Verification

Run repository orchestration commands from the repository root. The main app lives in applications/main; direct app-local commands use that working directory, while root wrappers preserve the root environment/data location. The source documentation gate is node scripts/check-docs.mjs from the root and checks applications/main/docs.

Install dependencies and the test browser once:

npm ci
npx playwright install chromium

Run the canonical local gate:

npm run verify

The gate type-checks source/tests/configuration, runs the Node suite with coverage, builds the spell-request frontend deployment, checks compiled template contracts, then runs the browser smoke suite. It starts no production services. GitHub Actions also builds and checks the default and allocation-risk frontend deployments independently.

Performance budgets fail CI (the backend:test:performance stage of npm run verify) when list latency, payload size or identity lookups regress. Tighten a budget when the path gets faster; do not loosen one to absorb a regression. seed:volume writes through the normal service, so a seeded store exercises the real Mongo decode and admission path locally (--access-out writes the matching policy).

Compiled-template contracts

The suite compares expression values returned by the compiled template API with source definitions for every registered template. It checks the shipped registry (including required spell registration) and anonymous-read denial. A correctly compiled expression can be assembled dynamically and never appear verbatim in bundle source; comparing runtime values avoids that false alarm.

This web-only lane uses isolated in-memory stores and a synthetic signing authority. Tokens go through normal authentication. No worker is started in this lane.

Browser and controlled worker

The browser lane starts a built web server and a separate source worker against a fresh temporary file store. No .env files or integration credentials are copied. Synthetic JWT identities exercise real authorization; no human login or production authentication bypass is involved. The requester acts in Chromium, while reviewer handoff and denied operations are checked through the real HTTP API.

The smoke verifies form entry, acknowledged autosave of all routing values, refresh, rich-text persistence, conditional routing, submission, private-read denial, denied reviewer operations by a requester, and an authorized reviewer transition with field-audit attribution.

The worker invokes the production scheduler pass and execution service on demand after acknowledged writes; it does not start the ordinary timer or credential-requiring worker launcher. It refuses non-spell workflows and allows only condition, automatic, and wait steps. A negative test verifies operational workflows are refused. The suite does not fake a condition by calling human completion on it.

A socket guard allows the server to reach only its owned signing authority; the worker has no allowed outbound endpoints. Browser requests are automatically limited to the fixture origin. These are test controls, not a sandbox for hostile code. The fixture owns its processes, deadlines and cleanup; it does not reuse or terminate other development servers. No local browser auth state is saved to disk.

For visible browser inspection after building the spell profile, use npm run test:browser -- --headed (or add --debug for the Playwright inspector). This uses the same synthetic fixture and cleanup path as the automated lane.

Evidence and limits

• Failure artifacts: screenshot, page context, redacted server/worker logs, and uncaught browser-error diagnostics. Raw browser traces/video are off to avoid serializing authentication tokens. A future redacted trace facility can improve this.
• Coverage reports: coverage/index.html and coverage/coverage-summary.json. This measures the Node suite, not the compiled child server or browser execution. No arbitrary global threshold has been imposed; use per-capability assertions and the measured baseline to choose the next tests.
• The file-backed smoke sequences writes and controlled ticks. It is not a proof of concurrent file writers, polling timing, crash recovery, or Mongo conformance.
• External integrations are refused, not exercised. Broader adapter tests need controlled response fixtures and explicit failure/idempotency scenarios.
• The first journey is not exhaustive: other intake branches, uploads, full multi-role browser handoffs and additional product views need tests alongside their extraction.
• test:built/test:browser reuse existing build artifacts and do not prove freshness. Use verify before treating source and compiled behavior as verified together.
• CI configuration is not merge enforcement by itself; required checks must be enabled separately where repository settings support them.

Project-boundary verification

The repository root is orchestration only. Main owns the operator console and neutral deployment composition; runtime, HTTP backend and peer frontends are separately owned projects. See project boundaries.

• npm run check:boundaries / npm run test:boundaries: dependency direction, declared/public imports and negative enforcement fixtures.
• npm run build:packages / npm run typecheck:packages: topologically build and independently typecheck the registered workspaces. Builds clear owned dist first.
• npm run check:packed: reject source/test artifacts and run packed contract and runtime/storage consumers. The latter strictly checks declarations and exercises closed-program execution without installing application or integration packages.
• npm run test:coverage:packages: per-project Node coverage, including unimported TS/TSX. Reports live in each project's coverage/; root coverage remains separate.
• npm run verify:spell: rebuild the root and packages, then copy only spell-owned source to a temporary checkout, install packed upstream artifacts, build its own Next frontend, then run the same browser journeys against a separate synthetic backend and worker. This verifies actual create/save/reload/submit, denial, reviewer attribution, list/table and audit-back navigation. It removes the temporary checkout on completion/failure.

npm run verify includes all of these, invoking independent proof scripts after one shared build. The isolated install is offline by default and requires a warm npm cache from the root install. If a local package firewall keeps its cache under different registry keys, PROCESS_SPELL_INSTALLER=sfw npm run verify explicitly permits installation through Socket Firewall instead. No production app credentials are loaded by the fixtures. Installation/build are distinct from the socket-guarded application runtime, whose allowed endpoints are only owned fixtures.

Coverage percentages before and after extraction are not directly comparable: source moved out of the root denominator, and root tests exercising compiled packages are not automatically credited to those packages' source reports. These are Node-lane measurements, not browser or total-product coverage. Keep the pre-extraction baseline and per-project results; do not claim improved coverage merely from moving files.

The standalone proof is not production OAuth validation, exhaustive feature parity, Mongo/concurrent-storage certification, or exhaustive product certification. Allocation Risk additionally verifies canonical file upload/download; arbitrary provider integrations still need their own authorized journeys. Network guards are regression safety controls, not hostile-code sandboxes.

Separate backend + frontend lane

npm run verify:backend builds the backend outside this checkout using only declared packed upstream artifacts. It verifies the absence of an installed spell package and empty startup, then loads fixture definitions/assets as trusted provisioning data. Compiled tests select this backend explicitly; the helper rejects accidental legacy-project overrides. A separate packed spell frontend and compiled controlled worker then run the browser scenarios against it. npm run verify includes this lane after the existing legacy/standalone-frontend lanes.

The expanded compiled suite checks CORS/Edge execution, invalid JWTs, optional-auth private reads, attachment reference and byte access, audit-only record/export access, and OAuth error redirects. These tests do not establish exhaustive API/security guarantees or real OAuth/Mongo behavior. Renderer/request helpers and their default composition remain distinct.

Shared sessions and app-only capability probes

check:browser-project installs the browser-session development project outside the repo, builds/typechecks/tests it using its declared development dependencies, and checks a fresh packed session-only consumer without React/Next installed. Session and useMe tests cover headers, org/401 branches, refresh events, impersonation retry and listener cleanup.

test:backend also runs the app capability probes. Synthetic credentials go through stdin; a bounded IPC channel requests only controlled worker ticks. The app's note handler is called directly with real backend identity/process checks; it is not a mounted production notes endpoint. Its data is separate from core reads and exports. Partial sharing results retain the created id; no creation is retried after a sharing failure.

Independent generic and Allocation Risk frontends

npm run verify:generic and npm run verify:allocation first build prerequisites, then install each frontend outside the checkout using only declared packed dependencies. The generic frontend proof rejects installed application/domain/integration packages; both bespoke proofs reject the generic frontend and other applications. Main-owned test launchers may run a separate canonical backend fixture, but no main private source enters a frontend artifact.

The generic journey registers a closed two-activity workflow through the public API, then exercises start, save/reload, completion, audit/export, workflow filtering, outsider denial and rejection of bespoke configuration. The neutral-host browser lane also creates two independent workflow apps and verifies origin-local mounted links, declared-member sharing and anonymous denial.

The Allocation Risk lane adds four clearly labeled synthetic UI transport stories and a separate real canonical-backend journey covering its actual 31 activities, 422 validation, shared editor field permissions, two-file upload/download, private outsider denial and final audit/export. This is not a historical screenshot/pixel-parity claim.

All three renderer suites reproduce and guard delayed poll/autosave responses across completion, reopening, newer drafts and principal changes. These UI response guards do not cancel or serialize writes already dispatched to the backend.

OAuth unit tests use real signed state and synthetic code exchange to verify configured origins, mount remapping rejection, per-flow browser binding and inert callback handoff encoding. Real tenant callback allowlists still require an authorized rollout check.

Manual release when Actions are unavailable

Use manual release: freeze the candidate, retain exact command and runtime evidence, run missing frontend-profile checks without repeating common suites, obtain reviewer approval and actual Railway staging acceptance. A billing-failed Actions run stays failed; do not claim a hosted pass. Merge is the deployment signal only after cutover prerequisites are complete.