Store Promotion Acceptance Suite

Run all five test panels and confirm zero failures before promoting any store to authoritative.

Store A Promotion: BLOCKED

Resolve all items below before promotion

2/9 passed

Merchant frontend write audit — UNSAFE=0, NEEDS_REVIEW=0

PASS

All sections[] writers CAS-protected

PASS

Physical record isolation verified

BLOCKED — prerequisite not met

CAS conflict rejection verified

BLOCKED — prerequisite not met

No blocking modifier migration issues

BLOCKED — prerequisite not met

End-to-end mutation chain verified

BLOCKED — prerequisite not met

Backend modifier authorization verified

FAIL — Run the backend auth test panel — all negative tests must be rejected

Writer auth negative tests passed (T1–T8)

FAIL — Run writer auth panel — all 8 rejection scenarios must return errors with records unchanged

Migration lifecycle validated — migration.state = shadow_comparison_passed

FAIL — Run validateStoreMenuShadow below — migration.state must be shadow_comparison_passed before promotion is possible

Test Target Selection

Merchant

Store A (writer)

Store B (must be unaffected)

Merchant Frontend Write Audit

Every merchant-reachable write path — UNSAFE=0 and NEEDS_REVIEW=0 required before promotion

Total paths

Safe

NEEDS_REVIEW 🔶

UNSAFE 🔴

UNSAFE=0 · NEEDS_REVIEW=0 — Merchant frontend write audit PASS

Control record

reviewed_build store-a-cas-hardening-v1

reviewed_at 2026-07-22T23:55:00Z

reviewed_by platform-engineering

inventory_version 1.1.0

Inventory is STATIC — tied to this reviewed build. Any new merchant-reachable write path must be added, re-reviewed, and inventory_version bumped before promotion.

Non-CAS Writer Audit

Every sections[] write path must have a final disposition — NEEDS_AUDIT is not acceptable

14 resolved0 NEEDS_AUDIT (blocking)

Required: each path must be assigned exactly one final disposition before promotion.

• CAS_PROTECTED — writer uses menu_version CAS• DISABLED_FOR_STORE_MENUS — blocked when store_id != null• REMOVED — code path deleted• READ_ONLY_LEGACY_ONLY — reads only, or only touches legacy menus

All writers have a final disposition — writer gate PASS

Control record — static inventory, reviewed build

reviewed_build store-a-cas-hardening-v1

reviewed_at 2026-07-22T23:10:00Z

reviewed_by platform-engineering

inventory_version 1.0.0

total_writers 14

If code changes introduce a new sections[] writer, increment inventory_version and re-review all paths.

Modifier Clone Migration

Clone blocking modifier groups per-store with CAS-protected rewiring

Select Store A above to enable this panel.

Physical Isolation Test

Prove Store A mutations do not affect Store B or legacy. Uses timestamped markers and physical record inspection.

⚠ Select a merchant and Store A to run this test.

CAS Conflict Test

Simulate two concurrent writers at version N. Only Worker A must commit; Worker B must be rejected.

⚠ Select a merchant with an initialized store menu.

Protocol:

① Both workers read menu at version N

② Worker A: updateMany(version=N) → must return updated=1

③ Worker B: updateMany(version=N) → must return updated=0

④ Physical record: final version = N+1, Worker A data present, Worker B absent

⑤ Cleanup read: artifacts absent from physical DB

End-to-End Mutation Chain

Create → Read DB → Read editable store menu → Shadow isolation → Delete → Confirm removal → Final integrity read

⚠ Select a merchant and Store A to run this test.

Chain:

Create item → Read physical DB → 4a Editable store menu read (management path) → 4b Runtime API check (shadow→absent via getMerchantMenu · authoritative→present via getRorkMenu+store_id) → Delete item → Confirm removal → Final integrity read (no artifacts)

Shadow: getMerchantMenu must NOT serve the item (legacy isolation). Authoritative: getRorkMenu({merchant_id, store_id}) must serve the item from the store-specific menu (migration_state=store_menu_authoritative).

Backend Modifier Authorization Test

Negative tests 1–8: each verifies both rejection AND physical records unchanged. Tests 6–8 are new saveItemModifierSetup CAS/ownership gate checks.

Negative tests must verify two things (not just rejection):

① Backend returns an error / non-OK response

② Physical records unchanged: menu_version, group.store_id, item.modifier_group_ids

A backend that mutates before failing is still a security gap.

⚠ Select Store A to run authorization tests.

Writer Authorization Negative Tests

6 rejection scenarios — each verifies: error returned + record unchanged + error code matches

Required evidence per scenario (all three must hold):

① Backend returns error / non-OK response with expected code

② Target record physically unchanged: merchant_id, store_id, is_active, hours, status

③ Error code matches expected pattern (e.g. MODIFIER_STILL_REFERENCED, status 400/403/409)

T1 — foreign merchantT5 — foreign modifier group (Store B required)T2 — foreign store (Store B required)T6 — archive referenced groupT3 — tampered merchant_idT7 — invalid store statusT4 — missing store_idT8 — invalid hours payload

⚠ Select Store A to run authorization tests.