Elijah/Study
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions
Study/audit-results/COVERAGE_MAP.md

4.6 KiB
Raw Blame History

Coverage Map

Mapping of repository areas → audit status → specialist report reference. Statuses: done / done+verified (parent-verified with runtime evidence) / partial.

Area Files Auditor Status Report ref
Prisma schema/migrations/transactions/cascades prisma/schema.prisma, prisma/migrations/*, prisma.config.ts, src/lib/db.ts, services DB specialist (task-1) done+verified (drift reproduced) sa_20260806_054030_000000000_5ed877563a0d
Quiz scoring/attempts/history/retakes/progress src/lib/scoring.ts, quizService, progressService, quizzes/*, api/quizzes/**, api/progress Quiz specialist (task-2) done+verified (server scoring path re-checked) sa_20260806_054030_000000000_e75a8ce575f9
Flashcards/SRS/progress/deletion/ordering flashcards/, spaced-repetition/, cardService, deckService, spacedRepetitionService, api/cards decks spaced-repetition-sets progress
Auth/protected routes/API authz/sharing src/proxy.ts, lib/auth.ts, authService, shareService, shareMetadata, api/auth/**, api/share, shared/*, all api routes Auth specialist (task-4) done+verified (proxy + fallback secret read directly) sa_20260806_054030_000000000_aab0c59dbad3
Imports/exports/generation/Zod/malformed input lib/validation/, jsonRepair, components/import/, api/decks quizzes material-groups settings
Material groups/library/drag-drop/deletion/orphans api/material-groups/**, reorder routes, library pages, classService Groups specialist (task-6) done sa_20260806_054030_000000000_9ae1f3dfa282
Frontend state/refresh/races/localStorage/boundaries all components + pages + shared viewers Frontend specialist (task-7) done sa_20260806_054030_000000000_0e17fd155702
Test quality/coverage gaps *.test.ts, vitest.config.ts, package.json, CI workflow Test specialist (task-8) done sa_20260806_054030_000000000_cd3652deb3f7
Docker/startup/env/scripts/production/recovery Dockerfile, docker-entrypoint.sh, compose files, package.json, prisma.config.ts, next.config.ts, .gitignore, CI Ops specialist (task-9) done sa_20260806_054030_000000000_f49cdaacaabf
Adversarial review (challenge Critical/High + missed issues) (all of the above + lightly-covered files) Adversarial specialist (task-10) done — 9/10 challenged findings confirmed/weakened, FE-06 refuted, 10 new issues added sa_20260806_055608_000000000_c550c742d5dc

Parent-level verification performed (see VERIFICATION_LOG.md and audit-results/tmp/)

  • npx prisma validate — PASS
  • npm test — PASS (30 tests: 20 arcade + 10 spacedRepetition)
  • npm run lint — 28 baseline problems (9 errors / 19 warnings), all pre-existing
  • npm run build — PASS (route table incl. "ƒ Proxy (Middleware)")
  • prisma migrate deploy on fresh temp DB — PASS (creates DB missing MaterialGroup/groupId → FIN-01 drift confirmed)
  • Temp DB introspection (audit-results/tmp/inspect-db.cjs) — MaterialGroup table and groupId columns absent
  • Prisma-shaped SQL against temp DB (audit-results/tmp/reproduce-drift.cjs) — no such column: Deck.groupId, no such table: MaterialGroup, no such column: ShareLink.groupId
  • FINDINGS.json validity — PASS (53 findings; validator audit-results/tmp/validate-findings.cjs)

Coverage gaps (areas NOT fully audited)

  1. Arcade feature internals — intentionally out of scope (may be removed). Only checked for shared-DB/build/deploy impact (Arcade models/indexes verified in migrations).
  2. Real browser interaction — no browser available in the audit environment: drag-drop, resume flows, share pages, keyboard a11y, theme behavior were code-verified only; findings needing runtime confirmation are flagged in UNVERIFIED_RISKS.md.
  3. Container build/run — docker CLI unavailable: OPS-02/FIN-22, FIN-06, FIN-24 need a container run to observe exact failure modes.
  4. git history deep-dive — limited to drift commit (7af0935), dev.db commits, and migration commits; other commits not diffed line-by-line.
  5. Committed dev.db blob contents — could not be fully enumerated (no sqlite3 CLI; blob grep only; no admin_password hash found in checked blobs).
  6. Live dev.db — none exists in the workspace; runtime behavior on a populated database (perf findings FIN-17) not measured.
  7. Network/remote behavior — the Forgejo remote and CI execution were not reachable; CI findings are static analysis of .forgejo/workflows/build.yml.
  8. External services — none (app calls no LLM/third-party APIs).