Acceptance and live-verification checklist

Local automated coverage

PYTHONPATH=app .venv/bin/python -m pytest -q

Tests use isolated in-memory data and fake AI. They demonstrate application rules, not Dodil gateway security or cloud-service compatibility.

• Owner/member/viewer permission matrix for every modifying use case.
• Outsiders cannot enumerate, read, mutate, obtain history, or run AI on private boards/cards.
• Web and MCP actions use the same authorization boundary.
• Required card fields round-trip; invalid input is rejected without partial updates.
• Due-today is not overdue; completed cards are not overdue.
• Membership is required for assignment; only the owner can change membership.
• Dependency links stay inside a board; self-links and cycles are refused.
• Each successful card change is audited; denied/invalid mutations do not change data/history.
• AI suggestions are read-only and restricted to visible data.
• Reviewed checklist steps preserve IDs/completion; unknown/duplicate/cross-card IDs and malformed steps are rejected atomically.
• Every existing-card edit requires a current strict-integer revision through web and MCP; denied/stale updates do not write history. Required-field and coercion-rejection tests cover metadata, assignment, checklist, moves and dependencies.
• Draft checklist additions, selection, editing, completion, removal, cancel/reopen, capacity errors, and viewer controls are exercised in simulated DOM.
• Late checklist/similarity/blocker/summary responses and errors cannot overwrite a later reopening; late dependency saves do not replace a newer editor revision.
• HTML-looking strings remain literal data, never executable UI markup.

Before a public entry can be called verified

These are not verified by local tests and must not be represented as passing:

1. Authorized account holder creates/chooses a Dodil organization and a Freelancer account. Verify eligibility and the current contest deadline. Use only the account, organization, publication and spending scope explicitly authorized by the account holder. A new account is not required when an existing owned organization is suitable.
2. Read the current Dodil build, remix, and SQL guides; inspect platform versions. Run dodil git ci verify and the official remix validator, not merely a YAML parser.
3. With explicit publication authorization, publish a public MIT-licensed repository in the account holder's own Dodil org with both challenge topics. CI must build the exact reviewed revision and deploy it on Ignite.
4. On a fresh remix, confirm the actual app URL from platform output. Verify callback registration in deploy logs; follow the documented fallback only if automatic registration did not occur. Never synthesize the callback host or replace other pool callbacks blindly. Inspect the pool’s sign-in connections; if email/password is intended and missing, an authorized administrator enables its local connection. Signup policy alone does not establish an enabled sign-in method.
5. Complete real appid sign-in for owner, member, viewer, and outsider. Try forged incoming X-Dodil-User headers at the public gateway; the gateway must remove client-controlled identity.
6. Confirm DataK3 table schema and all fields, multi-table mutation/history atomicity, and conflict behavior using the deployed app's own scoped service account. Check that data survives process restart. No external database is permitted.
7. Connect Claude/ChatGPT to the single /mcp endpoint through appid OAuth; approve the correct pending client once. Exercise board creation, assignment, moves, this-week work, overdue, and visibility with real user identities. Do not substitute a service-account identity for a person's session.
8. Apply the correct reviewed migration path before testing the new checklist enhancement (see README). Verify saved checklist IDs/completion survive reload and pod replacement, stale checklist updates return conflicts, and audit entries identify before/after values. Exercise Dodil Models checklist, summary, and semantic matching against real Models responses. Confirm no third-party AI credentials or endpoint are used. Check rate/cost controls before inviting others.
9. Exercise responsive UI, drag-and-drop and keyboard move, canceled/closed edit dialogs, repeated clicks, reload, navigation, backend error handling, and viewer-disabled controls. Authorization must still hold if controls are bypassed.
10. Test two simultaneous edits; stale changes must not silently overwrite newer changes. Test network retry behavior and duplicate create requests.
11. Repeat a fresh-org remix of the final revision, follow only the documented post-remix step, and keep evidence that sign-in, data, CI, web, and MCP work.
12. Submit truthfully through an authorized, policy-compliant channel. Declare AI assistance where required. Do not claim a contest win or earnings before award/payment evidence exists.