Omar Sobh
298eb8e20e
e2e: move backend/dex/frontend from 8080 to 18080 so runners don't collide
...
ci / gates (push) Successful in 6s
ci / frontend (push) Successful in 23s
ci / rust (push) Successful in 3m43s
ci / e2e (push) Failing after 14s
ci / publish (push) Successful in 36s
Two of the fleet's Gitea Actions runners (morpheus, architect) already
had 8080 permanently bound by unrelated services (nginx on morpheus,
envio-hasura on architect) — every e2e run scheduled there died at
playwright's webServer preflight with "http://127.0.0.1:8080/healthz is
already used". 18080 is unused across morpheus/tank/architect.
Swap 8080 → 18080 in the eight e2e-scoped sites: clawmates.e2e.toml
(listen_addr + slack base_url + oauth redirect_base), dex.yaml (client
redirect URIs must match backend), playwright.config.ts + tests
(p4-slack, p6-oauth), the http.ts dev-fallback origin, and the two
shell scripts (e2e-backend safety check, rehearse-install healthz probe).
Prod compose (/opt/clawmates/docker-compose.yml on gw-04) is untouched;
prod continues to expose the server on 8080 internally on the compose
network (that's per-network, not host-shared).
2026-07-05 20:25:27 -07:00
Omar Sobh and Claude Fable 5
de38449b41
P2 BLOCKING exit green: approval interception chain end-to-end
...
- tc-tools: Effect declarations -> §15 GatedCategory mapping, deny-by-default
external reach, taint invariant property-tested (tainted external effects
are NEVER auto-allowed)
- tc-safety: pending approvals with exact payload+preview, CAS decide with
audit + single-use grant in one tx, checkpoint suspend/load, exclusive
resume claim, expiry sweep, decided-unresumed work queue (migration 0004
adds the outbox the gated email.send tool writes)
- tc-runtime: resumable LoopState checkpointed to agent_runs; gated tool ->
approval row -> approval_required/run_suspended events -> suspend; resume
consumes the grant BEFORE executing (spent grant = no execution), rejection
feeds a structured refusal in-band; durable resume sweeper; continuous
journal seq across suspension (tested). ContentPart::Text became a struct
variant — internally-tagged newtype primitives don't serialize
- tc-api: GET/decide approvals endpoints (409 double-decide, tenant
isolation), decision triggers in-process resume; full chain proven over
HTTP incl. gateway resumeFrom continuation
- frontend: approval_required/run_suspended events, suspended reply state,
inline ApprovalCard (§10: summary, category, exact payload preview,
approve/reject -> decide + stream re-attach), /approvals queue page, nav
- E2E (14 journeys, workers:1 to serialize the shared backend): gated email
blocks with disabled composer -> approve -> continuation + ✓ step + reload
replay; reject -> ✗ step, nothing executed; queue page decides pending
106 Rust + 61 frontend tests + 14 Playwright journeys green.
Co-Authored-By: Claude Fable 5 <[email protected]
2026-06-10 04:58:47 -05:00
Omar Sobh and Claude Fable 5
fc173f170d
P0 exit: e2e harness, Playwright shell journeys green, deploy skeleton
...
- teamclaw-server e2e mode (TEAMCLAW_MODE=e2e): idempotent deterministic
seed through the real registration paths
- Playwright suite (6 journeys) against the real backend + prod Next build:
login redirect, bad-password error, shell/roster/online-dot, team members,
seeded credits, sign-out revocation — P0 exit criterion met
- Dockerfiles: musl-static server -> distroless, Next standalone -> distroless
node (multi-arch via TARGETARCH)
- Air-gapped compose topology with edge/core/sandbox_net/secrets_net
segmentation (engine-validated in CI), config-file + env-overlay pattern
- CI: compose validation + e2e job with trace upload
Co-Authored-By: Claude Fable 5 <[email protected]
2026-06-09 22:48:28 -05:00
Omar Sobh