docs: record first live staging smoke run

TASKS.md

@@ -2,18 +2,18 @@
 
 ## Current
 
-### `feat/next-live-staging-pass`
+### `feat/live-staging-run`
 
 Status: completed
 
 DoD:
-- automated staging smoke helper exists
-- helper validates core public routes, auth session JSON and legacy redirects
-- deploy smoke runbook and README reference the helper
+- first real staging regression entry exists
+- public routes, auth session JSON, MCP health and legacy redirects are recorded against the live domain
+- follow-up for the next authenticated staging pass is captured
 
 ## Next
 
-- `feat/live-staging-run`
+- `feat/authenticated-staging-pass`
 
 ## Backlog
 

docs/staging-regression-notes.md

@@ -1,5 +1,49 @@
 # Staging Regression Notes
 
+## 2026-04-07 12:53 MSK — rmcp.itexp.me
+
+- deploy commit: `unknown`
+- checked by: `codex + operator`
+- smoke status: `partial`
+- scope:
+  - auth
+  - ui shell
+  - mcp health
+  - clean routes
+  - legacy redirects
+
+### Passed
+
+- `bash scripts/staging-smoke.sh https://rmcp.itexp.me` passed.
+- public routes returned `200`:
+  - `/`
+  - `/login`
+  - `/agents`
+  - `/secrets`
+  - `/wizard/`
+  - `/mcp/health`
+- `/api/auth/session` returned `401` with `application/json`, not HTML fallback:
+  - `{"error":{"code":"unauthorized","message":"authentication required"}}`
+- legacy routes redirected correctly:
+  - `/html/login.html` -> `/login`
+  - `/html/agents.html` -> `/agents`
+  - `/html/wizard/` -> `/wizard/`
+
+### Findings
+
+- none in this pass
+
+### Infra notes
+
+- this pass covered only unauthenticated public/staging smoke;
+- authenticated UI flows, MCP tool calls, secrets/auth-profile flows and protocol smoke were not exercised in this entry.
+
+### Follow-up
+
+- run a full authenticated browser smoke after the next deploy;
+- record `REST`, `GraphQL`, `gRPC` protocol smoke results in the next entry;
+- add WebSocket/SOAP status as `not exercised` or `passed/failed` explicitly.
+
 ## 1. Назначение
 
 Этот документ фиксирует результаты ручных проверок на staging/production-like окружении после deploy.
@@ -120,9 +164,7 @@
 
 ## 6. Open follow-up inventory
 
-Пока документ создается как шаблон, без зафиксированных staging defects.
-
-Первый реальный проход должен заполнить минимум:
+Следующий полный проход должен заполнить минимум:
 
 - auth/login status;
 - clean routes status;
@@ -135,8 +177,8 @@
 
 ## 7. Последняя актуальная запись
 
-На момент создания документа:
+На данный момент:
 
 - automated baseline локально зеленый;
-- канонический post-deploy smoke runbook существует;
-- staging findings еще не занесены.
+- helper-based staging smoke на `rmcp.itexp.me` прошел;
+- полный authenticated staging pass еще не занесен.