110 lines
7.2 KiB
Markdown
110 lines
7.2 KiB
Markdown
# 48 — Milestone 5 Export and Run Pack evidence
|
|
|
|
## Outcome
|
|
|
|
Milestone 5 passed on 2026-07-27 through commits `a19ea56` and `5ba0caf`.
|
|
Authoritative validation used the isolated checkout
|
|
`/mnt/user/appdata/devrunbook-validation/m3` on Unraid 7.2, Docker 27.5.1,
|
|
Compose 2.40.3, Node.js 24.18.0 and PostgreSQL 17.9. The Windows
|
|
workstation's Node.js 23.7.0 results are supporting feedback only.
|
|
|
|
Generated output is now directly usable without changing the immutable run or
|
|
requiring Gitea. Plain prompt copy, canonical Markdown, deterministic Run Pack
|
|
ZIP, review-only `AGENTS.md.suggested`, authorized artifact history/download
|
|
and historical Run Pack verification are available from the generated-task
|
|
view. No export path executes repository commands or extracts imported files.
|
|
|
|
## Delivered behavior
|
|
|
|
- Plain copy uses the exact stored prompt bytes and reports clipboard success
|
|
or a recoverable failure through an accessible live region.
|
|
- Markdown export wraps the same prompt in a deterministic TASK metadata
|
|
envelope whose embedded prompt digest is verified before acceptance.
|
|
- Run Pack creation is dependency-free and deterministic: entries are sorted,
|
|
paths and names are canonical, metadata and modes are fixed, and the manifest
|
|
inventories every non-manifest file with exact SHA-256 and byte length.
|
|
- Run Pack verification parses into bounded memory and never extracts. It
|
|
rejects traversal, backslashes, absolute and Windows-device paths, duplicate
|
|
or case-colliding entries, symlinks and other non-regular entries, local ZIP
|
|
offsets, overlapping data, unsupported compression, CRC mismatch, oversized
|
|
inputs, duplicate JSON keys, inventory drift and digest substitution.
|
|
- Historical re-import additionally binds the verified manifest to an
|
|
authorized immutable run: run id, generated timestamp, render digest,
|
|
playbook slug/version/digest and repository-profile digest must all match.
|
|
- Artifact creation is workspace-authorized and idempotent per run, type and
|
|
idempotency key. Viewer reads remain allowed while viewer creation is denied.
|
|
- Artifact metadata and bytes are integrity-checked on read, have bounded
|
|
retention, and remain persisted in PostgreSQL plus the configured local
|
|
artifact store across container recreation.
|
|
- `AGENTS.md.suggested` is review-only. It includes only integrity-bound frozen
|
|
profile rules, confirmed commands explicitly marked safe for suggestion,
|
|
protected/excluded paths and durable policies; task input and rendered prompt
|
|
text are excluded and no existing `AGENTS.md` is modified.
|
|
- Download responses use the recorded media type, safe RFC 5987 content
|
|
disposition, `no-store` and `nosniff`. Mutation/import routes enforce strict
|
|
content types, same-origin checks and streaming byte limits.
|
|
- The generated-task UI exposes explicit viewer, unavailable, success and error
|
|
states, three artifact actions, persisted history and a Run Pack file chooser.
|
|
|
|
## Defect found by live validation
|
|
|
|
The first 390-pixel production verification exposed horizontal overflow after
|
|
a successful Run Pack import because the unbroken manifest digest in the
|
|
status message did not wrap. Commit `5ba0caf` applies `overflow-wrap: anywhere`
|
|
to export feedback and adds a UI contract regression assertion. The rebuilt
|
|
production page then had equal document client and scroll widths at 390 pixels,
|
|
and all five required viewports passed.
|
|
|
|
## Authoritative validation
|
|
|
|
| Command or check | Result |
|
|
| --- | --- |
|
|
| Integrated Node 24.18.0 verification | PASS: formatting, lint, typecheck, all workspace tests and production build across 14 workspaces. |
|
|
| `python scripts/validate_pack.py` | PASS: 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas, 28 golden prompts and 68 release-evidence fields. |
|
|
| `python scripts/reference_compose.py --check` | PASS: all 28 supplied prompt fixtures remain byte-identical. |
|
|
| Artifact package tests | PASS: 3 files and 23 tests, including 18 deterministic and hostile Run Pack cases. |
|
|
| Application tests | PASS: 17 files and 100 tests, including authorization, idempotency, retention, immutable-source and local-storage integrity cases. |
|
|
| Web tests | PASS: 29 files and 147 tests, including artifact/download/import HTTP contracts and generated-task UI states. |
|
|
| `pnpm test:security` | PASS: 2 files and 11 tests. |
|
|
| Live PostgreSQL integration | PASS: 6 focused files and 17 tests against PostgreSQL 17.9, including generated artifact persistence and authorization. The three fresh-database-only Milestone 0 cases were intentionally excluded from the already initialized production database run. |
|
|
| Production Compose build/start | PASS: exact Node 24.18.0 image build; migration replay exited zero; web, worker and PostgreSQL healthy. |
|
|
| Production browser export | PASS: exact prompt copy plus Markdown, Run Pack and AGENTS recommendation creation with explicit confirmations and three persisted history rows. |
|
|
| Production Run Pack re-import | PASS: the downloaded 12,356-byte ZIP verified without extraction against its historical immutable task and manifest digest `13a82ad8a0ac3eb352ddd7c0193ba7ca8592d8f3c63d3382bcb52e3358ed3276`. |
|
|
| Artifact byte evidence | PASS: downloaded/stored Run Pack SHA-256 `47e9308d97b6322157718a6766a7d71d07292e16e77e74cd9164f21b7b5b8eab` matched browser metadata and PostgreSQL. |
|
|
| Restart persistence | PASS: web and worker were recreated; readiness recovered; the immutable run still reported three artifacts and all three download rows. |
|
|
| Responsive matrix | PASS after regression repair: 390, 768, 1024, 1440 and 2560 pixel widths had no horizontal overflow. |
|
|
| Browser console | PASS: zero entries after export, import, restart and viewport checks. |
|
|
| Runtime boundary and log scan | PASS: web/worker run as `node`, read-only, all capabilities dropped and `no-new-privileges`; zero token, password or error-pattern matches. |
|
|
|
|
Production evidence identifiers are deliberately non-secret:
|
|
|
|
- run `a87ae11c-54b7-41c6-ba70-3a2d2a9aac0e`;
|
|
- render digest
|
|
`ea10cbd4920c94bb6af66189e1f35b880b8fe1eafdbe7a02097ee44efd0c4883`;
|
|
- Markdown artifact `348d0cda-c24b-5e9d-8a88-0466838d40e2`, 8,543 bytes,
|
|
SHA-256 `8cd95e53f6563281bbddc660d7d502731b53103855e21eb03452b46fd672e23d`;
|
|
- Run Pack artifact `bd0f1e6a-d644-563c-b8de-f4a2473ed172`, 12,356 bytes,
|
|
SHA-256 `47e9308d97b6322157718a6766a7d71d07292e16e77e74cd9164f21b7b5b8eab`;
|
|
- AGENTS recommendation artifact `c648ed3d-5e41-5c51-acb9-7baef4f33896`,
|
|
1,265 bytes, SHA-256
|
|
`bfd12bc02591be18fbcf36dc42cc58025f8cfd71a9923084f3f514674a5b51b4`.
|
|
|
|
## Requirement status
|
|
|
|
Completed with unit, PostgreSQL, production container and browser evidence:
|
|
|
|
- `FR-OUT-001` through `FR-OUT-008`;
|
|
- the Runs and exports acceptance section in `docs/19-acceptance-criteria.md`.
|
|
|
|
The package-authoring import/export criterion is separate and remains assigned
|
|
to Milestone 7. Personal-data export/deletion remains assigned to Milestone 8.
|
|
|
|
## Operational notes
|
|
|
|
No credential, cookie, token, session secret, encryption key or database
|
|
password is recorded here. The browser validation ZIP and remote transfer copy
|
|
were deleted after verification; the authoritative artifact remains in the
|
|
configured persistent artifact store under retention policy. No project-wide
|
|
`release-evidence.json` or `FINAL_HANDOFF.md` is created at this intermediate
|
|
gate; those remain final-release artifacts.
|