DevRunbook-Public/docs/50-milestone-seven-prompt-lab.md

Milestone 7 - Prompt Lab and quality system

Milestone 7 was completed on 2026-07-27 through commit 07cba0f. The authoritative runtime was the restricted Unraid validation stack at a private validation host, using Node.js 24.18.0 and PostgreSQL 17.9.

Delivered boundary

• Private playbook ZIP imports are validated in bounded memory against the v1.2 package contract. Deterministic exports preserve the complete declared inventory without extracting or executing imported content.
• Draft bytes, revisions and strong ETags are persisted per workspace. Every accepted update atomically replaces and revalidates the complete inventory; rejected updates return path, message and remediation details.
• Imported and edited content remains server-authoritative draft evidence. Source lifecycle text is never promoted into a platform lifecycle claim.
• The Prompt Lab presents the full inventory, YAML/Markdown editors, live local preview, lint and validation results, declared examples and evaluations, exact identity and digest, changelog, review and publication controls.
• Stored example inputs are rendered twice through the production composer. The UI displays the prompt, digest and byte-identical repeat result.
• Editorial review is an exact-digest attestation and remains distinct from objective lint/evaluation evidence. Publication transactionally rechecks the current digest, changelog, lint policy and review evidence.
• Published versions are database-immutable and read-only in the UI. Creating a next version clones and consistently rewrites manifest, example and evaluation version identities before validation and persistence.
• Version comparison explicitly reports scope, guardrail and validation changes. Persisted static evaluation results retain case, fixture, target, environment and rendered-prompt digests.

The MVP still does not execute evaluation repositories or arbitrary package commands. An isolated fixture-repository evaluation runner remains post-MVP.

Verification evidence

• Clean Node 24 verification covered formatting, lint, typecheck, all unit tests, 14 production builds and the configured security suite.
• Clean Python 3.12 validation passed 28 P0 packages, six normative examples, 72 catalog entries, nine schemas and all 28 golden prompt fixtures.
• Fresh PostgreSQL integration applied migrations 0000 through 0006 and passed the private draft, package-file and publication/evaluation suites.
• The production browser imported a deterministic package archive, rejected an invalid /apiVersion with a link to the manifest editor, recorded an exact-digest review, published an immutable version and created a separately editable next version.
• The published example reproduced through the production composer and its second render was byte-identical. The corrected next version preserved a coherent semantic identity across manifest, example and evaluation files.
• At widths 390, 768, 1024, 1440 and 2560 the Prompt Lab had no horizontal overflow. A fresh production tab produced zero console messages after the locale-sensitive hydration defect was repaired.
• Production migration initially exposed an ordering defect in 0005: the old immutability trigger blocked its required backfill. The migration now drops the trigger, performs the backfill and recreates the trigger; a regression test enforces that order. The failed attempt did not replace healthy runtime containers and the pre-milestone backup was retained.
• Web, worker and PostgreSQL were healthy after deployment. A web recreation retained the imported draft, published version, next version and evidence.

The restricted pre-M7 logical backup is /mnt/user/appdata/devrunbook-validation/backups/pre-m7-47a285c.dump. It is mode 0600; encryption and session keys remain separate from ordinary backup evidence.

Release boundary

Milestone 7 proves authoring and governance, but it is not a release claim. Clean-room deployment, restore, rollback limits, 10,000-version performance, final security/dependency/license/secret scans, browser regression and the machine-readable release evidence remain Milestone 8 work.