Skip to main content

Platform QA Report: Full Retest — Post-Sergey Feedback

Date: 2026-03-30

Environment: https://dev.securityv0.com (version dev-c8ad602)

Verdict: Ready for design partner demo — 1 high-severity default sort issue, 4 medium/low items. No blockers for demo flow.

At a Glance​

Complete retest of ALL changes since Sergey's March 26 feedback, including 3 new PRs (#231, #242, #243) that landed after the initial March 29 QA. Previous QA found 4 low issues — all now fixed (#236).

SectionPRsResultIssues
1. Overview + Trends#240PASS—
2. Findings Smart Defaults#237, #238, #239PASS (1 issue)1 HIGH
3. Finding Detail#237, #241PASS—
4. Cluster Detail#213, #227PASS—
5. Evidence Classification API#228PASS (1 issue)1 MEDIUM
6. Mitigation Tracking#229PASS—
7. Access Path Grouping#230PASS—
8. Attestation & Review API#231PASS—
9. Ownership Assignment#243PASS (1 issue)1 LOW
10. QA Fix Verification#236PASS—
11. Cross-CuttingAllPASS—

Totals: 1 HIGH, 1 MEDIUM, 3 LOW across 11 sections.

1. Overview + Trend Indicators (#240)​

All metrics load with demo data. Trend arrows show "—" placeholder since demo tenant has only one scan — correct behavior.

Overview with trend indicators

Tooltip confirms: "Trend data available after 2+ scans" appears both as visible text and on hover.

Trend tooltip on hover

CheckResult
Sidebar shows "Access Paths"PASS
Scan Metrics show trend arrows or placeholderPASS
Business Metrics show "—" for missing dataPASS
Tooltip explains placeholderPASS
Console errorsPASS — none

2. Findings List — Smart Defaults + Evidence Badges (#237, #238, #239)​

Smart Defaults (#238)​

Default view correctly pre-selects status=active. Three preset buttons visible.

Default findings view with presets

"Critical Active" preset filters correctly:

Critical Active preset applied

Cell-click filtering works — clicking a severity badge or type tag filters the list:

Cell-click filtering

Evidence Badges (#237)​

"Evidence" column visible between Source and Status. Badges show descriptive labels with color coding:

Evidence badges on findings list

Entity Column (#239)​

Entity column shows entity names (not "Workload") with links to /entities/:id. Navigation works.

CheckResult
Default shows active findingsPASS
3 preset buttons visiblePASS
"Critical Active" filters + deselectsPASS
"New This Week" filters to recentPASS
"High & Active" filters correctlyPASS
Cell-click severity filtersPASS
Cell-click type tag filtersPASS
Evidence column presentPASS
Badge labels readablePASS
Badge color codingPASS
Entity column with linksPASS
Descriptions wrap to 2 linesPASS
Default sort severity-descendingFAIL — see ISSUE-001

3. Finding Detail — Evidence Badge + Inline Path (#237, #241)​

Evidence Badge in Header (#237)​

Badge visible next to severity in the finding header, with full classification label:

Finding detail with evidence badge

Inline Path Visualization (#241)​

For findings with a path_id, the workload → identity → destination chain is shown with blast radius summary:

Inline path visualization

  • Chain shows role labels and source system
  • Blast radius: "8 executions (30d) - Domain: finance - Sensitivity: restricted - 3 active findings"
  • "View full path →" link navigates to /authority-paths/:id
  • Findings WITHOUT path_id show no visualization (no error)

Evidence Pack (#226 retest)​

Recommended Actions above Evidence Pack. Three sections expanded by default. No duplicate remediation.

Evidence Pack sections

CheckResult
Evidence badge in headerPASS
Full label visiblePASS
Color matches classificationPASS
Inline path chain visiblePASS
Blast radius summaryPASS
"View full path →" linkPASS
No-path finding: no errorPASS
Recommended Actions above Evidence PackPASS
3 sections expanded by defaultPASS

4. Risk Cluster Detail (#213, #227)​

Metric card labels fully readable at all 3 viewports — no truncation.

1024px​

Cluster detail at 1024px

1280px​

Cluster detail at 1280px

1536px​

Cluster detail at 1536px with expanded paths

Access Paths table expanded by default (24 paths visible). "Orphaned" terminology used consistently (#236 fix verified).

5. Evidence Classification API (#228)​

CheckResultDetail
meta.byClassification populatedPASSstructural_authority: 260, correlated_pattern: 105, observed_absence: 32
Individual findings have classificationPASSAll sampled findings have both fields
evidence_claim object completePASSAll fields: claim_statement, classification, basis[], business_impact, recommended_action
?classification=structural_authority filterPASSReturns correct data (see ISSUE-002 on count)
Exposures have classificationsPASSevidence_classifications[] and primary_classification present
orphaned_ownership → structural_authorityPASS
scope_drift → correlated_patternPASS
dormant_authority → observed_absencePASS

Full API output: api-output/evidence-classification.json

6. Mitigation Tracking (#229)​

Full interactive flow tested with video recording.

Track Button​

Track buttons in remediation section

After Tracking​

Tracked badge after click

Tracked Actions Section​

Tracked Actions with Proposed status

Status Lifecycle​

Status advanced to Assigned

Status advanced to In Progress

Persistence​

Actions persist after page reload

Duplicate Prevention​

Tracked badge prevents duplicate

CheckResult
Track button visiblePASS
Click → changes to "Tracked"PASS
Tracked Actions section appearsPASS
Advance: Proposed → AssignedPASS
Advance: Assigned → In ProgressPASS
Persistence after refreshPASS
Duplicate preventionPASS
API: list mitigation actionsPASS
API: summary endpointPASS
API: version conflict → 409PASS

Video: mitigation-tracking-flow.webm

7. Access Path Grouping (#230)​

Flat View (Default)​

Default flat view

Grouped View​

Grouped by identity — 13 groups, 74 paths

Expanded Group​

svc-data-pipeline expanded with child paths

Filtered (Orphaned)​

Filtered to Orphaned — 6 groups, 25 paths

CheckResult
Default flat viewPASS
Toggle to groupedPASS
Header "13 of 13 groups (74 paths)"PASS
svc-data-pipeline: 3 workloads, Cross-workloadPASS
svc-compliance-bot: Orphaned, Cross-workloadPASS
svc-ai-orchestrator: 2 workloadsPASS
[Unbound] Legacy Batch: amber badgePASS
Expand group → child pathsPASS
Filter works in grouped modePASS
Persistence after refreshPASS
API: grouped endpointPASS — 14 surfaces, 75 paths
API: orphaned filterPASS — 7 surfaces
API: pagination (limit=5)PASS — has_more=true

8. Attestation & Review Cadence API (#231)​

CheckResultDetail
Create attestationPASS201 with context_hash computed
Attestation statusPASSis_current=true, overdue=false, days_until_due=90
List attestationsPASS1 returned
Create review cadencePASS201, monthly critical review
List cadencesPASS1 returned
Delete cadencePASSHTTP 204

Full API output: api-output/attestation-lifecycle.json

9. Ownership Assignment (#243)​

No Owner State​

Not assigned + Assign owner button

Assignment Form​

Inline form with email, name, team

Assigned​

Alice Smith assigned as Platform Owner

Reassigned​

Bob Jones replaces Alice

Revoked​

Owner revoked with reason

CheckResult
"Not assigned" + "Assign owner" visiblePASS
Inline form: email, name, teamPASS
Submit creates assignmentPASS
"Reassign" and "Revoke" visiblePASS
Reassign replaces ownerPASS
Revoke prompts for reasonPASS
Persistence after refreshPASS
API: create → activePASS
API: list active → 1PASS
API: revoke → revokedPASS
API: invalid target → TARGET_NOT_FOUNDPASS

Full API output: api-output/ownership-lifecycle.json

10. QA Fix Verification (#236)​

CheckResult
"Orphaned" terminology (not "Unowned")PASS — confirmed across clusters, paths, grouped view
All findings have evidence classification badgesPASS — 51/51 active findings have badges

11. Cross-Cutting​

Console Errors​

PageErrors
Overview0
Clusters0
Findings0
Access Paths0
Graph Explorer0

Viewport Testing​

Overview at 1024px

Overview at 1920px

No layout breakage at either viewport. Sidebar "Access Paths" link navigates correctly.

Open Items​

ISSUE-001: Default findings sort not severity-descending — HIGH​

  • Section: 2 (Findings List)
  • Problem: Default findings view (status=active) shows medium-severity findings first. Critical active findings exist (51 via "Critical Active" preset) but don't appear at the top.
  • Expected: Severity-descending sort (critical → high → medium → low) as default
  • Impact: First impression of the findings list doesn't lead with the most important items
  • Recommended fix: Set default sort parameter to severity:desc in the findings list page

ISSUE-002: total_count returns page size when classification filter applied — MEDIUM​

  • Section: 5 (Evidence Classification API)
  • Problem: GET /api/v1/findings?classification=structural_authority returns total_count: 51 (page size) instead of the actual matching count (260 per byClassification facet)
  • Impact: API consumers can't determine how many findings match a classification filter
  • Recommended fix: Ensure total_count reflects the filtered total, not the page limit

ISSUE-003: Reassign doesn't auto-revoke previous assignment — LOW​

  • Section: 9 (Ownership Assignment)
  • Problem: When reassigning from Alice to Bob, then revoking Bob, Alice reappears as owner. Reassign creates a new assignment without revoking the previous one.
  • Impact: Minor — revoking twice clears correctly. But could confuse audit trail.
  • Recommended fix: Auto-revoke existing active assignment when a new one is created for the same target

ISSUE-004: URL finding_type param not reflected in dropdown — LOW​

  • Section: 2 (Findings List)
  • Problem: Navigating to ?finding_type=no_active_owner shows "All types" in dropdown and returns 0 results, even though findings of that type exist
  • Impact: Deep links with type filters may not work as expected

ISSUE-005: Exposure title field missing — LOW​

  • Section: 5 (Evidence Classification API)
  • Problem: GET /api/v1/exposures returns no title field on exposure objects
  • Impact: Cosmetic — UI may show fallback text

Release Readiness​

  • Not ready for demo
  • Ready for internal demo
  • Ready for design partner demo
  • Ready for broader pilot

Justification: All 11 sections pass with zero critical issues. The HIGH-severity default sort issue (#001) doesn't block the demo — the "Critical Active" preset works correctly and provides the intended view. Evidence classification, mitigation tracking, identity grouping, attestations, and ownership assignment all function as specified. Zero console errors across all pages. The platform tells a clear, deterministic risk story.

Evidence Summary​

  • 35 screenshots (annotated) across 11 sections
  • 1 video — mitigation tracking lifecycle flow
  • 3 API output files — evidence classification, attestation lifecycle, ownership lifecycle
  • 0 console errors across 5 pages