[
  { "id": "T001", "description": "Unit: requireHuduFlag guard returns 404/501 when EE off or flag disabled, passes context when both on", "implemented": true, "commitGroup": "scaffold", "featureIds": ["F001"] },
  { "id": "T002", "description": "Unit: client gating helper returns false by default when flag absent", "implemented": true, "commitGroup": "scaffold", "featureIds": ["F002"] },
  { "id": "T003", "description": "Integration: CE build of /api/integrations/hudu/* returns 501 eeUnavailable", "implemented": true, "commitGroup": "scaffold", "featureIds": ["F004"] },
  { "id": "T004", "description": "Integration: EE build resolves the real route (not 501) when flag on", "implemented": true, "commitGroup": "scaffold", "featureIds": ["F003"] },

  { "id": "T010", "description": "Unit: client injects x-api-key header and base URL from resolved credentials", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F010", "F011"] },
  { "id": "T011", "description": "Unit: credential resolution prefers tenant secret, falls back to env, errors when neither present", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F011"] },
  { "id": "T012", "description": "Unit: pagination fetches multiple pages and stops at first page with < 25 items", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F012"] },
  { "id": "T013", "description": "Unit: pagination treats empty page as terminal and returns accumulated items", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F012"] },
  { "id": "T014", "description": "Unit: 429 triggers Retry-After-based backoff then succeeds; retries are capped", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F013"] },
  { "id": "T015", "description": "Unit: error mapping yields distinct typed results for 401/403/404/422/429/500", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F014"] },
  { "id": "T016", "description": "Unit: domain resource names map to asset_passwords/procedures endpoints", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F015"] },
  { "id": "T017", "description": "Unit: validateConnection returns ok + passwordAccess=false when asset_passwords probe is 403", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F016"] },
  { "id": "T018", "description": "Unit: thrown/returned errors never include the api key or any password value (redaction)", "implemented": true, "commitGroup": "hudu-client", "featureIds": ["F017"] },

  { "id": "T020", "description": "Migration: hudu_integrations created with expected columns, PK (tenant,integration_id), and updated_at trigger; down() drops it", "implemented": true, "commitGroup": "connection", "featureIds": ["F020"] },
  { "id": "T021", "description": "Migration: table is distributed by tenant when Citus enabled; no-op safely when not", "implemented": true, "commitGroup": "connection", "featureIds": ["F021"] },
  { "id": "T022", "description": "Integration: second connection for same tenant violates unique constraint / upserts rather than duplicates", "implemented": true, "commitGroup": "connection", "featureIds": ["F022", "F024"] },
  { "id": "T023", "description": "Integration: connect stores base_url + api_key in secret provider and marks integration active", "implemented": true, "commitGroup": "connection", "featureIds": ["F024"] },
  { "id": "T024", "description": "Integration: test action returns connected + capability for valid creds, error for invalid", "implemented": true, "commitGroup": "connection", "featureIds": ["F025"] },
  { "id": "T025", "description": "Integration: getStatus never includes the api key in its payload", "implemented": true, "commitGroup": "connection", "featureIds": ["F026"] },
  { "id": "T026", "description": "Integration: disconnect deletes secrets, sets inactive, and leaves existing mappings intact", "implemented": true, "commitGroup": "connection", "featureIds": ["F027"] },
  { "id": "T027", "description": "Boundary: CE client-delete and tenant-delete paths never reference hudu_integrations (no error in CE); EE-only code/migrations own its deletes", "implemented": true, "commitGroup": "connection", "featureIds": ["F028"] },
  { "id": "T028", "description": "Boundary: deleting a client removes its hudu mapping rows from tenant_external_entity_mappings (shared CE table) in CE without touching hudu_integrations", "implemented": true, "commitGroup": "connection", "featureIds": ["F028"] },

  { "id": "T030", "description": "Component: Hudu item only renders in Settings>Integrations under IT Documentation when EE+flag", "implemented": true, "commitGroup": "settings-ui", "featureIds": ["F030"] },
  { "id": "T031", "description": "Component: settings panel renders base URL + masked key fields and Test/Connect/Disconnect", "implemented": true, "commitGroup": "settings-ui", "featureIds": ["F031"] },
  { "id": "T032", "description": "Component: status badge reflects Not connected / Connected / Error and password-access indicator", "implemented": true, "commitGroup": "settings-ui", "featureIds": ["F032"] },
  { "id": "T033", "description": "Component: submitting a blank key keeps the existing stored key; key is never pre-filled", "implemented": true, "commitGroup": "settings-ui", "featureIds": ["F033"] },
  { "id": "T034", "description": "Component: invalid base URL shows 404 message, invalid key shows 401 message", "implemented": true, "commitGroup": "settings-ui", "featureIds": ["F034"] },

  { "id": "T040", "description": "Integration: syncHuduCompanies fetches and caches the full paginated company list", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F040"] },
  { "id": "T041", "description": "Unit: matcher picks id_in_integration exact match over name match", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F041"] },
  { "id": "T042", "description": "Unit: matcher falls back to exact name then fuzzy name with lower confidence", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F041"] },
  { "id": "T043", "description": "Unit: matcher returns no suggestion when nothing crosses the fuzzy threshold", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F041"] },
  { "id": "T044", "description": "Integration: setHuduCompanyMapping writes a tenant_external_entity_mappings row with integration_type='hudu'", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F042", "F045"] },
  { "id": "T045", "description": "Integration: mapping a second Hudu company to an already-mapped client is rejected/replaced per one-to-one rule", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F043"] },
  { "id": "T046", "description": "Integration: getHuduCompanyMappings returns companies with mapping + suggestion + mapped client name", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F044"] },
  { "id": "T047", "description": "Integration: clearHuduCompanyMapping removes the mapping row", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F045"] },
  { "id": "T048", "description": "Unit: client_id <-> hudu company id resolver works both directions and returns null when unmapped", "implemented": true, "commitGroup": "company-mapping-data", "featureIds": ["F046"] },

  { "id": "T050", "description": "Component: mapping manager shows counters and a row per Hudu company", "implemented": true, "commitGroup": "company-mapping-ui", "featureIds": ["F050", "F052"] },
  { "id": "T051", "description": "Component: client picker is pre-filled with the suggested match and persists on change", "implemented": true, "commitGroup": "company-mapping-ui", "featureIds": ["F051"] },
  { "id": "T052", "description": "Component: row badge shows Suggested/Mapped/Unmapped correctly", "implemented": true, "commitGroup": "company-mapping-ui", "featureIds": ["F052"] },
  { "id": "T053", "description": "Component: Refresh companies re-pulls list and keeps confirmed mappings intact", "implemented": true, "commitGroup": "company-mapping-ui", "featureIds": ["F053"] },

  { "id": "T060", "description": "Integration: getCompanyAssets resolves mapping and returns paginated Hudu assets for the company", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F060"] },
  { "id": "T061", "description": "Integration: getCompanyArticles returns Hudu articles for the company", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F061"] },
  { "id": "T062", "description": "Integration: getCompanyPasswords returns only name/username/url/id and omits any password value field", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F062", "F064"] },
  { "id": "T063", "description": "Integration: second call within TTL hits cache; Refresh invalidates and re-fetches", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F063"] },
  { "id": "T064", "description": "Unit: deep-link builder produces per-record url and /companies/jump fallback", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F065"] },
  { "id": "T065", "description": "Integration: getCompanyPasswords returns a typed no-password-permission state on 403 instead of throwing", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F066"] },
  { "id": "T067", "description": "Integration: revealHuduPassword does a single live GET, returns the value transiently, and writes nothing to DB, Vault, or cache", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F067"] },
  { "id": "T068", "description": "Integration: each reveal writes an audit entry (who/when/which) that never contains the value; the value is never logged", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F068"] },
  { "id": "T069", "description": "Integration: revealHuduPassword on a key lacking password permission returns a 403 state, not the value", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F067", "F066"] },
  { "id": "T066", "description": "Integration: fetch for an unmapped client returns an unmapped state, no Hudu call made", "implemented": true, "commitGroup": "reference-fetch", "featureIds": ["F060", "F061", "F062"] },

  { "id": "T070", "description": "Component: client Hudu tab hidden unless EE+flag and client mapped + connected", "implemented": true, "commitGroup": "client-hudu-tab", "featureIds": ["F070"] },
  { "id": "T071", "description": "Component: assets and articles sections render rows with counts and deep-links", "implemented": true, "commitGroup": "client-hudu-tab", "featureIds": ["F071", "F072"] },
  { "id": "T073", "description": "Component: empty/error states for not-connected, unmapped, unreachable", "implemented": true, "commitGroup": "client-hudu-tab", "featureIds": ["F074"] },
  { "id": "T074", "description": "Component: Hudu source attribution is visible on the tab", "implemented": true, "commitGroup": "client-hudu-tab", "featureIds": ["F075"] },

  { "id": "T080", "description": "Component: a separate 'Passwords' tab appears on the Client page only when EE+flag, Hudu connected, and client mapped (hidden otherwise)", "implemented": true, "commitGroup": "client-passwords-tab", "featureIds": ["F080"] },
  { "id": "T081", "description": "Component: Passwords tab lists the company's Hudu credentials (name/username/url) with a count and no values", "implemented": true, "commitGroup": "client-passwords-tab", "featureIds": ["F081"] },
  { "id": "T082", "description": "Component: Reveal triggers a live fetch and shows the value masked/reveal-on-click; Open-in-Hudu links out; the value is never written to any persistent store", "implemented": true, "commitGroup": "client-passwords-tab", "featureIds": ["F082"] },
  { "id": "T083", "description": "Component: Passwords tab empty/error states for unmapped/disconnected/no-password-permission", "implemented": true, "commitGroup": "client-passwords-tab", "featureIds": ["F083"] },

  { "id": "T090", "description": "Integration: manage actions (connect/disconnect/mapping) denied without system_settings.update", "implemented": true, "commitGroup": "permissions", "featureIds": ["F090", "F092"] },
  { "id": "T091", "description": "Integration: view-gated surfacing denied without system_settings.read", "implemented": true, "commitGroup": "permissions", "featureIds": ["F090", "F092"] },
  { "id": "T093", "description": "Integration: every Hudu route/action enforces EE + flag + system_settings RBAC", "implemented": true, "commitGroup": "permissions", "featureIds": ["F092"] },

  { "id": "T100", "description": "Static: no hardcoded user-facing strings in Hudu components; all keys resolve", "implemented": true, "commitGroup": "i18n", "featureIds": ["F100"] },

  { "id": "T110", "description": "Security regression: assert no Hudu password value is ever written to any DB table, Vault, cache, or log sink (reveal value transits only to the client)", "implemented": true, "commitGroup": "regression", "featureIds": ["F062", "F064", "F067", "F082"] },
  { "id": "T111", "description": "Regression: disconnect then reconnect with a new key works and surfaces fresh data", "implemented": true, "commitGroup": "regression", "featureIds": ["F024", "F027"] },
  { "id": "T112", "description": "Regression: tenant A cannot read tenant B Hudu connection, mappings, or fetched data", "implemented": true, "commitGroup": "regression", "featureIds": ["F042", "F060", "F062"] },
  { "id": "T113", "description": "Regression: Hudu unreachable / timeout degrades every surface to an error state without crashing", "implemented": true, "commitGroup": "regression", "featureIds": ["F014", "F074", "F083"] },
  { "id": "T114", "description": "Regression: removing a client's mapping immediately empties its Hudu tab and its client Passwords tab", "implemented": true, "commitGroup": "regression", "featureIds": ["F045", "F070", "F080"] }
]