323 lines
11 KiB
JSON
323 lines
11 KiB
JSON
{
|
|
"baseline_version": "2026.08.14.1",
|
|
"defects": [
|
|
{
|
|
"contract": "Local Playwright stack starts only after the configured database exists and is stable.",
|
|
"flow_ids": [
|
|
"ui-auth-workspace"
|
|
],
|
|
"id": "DEF-BL-001",
|
|
"next_action": "Make readiness wait for the configured database after PostgreSQL bootstrap completes.",
|
|
"owner": "quality-community",
|
|
"severity": "Medium",
|
|
"steps": [
|
|
"Start the default Playwright stack with a new local PostgreSQL container.",
|
|
"Observe pg_isready succeed against the temporary bootstrap server.",
|
|
"Observe Admin API lose its connection when PostgreSQL restarts after database creation."
|
|
]
|
|
},
|
|
{
|
|
"contract": "Stopping the local Playwright stack terminates its loop and all child services.",
|
|
"flow_ids": [
|
|
"ui-auth-workspace"
|
|
],
|
|
"id": "DEF-BL-002",
|
|
"next_action": "Exit after the signal cleanup trap and terminate the actual cargo child processes.",
|
|
"owner": "quality-community",
|
|
"severity": "Medium",
|
|
"steps": [
|
|
"Start the Playwright stack and wait for readiness.",
|
|
"Send an interrupt to the stack process.",
|
|
"Observe the loop or re-parented Admin API and MCP processes remain alive."
|
|
]
|
|
},
|
|
{
|
|
"contract": "Workspace-dependent asynchronous UI loads reject stale responses.",
|
|
"flow_ids": [
|
|
"ui-agent-management",
|
|
"ui-auth-profiles-upstreams-secrets",
|
|
"ui-logs-approvals",
|
|
"ui-mcp-approval-keys",
|
|
"ui-operation-lifecycle",
|
|
"ui-usage"
|
|
],
|
|
"id": "DEF-UI-001",
|
|
"next_action": "Add request-generation identity guards in the owning UI hardening story and automate reordered responses.",
|
|
"owner": "admin-ui-community",
|
|
"severity": "Medium",
|
|
"steps": [
|
|
"Inspect workspace-change loaders for Operations, Agents, keys, secrets, logs, and usage.",
|
|
"Confirm requests are restarted on workspace change.",
|
|
"Confirm no shared request-generation or abort guard prevents an older response from overwriting newer state."
|
|
]
|
|
},
|
|
{
|
|
"contract": "OpenAPI import user-visible text follows the selected RU or EN locale.",
|
|
"flow_ids": [
|
|
"ui-operation-import-export"
|
|
],
|
|
"id": "DEF-UI-002",
|
|
"next_action": "Move OpenAPI import strings into the existing RU and EN i18n contract.",
|
|
"owner": "import-ui-community",
|
|
"severity": "Medium",
|
|
"steps": [
|
|
"Select the EN locale.",
|
|
"Open the OpenAPI import flow.",
|
|
"Observe Russian-only labels and status messages in the import component."
|
|
]
|
|
},
|
|
{
|
|
"contract": "Browser-visible error states never render credential-shaped fields received from an untrusted API response.",
|
|
"flow_ids": [
|
|
"ui-agent-management",
|
|
"ui-auth-profiles-upstreams-secrets",
|
|
"ui-logs-approvals",
|
|
"ui-operation-lifecycle",
|
|
"ui-usage"
|
|
],
|
|
"id": "DEF-UI-003",
|
|
"next_action": "Normalize browser API errors through a safe allowlisted message before rendering and add canary regressions for every async screen.",
|
|
"owner": "admin-ui-community",
|
|
"severity": "High",
|
|
"steps": [
|
|
"Authenticate to the local Community UI with seeded test data.",
|
|
"Return a bounded credential-shaped canary in a 500 response for each affected list endpoint.",
|
|
"Observe the untrusted response message rendered in the corresponding browser error state."
|
|
]
|
|
}
|
|
],
|
|
"environment_class": "community-test",
|
|
"manual_results": [
|
|
{
|
|
"check_id": "UI-01",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"ui-auth-workspace"
|
|
],
|
|
"next_evidence": "Automate the observed login error, recovery and locale transitions."
|
|
},
|
|
{
|
|
"check_id": "UI-02",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-operation-lifecycle"
|
|
],
|
|
"next_evidence": "Retest reordered responses and safe error rendering after DEF-UI-001 and DEF-UI-003 are fixed."
|
|
},
|
|
{
|
|
"check_id": "UI-03",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"ui-operation-test"
|
|
],
|
|
"next_evidence": "Automate the observed wizard validation and recovery states."
|
|
},
|
|
{
|
|
"check_id": "UI-04",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-operation-import-export"
|
|
],
|
|
"next_evidence": "Retest RU/EN after DEF-UI-002 and exercise malformed import recovery."
|
|
},
|
|
{
|
|
"check_id": "UI-05",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-agent-management"
|
|
],
|
|
"next_evidence": "Retest reordered responses and safe error rendering after DEF-UI-001 and DEF-UI-003 are fixed."
|
|
},
|
|
{
|
|
"check_id": "UI-06",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"ui-mcp-approval-keys"
|
|
],
|
|
"next_evidence": "Automate the observed empty/key-guidance state and a bounded create-and-cleanup reveal pass."
|
|
},
|
|
{
|
|
"check_id": "UI-07",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-auth-profiles-upstreams-secrets"
|
|
],
|
|
"next_evidence": "Retest safe error rendering after DEF-UI-003 is fixed."
|
|
},
|
|
{
|
|
"check_id": "UI-08",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-logs-approvals"
|
|
],
|
|
"next_evidence": "Retest safe error rendering after DEF-UI-003 is fixed."
|
|
},
|
|
{
|
|
"check_id": "UI-09",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-usage"
|
|
],
|
|
"next_evidence": "Retest safe errors and reordered responses after DEF-UI-001 and DEF-UI-003 are fixed."
|
|
},
|
|
{
|
|
"check_id": "UI-10",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-auth-workspace"
|
|
],
|
|
"next_evidence": "Add deterministic reordered-response tests after DEF-UI-001 is addressed."
|
|
},
|
|
{
|
|
"check_id": "UI-11",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-operation-lifecycle"
|
|
],
|
|
"next_evidence": "Repeat the EN locale pass after DEF-UI-002 is addressed."
|
|
},
|
|
{
|
|
"check_id": "UI-12",
|
|
"evidence_mode": "manual_only",
|
|
"execution_verdict": "fail",
|
|
"flow_ids": [
|
|
"ui-logs-approvals"
|
|
],
|
|
"next_evidence": "Repeat the bounded canary pass after DEF-UI-003 is fixed."
|
|
}
|
|
],
|
|
"runs": [
|
|
{
|
|
"accepted": true,
|
|
"collector": "capability-baseline-collector-v1",
|
|
"command_id": "ui-build",
|
|
"environment_class": "community-test",
|
|
"evidence_mode": "automated",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"ui-auth-workspace",
|
|
"ui-mcp-approval-keys",
|
|
"ui-operation-import-export",
|
|
"ui-operation-test"
|
|
],
|
|
"id": "run-ui-build-4e1216d7a69e",
|
|
"source_report_sha256": "4e1216d7a69e30c773c4e58799bbc2e41ebc247d2d400511d3bd8c32084b7a74",
|
|
"source_revision": "f6fc2e5c9bb748ad8db4bdc52ffdbdb6ac24d6d9",
|
|
"summary": {
|
|
"exit_code": 0,
|
|
"skipped": 0,
|
|
"timed_out": false
|
|
}
|
|
},
|
|
{
|
|
"accepted": true,
|
|
"collector": "capability-baseline-collector-v1",
|
|
"command_id": "ui-playwright",
|
|
"environment_class": "community-test",
|
|
"evidence_mode": "automated",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"ui-auth-workspace",
|
|
"ui-mcp-approval-keys",
|
|
"ui-operation-import-export",
|
|
"ui-operation-test"
|
|
],
|
|
"id": "run-ui-playwright-6040821b7473",
|
|
"source_report_sha256": "6040821b74732ade95dd604b091967d45edf9eb04633016d536ecaf1585973d9",
|
|
"source_revision": "f6fc2e5c9bb748ad8db4bdc52ffdbdb6ac24d6d9",
|
|
"summary": {
|
|
"failed": 0,
|
|
"flaky": 0,
|
|
"not_run": 0,
|
|
"passed": 26,
|
|
"skipped": 0
|
|
}
|
|
},
|
|
{
|
|
"accepted": true,
|
|
"collector": "capability-baseline-collector-v1",
|
|
"command_id": "authenticated-product-smoke",
|
|
"environment_class": "community-test",
|
|
"evidence_mode": "automated",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"api-agent-catalog",
|
|
"api-mcp-approval-keys",
|
|
"api-operation-lifecycle",
|
|
"api-operation-test-run",
|
|
"mcp-published-tool-call",
|
|
"mcp-published-tool-list",
|
|
"mcp-transport-session"
|
|
],
|
|
"id": "run-authenticated-product-smoke-bf9a835d877f",
|
|
"source_report_sha256": "bf9a835d877f0631051413a758f98b4cd7be55c3666acb22dcf012b22416d517",
|
|
"source_revision": "f6fc2e5c9bb748ad8db4bdc52ffdbdb6ac24d6d9",
|
|
"summary": {
|
|
"exit_code": 0,
|
|
"skipped": 0,
|
|
"timed_out": false
|
|
},
|
|
"safe_outcome": {
|
|
"agent_id": "agent_019ffd03085174338d660c8a7f19718a",
|
|
"agent_revision": 1,
|
|
"command_id": "authenticated-product-smoke",
|
|
"operation_id": "op_019ffd0307d37ae3ba38dd2986a22fb1",
|
|
"operation_version": 1,
|
|
"stages": [
|
|
"admin_test",
|
|
"operation_publish",
|
|
"agent_publish",
|
|
"mcp_list",
|
|
"mcp_call"
|
|
],
|
|
"verdict": "pass"
|
|
}
|
|
},
|
|
{
|
|
"accepted": true,
|
|
"collector": "capability-baseline-collector-v1",
|
|
"command_id": "just-verify",
|
|
"environment_class": "community-test",
|
|
"evidence_mode": "automated",
|
|
"execution_verdict": "pass",
|
|
"flow_ids": [
|
|
"api-agent-catalog",
|
|
"api-approvals",
|
|
"api-auth-profiles-upstreams-secrets",
|
|
"api-auth-workspace",
|
|
"api-canonical-request-trace-identity",
|
|
"api-logs-usage",
|
|
"api-mcp-approval-keys",
|
|
"api-operation-import-export",
|
|
"api-operation-lifecycle",
|
|
"api-operation-test-run",
|
|
"mcp-approval-lifecycle",
|
|
"mcp-published-tool-call",
|
|
"mcp-published-tool-list",
|
|
"mcp-scoped-tool-search",
|
|
"mcp-transport-session"
|
|
],
|
|
"id": "run-just-verify-fa53a3c600d7",
|
|
"source_report_sha256": "fa53a3c600d774dbed79b6029ffc8ffa20f210610388ac6810df328c36c6685a",
|
|
"source_revision": "f6fc2e5c9bb748ad8db4bdc52ffdbdb6ac24d6d9",
|
|
"summary": {
|
|
"exit_code": 0,
|
|
"skipped": 0,
|
|
"timed_out": false
|
|
}
|
|
}
|
|
],
|
|
"source_revision": "f6fc2e5c9bb748ad8db4bdc52ffdbdb6ac24d6d9"
|
|
}
|