# QA/Security DoD Audit Report — Issue #929

Date: 2026-04-21
Repository: /projects/Charon
Branch: feature/beta-release
Scope assessed: DoD revalidation after recent fixes (E2E-first, frontend coverage, pre-commit/version gate, SA1019, Trivy CVE check)

## Final Recommendation

FAIL

Reason: Two mandatory gates are still failing in current rerun evidence:
- Playwright E2E-first gate
- Frontend coverage gate

Pre-commit/version-check is now passing.

## Gate Summary

| # | DoD Gate | Status | Notes |
|---|---|---|---|
| 1 | Playwright E2E first | FAIL | Healthy container path confirmed (`charon-e2e Up ... (healthy)`), auth setup passes, but accessibility suite still has 1 failing test (security headers page axe timeout) |
| 2 | Frontend coverage | FAIL | `scripts/frontend-test-coverage.sh` still ends with unhandled `ENOENT` on `frontend/coverage/.tmp/coverage-132.json` |
| 3 | Pre-commit hooks + version check | PASS | `lefthook run pre-commit --all-files` passes; `check-version-match` passes (`.version` matches latest tag `v0.27.0`) |
| 4 | SA1019 reconfirmation | PASS | `golangci-lint run ./... --enable-only staticcheck` reports `0 issues`; no `SA1019` occurrences |
| 5 | Trivy FS status (CVE-2026-34040) | PASS (not detected) | Current FS scan (`trivy fs --scanners vuln .`) exits 0 with no CVE hit; `CVE-2026-34040` not present in available Trivy artifacts |

## Detailed Evidence

### 1) Playwright E2E-first gate (revalidated)

Execution evidence:
- Container health:
  - `docker ps --filter name=charon-e2e --format '{{.Names}} {{.Status}}'`
  - Output: `charon-e2e Up 35 minutes (healthy)`
- Auth setup:
  - `PLAYWRIGHT_HTML_OPEN=never npx playwright test --project=firefox tests/auth.setup.ts -g "authenticate"`
  - Result: `1 passed`
  - Evidence: `Login successful`
- Accessibility rerun:
  - `PLAYWRIGHT_HTML_OPEN=never npx playwright test --project=firefox -g "accessibility"`
  - Result: `1 failed, 2 skipped, 64 passed`
  - Failing test:
    - `tests/a11y/security.a11y.spec.ts:21:5`
    - `Accessibility: Security › security headers page has no critical a11y violations`
  - Failure detail: `Test timeout of 90000ms exceeded` during axe analyze step.

Gate disposition: FAIL.

### 2) Frontend coverage gate (revalidated)

Execution:
- `bash scripts/frontend-test-coverage.sh`

Result:
- Coverage run still fails with unhandled rejection.
- Blocking error remains present:
  - `Error: ENOENT: no such file or directory, open '/projects/Charon/frontend/coverage/.tmp/coverage-132.json'`
- Run summary before abort:
  - `Test Files 128 passed | 5 skipped (187)`
  - `Tests 1918 passed | 90 skipped (2008)`

Additional state:
- `frontend/coverage/lcov.info` and `frontend/coverage/coverage-summary.json` can exist despite gate failure, but command-level DoD gate remains FAIL due non-zero termination path from unhandled ENOENT.

Gate disposition: FAIL.

### 3) Pre-commit hooks + version-check gate (revalidated)

Execution:
- `lefthook run pre-commit --all-files`
- `bash ./scripts/check-version-match-tag.sh`

Result:
- Pre-commit summary shows all required hooks completed successfully, including:
  - `check-version-match`
  - `golangci-lint-fast`
  - `frontend-type-check`
  - `frontend-lint`
  - `semgrep`
- Version check output:
  - `OK: .version matches latest Git tag v0.27.0`

Gate disposition: PASS.

### 4) SA1019 reconfirmation

Execution:
- `cd backend && golangci-lint run ./... --enable-only staticcheck`

Result:
- Output: `0 issues.`
- Additional grep for `SA1019`: no matches.

Conclusion: SA1019 remains resolved.

### 5) Trivy FS reconfirmation for CVE-2026-34040

Execution:
- `trivy fs --scanners vuln .`

Result:
- Exit status: `0`
- Output indicates scan completed with:
  - `Number of language-specific files num=0`
- CVE lookup:
  - No `CVE-2026-34040` match found in available Trivy JSON artifacts (`vuln-results.json`, `trivy-image-report.json`).

Conclusion: CVE-2026-34040 not detected in current FS scan context.

## Local Patch Report Artifact Check

Execution:
- `bash /projects/Charon/scripts/local-patch-report.sh`

Result:
- Generated successfully in warn mode.
- Artifacts verified:
  - `/projects/Charon/test-results/local-patch-report.md`
  - `/projects/Charon/test-results/local-patch-report.json`

## Blocking Issues

1. Playwright E2E accessibility suite has one failing security headers test (axe timeout).
2. Frontend coverage command still fails with ENOENT under `frontend/coverage/.tmp`.

## Decision

Overall DoD decision for Issue #929: FAIL

Promotion recommendation: keep blocked until both failing mandatory gates are green on rerun.