daybook/issues/019-handover-to-llm-test-round-4-predeploy.md

019 — Handover to AGENT_DAYBOOK__LLM_TEST (round 4 — pre-deploy sign-off)

Status: For information — final regression pass before deployment.

This is the last test round before the app is deployed. Unlike previous handoffs, there are essentially no new features to probe: since round-3 (#018), the only changes are cosmetic CSS (table fonts → monospace cells / Arial headers; document body prose → system sans-serif). No API or behavioral surface changed. So the goal here is a broad regression sweep to confirm nothing has broken, so the maintainer can deploy with confidence.

Everything is on main (pushed) and live on the local dev instance (http://127.0.0.1:8001). Use the test / testpwd account and clean up what you create.

What to do: full regression sweep

Confirm the whole API still behaves. Don't just re-run one thing — cover the surface, since a clean pass here is the deploy gate.

Core CRUD, every kind

• POST each text kind (markdown, html_fragment, html_full, deck, json, csv) → 201, correct kind, renders, raw_available correct.
• POST each file kind (image, pdf, binary) and .xlsx (→ converts to csv).
• GET /api/artifacts (list, filters: source/label/day/kind/q) and GET /api/artifacts/{id} (session-authed).
• PATCH (title/tags/metadata/source_* fields) and the immutable-field rejections (content/source/kind/day → 400).
• DELETE → 204, files gone, second delete 404s.
• /api/capabilities returns the current kind/method/filter lists.

Auth boundaries (important pre-deploy)

• No token / bad token on writes → 403.
• One user's token cannot read/patch/delete another user's artifact (404).
• List/detail reads require a session, not just a bearer token.

Confirm every closed issue stays fixed

Spot-check the earlier repros — these are the regression-risk areas:

• #014 — script/onerror in markdown/deck/html_fragment still stripped; CSP script-src 'none' present on those (and /s/); html_full still verbatim.
• #015 — deeply nested JSON (content and request body) → 400, not 500.
• #016 — ragged CSV rows don't drop cells.
• #010 / #006 — quota race and eviction (thin/no automated coverage): concurrent posts never exceed quota; a doomed post doesn't destroy unkept artifacts.
• #008 — non-string source_* → 400.
• #003 / #004 — length limits and content-shape checks still enforced.

Sharing (the unauthenticated surface — worth re-checking before going live)

• Share toggle creates/clears the token; /s/{token} serves unauthenticated; unsharing kills the old link immediately; a bad/guessed token 404s; an unshared artifact's embedded assets are not reachable anonymously.

Cosmetic changes since #018 (not API-testable, FYI only)

• Table cells render in monospace, headers in Arial.
• Document body prose is system sans-serif (was serif in the report theme).
• Earlier UI-only work: unified off-white artifact backgrounds, greyscale chrome, dark-mode toggle, top-bar logo, sidebar width behavior.

None of these change API responses; verify only if a render looks broken.

Out of scope / don't report

• #017 (customizable theme variants) is an accepted design issue, not a bug.
• html_full being verbatim/unsanitized is by design.
• pdf using the browser's grey viewer chrome is expected.

Outcome

• Clean sweep → the maintainer deploys. If you find anything, file it as a new numbered issue (next is #020), severity-tagged, so it can be triaged as deploy-blocking or deploy-after.

As always: test/testpwd, clean up, and check artifacts/views.py before calling a surprise a bug.