From e404a6d6dbf3d4815f6fc2e4cab617e3460ca6a7 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 13 Mar 2026 16:31:21 +0000
Subject: [PATCH] TASK22028: document signer allow-list follow-up

---
 memory-bank/activeContext.md               |  8 +++++++
 memory-bank/change-log.md                  | 27 ++++++++++++++++++++++
 memory-bank/progress.md                    | 14 +++++++++++
 memory-bank/refactor-plan-actions-index.md | 15 ++++++++++++
 4 files changed, 64 insertions(+)

diff --git a/memory-bank/activeContext.md b/memory-bank/activeContext.md
index ed984a4f..d327bdce 100644
--- a/memory-bank/activeContext.md
+++ b/memory-bank/activeContext.md
@@ -521,6 +521,14 @@
 - phase16 behavioural suite: pass (4/4)
 - lint: warnings only (pre-existing)
 
+## Follow-up status (2026-03-13)
+
+- Applied targeted signer allow-list fix for browser delete-awaiting-submission path.
+- Updated `pages/api/endpoint/gethash_api.js` allow-list with:
+    - `/api/file/deleteblobcase`
+- Added focused behavioural test:
+    - `tests/phase14/service-behaviour.test.cjs` now includes allow-list coverage for deleteblobcase path.
+
 ## Likely next steps
 
 1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
diff --git a/memory-bank/change-log.md b/memory-bank/change-log.md
index 951271c7..03f54885 100644
--- a/memory-bank/change-log.md
+++ b/memory-bank/change-log.md
@@ -1018,3 +1018,30 @@ Validation:
 Follow-ups:
 
 - Continue incremental endpoint/file proxy consistency slices with same contract-preserving constraints.
+
+---
+
+### CL-028: Follow-up fix — signer allow-list expanded for deleteblobcase browser path
+
+date: 2026-03-13
+author: Cline
+scope: `pages/api/endpoint/gethash_api.js`, `tests/phase14/service-behaviour.test.cjs`
+type: change
+rationale: Resolve runtime failure where browser-side `deleteAwaitingSubmissionsFromBlob` hash signing requested a path not present in signer allow-list.
+impact: Restores browser-safe hash signing for delete-blob-case flow without weakening auth/session guard on signer endpoint.
+status: completed
+
+Summary:
+
+- Added `/api/file/deleteblobcase` to `gethash_api` allow-list.
+- Added focused test coverage in phase-14 suite for the new allow-listed path.
+
+Validation:
+
+- `node tests/phase14/service-behaviour.test.cjs` -> pass (6/6)
+- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
+- `npm run lint` -> warnings only (pre-existing)
+
+Follow-ups:
+
+- Keep signer allow-list additions minimal and path-specific.
diff --git a/memory-bank/progress.md b/memory-bank/progress.md
index 5741b58a..5461ff83 100644
--- a/memory-bank/progress.md
+++ b/memory-bank/progress.md
@@ -703,6 +703,20 @@
     - `tests/phase16/service-behaviour.test.cjs`
 2. Re-run phase6–phase16 tests and lint.
 
+## Latest update (2026-03-13 — signer allow-list follow-up)
+
+- Branch: `TASK22028-phase15-hardening-slice`
+- Fix applied:
+    - added `/api/file/deleteblobcase` to signer endpoint allow-list in `pages/api/endpoint/gethash_api.js`
+- Test update:
+    - extended `tests/phase14/service-behaviour.test.cjs` with deleteblobcase allow-list coverage
+
+### Validation snapshot (follow-up)
+
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (6/6)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `npm run lint` -> **warnings only** (pre-existing)
+
 ## Outstanding risks / gaps
 
 - Navigation regressions across EN/CY + route query combinations.
diff --git a/memory-bank/refactor-plan-actions-index.md b/memory-bank/refactor-plan-actions-index.md
index 48ee9923..3dd92adc 100644
--- a/memory-bank/refactor-plan-actions-index.md
+++ b/memory-bank/refactor-plan-actions-index.md
@@ -536,6 +536,21 @@ Status key: `[x] done`, `[ ] pending`
     - `tests/phase16/service-behaviour.test.cjs`
 - Re-run phase6–phase16 baseline tests and lint.
 
+### Follow-up completion snapshot (2026-03-13)
+
+1. `[x]` Address browser signer failure for delete-awaiting-submission path
+    - added signer allow-list entry: `/api/file/deleteblobcase`
+2. `[x]` Add focused behavioural test coverage
+    - extended `tests/phase14/service-behaviour.test.cjs`
+3. `[x]` Validate
+    - phase14 behaviour tests pass (6/6)
+    - phase7 behaviour tests pass (10/10)
+    - lint warnings only (pre-existing)
+
+### Follow-up rollback notes
+
+- Revert commit `49dd990` to undo allow-list/test follow-up.
+
 ## Safe execution mode for migration chunks (required)
 
 To reduce terminal hangs during bulk migration work, run refactor chunks in **safe stepwise mode** instead of long chained commands.