PASS valid encrypted live-capture intake decrypts and re-encodes JPEG
PASS relay fetch is pinned to a fixed HTTPS origin
PASS QR cannot provide an arbitrary fetch URL
PASS wrong AES key is rejected even after previous successful scan
PASS expired ciphertext cannot be imported
PASS invalid consent, capture metadata or image rejected 5
PASS invalid consent, capture metadata or image rejected 6
PASS invalid consent, capture metadata or image rejected 7
PASS invalid consent, capture metadata or image rejected 8
PASS invalid consent, capture metadata or image rejected 9
PASS case and photo are committed atomically
PASS authenticated photo readback matches retained JPEG
PASS case lists contain metadata, not image bytes or relay keys
PASS mismatched applicant cannot claim a photo
PASS corrections preserve original captured evidence
PASS one intake cannot be attached to a second case
PASS duplicate photo failure rolls back the entire new registration
PASS audit logs contain evidence hash and actions, not photo bytes
PASS encrypted backup restores the retained photo unchanged
PASS schema addition and restore preserve existing administrator credentials
PASS real browser capture, AES-GCM and QR contract decode on host
{"passed":21,"scope":"isolated synthetic data; no source system or field deployment","backupRestored":true}
