# T-724 validation evidence Editorial note (2026-10-10): obsolete state terminology is summarized by purpose below; cited IDs, commits and validation results still describe the original investigation, not new executions. Scope: `T-724`, authoritative item `00001M4D5ZN6P:4`, resume instruction thread sequence 7. Baseline: `c79506b60f1abcb3d8698d01491f2b6e644170d0` (clean detached checkout). Source branch: `work/T-724-workspace-drive`. T-717/T-722 are integrated; T-723 Tools/WIP and T-714 implementation are not modified. ## Requirements → observable proof | Requirement | Implementation / proof | | --- | --- | | Shared Workspace asset, no Repository/Git prerequisite | Workspace sidebar Drive; optional-node route; real `/api/workspaces` repositoryless bootstrap, zero repository records/config, folder/Markdown/PNG/empty-file and Worker artifact roundtrip. | | DB hierarchy, stable string node URL | `driveHref`, strict decimal/ref/metadata parsers; root/list/parent-chain APIs only; rename/move/delete/recreate lifecycle in real adapter and production browser. No blob path or second persisted tree. | | Paged folder list, metadata and mutations | Service cursors, bounded pages, breadcrumb, search, creation, native binary download, replace, relocate, empty-folder delete; real and fixture roundtrips. | | CAS and draft retention | Per-Workspace/node draft with observed node state at read time; 2-account real concurrent CAS (one success/one conflict), 2-tab browser drafts, explicit refresh vs discard; component regression proves open rename form does not silently rebase on refresh. | | Identity/content-condition fences | Controller selection/write/page epochs; saved tuple, scoped receipts and separate cancel generation; delayed old read/save/status/workspace browser gates; keyed image decode events and URL revocation component regression. | | Safe Markdown/raster/binary | Existing raw-HTML-rejecting renderer; same-Workspace explicit resource navigation and credential-free external HTTP(S), no automatic inline image requests; real node-content-bound PNG transfer, 256 KiB raster bound, HTML/SVG download-only, failed image/truncated/empty browser states. | | Upload publication / errors / OutcomeUnknown | Raw Blob ≤16 MiB + SHA-256; transfer receipt vs DB-published acknowledgment; cancellation/loss preserve request ID and query current-authorized result, no unconditional reupload; typed name/CAS/limit/denied/storage failures. | | Backend current permission and Worker grants | Existing authoritative Worker catalog; owner setting flag; explicit read_only/read_write, separate Profile enablement, complete paged grants, revoke; real signed read-only Worker denial/revoke and exact Web grant-adapter owner/member HTTP boundaries; component and browser grant interactions. | | Latest only / no added workflow | Explicit replacement/history warning; no versions, approval/publication workflow, public share links or recursive folder delete. | ## Real API/DB/LocalFileSystem evidence (not fixture responses) `crates/workspace-server/src/server/tests/drive_web_roundtrip_tests.rs` creates a fresh temporary SQLite/FeatureStorage/LocalFileSystem Workspace over real loopback HTTP. It starts no live dogfood Server or Runtime; the Runtime Worker-spawn process boundary is fake, while Workspace/Worker registry/grants/nodes/bytes/receipts and request authentication are production authorities. The explicit Deno child imports the **production** content and grant adapters. Fresh credentials arrive via stdin; origin/auth resolution is loopback-bound and responses are never mocked. This proves authenticated HTTP adapters, **not** a Passkey/cookie browser login or complete live Runtime process E2E. - Ordinary real HTTP test: **1 passed / 1 explicitly ignored** process test. - Explicit process test (`--ignored`): **1 passed**, including owner grant read_only/read_write create/list/revoke/re-read and non-owner administration rejection after parent integration. - Full changed Server crate, replayed by the parent before commit: **693 library + 11 binary passed**, 1 explicitly ignored; doc-tests passed (`target/t724-server-final.log`). - Parent real adapter replay: `target/t724-real-adapter-final.log` (**1 passed**). Ordinary HTTP coverage is also part of the full Server crate run. Reproduce using `web/workspace/test/drive-real-api/README.md` or `deno task test:drive:real-api` from `web/workspace`. ## Compile, generated contracts and Web semantic validation - Workspace root `cargo check`: pass (`target/t724-root-check-final.log`). - `cargo test -p server-api --features typescript`: **91 passed**, doc-tests pass. - Canonical OpenAPI `export_openapi -- --check openapi/server-api.json`: current. - Regenerated Drive TypeScript, Deno-formatted to the checked-in style: byte equal to `web/workspace/src/lib/generated/drive-api.ts`; no generated contract edits. - `generate_repository_openapi_types`, `generate_runtime_api_types`, `generate_ticket_api_types`, `generate_companion_api_types`, `generate_worker_launch_api_types` with `--check`: all current. - `cargo fmt --all -- --check`, Deno format/lint of new typed boundaries, and `git diff --check HEAD`: pass. - Web `deno task check`: **0 errors / 0 warnings**. - Web `deno task test`: **566 passed**, including 36 content/controller boundary tests and 2 preview/link-policy tests. - Web `deno task test:component`: **302 passed / 32 files**, including actual Markdown rendering/alt labels, late decode fences, pinned observed form condition, grant administration, and dependent existing Worker/Console/Markdown surfaces. - Separate fixture-client compatibility tests: **4 passed**. These prove mock wire compatibility, not real storage or authorization. Web logs: `.svelte-kit/t724-{web-check-final,unit-final,components-final}.log`, plus narrow `.svelte-kit/t724-{drive-state,ui-fence,markdown-tests}.log`. ## Production browser and visual review Production rebuild and implementer-owned visual acceptance completed on 2026-10-09 before the implementation commit: - `deno task build`: pass (`.svelte-kit/t724/final-build.log`). - Production browser scenarios: **9 passed** (`.svelte-kit/t724/browser-final.log`). - Responsive/keyboard/raster audit: **1 passed**, all 1440/768/390/320 widths in both themes (`.svelte-kit/t724/responsive-final.{log,json}`). - Official after bundles: `.svelte-kit/t724/visual/t724-after-{light,dark}-committed-candidate/`, **108 captures per theme**. The same baseline Home/Workers personas and widths are compared, with additional Drive/grant states. - Parent opened before and after screenshot overview sheets through `ViewImage` (`target/t724-final-visual/{before,after}-{light,dark}-*.png`), plus original 320px grant and 390px denied-write captures. Reviewed grouping, separators, spacing, focus, wrapping, page vs table scroll, and permission/recovery copy. Home/Workers composition is preserved except the intended shared Drive entry, grant section and contained Worker-table scrolling. New states remain distinct and narrow layouts retain accessible controls without document overflow. - Parent inspected official `review-context.json`: HTTP document status 200, accessibility snapshots and screenshot hashes present; diagnostic dispositions retain intentional 403/503 fixtures and superseded metadata aborts. Both `diagnostic-disposition.json` files have **no unexpected diagnostics**. The runner correctly reports `completed-with-errors` for injected failures; visual acceptance is the implementer's review, not that exit/status label. - Visual result: **pass**, no unresolved new visual regression. Artifacts use baseline source commit plus dirty context; production source is frozen by the subsequent commit (only test formatting/documentation changed afterward). A final grant regression also proves catalog readiness toggles cannot abandon an already transmitted mutation. Readiness gates new actions but is not Worker identity. All **22 grant component tests** pass; pending/unknown operations remain fenced until their result is reconciled. Worst-case 64 KiB NUL text additionally proves the separate 512 KiB JSON response bound without relaxing the raster bound. These changes are included in the final Web check/test/build/captures above. The production static Web shell is exercised against synthetic loopback APIs; this is separate from the real authority tests above. The fixture has a single Worker catalog reused by REST/subscription projections, not a second UI registry. See `web/workspace/test/drive-browser/README.md` for reproducible scenarios, gates, owned-process cleanup and the browser/visual commands. Before sources are preserved under `.svelte-kit/t724/before-build/`; baseline JS has no Drive/grant controls. Official before bundles use `.svelte-kit/t724/visual/t724-before-{light,dark}-representative/`. The current implementation was never overwritten to produce the final static before build. Intermediate visual review found and fixed: - Narrow Worker table widening the page grid and clipping grant controls: contain horizontal table scrolling and constrain the page grid; full identities remain available in a disclosure. - Markdown image placeholders losing alternate text: use the renderer library's actual `text` prop; retain no automatic image loading. Component and production browser regressions protect this. - Parent semantic review additionally fixed late image-decode event identity and open rename/replacement observed-condition pinning, with focused component tests. Injected permission/storage/list errors and superseded aborted breadcrumb reads remain in official context with explicit dispositions. A successful capture exit or HTTP200 alone is not visual acceptance. No screenshots, credential state or real response secrets are committed.