TASK22028: phase 15 hash guard consistency hardening slice

memory-bank/change-log.md

@@ -929,3 +929,52 @@ Follow-ups:
 - Keep signer allow-list expansion minimal and task-driven.
 - Continue replacing remaining browser-side direct hash assumptions only where flows require it.
 - Confirm work-item/branch naming alignment for any subsequent phase slices if strict tracker continuity is required.
+
+---
+
+### CL-026: Phase 15 hardening — consistency guards for additional hash-sensitive file handlers
+
+date: 2026-03-13
+author: Cline
+scope: `pages/api/file/{upload,uploadsinglefile,createappealcompletemessage_api,setupcontainer}.js`, `tests/phase15/service-behaviour.test.cjs`, `memory-bank/*`
+type: change
+rationale: Deliver a small reversible consistency-only hardening slice by standardizing missing/invalid hash negative paths and required input handling in additional sensitive file handlers.
+impact: Consistent early 400 behavior for missing/invalid hash and missing required params while preserving existing response shapes/signatures.
+status: completed
+
+Summary:
+
+- Started new branch from `origin/SIPS-Development`: `TASK22028-phase15-hardening-slice`.
+- Applied minimal hardening updates:
+    - `upload.js`: explicit missing-hash guard before hash comparison.
+    - `uploadsinglefile.js`: explicit missing-hash guard before hash comparison.
+    - `createappealcompletemessage_api.js`: added missing-hash guard to existing required-input guard block.
+    - `setupcontainer.js`: standardized to early-return on hash mismatch; contract and status behavior preserved.
+- Added focused tests:
+    - `tests/phase15/service-behaviour.test.cjs`
+    - covers missing-hash negative paths for all selected handlers
+    - includes required-input negative paths and one valid-hash happy-path shape check.
+
+Validation:
+
+- `node tests/phase6/service-parity.test.cjs` -> pass
+- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
+- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
+- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
+- Manual checks on `localhost:3002`:
+    - invalid/missing hash for each selected handler -> 400
+    - missing required params where applicable -> 400
+    - valid-hash spot-check (`setupcontainer`) -> 200
+
+Follow-ups:
+
+- Continue small-batch consistency hardening for remaining sensitive handlers where guard patterns are still inconsistent.
+- Keep manual happy-path checks constrained to feasible local dependencies; document downstream/environment-caused failures separately.