Commit graph

444 commits

Author SHA1 Message Date
rcourtman
6343b1f5cd Complete Core E2E release gate repair
Contract-Neutral: Mobile Assistant viewport containment and release-gate test repairs do not change the ai-runtime public contract
2026-07-19 18:30:27 +01:00
rcourtman
f6a59eb1c6 Repair Core E2E release gate
Contract-Neutral: RC4 gate repair only: responsive layout correction, internal test hook, and E2E-only runtime target; no public subsystem contract changes
2026-07-19 17:29:51 +01:00
rcourtman
83672a00a8 Harden Operational Trust rollout contracts 2026-07-19 15:11:02 +01:00
rcourtman
cd75722da3 Build canonical Operational Trust action loop
Refs #1034
2026-07-19 15:11:01 +01:00
rcourtman
69533c7afb Build canonical availability resource facets 2026-07-19 15:11:01 +01:00
rcourtman
07a4d05ca3 Build canonical Patrol attention workbench 2026-07-19 15:11:01 +01:00
rcourtman
93dbdd91cf Build canonical protection posture 2026-07-19 15:10:38 +01:00
rcourtman
816d55e03d Recover spec 68 infrastructure onboarding against evolved discovery UI
Some checks are pending
Build and Test / Secret Scan (push) Waiting to run
Build and Test / Frontend & Backend (push) Waiting to run
Canonical Governance / governance (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 1/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 2/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 3/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 4/4) (push) Waiting to run
Core E2E Tests / E2E verdict (push) Blocked by required conditions
The discovery-config surface changed: with discovery disabled by default the
empty state offers a 'Configure discovery' button (which opens the Discovery
settings dialog), and the 'Run discovery' scan button only renders once
discovery is enabled.

- Landing test: assert 'Configure discovery' and that 'Run discovery' is absent,
  instead of the stale 'Run discovery' / 'Discovery settings' button names.
- Discovery settings dialog test: open it via 'Configure discovery' (the dialog
  title/copy/close-button assertions were already current).
- Explicit discovery scan test: enable discovery for that test by passing the
  real /api/system/settings response through with discoveryEnabled flipped on,
  so the 'Run discovery' scan button appears and the candidate->review flow runs.

Verified: all 5 desktop tests pass against the managed local backend.
Contract-Neutral: E2E quarantine recovery
2026-07-19 09:51:23 +01:00
rcourtman
eddcbd5aa0 Recover spec 76 assistant tool-output-preview against current UI
Re-pin the assistant-drawer flow to the current surfaces: open via the
page-contextual 'Ask Pulse Assistant about TrueNAS' launcher on a live
/truenas page (not the retired /settings/infrastructure/platforms/truenas), and
resume the stubbed session through the 'Pulse Assistant sessions' menu -> the
'Resume Tool output preview proof' option (the session-picker list, not a bare
resume button).

Broaden the /api/ai/sessions stub glob to '**/api/ai/sessions*' so it matches
the picker's ?limit= query (the trailing * excludes the /messages subpath). The
tool row now renders the human summary with the target ('Run read-only command
on current resource') and the raw command preview ('$ printf preview-proof-0606')
as two separate lines, and the details control is the tool-row toggle
(title 'Show tool details'), not a standalone 'Details' button.

Verified: passes against the managed local backend.
Contract-Neutral: E2E quarantine recovery
2026-07-19 09:45:49 +01:00
rcourtman
448046b1e2 Recover journeys 01/06/07 as CI-safe cookie-session tests
Retrofit a worker-scoped cookie-session fixture (journeyAuth.ts) onto journey
smoke specs 01/06/07 so each worker logs in once and every test inherits the
cookie via storageState, instead of ensureAuthenticated's token path (which
leaves page.request cookie-less -> 401 on apiRequest/agent-report/audit
endpoints).

ensureJourneyReady verifies the cookie against the API directly and lands the
page on a non-bootstrap route (never '/' or '/login', which force the login
form even with a valid session -- #1574), so per-test auth issues zero login
POSTs and the suite stays under the backend's 10-logins/min/IP limit. The two
login-flow tests (health check, bootstrap-and-login) plus the logout/re-login
cycle keep their own explicit login on an isolated session -- logout() destroys
the current session, so it must never run against the shared worker cookie.

Re-pin 01 to the current platform-first IA: primary-nav tabs
['Proxmox','Alerts','Settings'] (no single 'Infrastructure' tab; Proxmox is
resource-admitted, so beforeAll enables mock mode first), settings sidebar
categories ['Infrastructure','System','Security']. Re-pin 06's reporting route
to /settings/support/reporting (heading 'Data & Reports') and guarantee mock
mode on before the two report-generation polls. Accept 503 in 07's
investigation-endpoint status set.

Verified: each spec passes on its own and a combined 01+06+07 run stays green
with zero login-rate-limit failures against the managed local backend.

Contract-Neutral: E2E quarantine recovery
2026-07-19 09:38:24 +01:00
rcourtman
aa4de54d42 Re-pin three live-gate straggler specs against current surfaces
Some checks are pending
Build and Test / Secret Scan (push) Waiting to run
Build and Test / Frontend & Backend (push) Waiting to run
Canonical Governance / governance (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 1/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 2/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 3/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 4/4) (push) Waiting to run
Core E2E Tests / E2E verdict (push) Blocked by required conditions
These never-quarantined specs had rotted red on CI against v6 IA changes.

- 67: the add-infrastructure dialog replaced per-platform buttons with a
  detect-or-agent chooser; the TLS-warning tests deep-link straight to
  the platform credential slot via ?add=vmware / ?add=truenas
  (ADD_STEP_TO_TYPE), and the notifications page heading is now
  'Notifications'.
- 68-platform-pages-shell: platform sub-tabs are inventory-gated
  (64cbdd6e4), so a platform with no connected instance shows the
  empty-state card instead of sub-tab chrome; the no-data test accepts
  either. The Docker containers tab was collapsed into Overview
  (1f66a2f93), so it drops from the expected tab list.
- 69: the Commercial Funnel and Infrastructure Onboarding analytics were
  removed from the diagnostics page and both exports (c6bcad255); the
  spec now pins that boundary (analytics never render and are stripped
  from full and sanitized exports) instead of asserting they appear.

Contract-Neutral: E2E straggler re-pins verified green on a fresh managed backend
2026-07-19 00:11:57 +01:00
rcourtman
f8fba328dd Recover the long-tail E2E quarantine batch against current surfaces
Delist nineteen quarantined specs (69 green, 13 env-gated skips in one
full-batch run); 05/19/20/30/52/60/63/77/79 passed unchanged. 03 stays
quarantined with its reason recorded inline: multi-tenant scenarios 6/7
carry an unresolved org-resolution bug that CI's multi-tenant
environment would exercise, and 47/48 still await their concept rework.

- 15: organization panels only exist in multi-tenant installs, so those
  routes now skip when the feature is off, and the Remote Access shell
  description follows the refreshed Relay copy.
- 17: the backups page defaults to the guest-centric Coverage view when
  anything needs attention; the day-activity assertions enter the By
  date view first.
- 18/51: the Patrol page crashed to its error boundary under stale
  autonomy stubs; the stubs now carry the requested/effective levels and
  autopilot acknowledgement the page reads, and the paused copy is
  sentence-case.
- 43: rewritten as a platform-pages tour (TrueNAS, vSphere, Proxmox,
  Docker, PBS, PMG) since the settings platform views it pinned were
  retired to a 404 with the legacy aliases.
- 49: the demo-estate proof follows the per-platform IA and drops a
  self-contradictory storage exclusion that could never pass alongside
  the west-a-service-pool assertion.
- 57: the RC Preview badge only renders in the authenticated shell, so
  the spec signs in instead of stubbing the session.
- 62: the retired platform-management aliases deliberately 404 now
  (cfb16e6da); the spec pins the graceful not-found page instead of the
  removed redirect.
- 75: switches to cookie-session auth (the token path leaves
  page.request unauthenticated), anchors on the Connection posture
  region, and drops the retired operations sub-route.
- 84: a missing lab artifact is now a skip rather than a hard failure.

Contract-Neutral: E2E quarantine recovery, spec re-pins verified green on a fresh managed backend
2026-07-18 23:15:25 +01:00
rcourtman
a40886ff3a Recover the commercial-funnel E2E batch against current surfaces
Re-pin five quarantined commercial-funnel specs and delist all eight
from the quarantine (54/55/56 already passed unchanged; the two managed
demo runtime tests stay env-gated).

- The old stubbed auth shell renders the login page now that the app
  shell makes auth-gated calls beyond the stub set; 59/61/70 sign in for
  real and stub only the license or diagnostics surface under test.
- 53: hidden demo billing routes redirect to the settings infrastructure
  root (the /install sub-route was retired), and the browser probe list
  gains the trial/activate endpoint its hidden-keys contract already
  named but never probed.
- 58: Remote Access stays in the free-tier nav on purpose (the panel
  renders its own upgrade gate; hiding it made Relay undiscoverable), so
  the spec pins its presence instead of its absence.
- 59/70: billing moved to the Pulse Intelligence settings group with a
  Plans & Billing heading; plan-card assertions re-anchor at page scope
  on the current copy (capability sentences, Apply key, Manual key
  recovery disclosure, Patrol-flavoured activation summary).
- 61: the Commercial Funnel diagnostics card was deliberately removed
  (c6bcad255); the spec now pins the inverse boundary, asserting the
  internal funnel analytics never render even when the API payload
  carries them.

Contract-Neutral: E2E quarantine recovery, spec re-pins verified green on a fresh managed backend
2026-07-18 22:32:31 +01:00
rcourtman
81c93835b3 Recover the workloads and storage E2E batch against current surfaces
Re-pin seven quarantined specs to the surfaces that replaced the retired
/workloads and /storage pages and delist them from the quarantine.

- 44/45: the summary chart strip and its range buttons are gone; the
  sparkline path maps x by timestamp, so the payload proofs assert
  window coverage and tail stability directly against
  /api/charts/workloads.
- 46: multi-range storage history proofs move onto /proxmox/storage
  with point-count floors a fresh seeded backend guarantees.
- 50: physical disks live under the Physical Disks tab on
  /proxmox/storage; rows are pinned by identity because live refreshes
  re-sort the table, and late in-flight poll responses no longer fail
  teardown.
- 59: the wide-set assertions run at 1600px (wide engages at 1536 after
  the layout fix) plus a no-horizontal-scroll proof for the 1440px
  compact default.
- 62: the Growth column is fixed to a 24h window; the rendered label is
  proven against the same used-capacity history the endpoint serves.
- 64: the workloads surface lives on /proxmox, drawer tabs expose tab
  roles, and row selection no longer writes a resource deep link.

Contract-Neutral: E2E quarantine recovery, spec re-pins verified green on a fresh managed backend
2026-07-18 22:08:14 +01:00
rcourtman
2190cf8171 Scope the recovered truenas and vmware specs to desktop presentation
Both specs came back from quarantine on 2026-07-17 proven against
chromium, but Core E2E also runs them on mobile-safari, where they have
failed on every run since. The mobile layout collapses the thresholds
platform-scope filter into the FilterBar sheet, so the TrueNAS scope
button the first spec clicks does not exist and the click falls through
to the platform nav tab, and platform tables render as cards, so the
tr-row locators the second spec asserts on match nothing. Skip both on
mobile projects the same way 06-theme-visual does; mobile presentation
coverage lives in 04-mobile.spec.ts.
2026-07-18 14:19:43 +01:00
rcourtman
3f18d78ea0 test(e2e): recover the eight vmware specs from quarantine
Re-pin the six /infrastructure-era specs to the vSphere platform page:
37 keeps its full facets/audit re-pin but is fixme'd because table-row
drawers disable remote history, leaving VMware hosts no reachable
change/action history surface (tracked); 38 and 42 move mention and
chat-turn coverage onto live mock state and the session transport (the
retired /api/ai/chat SSE stub is gone, so 42 proves the rendered
exchange instead of the wire payload); 39 and 41 pin the guest drawer's
read-only vCenter context and admin-action exclusions; 40 pins the
Datastores tab without backup semantics. 22 and 36 pass unchanged.
Verified via the managed local backend with PULSE_MOCK_MODE=true (8
passed, 1 tracked fixme).

Contract-Neutral: E2E quarantine-list shrink is test selection only; no deployment contract delta, mirrors bypass on 725837dc3
2026-07-17 15:37:30 +01:00
rcourtman
8ab5b0b3b4 test(e2e): recover the five truenas specs from quarantine
Re-pin 21 to the consolidated Connected-systems table (the address
column is gone; rows carry source, surfaces, state, and freshness) and
rewrite 26 against live mock websocket state with the stubable
alerts-config activation bypass, since REST resource stubs get
overwritten by state frames. 27, 28, and 31 were environmental-only
failures and pass unchanged against a mock-mode backend. Verified via
the managed local backend with PULSE_MOCK_MODE=true.

Contract-Neutral: E2E quarantine-list shrink is test selection only; no deployment contract delta, mirrors bypass on 725837dc3
2026-07-17 15:02:31 +01:00
rcourtman
725837dc39 test(e2e): quarantine the 50 spec files rotted against the platform-first UI
Core E2E has failed on every push since 2026-06-29. Fifty of the 81 spec
files still assert the pre-platform-first IA (locators, URLs, subheader
copy the June rebuild replaced), and with maxFailures aborting shards at
20 the healthy specs produced no verdict at all. The quarantine list in
playwright.config.ts excludes the rotted files from all three projects so
the remaining 38 files (323 tests, including the smoke and journey
coverage) return to being a live per-push gate.

This is a stopgap, named as such in the config comment. Each quarantined
spec leaves the list by being re-pinned to the current UI, never by
deletion; the recovery effort is tracked separately.

Contract-Neutral: E2E spec quarantine is test selection only; no deployment contract delta, and the contract file is another agent's in-progress work
2026-07-17 14:43:22 +01:00
rcourtman
bb369235d1 Stabilize v5 license migration fixtures 2026-07-17 01:02:05 +01:00
rcourtman
4d80e53588 Align restart-loop qualification with Patrol threshold 2026-07-16 20:53:02 +01:00
rcourtman
676117bf27 Separate Patrol evidence and model-turn budgets 2026-07-16 17:50:08 +01:00
rcourtman
b6e5f4d512 Align remediation qualification with Patrol policy 2026-07-16 17:01:37 +01:00
rcourtman
d162110233 Make remediation fixtures model-neutral 2026-07-16 15:44:19 +01:00
rcourtman
a39150ba4c Make qualification profiles statistically passable 2026-07-15 17:34:57 +01:00
rcourtman
87699dfff3 Align remediation qualification with advertised actions 2026-07-15 11:31:56 +01:00
rcourtman
03ae7d2b58 Score investigation facts without magic words 2026-07-15 10:56:12 +01:00
rcourtman
a95edafcf1 Qualify model-led Patrol investigations 2026-07-15 10:32:16 +01:00
rcourtman
3b1bc65b43 Separate Watch symptoms from injected fault targets 2026-07-14 19:02:32 +01:00
rcourtman
2b271e3e20 Repair disposable dependency qualification fixtures 2026-07-14 18:49:25 +01:00
rcourtman
3f45953866 Complete Patrol autonomous qualification loop 2026-07-14 15:35:48 +01:00
rcourtman
7b114f4d5a Connect Patrol action handoffs to Actions 2026-07-13 17:34:12 +01:00
rcourtman
66dc5fd7df Polish Actions layout and review details 2026-07-13 17:00:36 +01:00
rcourtman
d6387b8241 Redesign the Actions inbox 2026-07-13 16:38:16 +01:00
rcourtman
f9f90a1a27 Redesign Patrol open work queue 2026-07-13 16:12:37 +01:00
rcourtman
0062128414 Add durable Docker restart lifecycle proof 2026-07-12 12:11:16 +01:00
rcourtman
b0ee11e162 Add trusted APT action review
Refs #1491
2026-07-12 06:33:42 +01:00
rcourtman
e13abf84fa Add trusted action review workspace 2026-07-12 01:43:00 +01:00
rcourtman
ffd1ea8127 Enforce Assistant read-only scope integrity 2026-07-11 12:43:55 +01:00
rcourtman
500d3be2a7 Align Pro feature catalog names with the new Patrol vocabulary
Some checks failed
Build and Test / Secret Scan (push) Waiting to run
Build and Test / Frontend & Backend (push) Waiting to run
Canonical Governance / governance (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 1/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 2/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 3/4) (push) Waiting to run
Core E2E Tests / Playwright Core E2E (shard 4/4) (push) Waiting to run
Core E2E Tests / E2E verdict (push) Blocked by required conditions
Helm CI / Lint and Render Chart (push) Has been cancelled
The public pricing surface and in-app plan-selling copy now say
"Patrol investigates issues and explains the root cause" and
"Patrol applies safe fixes and verifies the result". Rename the
licensing catalog DisplayName/ComparisonName pairs to the title-cased
forms, align the ai_autofix UpgradeReason verbs (apply/verify the
result), regenerate the frontend catalog, and update the Go, vitest,
and Playwright pins plus README and PULSE_PRO docs.
2026-07-11 09:33:47 +01:00
rcourtman
8fbbed4d05 Harden mobile organization settings 2026-07-10 17:37:13 +01:00
rcourtman
6230bc9584 Improve mobile layouts across product surfaces 2026-07-10 16:50:59 +01:00
rcourtman
391d3d0be0 Fix responsive navigation and mobile table layouts 2026-07-10 15:19:50 +01:00
rcourtman
8d07089eb3 Finish the Assistant & Patrol settings rename to Pulse Intelligence
Commit cc948b022 fixed the Patrol preflight strings that gated keyless
onboarding; this sweeps the rest. Error messages, readiness checks, and
guidance copy that still pointed at the retired Assistant & Patrol
settings page now name the real surfaces: Pulse Intelligence settings
for the area as a whole, and the Provider & Models settings page for
provider-credential guidance, matching the phrasing cc948b022
established. Pinning tests updated in step, including three
ai_handlers_test.go assertions cc948b022 had already left stale.
2026-07-10 12:04:03 +01:00
rcourtman
0d89be1c91 Use canonical audit record API in migration test 2026-07-09 20:58:23 +01:00
rcourtman
042e7ef966 Harden remaining CodeQL security boundaries 2026-07-09 19:46:40 +01:00
rcourtman
24b2e40e92 Harden scanned request and storage boundaries
Harden CodeQL-scanned request, command, path, and frontend sinks across relay proxying, availability probes, connection probing, notification CLI execution, report storage, licensing persistence, preview bootstrapping, tooltip rendering, logging, and test identity generation.
2026-07-09 17:22:29 +01:00
rcourtman
584aa10699 Stabilize multi-tenant org switch in release E2E 2026-07-09 14:34:46 +01:00
rcourtman
1a05c715ac Reuse authenticated state in multi-tenant release E2E 2026-07-09 13:40:35 +01:00
rcourtman
5fe6bfde57 Harden release integration diagnostics and login retries 2026-07-09 12:50:55 +01:00
rcourtman
5f221941c7 Retire Patrol specs pinned to presentation the workbench simplified
The finding-links spec asserted Open related links into the retired
standalone routes from the pre-workbench findings list; those cross-link
affordances were removed deliberately with platform-first navigation,
and the monitor-first workbench feeds findings through a different
pipeline its stubs never reach. The run-history breakdown spec pinned
per-run type counts that the workbench simplified to plain totals; the
underlying count-separation contract (truenas_checked distinct from
agent hosts) lives in the investigation context model and is unit
covered there.
2026-07-08 17:23:04 +01:00