From 9ca39dc179415448cd8665fff2612c4f9e6bdd84 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Sun, 31 May 2026 10:04:09 +0000 Subject: [PATCH] =?UTF-8?q?review(3=20U4):=20PASS=20=E2=80=94=20dashboard?= =?UTF-8?q?=20grid=20+=20history=20cold-verified=20(R5,=20R3=20full);=20ne?= =?UTF-8?q?ver-greener=20vs=20results.json,=20honest=20#11=20failure=20row?= =?UTF-8?q?=20(no=20results.json=E2=86=92failure/=E2=80=94),=20no=20secret?= =?UTF-8?q?s,=209=20tests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/REVIEW-3.md | 62 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 59 insertions(+), 3 deletions(-) diff --git a/machine-docs/REVIEW-3.md b/machine-docs/REVIEW-3.md index 491b71a..2a477ad 100644 --- a/machine-docs/REVIEW-3.md +++ b/machine-docs/REVIEW-3.md @@ -9,11 +9,11 @@ JOURNAL-3.md / BACKLOG-3.md `## Build backlog`. I own this file + BACKLOG-3.md ` run; a missing lower rung caps the level (YunoHost semantics). **COLD-VERIFIED @U0 07:05Z.** - [x] **R2 โ€” Image-forward PR comment.** `!testme` posts/updates a Gitea PR comment: marker (๐ŸŒป) + status/level badge + summary image, both linking to run/dashboard; re-run updates same comment. -- [ ] **R3 โ€” Summary card image.** Per-run PNG: recipe+version, level, per-stage/per-test โœ”/โœ˜ +- [x] **R3 โ€” Summary card image.** Per-run PNG: recipe+version, level, per-stage/per-test โœ”/โœ˜ breakdown, embedded deployed-app screenshot; stable URL; in comment + dashboard. - [x] **R4 โ€” App screenshot.** Runner captures real screenshot of deployed app (Playwright, post-login where needed) for the card. **COLD-VERIFIED @U1 07:15Z.** -- [ ] **R5 โ€” Dashboard polish.** Overview at ci.commoninternet.net resembles ci-apps.yunohost.org: +- [x] **R5 โ€” Dashboard polish.** Overview at ci.commoninternet.net resembles ci-apps.yunohost.org: recipe grid w/ level badge, latest pass/fail, last version, app screenshot, history link. - [ ] **R6 โ€” Badges.** Per-recipe level/status SVG badge endpoint embeddable in READMEs + dashboard. - [ ] **R7 โ€” Safe & robust.** No secrets in images/comments/badges/screenshots (reuse P1 ยง4.4 @@ -26,7 +26,7 @@ JOURNAL-3.md / BACKLOG-3.md `## Build backlog`. I own this file + BACKLOG-3.md ` - [x] U1 โ€” App screenshot (real, post-login, secret-safe). **PASS @07:15Z.** - [x] U2 โ€” Summary card + badge (HTMLโ†’PNG; level/โœ”โœ˜/screenshot; SVG badge; stable URLs; pass+fail). **PASS @07:48Z.** - [x] U3 โ€” YunoHost-style PR comment (marker+badge+card, linked; updates on re-run; no secrets). **PASS @09:51Z.** -- [ ] U4 โ€” Dashboard polish (grid mirrors underlying results across several runs). +- [x] U4 โ€” Dashboard polish (grid mirrors underlying results across several runs). **PASS @10:04Z.** - [ ] U5 โ€” Badges + docs + hardening (leak scan clean; renderer-kill degrades to text; flip DONE). ## Adversary invariants to attack this phase (from ยง6 guardrails) @@ -422,3 +422,59 @@ may proceed to U4. degrades to text, verdict unaffected" demonstration is **U5** hardening scope, not U3. - **Placeholder (โณ) not observed live** this run (build completed inside one 30s poll window); covered by unit test + Builder's #3โ†’#4 demo. Not re-tested โ€” acceptable. + +### @2026-05-31T10:04Z โ€” U4 GATE: PASS (Dashboard polish; R5 + R3 "in dashboard") โ€” COLD-VERIFIED +Claim `fb8f382 claim(3 U4)`. Verified cold from my clone + the VM. Verdict formed WITHOUT reading +JOURNAL-3 (anti-anchoring); inbox artifact-map consumed @1be4492. + +**1. Deployed == committed source.** `sha256(dashboard/dashboard.py)` first-12 in MY clone = +`7b34ec8761df` == host `/etc/cc-ci/dashboard/dashboard.py` == swarm image tag +`cc-ci-dashboard:7b34ec8761df` (`ccci-dashboard_app` 1/1). Live dashboard IS the claimed source. โœ” + +**2. Unit tests (cold, cc-ci devshell):** `cc-ci-run -m pytest tests/unit/test_dashboard.py -q` โ†’ +**9 passed**. โœ” + +**3. Live grid (R5)** โ€” `GET https://ci.commoninternet.net/` โ†’ 200, YunoHost-style grid, two recipe +cards: **custom-html** (level 4, success, `db9a95024e9d`, cap "L5 integration N/A", โœ” teardown / โœ” +no-leak, screenshot thumb `/runs/7/screenshot.png` โ†’ `/runs/7/summary.png`, `history โ†’` +`/recipe/custom-html`) and **uptime-kuma** (level 4, success, `dfed87a39f8a`, `/runs/12/...`). Each has +level badge + latest pass/fail + last version + app screenshot + history link โ€” mirrors +`ci-apps.yunohost.org` shape (plan R5). โœ” + +**4. Live history** โ€” `/recipe/custom-html` โ†’ 200, rows #7/#4/#3/#1 each success/L4/version + per-run +`card` link to `/runs//summary.png`. `/recipe/uptime-kuma` โ†’ 200, **#12 success L4** + **#11 failure, +level โ€”, no card** โ€” a real failed run shown HONESTLY. โœ” + +**5. CARDINAL โ€” no inflation, grid/history vs raw results.json (make-or-break).** +- custom-html grid "level 4" == `/runs/7/results.json` `level=4`, all tiers pass (verified @U3). โœ” +- uptime-kuma grid "level 4" == `/runs/12/results.json` `recipe=uptime-kuma`, `version=dfed87a39f8a`, + `level=4`, results all-pass, flags both true. **Exact match.** โœ” +- **Honest failure (the key adversarial probe):** `/runs/11/results.json` โ†’ **HTTP 404 (genuinely + absent** โ€” run #11 failed at `fetch_recipe` on a bogus ref, wrote no artifact). The dashboard shows + #11 as **`failure / level โ€” / no card`** โ€” derived faithfully from the artifact's ABSENCE, **not a + fabricated or inflated level, and no screenshot/card it never produced.** โœ” +- **Live-read proof (not hardcoded):** the grid surfaces custom-html **run #7** (my U3 re-`!testme`, + newer than #4) with a dynamic "12m ago" โ€” it picks the latest Drone build + its results.json live, + so the displayed level cannot drift greener than the actual latest run. โœ” + +**6. No secrets (R7).** Scan of the grid + both history pages โ†’ the only `secret` hits are the +`title="no secret leak"` flag label (2ร—); zero real secret values. Embedded screenshot thumbnails are +the U1-verified secret-safe **setup pages** โ€” eyeballed `/runs/12/screenshot.png`: Uptime Kuma "Create +your admin account" with **EMPTY** username/password fields (a form to SET a password โ€” displays no +generated credential). โœ” + +**7. HEAD parity / A3-1 stays closed.** `HEAD /`, `HEAD /recipe/custom-html`, `HEAD /recipe/uptime-kuma` +โ†’ all **200** (shared `_route` w/ GET). โœ” + +**VERDICT: U4 PASS @2026-05-31T10:04Z.** The overview grid + per-recipe history are a faithful, +never-greener projection of each run's `results.json`; a failed/levelless run (#11) is shown honestly +(failure pill, level โ€”, no card); rendering is read-only over RO-bind-mounted artifacts and reads the +latest build live; no secrets; deployed dashboard == committed source; 9 unit tests pass. +**R5 satisfied. R3 now FULLY satisfied** (card embedded in both the PR comment (U3) and the dashboard +(U4)). No VETO. Builder may proceed to U5 (per-recipe badge + docs + hardening + final leak scan). + +**Scope / carry-forward (NOT defects):** +- **R6** (per-recipe latest-level badge endpoint embeddable in READMEs) โ€” still **U5** scope; the + per-RUN `badge.svg` is U2-verified, but the per-RECIPE endpoint isn't present yet. R6 stays unticked. +- **R7 full hardening** (render-kill degrades to text, broad leak scan over ALL published artifacts), + **R8 docs** โ€” **U5** scope.