Journey Regression Map

This is the QA regression map for stories marked [x] in the canonical user-story development plan. It maps each completed story to unit, integration, RBAC/API, E2E, mobile, accessibility, and PostgreSQL checks.

It is a coverage contract, not proof that every check has passed. The story's completion record, its linked journey contract, and the relevant test output remain the evidence. A historical implementation claim, fixture, scaffold, or browser mock does not turn a required check into verified evidence.

How to use the map

• Keep a row only while the corresponding story is checked in the canonical plan. Add all seven check categories before checking a new story.
• Run the smallest focused checks for the changed behavior and record commands/results in the story completion record. Re-run the broader journey checks when a shared workflow changes.
• Required means the check must be selected and evidenced for a future change or revalidation. Recorded means the current completion record names evidence for that category; it does not make an unexecuted local command pass.
• A story without a migration still has a PostgreSQL check: exercise or review the repository/query path that persists, filters, aggregates, or scopes its data. Use No changed SQL only when the story is genuinely display-only and its backing API/query regression is recorded.
• A browser test that intercepts APIs is UI-contract evidence only. It does not replace persistence, authorization, PostgreSQL, or deployed-runtime evidence.

Required check definitions

Category	Required proof
Unit	Focused component, hook, formatter, policy, or service behavior, including its error/edge state.
Integration	Controller, repository, service, job, notification, or persistence test proving the state reconciles across affected surfaces.
RBAC/API	Direct API/route negative test for self, Program, Organization, and sensitive-data scope as applicable.
E2E	Browser journey from its real entry point through the user-visible outcome; use a real backend for state-changing acceptance evidence.
Mobile	Phone-sized viewport or device path for the same workflow, including touch, fallback, and overflow behavior where applicable.
Accessibility	Keyboard/focus, semantic name/state/error behavior, and an automated axe scan or equivalent targeted assertion.
PostgreSQL	PostgreSQL-compatible migration/query/repository/report execution or focused review; reject dialect-specific SQL and unscoped results.

Completed-story coverage

Each cell names the required focused check. Recorded reflects evidence named in the current canonical completion record; Required identifies coverage that must be recorded during the next revalidation rather than inferred.

Story	Unit	Integration	RBAC/API	E2E	Mobile	Accessibility	PostgreSQL
US-PUB-001 Public portal visibility	Required — public-predicate serializer edge cases.	Recorded — Portal/GoodNearby repository visibility regressions.	Recorded — private, invite-only, unpublished, canceled, and inactive direct-data denial.	Recorded — GoodNearby public list/detail/calendar journey.	Recorded — GoodNearby phone browser run.	Required — keyboard and axe check for public Mission listing/detail filters.	Recorded — repository public-filter query path; re-run against PostgreSQL when changed.
US-PUB-002 Public Mission decision information	Required — public accessibility-note response shaping.	Recorded — publication-settings repository and migration regression.	Recorded — Program-scoped public-settings mutation denial.	Recorded — GoodNearby Mission-detail decision journey.	Recorded — GoodNearby phone browser run.	Required — semantic accessibility-notes section and keyboard/axe check.	Recorded — mission_publication_settings migration and scoped repository query.
US-PUB-003 Public-to-account continuity	Required — continuation URL normalization and fallback.	Recorded — account, role, verification-token, and audit persistence.	Recorded — unallowlisted continuation-origin denial.	Recorded — public Mission sign-up, verification, and return journey.	Recorded — phone browser return-path run.	Required — accessible sign-up/sign-in validation and continuation status.	Required — execute account/verification persistence path against PostgreSQL.
US-PUB-004 Invitation continuity	Required — token/hash and return-target normalization edge cases.	Recorded — handoff issue/consume and no-registration/capacity-mutation regressions.	Recorded — recipient, Program, invite-only, expired, revoked, and direct-API denials.	Recorded — invitation authentication and protected-access journey.	Recorded — GoodNearby phone browser run.	Required — keyboard/error status for invitation loading, unavailable, and confirmation states.	Required — PostgreSQL-backed handoff/capacity acceptance run without intercepted APIs.
US-PUB-005 Safe public gallery and impact	Required — approved-media response and empty-gallery rendering.	Recorded — persisted media/public-payload regression.	Required — private people, requirements, and operational-record exclusion.	Recorded — public gallery preview and full-gallery journey.	Recorded — phone gallery route run.	Required — gallery alt text, dialog/focus, and axe check.	Required — public media filtering query review/execution against PostgreSQL.
US-VOL-015 Check-in and checkout	Recorded — kiosk check-in page behavior.	Recorded — attendance, kiosk, and geofence service regressions.	Required — self, kiosk, and staff direct-endpoint scope denials.	Required — Volunteer and staff checkout through a real deployed backend.	Required — phone self-service/kiosk fallback journey.	Required — keyboard-only fallback, focus, and error announcements.	Required — attendance/hours persistence and reconciliation against PostgreSQL.
US-PM-025 AI-assisted operations	Required — preview/approval and grounded-response rendering behavior.	Required — scoped Copilot, drafting, outreach, risk, and report service integration.	Required — entitlement, Program scope, and unauthorized-data direct API denials.	Required — Program Manager preview-to-approved-action journey using persisted authorized data.	Required — phone viewport preview and approval path.	Required — keyboard, status announcement, and axe coverage for Copilot states.	Required — PostgreSQL execution for any Copilot context, audit, draft, or report query changed by the journey.
US-ORG-014 GoodNearby organization site	Required — organization-site settings and publication-state UI behavior.	Required — organization, Program, navigation, media, and publication persistence/reconciliation.	Required — organization-vs-Program and sibling-organization scope denials.	Required — Organization Admin publish/update to public GoodNearby result journey.	Required — phone public-site and admin-setting verification.	Required — navigation, media, and publish-control keyboard/axe checks.	Required — organization-site publication/filter queries and any migration path.
US-XCUT-005 Webhook event catalog	Required — event catalog, signature, retry, replay, and secret-redaction behavior.	Required — endpoint validation, delivery attempt, retry, replay, and audit persistence.	Required — credential scope, allowed-origin, replay, and delivery-history API denials.	Required — integration-owner configure, send, inspect, and replay journey against a controlled receiver.	Required — phone delivery-history and recovery view.	Required — keyboard/error/status behavior and axe scan for configuration and delivery history.	Required — delivery-history, retry, and audit query/migration execution against PostgreSQL.
US-XCUT-011 AI Copilot foundation	Required — grounding, citation, fallback, and no-fictional-data response behavior.	Required — permission-aware context retrieval, provider handling, and audit/service integration.	Required — entitlement, Organization/Program scope, and sensitive-data API denials.	Required — entitled user asks a scoped question and reaches an authorized next action.	Required — phone Copilot conversation and action affordance path.	Required — keyboard input, streamed/status announcement, focus, and axe coverage.	Required — PostgreSQL execution for scoped grounding, audit, and referenced operational queries.

Map integrity check

Run npm run journey:regression-map:check after changing the canonical plan or this map. It verifies that the rows exactly match currently checked story IDs and that every row includes all seven required categories. It deliberately does not treat the documentation as execution evidence.