# Frozen portal quality rubric

Frozen after the six ZIP submissions and frozen acceptance run, before detailed implementation review.

Cost, elapsed time, and token use are reported separately. They do not change the quality score.

## 1. Functional correctness — 40 points

- Raw frozen acceptance result: `40 × passed / 23` per run.
- Report any manually identified harness-only false positive separately, but do not alter the raw score.

## 2. Security and authorization — 20 points

- Ownership visibility and record access enforced server-side: 5
- Staff-only management enforced server-side for GET and POST: 4
- Privileged fields excluded from ordinary-user create/edit paths: 3
- CSRF/session/login/logout protections use Django mechanisms correctly: 2
- Authorization logic is centralized or consistently reused: 2
- Production-safe DEBUG and secret defaults: 2
- No obvious sensitive-data, credential, or mass-assignment defect: 2

## 3. Maintainability and Django conventions — 15 points

- Clear project/app structure and separation of responsibilities: 4
- Readable, low-duplication views/forms/models: 4
- Idiomatic Django query, form, model, and URL usage: 3
- Deterministic seed/migration organization: 2
- Useful documentation without misleading claims: 2

## 4. Test quality — 10 points

- Meaningful breadth across models, forms, views, filtering, and seed behavior: 4
- Strong negative permission and cross-user tests: 3
- Tests are deterministic, isolated, and test behavior rather than implementation trivia: 2
- Tests catch deployment or accessibility regressions without becoming self-defeating: 1

## 5. Mobile usability — 10 points

- No horizontal overflow at 390 CSS pixels on required pages: 3
- Navigation and primary actions remain usable: 2
- Lists, filters, pagination, forms, and detail/history remain readable: 3
- Responsive viewport, labels, focus behavior, and reasonable touch targets: 2

## 6. Deployment cleanliness — 5 points

- No database, debug users, debug requests, caches, or runtime artifacts shipped: 1.5
- Requirements, Procfile, migration state, and documented commands are coherent: 1.5
- Static files and production server configuration are coherent: 1
- Deployment caveats are explicit and accurate: 1

## Reporting rules

- Show both per-run and two-run model totals.
- Preserve raw acceptance scores.
- Call out defects by consequence, not only by failed test name.
- Do not infer API cost where per-run fresh/cached/output receipts are unavailable.
- Concurrent Claude wall-clock time is directional and not directly comparable with serial Codex time.