lxq/changes/n04-onboard/.superpowers/sdd/reviews/W3-wave.md

W3 Wave Review: n04-onboard

• Wave: W3
• Base SHA: a5730a7
• Head SHA: 310d931
• Verdict: PASS (conditional)
• Blocking findings inside W3: None
• Release status: blocked by external verification gates

Scope Reviewed

Read the execution contract, onboarding-checklist and company-knowledge specs, design, W3 task reports (W3-T6.md, W3-T6-rereview.md, W3-T7.md, W3-T8.md, W3-T8-rereview.md), task briefs where needed, the combined diff a5730a7..310d931, and the relevant production, integration-test, OpenAPI, and documentation artifacts.

The combined diff contains 31 files, +7123/-1903. W3 production changes are limited to:

• SecurityConfig.java
• OnboardingChecklistItemRepository.java
• OnboardingChecklistService.java
• CompanyKnowledgeService.java

The remainder is onboarding integration/privacy/end-to-end testing, OpenAPI/docs, and SDD workflow artifacts. No V1-V38 migration is modified in W3. No existing API path, request/response shape, or error semantics are intentionally changed.

Cross-Task Integration

Permissions and ownership

• /onboarding/** is explicitly authenticated; anonymous requests return 401 through the existing security entry point.
• STUDENT and COMPANY role checks are enforced in service code, not merely by the HTTP matcher.
• Company operations resolve the company from owner_user_id and reject cross-company checklist mutation with 9701/404 without modifying the target row.
• Privacy assertions cover success and error responses and verify absence of internal IDs, hashes, moderation fields, tokens, IP/User-Agent, phone, and email fields.

Concurrency and isolation

• Company checklist creation runs at READ_COMMITTED, acquires a PESSIMISTIC_WRITE company-row lock, and uses a locking read for company item lookup before idempotency and active-count decisions.
• The 49-to-50 boundary is deterministic under H2 MODE=MySQL with the connection default forced to REPEATABLE_READ; the test observes exactly one success and one 9703, with 50 active rows.
• Progress updates serialize per student user through a pessimistic user lock; concurrent first creation produces one progress row.
• Knowledge upserts serialize on the owning company row and map optimistic/duplicate-key conflicts to 9706.
• The focused concurrency suite passes. Real MySQL 8.4 lock/deadlock behavior remains an external acceptance gate.

End-to-end contract

• T7 exercises all 9 onboarding operations through the real Spring context, JWT/security chain, MockMvc, H2 persistence, and DTO serialization.
• Coverage includes standard/company checklist merge and fallback, completion and cancellation, stale versions, idempotent replay and hash conflict, 50-item limit, soft delete/repeat delete, cross-company isolation, BASIC_ONLY/CONFIGURED, EMPTY/INSUFFICIENT/SUFFICIENT, public-review filtering, tag limits, permission failures, and privacy assertions.
• T8 OpenAPI contains exactly 6 onboarding paths and 9 operations, all with bearer security and the expected response/error references. The repaired examples/defaults match runtime behavior.

Verification Evidence

Required focused regression

cd D:\1\zhi\zhilai\mydreamjob-server
$env:JAVA_HOME='D:\java'; $env:Path='D:\java\bin;'+$env:Path
& 'D:\maven\apache-maven-3.9.7\bin\mvn.cmd' '-Dtest=Onboarding*Test,CompanyKnowledge*Test' test

Result: Tests run: 96, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS.

Production-isolation concurrency check

& 'D:\maven\apache-maven-3.9.7\bin\mvn.cmd' '-Dtest=OnboardingConcurrencyIntegrationTest$RepeatableReadLimitBoundary' '-Dspring.datasource.hikari.transaction-isolation=TRANSACTION_REPEATABLE_READ' test

Result: Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS.

Randomized end-to-end ordering

& 'D:\maven\apache-maven-3.9.7\bin\mvn.cmd' '-Dtest=OnboardingEndToEndIntegrationTest' '-Djunit.jupiter.testmethod.order.default=org.junit.jupiter.api.MethodOrderer$Random' test

Result: Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS.

OpenAPI verification

python docs\verify_openapi.py

Result: paths: 135; N04 onboarding endpoints and schemas present (9 operations / 6 paths); No empty ref keys found; Valid JSON: True; All checks passed!.

Structured checks found 0 removed paths, 6 added paths, 0 removed schemas, and 20 added schemas.

External Blockers

The reported full-suite failures were independently reproduced in isolation:

& 'D:\maven\apache-maven-3.9.7\bin\mvn.cmd' '-Dtest=CareerProgressServiceTest,JobReviewDimensionControllerTest,JobReviewDimensionServiceTest,LocalResumeStorageServiceTest' test

Result: Tests run: 69, Failures: 2, Errors: 9, Skipped: 0, BUILD FAILURE.

• CareerProgressServiceTest.fullAggregation_returnsCorrectSummaries fails with expected 1 but got 0.
• JobReviewDimensionControllerTest.listReviews_shouldReturnDimensionScores fails with 500 due a null Page.
• JobReviewDimensionServiceTest.listReviews_shouldReturnDimensionScoresWithoutN1 fails with null Page.getContent().
• LocalResumeStorageServiceTest reports 8 JUnit extension cleanup errors caused by sandbox AccessDeniedException on temporary directories.

These failures are outside the W3 review range. git diff --name-only a5730a7..310d931 contains no files in the failing controllers/services/storage paths. Across the full N04 branch from a2c66b3, the only review-package changes are additive query methods in JobReviewRepository and JobReviewDimensionScoreRepository; the failing CareerProgress and LocalResumeStorage code is unchanged. Therefore W3 itself can pass conditionally, but final release cannot be declared while mvn clean verify is red.

Real MySQL 8.4/Docker execution also remains outstanding. The contract requires it for the final completion proof, and it was not performed without separate authorization.

Minor Findings

• git diff --check a5730a7..310d931 reports two workflow-report files with blank lines at EOF (W2-T4.md, W2-T5.md). This is documentation-only and non-blocking.
• Some OpenAPI error-code assertions remain partly textual rather than exact response-shape assertions. The repaired defaults/examples are covered.
• H2 MODE=MySQL is strong regression coverage but is not a substitute for the pending real-database acceptance gate.

Assessment

W3 passes conditionally. T6 concurrency repair, T7 end-to-end coverage, and T8 contract/docs repair are integrated and verified; no blocking W3 finding remains. The final release/DP-7 gate remains blocked by the independently reproduced non-N04 full-suite failures and the pending real MySQL 8.4/Docker acceptance run.

Report path: D:\1\zhi\zhilai\changes\n04-onboard\.superpowers\sdd\reviews\W3-wave.md