[saqibmanan]

What changed

ParakhAI-Backend#130 (dev) and #133 (main) add updated_at to the audits sort and filter allowlists (apps/model_audits/services/cached_queries.py).

Tests added

In tests/api/test_graphql_authenticated.py, class TestAuditsUpdatedAt (markers api, regression, auth; CI's API job runs -m api):

• test_audits_sorted_by_updated_at_asc_is_non_decreasing: sorts ascending, because the default order (created_at desc) would fail the check.
• test_audits_filtered_by_updated_at_narrows_the_result: takes the 10th-newest updatedAt as the cutoff, filters on gte, and asserts 0 < filtered < total.

The allowlist docstrings in test_security.py now list updated_at.

Validation on dev (2026-11-06)

• Green 3 times in a row: 2 passed.
• Red proof, simulating a resolver that ignores the arguments:
  • Sort dropped:

    AssertionError: updatedAt is not ascending: ['2026-11-05T18:53:40…', '2026-11-05T18:53:14…', …]
    

  • Filter dropped:

    AssertionError: Filtering on updated_at >= 2026-11-05T18:51:51… returned 1249 of 1249 audits; the filter was not applied
    

Not covered

• ParakhAI-Backend#128 (recompute passed/failed counts after evaluator review) needs an evaluator review flow with write access.
• ParakhAI-Backend#106 (Deepseek peak/off-peak pricing) has no API-visible surface to assert on without running a paid evaluation.
• #129, #135 and #55 are dependency pins and bumps, so they get no test.