34 lines
5.3 KiB
Markdown
34 lines
5.3 KiB
Markdown
# Browser verification and coverage reconciliation — 2026-10-01
|
|
|
|
## Current evidence
|
|
|
|
- Exclusive browser owner: Codex browser subagent. Browser tool: `mcp__cua_repl`, Codex in-app browser; available Edge extension was not used.
|
|
- Public production showcase was opened through an actual browser. Clicking **Track Pace** removed four cards, leaving **Bay Area Dawn Patrol**. This verifies public sample filtering only; it does not establish persisted group rides or authenticated workflows.
|
|
- The in-app browser unexpectedly inherited a personal production Firebase session after page hydration. No production account, ride, membership, entitlement, or admin mutations were performed. Authenticated production exploration stopped; isolated localhost testing uses a separately named Firebase app.
|
|
- Live read-only HTTPS `/api/version` returned `9bc16329ef539371e62cea175c89df8de6accd8f`, short `9bc16329ef53`. Verified using Node HTTPS fetch after Windows Schannel clients failed and browser API navigation was blocked by client. Certificate checking was not disabled.
|
|
- `git log -1 --format='%H %s' -- website` returned `71cd994b2f177417e1d67d62a95125b496d35f32`. This is the latest commit touching website files, not the deployed revision and not a claim that the repository HEAD equals that commit.
|
|
|
|
## Prior report arithmetic and classification corrections
|
|
|
|
The old section 4 matrix has **44 distinct IDs**, not 41. Its recorded labels comprise **32 runtime-emulator rows**, **5 runtime-browser rows**, **3 automated-web rows**, and **4 hardware rows**. These are counts of claims, not independently verified current passes.
|
|
|
|
The summary's emulator ranges total **30**, not 24: DASH 5 + PERF 2 + MAP 3 + GAR 5 + SOC 5 + AUTH 2 + SET 3 + ACT 5. The matrix additionally contains SOC-06 and SOC-07, bringing its emulator rows to 32. GRP-01, CLB-01, and CLB-02 occur in the summary but have no matrix rows. They cannot be added silently to the matrix total.
|
|
|
|
OPS-02, OPS-03, and OPS-04 cite automated test files, so their evidence supports automated checks rather than actual browser execution. WEB-03 and WEB-04 describe guest barriers, not authenticated Group Ride Hub, club, rider-account, or replay success. OPS-01 establishes only a guest barrier. SOC-02 and SOC-03 verify navigation retention, not process-restart persistence or cross-account backend visibility. ACT-04 establishes an existing GPX artifact and CSV paywall; it does not establish an executed entitled CSV export. The start/stop evidence does not execute pause/resume/cancel domain paths. The ANR contradiction requires separate diagnostics and is not resolved by the prior PASS label.
|
|
|
|
## Isolated client wiring
|
|
|
|
An explicit `NEXT_PUBLIC_FIREBASE_EMULATORS=true` opt-in requires `NEXT_PUBLIC_FIREBASE_QA_PROJECT_ID` starting with `demo-` and a loopback website origin. It creates the separately named `motorsignal-local-qa` app and connects Auth to 127.0.0.1:9099 and Firestore to 127.0.0.1:8088. Defaults retain the production Firebase configuration. The server must separately use matching `FIREBASE_PROJECT_ID`, `FIREBASE_AUTH_EMULATOR_HOST`, and `FIRESTORE_EMULATOR_HOST`. No production configuration was changed.
|
|
|
|
Focused regression checks: `website/tests/firebase-client-emulator.test.ts`, **4 passed**, covering unchanged defaults, rejecting a production project, both loopback connections, and module reload reuse. Vitest emitted its existing future config-loader warning.
|
|
|
|
## Isolated browser runtime — root QA session
|
|
|
|
- Exclusive owner: root; Playwright CLI session `motorsignal-qa`; local website at `http://localhost:3100`; isolated Firebase project `demo-motorsignal-qa` only. Screenshots: [Group Rides public showcase](browser-local-group-showcase.png) and [signed-out login after sign-out](browser-local-signout.png).
|
|
- Google provider popup created `qa-web-rider@motorsignal.example` in the Auth emulator. Firebase `accounts:signInWithIdp` and lookup returned 200, and `/account` rendered “Welcome back” with the email. This proves isolated Firebase client sign-in only. UI copy showed “Pro Telemetry Tier,” but no verified purchase or entitlement existed; do not treat that label as Pro evidence.
|
|
- Website server exchange `POST /api/auth/firebase-login` returned 401; email login `POST /api/auth/login` returned 401 three times; `/api/account/sessions` returned 401. These exact local route failures prevent authenticated server-backed workflows. The new Auth account had no MotorSignal role fixture. We do not classify valid Firebase credentials as invalid.
|
|
- Authenticated Group Ride Hub opened at `/group-rides`; it showed “0 Squads,” “My Pack Runs (0),” “Explore Community Rides (0),” and an empty-view prompt. It did not show SDK-seeded rides, so authenticated discovery, create/join, approvals, role management, visibility and persistence remain blocked. Public `/group-rides/showcase` was separately opened and labeled public showcase.
|
|
- Sign out returned the browser to `/login` and issued local `POST /api/auth/logout` 204. Browser closed before emulator cleanup. Dev server and loopback emulators stopped; Auth and Firestore cleanup endpoints both returned 200 (`auth.cleanup-results.json`).
|
|
- Local account/hub console showed two errors and one warning; server logs identify the 401 routes above. Public showcase had zero errors and one warning. No production account interaction or write occurred during isolated browser testing.
|
|
|