# Report Reconciliation: Post-Execution Validation

> **LESSON LEARNED (audit ba-002):** Simple "missing files" warnings were ignored.
> Structured reconciliation tables make gaps impossible to miss.

## Reconciliation 1: Handoff File Coverage

```javascript
const filesToCreate = prd.implementation?.filesToCreate || {};
const handoffReconciliation = { categories: [], totalDeclared: 0, totalPresent: 0, missingFiles: [] };

for (const [cat, files] of Object.entries(filesToCreate)) {
  let declared = 0, present = 0;
  for (const file of (files || [])) {
    declared++;
    const filePath = file.path || file;
    if (fileExists(filePath)) {
      present++;
    } else {
      handoffReconciliation.missingFiles.push({ category: cat, path: filePath });
    }
  }
  handoffReconciliation.categories.push({
    category: cat, declared, present, missing: declared - present,
    coverage: declared > 0 ? Math.round((present / declared) * 100) : 100
  });
  handoffReconciliation.totalDeclared += declared;
  handoffReconciliation.totalPresent += present;
}

const totalHandoffCoverage = handoffReconciliation.totalDeclared > 0
  ? Math.round((handoffReconciliation.totalPresent / handoffReconciliation.totalDeclared) * 100)
  : 100;
```

## Reconciliation 2: Business Rule Coverage

```javascript
const brMapping = prd.implementation?.brToCodeMapping || [];
const brReconciliation = { total: brMapping.length, implemented: 0, missing: [], notTested: [] };

for (const br of brMapping) {
  const componentFile = br.component || br.file;
  const methodName = br.method || br.function;

  if (!componentFile || !fileExists(componentFile)) {
    brReconciliation.missing.push({ id: br.id, rule: br.rule, reason: 'file not found' });
    continue;
  }
  if (methodName) {
    const content = readFile(componentFile);
    if (!content.includes(methodName)) {
      brReconciliation.missing.push({ id: br.id, rule: br.rule, reason: `method ${methodName} not found` });
      continue;
    }
  }
  brReconciliation.implemented++;

  if (br.testFile && !fileExists(br.testFile)) {
    brReconciliation.notTested.push({ id: br.id, rule: br.rule });
  }
}
```

## Reconciliation 3: API Endpoint Coverage

```javascript
const apiEndpoints = prd.implementation?.apiEndpointSummary || [];
const apiReconciliation = { total: apiEndpoints.length, found: 0, missing: [] };

const ctrlFilesForReconciliation = glob('src/**/Controllers/**/*Controller.cs');
for (const ep of apiEndpoints) {
  const opName = ep.operation || ep.name;
  let found = false;
  for (const f of ctrlFilesForReconciliation) {
    const content = readFile(f);
    if (content.includes(opName)) { found = true; break; }
  }
  if (found) {
    apiReconciliation.found++;
  } else {
    apiReconciliation.missing.push({ operation: opName, method: ep.method, path: ep.path });
  }
}

// Log summary
console.log(`Handoff files: ${handoffReconciliation.totalPresent}/${handoffReconciliation.totalDeclared} (${totalHandoffCoverage}%)`);
console.log(`Business rules: ${brReconciliation.implemented}/${brReconciliation.total} implemented`);
console.log(`API endpoints: ${apiReconciliation.found}/${apiReconciliation.total} found`);
```

## Build & Test Verification (Truth Check)

> **LESSON LEARNED (audit ba-002):** "92/92 COMPLETE" + "Build PASS" was reported but the code
> had compilation errors and critical security flaws. The report MUST reflect actual build/test
> state, not just PRD task statuses.

```bash
# REAL build verification — overrides any previous "Build PASS" claim
dotnet build --no-restore --verbosity quiet
FINAL_BUILD_RC=$?

FINAL_TEST_RC=-1
if [ $FINAL_BUILD_RC -eq 0 ]; then
  dotnet test --no-build --verbosity quiet
  FINAL_TEST_RC=$?
fi
```

```javascript
// Override PRD-based build/test status with REAL results
const buildStatus = FINAL_BUILD_RC === 0 ? 'PASS' : 'FAIL';
const testStatus = FINAL_TEST_RC === 0 ? 'PASS' : (FINAL_TEST_RC === -1 ? 'SKIPPED (build failed)' : 'FAIL');

// CRITICAL: If build fails despite all tasks "completed", flag this prominently
if (FINAL_BUILD_RC !== 0 && stats.tasks.completed === stats.tasks.total) {
  console.error('INTEGRITY WARNING: All tasks marked COMPLETE but build FAILS');
  console.error('This indicates phantom task completion — review code quality');
  stats.buildIntegrityWarning = true;
}
```

## MCP Security Scan (Final Gate)

```javascript
// Quick MCP security validation on the final codebase
const securityScan = await mcp__smartstack__validate_security();
const conventionScan = await mcp__smartstack__validate_conventions();

// Check for write endpoints with Read permissions (semantic permission check)
const permissionWarnings = [];
const ctrlFiles = glob('src/**/Controllers/**/*Controller.cs');
for (const f of ctrlFiles) {
  const content = readFile(f);
  const writeWithRead = content.matchAll(/\[(HttpPost|HttpPut|HttpDelete|HttpPatch)[^\]]*\][^[]*\[RequirePermission\([^\)]*\.Read\)\]/gs);
  for (const m of writeWithRead) {
    permissionWarnings.push(`${f}: ${m[1]} uses Read permission`);
  }
}
```
