TESTPLAN-02.1.05 · Allowlist release scrub gate

Source story

_00-Project-Management/32-Stories/EPIC-02/FEAT-02.1/STORY-02.1.05-allowlist-release-scrub-gate.md

Scope

Verifies the release build runs an allowlist-first scrub, fails closed on any surviving denylisted token, reports each offending file and token, and emits a path-free, denylist-free output on a clean build. Blocked until the rendered-output contract is finalised by STORY-02.1.03.

Preconditions

Repo at project root.
Runtime: Node 20.
Required services running: none.
Required env vars: none.
Test data / fixtures: a build output seeded with one denylisted token, and a clean output.

Acceptance criteria → Test case map

#	Acceptance criterion (verbatim from story)	Test case
AC-1	The release build runs an allowlist-first scrub over every output file.	TC-01
AC-2	A single surviving denylisted token fails the whole build.	TC-02
AC-3	The scrub report lists each offending file and token.	TC-03
AC-4	A clean build emits a path-free, denylist-free public output.	TC-04

Test cases

TC-01 · Scrub covers every output file

Type: integration
Priority: P1
Maps to: AC-1
Command:

``bash node scripts/release/scrub.test.js --case coverage ``

Expected: Exit 0; the scrub visits every file in the build output.
Result: pending

TC-02 · One token fails the build

Type: integration
Priority: P0
Maps to: AC-2
Command:

``bash node scripts/release/scrub.test.js --case fail-closed ``

Expected: Exit 0; a seeded denylisted token causes the build to fail.
Result: pending

TC-03 · Report lists offenders

Type: static-analysis
Priority: P1
Maps to: AC-3
Command:

``bash node scripts/release/scrub.test.js --case report ``

Expected: Exit 0; the report names each offending file and token.
Result: pending

TC-04 · Clean build is path-free and denylist-free

Type: static-analysis
Priority: P1
Maps to: AC-4
Command:

``bash node scripts/release/scrub.test.js --case clean-output ``

Expected: Exit 0; a clean build's output carries no denylisted token and no host path.
Result: pending

Code review checklist

[ ] Every story AC implemented
[ ] No security regressions (input validation / injection)
[ ] No performance regressions
[ ] Lint clean
[ ] Build clean
[ ] Tests green
[ ] No suppressed lint rules without justification
[ ] Error paths covered (not just happy path)
[ ] Logging / observability hooks added where exceptions can fire
[ ] Documentation updated if behaviour contract changed

Risks / edge cases

An over-tight allowlist could fail a clean build on legitimate content (false positive).
The output file set depends on the final render contract (blocked on STORY-02.1.03).

Sign-off

Code review: pending
All tests passed: pending
Date completed: ''