Found by review of #506. Three surfaces still ignore the deployment profile:
- Run packet —
backend-ts/src/audit/audit-packet.ts (~102–113) loads every outcome, computes unfiltered totals, and maps rows with the unfiltered toRunOutcomeRow and the static directory, so on the Maui profile a foreign subject id can reach the downloadable, hash-stamped JSON/HTML.
- Case packet —
audit-packet.ts (~137, ~217) and backend-ts/src/routes/auditor.ts (~56) accept a foreign case id and emit its external id and fallback name.
- Run summaries — the runs CSV (
export-csv.ts ~51), /api/runs (routes/runs.ts ~441, ~1191) and MCP run summaries (mcp/tools.ts ~230) use raw countOutcomesByStatus, so totals can include foreign subjects while the outcome grid excludes them.
Fix shape: profileSubjectMatcher (backend-ts/src/config/deployment-profile.ts) with the request-local directory, applied before rows/totals are assembled and hashed, a no-op on the default profile; for the counts, a per-status histogram that respects the predicate on scoped profiles. Each gets a Maui RED test plus a default companion asserting an unresolvable (QRDA-imported) subject is retained.
Not reachable on a freshly provisioned Maui database (no foreign rows), same premise as #501.
Found by review of #506. Three surfaces still ignore the deployment profile:
backend-ts/src/audit/audit-packet.ts(~102–113) loads every outcome, computes unfiltered totals, and maps rows with the unfilteredtoRunOutcomeRowand the static directory, so on the Maui profile a foreign subject id can reach the downloadable, hash-stamped JSON/HTML.audit-packet.ts(~137, ~217) andbackend-ts/src/routes/auditor.ts(~56) accept a foreign case id and emit its external id and fallback name.export-csv.ts~51),/api/runs(routes/runs.ts~441, ~1191) and MCP run summaries (mcp/tools.ts~230) use rawcountOutcomesByStatus, so totals can include foreign subjects while the outcome grid excludes them.Fix shape:
profileSubjectMatcher(backend-ts/src/config/deployment-profile.ts) with the request-local directory, applied before rows/totals are assembled and hashed, a no-op on the default profile; for the counts, a per-status histogram that respects the predicate on scoped profiles. Each gets a Maui RED test plus a default companion asserting an unresolvable (QRDA-imported) subject is retained.Not reachable on a freshly provisioned Maui database (no foreign rows), same premise as #501.