{
  "generatedAt": "2026-07-05T05:22:10+02:00",
  "scope": "Public Webform and form-route dogfood continuation for the Jan Kroeger maturity report.",
  "safety": {
    "productionWrites": false,
    "sensitiveDataUsed": false,
    "destructiveActions": false,
    "notes": [
      "All browser and submit checks ran against https://solcom.ddev.site.",
      "One synthetic local newsletter submission was created with an example.test address.",
      "No Salesforce, Personio, SendGrid, or production endpoint write was executed."
    ]
  },
  "runtime": {
    "ddevPrimaryUrl": "https://solcom.ddev.site",
    "mailpitApi": "http://localhost:8025/api/v1/messages",
    "routerWarning": "Router count mismatch: 30 loaded, 36 expected"
  },
  "inventory": {
    "artifact": "webform-inventory-2026-07-05.json",
    "webformCount": 7,
    "activeOpenWebforms": 7,
    "publicFormRoutesChecked": [
      {
        "source": "/webform/beispiel",
        "status": 301,
        "redirect": "/form/beispiel",
        "targetStatus": 200
      },
      {
        "source": "/webform/contact_form",
        "status": 301,
        "redirect": "/form/contact-form",
        "targetStatus": 200
      },
      {
        "source": "/webform/newsletter_signup",
        "status": 301,
        "redirect": "/form/newsletter-signup",
        "targetStatus": 200
      }
    ]
  },
  "browserEvidence": [
    {
      "route": "/form/beispiel",
      "title": "Projekt erstellen | SOLCOM",
      "screenshot": "webform-beispiel-2026-07-05.png",
      "consoleErrors": 0,
      "result": "reachable",
      "notes": "Public project-create style form with FriendlyCaptcha and enabled email handler. URL slug remains /form/beispiel."
    },
    {
      "route": "/form/contact-form",
      "title": "Kontakt | SOLCOM",
      "screenshot": "webform-contact-2026-07-05.png",
      "consoleErrors": 0,
      "result": "reachable",
      "notes": "Contact form renders required contact fields, privacy checkbox, FriendlyCaptcha, and enabled email handler. No live submit was executed."
    },
    {
      "route": "/form/newsletter-signup",
      "title": "Newsletter abonnieren | SOLCOM",
      "screenshotBefore": "webform-newsletter-before-2026-07-05.png",
      "screenshotAfter": "webform-newsletter-after-2026-07-05.png",
      "consoleErrors": 0,
      "result": "local submit passed",
      "network": {
        "submitRequest": "POST https://solcom.ddev.site/form/newsletter-signup",
        "status": 200
      },
      "confirmationText": "Vielen Dank fuer Ihre Anmeldung. Bitte behalten Sie Ihr Postfach im Blick.",
      "submissionCountBefore": 0,
      "submissionCountAfter": 1,
      "mailpitMessagesBefore": 9,
      "mailpitMessagesAfter": 9,
      "notes": "UI confirmation works and stores a local Webform submission, but no handler sends mail or double-opt-in evidence to Mailpit."
    }
  ],
  "webforms": [
    {
      "id": "beispiel",
      "title": "Projekt erstellen",
      "status": "active/open",
      "route": "/form/beispiel",
      "elements": 40,
      "requiredFields": 4,
      "fileFields": 1,
      "captcha": true,
      "handlers": [
        "email:email:enabled"
      ],
      "localSubmissionCountAfterDogfood": 0,
      "classification": "risk",
      "risk": "The public URL slug /form/beispiel and original config description still look like sample/default Webform provenance, while the rendered page is a production-facing project request form.",
      "acceptanceCriteria": [
        "Public route must be intentionally named and linked for the project-request journey.",
        "Copy, confirmation, and mail recipient must be product-owned rather than inherited sample defaults.",
        "Captcha-enabled submit leg needs a configured local/staging test path before release sign-off."
      ],
      "edgeCases": [
        "Captcha unavailable or unsolved blocks submit.",
        "File upload exceeds 5 MB or unsupported type.",
        "Required privacy checkbox missing.",
        "Email handler recipient misconfigured."
      ]
    },
    {
      "id": "contact_form",
      "title": "Kontakt",
      "status": "active/open",
      "route": "/form/contact-form",
      "elements": 21,
      "requiredFields": 6,
      "fileFields": 0,
      "captcha": true,
      "handlers": [
        "email:email:enabled"
      ],
      "localSubmissionCountAfterDogfood": 11,
      "classification": "partial",
      "risk": "Route and fields are covered by browser and FunctionalJavascript smoke tests, but real submit/mail delivery remains captcha-limited in this local run.",
      "acceptanceCriteria": [
        "Route renders with required contact fields and privacy confirmation.",
        "Empty required fields block submission.",
        "Valid captcha-backed submission reaches the configured mail sink or staging recipient."
      ],
      "edgeCases": [
        "Captcha unavailable.",
        "Invalid business email.",
        "Missing Datenschutz checkbox.",
        "Mail handler does not reach Mailpit/staging inbox."
      ]
    },
    {
      "id": "newsletter_signup",
      "title": "Newsletter abonnieren",
      "status": "active/open",
      "route": "/form/newsletter-signup",
      "elements": 2,
      "requiredFields": 1,
      "fileFields": 0,
      "captcha": false,
      "handlers": [],
      "localSubmissionCountAfterDogfood": 1,
      "classification": "risk",
      "risk": "The happy-path UI passes and stores a local submission, but the Webform has no enabled handler, no Mailpit message, and no local double-opt-in evidence.",
      "acceptanceCriteria": [
        "A valid email shows a clear confirmation.",
        "A real subscription path is documented and observable in Mailpit/staging evidence.",
        "Invalid or empty email must not create a subscription.",
        "Consent/double-opt-in responsibilities are explicit."
      ],
      "edgeCases": [
        "Duplicate email.",
        "Malformed email.",
        "Bot submission because no captcha is present.",
        "No downstream newsletter provider configured."
      ]
    },
    {
      "id": "projektpartner_registration",
      "title": "Projektpartner Registrierung",
      "status": "active/open",
      "route": "/projektportal/registrierung",
      "elements": 59,
      "requiredFields": 13,
      "fileFields": 1,
      "captcha": false,
      "handlers": [
        "solcom_projektpartner_registration:solcom_projektpartner_registration:enabled"
      ],
      "localSubmissionCountAfterDogfood": 12,
      "classification": "covered-by-existing-report",
      "risk": "Already covered by the Jan continuation report with browser/Mailpit evidence; keep in full regression reruns because it is account-creating and email-sending.",
      "acceptanceCriteria": [
        "Registration creates the expected account/submission state.",
        "Mailpit captures registration/verification messages.",
        "Validation and duplicate states are observable."
      ],
      "edgeCases": [
        "Duplicate email.",
        "Missing required company data.",
        "Upload edge case.",
        "Queue/mail failure."
      ]
    },
    {
      "id": "rsm_project_offer_application",
      "title": "RSM Projektangebot Bewerbung",
      "status": "active/open",
      "route": "project-offer controller and watchlist flows",
      "elements": 61,
      "requiredFields": 12,
      "fileFields": 1,
      "captcha": false,
      "handlers": [
        "rsm_project_offer_mail:rsm_project_offer_mail:enabled",
        "solcom_project_offer_account_creation:solcom_project_offer_account_creation:enabled"
      ],
      "localSubmissionCountAfterDogfood": 17,
      "classification": "covered-by-existing-report",
      "risk": "Already covered by the Jan continuation report with browser/Mailpit evidence; keep in full regression reruns because it couples mail and account creation.",
      "acceptanceCriteria": [
        "Application reaches the correct project-offer context.",
        "Mailpit captures the outgoing confirmation/notification.",
        "Account creation side-effect is correct."
      ],
      "edgeCases": [
        "Watchlist bulk apply.",
        "Duplicate account.",
        "Missing project context.",
        "Upload edge case."
      ]
    },
    {
      "id": "salesforce_web_to_lead",
      "title": "Salesforce Web-to-Lead",
      "status": "active/open",
      "route": "render callback / embedded Salesforce lead forms",
      "elements": 22,
      "requiredFields": 9,
      "fileFields": 0,
      "captcha": true,
      "handlers": [
        "salesforce_web_to_lead:salesforce_web_to_lead:enabled"
      ],
      "localSubmissionCountAfterDogfood": 0,
      "classification": "blocked-live-write",
      "risk": "Local unit/kernel regression passed in the endpoint summary, but a real Salesforce Web-to-Lead POST was intentionally not executed without approval.",
      "acceptanceCriteria": [
        "Mapper sends required Salesforce payload fields.",
        "Success and failure statuses are persisted on the submission.",
        "Live/staging write smoke uses approved test lead data only."
      ],
      "edgeCases": [
        "Salesforce HTTP 500.",
        "Captcha unavailable.",
        "Missing required lead field.",
        "Duplicate or test lead cleanup."
      ]
    },
    {
      "id": "vacancy_application",
      "title": "Vacancy Application",
      "status": "active/open",
      "route": "/karriere/{node}/bewerben",
      "elements": 34,
      "requiredFields": 7,
      "fileFields": 3,
      "captcha": false,
      "handlers": [
        "solcom_application_queue:solcom_application_queue:enabled"
      ],
      "localSubmissionCountAfterDogfood": 3,
      "classification": "blocked-live-write",
      "risk": "Local queue/DLQ/purge regression passed in the endpoint summary, but a real Personio application/documents POST was intentionally not executed without approval and API key readiness.",
      "acceptanceCriteria": [
        "Application route is only reachable from a valid vacancy context.",
        "Queue item contains all Personio payload fields and documents.",
        "DLQ and retry behavior are observable.",
        "Standalone public Webform page remains blocked where intended."
      ],
      "edgeCases": [
        "Missing vacancy context.",
        "Oversized or unsupported documents.",
        "Personio API failure.",
        "Purge timing for sensitive application data."
      ]
    }
  ],
  "regressionCommands": [
    {
      "command": "ddev exec ./vendor/bin/phpunit -c web/core/phpunit.xml.dist web/modules/custom/solcom_editorial/tests/src/Kernel/PublicWebformCopyUpdateTest.php",
      "result": "pass",
      "tests": 1,
      "assertions": 14,
      "duration": "00:44.545"
    },
    {
      "command": "ddev exec env SIMPLETEST_DB='mysql://db:db@db/db' ./vendor/bin/phpunit -c web/core/phpunit.xml.dist web/modules/custom/solcom_editorial/tests/src/FunctionalJavascript/ContactFormSmokeTest.php web/modules/custom/solcom_editorial/tests/src/FunctionalJavascript/NewsletterSignupSmokeTest.php",
      "result": "pass-with-deprecations",
      "tests": 7,
      "assertions": 8,
      "deprecations": 46,
      "duration": "05:25.895"
    }
  ],
  "maturityImpact": {
    "scoreDelta": -1,
    "reason": "Public Webform surface is broader than the route smoke inventory alone implied: newsletter has no downstream handler evidence, and /form/beispiel remains publicly exposed with sample-style slug/provenance.",
    "updatedRecommendedScore": 51,
    "releaseAssessment": "UAT-Beta, not release-ready without explicit decisions for newsletter downstream integration and the /form/beispiel project-request route."
  }
}