# Test Coverage Map (High-Risk Flows) — 2026-03-25

Purpose: make current automated coverage explicit for high-risk architecture lanes and highlight remaining gaps.

## Coverage legend

- Covered: explicit automated assertion exists
- Partial: some coverage exists, but not end-to-end or not broad enough
- Gap: no focused automation currently identified for this flow

## Flow map

| Flow / risk area                                                      | Current status           | Automated evidence                                                                                                   | Notes / next gap                                                   |
| --------------------------------------------------------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Auth redirect/callback safety                                         | Covered                  | `tests/phase22/auth-redirect-safety.test.cjs`                                                                        | Add callback URL edge-case matrix if auth flow expands.            |
| EN/CY rewrite parity (key routes)                                     | Covered                  | `tests/phase22/i18n-route-parity.test.cjs`                                                                           | Extend to wider rewrite inventory + CI gate.                       |
| Signed-delete negative path(s)                                        | Covered (targeted)       | Existing phase21/phase22 slices (see `memory-bank/change-log.md`)                                                    | Expand to additional signed flows once helper consolidation lands. |
| Upload/document authorization negative path                           | Covered (targeted)       | Existing phase21/phase22 slices (see `memory-bank/change-log.md`)                                                    | Add broader journey-level checks around auth/session edge paths.   |
| Endpoint contract behavior (selected clusters)                        | Covered (broad targeted) | `tests/phase21/endpoint-handler-contract.test.cjs`                                                                   | Continue long-tail cluster migration and assertions.               |
| Relay retry/timeout/logging policy behavior                           | Covered                  | `tests/phase21/relay-forwarding-hardening.test.cjs`                                                                  | Keep updated if retry classification/policy changes.               |
| Service-layer behavior in migrated clients                            | Covered (targeted)       | `tests/phase6/service-behaviour.test.cjs`, `tests/phase7/service-behaviour.test.cjs`, `tests/phase22/index.test.cjs` | Add new tests as signed-request helper abstraction is introduced.  |
| Runtime canonicalization behavior (`server.js` vs `server/server.js`) | Gap                      | N/A                                                                                                                  | Needs architecture decision before test strategy is meaningful.    |

## Recommended next coverage increments

1. Add CI execution for phase22 aggregate (`tests/phase22/index.test.cjs`) if not already wired.
2. Expand i18n parity checks to include broader route/key parity surface.
3. Add a focused regression test set for signed-request helper once Sequence B B1 starts.
4. Define minimum “high-risk flow” coverage bar in `memory-bank/open-questions.md` (Q-002 resolution).