jarca-ledger-mcp/docs/batches/bat-017_20260708_import-provenance-sensitive-data-policy/verification.md

BAT-017 Verification Evidence

• Status: passed-merged
• Created At (KST): 2026-07-08 11:33 KST

Verification Commands

• . .venv/bin/activate && python -m ruff check jarca_ledger_mcp/application/imports_service.py jarca_ledger_mcp/adapters/mcp/server.py tests/test_import_provenance_policy.py
  • result: pass (All checks passed!)
• . .venv/bin/activate && python -m pytest -q tests/test_import_provenance_policy.py
  • result: pass (11 passed)
• . .venv/bin/activate && python -m ruff check .
  • result: pass (All checks passed!)
• . .venv/bin/activate && python -m pytest -q
  • result: pass (59 passed, 4 skipped)
• StagePilot doctor
  • result: blocked in current workspace/runtime because no discoverable stagepilot-doctor entrypoint or package was present; needs QC classification as pre-existing environment/tooling debt vs. closure blocker.

Expected Gates

• python -m ruff check .
• python -m pytest -q
• source-specific import provenance tests
• MCP privacy/default exposure tests
• fixture/log sensitive-field scan
• affected dashboard smoke, if applicable
• StagePilot doctor with pre-existing debt separated from BAT-017 findings

Batch-specific verification notes

• Full pytest includes the affected import/privacy regression suite and leaves 4 skips in place without introducing new failures.
• Import batch debug-gated exposure now requires explicit debug_provenance_gate=True; the regression suite covers both deny-without-gate and allow-with-gate behavior.
• BAT-017 touched MCP import batch exposure behavior but did not modify dashboard code paths directly; no additional dashboard-only code change was required in this slice.
• Independent QC completed through BAT-017 delivery; QC requested explicit debug gate enforcement, runner applied it, and the second QC handoff passed.

Merge-backed Verification

• PR: https://github.com/genichin/jarca-ledger-mcp/pull/2
• Merge commit: d9182f28f286667fb7ff52115c33ab2e5003b269
• GitHub Actions before merge:
  • contract-regression: pass
  • dashboard-app-test: pass
  • dashboard-http-smoke: pass
  • db-safety-smoke: pass
  • lint: pass
  • pytest-regression: pass
• Local main verification after merge:
  • . .venv/bin/activate && python -m ruff check . → pass (All checks passed!)
  • . .venv/bin/activate && python -m pytest -q → pass (59 passed, 4 skipped)
• StagePilot doctor entrypoint remains unavailable in this runtime and is classified as environment/tooling debt, not a BAT-017 behavior blocker.