12 KiB
Curated documentation snapshot as of 2026-10-24 08:08 UTC. Lane-owner factual review pending unless explicitly stated; not release approval, execution admission, or confirmation that implementation is published.
Testing process, commands and prerequisites
Evidence gates
| Gate | Required exit |
|---|---|
| G0 provenance | Exact canonical accepted refs/component pins, preserved dirty work, reproducible baseline and reviewed manifest |
| G1 source | Production-module regressions, applicable lint/typecheck/build, full tests at coherent freeze, independent high-risk review |
| G2 integration | Real isolated services and fault scenarios; exact bytes/operation identity/route evidence rather than UI mocks |
| G3 artifact | Exact backend/UI/app/APK payload, immutable hashes, compatibility, nonempty migration/rollback; no final hot patch |
| G4 installed | Authorized managed delivery, backup/restore readiness, installed AND served hashes, preservation and money-free smoke |
| G5 physical/operator | Actual supported devices/nodes and operator scenarios, explicit pass/fail/blocked scope |
| G6 release | Complete reconciled matrix, canonical publication/mirror/metadata/assets and separate release-owner authority |
Commands: inspect current source before execution
These are command entry points, not authorization to run against a live installation. Freeze the reviewed source, read its instructions and actual script usage, bind tools/lockfiles/architecture and obtain applicable bounded admission first. Private endpoints/credentials do not belong in command examples or public receipts.
# Read-only provenance and script/package inspection in the selected checkout
git rev-parse HEAD
git status --short
# Inspect scripts/test-backend-isolated.sh and the relevant package.json/lockfile.
# Backend tests on a machine with installed apps: approved isolated harness ONLY.
ARCHY_TEST_REPO='/path/to/clean-reviewed-checkout' ./scripts/test-backend-isolated.sh
# Core dashboard, from its package directory after approved frozen dependency setup:
npm test
npm run type-check
npm run build
# IndeeHub backend, ONLY inside the reviewed disposable test environment:
npm run build
npm test -- --runInBand
Historical source pins used these npm entry points. Confirm them against the chosen commit before running; package scripts and dependencies can change. Do not invoke npx to acquire an unpinned lint tool. No unrestricted backend cargo test on an installed-app host. cargo test --no-run is compilation only and must itself use the reviewed bounded compile configuration. Do not execute a backend binary on the host merely to enumerate tests. Cached runtime must verify exact source/compiler/profile/artifact bindings and refuse fallback compilation.
Current complete private wrappers are not portable public recipes: commands above do not supply missing capacity, identity ownership, cleanup or environment controls. Scenario-specific browser/provider/hardware commands require the owning reviewed harness at the frozen source; never invent a generic script name. This draft requires owner confirmation of those exact public command mappings.
One bounded sequence, not per-phase permission loops
Freeze source, exact test-name inventory, dependencies, artifact transitions and all controller/supervisor hashes. Independently review the whole sequence: compile → artifact verification → primary → collateral → owned cleanup. Each phase keeps its own finite resource/time/output bounds and fresh prerequisites. A source/scope/control change needs review; consumed attempts never become fresh authority through repeated messages.
Before launch: fresh capacity and peer exclusion, immutable fixtures, no sensitive mounts, no host home/credentials/wallet/live storage/service bus/container socket/host networking; pinned proposal CI remains disposable and secret-free. Use architecture-compatible inputs. ARM compilation is additional evidence, not x86 installed acceptance; Pi claims need pinned compatible ARM environment and physical hardware.
Record durable child ownership before launch independently of logs; bind workload-origin nonce, invocation and process identity. Missing/replaced ownership means no signal to an unproven service. Bound queries/stops, service-side output, parent and independently managed children. Provide an explicit outer supervisor and surviving cleanup owner. Test collision, missing/truncated receipt, replaced invocation, timeout, controller exit and cleanup failure; fake models do not establish real lifecycle behavior.
Stop on raw failure, drift, wrong inventory, cap exhaustion or uncertain cleanup. Preserve raw and outer verdicts separately, including UNRUN later phases. Remove children before providers; prove exact parent/child/service/process absence and unrelated inventory preservation. Supplemental cleanup does not turn an original failed guard green. After two unsuccessful cycles on one objective, stop expensive retries and require a reproducer/changed approach; continue unrelated authorized work.
Required scenario families
Identity, media, distribution and UX
Native account swap/logout/expiry/cancelled consent must not reuse stale or app-generated identity. Exercise iframe/tab/Companion lifecycle and owner/guest separation. Use publisher, buyer and unrelated late-node roles for signed catalog pagination/revisions/withdrawals, draft/master secrecy, partitions/backfill, stable discussion identity, deduplication, bounded subscriptions and XSS/author mismatch rejection.
Backstage covers both asset sources, save/reopen/reload, cancellation/resume, worker failure/restart, replacement preservation and explicit publication consent. Every remote media route/variant/redirect/master/trailer/subtitle/segment/key must enforce authenticated FIPS and entitlement; denied FIPS fails closed even if alternatives work, restoration must not require repayment. Test real decode/seek/background, expiry and cache boundaries.
Retain original shell/black modal containers, detail-before-pay, player and zap picker. Test nested return/focus, Escape/back, labelled controls, 320/390/768/1440 and landscape, keyboard/touch, reduced motion and disabled explanations. Physical touch/gesture/background evidence cannot be replaced by screenshots.
Payments, rentals, chunks and social receipts
Cover enabled native Cashu/Lightning/on-chain and external Lightning/on-chain rails: incompatible recipients/network/mint, unknown vs zero balance, minimums, fee changes, declined consent, exact receipts/producer credit, price/recipient/revision substitution and bounded funds. Unsupported adapters must not appear working. Customer-visible producer unavailability is only “Not offered”; timing/status/header/polling must not leak producer wallet/configuration/balance/health. Separate customer errors from authorized producer diagnostics.
Crash before/after side effects, lost reply, uncertain settlement, concurrent tabs/clicks, stale quote, exposed invoice/address, cancellation, outage, late confirmation and restart must retain one intent and at most intended spend. No entitlement/tip credit before authoritative settlement; no alternative spend while unresolved. Use isolated regtest for chain signing/leases/broadcast/confirmations/reorg/fee-bump faults, never real funds for destructive tests.
Rental checks distinguish payment from first play, concurrent first start, watch-later, original resume window, seek/range/cache/key expiry and explicit renewal. Metered checks include zero/off, integer/upper limits, insufficient next chunk, exact budget boundary, atomic reserved+spent, overlap policy, rate reapproval, paid-chunk retry/seek reuse, pause/background, unresolved locks, ceiling changes and restart/no double debit. Never precharge the whole ceiling. Zaps require original UI, rail-correct approval/receipts, no rental entitlement and exactly-once confirmed social totals.
Networking Profits must separate revenue buckets/pending/confirmed/session subsets; test timezone/range/pagination, idempotency/reorg/restart, unknown vs zero, payer-budget secrecy and gross vs net.
Platform, apps and preservation
Use every B–E row and all eight app rows in the matrix. Real Cloud providers must work without File Browser, respect account permissions and revoked downloads. Test uploads/cancel/resume/exact bytes/viewer menus, connection ordering, peer/Fleet auth and mixed versions, nullable/offline metrics, trusted origins, actual AI error/unfunded states without unapproved spend, actual radio interoperability, effective firewall/tunnel/IPv4+IPv6/TLS/reboot, and authorized routes.
Managed lifecycle covers install/start/stop/restart/upgrade/interruption/preserve/uninstall/reinstall, tombstones/unmanaged stores and nonempty ownership/migration. Terminal requires actual packaged PTY/tools/auth/workspace sandbox/reboot, not only explicit-workspace fixtures. App-specific network, signing, miner/business/media workflows and physical boundaries remain mandatory.
Nonempty monetary migration includes unresolved purchases/chunks/tips/proofs/change/outbox plus drafts/assets/comments/identities, stopped/uninstalled apps and unrelated stores. Inject disk-full, permissions, drain failure, interrupted migration, health failure, rollback and restart only in approved disposable environments. Never restore stale monetary databases while external settlement may have advanced.
Installed and operator procedure
Verify authorized node/ownership privately; freeze components/review dispositions/hashes and compatible schema. Inventory pending operations and preserve consistent backups; rehearse restore/rollback on nonempty disposable equivalents. Specify exact managed commands/restarts/health/timeouts and notify the operator. Obtain separate authority for new spend, public events, hardware/RF/reboot, peer-node changes, destructive migration and release signing/publication.
Drain safely, apply the exact candidate through lifecycle ownership, then verify installed and served bytes, readiness/migration, identity, preservation and unrelated service health. No running-container edits as final fixes. Perform applicable money-free functional smoke and give exact visible click-path/expected outcome/known limits. Healthy containers are not functional UAT.
For approved multi-node testing: freeze each node independently, isolate identities, read-only discovery first, private fixture publication/discussion only if separately approved, FIPS fail-closed/restoration, peer restart/partition and original-operation recovery. Two nodes do not replace unrelated late-third-node catalog acceptance. Real funded steps require explicit caps; unauthorized steps remain NOT_RUN.
Stop rollout on auth/FIPS bypass, wrong artifact, unexpected money, identity/data loss, uncertain migration/drain or unrelated health failure. Preserve current journals, reconcile external effects, and distinguish code rollback from data restore. Never reset/reinstall/prune or replay payment as troubleshooting. Every defect needs a reproducible case, owner, fix pin, focused/regression reruns and a newly bound artifact.
Evidence and final sign-off
Per run retain requirement/task IDs, exact source/review/tool/architecture, command and raw exit, names/counts/skips, fixture/artifact hashes, timestamps, real vs simulated dependencies, failure/rerun history, outer/isolation/cleanup verdict and missing gates. Public receipts are curated; operational and financial data remain private. Measure p50/p95, memory/descriptors/queues and duplicate sessions through soak/expiry/recovery under declared codec/bitrate/link/concurrency. Agree performance budgets before tuning; do not silently relax them.
No final pass with mandatory ignored/skipped/blocked cases. Sign-off applies only to tested artifacts; independent product approval, execution admission and release authority are distinct.