{
  "title": "Tenant-scoped customer export: verification record",
  "owner": "TeqEngine",
  "recordedAt": "2026-09-07T18:17:59Z",
  "recheckedOn": "2026-09-09",
  "classification": "Owned demonstration with synthetic data; not client evidence",
  "contract": {
    "request": "GET /customers/export",
    "authorization": "Authenticated fixture session, administrator role and export permission, checked before reading customers",
    "selection": "Active customers belonging to the authenticated tenant, ordered by customer_id",
    "columns": ["customer_id", "name", "email"],
    "maxDataRows": 1000,
    "maxEncodedBytesIncludingHeader": 1048576,
    "failure": "Refuse the complete download if authorization, validation or output bounds fail; no partial CSV",
    "format": "UTF-8 CSV; preserve accepted values with CSV quoting; reject formula-like prefixes under a scoped field policy",
    "excludedInputs": "Query parameters and client-supplied identity or permission headers"
  },
  "observedResponse": {
    "status": 200,
    "contentType": "text/csv; charset=utf-8",
    "encodedBytes": 64,
    "customerSelectCount": 1,
    "csv": "customer_id,name,email\na-101,\"North, Branch\",north@example.test\n"
  },
  "verification": {
    "existingListTests": 6,
    "exportTests": 18,
    "totalTestMethods": 24,
    "result": "All passed on local recheck",
    "frozenFilesCheckedInOriginalRecord": 8,
    "frozenFileMismatchesInOriginalRecord": 0,
    "implementationSha256": {
      "routes.py": "0452e9e3b68a798f7863e80a6694edca4d3eec985df28f10a2bf966e867a612a",
      "export.py": "027996e7c3f3877fe1861c837e15b6b180457e8b52cf41629d2790fcfffc321e"
    },
    "checkedBehaviors": [
      "Session, administrator and export permission required before customer read",
      "Exact membership and fields, second tenant, active-only selection",
      "Client headers cannot change identity or permission; all query parameters refused",
      "Quotes, commas, embedded lines and ordinary leading spaces round-trip",
      "Scoped formula-prefix policy applies to every exported field",
      "Empty export includes header; export is not just the first list page",
      "Exact row limit and encoded-byte limit, including CSV header",
      "Database failure and exceeded bounds produce no partial download",
      "Only GET supported; existing list behavior preserved"
    ]
  },
  "challenge": {
    "type": "Deliberately unscoped in-memory control, not an observed model mistake",
    "observation": "A tenant-B row appeared when the tenant filter was deliberately removed; the exact-membership check rejected the result",
    "restoredImplementation": "Passed"
  },
  "decision": "Accepted as a bounded local demonstration; not qualified for production deployment",
  "limitations": [
    "The same interactive coding session specified, implemented and checked this sample; no independent review is claimed.",
    "Trusted session state and synthetic tenants are local fixtures, not production identity integration.",
    "Calls are in-process. Network, browser integration, production load and all spreadsheet consumers are untested.",
    "Output limits do not establish database latency or a process-memory ceiling.",
    "Frozen-file hashes detect changes; they do not enforce a permission boundary.",
    "Model checkpoint, token use, cost, active author effort and comparative speedup are unmeasured."
  ]
}