Built, tested, handed over.

Plain PowerShell against a fake Graph, so no tenant is needed.

1. retry honours Retry-After on 429 then succeeds
2. gives up after MaxAttempts and rethrows
3. client errors are not retried
4. paging follows nextLink to the end
5. report keeps only stale and never signed in devices
6. report writes the CSV evidence
7. WhatIf performs no writes
8. Disabling devices first writes a before record for each one, then changes exactly the devices named.disable writes before evidence then patches exactly the given ids
9. rollback restores exactly the devices in the evidence file
10. evidence lines are valid JSON with a header
11. pilot assignment keeps existing assignments and adds the pilot group
12. pilot assignment refuses an empty group id
13. pilot assignment is a no op when the group is already assigned
14. rollback reposts the original assignment set only

Install first with the command in its README. It runs on a demo database, so no SQL Server is needed.

1. Refuses a delete. DELETE FROM dbo.loads returns select_only.test_rejections
2. Refuses an update. UPDATE dbo.v_loads SET status = 'x' returns select_only.test_rejections
3. Refuses an insert. INSERT INTO dbo.loads (load_id) VALUES (1) returns select_only.test_rejections
4. Refuses a command to drop a table. DROP TABLE dbo.loads returns select_only.test_rejections
5. Refuses a second statement hidden after a semicolon. SELECT 1; DROP TABLE dbo.loads returns single_statement.test_rejections
6. Refuses a query that would create a table. SELECT * INTO backup FROM dbo.v_loads returns no_into.test_rejections
7. Refuses a raw table; only the safe views are open. SELECT * FROM dbo.loads returns views_only.test_rejections
8. Refuses a join to a raw table. SELECT * FROM dbo.v_loads l JOIN dbo.drivers d ON d.carrier_id = l.carrier_id returns views_only.test_rejections
9. Refuses a view outside the approved schema. SELECT * FROM other.v_loads returns views_only.test_rejections
10. Refuses a restricted column. SELECT carrier_rate FROM dbo.v_loads returns no_restricted.test_rejections
11. Refuses a restricted column reached through a join. SELECT l.load_number, x.license_no FROM dbo.v_loads l JOIN dbo.v_drivers x ON x.carrier_id = l.carrier_id returns no_restricted.test_rejections
12. Refuses a call that reaches outside the database. SELECT * FROM OPENROWSET('SQLNCLI', 'Server=x', 'SELECT 1') returns no_dangerous_calls.test_rejections
13. Refuses a call that runs system commands. EXEC xp_cmdshell 'dir' returns no_dangerous_calls.test_rejections
14. Adds a row cap to a query that has none.test_row_cap_added_when_missing
15. Lowers a row cap that is too high: TOP 5000 becomes TOP 100.test_row_cap_lowered_when_too_high
16. Keeps a row cap that is already under the limit.test_row_cap_kept_when_under
17. Allows a WITH query built on the safe views, and still caps its rows.test_cte_over_views_allowed
18. A real MCP client starts the server, lists its seven tools, reads a load and is refused a write.test_stdio_roundtrip
19. Load search keeps to the limit and to the state filter.test_search_loads_respects_limit_and_filter
20. One load comes back whole: its stops starting at stop one, its events and its invoices.test_get_load_full_picture
21. An unknown load number returns a clear not_found answer.test_get_load_unknown_is_structured
22. The status board counts loads by status and includes a list of late deliveries.test_status_board_and_late
23. Carrier lookup flags a carrier whose insurance has expired.test_carrier_lookup_flags_expired_insurance
24. Open invoices leave out paid ones, and the total equals the sum of the rows.test_open_invoices_totals
25. No data tool or free query returns a restricted column.test_restricted_columns_never_leave
26. A free query runs, stops at the row cap and says it was cut short.test_sql_readonly_executes_and_caps
27. A write sent as a free query is refused with the code select_only.test_sql_readonly_rejects_writes_with_code
28. A server scoped to one customer sees only that customer’s loads, in search, load lookups and free queries.test_customer_scope_isolates_everything
29. Every call is written to the audit log, refused ones included.test_audit_log_written

Install first with the command in its README. 18 checks run without a server; set two database addresses to run all 20.

1. A live PostgreSQL run writes the report, from its title to its evidence appendix, and no password appears above the appendix.test_postgres_end_to_end
2. A live MySQL or MariaDB run writes the report, with the queries behind its evidence.test_mysql_end_to_end
3. The report has every numbered section, and each finding’s evidence appears in the appendix.test_wiki_structure_and_citations
4. Report wording uses no dash characters outside code.test_wiki_prose_has_no_dashes
5. Loading the same run into the inventory twice changes nothing, and the counts match.test_inventory_round_trip
6. The command line assesses a run again and loads it into the inventory.test_cli_assess_and_inventory
7. A healthy PostgreSQL server raises no findings; only the backup schedule is left for a person to confirm.test_healthy_postgres_raises_nothing
8. A single server with no replica and no WAL archiving is flagged as high risk.test_postgres_single_instance_without_archiving
9. A standby server is never reported as a lone primary.test_postgres_standby_is_not_reported_as_single_primary
10. PostgreSQL 12, past its support date, is flagged as high, and 14, whose support ends in November 2026, as medium.test_postgres_end_of_life_version
11. Open trust logins, TLS switched off and weak password hashing are each flagged.test_postgres_security_rules
12. A check the account may not run becomes an open question, never a false finding.test_postgres_missing_permission_becomes_unknown_not_finding
13. Extra superusers, an open public schema and connections near the limit are flagged.test_postgres_access_and_capacity_rules
14. Finding numbers are unique, and the monitoring findings are numbered in order.test_finding_ids_are_unique_and_sequential_per_area
15. A healthy MySQL server raises no findings.test_healthy_mysql_raises_nothing
16. MySQL and MariaDB versions past their support dates are flagged, and supported ones are not.test_mysql_end_of_life_lines
17. Binary logging off, no replica and relaxed commit flushing are each flagged.test_mysql_durability_and_replication_rules
18. TLS disabled, anonymous users and a root login open to any host are flagged.test_mysql_security_and_access_rules
19. Tables without a primary key are rated by how replication is set up.test_mysql_operations_rules_scale_with_replication_format
20. Every finding carries its evidence and valid labels.test_every_finding_carries_evidence_and_valid_labels

Node 20 or newer, with no other dependencies.

1. the XML feed reads into records and decodes CDATA
2. normalize produces one shape from both a JSON ATS and an XML feed
3. a record with no external id is rejected with a reason, never synced
4. first run creates only the open vacancies
5. running twice performs zero writes
6. a changed title patches exactly one item and names the changed field
7. a vacancy that closes is archived, not deleted
8. a dry run reports the same counts and writes nothing
9. a 429 is retried after the Retry-After delay and the write still lands
10. a client error is not retried and is reported against its vacancy
11. pagination walks past the first page
12. the drift report names what is missing, stale and hand made
13. a synced site reports itself in sync
14. an application is validated before it reaches the ATS
15. an application carries only the fields the ATS needs
16. the evidence file records the plan, each change and the result
17. two feeds share one collection without archiving each other
18. an item typed in by hand is never archived by a sync
19. the same vacancy id in two systems stays two vacancies

Run npm install first. It runs 7 unit checks, then 11 that launch the real shell.

1. opens the locked company app with no browser chrome
2. branding from the API is applied to the shell
3. navigation to an unapproved site is refused inside the frame
4. window.open never spawns a second frame window
5. file and unknown protocol attempts never leave the frame
6. downloads are blocked and audited
7. devtools cannot open in production
8. login lands on the dashboard and the frame menu is present
9. the API refuses another company’s configuration for this user
10. admin sees Frame Host Settings; the shell only navigates, the app decides
11. logout clears the session and returns to the login page
12. approved origins are allowed
13. a lookalike origin is not allowed
14. http(s) outside the allowlist goes to the default browser, never the frame
15. non web protocols are denied outright
16. sanitize accepts a clean configuration and locks the slug
17. sanitize refuses configuration for another company
18. sanitize rejects script bearing and malformed branding values

Install first with the command in its README. 11 checks run without a database; set a PostgreSQL address as its README shows to run all 17.

1. A file whose columns do not match its spec is stopped before any data is written.test_structure_contract_fails_before_touching_data
2. A messy nine row spreadsheet loads four clean customers and rejects four rows, each with its reason.test_first_import_cleans_validates_and_rejects
3. Importing the same file twice changes nothing.test_same_file_twice_is_a_no_op
4. Orders that point to an unknown customer or repeat a row are rejected, each with its reason.test_foreign_keys_duplicates_and_changed_file
5. A dry run reports what it would do and writes nothing.test_dry_run_writes_nothing
6. Strict mode rolls the whole file back when any row is rejected.test_strict_mode_rolls_back_everything
7. Extra columns are tolerated, and header names are tidied before matching.test_extra_columns_tolerated_and_headers_normalised
8. A CSV with semicolons and an older Windows encoding is read correctly.test_csv_delimiter_and_encoding_sniffing
9. Email addresses are trimmed and lowercased, and invalid ones are rejected.test_email_cleaning_and_pattern
10. Amounts such as $1,299.00 are read as numbers, and a negative fee is rejected.test_currency_and_thousands
11. Reads the date 2026-01-15 as 15 January 2026.test_dates_in_common_formats
12. Reads the date 02/03/2026 as 3 February 2026.test_dates_in_common_formats
13. Reads the date 31/01/2026 as 31 January 2026.test_dates_in_common_formats
14. Reads the date Jan 5, 2026 as 5 January 2026.test_dates_in_common_formats
15. Yes and no words become true or false, and a blank takes the default.test_bool_words_and_default
16. A missing required value is rejected, and a blank optional value stays empty.test_required_missing_and_optional_blank
17. Plan names are mapped, so Pro becomes professional, and unknown plans are rejected.test_value_map_and_allowed

Run it from the Apps Script editor after the setup in its README.

1. Inline image skipped
2. Dialogue text kept
3. Table text kept as a line
4. No binary in text
5. Small transcript is one request
6. Large transcript is chunked
7. Abnormal transcript is refused
8. Fresh document is not settled
9. With the ledger switched off, the same document is summarised twice: the double send the ledger exists to stop.Bug reproduced: without the ledger the same document is summarised twice
10. With the ledger on, the second pass is skipped.Fix proven: with the ledger the second pass is skipped
11. Script lock acquirable