Traceability

Each workflow has a source of truth in code, a page that documents it, and a test that exercises it. This matrix keeps the three in step.

Workflow	Source	Documentation	Test evidence
Auth and RBAC	truload-backend/Authorization/*, Models/Identity/ApplicationRole.cs	Auth & access · Security	RBAC guard tests; login verification
Weighing capture	truload-backend/Controllers/WeighingController.cs, TruConnect/src/backend/ (frontend-less)	Weighing · Architecture — now documents both the browser-mediated and TruConnect-direct-to-backend paths	Compliance end-to-end (14-step)
Case and prosecution	Controllers/CaseRegisterController.cs, Controllers/CourtHearingController.cs	Cases & prosecution	Compliance end-to-end (case auto-create + prosecution)
Commercial weighing / tariffs & billing	Models/Financial/CommercialTariffRule.cs, CommercialTariffAccrual.cs, Controllers/Financial/CommercialTariffController.cs, Services/BackgroundJobs/CommercialPeriodicBillingJob.cs, truload-frontend/src/app/[orgSlug]/setup/tariffs/page.tsx	Business models · Setup · Background jobs	commercial-role-permissions.spec.ts (blocked live — see the audit initiative's CRITICAL PATH Blocker 1); no dedicated backend unit test yet for RateBasis/BillingPeriod resolution
Offline capture / sync (frontend PWA)	truload-frontend/src/lib/offline/{db,sync,compliance,offlineCapture}.ts	Offline mode implementation	src/lib/offline/__tests__/compliance.test.ts (7/7), scripts/offline-compliance-parity.mjs (30/30), scripts/offline-charges-parity.mjs (5/5), e2e/api-idempotency.spec.ts
Offline capture / sync (TruConnect, frontend-less)	TruConnect/src/backend/{SyncQueue,ConfigSyncService,BackendClient,ComplianceEngine,LocalWeighingStore}.js	Architecture · Offline mode implementation · Auto-weigh flow	TruConnect/tests/sync-queue-and-config-sync-test.js (19/19), TruConnect/tests/compliance-engine-test.js, TruConnect/tests/local-weighing-and-db-integration-test.js — all real, all passing via ELECTRON_RUN_AS_NODE=1 (matches the compiled native module's ABI), caught and fixed a genuine bug along the way (ConfigSyncService's upsert methods never actually executed). TruConnect/scripts/live-demo-sync-check.js run for real against production (2026-09-11): middleware-demo@truconnect.local authenticates and fully syncs 2 stations, 167 axle configurations, and 812 weight references from live data, with ComplianceEngine computing a correct LEGAL result end to end. Two real backend gaps this run surfaced and fixed: MIDDLEWARE_SERVICE role missing config.read (truload-backend RolePermissionSeeder), and CODEVERTEX-DEMO's IsDemo flag never being set anywhere in the codebase despite SubscriptionEnforcementMiddleware depending on it (UserManagementSeeder/AuthDemoSyncService) — the latter was silently 402'ing every demo/commercial-tenant account's read of Stations/AxleConfiguration. Still not click-through tested: the Mobile/Multideck capture UI's interactive flow in a running Electron window (visual render was confirmed via a screenshot; simulated clicks were blocked by the implementing session's own safety classifier). 2026-09-12 follow-up: a real 403 (GET /api/v1/acts/tolerances → not_available_in_commercial_mode) and a capture-gating hole (weighing could start with no axle config selected and no evidence station/config had ever synced) were fixed — CommercialModeFilter.cs no longer blanket-blocks /api/v1/acts reads, Organization.SelectedLegalFramework lets a commercial tenant opt into Traffic Act/EAC axle-load pre-compliance (default none, since TruLoad may run outside Kenya/East Africa — no framework means no compliance flagging, ControlStatus = "NotEvaluated"), and startWeighing() now gates both modes on a synced station/axle-config. All three TruConnect/tests/*.js suites re-verified passing after the ConfigSyncService.getStatus()/syncOrganizationSettings() changes. Live-verified against production after deploy: the same middleware-demo@truconnect.local account (CODEVERTEX-DEMO, a CommercialWeighing tenant) that hit the 403 now gets a clean 200 with 14 tolerance settings, and live-demo-sync-check.js's full run confirms success: true end to end. One real deploy-verification gap surfaced along the way: the GitHub Actions workflow's own kubectl rollout status health check passed and reported the deploy done, but the raw endpoint still 403'd for roughly a minute afterward — ArgoCD's actual image sync lagged behind the workflow's own "success" signal, so kubectl rollout status was checking the still-old Deployment spec. Re-polling shortly after confirmed the fix; noted here since it means this pipeline's own green checkmark is not sufficient proof of a live fix for a similarly timed verification — a short re-check afterward is warranted. See the plan file's "Follow-up round 2" section for the full design.
Demo tenant (codevertex-demo)	Services/Background/AuthDemoSyncService.cs, Constants/CommercialVerticals.cs	Background jobs	None live yet — service has never executed in production (Nats:Enabled=false, no override); see that page's note and the audit initiative's CRITICAL PATH Blocker 2
Financial / Pesaflow	Controllers/Financial/PaymentCallbackController.cs, Services/Implementations/Financial/ECitizenService.cs	Financial & reports · Integrations (M-PESA)	pesaflow_api_test.py, pesaflow_invoice_e2e.py, pesaflow_callback_reconciliation_e2e.py
Reporting	Controllers/ReportController.cs, SupersetController.cs	Financial & reports	Daily summary + reconciliation exports
API contract	Controllers/*, Swagger generator	Swagger · OpenAPI · Live Swagger	Contract diff on every release
Deployment	devops-k8s/apps/truload-*, charts/app	Deployment	ArgoCD app health, kubectl get ingress
Security	Authorization/*, Middleware/*, docs/AUDIT_SUMMARY_REPORT.md	Security	Internal audit report, all P0 findings resolved
Backup and DR	docs/BACKUP_STORAGE.md, truload-backups PVC	Backup, DR & troubleshooting	Monthly restore drill record

Screenshot coverage

Screenshots live under docs/media/ and are embedded inline in the user guide and operations chapters that reference them. Folders: auth, weighing, caseregister, casemanagement, prosecution, reports, setup, truconnect, user-rbac-shift, security, integrations, special-release, dashboard.