3 Commits

Include renames

Author	SHA1	Message	Date
ehoandClaude Sonnet 5	ae7781efef	docs: close WP-72..75, regenerate behaviour spec ... Four close-outs and their README rows. The behaviour spec is regenerated once here rather than per-track — it derives from every test name in the repo, so any track running it would have conflicted with the other three. Records two findings the arc surfaced but did not cause: the /brief/preview staleness for non-DemoOwner identities (blocking per-spec identity isolation in brief-v2.spec.ts), and that WP-72/73 had to share a commit because both edit Program.cs — separate execution waves prevented build collisions but did not produce separable diffs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-19 16:34:54 +02:00
ehoandClaude Sonnet 5	5d73ca21f6	feat(backend): enforce the scholing threshold server-side (WP-69) ... ADR-0001's own canonical "config value" example was unenforced: GET /intake/policy echoed ScholingThreshold, but no request DTO carried a scholing answer, so the server had nothing to re-validate. A crafted POST could skip a requirement the wizard presents as mandatory. IntakePolicy.RejectIncompleteScholing is the authority — three-valued completeness (below threshold an answer is required; "nee" is legal and still submits; punten only belong to a followed scholing), living in the class that owns the constant so scripts/check-seam.sh keeps guarding the FE/BE literal pair. Both submit paths call it; a violation 400s with ProblemDetails and leaves the aanvraag a Concept. Gated on Type == "intake" (the endpoint's switch lumps herregistratie with intake, which has no scholing question), and guarded by `reject is null` so a zero-uren submission is still decided on its merits. Also fixes a live FE bug in the same rule: validateStep required punten whenever scholingGevolgd was 'ja' regardless of lageUren, while the template renders those fields only when lageUren — so answering 'ja' then raising uren either blocked the user on an invisible field or emitted aanvullendeScholing: undefined alongside punten. punten now derives from aanvullendeScholing, so that combination is unrepresentable in ValidIntake. Note: EndpointTests' Worked_hours_submission_succeeds was itself asserting the vulnerable payload ({ uren: 40 }, no answer) and needed a complete answer added; the zero-hours rows are the ordering regression net and are unmodified. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-18 22:42:14 +02:00
ehoandClaude Sonnet 5	306d002221	docs(test): generated living behaviour spec + FE/BE seam drift check (WP-71) ... Gherkin/Cucumber was considered and rejected for business-readable BDD scenarios: step-binding by runtime string match undoes the compile-time guarantees WP-70 just added, and needs two frameworks for .NET+TS with no non-technical co-author in view. Instead scripts/gen-behaviour-spec.mjs (modeled on the existing gen-snippets.mjs) extracts every describe/it and [Fact]/[Theory] name straight from the real suites into libs/shared/docs/behaviour-spec.mdx, gated for drift in CI exactly like gen-snippets/gen-api — the page can never diverge from the tests because it's generated from them, and test names stay the single source of truth. scripts/check-seam.sh guards the one FE/BE rule duplication most likely to silently diverge: IntakePolicy.cs's ScholingThreshold vs intake.machine.ts's SCHOLING_THRESHOLD_DEFAULT, two unlinked literals pinned separately in each side's own tests but never against each other. package.json/CI wiring for both (gen:behaviour-spec, check:seam) shipped in the prior commit alongside the typecheck gate, since all three touch the same few config files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-18 20:25:17 +02:00