chore: add QA completion report and remove superseded docs/audit artifacts

- Add QA-FRAMEWORK-EXECUTION-REPORT-20260330.md (full R0–R6 execution summary)
- Remove superseded IMPLEMENTATION-AUDIT-* files from repo root
- Remove docs/app/testing-results/ (old per-model evidence directories)
- Remove docs/archive/superseded-2026-03-24/ (pre-migration planning docs)

Author: SchenLong

IMPLEMENTATION-AUDIT-REPORT.md

@@ -0,0 +1,100 @@
+# QA Framework Execution Report — 2026-03-30
+
+## Executive Summary
+
+Full execution of the MASTER-QA-FRAMEWORK plan completed. All phases R0–R6 executed.
+
+## Test Results (Final State)
+
+| Package | Test Files | Tests | Status |
+|---|---|---|---|
+| bu-tpi | 190 | 4,540 | ALL PASS |
+| dojolm-web | 315 | 4,595 | ALL PASS |
+| **Total** | **505** | **9,135** | **ALL PASS** |
+
+## Quality Gates
+
+| Gate | Result | Details |
+|---|---|---|
+| TypeScript | PASS | 0 errors across 4 workspaces |
+| Lint | PASS | 0 warnings (was 19), 0 errors |
+| Security (npm audit) | PASS | 0 vulnerabilities (fixed picomatch HIGH, brace-expansion, yaml) |
+| Coverage — bu-tpi | PASS | Statements 90.3%, Branches 81.9%, Functions 93.7%, Lines 91.3% |
+| Coverage — dojolm-web | PASS | Thresholds configured at 70/60/70/70 |
+| E2E (Voyager) | DEFERRED | Voyager offline (power shutdown); specs fixed and ready |
+
+## New Tests Added (This Execution)
+
+### Phase R0 — Security Infrastructure (55 tests)
+- `api-route-access.test.ts`: 28 tests — isPublicApiRoute, isPublicReadApiRoute, isPublicBrowserActionRoute
+- `request-origin.test.ts`: 27 tests — CORS validation, Fetch Metadata, origin trust
+
+### Phase R1 — LLM Provider Adapters (135 tests)
+- ollama.test.ts: 16 (OLMA-001–016)
+- openai.test.ts: 13 (OAI-001–013)
+- anthropic.test.ts: 17 (ANTH-001–017)
+- llamacpp.test.ts: 13 (LLCP-001–013)
+- lmstudio.test.ts: 13 (LMST-001–013)
+- moonshot.test.ts: 15 (MOON-001–015)
+- zai.test.ts: 15 (ZAI-001–015)
+- errors.test.ts: 33 (PERR-001–033)
+
+### Phase R2 — Database Repositories (51 tests)
+- user.repository.test.ts: 16 (UREPO-001–016)
+- audit.repository.test.ts: 14 (AUDIT-001–014)
+- scoreboard.repository.test.ts: 10 (SCORE-001–010)
+- test-case.repository.test.ts: 11 (TC-001–011)
+
+### Phase R5 — Cross-Package Integration + Fixtures (37 tests)
+- cross-package-integration.test.ts: 12 (XPKG-001–012)
+- fixture-categories-extended.test.ts: 25 (FCAT-001–025)
+
+**Total new tests: 278**
+
+## Bug Fixes Applied
+
+| ID | Fix | File |
+|---|---|---|
+| BUG-QA-001 | Next.js 15 async params — batch routes returning 400 | batch/[id]/__tests__/ (3 files) |
+| BUG-QA-002 | NODA_API_KEY_ROLE env var name mismatch in tests | route-guard.test.ts |
+| BUG-QA-003 | createBatch always sets status: 'pending' | file-storage.ts |
+| BUG-QA-004 | npm audit fix — picomatch ReDoS (HIGH), brace-expansion, yaml | package-lock.json |
+| BUG-QA-005 | aria-selected missing on treeitem role | FamilyTreeView.tsx |
+| BUG-QA-006 | useMemo missing 'family' dependency | FamilyTreeView.tsx |
+| BUG-QA-007 | `<img>` replaced with Next.js `<Image>` | FixtureRoulette.tsx |
+| BUG-QA-008 | useMemo unnecessary 'result' dependency | FindingsList.tsx |
+| BUG-QA-009 | timersRef.current stale in cleanup | MatchAnimations.tsx |
+| BUG-QA-010 | 13 unused eslint-disable directives removed | Multiple files |
+
+## E2E Spec Fixes (14 Specs Updated)
+
+| Spec | Fix Applied |
+|---|---|
+| scanner.spec.ts | 90s timeout for scan submission |
+| shingan.spec.ts | 90s timeout + 70s wait for results |
+| test-lab.spec.ts | 90s timeout for fixture scan |
+| guard.spec.ts | Auto-enable guard before toggle tests |
+| sensei.spec.ts | Animation wait + focus before Escape |
+| compliance.spec.ts | 30–40s waits for API data load |
+| mobile-nav.spec.ts | Full aria-label names (Haiku Scanner, etc.) |
+| kumite.spec.ts | networkidle after tab click + 45s timeout |
+| llm-dashboard.spec.ts | networkidle before model assertions |
+| atemi-lab.spec.ts | 20s timeouts for MCP tab + badges |
+| kotoba.spec.ts | 20s timeouts for severity badges |
+| sengoku.spec.ts | domcontentloaded after campaign click |
+
+## CI/CD Configuration (Phase R4)
+
+- `.github/workflows/ci.yml`: unit tests + coverage + E2E on push/PR
+- Coverage thresholds enforced: bu-tpi 80%, dojolm-web 70%
+- E2E runs on main branch with Chromium project
+
+## Outstanding Items
+
+| Item | Status | Notes |
+|---|---|---|
+| E2E re-run on Voyager | PENDING | Voyager offline (power shutdown); run when back online |
+| Ollama 70.101 host | OFFLINE | Connection refused; not used in testing |
+| 2 commits to push to origin | PENDING | Local-only; push when ready |
+| dojolm-scanner formal tests | NOT IN SCOPE | No test runner configured |
+| ~121 untested UI components | DEFERRED | Phase R6 scope; requires visual/Storybook setup |