{
  "title": "Compass fix verification",
  "date": "2026-09-06",
  "branch": "fix/review-20260905",
  "baseline_head": "d6a057f9f8632c2ff7eff67fa7fa4ed013ce626a",
  "tested_head": "3cf81c1cc77add6ac25abfc4c5b24ee566fd9797",
  "baseline_examples": 2481,
  "final_examples": 2537,
  "failures": 0,
  "seed": 10459,
  "duration_seconds": 176.337799939,
  "findings": [
    {
      "id": 1,
      "title": "Back navigation erases account requirements",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Edited naming, domicile and custom rows survive Back/Next and Turbo Back; changed currencies reconcile rows."
    },
    {
      "id": 2,
      "title": "Admin email edits update an unused account column",
      "group": "Authentication",
      "status": "Verified",
      "evidence": "Credentials receive email changes through Devise reconfirmation; invalid account/credential updates roll back together."
    },
    {
      "id": 3,
      "title": "Deselected upload rows are still imported",
      "group": "Imports",
      "status": "Strengthened during verification",
      "evidence": "Selection is honored. Empty replacement imports are refused even without the selection marker, before deletion."
    },
    {
      "id": 4,
      "title": "Turning off 2FA calls a missing mailer",
      "group": "Authentication",
      "status": "Verified",
      "evidence": "Reset mail renders and its token is consumed under a row lock; signed-out removal and rejected tokens are covered."
    },
    {
      "id": 5,
      "title": "Wildcard capability form options cannot be saved",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Blank account currency/IBAN country and entity country normalize to the supported wildcard before validation."
    },
    {
      "id": 6,
      "title": "Document boolean false becomes supported true",
      "group": "Imports",
      "status": "Strengthened during verification",
      "evidence": "Native false remains false; blank supported values retain the accepted true default across document and edited rows."
    },
    {
      "id": 7,
      "title": "Failed imports commit earlier writes and deletions",
      "group": "Imports",
      "status": "Strengthened during verification",
      "evidence": "Nested transaction rollback holds. A later row persistence failure now rolls back replacement deletion and earlier writes."
    },
    {
      "id": 8,
      "title": "Either forwards accepts providers offering neither forward type",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Either forwards requires deliverable or NDF support in partner and prospect matching; neither does not qualify."
    },
    {
      "id": 9,
      "title": "Lookup details are mouse-only",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Provider disclosure uses a named native button with keyboard activation and synchronized expanded state."
    },
    {
      "id": 10,
      "title": "Rerun hides required forward fields",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Saved and rejected forward requirements immediately show populated controls; disabling forwards clears inactive fields."
    },
    {
      "id": 11,
      "title": "Request logs retain conversation content and authentication codes",
      "group": "Authentication",
      "status": "Verified",
      "evidence": "Real request-log sentinel checks cover derived transcript fields, OTP/reset secrets and nested recovery code; decisions are enum values."
    },
    {
      "id": 12,
      "title": "The six-digit 2FA challenge allows unlimited guesses",
      "group": "Authentication",
      "status": "Strengthened during verification",
      "evidence": "Separate atomic OTP budget survives password login. Numeric OTP input consumes budget; format and HEAD variants share IP throttles."
    },
    {
      "id": 13,
      "title": "Country-group searches misclassify partners and ignore restrictions",
      "group": "Matching",
      "status": "Strengthened during verification",
      "evidence": "Recorded-member jurisdiction semantics and per-member entity precedence hold; snapshots now preserve distinct effective entity rules."
    },
    {
      "id": 14,
      "title": "Account row controls have no names",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Generated account controls have unique IDs and accessible names; add/remove and restore paths retain labels and focus."
    },
    {
      "id": 15,
      "title": "Failed document uploads return silently to the capability tab",
      "group": "Imports",
      "status": "Verified",
      "evidence": "Failed extraction stays visible with a safe error and recovery action, including queue-enqueue failure."
    },
    {
      "id": 16,
      "title": "Malformed account requirements fail open or crash",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Malformed JSON, null, scalar/object shapes and invalid nested account elements return validation errors without creating a lookup."
    },
    {
      "id": 17,
      "title": "Validate currency elements before producing lookup matches",
      "group": "Matching",
      "status": "Strengthened during verification",
      "evidence": "Empty/unknown currencies are rejected. Legacy blank-currency show/CSV/PDF now lead to correction or API 422 without changing saved data."
    },
    {
      "id": 18,
      "title": "Missing client country raises a database error",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Missing client country returns field validation and API 422 before insert; configured countries/groups remain accepted."
    },
    {
      "id": 19,
      "title": "Restricted currency pairs incorrectly receive direct prospect ranking",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Direct prospect evidence must contain an allowed requested sell/buy pair; contradictory allowed-sell restrictions cannot rank direct."
    },
    {
      "id": 20,
      "title": "Selecting no industry produces a false data-gap indicator",
      "group": "Matching",
      "status": "Verified",
      "evidence": "Empty industry input normalizes to not requested, matching omitted input in persistence and matching."
    },
    {
      "id": 21,
      "title": "Gap unlocks confuse one dimension with one requirement",
      "group": "Analytics",
      "status": "Strengthened during verification",
      "evidence": "Independent account/entity/exclusion rules remain conjunctive; currency pairs are alternatives. Historical missing rule detail is explicit; CSV preserves meaning."
    },
    {
      "id": 22,
      "title": "Jurisdiction gaps name the sending country instead of client",
      "group": "Analytics",
      "status": "Strengthened during verification",
      "evidence": "Jurisdiction labels use client country or stored blocked members. All accepted groups, including EU and SEPA, have display labels."
    },
    {
      "id": 23,
      "title": "Analytics filters and lookup account rows overflow phone screens",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Wizard table scrolls within its container; analytics controls fit a 390px viewport, including the enlarged-text check."
    },
    {
      "id": 24,
      "title": "Analytics lookup links fail for colleagues and API searches",
      "group": "Analytics",
      "status": "Verified",
      "evidence": "Any authenticated admin can read stored colleague/API snapshots; live evaluation and mutation controls remain absent and owner routes remain scoped."
    },
    {
      "id": 25,
      "title": "Autocomplete omits combobox semantics",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Autocomplete exposes combobox/listbox/option state; arrows, Enter, Escape, Tab and no-match dismissal keep ARIA state consistent."
    },
    {
      "id": 26,
      "title": "Upload selection count becomes false",
      "group": "Imports",
      "status": "Verified",
      "evidence": "Upload selection totals update from checked rows after select-all, select-none and individual toggles."
    },
    {
      "id": 27,
      "title": "Document failures never reach the configured retry policy",
      "group": "Imports",
      "status": "Strengthened during verification",
      "evidence": "Transient failures reach Sidekiq retries. Attempt counters isolate manual retry from stale delivery/exhaustion, including legacy jobs and attachment touches."
    },
    {
      "id": 28,
      "title": "Duplicate requirements fail without explanation",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Duplicate requirements show a specific error, identify/focus the offending row and preserve values after server rejection."
    },
    {
      "id": 29,
      "title": "Polling can navigate after leaving page",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Disconnect aborts polling; late responses cannot navigate after removal/reconnect. Requests stay serial and retry after transient HTTP failure."
    },
    {
      "id": 30,
      "title": "Accepted legacy XLS files are parsed as XLSX",
      "group": "Imports",
      "status": "Verified",
      "evidence": "Legacy .xls is rejected before persistence with instructions to use .xlsx or CSV."
    },
    {
      "id": 31,
      "title": "CLI extraction retains an extra transcript copy",
      "group": "Authentication",
      "status": "Strengthened during verification",
      "evidence": "CLI disables session persistence and customizations. Live synthetic probes verified auth, no MCP/session files, and actual extraction/refinement."
    },
    {
      "id": 32,
      "title": "URL extraction downloads unlimited response bodies",
      "group": "Imports",
      "status": "Verified",
      "evidence": "URL reads enforce body size, permitted content types and deadline; transient HTTP statuses are now retryable."
    },
    {
      "id": 33,
      "title": "Every rolodex page recomputes all recent gap matching",
      "group": "Analytics",
      "status": "Verified",
      "evidence": "Evidence is loaded once per coverage calculation with recency work skipped; uncached query count stayed 16 as synthetic volume increased."
    },
    {
      "id": 34,
      "title": "Breadcrumb landmark name is misspelled",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "Breadcrumbs render the correctly spelled aria-label on their navigation landmark."
    },
    {
      "id": 35,
      "title": "Sign-in document has no language",
      "group": "UI and accessibility",
      "status": "Verified",
      "evidence": "The sign-in document declares lang=en."
    }
  ],
  "migrations": 2,
  "open_transactions_per_connection": [
    0,
    0
  ],
  "model": "gpt-6-astra",
  "reasoning_effort": "xhigh",
  "report_url": "https://compass-fix-verification-20260906.pages.dev/"
}