Regenerated on every push to dev. Test target: https://msp-dev.co-sec.io

How to use: Click through every checkbox in a real browser and tick it off. Log in twice — once as an admin and once as a technician — and run the permission/isolation groups under both. Keep a portal contact logged in (separate browser/incognito) at /portal for the isolation probes. When a step says "→ expected", the box passes only if reality matches; otherwise file a bug with the module, step, and payload. "500" is always a bug — the app should surface a clean error, never a stack trace. Prefer pasting the reusable fuzz payloads below.

Reusable fuzz payloads (paste into any text field):

• Huge: 10,000 A characters (generate once, reuse).
• XSS/template: <script>alert(1)</script> · <img src=x onerror=alert(1)> · <b>bold</b> · ${7*7} · {{7*7}} · #{7*7}
• SQL-ish: '; DROP TABLE tickets;-- · " OR 1=1 --
• Unicode/RTL/emoji: 🧨💥🔥 مرحبا שלום 日本語 ​ ‮reversed (includes zero-width + RTL override)
• Whitespace-only: (spaces), \t, and a lone newline.
• Numbers: 0, -1, -9999, 0.001, 999999999999, 1e9, 007, 1,234.56, NaN, Infinity.
• Dates: 01/01/1900, 12/31/2999, 02/30/2026, 0000-00-00.
• Long URL: https://example.com/ + 5,000 chars.

1. Auth & Registration
2. Dashboard
3. Tickets
4. Kanban Board
5. Security Incidents
6. Leads / CRM (+ Netlify capture)
7. Prospects / Lead Generator
8. Clients (+ contacts, notes, docs, credit, tax id)
9. Projects
10. Assets
11. Time Tracking
12. Expenses (+ receipts)
13. Mileage (+ geocode/distance)
14. Billing / Invoices
15. Client Contracts & Recurring Billing
16. Margin Calculator
17. Vendors (+ contracts/renewals)
18. Knowledge Base / Docs
19. Reports
20. Settings
21. Ticket Rules Automation
22. AI Assistant
23. Notifications
24. SLA Management
25. Email-to-Ticket
26. CSV Import
27. Command Palette & Keyboard Shortcuts
28. Customer Portal
29. Orders / Sales Quotes
30. Quotes / Proposals
31. Shipping
32. Two-Factor Authentication (MFA)
33. Dispatch Board
34. Cross-cutting: Permissions, Isolation, Security
35. QA Test Plan Page (this checklist)
36. Architecture Map (admin-only)
37. Mobile Navigation & Responsive Layout (global)
38. Security Event Log / Intrusion Detection
39. Security Log Export (S3 / Azure / SIEM)
40. Staff Activity Audit Log
41. Vendor / Cloud Charges (Pax8)
42. Task System (internal to-dos & recurring work)
43. Task Follow-ups (conversions, dispatch blocks, AI tools, ticket templates)
44. Appearance / Per-User Theme & Accent Color
45. Modal Keyboard Layer — Escape + ⌘/Ctrl+Enter (app-wide)
46. AI Connection Settings (Claude / OpenRouter)
47. Business Card Scanner (photo → lead or client contact)
48. Global Search (every record type)
49. Deleting Records That Other Records Point At
50. Ticket Types & Per-Type SLA
51. Knowledge Base — Version History, Files & Review Cycles
52. Credential Vault
53. Documentation Phase 3 — point of use, capture, drift, exceptions, coverage, survey
54. AI Automation — the suggestion queue and everything that fills it
55. Ticket Requesters — who asked, without a contact record
56. Ticket Email Composer — reply and forward with chosen recipients
57. Time Entry Import — spreadsheets that match themselves to clients, projects and people
58. Vendors — sortable columns, the readability pass, and cards on existing vendors
59. Proposals — a client-facing document built from prospect research
60. Invoicing by Project — the unbilled picker's project filter
61. Invoice Branding & Numbering — the logo, client-coded numbers and titles
62. Invoice Payment Links — customers pay through Stripe
63. Session Persistence — Rotating Refresh Tokens
64. Installable PWA & Field Mode (Mobile)
65. Knowledge Base Files — a PDF or Word document AS the article
66. Daily Digest Email — the morning reminder of what is outstanding
67. Ticket Prediction — the client, type and due date suggested from past tickets
68. Prediction follow-ups — triage queue, backtest, device and project suggestions
69. Security Audit Hardening — tenancy, tokens, files, email spoofing, billing races
70. SLA Business Hours & Clock Pausing
71. Huntress Connector (Phase 1: billing)
72. Harvest Invoice Import — past invoices brought over so Harvest can close
73. QA Triage Fix Regressions — rates, reports, shipping, quotes, tasks, margin
74. Newsletter — signups, double opt-in, campaigns, click tracking, unsubscribe
75. QA Batch-2 Fix Regressions — double-submit, project/client guards, search, CSV, newsletter HTML, files
76. Passkeys — sign in with Face ID, Touch ID, Windows Hello, a phone or a security key
77. Knowledge Base Internal-Only Sections — hidden from the portal after an editor save
78. Knowledge Base Tables — insert, edit, paste from Excel, import CSV
79. Invoice Pay Link: customer views in the audit log

New client-side guard (AuthGuard.tsx) mounted in both the staff dashboard layout and the portal layout: checks the stored token on mount, on tab focus, on visibilitychange, and every 60s — decodes the JWT exp claim client-side (never verifies signature) and force-navigates to login the moment it's missing or expired, instead of waiting for the next failed API call.

The dashboard's "Overdue" card COUNTS past_due_condition (unfinished tickets whose due date fell on a previous UTC calendar day — the same helper backing the tickets page's Past Due tile/?overdue=1 filter), but used to LINK to /tickets?sla=breached (SLA response/resolution breach — a different, unrelated condition). The link now matches the count: /tickets?overdue=1.

Currency renders far wider than a bare count ($20,199.97 vs 31), so of the 7 KPI cards only Revenue (Month) now renders its figure at a smaller compact scale (text-[18px] sm:text-[22px] xl:text-[20px]) instead of the shared text-[22px] sm:text-[28px] the other 6 use — specifically to stop it overflowing/wrapping at the 7-card desktop grid width. Note xl is deliberately SMALLER than sm here: the grid gets tighter per card right at that breakpoint before easing up again.

Due dates are stored as UTC datetimes but represent a calendar date; formatDueDate/isDueOverdue (frontend/src/app/(dashboard)/page.tsx) format in the UTC timezone specifically to avoid a local-timezone day shift.

New TodaysScheduleCard in the right column, between the KPI/status area and Upcoming Renewals — the signed-in user's own dispatch appointments for the current calendar day, sourced from GET /api/dispatch/appointments?tech_id={me} for [today 00:00, tomorrow 00:00).

The card now also pulls GET /api/dispatch/reminders?tech_id={me} for the same [today 00:00, tomorrow 00:00) window and merges those rows with the appointments into ONE list sorted by time (remind_at vs start_at) — reminders are exactly as personal as the appointments (own tech_id only), matching the dispatch board's setter's-lane rule.

A Clock-icon "Log Time" button now sits first in the quick-action row, opening the shared LogTimeModal in its fully unlocked variant (client/project/ticket pickers all offered, prefilled with today's local date via todayLocalISO()) — so time can be logged without navigating to /time or a ticket first.

get_ticket (GET /api/tickets/{id}) never eager-loaded Ticket.project, but _ticket_to_response read ticket.project.name unconditionally — on an async session that lazy load raises MissingGreenlet, and the frontend's blanket if (!ticket) branch rendered that 500 identically to a real 404: "Ticket not found". This was 100%-reproducible for EVERY project-linked ticket, not an edge case. Fixed two ways: (1) get_ticket now also selectinload(Ticket.project)s; (2) a new _loaded(ticket, name) helper backstops client/contact/assignee/project/merged_into — an unloaded relationship now degrades to a missing label (None) instead of a 500, so a future call site that forgets an eager load loses a name, not the whole response. The frontend ticket detail page also now tells a real 404 apart from any other failure (ticketError/status), showing distinct copy and, for non-404 failures, a "Try again" button wired to refetchTicket().

extract_email_attachments now recurses via _collect_attachment_parts and treats a message/rfc822 part (Outlook "Forward as Attachment", the standard way a user reports phishing) as a leaf — the whole inner message is serialized to a single .eml file instead of being silently dropped (get_payload(decode=True) returns None for attached messages) or walked into.

record_poll_outcome (both the worker cron and manual "Poll Now") stamps last_poll_at/last_poll_errors (≤10 entries, 300 chars each) onto org settings; /api/alerts surfaces an email_poll_errors alert and Settings → Email renders an amber panel. See full fuzz pass in §20/§25.

Merge button on ticket detail → MergeTicketModal: search for the duplicate, radio-pick which ticket survives → POST /api/tickets/{id}/merge. Everything of substance (comments, attachments, time entries, expenses, mileage, shipments, linked docs, appointments, reminders) moves to the survivor; the duplicate becomes a closed stub with merged_into_ticket_id set. The administrative close deliberately sends NO client emails and NO CSAT survey. Inbound email replies to the dup's thread are rerouted to the survivor via _follow_merge_chain.

/tickets → tick two or more rows → the floating selection bar's Merge button → MergeSelectedTicketsModal. The tickets are already chosen, so the only question is which one survives: every selected ticket is a radio row, the rest close as stubs pointing at it. Same POST /api/tickets/{id}/merge endpoint as the detail-page dialog.

New TicketVisitsCard on the ticket detail sidebar (above Reminders) — lists the ticket's own dispatch appointments (GET /api/dispatch/appointments?ticket_id=) and lets you schedule one without leaving the ticket page, via the shared AppointmentModal opened with a fixedTicket.

Owner report — "The cards trail all the way down the page on the right and I feel like a lot of it can be compressed." The sidebar became a compact triage panel: a Properties card (Status/Priority and Assignee/Due Date as two-column grids, Client/Tags full-width, Submitted-By/Created folded into a two-line meta footer with no card heading), a single merged Time card (Start Timer + Log Time side by side, Stop + Log while a timer is running, Total/Billable rolled into the header line, the entry list — >5 entries scrolls at max-h-[17rem] — inside the same card), and everything else as a collapsible SidebarSection: Visits, Reminders, Tasks, "Also Copied" (CC), Attachments, Client Satisfaction, and AI Tools. Collapsed = a single 42px header row with a count pill. On desktop the whole sidebar is sticky (lg:sticky top-[4.75rem], its own max-h/overflow-y-auto) so it stays at hand while a long thread scrolls.

Assignee, Client, Due Date, and Tags no longer require entering ticket Edit mode — each control (handleAssigneeChange/handleClientChange/commitDueDate/commitTagInput/handleRemoveTag) fires its own PATCH independent of the title/description Edit-mode flow, and each disables itself (disabled={updateTicket.isPending}) while its mutation is in flight.

Due Date is now a locally-buffered dueDateDraft state (synced from ticket.due_date via useEffect) instead of saving on every onChange. A native <input type="date"> fires onChange with intermediate, partially-typed values while the user is mid-keystroke (e.g. a year segment reading 0002 on the way to 2026), and the ORIGINAL inline-save implementation PATCHed every one of those — this fix buffers locally and only calls commitDueDate() on blur or Enter (which blurs the field, reusing the same commit path).

Activity details now carries typed old/new values (enums as their lowercase value, tag lists as real arrays, dates as ISO strings) plus resolved old_label/new_label for FK fields (client/contact/assignee/asset/SLA policy/project); describeTicketActivity() (frontend/src/lib/ticketActivity.ts) turns action+details into a human sentence instead of the raw action key.

The timeline was printing a row for things the card beneath it already said ("Added an internal note" directly above the note), and one save that changed three fields cost three blocks each repeating the same name and timestamp. lib/ticketTimeline.ts drops the announcement rows, folds a run of one person's changes into one entry, and activities now render as a quiet one-line row rather than a card. Nothing is dropped from the API — GET /api/tickets/{id}/timeline still returns every row, so this is reversible and the audit trail is untouched. Measured on a planted ticket: 17 rows / 1766px → 8 entries / 796px.

The 7-tile status bar became 9 tiles: Open (new, an AGGREGATE condition — every ticket not resolved/closed, matching the dashboard's Open Tickets KPI — sitting between New and In Progress) plus Due Today and Past Due (amber/red, appended after Closed). GET /api/tickets/stats now also returns overdue/due_today counts computed from the same past_due_condition/due_today_condition the ?overdue=1/?due_today=1 list filters use, and ?open=1 matches the aggregate sense (the literal open status is still reachable via the status dropdown/?status=open). Due dates are UTC-midnight calendar dates — "today" and "past" are judged against the UTC calendar day, not the browser's local day or a rolling 24h window, mirrored between backend/app/api/tickets.py (_utc_today_bounds) and frontend/src/lib/utils.ts (isDueOverdue/isDueToday/formatDueDate).

The ticket list (GET /api/tickets) now embeds each row's PENDING reminders (reminders: TicketReminderBrief[], soonest-first, fired_at IS NULL only) so the list page can show a bell without a per-row follow-up request. GET /api/tickets/{id} (single-ticket fetch) deliberately does NOT load them — reminders is null there, not an empty array, so the frontend can tell "not loaded" apart from "genuinely none pending."

GET /api/tickets/export?format=csv|json shares its filter logic with the list endpoint (_filtered_ticket_query), so the file always matches what the filtered/searched list currently shows — unpaginated. No role gate: any authenticated user can export. Logged to the audit trail as read.export.

Row checkboxes (desktop table + mobile card list) build a selected id set that persists across pagination/filter changes until cleared or applied. Shift-click a checkbox range-selects between it and the last-clicked row; "select all on page" and a Gmail-style "select all N matching this filter" (capped at 500, POST /api/tickets/?per_page=500) are also available. A floating pill bar appears once anything is selected, offering Bulk Edit (POST /api/tickets/bulk, any authenticated user) and, admin-only, Delete (POST /api/tickets/bulk-delete, require_role(ADMIN)). Every field in the Bulk Edit modal defaults to "No change" and is only sent if the user touched it (exclude_unset server-side); add_tags unions into each ticket's existing tags, remove_tags subtracts, and status changes suppress client emails/CSAT surveys unless "Email clients about this change" is explicitly checked.

(migration 021 — HIGH PRIORITY, needs review)

Attachments gained an optional single-level folder string (folders have no identity of their own — they exist only through the files filed in them). Upload directly into a folder via the folder-header upload icon; rename/move a file via the pencil / folder-input icons or by dragging its row; rename a whole folder (refiles every file in it as ONE undeletable timeline entry, folder_renamed) via the pencil on the folder header — renaming onto an existing folder name MERGES the two. Shared _strip_name hygiene (strips path separators, Unicode control/format chars incl. bidi overrides, and rejects dots-only names) now guards folder names, renamed filenames, AND upload filenames; a new content_disposition() helper (RFC 6266) fixed a latent crash where a non-ASCII filename set raw into Content-Disposition would blow up the response — this is app-wide (§3 Ticket attachments, §8 Client documents, §12 Expense receipts, §17 Vendor attachments, Portal downloads), not incident-only.

(A lead can be kept as a "Keep / Networking" (reference) card — a contact worth keeping but not an active deal — tagged for slicing, and given a follow-up date that drives an alert + a fired-once reminder notification. Backend: app/api/leads.py, app/services/lead_service.py, app/tasks/worker.py:notify_due_lead_followups. Frontend: components/leads/LeadFields.tsx (TagInput, FollowUpPicker, FollowUpBadge).)

(migration 026 — HIGH PRIORITY, needs review — AI-driven research, no admin gating, real outbound network calls)

Prospect.status is declared on the model as a native Enum(ProspectStatus), but migration 026 created the column as VARCHAR(20) and never created the prospectstatus PostgreSQL type. On real Postgres, SQLAlchemy casts every bound parameter for that column to the declared type — so EVERY write (creating a prospect via "Research Prospect", the worker stamping researched/failed when the AI brief lands, a manual status change) 500'd with type "prospectstatus" does not exist. Reads were unaffected, which is why the module looked healthy at a glance. The SQLite test suite is structurally blind to this class (Enum compiles to VARCHAR there). Migration 059 creates the type and converts the column in place; a new tests/test_schema_parity.py compares every model's native enum types against the migration sources so a future regression of this shape fails a fast unit test instead of shipping a silent 500.

GET /api/clients?search= now splits the query on whitespace and ANDs each token as a name ILIKE OR email ILIKE match (was a single name ILIKE substring match) — meant to tolerate odd spacing/word-order from Atera/CSV-imported client names.

The detail header gained Start Timer / Log Time / New Ticket buttons (alongside Edit), and a 4th "Report" tab (ProjectReportTab, sharing the reports engine scoped to this project).

The row's second line used to be JUST the client name no matter what the entry was linked to, so a ticket entry on a project never showed which project it belonged to on /time. associationLabel's ticket branch now builds the second line from a ·-joined crumbs() helper over every OTHER link the entry has (client, and now project), dropping any that are absent instead of rendering a stray separator.

An entry's client is derived explicit > project > ticket, so an Acme project plus a Globex ticket used to save quietly and bill Globex's work to Acme. Every path that creates or re-links an entry now refuses that: manual entry, the timer, the entry editor, bulk edit, the AI assistant's log-time tool, accepting an AI time suggestion, and the spreadsheet import.

Time entries, expenses and mileage trips each keep the client they were logged against, so correcting a ticket's client used to leave all of it on the old client's books. The ticket page now asks. Nothing invoiced ever moves.

The ticket page's own cut-down inline "Add Time" form (date + duration + notes + billable, no client/project fields) was replaced by the shared Log Time modal, locked to that ticket. Both the sidebar Time Tracking card and the Time Entries card open it.