Skip to content

M5-13 Test Evidence (D4c)

Milestone: M5 — Disclosure and Verification SOW Reference: Deliverable D4c Requirement Clarity: ✅ Clear — concrete test plan added 2026-08-26 Dev Status: ❌ Not started

Overview

Produce the Test Evidence deliverable for M5's scope: test results, logs, and defect summary for disclosure and verification.

2026-08-26, from Velocity's CV Capture spec — a concrete starting checklist, not previously available:

Happy path - [ ] Authorized recruiter creates one share request for one application; wallet verifies the request signature, candidate selects and submits credentials; submission lands in the expected depot; recruiter sees results with the exact verification states for all 6 checks

Access isolation - [ ] Unauthenticated requests return 401/404, never credential data - [ ] A recruiter from org B cannot read org A's applications by manipulating route/record IDs - [ ] A recruiter from org A without permission on a specific application cannot access it - [ ] Backend ignores any tenantId/depotId/presentationId supplied by the browser for authorization decisions — always derives from session + application record - [ ] Forwarding a candidate's link to someone else does not expose an already-submitted presentation - [ ] Operator bearer token is absent from HTML source, browser storage, HTTP responses, and telemetry

Protocol correctness - [ ] Wallet/backend rejects an invalid request signature - [ ] Deep-link parameters (vendorOriginContext etc.) are correctly forwarded to the request URI and echoed back in the submission — confirm this doesn't silently create an uncorrelated depot - [ ] Replaying a completed exchange is rejected or produces no duplicate record

Verification & failure states - [ ] Exhausted verification vouchers/credits show a clear "unavailable" message — never a false-positive green check - [ ] Revoked, expired, untrusted-issuer, and tampered credentials each show their own distinct failure state, not a generic "failed" - [ ] PDF generation failure shows a visible error; the download control is never a dead/empty-href link - [ ] A successful PDF export's content matches the on-screen verification results exactly

Tasks

  • Write unit tests for disclosure request, verification, and PDF report services
  • Write integration tests for the VerifyMyCreds/Velocity Verification Platform integration
  • Work through the four checklists above as the core of the integration/E2E suite
  • Produce test summary/logs and a defect log per Appendix 3

Dependencies

  • Runs alongside all M5 build tasks.

Acceptance Criteria

  • Test evidence complete and traceable to scope (per SOW Appendix 3, D4c)

Existing Reference Material

None — confirmed gap.

Blockers & Risks

None beyond the general "M5 starts from zero" risk noted elsewhere.