48 — Milestone 5 Export and Run Pack evidence

Outcome

Milestone 5 passed on 2026-07-27 through commits a19ea56 and 5ba0caf. Authoritative validation used the isolated checkout /mnt/user/appdata/devrunbook-validation/m3 on Unraid 7.2, Docker 27.5.1, Compose 2.40.3, Node.js 24.18.0 and PostgreSQL 17.9. The Windows workstation's Node.js 23.7.0 results are supporting feedback only.

Generated output is now directly usable without changing the immutable run or requiring Gitea. Plain prompt copy, canonical Markdown, deterministic Run Pack ZIP, review-only AGENTS.md.suggested, authorized artifact history/download and historical Run Pack verification are available from the generated-task view. No export path executes repository commands or extracts imported files.

Delivered behavior

Plain copy uses the exact stored prompt bytes and reports clipboard success or a recoverable failure through an accessible live region.
Markdown export wraps the same prompt in a deterministic TASK metadata envelope whose embedded prompt digest is verified before acceptance.
Run Pack creation is dependency-free and deterministic: entries are sorted, paths and names are canonical, metadata and modes are fixed, and the manifest inventories every non-manifest file with exact SHA-256 and byte length.
Run Pack verification parses into bounded memory and never extracts. It rejects traversal, backslashes, absolute and Windows-device paths, duplicate or case-colliding entries, symlinks and other non-regular entries, local ZIP offsets, overlapping data, unsupported compression, CRC mismatch, oversized inputs, duplicate JSON keys, inventory drift and digest substitution.
Historical re-import additionally binds the verified manifest to an authorized immutable run: run id, generated timestamp, render digest, playbook slug/version/digest and repository-profile digest must all match.
Artifact creation is workspace-authorized and idempotent per run, type and idempotency key. Viewer reads remain allowed while viewer creation is denied.
Artifact metadata and bytes are integrity-checked on read, have bounded retention, and remain persisted in PostgreSQL plus the configured local artifact store across container recreation.
AGENTS.md.suggested is review-only. It includes only integrity-bound frozen profile rules, confirmed commands explicitly marked safe for suggestion, protected/excluded paths and durable policies; task input and rendered prompt text are excluded and no existing AGENTS.md is modified.
Download responses use the recorded media type, safe RFC 5987 content disposition, no-store and nosniff. Mutation/import routes enforce strict content types, same-origin checks and streaming byte limits.
The generated-task UI exposes explicit viewer, unavailable, success and error states, three artifact actions, persisted history and a Run Pack file chooser.

Defect found by live validation

The first 390-pixel production verification exposed horizontal overflow after a successful Run Pack import because the unbroken manifest digest in the status message did not wrap. Commit 5ba0caf applies overflow-wrap: anywhere to export feedback and adds a UI contract regression assertion. The rebuilt production page then had equal document client and scroll widths at 390 pixels, and all five required viewports passed.

Authoritative validation

Command or check	Result
Integrated Node 24.18.0 verification	PASS: formatting, lint, typecheck, all workspace tests and production build across 14 workspaces.
`python scripts/validate_pack.py`	PASS: 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas, 28 golden prompts and 68 release-evidence fields.
`python scripts/reference_compose.py --check`	PASS: all 28 supplied prompt fixtures remain byte-identical.
Artifact package tests	PASS: 3 files and 23 tests, including 18 deterministic and hostile Run Pack cases.
Application tests	PASS: 17 files and 100 tests, including authorization, idempotency, retention, immutable-source and local-storage integrity cases.
Web tests	PASS: 29 files and 147 tests, including artifact/download/import HTTP contracts and generated-task UI states.
`pnpm test:security`	PASS: 2 files and 11 tests.
Live PostgreSQL integration	PASS: 6 focused files and 17 tests against PostgreSQL 17.9, including generated artifact persistence and authorization. The three fresh-database-only Milestone 0 cases were intentionally excluded from the already initialized production database run.
Production Compose build/start	PASS: exact Node 24.18.0 image build; migration replay exited zero; web, worker and PostgreSQL healthy.
Production browser export	PASS: exact prompt copy plus Markdown, Run Pack and AGENTS recommendation creation with explicit confirmations and three persisted history rows.
Production Run Pack re-import	PASS: the downloaded 12,356-byte ZIP verified without extraction against its historical immutable task and manifest digest `13a82ad8a0ac3eb352ddd7c0193ba7ca8592d8f3c63d3382bcb52e3358ed3276`.
Artifact byte evidence	PASS: downloaded/stored Run Pack SHA-256 `47e9308d97b6322157718a6766a7d71d07292e16e77e74cd9164f21b7b5b8eab` matched browser metadata and PostgreSQL.
Restart persistence	PASS: web and worker were recreated; readiness recovered; the immutable run still reported three artifacts and all three download rows.
Responsive matrix	PASS after regression repair: 390, 768, 1024, 1440 and 2560 pixel widths had no horizontal overflow.
Browser console	PASS: zero entries after export, import, restart and viewport checks.
Runtime boundary and log scan	PASS: web/worker run as `node`, read-only, all capabilities dropped and `no-new-privileges`; zero token, password or error-pattern matches.

Production evidence identifiers are deliberately non-secret:

run a87ae11c-54b7-41c6-ba70-3a2d2a9aac0e;
render digest ea10cbd4920c94bb6af66189e1f35b880b8fe1eafdbe7a02097ee44efd0c4883;
Markdown artifact 348d0cda-c24b-5e9d-8a88-0466838d40e2, 8,543 bytes, SHA-256 8cd95e53f6563281bbddc660d7d502731b53103855e21eb03452b46fd672e23d;
Run Pack artifact bd0f1e6a-d644-563c-b8de-f4a2473ed172, 12,356 bytes, SHA-256 47e9308d97b6322157718a6766a7d71d07292e16e77e74cd9164f21b7b5b8eab;
AGENTS recommendation artifact c648ed3d-5e41-5c51-acb9-7baef4f33896, 1,265 bytes, SHA-256 bfd12bc02591be18fbcf36dc42cc58025f8cfd71a9923084f3f514674a5b51b4.

Requirement status

Completed with unit, PostgreSQL, production container and browser evidence:

FR-OUT-001 through FR-OUT-008;
the Runs and exports acceptance section in docs/19-acceptance-criteria.md.

The package-authoring import/export criterion is separate and remains assigned to Milestone 7. Personal-data export/deletion remains assigned to Milestone 8.

Operational notes

No credential, cookie, token, session secret, encryption key or database password is recorded here. The browser validation ZIP and remote transfer copy were deleted after verification; the authoritative artifact remains in the configured persistent artifact store under retention policy. No project-wide release-evidence.json or FINAL_HANDOFF.md is created at this intermediate gate; those remain final-release artifacts.

7.2 KiB Raw Permalink Blame History