ahmido 83ab4690d5 fix: stabilize post-cutover suite baseline (#348 )

## Summary
- stabilize the active spec 293 post-cutover suite baseline around the current admin-panel and workspace-first runtime
- align operations, provider, required-permissions, and action-surface expectations to canonical workspace-aware routes
- add the monitoring operations workspace-membership guard and update the spec 293 classification artifacts
- include the browser smoke screenshots captured during verification

## Validation
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Filament/PanelNavigationSegregationTest.php tests/Feature/ManagedEnvironment/LegacyTenantCoreGuardTest.php`
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/OpsUx/CanonicalViewRunLinksTest.php tests/Feature/OpsUx/OperateHubShellTest.php tests/Feature/OpsUx/FailureSanitizationTest.php tests/Feature/OpsUx/NonLeakageWorkspaceOperationsTest.php`
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Guards/ActionSurfaceContractTest.php tests/Feature/ProviderConnections/NavigationPlacementTest.php tests/Feature/ProviderConnections/ProviderConnectionListAuthorizationTest.php tests/Feature/Verification/VerificationAuthorizationTest.php`
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Feature/Guards/Spec288NoLegacyRouteAndHelperGuardTest.php tests/Feature/Guards/Spec288ProviderCoreAndRoleAuthorityGuardTest.php tests/Feature/Guards/AdminWorkspaceRoutesGuardTest.php tests/Feature/Guards/ProviderBoundaryPlatformCoreGuardTest.php tests/Feature/ProviderConnections/LegacyRedirectTest.php tests/Feature/ManagedEnvironment/LegacyTenantCoreGuardTest.php tests/Feature/Spec080WorkspaceManagedTenantAdminMigrationTest.php tests/Feature/Rbac/ProviderConnectionWorkspaceFirstPolicyTest.php tests/Feature/Filament/ManagedEnvironmentAccessScopeManagementTest.php tests/Feature/Guards/BrowserLaneIsolationTest.php tests/Feature/Guards/CiLaneFailureClassificationContractTest.php tests/Feature/Guards/CiHeavyBrowserWorkflowContractTest.php tests/Unit/Auth/NoRoleStringChecksTest.php`
- `cd apps/platform && ./vendor/bin/sail artisan test --compact tests/Browser/Spec281ProviderConnectionScopeSmokeTest.php tests/Browser/Spec285WorkspaceRbacEnvironmentAccessSmokeTest.php`
- `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent`

## Notes
- remaining provider/verification failures are classified in `specs/293-post-cutover-suite-stabilization/failure-classification.md` as unrelated existing debt and are not folded into this slice

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #348

2026-05-11 06:41:47 +00:00

3.5 KiB

Raw Permalink Blame History

Data Model: Post-Cutover Suite Stabilization & Baseline Reconciliation

Overview

293 introduces no new application entity, table, or persisted runtime artifact. Its only modeled data is spec-local preparation truth for later implementation: one failure-classification artifact, one bounded failure-category inventory, and one bounded stabilization-seam inventory.

Pinned Failure-Classification Categories

Category	Meaning	Default Treatment in `293`
`cutover-baseline-debt`	stale test or baseline expectation caused directly by the `287` and `288` cutover truth	fix in `293`
`cutover-runtime-regression`	current workspace-first primary path is actually broken	allow minimal targeted fix in `293` if proven
`unrelated-existing-debt`	existing failure outside the cutover stabilization scope	document, do not silently absorb
`flaky-or-environment`	nondeterministic or environment-specific failure	isolate, rerun, and document
`resolved-or-not-needed`	initially suspected cutover debt that no longer needs work after classification or adjacent repair	record and stop

Pinned Stabilization Seams

Seam Key	Meaning	Primary Targets
`tenant_panel_baseline`	tests still assuming TenantPanel or `panel: 'tenant'` as current runtime truth	panel navigation and adjacent helper expectations
`legacy_admin_t_routes`	tests still expecting `/admin/t/...` management paths to behave as canonical runtime routes	panel navigation, required-permissions, provider routes
`workspace_aware_operations_routes`	tests or helpers generating operations routes without `workspace` context	OpsUx helpers, action-surface links, operations route tests
`legacy_required_permissions_provider_connections`	tests still expecting tenant-scoped required-permissions or provider-connection URLs to be canonical	provider-connection and verification-adjacent surfaces
`action_surface_rebaseline`	stale action expectations caused only by workspace-first, environment-scope, or TenantPanel removal	action-surface, RBAC, and adjacent Filament expectations

Spec-Local Artifact: `failure-classification.md`

Field	Meaning
`Group`	failing test, test family, or lane-visible group
`Seam`	one or more pinned stabilization seams, or `N/A` when the failure is unrelated
`Category`	one pinned failure category
`Reason`	short explanation for why the group belongs to that category
`Fix In 293?`	`yes`, `no`, or `only-if-proven-runtime-regression`
`Follow-up`	next action if the group remains open
`Status`	current implementation-tracking note

Invariants

The same five failure-classification categories must appear in spec.md, plan.md, tasks.md, research.md, quickstart.md, checklists/requirements.md, and failure-classification.md.
The same five stabilization seams must appear in spec.md, plan.md, tasks.md, research.md, and failure-classification.md.
293 introduces no new runtime product state and no new runtime persistence.
293 must not reactivate TenantPanel, /admin/t/..., or tenant-scoped provider fallback routes.
293 must keep the Spec 288 proof pack and browser anchors green.

Out-of-Scope Data Changes

no database migrations by default
no new provider registry or provider execution contract
no new RBAC role family or persisted access overlay
no new browser fixture family
no new runtime ledger or stabilization table

3.5 KiB Raw Permalink Blame History