From ef08717ce54c83d431f191447dc8551040575a4c Mon Sep 17 00:00:00 2001
From: sechmachine <97589681+sechmachine727@users.noreply.github.com>
Date: Sat, 15 Aug 2026 14:36:29 +0700
Subject: [PATCH] docs(test): scope calendar authorization evidence

---
 docs/tests/web/admin-calendar-authentication.md | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/docs/tests/web/admin-calendar-authentication.md b/docs/tests/web/admin-calendar-authentication.md
index fe4fc1c..706eff4 100644
--- a/docs/tests/web/admin-calendar-authentication.md
+++ b/docs/tests/web/admin-calendar-authentication.md
@@ -1,10 +1,20 @@
 # Test Evidence: form-authenticated global calendar access
 
 - **Test type:** Web
-- **Requirement IDs:** `AUTH-001`, `AUTH-002`, `CAL-001`, `SEC-001`, `TST-001`, `TST-003`-`TST-008`
-- **Scenario IDs:** `AC-CAL-003`, `AC-SEC-005`, `AC-TST-001`
+- **Requirement IDs:** `AUTH-002`, `CAL-001`, `SEC-001`, `SEC-013`
+- **Scenario IDs:** `AC-SEC-005`
 - **Test class/method:** `com.lab.labtimesheet.feature.attendance.controller.CalendarAuthorizationWebIntegrationTest#formAuthenticatedAdminCanOpenCalendarWhileMentorAndInternAreDenied`
-- **Implementation commit:** No production implementation change; this regression and its evidence are committed locally for the incident handoff.
+- **Implementation commit:** `c8d4e9eecc59c78941769487af30953fb31a83c5`
+
+## Incident scope
+
+This record covers only the reported HTTP 403 for a fresh Admin session on
+`GET /attendance/calendar`. The separately supplied 500 about policy
+materialization is not a calendar-session or identity-mapping claim. It is
+cross-referenced to
+`.superpowers/sdd/access-navigation-icon-intern-picker/task-4-intern-dashboard-report.md`,
+which independently records valid current PostgreSQL policy/constraint state
+and no reproduction of that 500.
 
 ## Protected behavior