Requirements traceability — Karsa

Generated by docs/ba/build_pack.py from the recorded runs in docs/ba/evidence/ (code at a701e92). 67 automated checks found, 67 passed.

FR	Requirement	Rule	Persona	UAT script	Automated checks	Status
FR-01	Intake keeps the original brief with a hash	—	Analyst	UAT-01	`test_brief_text_is_stored_with_hash` `test_pdf_upload_keeps_pages_and_rejects_scans` `test_eml_upload`	Passed
FR-02	Extraction with exact evidence; nothing invented	BR-009, AC-01	Analyst	UAT-01	`test_every_span_is_a_real_substring_of_the_source` `test_aster_brief_extracts_values_and_leaves_gaps_missing` `test_model_output_without_verbatim_quote_is_discarded` `test_per_lead_rate_is_not_read_as_budget`	Passed
FR-03	Conflicting values are surfaced, not resolved silently	AC-02	Analyst	UAT-02	`test_conflicting_budget_is_flagged_with_both_sources`	Passed
FR-04	Brief text is untrusted data	—	Analyst	UAT-02	`test_instruction_text_is_flagged_as_data` `test_injected_instructions_do_not_change_permissions_or_state`	Passed
FR-05	Versioned requirement review; stale edits refused	—	Analyst	UAT-01	`test_stale_versions_get_409` `test_reextract_keeps_human_decisions`	Passed
FR-06	Clarification answers carry their evidence	—	Analyst	UAT-01	`test_clarification_evidence_is_labelled_by_verification`	Passed
FR-07	Deterministic integer-rupiah pricing	BR-002, AC-03	Analyst	UAT-03	`test_reference_scenario_is_exact` `test_margin_rounds_half_up_in_basis_points` `test_repeating_decimal_margin` `test_negative_margin_is_reported_not_hidden` `test_zero_fee_is_rejected_instead_of_dividing_by_zero` `test_invalid_inputs_are_listed_per_field` `test_large_values_have_no_float_error`	Passed
FR-08	Capacity check and scenario comparison	FR-008	Analyst	UAT-03	`test_capacity_blocks_package_and_options_are_compared`	Passed
FR-09	Package gate blocks incomplete decisions	BR-001	Analyst	UAT-03	`test_package_is_blocked_while_critical_requirements_are_missing` `test_approve_endpoint_rechecks_blockers_on_the_frozen_content`	Passed
FR-10	Approval binds one exact snapshot	BR-003, AC-04	Approver	UAT-04	`test_approval_records_the_exact_snapshot_hash_and_version` `test_stale_hash_or_version_gets_409` `test_tampered_snapshot_still_fails_closed_without_the_trigger`	Passed
FR-11	Change after approval creates a new version	BR-004	Analyst, Approver	UAT-05	`test_change_after_approval_creates_new_version_and_keeps_old_snapshot`	Passed
FR-12	Segregation of duties and mandatory notes	—	Approver	UAT-04	`test_package_author_cannot_review_own_package` `test_reject_and_request_changes_need_a_note` `keyboard-only approver can open a package, compare changes and reject it (AC-10)`	Passed
FR-13	High risk needs an exception and two approvers	BR-006	Approver	UAT-06	`test_below_floor_needs_exception_and_two_different_approvers` `mobile second approver completes a high-risk dual approval`	Passed
FR-14	Approval is not execution	—	Approver	UAT-07	`test_execution_requires_approval_and_separate_authorization`	Passed
FR-15	Connector allowlist	BR-005	Admin	UAT-07	`test_disabled_connector_blocks_authorization`	Passed
FR-16	Expired rate card blocks approval and execution	BR-013	Admin	UAT-03	`test_expired_rate_card_blocks_approval_and_execution`	Passed
FR-17	Idempotent retry	BR-007, AC-05	Automation Engineer	UAT-08	`test_retry_after_timeout_does_not_duplicate_sandbox_records` `test_duplicate_delivery_and_lease_expiry_do_not_duplicate_writes`	Passed
FR-18	Unknown outcome needs reconciliation	AC-06	Automation Engineer	UAT-08	`test_unknown_outcome_blocks_blind_retry_and_reconciles_without_second_write`	Passed
FR-19	Recovery: exception queue, manual resolution, cancel, reopen	—	Automation Engineer	UAT-08	`test_manual_resolution_continues_the_run` `test_cancelled_run_lists_compensation_and_case_can_be_reopened` `test_rejected_case_is_locked_until_reopened`	Passed
FR-20	Server-side roles and tenant isolation	AC-08	All	UAT-09	`test_unauthorized_roles_are_denied_and_audited` `test_other_tenant_cannot_see_or_touch_cases` `test_password_login_session_and_csrf` `password sign-in, role-based navigation and tenant isolation`	Passed
FR-21	Append-only audit with request IDs	—	All	UAT-09	`test_audit_is_append_only_and_traced` `test_database_refuses_to_change_frozen_package_content`	Passed
FR-22	Evaluation Lab with held-out gate	—	AI Evaluation Analyst	UAT-10	`test_eval_run_scores_all_cases_and_reports_real_failures` `test_eval_splits_gate_and_adjudication`	Passed
FR-23	Keyboard and automated accessibility checks	AC-10	All	UAT-09	`keyboard-only approver can open a package, compare changes and reject it (AC-10)` `no serious accessibility violations` ×12	Passed
FR-24	End-to-end critical path in the browser	—	All	UAT-01..08	`intake → requirements → clarification → pricing → package → approval → authorization → async sandbox run`	Passed

Checks not mapped to a requirement (5): test_alembic_migration_builds_schema, test_exports_carry_the_hash, test_input_validation_errors_are_helpful, test_notifications_follow_the_workflow, test_pagination

Published from the Karsa project repository on 13 Nov 2026. Fictional organisation and synthetic data; nothing here describes a real client or result.