Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / tools/verify/walkthrough/README.txt |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 720d47fae476b0d38477ae4401697d372b1ea2bc |
| Branch | feature/opportunity-to-outcome |
| Path or archive member | tools/verify/walkthrough/README.txt |
| Original SHA-256 | 1ae471da920d921248e01644d241f571376a9ac85b9458cd8488567a818425e0 |
| Git blob SHA | 8f7cac060a320b3771a8fd1a41a8d3ee25f1a6bf |
| Reading-copy SHA-256 | 1ae471da920d921248e01644d241f571376a9ac85b9458cd8488567a818425e0 |
Recovered source transcript
Download complete source text ↓30 lines · 2.0 KB
END TO END WALKTHROUGHS. The only instruments in this build that a bad regex cannot fool.
WHY THEY EXIST. Twice in one night a grep produced a FALSE ABSENCE and I believed it. A character class of
[a-z0-9/_{}.-] with no A-Z hid every write route carrying a camelCase path parameter, which is most of them,
and I concluded the recruiting write path did not exist. It has 42 routes. I then "confirmed" it with a second
query using the same broken pattern and treated two failures of one instrument as agreement.
These scripts exercise the REAL authenticated API instead: genuine CSRF, genuine Origin check, genuine session,
real writes, then read the writes back. A route that does not exist fails here loudly and cannot be argued with.
recruiting-funnel.sh client, contact, requisition, candidate, source, six stage moves, interview and its
outcome, offer, acceptance, placement, then reads it all back. 25 assertions.
CONTROLS: a stale expected_stage must be refused (409), and an unpriced contract
offer must be refused (422). Without those two the other 23 prove much less.
operator-console.sh the platform plane. 13 assertions.
CONTROL FIRST: a NON operator must receive 404, not 403, because a 403 confirms the
surface exists to someone who should not know it does. Then operator list, validation
refusals, a real tenant provisioned, a duplicate slug conflicting rather than 500ing,
and the new owner redeeming the invite and logging in with tools already granted.
RUN
BASE=https://missionmatch-staging.thatwebhostingguy.com \
EMAIL=<user> PW=<password> bash recruiting-funnel.sh
BASE=... OP_EMAIL=<operator> OP_PW=<pw> MGR_EMAIL=<non operator> MGR_PW=<pw> bash operator-console.sh
Fixture passwords are set with cmd/rotate-credential through MM_ROTATE_PASSWORD, which keeps them out of argv,
and they are recorded NOWHERE, per finding D4.