`verification/e2e-proof.json`

65 lines
{
  "intent": "Provide a read-only room-dimensions-to-roll-count API contract using the existing local calculator.",
  "risk_tier": "R1 isolated backend API; no production data or external integration",
  "environment": "local Node HTTP server on an ephemeral loopback port",
  "build_identity": "git parent 062bfad plus the owned Cycle 14 server/test/documentation diff",
  "timestamp": "2026-08-29T05:39:00Z",
  "ticket": "TK-10951-cap-json-bodies-and-validate-roll-snapshot",
  "precondition": "POST bodies were unbounded and decoded per stream chunk; roll loading silently returned an empty array without validating the complete snapshot.",
  "checks": [
    {
      "verdict": "PASS",
      "boundary": "calculation module",
      "command": "node --test test/calculate-coverage.test.js",
      "assertions": "11/11 pass: room dimensions map to rolls; exact canonical SKU outranks aliases; ambiguous and stand-in aliases fail; prototype pricing is withheld; coercible/oversized inputs and invalid roll specs fail closed"
    },
    {
      "verdict": "PASS",
      "boundary": "HTTP API",
      "command": "node --test test/calculate-coverage.test.js",
      "assertions": "ephemeral local POST returns HTTP 200 with labeled non-authoritative prototype coverage and null prices; empty input returns HTTP 400"
    },
    {
      "verdict": "PASS",
      "boundary": "syntax and diff",
      "command": "node --check server.js && git diff --check",
      "assertions": "server parses and diff has no whitespace errors"
    },
    {
      "verdict": "PASS",
      "boundary": "request size and JSON parsing",
      "command": "node --test test/calculate-coverage.test.js",
      "assertions": "all three POST routes return 413 above 16 KiB and 400 for malformed JSON; split multibyte UTF-8 round-trips exactly; invalid UTF-8, aborted streams, and premature close settle as 400"
    },
    {
      "verdict": "PASS",
      "boundary": "startup snapshot schema",
      "command": "node --test test/calculate-coverage.test.js",
      "assertions": "complete checked-in snapshot passes while empty, duplicate, invalid-spec, invalid-match, and invalid exact-match inputs fail"
    }
  ],
  "negative_checks": [
    "missing SKU",
    "unknown SKU",
    "zero width",
    "non-finite height",
    "fractional wall count",
    "boolean, string, and array dimensions",
    "dimensions beyond documented bounds",
    "false-match Shopify alias",
    "alias collision with exact canonical SKU and ambiguous aliases",
    "negative roll width/length/repeat and unsupported match",
    "non-finite estimator output from malformed roll data",
    "empty HTTP payload"
    ,"oversized HTTP payload"
    ,"malformed JSON"
    ,"invalid whole-snapshot schema"
    ,"split multibyte UTF-8 and invalid UTF-8"
    ,"aborted request stream"
    ,"noncanonical snapshot strings"
  ],
  "side_effects": "none; test server is ephemeral and closed by the test; no Shopify, dw_unified, lead, send, deploy, restart, or scheduled-job action",
  "cleanup": "ephemeral HTTP server closed after assertions",
  "verdict": "PASS for the local API journey"
}