yoi/docs/report/t724-validation.md

T-724 validation evidence

Editorial note (2026-10-10): obsolete state terminology is summarized by purpose below; cited IDs, commits and validation results still describe the original investigation, not new executions.

Scope: T-724, authoritative item 00001M4D5ZN6P:4, resume instruction thread sequence 7. Baseline: c79506b60f1abcb3d8698d01491f2b6e644170d0 (clean detached checkout). Source branch: work/T-724-workspace-drive. T-717/T-722 are integrated; T-723 Tools/WIP and T-714 implementation are not modified.

Requirements → observable proof

Requirement	Implementation / proof
Shared Workspace asset, no Repository/Git prerequisite	Workspace sidebar Drive; optional-node route; real /api/workspaces repositoryless bootstrap, zero repository records/config, folder/Markdown/PNG/empty-file and Worker artifact roundtrip.
DB hierarchy, stable string node URL	driveHref, strict decimal/ref/metadata parsers; root/list/parent-chain APIs only; rename/move/delete/recreate lifecycle in real adapter and production browser. No blob path or second persisted tree.
Paged folder list, metadata and mutations	Service cursors, bounded pages, breadcrumb, search, creation, native binary download, replace, relocate, empty-folder delete; real and fixture roundtrips.
CAS and draft retention	Per-Workspace/node draft with observed node state at read time; 2-account real concurrent CAS (one success/one conflict), 2-tab browser drafts, explicit refresh vs discard; component regression proves open rename form does not silently rebase on refresh.
Identity/content-condition fences	Controller selection/write/page epochs; saved tuple, scoped receipts and separate cancel generation; delayed old read/save/status/workspace browser gates; keyed image decode events and URL revocation component regression.
Safe Markdown/raster/binary	Existing raw-HTML-rejecting renderer; same-Workspace explicit resource navigation and credential-free external HTTP(S), no automatic inline image requests; real node-content-bound PNG transfer, 256 KiB raster bound, HTML/SVG download-only, failed image/truncated/empty browser states.
Upload publication / errors / OutcomeUnknown	Raw Blob ≤16 MiB + SHA-256; transfer receipt vs DB-published acknowledgment; cancellation/loss preserve request ID and query current-authorized result, no unconditional reupload; typed name/CAS/limit/denied/storage failures.
Backend current permission and Worker grants	Existing authoritative Worker catalog; owner setting flag; explicit read_only/read_write, separate Profile enablement, complete paged grants, revoke; real signed read-only Worker denial/revoke and exact Web grant-adapter owner/member HTTP boundaries; component and browser grant interactions.
Latest only / no added workflow	Explicit replacement/history warning; no versions, approval/publication workflow, public share links or recursive folder delete.

Real API/DB/LocalFileSystem evidence (not fixture responses)

crates/workspace-server/src/server/tests/drive_web_roundtrip_tests.rs creates a fresh temporary SQLite/FeatureStorage/LocalFileSystem Workspace over real loopback HTTP. It starts no live dogfood Server or Runtime; the Runtime Worker-spawn process boundary is fake, while Workspace/Worker registry/grants/nodes/bytes/receipts and request authentication are production authorities.

The explicit Deno child imports the production content and grant adapters. Fresh credentials arrive via stdin; origin/auth resolution is loopback-bound and responses are never mocked. This proves authenticated HTTP adapters, not a Passkey/cookie browser login or complete live Runtime process E2E.

• Ordinary real HTTP test: 1 passed / 1 explicitly ignored process test.
• Explicit process test (--ignored): 1 passed, including owner grant read_only/read_write create/list/revoke/re-read and non-owner administration rejection after parent integration.
• Full changed Server crate, replayed by the parent before commit: 693 library + 11 binary passed, 1 explicitly ignored; doc-tests passed (target/t724-server-final.log).
• Parent real adapter replay: target/t724-real-adapter-final.log (1 passed). Ordinary HTTP coverage is also part of the full Server crate run.

Reproduce using web/workspace/test/drive-real-api/README.md or deno task test:drive:real-api from web/workspace.

Compile, generated contracts and Web semantic validation

• Workspace root cargo check: pass (target/t724-root-check-final.log).
• cargo test -p server-api --features typescript: 91 passed, doc-tests pass.
• Canonical OpenAPI export_openapi -- --check openapi/server-api.json: current.
• Regenerated Drive TypeScript, Deno-formatted to the checked-in style: byte equal to web/workspace/src/lib/generated/drive-api.ts; no generated contract edits.
• generate_repository_openapi_types, generate_runtime_api_types, generate_ticket_api_types, generate_companion_api_types, generate_worker_launch_api_types with --check: all current.
• cargo fmt --all -- --check, Deno format/lint of new typed boundaries, and git diff --check HEAD: pass.
• Web deno task check: 0 errors / 0 warnings.
• Web deno task test: 566 passed, including 36 content/controller boundary tests and 2 preview/link-policy tests.
• Web deno task test:component: 302 passed / 32 files, including actual Markdown rendering/alt labels, late decode fences, pinned observed form condition, grant administration, and dependent existing Worker/Console/Markdown surfaces.
• Separate fixture-client compatibility tests: 4 passed. These prove mock wire compatibility, not real storage or authorization.

Web logs: .svelte-kit/t724-{web-check-final,unit-final,components-final}.log, plus narrow .svelte-kit/t724-{drive-state,ui-fence,markdown-tests}.log.

Production browser and visual review

Production rebuild and implementer-owned visual acceptance completed on 2026-10-09 before the implementation commit:

• deno task build: pass (.svelte-kit/t724/final-build.log).
• Production browser scenarios: 9 passed (.svelte-kit/t724/browser-final.log).
• Responsive/keyboard/raster audit: 1 passed, all 1440/768/390/320 widths in both themes (.svelte-kit/t724/responsive-final.{log,json}).
• Official after bundles: .svelte-kit/t724/visual/t724-after-{light,dark}-committed-candidate/, 108 captures per theme. The same baseline Home/Workers personas and widths are compared, with additional Drive/grant states.
• Parent opened before and after screenshot overview sheets through ViewImage (target/t724-final-visual/{before,after}-{light,dark}-*.png), plus original 320px grant and 390px denied-write captures. Reviewed grouping, separators, spacing, focus, wrapping, page vs table scroll, and permission/recovery copy. Home/Workers composition is preserved except the intended shared Drive entry, grant section and contained Worker-table scrolling. New states remain distinct and narrow layouts retain accessible controls without document overflow.
• Parent inspected official review-context.json: HTTP document status 200, accessibility snapshots and screenshot hashes present; diagnostic dispositions retain intentional 403/503 fixtures and superseded metadata aborts. Both diagnostic-disposition.json files have no unexpected diagnostics. The runner correctly reports completed-with-errors for injected failures; visual acceptance is the implementer's review, not that exit/status label.
• Visual result: pass, no unresolved new visual regression. Artifacts use baseline source commit plus dirty context; production source is frozen by the subsequent commit (only test formatting/documentation changed afterward).

A final grant regression also proves catalog readiness toggles cannot abandon an already transmitted mutation. Readiness gates new actions but is not Worker identity. All 22 grant component tests pass; pending/unknown operations remain fenced until their result is reconciled. Worst-case 64 KiB NUL text additionally proves the separate 512 KiB JSON response bound without relaxing the raster bound. These changes are included in the final Web check/test/build/captures above.

The production static Web shell is exercised against synthetic loopback APIs; this is separate from the real authority tests above. The fixture has a single Worker catalog reused by REST/subscription projections, not a second UI registry. See web/workspace/test/drive-browser/README.md for reproducible scenarios, gates, owned-process cleanup and the browser/visual commands.

Before sources are preserved under .svelte-kit/t724/before-build/; baseline JS has no Drive/grant controls. Official before bundles use .svelte-kit/t724/visual/t724-before-{light,dark}-representative/. The current implementation was never overwritten to produce the final static before build.

Intermediate visual review found and fixed:

• Narrow Worker table widening the page grid and clipping grant controls: contain horizontal table scrolling and constrain the page grid; full identities remain available in a disclosure.
• Markdown image placeholders losing alternate text: use the renderer library's actual text prop; retain no automatic image loading. Component and production browser regressions protect this.
• Parent semantic review additionally fixed late image-decode event identity and open rename/replacement observed-condition pinning, with focused component tests.

Injected permission/storage/list errors and superseded aborted breadcrumb reads remain in official context with explicit dispositions. A successful capture exit or HTTP200 alone is not visual acceptance. No screenshots, credential state or real response secrets are committed.