Overall status: contract-only for the full public/customer/admin and deployed dual-environment acceptance contract. Executable public synthetic browser tests are now available; these do not establish the remaining capabilities.
This repository is an executable acceptance-suite boundary, not evidence that the corresponding product capability is complete. The suite must target both ores-chat and the isolated ores-chat-test fixture. Promotion to live requires hosted execution, deterministic assertions, and redacted retained evidence.
The machine-readable plan is in suite.json and is validated by the organization policy action pinned to an immutable commit. Public, customer, administrator, and internal-service identities are never interchangeable.
tests/public-support.spec.js exercises desktop and mobile Chromium using a real
Rust web process and its real public HTTP SDK against a synthetic API:
- Replies, continuation, and absence of browser credentials or transcript storage.
- Upstream failures, safe errors, retry, cancellation, and in-flight draft edits.
- Prompt controls, clear draft, new conversation, and escaped untrusted markup.
- Native forms without JavaScript and public origin/credential rejection.
- Viewport overflow, keyboard navigation, and axe checks with no disabled rules.
All prompts and responses are synthetic. Tests require
http://127.0.0.1:4311/readyz to return 204 and
X-ORES-Chat-Fixture: synthetic-public-v1. The origin is deliberately not an
environment option. Do not use a tunnel or proxy to a real service.
The browser receives the exact locked HTMX npm distribution at its production CDN URL; the suite verifies its SHA-384 and the browser enforces the page's SRI. This isolates application behavior from CDN availability, not proof of CDN uptime.
npm ci --ignore-scripts
zed validate
zed task run check
npx --no-install playwright install --with-deps chromium
# In an authorized private source checkout, start `cargo run --locked --example preview`.
zed task run browserThe public repository CI validates lint, formatting, test discovery, and the suite
manifest. Actual browser execution is performed by the private
ores-chat/ores-chat-web-server.rs workflow, which checks out an immutable commit
of this test suite. This keeps private application source out of the public test
repository and avoids granting a public job access to private repository tokens.
Synthetic failure traces, screenshots, and results stay in that private run under
tmp/. A green discovery check is not a passing browser run.
admin-tests/admin-identity.spec.js and playwright.admin.config.js add a separate
desktop/mobile suite on fixed http://127.0.0.1:4312. It refuses to start without
the synthetic-admin-identity-v1 response marker, live health, and 503 chat
readiness. The admin web example uses the real production router and official
Shared Auth HTTP SDK against a local synthetic identity authority.
The suite checks anonymous/invalid access, stale MFA, authority outages, and the verified-but-restricted console; it must not find enabled execution, raw identity claims, visible cookies, browser transcript storage, or a claimed audit receipt. It also checks direct form rejection, origin isolation, accessibility, keyboard navigation, and viewport overflow without disabling accessibility rules.
Start the private admin web repository's cargo run --locked --example preview,
then run zed task run admin-browser. The private admin-web CI executes these
browsers and retains synthetic evidence. This repository's CI only lints and
discovers both suites. The public-suite config and fixed port remain unchanged.
This is not acceptance of login issuance, real Shared Auth realm deployment,
product authorization, admin API execution, or an audit store.
Customer authentication, secure-session lifecycle, streaming, actual model providers, persisted support records, and deployed main-org/test-org environments still need separate runtime acceptance. Track this slice in issue #1 and the complete platform work in the parity milestone.