OpenConstructionERP Files

20-wave deep audit + control wave

R7 security pattern revival across three modules + QuickEstimatePage a11y debt cleared + QA harness parameterized.

Added

• QMS audit-log infrastructure (QMSAuditLog model + alembic v3140_qms_audit_log) — records entity-scoped state transitions on NCR raise/close and inspection start/complete. New GET endpoints honour IDOR→404 + tenant scoping. Magic-byte denylist + 8 MB cap on attachment uploads.
• EAC tenant-scoped hardening — aliases router/service/schemas with tenant_id scoping, magic-byte denylist (PE/ELF/ZIP/PDF/PNG/JPEG), Decimal-as-string serialization. 12 new R7-pattern tests.
• CRM R7 orphan tests restored — 5 files / ~59 tests / 1155 lines covering GDPR forget, lead dedupe, money decimal, PII redaction, win role gate.
• Marketing site: concept paper published as standalone news article at /news/open-erp-own-your-stack.html with downloadable PDF. 6 workshop testimonials localized across 20 locales (280 new strings).
• QA harness: 3-layer public-demo modal dismissal + QA_LOCALE / QA_THEME / QA_VIEWPORT / QA_ROUTE_LIMIT env vars + new axe-sweep.spec.ts for accessibility scans.

Changed

• QuickEstimatePage accessibility pass — all 10 deferred findings closed (4 P1 + 6 P2): sr-only labels via useId(), aria-live on LoadingState, role=alert error banners, focus management with refs + tabIndex={-1}, aria-describedby on disabled submit, tablist ARIA, color-only banner sr-only prefixes, aria-hidden decorative icons, SaveDialog focus trap.

Notes

Wave 16-DE i18n audit verified — German locale renders cleanly with no missing-key fallbacks or overflow.

Two QA findings raised for follow-up (non-blocking):

• Authenticated / should redirect to /dashboard
• /costs shows DE chrome but Arabic-script data (regional DB auto-pick missing)

Full diff: https://github.com/DataDrivenConstruction/OpenConstructionERP/compare/v4.11.0...v4.12.0