feat(openapi): complete upload preview and UI evidence

.gitea/workflows/ci.yml

@@ -214,7 +214,31 @@ jobs:
 
       - name: Run Playwright e2e
         working-directory: apps/ui
-        run: npx playwright test
+        run: |
+          mkdir -p ../../.tmp
+          rm -f ../../.tmp/openapi-playwright.json ../../.tmp/openapi-ui-evidence.json
+          PLAYWRIGHT_JSON_OUTPUT=../../.tmp/openapi-playwright.json npx playwright test
+
+      - name: Collect sanitized OpenAPI UI evidence
+        working-directory: apps/ui
+        run: |
+          trap 'rm -f ../../.tmp/openapi-playwright.json' EXIT
+          python3 ../../scripts/collect-capability-baseline.py playwright \
+            --report ../../.tmp/openapi-playwright.json \
+            --output ../../.tmp/openapi-ui-evidence.json \
+            --source-revision "$(git -C ../.. rev-parse HEAD)" \
+            --environment-class ci \
+            --flow-id openapi-upload-ui \
+            --required-test 'operations page imports OpenAPI methods as drafts' \
+            --required-test 'OpenAPI upload rejects invalid files locally and restores focus after Escape' \
+            --required-test 'OpenAPI upload recovers from pagehide and a preview server error' \
+            --required-test 'OpenAPI upload invalidates active draft creation after language or workspace changes' \
+            --required-test 'OpenAPI upload only renders the latest selected file and clears reset or close races' \
+            --required-test 'OpenAPI upload ignores a stale failure and renders only correlation identifiers'
+          python3 ../../scripts/validate-capability-run.py \
+            --schema ../../docs/schemas/capability-baseline.schema.json \
+            --candidate ../../.tmp/openapi-ui-evidence.json \
+            --require-accepted
 
       - name: Show Playwright stack logs
         if: failure()

.gitea/workflows/release.yml

@@ -121,7 +121,31 @@ jobs:
 
       - name: Run release end-to-end tests
         working-directory: apps/ui
-        run: npm run e2e
+        run: |
+          mkdir -p ../../.tmp
+          rm -f ../../.tmp/openapi-playwright.json ../../.tmp/openapi-ui-evidence.json
+          PLAYWRIGHT_JSON_OUTPUT=../../.tmp/openapi-playwright.json npm run e2e
+
+      - name: Collect sanitized OpenAPI UI release evidence
+        working-directory: apps/ui
+        run: |
+          trap 'rm -f ../../.tmp/openapi-playwright.json' EXIT
+          python3 ../../scripts/collect-capability-baseline.py playwright \
+            --report ../../.tmp/openapi-playwright.json \
+            --output ../../.tmp/openapi-ui-evidence.json \
+            --source-revision "$(git -C ../.. rev-parse HEAD)" \
+            --environment-class release \
+            --flow-id openapi-upload-ui \
+            --required-test 'operations page imports OpenAPI methods as drafts' \
+            --required-test 'OpenAPI upload rejects invalid files locally and restores focus after Escape' \
+            --required-test 'OpenAPI upload recovers from pagehide and a preview server error' \
+            --required-test 'OpenAPI upload invalidates active draft creation after language or workspace changes' \
+            --required-test 'OpenAPI upload only renders the latest selected file and clears reset or close races' \
+            --required-test 'OpenAPI upload ignores a stale failure and renders only correlation identifiers'
+          python3 ../../scripts/validate-capability-run.py \
+            --schema ../../docs/schemas/capability-baseline.schema.json \
+            --candidate ../../.tmp/openapi-ui-evidence.json \
+            --require-accepted
 
       - name: Validate deployment manifests
         run: |
@@ -132,9 +156,12 @@ jobs:
       - name: Package release artifacts
         run: |
           mkdir -p dist/release
+          source_revision="$(git rev-parse HEAD)"
+          evidence_artifact="dist/crank-openapi-ui-evidence-${IMAGE_TAG}-${source_revision}.json"
           cp target/release/admin-api dist/release/admin-api
           cp target/release/crank-migrate dist/release/crank-migrate
           cp target/release/mcp-server dist/release/mcp-server
+          cp .tmp/openapi-ui-evidence.json "$evidence_artifact"
           tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api crank-migrate
           tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
           tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
@@ -142,6 +169,7 @@ jobs:
             dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
             dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
             dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
+            "$evidence_artifact" \
             > dist/crank-community-${IMAGE_TAG}-checksums.txt
 
       - name: Generate SBOM