Keep stale test evidence out of a release decision

A release report says every required check passed, but some evidence belongs to an old commit or another service. Repair the evidence-selection function before the report hides those gaps.

Requires Node.js 22 or newer. No package installation or server needed. To work in a container instead, open the folder with VS Code Dev Containers or GitHub Codespaces: .devcontainer/devcontainer.json uses the Dev Containers Node.js 24 image, pinned by digest.
1. Unzip all files into one folder.
2. In that folder, run: node --test exercise.test.mjs
3. Edit evidence-policy.mjs, then run the same command again.

The starter deliberately fails some tests. A successful repair passes every case, including cases that catch common wrong fixes. The browser runs this same cases.mjs with the same fixtures; locally Node runs your code directly. If you completed the optional first stage in the browser, Download my work adds your input as stage1-input.json and the tests include it. Only run code you wrote or reviewed.

1. Find the unsupported claim
Run the old-commit fixture. A passed result for a previous revision does not establish the behavior of this release.

2. Match the scope
For each requirement, find a record for the exact requirement, service and commit. Require a passed result.

3. Check evidence completeness
Every required case must appear in that record. A successful positive request alone says nothing about a denied cross-tenant request.

4. Report gaps precisely
Return the sorted IDs without usable evidence. A fully evidenced release returns an empty array. This is evidence organization, not automatic compliance certification.

SUPPLIED CONTRACT
missingEvidence(requirements, records, target) returns sorted requirement IDs lacking usable evidence. Each requirement has id and requiredCases (positive/negative). A record must match requirement, target.commit and target.service, have result=passed, and list all required case names. Several incomplete records do not substitute for one scoped complete run in this exercise.

REFERENCE
reference.mjs contains an explained solution: Both tenant-policy and replay-policy need records for service=invoices and commit=abc123. An old commit or other service leaves both missing. A record containing owner-allowed without other-tenant-denied leaves tenant-policy missing; a failed replay result leaves replay-policy missing. The output sorts replay-policy before tenant-policy. Under this exercise’s one-complete-run contract, two partial records do not merge into a passing run. Matching metadata still does not prove the assertions were meaningful or that abc123 is deployed.

SCOPE
This exercise uses synthetic requirement IDs, not official ASVS identifiers. Metadata matching cannot prove test quality, evidence authenticity, deployed-build identity, framework compliance or acceptable risk. The accompanying evidence-pack walkthrough addresses human assessment.

NEXT TASK
Which records demonstrate that the tested revision is the one deployed, and who evaluates the adequacy of the tests?

SOURCE
https://owasp.org/projects/asvs
