Repository navigation
Conversation
…t deleted Per the clean-tree plan, but ARCHIVED instead of deleted so we can mine them for salvageable code/data first. Moved 44 files into archive/2026-06-test-cleanup/ (original paths preserved) with a MANIFEST.md flagging each for future deletion + the reason: 23 redundant/stale/placeholder e2e specs, 11 loose debug runners/JS + duplicate/stale playwright configs + global-setup, and 8 redundant shell scripts. Repointed the 3 npm scripts that targeted archived files: - test:comprehensive → node tests/run-unified.mjs --profile full (Makefile uses it) - test:pr → node tests/run-unified.mjs --profile pr (CI advisory step) - removed test:e2e:error-handling (its target spec is archived) Nothing archived is run by Playwright/vitest/CI/npm. Verified: playwright --list = 493 tests / 43 files, zero collection errors, no archived spec collected; unified smoke profile 212✓; THE GATE green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-1: archive ~34 dead/stale test files (moved, not deleted)
…(Phase 2) The reusable test layer now lives in ONE place. Moved all helpers (auth, api, seedGraph, dbHealing, testEnv, mobileAudit, zorder, vlm, mock-oauth-server, README) into tests/lib/ alongside the harness modules, and balance_metrics.py into tests/lib/metrics/. Codemod across all 39 keeper specs: '../helpers/' → '../lib/' (uniform — every spec is depth-1 under tests/); fixed the balance_metrics.py path string in graph-balance.spec.ts and two stale doc-comment paths. Verified (the plan's #1 risk — a missed import silently zeroes a project at collection): playwright --list per project all resolve with ZERO collection errors (default 352, perf 3, geometry 18, showcase 5, vlm 1, matrix 109); THE GATE 5/5. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-2: helpers → tests/lib + import codemod (gate green, 0 collection errors)
…aude/ Phase 2's git add -A swept in 4 leftover Workflow worktree gitlinks under .claude/worktrees/ (embedded repos). Remove them from tracking and gitignore .claude/ so agent scratch never lands in commits again. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chore: untrack accidental .claude/ worktrees + gitignore .claude/
…ht config (Phase 3)
Clean tree: tests/e2e/{smoke,auth,graph,ui,a11y,mobile,responsive,api,admin,reports}/,
tests/diagnostics/{layout,interactions,hierarchy,inspector,physics,perf,ui}/, and
infra specs to tests/integration/. Specs renamed for clarity (login-focus→auth/
passwordless-focus, copy-id→graph/node-inspector-copyid, visual-vlm→reports/
vlm-evaluation, etc.).
Config + refs:
- playwright.config.ts: default project testIgnore → '**/reports/**' (capture-heavy
report specs run in their own projects; integration/ is outside testDir); vlm
testMatch → vlm-evaluation.spec.ts. showcase/matrix/matrix-setup testMatch match
by filename (unchanged).
- repointed test:smoke + test:e2e:visual, the unified sequence manifest, and CI
ci.yml living-graph path to the new locations.
Caught + fixed the plan's #1 risk: moving specs into subfolders changed their depth,
so the Phase-2 '../lib/' imports broke (depth-2 specs need '../../lib/') — the
verification showed 0 tests / collection errors; fixed 37 files; re-verified.
Verified: per-project playwright --list all 0 collection errors (default 117, perf 3,
geometry 18, showcase 5, vlm 1, matrix 109, matrix-setup 1); reports specs excluded
from the default project; THE GATE 5/5; unified smoke profile 212✓.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-3: specs into domain folders + playwright config rewrite (0 collection errors, gate green)
… infra scripts (Phase 4) - Moved the 4 generate-*-report.mjs (showcase/matrix/perf/vlm) into tests/lib/reporting/ so all reporting lives in one reusable place. They use process.cwd()-relative paths, so only the npm script paths needed updating (report:showcase/matrix/perf/vlm, test:perf:scale, test:vlm). - Co-located the 2 loose infra/TLS node scripts in tests/integration/ (ssl-certificate-analysis.js, mobile-https-compatibility-test.js); updated test:https. tests/ root is now clean (only run-unified.mjs). - Expanded the unified manifest so `--profile full` runs the whole battery: added perf-budgets + diagnostics + matrix + vlm + perf-scale as report-only (non-blocking) sequences; pr profile now includes perf budgets. Verified: 4 generators node --check ok; playwright --list unaffected (default 117, geometry 18, perf 3, 0 collection errors); new harness sequence perf-budgets runs 3✓ through run-unified.mjs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-4: consolidate report generators into tests/lib + relocate infra scripts
…t into the unified report
Cross-repo unification (Core side). New tests/lib/adapters/cloud-audit.mjs reads a
Cloud live-audit findings.json (the AuditRun output: {findings:[{dim,name,status,
detail}]}) and maps pass/warn/fail/info → the unified counts, skipping cleanly when
absent. Wired a 'cloud-audit' sequence into the manifest (full + report profiles,
non-blocking) that auto-resolves the newest findings.json from the sibling
../GraphDone-Cloud/live-audit-artifacts (or --cloud-findings <path>).
So `npm run test:unified --profile full` now reflects the live Cloud audit alongside
the local unit/e2e/report sequences — one report across both repos.
Verified: node:test 13/13 (incl. 3 new cloud-audit cases); ingesting the real
findings.json reports 73✓ 5⚠ 11⏭, matching the live audit. (Fixed a status-key bug
where warn landed in a stray counts key instead of 'warned'.)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-5a: cloud-audit adapter (ingest Cloud live-audit into unified report)
…ree (Phase 6)
- CLAUDE.md: testing section now documents `npm run test:unified` (dual HTML+video /
JSON output), the domain-folder tree, tests/lib/ as the reusable layer, the
archive/ convention, and the new THE GATE + helper import paths.
- Makefile test-all/test-report + package.json test:report → test-artifacts/unified/report.html.
- tests/lib/README.md rewritten for the consolidated helpers + harness layout.
- Repointed tests/helpers/ → tests/lib/ across docs; fixed the THE GATE spec path
in docs/SYSTEMS.md.
Known remaining doc-debt (NOT in scope here): docs/testing/{pr-testing-guide,
testing-architecture,test-organization}.md still describe the old run-all-tests.js /
run-pr-tests.js runners (now archived) and old test-results/reports/ filenames;
they need a rewrite to the unified harness in a follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TEST-UNIFY-6: docs + pointers for the unified harness / clean tree
… stale guides Replaces the three guides that still documented the archived run-all-tests.js / run-pr-tests.js runners + old test-results/reports paths with a single accurate docs/testing/README.md (unified harness entry, dual HTML+video/JSON output, profiles, the domain tree, how to add a spec/sequence, auth helper). The stale pr-testing-guide.md / testing-architecture.md / test-organization.md are moved to archive/2026-06-test-cleanup/docs/testing/ (nothing linked them) — mineable, per the archive convention. Clears the test-refactor's remaining doc-debt. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs(testing): canonical unified-harness guide; archive 3 stale guides
…d lagoon CSS Profiled idle FPS on a small graph (4 nodes, ULTRA quality): 52 fps, recovering to 59 when the lagoon backdrop is hidden and 60 with all animation off. The static `.lagoon-caustics` backdrop had no compositor-layer promotion, so it was repainted every frame the SVG nodes animate above it — the dominant idle cost on small graphs (the #57 work only size-gated node/edge effects, not the backdrop). - Promote `.lagoon-caustics` to its own GPU layer (transform: translateZ(0); will-change: transform; contain: layout paint style) → idle 52 → 57-58 fps on the same small graph, no visual change. (Verified via an auth'd FPS probe.) - Removed ~125 lines of DEAD lagoon CSS: `.caustic-layer` + `.caustic-layer-1..20` + `.lagoon-shimmer` + `.lagoon-shimmer-2..10` and their `@keyframes` (lagoonCaustics1/2/3, lagoonShimmer) + `--lagoon-shimmer-*` vars — confirmed no DOM element anywhere uses these classes (they animated nothing; a perf red-herring). THE GATE 5/5; no element references the removed classes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
FIX-62: small-graph idle FPS — isolate lagoon backdrop + drop dead lagoon CSS
On a phone the graph defaults to LOCKED (touch pans the canvas), and a single tap on a node previously relied on the flaky synthetic mouse-click — so opening a node on touch was unreliable. The header icon buttons also draw at 16-24px, well under the 44px touch-target minimum. - New pure lib/touchInteraction.ts (11 unit tests): isTap / isLongPress (duration + movement thresholds), touchHitSize (>= 44px on touch), distance, isCoarsePointer. - TAP-TO-OPEN: the node touchend now classifies a quick, still touch as a tap and calls handleNodeClick directly + preventDefault (suppresses the synthetic click so it can't double-fire open-then-shut). Long-press (context menu) and drag/pan are excluded by isTap. Works even while the graph is locked. This also makes the touch grow flow's target-tap (complete-connection) fire deterministically. - 44px HIT AREAS: on a coarse pointer, each node header icon group (edit / relationship / expand / descend) gets a transparent 44px hit-rect — bigger tap target, identical look, tracks the counter-zoom. Verified: touchInteraction 11/11; new tests/e2e/mobile/touch-graph.spec.ts (@mobile @touch, real hasTouch context) — single tap opens the inspector while locked; web typecheck clean; THE GATE 5/5 (no desktop regression). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MOBILE-TOUCH (#29): reliable tap-to-open + 44px hit areas
… parallel D1 writes) persistAllPositions (fired when the sim settles after a reflow) looped every moved node and called saveNodePosition in parallel — a large-graph reflow produced N simultaneous mutations, i.e. N parallel D1 writes (write-amplification spike). Now those writes go through a queue that (a) coalesces repeated writes per node (last position wins) and (b) drains with a hard cap of 4 in-flight writes, so a 500-node reflow does at most 4 writes at a time. Drag-end saves route through the same queue so a drag during a reflow doesn't add another parallel write. - New pure lib/positionSaveQueue.ts (5 unit tests): drainWithLimit (never exceeds the concurrency limit, runs every item) + createPositionSaveQueue (coalesce last-write-wins; cap in-flight; saves queued mid-flush aren't lost). - Queue bound to the latest saveNodePosition via a ref (created once). Verified: positionSaveQueue 5/5; web typecheck clean; THE GATE 5/5 incl. the layout-persistence test (an arranged node still survives a reload through the queue). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
PERF-95: coalescing, concurrency-bounded node-position saves
The live red-team probe caught /assets/index-*.js.map served 200 on production — public source maps leak the original source. vite build had sourcemap:true; set it to false. Dev (Vite dev server with its own maps) is unaffected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
SEC: disable production source maps (no public .js.map)
…tags) So a reviewer can say "3.5 looks wrong". buildReport now assigns each sequence a section ref and each case `<section>.<n>` (presets like a live runner's source.dimension.check are preserved); html.mjs renders a citable §ref badge on each section and a copy-selectable ref chip on each check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
report: hierarchical reference IDs (citable tags) on every check
…apsed Previously only warn/fail + media cases were listed, so a passing check had no visible ref to cite. Now every case renders (with its ref); sections are <details> collapsed by default (open if warn/fail) so the page stays scannable while nothing is hidden — any check is citable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
report: render every check with its citable ref (sections collapsed)
…g light) A local read-only web dashboard (npm run dashboard → http://localhost:3199) that watches every graphdone.unified-report/1 run across BOTH repos (Core test-artifacts/unified* + Cloud live-full-report/<stamp>), accumulates trend history that survives Core's per-run overwrite, and updates itself LIVE over SSE when a new run lands — no zip, no manual refresh. - Performance & health trend charts over time (suite pass-rate/failures/duration; graph idle/drag/interaction FPS, load, tick cost, query p95, drift; physics settle; VLM score) — hand-rolled inline SVG, zero deps. - Runs timeline + per-check drill-down (citable §-refs) with embedded screenshots and video clips; a media gallery. - Append-only JSONL history + retention-capped media snapshots of clobber-prone runs (under the already-gitignored test-artifacts/dashboard/). Zero runtime deps (node:http + SSE + native-ESM modules shared by Node tests and the browser). Read-only, bound to 127.0.0.1; media served only from within a run's report dir (realpath-checked, traversal/symlink-escape rejected, media-ext allowlist) with HTTP Range support; CSP on the shell; /static is a 3-file allowlist. 31 unit tests; hardened against a 4-lens adversarial review (Range suffix-bytes, runId/snapshot/history-staleness, canonical metric keys). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Live, self-updating test dashboard (continuous guiding light)
|
Independent review of clean No source blocker was found. This review is independent agent evidence, not a GitHub non-author approval. Actual production-stack acceptance and exact-head CI remain pending and required. The local production images have built; the owned stack is starting. No registry image or release was published. |
🧪 Comprehensive Test Suite
Full-stack smoke gate runs in the CI workflow. |
|
First real production run on clean The correction will use the actual CI run 40042545922 was deliberately cancelled as superseded after its static/unit/security/real-Neo4j checks passed; its browser gates were still running. It is not a passed run. Final-head CI and the corrected full production run remain required. The independently reviewed public-artifact allowlist fix has been integrated locally; raw browser traces will not be uploaded. |
🧪 Comprehensive Test Suite
Full-stack smoke gate runs in the CI workflow. |
|
Corrected production acceptance passed on clean PLAYWRIGHT_BROWSERS_PATH=/tmp/graphdone-audit-playwright xvfb-run --auto-servernum node scripts/test-production-stack.mjs --out test-artifacts/release-production
Evidence retained locally at |
# Conflicts: # .agents/issues/INDEX.md
mvalancy
changed the title
🧪 Comprehensive Test Suite
Full-stack smoke gate runs in the CI workflow. |
|
Main PR #191 is blocked by its fresh production audit at The high finding is GHSA-xjj6-f33q-929c in A narrow lockfile update, clean install, fresh audit, relevant SQLite/runtime checks and final CI are being prepared in an isolated worktree. No force audit fix, threshold change or unvalidated merge. |
🧪 Comprehensive Test Suite
Full-stack smoke gate runs in the CI workflow. |
|
The high-advisory correction is now in final candidate The two new regression cases fail on the old dependency and pass on the correction. Patched clean installation, all 207 harness cases and native SQLite bootstrap/persistence passed. A separate fresh-cache audit reports 8 moderate, 0 high and 0 critical findings, with Undici removed. The prior high failure remains retained; the audit threshold was not relaxed. The fully rebuilt local production stack and final-head CI, Comprehensive Tests and read-only image builds are running. The previous blocked/superseded runs are not complete passes. No main merge or protection change yet. |
|
Final patched production stack passed on clean All six headed smoke cases passed with zero Playwright retries/skips, all seven persistence/configuration checks passed, API/Neo4j readiness and exact saved graph readback passed, and HTTP admin identity/login survived API recreation. All owned containers, volumes and networks were removed. Starting/finished source fingerprints were identical and clean: A separate network-disabled, volume-free probe of the exact built API image GitHub's final-head security, unit/matrix and harness checks have passed. Remaining main-target browser/production/image jobs are still running; no main merge is claimed until all applicable jobs and review requirements are satisfied. |
|
Final main-target production CI and all six architecture builds have passed on the exact reviewed merge tree.
Comprehensive Tests, fresh security audit, units, 207 harness cases and the real Neo4j/MCP contract have also passed. The broader normal browser sequence remains in progress; main's existing non-author review requirement is still active. No merge or protection change yet. |
Promote the reviewed Core development line to
main, including the completed #156 application/test sweep and the main-readiness corrections in #189. The normal merge composition preserves existing main history. Production validation becomes blocking, authentication data uses the actual persistent volume path, and source promotion cannot trigger unvalidated registry/release/deployment writes.The existing dev work was integrated through #157 and #188 with passing final-dev CI. This PR adds read-only amd64/arm64 image builds; explicitly disabled unfinished Release/Deploy actions; an isolated real HTTPS Compose acceptance runner with generated credentials, saved-graph readback, strict headed smoke and container-recreation checks; matching SQLite mounts with migration guidance; and a password-form helper fix exposed by the first production run. A fresh main audit then found a high advisory in optional SQLite build tooling, so the candidate also patches only the Undici lock entry from 6.28.1 to compatible 6.29.1 and guards the actual installed consumer.
Current candidate:
8a9c7512b5dedf4020d117887674d378de85667b. Validation:abc29d9passed the real production stack: 6/6 headed smoke cases, zero Playwright retries/skips; 7/7 persistence checks; unchanged source; confirmed cleanup. Detailed result and retained initial failure. This is retained historical runtime evidence, not a claim that the updated image has already passed.d56f32cfc5f27b4fff305129af58c6403936e294has parents current main775362eand candidate8a9c751, with full treee6a76e7f7cfec16db8aca9467a49218b75cc04e0exactly matching the candidate. Browser and production source stayed clean and unchanged. Browser artifact, production artifact.Existing installations must back up authentication data from the old container writable layer before recreation. The production Compose MCP service is not running; the separate real-MCP contract is checked independently. Public production artifacts contain only summary and redacted logs; raw browser traces stay private.
Exact-SHA publishing and real deployment remain disabled and tracked in #190. This PR does not deploy graphdone.com or publish a release. Main protection is unchanged and human review has been requested. Running independently on Matthew's behalf while he works.