": "Delete Sales team: \"Sales has 2 people and is used by 1 collection, so it can't be deleted.\". Delete IT & Accounts: \"IT & Accounts has 6 cards, so it can't be deleted.\". Both still listed." }, { "phase": 1, "text": "Dana removes Ben's admin flag, and removing her own is refused with \"At least one active admin is needed.\" Deactivating Tom Bennett works, and signing in as Tom then shows \"Ask an admin to add you.\"", "status": "pass", "evidence": "Ben Cho admin flag removed. Dana removing her own: \"At least one active admin is needed.\" (still admin). Tom Bennett deactivated (Active: inactive). Signing in as Tom shows \"Ask an admin to add you.\" and no signed-in name." }, { "phase": 1, "text": "The toolbar shows \"Today: Wed 14 Oct 2026, 09:00 (America/New_York)\" and \"+1 day\" changes it to Thu 15 Oct. \"Reset to seed data\" sets it back, makes Ben an admin again and Tom active again.", "status": "pass", "evidence": "\"Today: Wed 14 Oct 2026, 09:00 (America/New_York)\" → +1 day → \"Today: Thu 15 Oct 2026, 09:00 (America/New_York)\" → reset → \"Today: Wed 14 Oct 2026, 09:00 (America/New_York)\"; Ben Cho admin again, Tom Bennett active again." }, { "phase": 2, "text": "Signed in as Jo, Collections shows \"IT & Accounts · 5 cards · 2 verified (40%)\" and \"People & Policies · 3 cards · 2 verified (67%)\", and not Sales playbook or Finance; opening KB-107 by URL shows \"Not found\". Signed in as Lee, Sales playbook also shows \"1 card · 1 verified (100%)\".", "status": "pass", "evidence": "Jo: \"IT & Accounts · 5 cards · 2 verified (40%)\", \"People & Policies · 3 cards · 2 verified (67%)\" (2 collections). /cards/107 as Jo: \"Not found\" (JSON request HTTP 404). Lee: \"Sales playbook · 1 card · 1 verified (100%)\"." }, { "phase": 2, "text": "KB-101 shows \"Verified by Ben Cho on Tue 13 Oct · next review by Mon 11 Jan 2027\" and \"Updated Tue 13 Oct by Ben Cho: Moved from Cisco AnyConnect to Tailscale\". History lists version 2 and version 1, and Compare marks \"Install Cisco AnyConnect from the Self Service app.\" with \"-\" and \"Install Tailscale from tailscale.com/download.\" with \"+\".", "status": "pass", "evidence": "Trust: Verified, \"Verified by Ben Cho on Tue 13 Oct · next review by Mon 11 Jan 2027\". \"Updated Tue 13 Oct by Ben Cho: Moved from Cisco AnyConnect to Tailscale\". History: versions 2, 1. Compare: - Install Cisco AnyConnect from the Self Service app. / - Sign in with your company email and password. / + Install Tailscale from tailscale.com/download. / + Sign in with your company Google account. / + If your laptop isn't listed, message Ben Cho." }, { "phase": 2, "text": "KB-103 shows \"Review was due Sun 4 Oct.\", KB-104 \"Edited by Sam Okafor on Tue 13 Oct. Waiting for Ben Cho to verify.\", KB-105 \"Flagged by Jo Park on Mon 12 Oct: The meal limit changed to $60 in October.\", KB-109 \"Verified by Dana Ruiz on Mon 2 Mar · doesn't expire\" and KB-112 \"Needs a new owner: Kai Brooks is inactive.\"", "status": "pass", "evidence": "KB-103 Unverified: \"Review was due Sun 4 Oct.\"; KB-104 Unverified: \"Edited by Sam Okafor on Tue 13 Oct. Waiting for Ben Cho to verify.\"; KB-105 Unverified: \"Flagged by Jo Park on Mon 12 Oct: The meal limit changed to $60 in October.\"; KB-109 Verified: \"Verified by Dana Ruiz on Mon 2 Mar · doesn't expire\"; KB-112 Unverified: \"Needs a new owner: Kai Brooks is inactive.\"" }, { "phase": 2, "text": "Signed in as Sam, KB-104 has no Verify button and a direct request to verify it is refused with \"Only the card's owner, Ben Cho, can verify it.\" Signed in as Ben, Verify makes it \"Verified by Ben Cho on Wed 14 Oct · next review by Tue 12 Jan 2027\", and Collections shows \"IT & Accounts · 5 cards · 3 verified (60%)\".", "status": "pass", "evidence": "Sam: no Verify button; direct POST /cards/104/verify → HTTP 403 \"Only the card's owner, Ben Cho, can verify it.\". Ben clicks Verify: \"Verified by Ben Cho on Wed 14 Oct · next review by Tue 12 Jan 2027\". Collections: \"IT & Accounts · 5 cards · 3 verified (60%)\"." }, { "phase": 2, "text": "Signed in as Tom, flagging KB-106 with \"Is this still 20 days after the new policy?\" makes it \"Flagged by Tom Bennett on Wed 14 Oct: Is this still 20 days after the new policy?\". Flagging it again is refused with \"You already flagged this card.\" Signed in as Ana, a direct request to flag KB-106 is refused with \"You own this card. Edit or verify it instead.\"", "status": "pass", "evidence": "Tom flags KB-106: \"Flagged by Tom Bennett on Wed 14 Oct: Is this still 20 days after the new policy?\". Again: \"You already flagged this card.\". Ana direct POST: HTTP 403 \"You own this card. Edit or verify it instead.\"." }, { "phase": 2, "text": "Signed in as Ana, publishing an edit of KB-105 without a change note is refused with \"Say what changed in 3 to 200 characters.\" With the body changed from $50 to $60, the note \"Meal limit is now $60\" and \"Verify now\" ticked, it becomes version 2, shows \"Verified by Ana Lima on Wed 14 Oct · next review by Tue 12 Jan 2027\", and Jo's flag shows as resolved.", "status": "pass", "evidence": "No note: \"Say what changed in 3 to 200 characters.\". After publish: version 2, \"Verified by Ana Lima on Wed 14 Oct · next review by Tue 12 Jan 2027\"; open flags: 0; Activity: \"Wed 14 Oct 09:00 · Ana Lima · Published version 2 and verified it and resolved 1 flag Mon 12 Oct 10:00\"." }, { "phase": 2, "text": "Signed in as Sam, the editor for KB-102 has no \"Verify now\". After he publishes an edit with the note \"Added the sign-in screen steps\", KB-102 shows \"Edited by Sam Okafor on Wed 14 Oct. Waiting for Ben Cho to verify.\" and its Activity lists the update by Sam Okafor.", "status": "pass", "evidence": "Sam's editor for KB-102 has no Verify now. After publishing: \"Edited by Sam Okafor on Wed 14 Oct. Waiting for Ben Cho to verify.\". Activity first line: \"Wed 14 Oct 09:00 · Sam Okafor · Published version 2\"." }, { "phase": 2, "text": "Signed in as Jo, opening the draft KB-110 by URL shows \"Not found\". Signed in as Ana, she publishes it as its owner with \"Verify now\" ticked: it shows Verified, and Collections shows \"People & Policies · 4 cards · 3 verified (75%)\".", "status": "pass", "evidence": "Jo /cards/110: \"Not found\". Ana publishes with Verify now: Verified, \"Verified by Ana Lima on Wed 14 Oct · next review by Tue 12 Jan 2027\". Collections: \"People & Policies · 4 cards · 3 verified (75%)\"." }, { "phase": 2, "text": "Signed in as Dana, a direct request to make Jo Park the owner of KB-112 is refused with \"Jo Park isn't an editor of IT & Accounts.\" Changing its owner to Ben Cho shows \"Not verified yet. Waiting for Ben Cho.\" Signed in as Ben, archiving KB-103 removes it from the IT & Accounts list and its page shows \"Archived on Wed 14 Oct by Ben Cho.\"; restoring it shows \"Restored on Wed 14 Oct. Waiting for Ben Cho to verify.\"", "status": "pass", "evidence": "Dana direct POST owner=Jo Park: HTTP 400 \"Jo Park isn't an editor of IT & Accounts.\". Owner → Ben Cho: \"Not verified yet. Waiting for Ben Cho.\". Ben archives KB-103: page shows \"Archived on Wed 14 Oct by Ben Cho.\"; IT & Accounts list: KB-101 How do I connect to the VPN? Verified Verified by Ben Cho on Tue 13 Oct · next review by Mon 11 Jan 2027 KB-102 How do I reset my laptop password? Unverified Edited by Sam Okafor on Wed 14 Oct.. Restored: \"Restored on Wed 14 Oct. Waiting for Ben Cho to verify.\"." }, { "phase": 3, "text": "Signed in as Jo, Search with an empty box shows Recently changed starting with \"KB-104 Who approves software purchases? · Tue 13 Oct · Sam Okafor · Added the $500 yearly limit\", then KB-101 with \"Moved from Cisco AnyConnect to Tailscale\", and ending with \"KB-106 How many vacation days do I get? · Thu 8 Jan · Ana Lima · Published\" as the 10th line (archived KB-111 is never listed).", "status": "pass", "evidence": "1. KB-104 Who approves software purchases? · Tue 13 Oct · Sam Okafor · Added the $500 yearly limit | 2. KB-101 How do I connect to the VPN? · Tue 13 Oct · Ben Cho · Moved from Cisco AnyConnect to Tailscale | 3. KB-105 How do I submit an expense? · Mon 14 Sep · Ana Lima · Published | 4. KB-103 What is the office Wi-Fi password? · Fri 4 Sep · Ben Cho · Published | 5. KB-104 Who approves software purchases? · Mon 3 Aug · Ben Cho · Published | 6. KB-102 How do I reset my laptop password? · Mon 20 Jul · Ben Cho · Published | 7. KB-101 How do I connect to the VPN? · Mon 6 Jul · Ben Cho · Published | 8. KB-112 How do I set up two-factor sign-in? · Mon 6 Apr · Kai Brooks · Published | 9. KB-109 How do I book a meeting room? · Mon 2 Mar · Dana Ruiz · Published | 10. KB-106 How many vacation days do I get? · Thu 8 Jan · Ana Lima · Published" }, { "phase": 3, "text": "Signed in as Jo, \"vpn not working\" returns only KB-101, and \"password\" returns KB-102 and then KB-103, which shows \"Review was due Sun 4 Oct.\"", "status": "pass", "evidence": "\"vpn not working\" → KB-101. \"password\" → KB-102, KB-103; KB-103 shows \"Review was due Sun 4 Oct.\"." }, { "phase": 3, "text": "Signed in as Jo, \"laptop\" returns KB-102, KB-101 and KB-112 in that order, and \"office\" returns KB-103 and then KB-109, without KB-110.", "status": "pass", "evidence": "\"laptop\" → KB-102, KB-101, KB-112. \"office\" → KB-103, KB-109 (no KB-110)." }, { "phase": 3, "text": "Signed in as Jo, \"How do I get reimbursed for meals?\" returns only KB-105, \"Wi-Fi\" returns KB-103, and \"the and of\" shows \"Type a word to search for.\"", "status": "pass", "evidence": "\"How do I get reimbursed for meals?\" → KB-105. \"Wi-Fi\" → KB-103. \"the and of\" → \"Type a word to search for.\"" }, { "phase": 3, "text": "Signed in as Jo, \"discount\" shows \"No cards match \"discount\".\" Signed in as Lee, \"discount\" returns KB-107.", "status": "pass", "evidence": "Jo \"discount\" → \"No cards match \"discount\".\". Lee \"discount\" → KB-107." }, { "phase": 3, "text": "Signed in as Dana, Insights shows 6 of 10 verified (60%) with IT & Accounts 40%, People & Policies 67%, Sales playbook 100% and Finance 100%; Needs review lists Ana Lima: KB-105, Ben Cho: KB-103 and KB-104, and Kai Brooks (inactive): KB-112; Searches with no results lists parking pass 3, payroll date 2, discount 1 and dental plan 1, in that order, with no names.", "status": "pass", "evidence": "\"60% · 6 of 10 verified (60%)\"; by collection {\"Finance\":\"100%\",\"IT & Accounts\":\"40%\",\"People & Policies\":\"67%\",\"Sales playbook\":\"100%\"}. Needs review: Ana Lima: KB-105; Ben Cho: KB-103 and KB-104; Kai Brooks (inactive): KB-112. Searches with no results: parking pass 3, payroll date 2, discount 1, dental plan 1 (no names)." }, { "phase": 3, "text": "Signed in as Ben, \"shared drive\" shows \"No cards match \"shared drive\".\" even though KB-111 is archived in his collection. Signed in as Dana, Export downloads a Cards CSV with 12 rows: KB-103 has trust unverified, trust_reason \"Review was due Sun 4 Oct.\" and verified_until 2026-10-04, KB-101 has verified_at 2026-10-13T14:00:00Z, and KB-110 has status draft, empty trust and version 0.", "status": "pass", "evidence": "Ben \"shared drive\" → \"No cards match \"shared drive\".\". Export file cards-2026-10-14.csv: 12 rows, columns number,title,collection,status,trust,trust_reason,owner,owner_email,review_interval_days,verified_at,verified_by,verified_until,version,updated_at,updated_by,open_flags,tags,questions. KB-103 trust=unverified, trust_reason=\"Review was due Sun 4 Oct.\", verified_until=2026-10-04; KB-101 verified_at=2026-10-13T14:00:00Z; KB-110 status=draft, trust=\"\", version=0." }, { "phase": 4, "text": "A request to /api/cron/tick without the Authorization header gets 401. \"Run scheduled job now\" at the seed clock adds one email, to Ben Cho: \"KB-103 is overdue for review (due Sun 4 Oct)\", with status logged. Running it again adds nothing.", "status": "pass", "evidence": "POST /api/cron/tick without header: HTTP 401 (GET with a wrong bearer: 401). First run adds Ben Cho: \"KB-103 is overdue for review (due Sun 4 Oct)\" (review_overdue, logged). Second run: outbox still 1 row." }, { "phase": 4, "text": "Set the clock to Mon 19 Oct 2026, 09:00 and run the job. The outbox gains exactly one email, to Rosa Quinn: \"KB-107 needs review by Sun 25 Oct\".", "status": "pass", "evidence": "Clock \"Today: Mon 19 Oct 2026, 09:00 (America/New_York)\"; job adds exactly Rosa Quinn: \"KB-107 needs review by Sun 25 Oct\" (review_due, logged)." }, { "phase": 4, "text": "In the Slack command tester, as Jo Park, \"vpn not working\" gets HTTP 200 with response_type ephemeral, \"1 card matches \"vpn not working\":\" and \"KB-101 How do I connect to the VPN? · Verified\". The request \"payroll date\" sent with \"Wrong signature\" gets 401, and so does one with \"Timestamp 10 minutes old\".", "status": "pass", "evidence": "Signed \"vpn not working\": HTTP 200, ephemeral, text \"1 card matches \"vpn not working\": / KB-101 How do I connect to the VPN? · Verified · http://localhost:3100/cards/101\". \"payroll date\" wrong signature: HTTP 401; timestamp 10 minutes old: HTTP 401." }, { "phase": 4, "text": "In the tester, as Jo Park, \"discount\" replies \"No cards match \"discount\".\" and \"post KB-101\" replies with response_type in_channel and the line \"Verified by Ben Cho on Tue 13 Oct\". As Lee Park, \"post KB-107\" replies \"KB-107 is in a collection not everyone can see, so it can't be posted to a channel.\" As an unlinked Slack user, any text replies \"Your Slack account isn't linked to the knowledge base. Ask an admin to link it in Admin → People.\"", "status": "pass", "evidence": "Jo \"discount\": \"No cards match \"discount\".\". Jo \"post KB-101\": in_channel, lines: KB-101 How do I connect to the VPN? / Verified by Ben Cho on Tue 13 Oct · next review by Mon 11 Jan 2027 / Install Tailscale from tailscale.com/download. Sign in with your company Google account. If your laptop isn't listed, message Ben Cho. / http://localhost:3100/cards/101. Lee \"post KB-107\": ephemeral \"KB-107 is in a collection not everyone can see, so it can't be posted to a channel.\". U0NOBODY \"vpn\": \"Your Slack account isn't linked to the knowledge base. Ask an admin to link it in Admin → People.\"." }, { "phase": 4, "text": "Signed in as Tom, flagging KB-106 adds \"Tom Bennett flagged KB-106: How many vacation days do I get?\" for Ana Lima. Signed in as Ana, verifying KB-106 adds \"Ana Lima verified KB-106 after your flag\" for Tom Bennett.", "status": "pass", "evidence": "Tom flags KB-106 → Ana Lima: \"Tom Bennett flagged KB-106: How many vacation days do I get?\" (flagged, logged). Ana verifies → Tom Bennett: \"Ana Lima verified KB-106 after your flag\" (flag_resolved, logged)." }, { "phase": 4, "text": "Signed in as Ben, publishing an edit of KB-101 with the note \"Added the Linux client\", \"Verify now\" and \"Notify followers\" ticked adds \"KB-101 updated: How do I connect to the VPN?\" for Jo Park and Lee Park, and nothing for Ben.", "status": "pass", "evidence": "Ben publishes KB-101 version 3 → Lee Park: \"KB-101 updated: How do I connect to the VPN?\" (card_updated, logged); Jo Park: \"KB-101 updated: How do I connect to the VPN?\" (card_updated, logged); nothing for Ben Cho." }, { "phase": 4, "text": "Signed in as Sam, publishing an edit of KB-102 adds \"Sam Okafor edited KB-102. Please verify it.\" for Ben Cho. Signed in as Dana, Link Slack accounts with no SLACK_BOT_TOKEN set shows \"Slack isn't configured. Set SLACK_BOT_TOKEN first.\"", "status": "pass", "evidence": "Sam publishes KB-102 → Ben Cho: \"Sam Okafor edited KB-102. Please verify it.\" (verify_request, logged). Link Slack accounts: \"Slack isn't configured. Set SLACK_BOT_TOKEN first.\"" }, { "phase": 4, "text": "Signed in as Dana, Insights now lists discount with 1 search (from the tester), and payroll date still with 2, because the request with the wrong signature wrote nothing.", "status": "pass", "evidence": "Searches with no results: parking pass 3, payroll date 2, discount 1, dental plan 1." } ] } ], "notTested": [ "Production sign-in: a trusted-email-header path for a sign-in proxy was built, but every check used the development \"sign in as\" switcher.", "Real email delivery: notifications and review reminders were written to the outbox and logged, not sent; the optional email provider was exercised only against a fake in automated tests.", "A real Slack workspace: /kb was tested with signed requests from the development Slack command tester, and Link Slack accounts only without a bot token.", "The hourly job on a real scheduler: it ran from \"Run scheduled job now\" with the development clock, and /api/cron/tick was called directly without the secret and with a wrong one.", "Two editors saving the same card at once from two browsers: the version check is covered by automated tests only.", "Spec fixes that no acceptance check covers (status codes, cross-site posts, APP_URL, Slack escaping) were written after the build; the test build handles these through its own choices.", "Hosting: the build ran on SQLite on one server." ] }