cc-ci/REVIEW-shot.md

REVIEW-shot.md — Adversary verdicts, phase shot (recipe screenshot audit & repair)

Owner: Adversary loop. Append-only verdict log. Gates: M1 (audit+diagnosis), M2 (all working). SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-shot-screenshots.md.

No gate CLAIMED yet (phase just opened; Builder has not bootstrapped STATUS-shot.md). Doing independent cold ground-truth prep below so M1/M2 cold-verify is fast and un-anchored.

---

Independent cold pre-audit (Adversary, @2026-06-11T01:20Z)

Method: ssh cc-ci, scanned /var/lib/cc-ci-runs/*/results.json for recipe + screenshot field + on-disk screenshot.png size; scp'd suspect PNGs locally and looked at them (Read tool). This is MY ground truth, formed before any Builder claim — to compare against the Builder's matrix.

PNG sizes from latest representative runs (m2r-* sweep + numbered drone runs):

recipe	PNG bytes	my visual read	class
immich	4801	pure blank white frame	BLANK
n8n	4801	blank near-white frame	BLANK
lasuite-meet	4801	(size-identical to immich/n8n 4801B — blank tell)	BLANK (to confirm visually)
cryptpad	4802	blank light-grey frame	BLANK
keycloak	8764	spinner + "Loading the Administration Console" — paint-race loading state, NOT a real login form	BLANK/LOADING (not the "genuine sparse login" §2 guessed)
lasuite-docs	6022	bare spinner on white	BLANK/LOADING
lasuite-drive	~5.9K	(size sibling of lasuite-docs — likely same spinner)	BLANK (to confirm)
plausible	null / NO PNG	every run null (122→357 incl. 357); run dir has no screenshot.png; capture stdout not in run dir (goes to Drone build log) — root cause still to trace	NULL
ghost	444183	(reference healthy, §2)	OK (visual-confirm at M2)
mattermost-lts	242139	reference healthy	OK
hedgedoc	131967	reference healthy	OK
discourse	66-67K	reference healthy	OK
custom-html	35707	reference healthy	OK
mailu	33800	reference healthy	OK
matrix-synapse	33296	reference healthy	OK
uptime-kuma	30858	reference healthy	OK
custom-html-tiny	12950	reference healthy	OK
mumble	7913	voice server — web-UI N/A candidate (confirm)	N/A?

Confirmed defect classes match the orchestrator pre-audit (§2): SPA paint-race (domcontentloaded fires before JS paints) → immich/n8n/cryptpad fully blank, keycloak/lasuite-docs/-drive caught at loading spinner; plausible never captures (null on every run). The 4801B byte-identical size is a reliable blank-frame fingerprint.

Open items I must still resolve when verifying:

• plausible NULL root cause — need the Drone build log for a plausible run (capture stdout: "capture failed" vs "produced no file" vs step never reached). Run dir alone doesn't have it.
• lasuite-meet / lasuite-drive / mumble — visual confirm.
• Authoritative enrolled-recipe set: every tests/<recipe>/recipe_meta.py minus fixtures (_generic, regression, concurrency, custom-html-bkp-bad, custom-html-rst-bad).

No verdict yet. Awaiting claim(shot): M1.

---

M1: PASS @2026-06-11T01:38Z (audit + diagnosis complete)

Claim: claim(shot): M1 commit e005897; matrix+diagnoses at 8978fa6. STATUS-shot.md "M1 claim". Verified COLD from my own clone + ssh cc-ci, without reading JOURNAL-shot.md (anti-anchoring). My independent pre-audit (commit 4f3a747, formed BEFORE reading the Builder's matrix) already agreed on every BLANK/LOADING/NULL read I had pre-formed — no anchoring.

Enrolled set — complete, no omissions. ls tests/*/recipe_meta.py = 21. Minus the two harness canaries custom-html-bkp-bad, custom-html-rst-bad (plan §2 explicitly excludes both) = 19. The 19 matrix rows are exactly that set (diffed by hand) and exactly the plan §2 expected set. _generic/regression/concurrency/unit have no recipe_meta.py → correctly absent. ✓

Every non-OK row has evidence-backed root cause (independently re-derived):

• plausible NULL — ran the Builder's drone-log command myself: build 357 step log shows capture failed … page.goto(https://plau-…/) never returned a status in (200,301,302,303,401,403) after 15 attempts (45s); last status=500. / 500s by design (DISABLE_AUTH) → default landing capture can never succeed; needs a SCREENSHOT hook to a rendering path. Confirmed. ✓
• bluesky-pds NULL — capture is if deploy_ok:-gated, OUTSIDE the deploy try/except (runner/run_recipe_ci.py:1024, read it). install=fail level=0 → capture correctly skipped. Not a screenshot defect; upstream image breakage already in DEFERRED.md (rcust). ✓
• BLANK/LOADING — screenshot.py:84-93 navigates wait_until="domcontentloaded" then screenshots immediately, no paint wait; accept_statuses excludes 500 (plausible mechanism). Read the code. ✓
• mumble NOT N/A — tests/mumble/recipe_meta.py header: deploys compose.mumbleweb.yml, a mumble-web HTTP client routed through Traefik, HEALTH_PATH "/". A real web surface IS served → correctly the HARDER (non-N/A) call. ✓

Independent visual spot-checks (Read tool) — 11 artifacts, matrix matched reality on every one: immich 4801B = pure white; n8n 4801B = blank; cryptpad 4802B = blank grey; lasuite-meet 4801B = pure white; keycloak 8764B = "Loading the Administration Console" spinner (NOT a real login — the §2 "might be a genuine login" guess was wrong, Builder classed it LOADING correctly); lasuite-docs 6022B = bare spinner; mumble 7913B = spinner ring on grey; mattermost-lts 242139B = blue brand splash + logo, NO login form (correctly LOADING despite large size — size alone is NOT a sufficient signal, good catch); n8n run 197 30256B = real "Set up owner account" form, empty fields, credential-free (flaky-pass + secret-safe, confirmed); custom-html 35707B = genuine "Welcome to nginx!" (honest fresh-install view for a bare static host — OK); plausible = NULL via drone log. Includes plausible ✓ and multiple 4801B cases ✓ (M1 minimum was ≥5 incl. those — exceeded).

N/A arguments — agreed:

• bluesky-pds → justified N/A (deploy-gated: can't screenshot what can't deploy; upstream breakage is pre-existing/DEFERRED, not a screenshot defect). Agreed, contingent on the upstream image still being broken at M2 — if it becomes deployable, it re-enters as a real recipe.
• mumble → NOT N/A. Agreed (real mumble-web surface, evidence above).

No omissions, no fabricated visual reads, diagnoses are causal not symptomatic. M1 PASS.

Watch-list for M2 (so the Builder has it early — NOT blocking M1):

1. Harness default-wait fix must stay within NAV_DEADLINE_S=45 / step worst-case ≤~60s and must NEVER affect a verdict on screenshot failure (R7) — I will test the failure path has teeth but no verdict impact, and compare pre/post run durations.
2. plausible SCREENSHOT hook must land on a credential-free rendering path (not /login showing a generated secret; not a 500 page).
3. mattermost-lts proof: a bigger PNG is NOT acceptance — I will visually confirm the real login, not a brand splash.
4. Secret-safety: every final PNG must show no generated credentials (install wizards, secrets pages). n8n's "Set up owner account" with EMPTY fields is the safe shape; a pre-filled one is not.
5. M2 requires ≥2 proof runs via the drone !testme path + me Reading every final PNG.

Did not read JOURNAL-shot.md before this verdict. No finding filed (audit is accurate). No VETO.

---

M2: PASS @2026-06-11T07:17:53Z — all screenshots working (cold-verified from scratch)

Verified independently from a cold start (my own clone, my own scp/Read/re-runs; did NOT read JOURNAL before this verdict). Claim commit 196156e. Every M2 DoD item checked:

1. Every final PNG Read (18/18) — real, representative, credential-free. Pulled each PNG by scp, Read it with the image tool, byte-size matched the claim on all 18:

• Fixed-class (10): immich 234351B "Welcome to Immich" onboarding; plausible 64132B real registration form (EMPTY fields); keycloak 215587B real "Sign in to your account" (EMPTY) — was the 8764B "Loading Admin Console" spinner at M1, settle fix resolved it; cryptpad 57310B real landing + doc-type picker; lasuite-meet 225686B real video-conf landing; lasuite-docs 284769B real Docs landing; lasuite-drive 132037B real "Fichiers" landing; n8n 26433B "Set up owner account" (ALL fields EMPTY — secret-safe, now deterministic); mattermost-lts 178367B real "Log in to your account" form (EMPTY) — NOT the byte-identical interstitial (hook v2 click-through works — my sharpest watch-item, resolved); mumble 7980B loader spinner (see §N/A).
• Healthy-class (8): ghost 444183B blog landing; hedgedoc 131967B landing; discourse 66121B forum + welcome topic; custom-html 35707B "Welcome to nginx!" (honest fresh-install); custom-html-tiny 12950B seeded content; mailu 33800B sign-in (EMPTY); matrix-synapse 33296B "It works!"; uptime-kuma 30858B "Create your admin account" (EMPTY). Every login/setup form has EMPTY fields — NO generated credential is shown anywhere. Secret-safety cardinal guardrail holds across all 18.

2. No verdict/level regression. All 10 proof runs status=pass at their baseline level (immich /plausible/keycloak/cryptpad/lasuite-*/n8n/mumble=4, mattermost-lts=2). screenshot field populated on every one. no_secret_leak=true on every proof run I sampled (370/371/keycloak/n8n/mattermost /mumble).

3. ≥2 genuine drone !testme proofs — confirmed end-to-end, NOT manual. ccci-bridge_app logs: [poll] triggered build 370 for immich@107d7220 (PR #2, comment 14321) by autonomic-bot and ...build 371 for plausible@13458fac (PR #3, comment 14322)..., both reflected outcome ...: success. The bridge polled Gitea, found real !testme comments, triggered the builds, reflected verdicts back — the full comment→build path. Drone params {RECIPE,PR,REF,SRC}, event=custom, trigger/sender=autonomic-bot — matches the Phase-1c bridge-!testme fingerprint (REVIEW-1c:110).

4. Durations unaffected (no balloon). Drone same-recipe pre/post: immich 199s→198s, plausible 209s→166s (faster — capture no longer burns 45s failing on the 500). Screenshot step wait budget = 60000ms exactly (unit test_wait_budget_within_step_cap + my own cold probe). ≤~60s holds.

5. R7 (cosmetics never block) — intact. Call site run_recipe_ci.py ~1024-1037 is OUTSIDE the deploy try/except AND double-wrapped in its own try/except (_scrub-bed log) — and git log proves NO shot-phase commit touched run_recipe_ci.py (call site unchanged). capture() swallows everything → None → placeholder. I cold-probed the new helpers independently: _settle swallows all exceptions, _snap keeps the larger frame (A1 fix, 5/5), 60s budget — 9/9+5/5 pass. Screenshot unit suite 12/12

• card suite 10/10 ran GREEN cold on the real harness (cc-ci-run) from my scp'd clone.

6. Dashboard/card/badge render — live 200. GET dashboard / → 200; runs/370+371/screenshot.png → 200 image/png; badge/immich.svg + badge/plausible.svg → 200 image/svg+xml.

7. N/A set (19/19 enrolled, no omissions) — AGREED.

• bluesky-pds → N/A, re-confirmed at M2 (ab-bluesky-pds-oldmain: install=fail, level=0, screenshot=null → placeholder correct; upstream MODULE_NOT_FOUND still broken, DEFERRED).
• mumble → N/A-variant, AGREED — this reverses my M1 "NOT N/A" stance, on NEW evidence not available at M1. rankenstein/mumble-web:0.5 renders no usable UI for an anonymous browser: connect-dialog DOM genuinely absent (probe4 console: #connect-dialog_input_address ... did not match any element), perpetual loading-container spinner at 5/15/30/60/90s (probe2) — corroborated by my own Read of the 7980B spinner PNG. The loader frame is the literal web-surface reality every visitor gets; mumble's actual function (voice) is fully protocol-tested; fix needs a recipe/overlay change (out of scope, guardrail prefers upstream). Documented in DEFERRED with an upstream question. NOTE (not a defect, not a veto): the dashboard shows the honest loader frame rather than the "no screenshot" placeholder — acceptable as a documented, agreed limitation, NOT a healthy-app screenshot.

Finding A1 (blank-retry regression) was filed, fixed (7ad7d1f), and CLOSED after my cold re-test. No open findings. No fabricated reads — every matrix/claim value matched what I independently observed. M2 PASS. No VETO. With M1 PASS (ae10b55) + M2 PASS both fresh and A1 closed, the DoD handshake (§6.1) is satisfied — the Builder may write ## DONE to STATUS-shot.md.

(Consulted no JOURNAL-shot.md before forming this verdict.)