Source-derived document; review findings and open questions with the application owner.

01 — Executive Current-System Overview

Purpose and scope

The International Waste Shipments (IWS) application is intended to support the management of waste shipments into or out of the country under European and UK rules. The available source represents notifications, movements, assessments, shipments, waste and recovery information, competent authorities, facilities, carriers, financial guarantees, documents, reporting, users, and related lookups. This is a business-domain description inferred from the breadth of the model and request contracts; the evidence does not establish every deployed responsibility or integration boundary. E0006 E0054

The system is best understood as an application family rather than a single proven runtime process. The evidence identifies ASP.NET Web API and MVC components, request handlers, client libraries, core/domain models, Entity Framework data access, document-generation code, email and virus-scanning components, maintenance behavior, and test projects. Different projects target .NET Framework 4.5.2 or 4.8, so one application-wide target framework cannot be confirmed. E0011 E0158 E0316

Actors and external relationships

Observed actors include application users, administrators, internal users, external users, competent authorities, and technical callers of API or request-handler operations. Internal and external user concepts appear in authorization and repository code: internal users may be checked against a competent authority, while external users may be checked against notification ownership or sharing. Import-notification access is reported as denied to non-internal users in the cited authorization implementation. E0182

The human role behind a particular request handler is not always established. For example, movement, consent, and financial-guarantee handlers execute domain operations, but the supplied handler evidence does not identify whether their caller is an MVC controller, Web API endpoint, background process, or another application component. E0008

The system also relates to supporting services. The API is composed through OWIN with bearer-token validation, IdentityServer middleware, claims transformation, Autofac, and Web API dispatch. A separate virus-scanning API exposes an authenticated POST scan operation and an anonymous GET health-style operation on the same route template. The evidence does not establish the deployed authority, endpoint inventory, or whether all configured components are active in production. E0011 E0412

flowchart LR
    U[Application users and administrators] --> W[MVC/Web API application]
    W --> H[Request handlers]
    H --> D[Domain operations and models]
    D --> R[Repositories and persistence]
    R --> DB[(SQL Server / EF data access)]
    W --> A[Authentication and authorization]
    W --> G[Document generation]
    W -.-> X[External services and deployment boundaries]

The solid relationships above are evidenced at component or source level. The dashed external boundary is unresolved: the supplied extracts do not establish which services are deployed together, which are called synchronously, or which are operated by another system. E0011 E0414 E0457

Main business purpose and triggers

The principal business trigger is the creation and processing of an international waste-shipment notification. Controller tests indicate a multi-step creation flow: a user selects a competent authority, submits a notification type, and is redirected through creation-related pages. These tests establish expected controller navigation and mediator interaction under mocks, but do not prove that each step persists a notification in production. E0494

A notification then provides a container for information about organisations, facilities, carriers, waste, routes, customs offices, shipment details, assessments, documents, and financial guarantees. The model evidence establishes these data shapes and the existence of corresponding search and reporting contracts; it does not establish that every field is always populated or that all model values are calculated by the application. E0459 E0006

Movement processing is another major trigger. The domain represents captured or new movements, submission, receipt, completion, rejection, cancellation, and partial rejection. Separate external and internal receipt/completion paths exist in the cited domain evidence. [[LRG-02-0001-781f4f335c5c1c9b::state::MOVEMENT-RECEIPT-COMPLETION-TRANSITIONS]] Provenance gap: artifact/source reference unresolved. [[LRG-02-0001-781f4f335c5c1c9b::claim::BR-CLAIM-002]] Provenance gap: artifact/source reference unresolved.

Assessment decisions provide a further trigger. Observed handlers record consent with a date range, conditions, and date, and perform financial-guarantee creation, approval, refusal, and release operations. These operations show that the application can persist selected decision-related changes; they do not establish the complete decision authority, ordering, or downstream notification behavior. [[LRG-02-0001-781f4f335c5c1c9b::state::ASSESSMENT-CONSENT-GUARANTEE-RECORDS]] Provenance gap: artifact/source reference unresolved. [[LRG-02-0001-781f4f335c5c1c9b::rule::ASSESSMENT-DECISION-RULES]] Provenance gap: artifact/source reference unresolved.

Lifecycle and state changes

Notification assessment

The notification assessment model represents statuses including NotSubmitted, Submitted, InAssessment, Consented, FileClosed, Resubmitted, UnderProhibition, and InDetermination. Unit tests describe a more detailed tested sequence: submission requires notification progress to be complete; successful submission changes the status to Submitted and raises status-change and submission events; receipt is allowed from Submitted; commencement requires receipt and a payment-received date; and completion, transmission, and acknowledgement follow the tested sequence toward decision. E0006 E0279

The same tests show additional transitions, including consent withdrawal, unlocking, reassessment, resubmission, rejection of changes, and closure after decisions. Prohibition is tested from a broad list of non-prohibition states, but not literally from every enum value. Editability is tested for only some statuses, so a complete rule cannot be stated from this evidence. E0279

Movement receipt and completion

The movement state machine represents transitions involving Captured, New, Submitted, Received, PartiallyRejected, Completed, Rejected, and Cancelled. The reported definition treats rejected and cancelled paths as terminal, but production enforcement across all request, handler, and persistence paths is not established. [[LRG-02-0001-781f4f335c5c1c9b::state::MOVEMENT-RECEIPT-COMPLETION-TRANSITIONS]] Provenance gap: artifact/source reference unresolved.

REQ-CUR-001 — Movement receipt validation. When a receipt operation is invoked, the current system must apply the observed receipt guards: the relevant date, quantity, and file identifier must satisfy the domain’s non-default and state rules, and future dates must be rejected where that path applies. The evidence does not prove that external and internal receipt paths use identical guards. [[LRG-02-0001-781f4f335c5c1c9b::decision::MOVEMENT-RECEIPT-COMPLETION-GUARDS]] Provenance gap: artifact/source reference unresolved.

REQ-CUR-002 — Movement completion ordering. On the observed internal completion path, completion must not precede receipt. The domain also validates selected completion date, quantity, file identifier, and future-date conditions. Whether every completion entry point enforces the same rules remains unknown. [[LRG-02-0001-781f4f335c5c1c9b::decision::MOVEMENT-RECEIPT-COMPLETION-GUARDS]] Provenance gap: artifact/source reference unresolved.

Assessment and guarantee decisions

REQ-CUR-003 — Record assessment consent. When consent is processed, the current handler path records a consent date range, conditions, and date. This establishes the observed data change, not the complete eligibility or authorization policy. [[LRG-02-0001-781f4f335c5c1c9b::claim::BR-CLAIM-003]] Provenance gap: artifact/source reference unresolved.

REQ-CUR-004 — Record financial-guarantee decisions. The current system exposes operations to create an import financial guarantee and to approve, refuse, or release a guarantee. Approval and refusal may include references or reasons in the observed paths. Permitted sequencing and transactional guarantees are unresolved. [[LRG-02-0001-781f4f335c5c1c9b::claim::BR-CLAIM-003]] Provenance gap: artifact/source reference unresolved.

Data persistence and derived outputs

The data-access evidence shows Entity Framework-style asynchronous queries, repositories, SQL Server-compatible configuration, stored procedures, parameterized SQL in selected paths, and explicit transaction handling for some operations. For example, notification archiving calls a stored procedure inside a transaction and rolls back on exception, but returns a default "false" value rather than visibly rethrowing. This behavior is repository-specific and should not be generalized to every mutation. E0302 E0173

Authorization is also unevenly visible. Some notification repositories authorize before reading notification-specific information, while other repository methods perform identifier-based reads or mutations without a visible repository-level authorization call. Authorization may occur in a controller, request attribute, handler, stored procedure, or caller; the supplied extracts do not establish complete end-to-end enforcement. E0182 E0414

Reporting and search are represented through DTOs and repositories that call SQL objects and stored procedures under schemas such as Reports, Search, Notification, and ImportNotification. The source supports the existence of advanced search criteria, separate import/export result shapes, finance and freedom-of-information reporting paths, and notification progress results. It does not establish refresh timing, report completeness, or whether named SQL objects are views, tables, or synonyms. E0182 E0459 E0008

Documents are generated through an observed ordered block pipeline. MovementDocument orders document blocks by OrdinalPosition, invokes Merge, and conditionally invokes GenerateAnnex for annex-capable blocks whose HasAnnex value is true. Carrier, facility, and customs-office blocks split work between the main document and annexes. Template structure is treated strictly: missing fields or unexpected facility data can cause failures. Template validity, storage, transmission, and successful production rendering remain unknown. E0457

Exceptions and operational edge cases

The evidence identifies several consequential exception paths. An unknown export-notification number can produce a null dereference in DeleteExportNotificationController because the visible code accesses notificationDetails.NotificationId after a null lookup result. The controller also receives a client-supplied notification identifier on POST; notification-specific ownership and current deletability checks are not visible there. E0105

Notification-number lookup is not full-string validation: the regular expression is unanchored, so a string containing a matching substring may pass. The handler also catches Exception around an authorization-related call and returns null, potentially suppressing database or programming failures as well as authorization failures. E0008

Maintenance behavior is evidenced by tests indicating HTTP 503 responses during maintenance mode. The supplied evidence does not establish which endpoints are exempt, how maintenance is enabled in deployment, or whether background operations are also stopped. E0011 E0401

Open question for Harten: The inspected artifacts are E0105, E0182, E0414, E0412, and E0457. Please confirm, using deployed route configuration, authorization registrations, handler implementations, database procedures, and production configuration, which caller paths are active; whether all mutation and download operations enforce ownership or competent-authority access; which lifecycle transitions are permitted in production; and whether document generation, virus scanning, email, and persistence are synchronous or externally orchestrated. Those artifacts would resolve the consequential gaps between declared contracts, tested expectations, and runtime behavior.

Provenance gap: This passage has no artifact/source citation.

Characterisation scenarios — candidates

Scenario CAND-001 — Submit a complete notification

Provenance gap: This passage has no artifact/source citation.

• Given a notification assessment is NotSubmitted and notification progress is complete
• When the user submits the notification
• Then the assessment becomes Submitted and submission/status-change events are raised. E0279

Scenario CAND-002 — Reject invalid movement completion

Provenance gap: This passage has no artifact/source citation.

• Given a movement has not yet been received
• When an internal completion operation is requested with a completion date
• Then the operation is rejected because completion cannot precede receipt. [[LRG-02-0001-781f4f335c5c1c9b::decision::MOVEMENT-RECEIPT-COMPLETION-GUARDS]] Provenance gap: artifact/source reference unresolved.

Scenario CAND-003 — Handle an unknown deletion number

Provenance gap: This passage has no artifact/source citation.

• Given an export-notification number cannot be resolved
• When the deletion page is submitted
• Then the system should return a controlled not-found or validation outcome rather than dereferencing a null result; the observed controller code does not currently establish that outcome. E0105