# Booking-request application trial / 预约申请网站试用

This is a test protocol, not a completed benchmark. 所有结果待实际执行后填写。

## Common brief / 统一任务

Build a consulting service list, name/email/request form, persistent submissions,
and operator-only request list. Use fictional data. Receiving an application
must not be described as confirming a time slot. Do not connect real payments
or send email. Implement server-side permissions; hiding a UI is insufficient.
Explain data storage, runtime setup, publishing and code export.

## Record before running

Tool and version:
Plan and date:
Starting files / account settings:
Time limit:
Spending limit and currency:
Reviewer:

## Record actual results (leave unperformed checks blank)

| Check | Expected | Actual | Evidence / artifact | Pass / Fail / Not run |
|---|---|---|---|---|
| Empty form | Validation identifies missing fields | | | |
| Submit | One stored request; not a confirmed booking | | | |
| Unauthorized read | No access to request list through UI or API | | | |
| Refresh | Data persists as documented | | | |
| Change service name | Existing submission flow still works | | | |
| Export | Runnable code and setup instructions; no frontend secrets | | | |

First output:
Correction prompts and count:
Final output:
Unresolved failures:
Actual generation spend:
Recurring hosting / data / subscription costs:
Operator time (setup + review + rework):
What was not tested:

A permission failure blocks release. Passing this sheet is not a complete
security audit. Keep failures; do not replace them with a synthetic success.