Manual Test Tracking Plan - Security Posture Closure

[github-actions]

Manual Test Tracking Plan - PR-2 Security Posture Closure

Scope

PR-2 only.

This plan tracks manual verification for:

• Patch disposition decisions
• Admin API assumptions and guardrails
• Rollback checks

Out of scope:

• PR-1 compatibility closure tasks
• PR-3 feature or UX expansion

Preconditions

• Branch contains PR-2 documentation and configuration changes only.
• Environment starts cleanly with default PR-2 settings.
• Tester can run container start/restart and review startup logs.

Track A - Patch Disposition Validation

TC-PR2-001 Retained patches remain retained

• Verify expr and ipstore patch decisions are documented as retained in the PR-2 security posture report.
• Confirm no conflicting PR-2 docs state these patches are retired.
• Expected result: retained/retained remains consistent across PR-2 closure docs.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

TC-PR2-002 Nebula default retirement is clearly bounded

• Verify PR-2 report states nebula retirement is by default scenario switch.
• Verify rollback instruction is present and explicit.
• Expected result: reviewer can identify default posture and rollback without ambiguity.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

Track B - Admin API Assumption Checks

TC-PR2-003 Internal-only admin API assumption

• Confirm PR-2 report states admin API is expected to be internal-only.
• Confirm PR-2 QA report includes admin API validation/normalization posture.
• Expected result: both reports communicate the same assumption.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

TC-PR2-004 Invalid admin endpoint fails fast

• Start with an intentionally invalid/non-allowlisted admin API URL.
• Verify startup fails fast with clear configuration rejection behavior.
• Restore valid URL and confirm startup succeeds.
• Expected result: unsafe endpoint rejected; safe endpoint accepted.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

TC-PR2-005 Port exposure assumption holds

• Verify deployment defaults do not publish admin API port 2019.
• Confirm no PR-2 doc contradicts this default posture.
• Expected result: admin API remains non-published by default.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

Track C - Rollback Safety Checks

TC-PR2-006 Scenario rollback switch

• Set CADDY_PATCH_SCENARIO=A.
• Restart and verify the rollback path is accepted by the runtime.
• Return to PR-2 default scenario and verify normal startup.
• Expected result: rollback is deterministic and reversible.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

TC-PR2-007 QA report rollback statement alignment

• Confirm QA report and security posture report use the same rollback instruction.
• Confirm both reports remain strictly PR-2 scoped.
• Expected result: no conflicting rollback guidance; no PR-3 references.
• Status: [ ] Not run [ ] Pass [ ] Fail
• Notes:

Defect Log

ID	Test Case	Severity	Summary	Reproducible	Status

Exit Criteria

• All PR-2 test cases executed.
• No unresolved critical defects.
• Patch disposition, admin API assumptions, and rollback checks are all verified.
• No PR-3 material introduced in this tracking plan.

---

Auto-created from manual_test_pr2_security_posture_closure.md