bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: harden community production foundation through story 1.5

Browse Source
This commit is contained in:
bsodfather
2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/capability-baseline/manifest.json
+31
View File
@@ -0,0 +1,31 @@
{
"artifacts": [
{
"kind": "inventory",
"path": "docs/capability-inventory.json",
"sha256": "fa6728e211dc55bf49225884a6cf0182ecb2e3bc1dc59e4580499e551ae4dcf1"
},
{
"kind": "required_surfaces",
"path": "docs/capability-baseline/required-surfaces.json",
"sha256": "61714a2a141cf0a657816f35a6bfe31a7f2de77296303343bfaf6aeab9802681"
},
{
"kind": "taxonomy",
"path": "docs/capability-baseline/outcome-taxonomy.json",
"sha256": "2a57ef358ea08ad436bd96244cd7000a660e90b4ecd04a27d5fd071ea394e549"
},
{
"kind": "checklist",
"path": "docs/capability-baseline/manual-checklist.md",
"sha256": "688cafba282bac5a781f6b90f1a305d2ec30d1bf11b5a1f1af1f20fed3c26798"
},
{
"kind": "results",
"path": "docs/capability-baseline/results.json",
"sha256": "aa127c8e5aabed6bdc4fdcb4734da7ea1c4b2c82e42ff47c603737e2ffa38e58"
}
],
"baseline_version": "2026.08.10.1",
"schema_version": 1
}
docs/capability-baseline/manual-checklist.md
+89
View File
@@ -0,0 +1,89 @@
# Community UI capability baseline checklist
baseline_version: 2026.08.10.1
This is a bounded brownfield baseline, not the release-candidate regression from Epic 8. For every charter record happy, loading, empty, error, recovery, stale-response, RU/EN, and safe-output observations. Use `not_run` for an applicable unexecuted state, `gap` for a missing required contract, and `n/a` only with a by-design reason.
## UI-01 Authentication and workspace
- flow_id: ui-auth-workspace
- states: happy, loading, error, recovery, stale, ru-en, safe-output
- verdict: pass
- reason: Wrong-password error and successful recovery were observed; settings and RU/EN navigation remained usable.
## UI-02 Operations catalog and lifecycle
- flow_id: ui-operation-lifecycle
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Happy, loading, empty, error and recovery rendered, but an older response overwrote newer state and a credential-shaped error canary reached the DOM; see DEF-UI-001 and DEF-UI-003.
## UI-03 Operation test execution
- flow_id: ui-operation-test
- states: happy, loading, error, recovery, stale, ru-en, safe-output
- verdict: pass
- reason: Wizard happy path, validation feedback and recovery controls were observed; loading and empty are not applicable to this local step flow.
## UI-04 YAML and OpenAPI import/export
- flow_id: ui-operation-import-export
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Import entry and recovery are present, but EN mode still exposes Russian-only OpenAPI text; see DEF-UI-002.
## UI-05 Agent lifecycle and bindings
- flow_id: ui-agent-management
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Happy, error and recovery rendered, but stale-response protection is absent and a credential-shaped error canary reached the DOM; see DEF-UI-001 and DEF-UI-003.
## UI-06 MCP and approval keys
- flow_id: ui-mcp-approval-keys
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: pass
- reason: Agent selection, key creation entry and single raw-key disclosure guidance were observed; the seeded stack made the initial empty state inapplicable.
## UI-07 Auth Profiles, Upstreams, and Secrets
- flow_id: ui-auth-profiles-upstreams-secrets
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Happy, real empty, error and recovery rendered, but a credential-shaped error canary reached the DOM; see DEF-UI-003.
## UI-08 Logs and approvals
- flow_id: ui-logs-approvals
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Happy, error and recovery rendered, but a credential-shaped error canary reached the DOM; see DEF-UI-003.
## UI-09 Usage
- flow_id: ui-usage
- states: happy, loading, empty, error, recovery, stale, ru-en, safe-output
- verdict: fail
- reason: Happy, error and recovery rendered, but a credential-shaped error canary reached the DOM; see DEF-UI-003.
## UI-10 Cross-screen stale response
- flow_id: ui-auth-workspace
- states: stale, recovery
- verdict: fail
- reason: A delayed older Operations response overwrote a newer empty response; see DEF-UI-001.
## UI-11 Localization consistency
- flow_id: ui-operation-lifecycle
- states: ru-en
- verdict: fail
- reason: Switching to EN left RU fragments on the Operations screen and OpenAPI import has hardcoded RU text; see DEF-UI-002.
## UI-12 Unsafe output canaries
- flow_id: ui-logs-approvals
- states: safe-output, error
- verdict: fail
- reason: Credential-shaped API error canaries were visible in multiple browser error states; see DEF-UI-003.
docs/capability-baseline/outcome-taxonomy.json
+28
View File
@@ -0,0 +1,28 @@
{
"baseline_version": "2026.08.10.1",
"evidence_modes": [
"automated",
"manual_only"
],
"execution_verdicts": [
"pass",
"fail",
"blocked",
"skipped",
"flaky",
"not_run"
],
"full_pass": {
"evidence_mode": "automated",
"execution_verdict": "pass",
"implementation_status": "implemented"
},
"implementation_statuses": [
"implemented",
"planned",
"gap",
"blocked"
],
"manual_only_rule": "Requires a retained manual result and next_evidence; it is not a full baseline pass.",
"non_pass_rule": "Failed, blocked, skipped, flaky, not_run, missing, or malformed evidence never becomes pass."
}
docs/capability-baseline/required-surfaces.json
+95
View File
@@ -0,0 +1,95 @@
{
"baseline_version": "2026.08.10.1",
"required_flow_ids": [
"api-agent-catalog",
"api-approvals",
"api-auth-profiles-upstreams-secrets",
"api-auth-workspace",
"api-canonical-request-trace-identity",
"api-logs-usage",
"api-mcp-approval-keys",
"api-operation-import-export",
"api-operation-lifecycle",
"api-operation-test-run",
"mcp-approval-lifecycle",
"mcp-published-tool-call",
"mcp-published-tool-list",
"mcp-scoped-tool-search",
"mcp-transport-session",
"ui-agent-management",
"ui-auth-profiles-upstreams-secrets",
"ui-auth-workspace",
"ui-logs-approvals",
"ui-mcp-approval-keys",
"ui-operation-import-export",
"ui-operation-lifecycle",
"ui-operation-test",
"ui-usage"
],
"surface_groups": [
{
"flow_ids": [
"api-canonical-request-trace-identity"
],
"id": "correlation"
},
{
"flow_ids": [
"ui-operation-lifecycle",
"ui-operation-test",
"ui-operation-import-export",
"api-operation-lifecycle",
"api-operation-test-run",
"api-operation-import-export"
],
"id": "operations"
},
{
"flow_ids": [
"ui-agent-management",
"api-agent-catalog"
],
"id": "agents"
},
{
"flow_ids": [
"ui-auth-profiles-upstreams-secrets",
"api-auth-profiles-upstreams-secrets"
],
"id": "credentials"
},
{
"flow_ids": [
"ui-mcp-approval-keys",
"api-mcp-approval-keys",
"mcp-approval-lifecycle"
],
"id": "keys-and-approvals"
},
{
"flow_ids": [
"ui-logs-approvals",
"ui-usage",
"api-approvals",
"api-logs-usage"
],
"id": "history-and-usage"
},
{
"flow_ids": [
"ui-auth-workspace",
"api-auth-workspace"
],
"id": "auth-and-workspace"
},
{
"flow_ids": [
"mcp-transport-session",
"mcp-published-tool-list",
"mcp-published-tool-call",
"mcp-scoped-tool-search"
],
"id": "mcp-tools"
}
]
}
docs/capability-baseline/results.json
+318
View File
@@ -0,0 +1,318 @@
{
"baseline_version": "2026.08.10.1",
"defects": [
{
"contract": "Local Playwright stack starts only after the configured database exists and is stable.",
"flow_ids": ["ui-auth-workspace"],
"id": "DEF-BL-001",
"next_action": "Make readiness wait for the configured database after PostgreSQL bootstrap completes.",
"owner": "quality-community",
"severity": "Medium",
"steps": [
"Start the default Playwright stack with a new local PostgreSQL container.",
"Observe pg_isready succeed against the temporary bootstrap server.",
"Observe Admin API lose its connection when PostgreSQL restarts after database creation."
]
},
{
"contract": "Stopping the local Playwright stack terminates its loop and all child services.",
"flow_ids": ["ui-auth-workspace"],
"id": "DEF-BL-002",
"next_action": "Exit after the signal cleanup trap and terminate the actual cargo child processes.",
"owner": "quality-community",
"severity": "Medium",
"steps": [
"Start the Playwright stack and wait for readiness.",
"Send an interrupt to the stack process.",
"Observe the loop or re-parented Admin API and MCP processes remain alive."
]
},
{
"contract": "Workspace-dependent asynchronous UI loads reject stale responses.",
"flow_ids": [
"ui-agent-management",
"ui-auth-profiles-upstreams-secrets",
"ui-logs-approvals",
"ui-mcp-approval-keys",
"ui-operation-lifecycle",
"ui-usage"
],
"id": "DEF-UI-001",
"next_action": "Add request-generation identity guards in the owning UI hardening story and automate reordered responses.",
"owner": "admin-ui-community",
"severity": "Medium",
"steps": [
"Inspect workspace-change loaders for Operations, Agents, keys, secrets, logs, and usage.",
"Confirm requests are restarted on workspace change.",
"Confirm no shared request-generation or abort guard prevents an older response from overwriting newer state."
]
},
{
"contract": "OpenAPI import user-visible text follows the selected RU or EN locale.",
"flow_ids": ["ui-operation-import-export"],
"id": "DEF-UI-002",
"next_action": "Move OpenAPI import strings into the existing RU and EN i18n contract.",
"owner": "import-ui-community",
"severity": "Medium",
"steps": [
"Select the EN locale.",
"Open the OpenAPI import flow.",
"Observe Russian-only labels and status messages in the import component."
]
},
{
"contract": "Browser-visible error states never render credential-shaped fields received from an untrusted API response.",
"flow_ids": [
"ui-agent-management",
"ui-auth-profiles-upstreams-secrets",
"ui-logs-approvals",
"ui-operation-lifecycle",
"ui-usage"
],
"id": "DEF-UI-003",
"next_action": "Normalize browser API errors through a safe allowlisted message before rendering and add canary regressions for every async screen.",
"owner": "admin-ui-community",
"severity": "High",
"steps": [
"Authenticate to the local Community UI with seeded test data.",
"Return a bounded credential-shaped canary in a 500 response for each affected list endpoint.",
"Observe the untrusted response message rendered in the corresponding browser error state."
]
}
],
"environment_class": "community-test",
"manual_results": [
{
"check_id": "UI-01",
"evidence_mode": "manual_only",
"execution_verdict": "pass",
"flow_ids": ["ui-auth-workspace"],
"next_evidence": "Automate the observed login error, recovery and locale transitions."
},
{
"check_id": "UI-02",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-operation-lifecycle"],
"next_evidence": "Retest reordered responses and safe error rendering after DEF-UI-001 and DEF-UI-003 are fixed."
},
{
"check_id": "UI-03",
"evidence_mode": "manual_only",
"execution_verdict": "pass",
"flow_ids": ["ui-operation-test"],
"next_evidence": "Automate the observed wizard validation and recovery states."
},
{
"check_id": "UI-04",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-operation-import-export"],
"next_evidence": "Retest RU/EN after DEF-UI-002 and exercise malformed import recovery."
},
{
"check_id": "UI-05",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-agent-management"],
"next_evidence": "Retest reordered responses and safe error rendering after DEF-UI-001 and DEF-UI-003 are fixed."
},
{
"check_id": "UI-06",
"evidence_mode": "manual_only",
"execution_verdict": "pass",
"flow_ids": ["ui-mcp-approval-keys"],
"next_evidence": "Automate the observed empty/key-guidance state and a bounded create-and-cleanup reveal pass."
},
{
"check_id": "UI-07",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-auth-profiles-upstreams-secrets"],
"next_evidence": "Retest safe error rendering after DEF-UI-003 is fixed."
},
{
"check_id": "UI-08",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-logs-approvals"],
"next_evidence": "Retest safe error rendering after DEF-UI-003 is fixed."
},
{
"check_id": "UI-09",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-usage"],
"next_evidence": "Retest safe errors and reordered responses after DEF-UI-001 and DEF-UI-003 are fixed."
},
{
"check_id": "UI-10",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-auth-workspace"],
"next_evidence": "Add deterministic reordered-response tests after DEF-UI-001 is addressed."
},
{
"check_id": "UI-11",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-operation-lifecycle"],
"next_evidence": "Repeat the EN locale pass after DEF-UI-002 is addressed."
},
{
"check_id": "UI-12",
"evidence_mode": "manual_only",
"execution_verdict": "fail",
"flow_ids": ["ui-logs-approvals"],
"next_evidence": "Repeat the bounded canary pass after DEF-UI-003 is fixed."
}
],
"runs": [
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "rust-admin-integration",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"api-agent-catalog",
"api-approvals",
"api-auth-profiles-upstreams-secrets",
"api-auth-workspace",
"api-logs-usage",
"api-mcp-approval-keys",
"api-operation-import-export",
"api-operation-lifecycle",
"api-operation-test-run"
],
"id": "run-rust-admin-integration-fa07285c8e58",
"environment_class": "community-test",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"source_report_sha256": "fa07285c8e58dfad3834ffd420d80c91cdf0f0b5d0c54ef3e0eeaf35df3ab3f8"
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "rust-mcp-integration",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"mcp-approval-lifecycle",
"mcp-published-tool-call",
"mcp-published-tool-list",
"mcp-scoped-tool-search",
"mcp-transport-session"
],
"id": "run-rust-mcp-integration-ccff7c0029c1",
"environment_class": "community-test",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"source_report_sha256": "ccff7c0029c1347459a76b8ecd63a308a7162ddb5bc272441e79ffbf2ccdfb83"
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "ui-build",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"ui-auth-workspace",
"ui-mcp-approval-keys",
"ui-operation-import-export",
"ui-operation-test"
],
"id": "run-ui-build-755e91f2200b",
"environment_class": "community-test",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"source_report_sha256": "755e91f2200b4ac43783820afde4f5d6b336ff7a6ebd5e71b055c43d5c2e4986"
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "ui-playwright",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"ui-auth-workspace",
"ui-mcp-approval-keys",
"ui-operation-import-export",
"ui-operation-test"
],
"id": "run-ui-playwright-a1236d5f45ab",
"environment_class": "community-test",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"summary": {"passed": 21, "failed": 0, "flaky": 0, "skipped": 0},
"source_report_sha256": "a1236d5f45ab6273625bdb61634b1ea6c6d3ac876757b85a0a5ed8b5855fea6b"
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "authenticated-product-smoke",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"api-agent-catalog",
"api-mcp-approval-keys",
"api-operation-lifecycle",
"api-operation-test-run",
"mcp-published-tool-call",
"mcp-published-tool-list",
"mcp-transport-session"
],
"id": "run-authenticated-product-smoke-471a29ea400f",
"environment_class": "community-test",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"safe_outcome": {
"agent_id": "agent_019fe3a5468d75039020e367f1096136",
"agent_revision": 1,
"operation_id": "op_019fe3a546177533a2df26a36c79d358",
"operation_version": 1,
"stages": ["admin_test", "operation_publish", "agent_publish", "mcp_list", "mcp_call"]
},
"source_report_sha256": "471a29ea400fe1cb3eceb68d073c15ecba4e95ee5dff487fec0bb969f09c65e0"
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "just-verify",
"environment_class": "community-test",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"api-agent-catalog",
"api-approvals",
"api-auth-profiles-upstreams-secrets",
"api-auth-workspace",
"api-logs-usage",
"api-mcp-approval-keys",
"api-operation-import-export",
"api-operation-lifecycle",
"api-operation-test-run",
"mcp-approval-lifecycle",
"mcp-published-tool-call",
"mcp-published-tool-list",
"mcp-scoped-tool-search",
"mcp-transport-session"
],
"id": "run-just-verify-c6c16ce3c4b2",
"source_report_sha256": "c6c16ce3c4b2fa8355ae73c6ad6e87f3c829e86d720cd153133c161d073330b2",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"summary": {"exit_code": 0, "skipped": 0, "timed_out": false}
},
{
"accepted": true,
"collector": "capability-baseline-collector-v1",
"command_id": "just-verify",
"environment_class": "community-test",
"evidence_mode": "automated",
"execution_verdict": "pass",
"flow_ids": [
"api-canonical-request-trace-identity"
],
"id": "run-just-verify-a3e1538374ee",
"source_report_sha256": "a3e1538374eea02b3140ea20a7966c01225a78ac510296d0bb08eaf87a3c476c",
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006",
"summary": {"exit_code": 0, "skipped": 0, "timed_out": false}
}
],
"source_revision": "c30461cc92491ebe3d527e125a1657b73fa67006"
}