---
id: w4/m7/t007
title: "Test coverage — meaningful tests for the behavior this milestone shipped"
worker: worker4
status: done
estimate: 30m
depends_on: [w4/m7/t005]
---

## Objective

Round out coverage for m7's behavior. The change is config + scripts, so the E2E script is the test vehicle: diff the DoD against its checks and add the missing failure modes — e.g. expired/garbage recovery code rejected, recovery for a nonexistent email neither errors visibly nor sends mail (anti-enumeration), courier misconfigured ⇒ flow degrades without leaking. Tests must assert real behavior and failure modes — never trivial or tautological checks.

## Context

- Standing closing task; vehicle = the t004 script (same role `auth-verify.sh` played for m1).

## Steps

1. Gap-scan DoD + Kratos flow edge cases against the script's assertions.
2. Add the missing negative cases; run green on the mock cluster.

## Files

- `scripts/auth-e2e.sh` / `scripts/auth-mail-e2e.sh`

## Acceptance criteria

- [ ] Every DoD clause and the listed negative cases map to executed checks; script exits 0.

## Out of scope

- Dashboard component tests (pages unchanged this milestone).
