From a355285f3bc5690510202bfda441c15923fcf746 Mon Sep 17 00:00:00 2001 From: peter Date: Thu, 3 Sep 2026 14:16:53 +0100 Subject: [PATCH] Add round-4 (pre-deploy) handover for the LLM test project MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Final regression sign-off before deployment. Since #018 the only changes are cosmetic (table/body fonts), so no new API surface — this round is a broad regression sweep: full CRUD across all kinds, auth boundaries, confirmation that every closed issue (#003/#004/#006/#008/#010/#014/#015/ #016) stays fixed, and a sharing re-check. A clean pass is the deploy gate. Co-Authored-By: Claude Opus 4.8 --- ...-handover-to-llm-test-round-4-predeploy.md | 77 +++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 issues/019-handover-to-llm-test-round-4-predeploy.md diff --git a/issues/019-handover-to-llm-test-round-4-predeploy.md b/issues/019-handover-to-llm-test-round-4-predeploy.md new file mode 100644 index 0000000..8c2a05e --- /dev/null +++ b/issues/019-handover-to-llm-test-round-4-predeploy.md @@ -0,0 +1,77 @@ +# 019 — Handover to AGENT_DAYBOOK__LLM_TEST (round 4 — pre-deploy sign-off) + +**Status:** For information — final regression pass before deployment. + +This is the **last test round before the app is deployed**. Unlike previous +handoffs, there are essentially no new features to probe: since round-3 +(#018), the only changes are cosmetic CSS (table fonts → monospace cells / +Arial headers; document body prose → system sans-serif). **No API or +behavioral surface changed.** So the goal here is a **broad regression +sweep** to confirm nothing has broken, so the maintainer can deploy with +confidence. + +Everything is on `main` (pushed) and live on the local dev instance +(`http://127.0.0.1:8001`). Use the `test` / `testpwd` account and clean up +what you create. + +## What to do: full regression sweep + +Confirm the whole API still behaves. Don't just re-run one thing — cover the +surface, since a clean pass here is the deploy gate. + +### Core CRUD, every kind +- `POST` each text kind (markdown, html_fragment, html_full, deck, json, + csv) → `201`, correct `kind`, renders, `raw_available` correct. +- `POST` each file kind (image, pdf, binary) and `.xlsx` (→ converts to csv). +- `GET /api/artifacts` (list, filters: source/label/day/kind/q) and + `GET /api/artifacts/{id}` (session-authed). +- `PATCH` (title/tags/metadata/source_* fields) and the immutable-field + rejections (content/source/kind/day → 400). +- `DELETE` → 204, files gone, second delete 404s. +- `/api/capabilities` returns the current kind/method/filter lists. + +### Auth boundaries (important pre-deploy) +- No token / bad token on writes → 403. +- One user's token cannot read/patch/delete another user's artifact (404). +- List/detail reads require a session, not just a bearer token. + +### Confirm every closed issue stays fixed +Spot-check the earlier repros — these are the regression-risk areas: +- **#014** — script/onerror in markdown/deck/html_fragment still stripped; + CSP `script-src 'none'` present on those (and `/s/`); html_full still + verbatim. +- **#015** — deeply nested JSON (content *and* request body) → 400, not 500. +- **#016** — ragged CSV rows don't drop cells. +- **#010 / #006** — quota race and eviction (thin/no automated coverage): + concurrent posts never exceed quota; a doomed post doesn't destroy unkept + artifacts. +- **#008** — non-string source_* → 400. +- **#003 / #004** — length limits and content-shape checks still enforced. + +### Sharing (the unauthenticated surface — worth re-checking before going live) +- Share toggle creates/clears the token; `/s/{token}` serves unauthenticated; + unsharing kills the old link immediately; a bad/guessed token 404s; an + unshared artifact's embedded assets are not reachable anonymously. + +## Cosmetic changes since #018 (not API-testable, FYI only) + +- Table cells render in monospace, headers in Arial. +- Document body prose is system sans-serif (was serif in the report theme). +- Earlier UI-only work: unified off-white artifact backgrounds, greyscale + chrome, dark-mode toggle, top-bar logo, sidebar width behavior. + +None of these change API responses; verify only if a render looks broken. + +## Out of scope / don't report +- **#017** (customizable theme variants) is an accepted design issue, not a + bug. +- `html_full` being verbatim/unsanitized is by design. +- `pdf` using the browser's grey viewer chrome is expected. + +## Outcome +- **Clean sweep → the maintainer deploys.** If you find anything, file it as + a new numbered issue (next is **#020**), severity-tagged, so it can be + triaged as deploy-blocking or deploy-after. + +As always: `test`/`testpwd`, clean up, and check `artifacts/views.py` before +calling a surprise a bug.