repo-backed operator control plane, not a hosted product
+shipped MCP surface remains read-only
+news_digest topic_brief page_brief
+ """, + encoding="utf-8", + ) + (root / "docs" / "use-cases" / "index.html").write_text( + """ +news_digest is the only official release-proven public baseline.
+topic_brief and page_brief are not yet equally release-proven.
+What we still do not claim
+ Open proof summary + Open benchmark summary + Open recap asset + Open proof-pack manifest + Open proof-pack index + Open demo-status ledger + """, + encoding="utf-8", + ) + (root / "docs" / "compatibility" / "index.html").write_text( + """ +read-only MCP
+ See the first proven workflow + """, + encoding="utf-8", + ) + (root / "docs" / "releases" / "assets" / "news-digest-healthy-proof-2026-03-27.md").write_text("ok\n", encoding="utf-8") + (root / "docs" / "releases" / "assets" / "news-digest-benchmark-summary-2026-03-27.md").write_text("ok\n", encoding="utf-8") + (root / "docs" / "releases" / "assets" / "news-digest-workflow-case-recap-2026-03-27.md").write_text("ok\n", encoding="utf-8") + (root / "docs" / "releases" / "assets" / "news-digest-proof-pack-2026-03-27.json").write_text("{}\n", encoding="utf-8") + (root / "docs" / "assets" / "storefront" / "demo-status.md").write_text("ok\n", encoding="utf-8") + (root / "docs" / "assets" / "storefront" / "proof-pack-index.json").write_text("{}\n", encoding="utf-8") + + +def test_frontdoor_contract_gate_passes_with_required_surfaces(tmp_path: Path, monkeypatch) -> None: + module = _load_gate_module() + _write_frontdoor_fixture(tmp_path) + module.ROOT = tmp_path + module.INDEX_PATH = tmp_path / "docs" / "index.html" + module.USE_CASES_PATH = tmp_path / "docs" / "use-cases" / "index.html" + module.COMPATIBILITY_PATH = tmp_path / "docs" / "compatibility" / "index.html" + module.PROOF_SUMMARY_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-healthy-proof-2026-03-27.md" + module.BENCHMARK_SUMMARY_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-benchmark-summary-2026-03-27.md" + module.WORKFLOW_RECAP_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-workflow-case-recap-2026-03-27.md" + module.PROOF_PACK_MANIFEST_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-proof-pack-2026-03-27.json" + module.DEMO_STATUS_PATH = tmp_path / "docs" / "assets" / "storefront" / "demo-status.md" + module.PROOF_PACK_INDEX_PATH = tmp_path / "docs" / "assets" / "storefront" / "proof-pack-index.json" + monkeypatch.setattr(sys, "argv", ["check_frontdoor_contract.py"]) + assert module.main() == 0 + + +def test_frontdoor_contract_gate_fails_when_proof_link_drifts( + tmp_path: Path, capsys, monkeypatch +) -> None: + module = _load_gate_module() + _write_frontdoor_fixture(tmp_path) + use_cases = tmp_path / "docs" / "use-cases" / "index.html" + use_cases.write_text( + use_cases.read_text(encoding="utf-8").replace( + "Open benchmark summary", "Open benchmark bundle" + ), + encoding="utf-8", + ) + module.ROOT = tmp_path + module.INDEX_PATH = tmp_path / "docs" / "index.html" + module.USE_CASES_PATH = use_cases + module.COMPATIBILITY_PATH = tmp_path / "docs" / "compatibility" / "index.html" + module.PROOF_SUMMARY_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-healthy-proof-2026-03-27.md" + module.BENCHMARK_SUMMARY_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-benchmark-summary-2026-03-27.md" + module.WORKFLOW_RECAP_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-workflow-case-recap-2026-03-27.md" + module.PROOF_PACK_MANIFEST_PATH = tmp_path / "docs" / "releases" / "assets" / "news-digest-proof-pack-2026-03-27.json" + module.DEMO_STATUS_PATH = tmp_path / "docs" / "assets" / "storefront" / "demo-status.md" + module.PROOF_PACK_INDEX_PATH = tmp_path / "docs" / "assets" / "storefront" / "proof-pack-index.json" + monkeypatch.setattr(sys, "argv", ["check_frontdoor_contract.py"]) + + rc = module.main() + out = capsys.readouterr().out + assert rc == 1 + assert "Open benchmark summary" in out diff --git a/apps/orchestrator/tests/test_generate_storefront_proof_pack_index.py b/apps/orchestrator/tests/test_generate_storefront_proof_pack_index.py new file mode 100644 index 0000000..a792781 --- /dev/null +++ b/apps/orchestrator/tests/test_generate_storefront_proof_pack_index.py @@ -0,0 +1,84 @@ +from __future__ import annotations + +import importlib.util +import json +from pathlib import Path + + +def _load_generator_module() -> object: + script_path = Path(__file__).resolve().parents[3] / "scripts" / "generate_storefront_proof_pack_index.py" + spec = importlib.util.spec_from_file_location("cortexpilot_generate_storefront_proof_pack_index", script_path) + module = importlib.util.module_from_spec(spec) + assert spec and spec.loader + spec.loader.exec_module(module) + return module + + +def test_generate_storefront_proof_pack_index_builds_assets_from_pack_manifest(tmp_path: Path) -> None: + module = _load_generator_module() + root = tmp_path + (root / "configs").mkdir(parents=True, exist_ok=True) + (root / "docs" / "releases" / "assets").mkdir(parents=True, exist_ok=True) + + registry = { + "schema_version": 1, + "artifact_type": "cortexpilot_storefront_proof_bundle_registry", + "vocabulary_contract": { + "proven_workflow_label": "first proven workflow", + "proof_pack_label": "public proof pack", + "showcase_label": "showcase expansion", + }, + "bundles": [ + { + "bundle_id": "news_digest", + "task_template": "news_digest", + "proof_state": "release_proven", + "claim_scope": "official_first_public_baseline", + "authority_level": "repo_side_public_proof", + "public_entrypoint": "docs/use-cases/index.html", + "pack_manifest": "docs/releases/assets/news-digest-proof-pack-2026-03-27.json", + "safe_public_claims": ["claim"], + "forbidden_claims": ["forbidden"], + "capture_contract": { + "healthy_live_capture_gif_present": False, + "healthy_english_first_public_capture_set_present": False, + "current_tracked_dashboard_captures": "local_degraded_non_english_mixed", + }, + "missing_expected_artifacts": ["healthy_live_capture_gif"], + } + ], + } + pack_manifest = { + "artifact_type": "news_digest_public_proof_pack", + "primary_assets": { + "proof_summary_markdown": "docs/releases/assets/news-digest-healthy-proof-2026-03-27.md", + "proof_summary_json": "docs/releases/assets/news-digest-healthy-proof-summary-2026-03-27.json", + "benchmark_summary_markdown": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md", + "benchmark_summary_json": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.json", + "workflow_case_recap_markdown": "docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md", + "demo_status_markdown": "docs/assets/storefront/demo-status.md", + }, + "supporting_assets": { + "gemini_proof_screenshot": "docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png", + }, + } + registry_path = root / "configs" / "storefront_proof_bundle_registry.json" + registry_path.write_text(json.dumps(registry, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + manifest_path = root / "docs" / "releases" / "assets" / "news-digest-proof-pack-2026-03-27.json" + manifest_path.write_text(json.dumps(pack_manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + + module.ROOT = root + module.REGISTRY_PATH = registry_path + module.OUTPUT_PATH = root / "docs" / "assets" / "storefront" / "proof-pack-index.json" + + registry_payload = module._load_json(registry_path) + registry_payload["source_registry"] = "configs/storefront_proof_bundle_registry.json" + rendered = module.build_index(registry_payload) + + assert rendered["artifact_type"] == "cortexpilot_public_proof_pack_index" + assert rendered["source_registry"] == "configs/storefront_proof_bundle_registry.json" + news = rendered["bundles"][0] + roles = {item["role"] for item in news["assets"]} + assert "healthy_proof_summary" in roles + assert "benchmark_summary_machine" in roles + assert "gemini_proof_screenshot" in roles diff --git a/apps/orchestrator/tests/test_github_control_plane.py b/apps/orchestrator/tests/test_github_control_plane.py new file mode 100644 index 0000000..3a0cd2c --- /dev/null +++ b/apps/orchestrator/tests/test_github_control_plane.py @@ -0,0 +1,112 @@ +from __future__ import annotations + +import importlib.util +import json +import sys +from pathlib import Path + + +def _load_module() -> object: + script_path = Path(__file__).resolve().parents[3] / "scripts" / "check_github_control_plane.py" + spec = importlib.util.spec_from_file_location("cortexpilot_check_github_control_plane", script_path) + module = importlib.util.module_from_spec(spec) + assert spec and spec.loader + spec.loader.exec_module(module) + return module + + +def _policy_payload() -> dict: + return { + "owner": "example", + "repo": "repo", + "default_branch": "main", + "required_actions_permissions": { + "enabled": True, + "allowed_actions": "all", + "sha_pinning_required": True, + }, + "required_environments": ["owner-approved-sensitive"], + "required_checks": ["Quick Feedback"], + "branch_protection_required": True, + "platform_evidence": { + "private_vulnerability_reporting": {"required": True, "mode": "api"}, + "vulnerability_alerts": {"required": True, "mode": "api"}, + "secret_scanning": {"required": True, "mode": "api"}, + "secret_scanning_push_protection": {"required": True, "mode": "api"}, + "secret_scanning_non_provider_patterns": {"required": True, "mode": "api"}, + "secret_scanning_validity_checks": {"required": True, "mode": "api"}, + "dependabot_config": {"required": True, "mode": "repo_file", "path": ".github/dependabot.yml"}, + "codeql_workflow": {"required": True, "mode": "repo_file", "path": ".github/workflows/codeql.yml"}, + "codeql_config": {"required": True, "mode": "repo_file", "path": ".github/codeql/codeql-config.yml"}, + }, + } + + +def _fake_gh_json(secret_non_provider: str, validity_checks: str): + def _impl(path: str) -> tuple[int, dict]: + if path == "repos/example/repo": + return ( + 0, + { + "default_branch": "main", + "security_and_analysis": { + "secret_scanning": {"status": "enabled"}, + "secret_scanning_push_protection": {"status": "enabled"}, + "secret_scanning_non_provider_patterns": {"status": secret_non_provider}, + "secret_scanning_validity_checks": {"status": validity_checks}, + }, + }, + ) + if path == "repos/example/repo/actions/permissions": + return 0, {"enabled": True, "allowed_actions": "all", "sha_pinning_required": True} + if path == "repos/example/repo/branches/main/protection": + return 0, {"required_status_checks": {"contexts": ["Quick Feedback"]}} + if path == "repos/example/repo/environments": + return 0, {"environments": [{"name": "owner-approved-sensitive"}]} + if path == "repos/example/repo/private-vulnerability-reporting": + return 0, {"enabled": True} + if path == "repos/example/repo/vulnerability-alerts": + return 0, {} + if path == "repos/example/repo/code-scanning/default-setup": + return 0, {} + if path == "repos/example/repo/dependabot/alerts?per_page=1": + return 0, [] + raise AssertionError(path) + + return _impl + + +def test_github_control_plane_requires_secret_scanning_subfeatures(tmp_path: Path, monkeypatch) -> None: + module = _load_module() + policy_path = tmp_path / "policy.json" + output_path = tmp_path / "report.json" + policy_path.write_text(json.dumps(_policy_payload(), ensure_ascii=False, indent=2), encoding="utf-8") + + monkeypatch.setattr(module, "ROOT", tmp_path) + monkeypatch.setattr(module, "_gh_json", _fake_gh_json("disabled", "disabled")) + monkeypatch.setattr(module, "_repo_path_exists", lambda _path: True) + monkeypatch.setattr(sys, "argv", ["check_github_control_plane.py", "--policy", str(policy_path), "--output", str(output_path)]) + + rc = module.main() + report = json.loads(output_path.read_text(encoding="utf-8")) + assert rc == 1 + assert any("secret_scanning_non_provider_patterns drift" in item for item in report["errors"]) + assert any("secret_scanning_validity_checks drift" in item for item in report["errors"]) + + +def test_github_control_plane_accepts_enabled_secret_scanning_subfeatures(tmp_path: Path, monkeypatch) -> None: + module = _load_module() + policy_path = tmp_path / "policy.json" + output_path = tmp_path / "report.json" + policy_path.write_text(json.dumps(_policy_payload(), ensure_ascii=False, indent=2), encoding="utf-8") + + monkeypatch.setattr(module, "ROOT", tmp_path) + monkeypatch.setattr(module, "_gh_json", _fake_gh_json("enabled", "enabled")) + monkeypatch.setattr(module, "_repo_path_exists", lambda _path: True) + monkeypatch.setattr(sys, "argv", ["check_github_control_plane.py", "--policy", str(policy_path), "--output", str(output_path)]) + + rc = module.main() + report = json.loads(output_path.read_text(encoding="utf-8")) + assert rc == 0 + assert report["errors"] == [] + assert report["security_and_analysis"]["secret_scanning_non_provider_patterns"]["status"] == "enabled" diff --git a/apps/orchestrator/tests/test_intake_branch_matrix_extra.py b/apps/orchestrator/tests/test_intake_branch_matrix_extra.py index fb6c1e0..8e52e3c 100644 --- a/apps/orchestrator/tests/test_intake_branch_matrix_extra.py +++ b/apps/orchestrator/tests/test_intake_branch_matrix_extra.py @@ -205,7 +205,7 @@ def test_intake_service_build_contract_artifacts_non_list(tmp_path: Path, monkey contract = service.build_contract(intake_id) assert isinstance(contract, dict) - assert contract.get("handoff_chain", {}).get("enabled") is True + assert "handoff_chain" not in contract artifacts = contract.get("inputs", {}).get("artifacts", []) assert isinstance(artifacts, list) assert any(item.get("name") == "search_requests.json" for item in artifacts) diff --git a/apps/orchestrator/tests/test_intake_helpers_coverage.py b/apps/orchestrator/tests/test_intake_helpers_coverage.py index 160f9d7..75b6fc7 100644 --- a/apps/orchestrator/tests/test_intake_helpers_coverage.py +++ b/apps/orchestrator/tests/test_intake_helpers_coverage.py @@ -426,13 +426,13 @@ def test_intake_service_answer_and_build_contract(monkeypatch, tmp_path: Path) - assert any(item.get("name") == "search_requests.json" for item in artifacts) assert contract["tool_permissions"]["mcp_tools"] == ["codex", "search"] - # PM owner should force handoff chain in compiled contract. + # Search-style compiled contracts should stay direct instead of carrying a PM handoff chain. response_path = service._store._intake_dir(intake_id) / "response.json" response = json.loads(response_path.read_text(encoding="utf-8")) response["plan"]["owner_agent"] = {"role": "PM", "agent_id": "agent-1"} response_path.write_text(json.dumps(response, ensure_ascii=False, indent=2), encoding="utf-8") contract_pm = service.build_contract(intake_id) - assert contract_pm.get("handoff_chain", {}).get("enabled") is True + assert "handoff_chain" not in contract_pm def test_intake_service_auto_run_chain_restores_runner_env(monkeypatch, tmp_path: Path) -> None: diff --git a/apps/orchestrator/tests/test_news_digest_template.py b/apps/orchestrator/tests/test_news_digest_template.py index c0776a0..b236c34 100644 --- a/apps/orchestrator/tests/test_news_digest_template.py +++ b/apps/orchestrator/tests/test_news_digest_template.py @@ -59,6 +59,7 @@ def test_news_digest_intake_builds_contract_artifact(monkeypatch, tmp_path: Path assert contract["template_payload"]["sources"] == ["theverge.com", "techcrunch.com"] assert contract["owner_agent"]["role"] == "TECH_LEAD" assert contract["assigned_agent"]["role"] == "SEARCHER" + assert "handoff_chain" not in contract assert contract["tool_permissions"]["network"] == "allow" assert "search" in contract["tool_permissions"]["mcp_tools"] assert "search" in contract["mcp_tool_set"] @@ -95,6 +96,8 @@ def test_news_digest_result_builder_and_search_payload() -> None: assert digest["status"] == "SUCCESS" assert digest["topic"] == "Seattle AI" assert len(digest["sources"]) == 2 + assert digest["summary"].startswith("Collected 2 public-source result(s)") + assert "Title A, Title B." in digest["summary"] payload = search_payload_helpers.build_search_payload( "run-news", @@ -331,4 +334,5 @@ def run_search(self, query: str, provider: str | None = None, browser_policy=Non assert digest_path.exists() digest_payload = json.loads(digest_path.read_text(encoding="utf-8")) assert digest_payload["status"] == "FAILED" + assert digest_payload["summary"].startswith("The news digest for 'Seattle AI' did not complete successfully.") assert "来源链路失败" in digest_payload["failure_reason_zh"] diff --git a/apps/orchestrator/tests/test_scheduler_helpers.py b/apps/orchestrator/tests/test_scheduler_helpers.py index 8ca3727..385472d 100644 --- a/apps/orchestrator/tests/test_scheduler_helpers.py +++ b/apps/orchestrator/tests/test_scheduler_helpers.py @@ -1,4 +1,5 @@ import json +import threading import time from pathlib import Path @@ -296,6 +297,51 @@ def run_search(self, query: str, provider: str = "chatgpt_web", browser_policy=N assert verify_failing.get("verify_failures") +def test_run_search_pipeline_serializes_allow_profile_browser_sessions(tmp_path: Path, monkeypatch) -> None: + runs_root = tmp_path / "runs" + monkeypatch.setenv("CORTEXPILOT_RUNS_ROOT", str(runs_root)) + store = RunStore(runs_root=runs_root) + run_id = store.create_run("task_search_serialized") + + lock = threading.Lock() + active_calls = 0 + max_concurrent = 0 + + class DummyToolRunner: + def run_search(self, query: str, provider: str = "chatgpt_web", browser_policy=None, policy_audit=None): + nonlocal active_calls, max_concurrent + del query, browser_policy, policy_audit + with lock: + active_calls += 1 + max_concurrent = max(max_concurrent, active_calls) + time.sleep(0.01) + with lock: + active_calls -= 1 + return { + "ok": True, + "provider": provider, + "results": [{"href": f"https://{provider}.example.com/result"}], + "verification": {"consistent": True}, + } + + request = { + "queries": ["alpha"], + "repeat": 2, + "parallel": 4, + "providers": ["chatgpt_web", "grok_web"], + "verify": {"providers": ["chatgpt_web"], "repeat": 1}, + "browser_policy": {"profile_mode": "allow_profile"}, + } + result = sched._run_search_pipeline( + run_id, + DummyToolRunner(), + request, + {"role": "SEARCHER", "agent_id": "agent-1"}, + ) + assert result["ok"] is True + assert max_concurrent == 1 + + def test_orchestrator_replay_error_paths(tmp_path: Path, monkeypatch) -> None: repo_root = tmp_path / "repo" repo_root.mkdir() diff --git a/apps/orchestrator/tests/test_search_web_strict.py b/apps/orchestrator/tests/test_search_web_strict.py index e16458d..f3e386b 100644 --- a/apps/orchestrator/tests/test_search_web_strict.py +++ b/apps/orchestrator/tests/test_search_web_strict.py @@ -3,6 +3,7 @@ from urllib.parse import urlparse from tooling.search.search_engine import ( + _activate_chat_input, _browser_search, _pick_chat_input_locator, _url_allowed, @@ -71,7 +72,7 @@ def content(self) -> str: assert Path(artifacts["html"]).exists() -def test_pick_chat_input_locator_prefers_standard_inputs() -> None: +def test_pick_chat_input_locator_prefers_provider_specific_editors_before_generic_inputs() -> None: class DummyLocator: def __init__(self, name: str, count: int) -> None: self.name = name @@ -84,12 +85,14 @@ def count(self) -> int: class DummyPage: def __init__(self) -> None: self.locators = { - "textarea": DummyLocator("textarea", 1), - "input[type='text']": DummyLocator("input", 1), + "[data-placeholder='Ask anything'][contenteditable='true']": DummyLocator("grok-placeholder", 1), + ".tiptap.ProseMirror[contenteditable='true']": DummyLocator("grok-tiptap", 1), + "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator("aria", 1), "[role='textbox'][contenteditable='true']": DummyLocator("textbox", 1), "[contenteditable='true'][role='textbox']": DummyLocator("textbox-reversed", 1), - "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator("aria", 1), ".ql-editor[contenteditable='true']": DummyLocator("ql-editor", 1), + "textarea": DummyLocator("textarea", 1), + "input[type='text']": DummyLocator("input", 1), } def locator(self, selector: str) -> DummyLocator: @@ -97,7 +100,7 @@ def locator(self, selector: str) -> DummyLocator: locator = _pick_chat_input_locator(DummyPage()) assert locator is not None - assert locator.name == "textarea" + assert locator.name == "grok-placeholder" def test_pick_chat_input_locator_falls_back_to_contenteditable_textbox() -> None: @@ -113,12 +116,14 @@ def count(self) -> int: class DummyPage: def __init__(self) -> None: self.locators = { - "textarea": DummyLocator("textarea", 0), - "input[type='text']": DummyLocator("input", 0), + "[data-placeholder='Ask anything'][contenteditable='true']": DummyLocator("grok-placeholder", 0), + ".tiptap.ProseMirror[contenteditable='true']": DummyLocator("grok-tiptap", 0), + "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator("aria", 0), "[role='textbox'][contenteditable='true']": DummyLocator("textbox", 1), "[contenteditable='true'][role='textbox']": DummyLocator("textbox-reversed", 0), - "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator("aria", 0), ".ql-editor[contenteditable='true']": DummyLocator("ql-editor", 0), + "textarea": DummyLocator("textarea", 0), + "input[type='text']": DummyLocator("input", 0), } def locator(self, selector: str) -> DummyLocator: @@ -129,6 +134,37 @@ def locator(self, selector: str) -> DummyLocator: assert locator.name == "textbox" +def test_pick_chat_input_locator_supports_grok_tiptap_editor() -> None: + class DummyLocator: + def __init__(self, name: str, count: int) -> None: + self.name = name + self._count = count + self.first = self + + def count(self) -> int: + return self._count + + class DummyPage: + def __init__(self) -> None: + self.locators = { + "[data-placeholder='Ask anything'][contenteditable='true']": DummyLocator("grok-placeholder", 1), + ".tiptap.ProseMirror[contenteditable='true']": DummyLocator("grok-tiptap", 1), + "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator("aria", 0), + "[role='textbox'][contenteditable='true']": DummyLocator("textbox", 0), + "[contenteditable='true'][role='textbox']": DummyLocator("textbox-reversed", 0), + ".ql-editor[contenteditable='true']": DummyLocator("ql-editor", 0), + "textarea": DummyLocator("textarea", 0), + "input[type='text']": DummyLocator("input", 0), + } + + def locator(self, selector: str) -> DummyLocator: + return self.locators[selector] + + locator = _pick_chat_input_locator(DummyPage()) + assert locator is not None + assert locator.name == "grok-placeholder" + + def test_pick_chat_input_locator_returns_none_when_no_supported_input_exists() -> None: class DummyLocator: def __init__(self) -> None: @@ -144,6 +180,97 @@ def locator(self, selector: str) -> DummyLocator: # noqa: ARG002 assert _pick_chat_input_locator(DummyPage()) is None +def test_pick_chat_input_locator_skips_hidden_textarea_for_visible_grok_editor() -> None: + class DummyCandidate: + def __init__(self, name: str, visible: bool) -> None: + self.name = name + self._visible = visible + + def is_visible(self) -> bool: + return self._visible + + class DummyLocator: + def __init__(self, candidates: list[DummyCandidate]) -> None: + self._candidates = candidates + self.first = candidates[0] if candidates else None + + def count(self) -> int: + return len(self._candidates) + + def nth(self, index: int) -> DummyCandidate: + return self._candidates[index] + + class DummyPage: + def __init__(self) -> None: + self.locators = { + "[data-placeholder='Ask anything'][contenteditable='true']": DummyLocator( + [DummyCandidate("grok-visible", True)] + ), + ".tiptap.ProseMirror[contenteditable='true']": DummyLocator([]), + "[aria-label='Enter a prompt for Gemini'][contenteditable='true']": DummyLocator([]), + "[role='textbox'][contenteditable='true']": DummyLocator([]), + "[contenteditable='true'][role='textbox']": DummyLocator([]), + ".ql-editor[contenteditable='true']": DummyLocator([]), + "textarea": DummyLocator([DummyCandidate("hidden-textarea", False)]), + "input[type='text']": DummyLocator([]), + } + + def locator(self, selector: str) -> DummyLocator: + return self.locators[selector] + + locator = _pick_chat_input_locator(DummyPage()) + assert locator is not None + assert locator.name == "grok-visible" + + +def test_activate_chat_input_prefers_normal_click() -> None: + events: list[str] = [] + + class DummyLocator: + def click(self, *, timeout=None, force=False): # noqa: ANN001 + events.append(f"click:{timeout}:{force}") + + def focus(self) -> None: + events.append("focus") + + _activate_chat_input(DummyLocator()) + + assert events == ["click:5000:False"] + + +def test_activate_chat_input_falls_back_to_force_click() -> None: + events: list[str] = [] + + class DummyLocator: + def click(self, *, timeout=None, force=False): # noqa: ANN001 + events.append(f"click:{timeout}:{force}") + if not force: + raise RuntimeError("overlay intercept") + + def focus(self) -> None: + events.append("focus") + + _activate_chat_input(DummyLocator()) + + assert events == ["click:5000:False", "click:5000:True"] + + +def test_activate_chat_input_falls_back_to_focus_when_clicks_fail() -> None: + events: list[str] = [] + + class DummyLocator: + def click(self, *, timeout=None, force=False): # noqa: ANN001 + events.append(f"click:{timeout}:{force}") + raise RuntimeError("still blocked") + + def focus(self) -> None: + events.append("focus") + + _activate_chat_input(DummyLocator()) + + assert events == ["click:5000:False", "click:5000:True", "focus"] + + def test_browser_search_closes_session_before_playwright_exit(monkeypatch, tmp_path: Path) -> None: order: list[str] = [] diff --git a/apps/orchestrator/tests/test_storefront_proof_assets_gate.py b/apps/orchestrator/tests/test_storefront_proof_assets_gate.py new file mode 100644 index 0000000..280c03c --- /dev/null +++ b/apps/orchestrator/tests/test_storefront_proof_assets_gate.py @@ -0,0 +1,224 @@ +from __future__ import annotations + +import importlib.util +import json +import sys +from pathlib import Path + + +def _load_generator_module() -> object: + script_path = Path(__file__).resolve().parents[3] / "scripts" / "generate_storefront_proof_pack_index.py" + spec = importlib.util.spec_from_file_location("cortexpilot_generate_storefront_proof_pack_index", script_path) + module = importlib.util.module_from_spec(spec) + assert spec and spec.loader + spec.loader.exec_module(module) + return module + + +def _load_gate_module() -> object: + script_path = Path(__file__).resolve().parents[3] / "scripts" / "check_storefront_proof_assets.py" + spec = importlib.util.spec_from_file_location("cortexpilot_storefront_proof_assets_gate", script_path) + module = importlib.util.module_from_spec(spec) + assert spec and spec.loader + spec.loader.exec_module(module) + return module + + +def _write_fixture(root: Path) -> None: + (root / "docs" / "assets" / "storefront").mkdir(parents=True, exist_ok=True) + (root / "docs" / "releases" / "assets").mkdir(parents=True, exist_ok=True) + (root / "docs" / "runbooks").mkdir(parents=True, exist_ok=True) + (root / "docs" / "use-cases").mkdir(parents=True, exist_ok=True) + (root / "configs").mkdir(parents=True, exist_ok=True) + + for rel in [ + "docs/releases/assets/news-digest-healthy-proof-2026-03-27.md", + "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md", + "docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md", + ]: + path = root / rel + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text("ok\n", encoding="utf-8") + + (root / "docs" / "releases" / "assets" / "news-digest-healthy-proof-summary-2026-03-27.json").write_text( + json.dumps({"artifact_type": "healthy-proof-summary"}, ensure_ascii=False, indent=2) + "\n", + encoding="utf-8", + ) + (root / "docs" / "releases" / "assets" / "news-digest-benchmark-summary-2026-03-27.json").write_text( + json.dumps({"artifact_type": "benchmark-summary"}, ensure_ascii=False, indent=2) + "\n", + encoding="utf-8", + ) + (root / "docs" / "releases" / "assets" / "news-digest-healthy-proof-gemini-2026-03-27.png").write_text( + "png\n", + encoding="utf-8", + ) + (root / "docs" / "assets" / "storefront" / "dashboard-home-live-1440x900.png").write_text("png\n", encoding="utf-8") + (root / "docs" / "assets" / "storefront" / "dashboard-command-tower-live-1440x900.png").write_text("png\n", encoding="utf-8") + (root / "docs" / "assets" / "storefront" / "dashboard-runs-live-1440x900.png").write_text("png\n", encoding="utf-8") + (root / "docs" / "assets" / "storefront" / "dashboard-live-healthy-loop.gif").write_text("gif\n", encoding="utf-8") + (root / "docs" / "releases" / "assets" / "news-digest-proof-pack-2026-03-27.json").write_text( + json.dumps( + { + "artifact_type": "news_digest_public_proof_pack", + "primary_assets": { + "proof_summary_markdown": "docs/releases/assets/news-digest-healthy-proof-2026-03-27.md", + "proof_summary_json": "docs/releases/assets/news-digest-healthy-proof-summary-2026-03-27.json", + "benchmark_summary_markdown": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md", + "benchmark_summary_json": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.json", + "workflow_case_recap_markdown": "docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md", + "demo_status_markdown": "docs/assets/storefront/demo-status.md" + }, + "supporting_assets": { + "gemini_proof_screenshot": "docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png", + "dashboard_home_capture": "docs/assets/storefront/dashboard-home-live-1440x900.png", + "dashboard_command_tower_capture": "docs/assets/storefront/dashboard-command-tower-live-1440x900.png", + "dashboard_runs_capture": "docs/assets/storefront/dashboard-runs-live-1440x900.png", + "healthy_live_capture_gif": "docs/assets/storefront/dashboard-live-healthy-loop.gif" + } + }, + ensure_ascii=False, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + + (root / "docs" / "use-cases" / "index.html").write_text( + """ +The current recap story now has one tracked news_digest Workflow Case asset, tracked healthy local captures and proof assets, and one remaining broader benchmark gap.
+The current benchmark story is a tracked single-run baseline, not a broad release average.
+Global proof-pack index across public proven and showcase bundles
+ """, + encoding="utf-8", + ) + (root / "docs" / "assets" / "storefront" / "demo-status.md").write_text( + """ + | Proof class | Current status | Notes | + | --- | --- | --- | + | Healthy backend-backed dashboard capture set | present | tracked English-first home, Command Tower session, and Runs captures from a clean local runtime root | + | Healthy backend-backed live GIF | present | tracked multi-page walkthrough of the official first public happy path | + ## Truth Boundary + - these tracked captures are safe repo-side proof of a healthy local first public path, not proof of hosted production scale or live GitHub publication state. + """, + encoding="utf-8", + ) + (root / "docs" / "assets" / "storefront" / "live-capture-requirements.json").write_text( + json.dumps( + { + "artifact_type": "cortexpilot_storefront_live_capture_requirements", + "required_assets": [ + {"asset_id": "healthy_live_capture_gif", "status": "present"}, + {"asset_id": "healthy_english_first_dashboard_home_capture", "status": "present"}, + {"asset_id": "healthy_english_first_command_tower_capture", "status": "present"}, + {"asset_id": "healthy_english_first_runs_capture", "status": "present"}, + ], + }, + ensure_ascii=False, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + (root / "docs" / "runbooks" / "storefront-share-kit.md").write_text( + """ + ## Proof Status By Asset Type + - Healthy backend-backed dashboard capture set + - Healthy backend-backed live GIF + ## Safe Post Angles + - safe to reference as repo-tracked proof, not as proof of live GitHub publication + """, + encoding="utf-8", + ) + + (root / "configs" / "storefront_proof_bundle_registry.json").write_text( + json.dumps( + { + "schema_version": 1, + "artifact_type": "cortexpilot_storefront_proof_bundle_registry", + "vocabulary_contract": { + "proven_workflow_label": "first proven workflow", + "proof_pack_label": "public proof pack", + "showcase_label": "showcase expansion", + }, + "bundles": [ + { + "bundle_id": "news_digest", + "task_template": "news_digest", + "proof_state": "release_proven", + "claim_scope": "official_first_public_baseline", + "authority_level": "repo_side_public_proof", + "public_entrypoint": "docs/use-cases/index.html", + "pack_manifest": "docs/releases/assets/news-digest-proof-pack-2026-03-27.json", + "capture_contract": { + "healthy_live_capture_gif_present": True, + "healthy_english_first_public_capture_set_present": True, + "current_tracked_dashboard_captures": "healthy_english_first_backend_backed_local", + }, + "missing_expected_artifacts": [ + "broader_multi_round_benchmark", + ], + }, + { + "bundle_id": "topic_brief", + "proof_state": "showcase_only", + "missing_expected_artifacts": ["dedicated_healthy_proof_summary"], + }, + { + "bundle_id": "page_brief", + "proof_state": "showcase_only", + "missing_expected_artifacts": ["dedicated_healthy_proof_summary"], + }, + ], + }, + ensure_ascii=False, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + + generator = _load_generator_module() + generator.ROOT = root + generator.REGISTRY_PATH = root / "configs" / "storefront_proof_bundle_registry.json" + generator.OUTPUT_PATH = root / "docs" / "assets" / "storefront" / "proof-pack-index.json" + rendered = generator.build_index(generator._load_json(generator.REGISTRY_PATH)) + generator.OUTPUT_PATH.write_text(json.dumps(rendered, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + + +def test_storefront_proof_assets_gate_passes_with_expected_index(tmp_path: Path, monkeypatch) -> None: + module = _load_gate_module() + _write_fixture(tmp_path) + module.ROOT = tmp_path + module.PROOF_PACK_INDEX = tmp_path / "docs" / "assets" / "storefront" / "proof-pack-index.json" + module.DEMO_STATUS_PATH = tmp_path / "docs" / "assets" / "storefront" / "demo-status.md" + module.LIVE_CAPTURE_REQUIREMENTS_PATH = tmp_path / "docs" / "assets" / "storefront" / "live-capture-requirements.json" + module.SHARE_KIT_PATH = tmp_path / "docs" / "runbooks" / "storefront-share-kit.md" + module.USE_CASES_PATH = tmp_path / "docs" / "use-cases" / "index.html" + monkeypatch.setattr(sys, "argv", ["check_storefront_proof_assets.py"]) + assert module.main() == 0 + + +def test_storefront_proof_assets_gate_fails_when_news_digest_loses_release_proven( + tmp_path: Path, capsys, monkeypatch +) -> None: + module = _load_gate_module() + _write_fixture(tmp_path) + index_path = tmp_path / "docs" / "assets" / "storefront" / "proof-pack-index.json" + payload = json.loads(index_path.read_text(encoding="utf-8")) + payload["bundles"][0]["proof_state"] = "showcase_only" + index_path.write_text(json.dumps(payload, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") + + module.ROOT = tmp_path + module.PROOF_PACK_INDEX = index_path + module.DEMO_STATUS_PATH = tmp_path / "docs" / "assets" / "storefront" / "demo-status.md" + module.LIVE_CAPTURE_REQUIREMENTS_PATH = tmp_path / "docs" / "assets" / "storefront" / "live-capture-requirements.json" + module.SHARE_KIT_PATH = tmp_path / "docs" / "runbooks" / "storefront-share-kit.md" + module.USE_CASES_PATH = tmp_path / "docs" / "use-cases" / "index.html" + monkeypatch.setattr(sys, "argv", ["check_storefront_proof_assets.py"]) + + rc = module.main() + out = capsys.readouterr().out + assert rc == 1 + assert "release_proven" in out diff --git a/apps/orchestrator/tests/test_tool_pipeline_integration.py b/apps/orchestrator/tests/test_tool_pipeline_integration.py index b53d4f8..ee6f2dd 100644 --- a/apps/orchestrator/tests/test_tool_pipeline_integration.py +++ b/apps/orchestrator/tests/test_tool_pipeline_integration.py @@ -202,6 +202,7 @@ def test_tool_pipeline_network_gate_denied(tmp_path: Path, monkeypatch) -> None: repo = tmp_path / "repo" repo.mkdir() _init_repo(repo) + (repo / "codex_home").mkdir() (repo / "README.md").write_text("hello", encoding="utf-8") _git(["git", "add", "README.md", "policies/command_allowlist.json"], repo) _git(["git", "commit", "-m", "init"], repo) @@ -330,6 +331,66 @@ def run_script(self, _script: str, _url: str) -> dict: ) +def test_tool_pipeline_searcher_short_circuits_before_codex_runner(tmp_path: Path, monkeypatch) -> None: + _reset_scheduler_tool_hooks(monkeypatch) + repo = tmp_path / "repo" + repo.mkdir() + _init_repo(repo) + (repo / "codex_home").mkdir() + (repo / "README.md").write_text("hello", encoding="utf-8") + _git(["git", "add", "README.md", "policies/command_allowlist.json"], repo) + _git(["git", "commit", "-m", "init"], repo) + + runtime_root = tmp_path / "runtime" + runs_root = runtime_root / "runs" + worktree_root = runtime_root / "worktrees" + _configure_runtime_roots(monkeypatch, runtime_root, runs_root, worktree_root) + monkeypatch.setenv("CORTEXPILOT_SEARCH_MODE", "mock") + monkeypatch.setenv("CORTEXPILOT_CHAIN_EXEC_MODE", "inline") + monkeypatch.setenv("CORTEXPILOT_RUNNER", "codex") + monkeypatch.setenv("CORTEXPILOT_MCP_ONLY", "1") + monkeypatch.setenv("CORTEXPILOT_ALLOW_CODEX_EXEC", "1") + + search_path = repo / "search_requests.json" + search_body = _write_json( + search_path, + {"queries": ["cortexpilot"], "providers": ["chatgpt_web", "grok_web"], "repeat": 2, "parallel": 2}, + ) + _pin_tool_requests( + monkeypatch, + search_request={"queries": ["cortexpilot"], "providers": ["chatgpt_web", "grok_web"], "repeat": 2, "parallel": 2}, + ) + + artifacts = [ + { + "name": "search_requests.json", + "uri": search_path.name, + "sha256": _sha256_text(search_body), + } + ] + + contract = _base_contract("task_search_short_circuit", artifacts) + contract["assigned_agent"]["role"] = "SEARCHER" + contract_path = repo / "contract.json" + _write_json(contract_path, contract) + + monkeypatch.setattr( + "cortexpilot_orch.runners.codex_runner.CodexRunner.run_contract", + lambda *_args, **_kwargs: (_ for _ in ()).throw(AssertionError("codex runner should not execute after search pipeline success")), + ) + + monkeypatch.chdir(repo) + orch = Orchestrator(repo) + run_id = orch.execute_task(contract_path, mock_mode=False) + + manifest = json.loads((runs_root / run_id / "manifest.json").read_text(encoding="utf-8")) + run_dir = runs_root / run_id + assert manifest["status"] == "SUCCESS" + assert (run_dir / "artifacts" / "search_results.json").exists() + assert (run_dir / "reports" / "evidence_bundle.json").exists() + assert (run_dir / "reports" / "task_result.json").exists() + + def test_tool_pipeline_browser_failure_marks_run_failed(tmp_path: Path, monkeypatch) -> None: _reset_scheduler_tool_hooks(monkeypatch) repo = tmp_path / "repo" diff --git a/configs/docs_render_manifest.json b/configs/docs_render_manifest.json index 216a2e4..2e70527 100644 --- a/configs/docs_render_manifest.json +++ b/configs/docs_render_manifest.json @@ -2,6 +2,21 @@ "schema_version": 1, "description": "Minimal generated-doc outputs kept after the public-surface reduction.", "entries": [ + { + "output_path": "docs/assets/storefront/proof-pack-index.json", + "mode": "full_render", + "source_inputs": [ + "scripts/generate_storefront_proof_pack_index.py", + "configs/storefront_proof_bundle_registry.json", + "docs/releases/assets/news-digest-proof-pack-2026-03-27.json" + ], + "generator": "python3 scripts/generate_storefront_proof_pack_index.py", + "freshness_strategy": "timestamp", + "authoritative_for": [ + "public_storefront_proof_pack_index" + ], + "human_editable_regions": "none" + }, { "output_path": "docs/governance/ui-button-coverage-matrix.md", "mode": "full_render", @@ -25,7 +40,7 @@ "configs/ci_governance_policy.json" ], "generator": "python3 scripts/render_docs.py", - "freshness_strategy": "timestamp", + "freshness_strategy": "existence_only", "authoritative_for": [ "generated_ci_topology_summary" ], @@ -38,7 +53,7 @@ "scripts/render_docs.py" ], "generator": "python3 scripts/render_docs.py", - "freshness_strategy": "timestamp", + "freshness_strategy": "existence_only", "authoritative_for": [ "generated_current_run_summary" ], @@ -51,7 +66,7 @@ "scripts/render_docs.py" ], "generator": "python3 scripts/render_docs.py", - "freshness_strategy": "timestamp", + "freshness_strategy": "existence_only", "authoritative_for": [ "generated_coverage_summary" ], diff --git a/configs/env.registry.json b/configs/env.registry.json index a0b6212..efff430 100644 --- a/configs/env.registry.json +++ b/configs/env.registry.json @@ -6100,9 +6100,9 @@ "scope": "platform", "secret": false, "required": false, - "default": "1", + "default": "0", "owner": "platform", - "description": "Boolean switch controlling mandatory local verification bundle in pre-push gate.", + "description": "Controls the pre-push local verification profile. `0` keeps the default fast bundle, `1` enables the old strict local mirror, and `off` requires break-glass to skip local verification entirely.", "consumers": [ "scripts/pre_push_quality_gate.sh" ] diff --git a/configs/github_control_plane_policy.json b/configs/github_control_plane_policy.json index 0da3778..586c460 100644 --- a/configs/github_control_plane_policy.json +++ b/configs/github_control_plane_policy.json @@ -26,6 +26,22 @@ "required": true, "mode": "api" }, + "secret_scanning": { + "required": true, + "mode": "api" + }, + "secret_scanning_push_protection": { + "required": true, + "mode": "api" + }, + "secret_scanning_non_provider_patterns": { + "required": true, + "mode": "api" + }, + "secret_scanning_validity_checks": { + "required": true, + "mode": "api" + }, "dependabot_config": { "required": true, "mode": "repo_file", diff --git a/configs/storefront_proof_bundle_registry.json b/configs/storefront_proof_bundle_registry.json new file mode 100644 index 0000000..4c588fc --- /dev/null +++ b/configs/storefront_proof_bundle_registry.json @@ -0,0 +1,77 @@ +{ + "schema_version": 1, + "artifact_type": "cortexpilot_storefront_proof_bundle_registry", + "vocabulary_contract": { + "proven_workflow_label": "first proven workflow", + "proof_pack_label": "public proof pack", + "showcase_label": "showcase expansion" + }, + "bundles": [ + { + "bundle_id": "news_digest", + "task_template": "news_digest", + "proof_state": "release_proven", + "claim_scope": "official_first_public_baseline", + "authority_level": "repo_side_public_proof", + "public_entrypoint": "docs/use-cases/index.html", + "pack_manifest": "docs/releases/assets/news-digest-proof-pack-2026-03-27.json", + "safe_public_claims": [ + "news_digest is the only official release-proven first public baseline today", + "the public trust bundle includes proof summary, benchmark summary, Workflow Case recap, and demo-status ledger", + "the benchmark remains a single-run baseline" + ], + "forbidden_claims": [ + "topic_brief is equally release-proven today", + "page_brief is equally release-proven today", + "the current benchmark is a broad multi-run release average", + "current storefront captures prove a fully healthy end-to-end public session" + ], + "capture_contract": { + "healthy_live_capture_gif_present": true, + "healthy_english_first_public_capture_set_present": true, + "current_tracked_dashboard_captures": "healthy_english_first_backend_backed_local" + }, + "missing_expected_artifacts": [ + "broader_multi_round_benchmark" + ] + }, + { + "bundle_id": "topic_brief", + "task_template": "topic_brief", + "proof_state": "showcase_only", + "claim_scope": "public_showcase_path", + "authority_level": "repo_side_story_surface", + "public_entrypoint": "docs/use-cases/index.html", + "safe_public_claims": [ + "topic_brief is a public showcase path with search-backed evidence" + ], + "forbidden_claims": [ + "topic_brief is an equally release-proven baseline today" + ], + "missing_expected_artifacts": [ + "dedicated_healthy_proof_summary", + "dedicated_benchmark_summary", + "share_ready_recap" + ] + }, + { + "bundle_id": "page_brief", + "task_template": "page_brief", + "proof_state": "showcase_only", + "claim_scope": "public_showcase_path", + "authority_level": "repo_side_story_surface", + "public_entrypoint": "docs/use-cases/index.html", + "safe_public_claims": [ + "page_brief is a browser-backed public showcase path" + ], + "forbidden_claims": [ + "page_brief is an equally release-proven baseline today" + ], + "missing_expected_artifacts": [ + "dedicated_healthy_proof_summary", + "dedicated_benchmark_summary", + "share_ready_recap" + ] + } + ] +} diff --git a/docs/README.md b/docs/README.md index 54dd860..87c012f 100644 --- a/docs/README.md +++ b/docs/README.md @@ -15,29 +15,19 @@ summary for contributors and maintainers. `configs/docs_nav_registry.json` is the machine source of truth for the active docs inventory. This file is the human-readable summary of that registry. -Public-fixture hygiene stays part of the docs contract too: orchestrator probe -and security fixtures must use synthetic token fragments plus generic workspace -sample roots instead of maintainer-local paths or raw token-looking literals. -The same contract now keeps `security_scan.sh` placeholder URIs pinned to the -exact `example.com` host and preserves `.jsonl` hints in portable temp-report -names, while `scripts/check_public_sensitive_surface.py` blocks tracked -local-path/PII/raw-token/runtime-file leaks on current public source surfaces. -The same gate family now includes `scripts/check_github_security_alerts.py`, -which fails closed on open GitHub secret-scanning and code-scanning alerts in -repo hygiene, host-compatible pre-commit quality, a dedicated pre-commit hook, -pre-push, and Quick Feedback. -Workflow governance now has matching repo-owned entrypoints too: -`scripts/check_workflow_static_security.sh` pairs `actionlint` with -`zizmor` in one fail-closed gate, `scripts/check_trivy_repo_scan.sh` -owns the repo-wide Trivy filesystem/dependency lane, and -`scripts/check_secret_scan_closeout.sh` is the closeout wrapper that can rerun -secret scanning against the current tree or a fresh clone. Pull requests also -run the official GitHub Dependency Review action under the repo-owned -`.github/dependency-review-config.yml` policy file. On GitHub-hosted -`trusted_pr`, `untrusted_pr`, and hosted-first `push_main` routes the live -alerts query stays advisory for both Quick Feedback and the hosted policy -slice because the integration token may not be allowed to read the alerts APIs -there and a fresh hosted `push_main` route may not have live analysis yet. +Daily local verification lives in the root [README](../README.md). Treat this +file as the docs inventory map, not as a second CI manual. + +For CI/security/documentation truth, prefer the machine-owned surfaces and +repo-owned gates instead of restating the same rules here: + +- `configs/docs_nav_registry.json` +- `configs/ci_governance_policy.json` +- `configs/github_control_plane_policy.json` +- `scripts/check_public_sensitive_surface.py` +- `scripts/check_workflow_static_security.sh` +- `scripts/check_trivy_repo_scan.sh` +- `scripts/check_secret_scan_closeout.sh` ## Repository Entry @@ -97,6 +87,8 @@ navigation set. - `docs/runbooks/github-storefront-manual-steps.md`: exact GitHub UI values and manual storefront steps - `docs/releases/first-public-release-draft.md`: repo-side draft source for the first public GitHub Release - `docs/assets/storefront/demo-status.md`: status ledger for tracked public demo and proof assets +- `docs/assets/storefront/proof-pack-index.json`: machine-readable public proof bundle index for proven and showcase storefront slices +- `docs/assets/storefront/live-capture-requirements.json`: machine-readable contract for the remaining healthy GIF and English-first public capture deliverables - `docs/assets/storefront/benchmark-methodology.md`: public benchmark evidence contract and wording boundary - `docs/architecture/ecosystem-and-builder-surfaces-v1.md`: ecosystem binding, first-run distribution loop, and current builder/client entry points - `docs/runbooks/render-hosted-operator-pilot.md`: repo-side Git-backed hosted operator blueprint for future guarded Render pilots; use it to stage env/health/rollback/support/security requirements without implying a live hosted service diff --git a/docs/assets/storefront/README.md b/docs/assets/storefront/README.md index 42c7de2..01e8a54 100644 --- a/docs/assets/storefront/README.md +++ b/docs/assets/storefront/README.md @@ -9,14 +9,17 @@ and social-preview use. - `first-loop-storyboard.svg`: shareable storyboard for the PM -> Command Tower -> Runs story - `first-loop-storyboard.png`: exportable static storyboard preview - `first-loop-storyboard.gif`: tracked storyboard animation (not a live product capture) -- `dashboard-home-live-1440x900.png`: tracked real screenshot from the dashboard home page in local degraded mode -- `dashboard-command-tower-live-1440x900.png`: tracked real Command Tower screenshot in local degraded mode -- `dashboard-runs-live-1440x900.png`: tracked real Runs screenshot in local degraded mode -- `dashboard-live-degraded-loop.gif`: tracked real dashboard GIF in local degraded mode +- `dashboard-home-live-1440x900.png`: tracked healthy English-first dashboard home screenshot +- `dashboard-command-tower-live-1440x900.png`: tracked healthy English-first Command Tower session screenshot +- `dashboard-runs-live-1440x900.png`: tracked healthy English-first Runs / Proof & Replay screenshot +- `dashboard-live-healthy-loop.gif`: tracked healthy backend-backed dashboard GIF +- `dashboard-live-degraded-loop.gif`: historical degraded dashboard GIF retained as a truth-boundary reference - `desktop-shell-live-1440x900.png`: tracked real screenshot from the desktop snapshot pipeline - `social-preview-source.svg`: source artwork for a GitHub social preview export - `social-preview-1280x640.png`: exported GitHub social preview candidate - `demo-status.md`: explicit status ledger for real demo/benchmark asset closure +- `proof-pack-index.json`: machine-readable public proof bundle index +- `live-capture-requirements.json`: machine-readable contract for the remaining healthy public capture deliverables ## Rules @@ -27,4 +30,7 @@ and social-preview use. - treat `first-loop-storyboard.gif` as a storyboard animation, not as a real live-product recording - label degraded local screenshots honestly when backend data is unavailable - label degraded local GIF captures honestly when backend data is unavailable +- label healthy local dashboard captures as repo-side local proof, not as proof of hosted production scale or live GitHub publication +- treat `proof-pack-index.json` as the public proof bundle SSOT for repo-tracked proof surfaces +- treat `live-capture-requirements.json` as the SSOT for the remaining healthy GIF / English-first capture deliverables - regenerate tracked exports on macOS with `bash scripts/export_storefront_assets.sh` (supports `inkscape` or `rsvg-convert` as optional SVG fallbacks) diff --git a/docs/assets/storefront/dashboard-command-tower-live-1440x900.png b/docs/assets/storefront/dashboard-command-tower-live-1440x900.png index f567bf4..a815245 100644 Binary files a/docs/assets/storefront/dashboard-command-tower-live-1440x900.png and b/docs/assets/storefront/dashboard-command-tower-live-1440x900.png differ diff --git a/docs/assets/storefront/dashboard-home-live-1440x900.png b/docs/assets/storefront/dashboard-home-live-1440x900.png index 04b161f..336ef04 100644 Binary files a/docs/assets/storefront/dashboard-home-live-1440x900.png and b/docs/assets/storefront/dashboard-home-live-1440x900.png differ diff --git a/docs/assets/storefront/dashboard-live-healthy-loop.gif b/docs/assets/storefront/dashboard-live-healthy-loop.gif new file mode 100644 index 0000000..72fa676 Binary files /dev/null and b/docs/assets/storefront/dashboard-live-healthy-loop.gif differ diff --git a/docs/assets/storefront/dashboard-runs-live-1440x900.png b/docs/assets/storefront/dashboard-runs-live-1440x900.png index 558419a..e33fcb9 100644 Binary files a/docs/assets/storefront/dashboard-runs-live-1440x900.png and b/docs/assets/storefront/dashboard-runs-live-1440x900.png differ diff --git a/docs/assets/storefront/demo-status.md b/docs/assets/storefront/demo-status.md index 1a374d6..3466d2d 100644 --- a/docs/assets/storefront/demo-status.md +++ b/docs/assets/storefront/demo-status.md @@ -9,10 +9,10 @@ ones that still need a real capture pass. - `first-loop-storyboard.svg`: shareable storyboard of the PM -> Command Tower -> Runs loop - `first-loop-storyboard.png`: static storyboard export - `first-loop-storyboard.gif`: storyboard animation export -- `dashboard-home-live-1440x900.png`: real dashboard home screenshot captured from a local production server -- `dashboard-command-tower-live-1440x900.png`: real Command Tower screenshot captured from a local production server -- `dashboard-runs-live-1440x900.png`: real Runs page screenshot captured from a local production server -- `dashboard-live-degraded-loop.gif`: real multi-page dashboard GIF captured from a local degraded run +- `dashboard-home-live-1440x900.png`: healthy English-first dashboard home screenshot captured from a clean local runtime root +- `dashboard-command-tower-live-1440x900.png`: healthy English-first Command Tower session screenshot captured from the same verified path +- `dashboard-runs-live-1440x900.png`: healthy English-first Runs / Proof & Replay screenshot captured from the same verified path +- `dashboard-live-healthy-loop.gif`: healthy backend-backed multi-page dashboard GIF captured from the same verified path - `desktop-shell-live-1440x900.png`: real desktop preview screenshot captured from the app snapshot pipeline - `social-preview-source.svg`: editable social card source - `social-preview-1280x640.png`: upload-ready social card candidate @@ -20,6 +20,7 @@ ones that still need a real capture pass. - `docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png`: successful Gemini proof screenshot - `docs/releases/assets/news-digest-healthy-proof-grok-2026-03-27.png`: successful Grok proof screenshot - `docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md`: first tracked public `news_digest` baseline summary +- `docs/releases/assets/news-digest-proof-pack-2026-03-27.json`: machine-readable proof-pack directory for the current public trust bundle - `docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md`: share-ready Workflow Case recap for the official first public baseline ## Current Proof Ledger @@ -27,7 +28,8 @@ ones that still need a real capture pass. | Proof class | Current status | Notes | | --- | --- | --- | | Storyboard explainer assets | present | useful for explaining the loop, not proving runtime health | -| Real local degraded dashboard captures | present | honest supporting evidence, but not healthy backend-backed proof | +| Healthy backend-backed dashboard capture set | present | tracked English-first home, Command Tower session, and Runs captures from a clean local runtime root | +| Healthy backend-backed live GIF | present | tracked multi-page walkthrough of the official first public happy path | | Desktop preview capture | present | shows the shell surface only | | Healthy backend-backed `news_digest` public proof set | present | tracked proof summary: `docs/releases/assets/news-digest-healthy-proof-2026-03-27.md` | | Public benchmark artifact from a real tracked run | present | first tracked single-run baseline: `docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md` | @@ -36,7 +38,6 @@ ones that still need a real capture pass. ## Still Missing -- a tracked healthy live-capture GIF for the official first public happy path - a broader multi-round public benchmark artifact beyond the current single-run baseline summary - a live GitHub social preview upload @@ -47,9 +48,17 @@ It prevents “we already have assets” from drifting into fake maturity. A sou file, a storyboard, a storyboard animation, and a production-ready live capture are different things. +The public storytelling shorthand is now: + +- **first proven workflow** = `news_digest` +- **public proof pack** = healthy proof summary + benchmark summary + Workflow Case recap + demo-status ledger +- **showcase paths** = `topic_brief` and `page_brief` until they have their own healthy proof bundles + ## Truth Boundary -- `dashboard-home-live-1440x900.png`, `dashboard-command-tower-live-1440x900.png`, `dashboard-runs-live-1440x900.png`, and `dashboard-live-degraded-loop.gif` are real captures from the dashboard server, but they were captured in a local degraded state where backend data was unavailable. +- `dashboard-home-live-1440x900.png`, `dashboard-command-tower-live-1440x900.png`, `dashboard-runs-live-1440x900.png`, and `dashboard-live-healthy-loop.gif` are real healthy captures from the dashboard server backed by the clean local runtime root `.runtime-cache/storefront-final-capture-english`. +- these tracked captures are safe repo-side proof of a healthy local first public path, not proof of hosted production scale, stable multi-run release averages, or live GitHub publication state. +- `dashboard-live-degraded-loop.gif` remains a historical degraded capture and should stay labeled as degraded if it is referenced at all. - `desktop-shell-live-1440x900.png` is a real screenshot from the desktop snapshot pipeline. - `social-preview-1280x640.png` is a repo-tracked upload candidate for the GitHub social preview setting, not proof that the live GitHub setting has already been applied. - `docs/releases/first-public-release-draft.md` remains the repo-side draft source that fed the published release notes. @@ -64,4 +73,4 @@ are different things. a historical blocker receipt from earlier failed healthy-proof attempts. - `https://xiaojiou176-open.github.io/CortexPilot-public/` is now the live GitHub Pages site backed by `main` / `/docs`. -- None of these captures should be described as proof of a fully healthy end-to-end backend session. +- None of these captures should be described as proof of live hosted readiness, live GitHub publication state, or broad production-scale stability. diff --git a/docs/assets/storefront/live-capture-requirements.json b/docs/assets/storefront/live-capture-requirements.json new file mode 100644 index 0000000..d856e08 --- /dev/null +++ b/docs/assets/storefront/live-capture-requirements.json @@ -0,0 +1,56 @@ +{ + "artifact_type": "cortexpilot_storefront_live_capture_requirements", + "applies_to_bundle": "news_digest", + "summary": "This contract records the healthy public capture deliverables for the official first public baseline and the tracked assets that currently satisfy them.", + "required_assets": [ + { + "asset_id": "healthy_live_capture_gif", + "status": "present", + "required": true, + "description": "A healthy backend-backed GIF that shows the official news_digest first public happy path.", + "path": "docs/assets/storefront/dashboard-live-healthy-loop.gif", + "must_not_be": [ + "storyboard animation", + "local degraded capture", + "mocked or synthetic walkthrough" + ] + }, + { + "asset_id": "healthy_english_first_dashboard_home_capture", + "status": "present", + "required": true, + "description": "A healthy English-first dashboard home screenshot captured from the public first-run path.", + "path": "docs/assets/storefront/dashboard-home-live-1440x900.png", + "must_not_be": [ + "localized non-English default capture", + "degraded data capture" + ] + }, + { + "asset_id": "healthy_english_first_command_tower_capture", + "status": "present", + "required": true, + "description": "A healthy English-first Command Tower screenshot from the same verified path.", + "path": "docs/assets/storefront/dashboard-command-tower-live-1440x900.png", + "must_not_be": [ + "degraded data capture" + ] + }, + { + "asset_id": "healthy_english_first_runs_capture", + "status": "present", + "required": true, + "description": "A healthy English-first Runs / Proof & Replay screenshot from the same verified path.", + "path": "docs/assets/storefront/dashboard-runs-live-1440x900.png", + "must_not_be": [ + "degraded data capture" + ] + } + ], + "success_criteria": [ + "All required assets exist as tracked files or release assets.", + "The captures come from a healthy backend-backed path, not a degraded local fallback.", + "The visible UI language is English-first.", + "The assets can be safely linked from the public first proven workflow story without overstating proof." + ] +} diff --git a/docs/assets/storefront/proof-pack-index.json b/docs/assets/storefront/proof-pack-index.json new file mode 100644 index 0000000..b841a74 --- /dev/null +++ b/docs/assets/storefront/proof-pack-index.json @@ -0,0 +1,166 @@ +{ + "artifact_type": "cortexpilot_public_proof_pack_index", + "generated_by": "scripts/generate_storefront_proof_pack_index.py", + "source_registry": "configs/storefront_proof_bundle_registry.json", + "vocabulary_contract": { + "proven_workflow_label": "first proven workflow", + "proof_pack_label": "public proof pack", + "showcase_label": "showcase expansion" + }, + "bundles": [ + { + "bundle_id": "news_digest", + "task_template": "news_digest", + "proof_state": "release_proven", + "claim_scope": "official_first_public_baseline", + "authority_level": "repo_side_public_proof", + "public_entrypoint": "docs/use-cases/index.html", + "pack_manifest": "docs/releases/assets/news-digest-proof-pack-2026-03-27.json", + "safe_public_claims": [ + "news_digest is the only official release-proven first public baseline today", + "the public trust bundle includes proof summary, benchmark summary, Workflow Case recap, and demo-status ledger", + "the benchmark remains a single-run baseline" + ], + "forbidden_claims": [ + "topic_brief is equally release-proven today", + "page_brief is equally release-proven today", + "the current benchmark is a broad multi-run release average", + "current storefront captures prove a fully healthy end-to-end public session" + ], + "capture_contract": { + "healthy_live_capture_gif_present": true, + "healthy_english_first_public_capture_set_present": true, + "current_tracked_dashboard_captures": "healthy_english_first_backend_backed_local" + }, + "missing_expected_artifacts": [ + "broader_multi_round_benchmark" + ], + "assets": [ + { + "path": "docs/releases/assets/news-digest-healthy-proof-2026-03-27.md", + "role": "healthy_proof_summary", + "format": "markdown", + "truth_class": "repo_side_proof", + "required_for_claim": true + }, + { + "path": "docs/releases/assets/news-digest-healthy-proof-summary-2026-03-27.json", + "role": "healthy_proof_summary_machine", + "format": "json", + "truth_class": "repo_side_machine_summary", + "required_for_claim": true + }, + { + "path": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md", + "role": "benchmark_summary", + "format": "markdown", + "truth_class": "repo_side_benchmark", + "required_for_claim": true + }, + { + "path": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.json", + "role": "benchmark_summary_machine", + "format": "json", + "truth_class": "repo_side_machine_summary", + "required_for_claim": true + }, + { + "path": "docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md", + "role": "workflow_case_recap", + "format": "markdown", + "truth_class": "share_ready_recap", + "required_for_claim": true + }, + { + "path": "docs/assets/storefront/demo-status.md", + "role": "demo_status_ledger", + "format": "markdown", + "truth_class": "truth_boundary_ledger", + "required_for_claim": true + }, + { + "path": "docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png", + "role": "gemini_proof_screenshot", + "format": "png", + "truth_class": "supporting_capture", + "required_for_claim": false + }, + { + "path": "docs/releases/assets/news-digest-healthy-proof-grok-2026-03-27.png", + "role": "grok_proof_screenshot", + "format": "png", + "truth_class": "supporting_capture", + "required_for_claim": false + }, + { + "path": "docs/assets/storefront/dashboard-home-live-1440x900.png", + "role": "dashboard_home_capture", + "format": "png", + "truth_class": "supporting_capture", + "required_for_claim": false + }, + { + "path": "docs/assets/storefront/dashboard-command-tower-live-1440x900.png", + "role": "dashboard_command_tower_capture", + "format": "png", + "truth_class": "supporting_capture", + "required_for_claim": false + }, + { + "path": "docs/assets/storefront/dashboard-runs-live-1440x900.png", + "role": "dashboard_runs_capture", + "format": "png", + "truth_class": "supporting_capture", + "required_for_claim": false + }, + { + "path": "docs/assets/storefront/dashboard-live-healthy-loop.gif", + "role": "healthy_live_capture_gif", + "format": "gif", + "truth_class": "supporting_capture", + "required_for_claim": false + } + ] + }, + { + "bundle_id": "topic_brief", + "task_template": "topic_brief", + "proof_state": "showcase_only", + "claim_scope": "public_showcase_path", + "authority_level": "repo_side_story_surface", + "public_entrypoint": "docs/use-cases/index.html", + "safe_public_claims": [ + "topic_brief is a public showcase path with search-backed evidence" + ], + "forbidden_claims": [ + "topic_brief is an equally release-proven baseline today" + ], + "missing_expected_artifacts": [ + "dedicated_healthy_proof_summary", + "dedicated_benchmark_summary", + "share_ready_recap" + ], + "assets": [] + }, + { + "bundle_id": "page_brief", + "task_template": "page_brief", + "proof_state": "showcase_only", + "claim_scope": "public_showcase_path", + "authority_level": "repo_side_story_surface", + "public_entrypoint": "docs/use-cases/index.html", + "safe_public_claims": [ + "page_brief is a browser-backed public showcase path" + ], + "forbidden_claims": [ + "page_brief is an equally release-proven baseline today" + ], + "missing_expected_artifacts": [ + "dedicated_healthy_proof_summary", + "dedicated_benchmark_summary", + "share_ready_recap" + ], + "assets": [] + } + ] +} diff --git a/docs/compatibility/index.html b/docs/compatibility/index.html index 9222d25..ac4c7e4 100644 --- a/docs/compatibility/index.html +++ b/docs/compatibility/index.html @@ -272,7 +272,7 @@If you need to prove the story to a team first, use the public proof-first loop and share-ready Workflow Case surfaces before deeper adoption.
- +If you need to prove the story to a team first, start with the public proof-first loop, the news_digest baseline, and the share-ready Workflow Case recap before deeper adoption.
- CortexPilot is for teams that need more than “the agent replied.” Route Codex- and - Claude Code-style governed work through one command tower, keep every workflow case - reviewable, and attach MCP-readable proof plus replay to the same operating record. - The same front door also speaks to AI ops and platform teams that need - a shared operator view instead of scattered agent logs. + Start with one proven workflow, confirm the Workflow Case, then inspect Proof & Replay. + CortexPilot gives Codex- and Claude Code-style teams one governed operator path instead + of scattered prompts, local scripts, and after-the-fact logs.
- Current boundary: the public surface is still a repo/demo control plane, not a hosted operator product, - and the shipped MCP surface remains read-only. + Current boundary: this is a repo-backed operator control plane, not a hosted product, and the + shipped MCP surface remains read-only.
- Using Codex, Claude Code, OpenClaw, skills, or builders and not sure which door to open first? - Start with the compatibility matrix. Need release notes, the repo home, or the docs map instead? Open the - release page, the - repository, the - docs map - or - runtime topology. + After those two doors, go deeper through + agent starter kits, + read-only MCP, + integrations, + skills, + AI + MCP + API surfaces, or the + ecosystem map.
- The public story should be simple: send one request, watch it move through Command Tower, - confirm the Workflow Case, then inspect Proof & Replay. + The public story should stay simple: send one request, watch it move through Command Tower, + confirm the Workflow Case, then inspect Proof & Replay before you trust the result.
It is not just “the model replied.” The same first loop keeps the request, case record, proof, and replay on one operator path.
+The strongest public slice is not a screenshot alone. It is the Workflow Case recap that lets other people review what happened without re-running the whole stack.
+CortexPilot explicitly says what is proven, what is still a showcase path, and what remains read-only or live-verified later.
+- New here? Use this as the only decision layer on the homepage. Let the deeper pages carry the detail once you know which door fits the job. + New here? Keep the first decision simple: start with one proven workflow, choose the right adoption path, + then open deeper protocol or builder pages only after the job is clear.
Start with the public first-run cases if you want to see a governed workflow, a case record, and replayable proof before you read package internals.
- +Start here if you want the shortest honest story: one public baseline, one proof pack, and one share-ready Workflow Case recap before you read internals.
+Start here if your main question is “I use Codex, Claude Code, OpenClaw, skills, or builders. Which CortexPilot surface should I open first?”
- +Start here if your real question is “I use Codex, Claude Code, OpenClaw, skills, or builders. Which CortexPilot surface should I open first?”
+Open the agent starter kits when your team already understands the boundary and now wants tracked Codex / Claude Code / OpenClaw setup files instead of reverse-engineering them from source.
- -Start with the read-only MCP quickstart if you want the shortest truthful map of what external tools can inspect today.
- -Start with the integration guide if you need the truthful answer to how Codex, Claude Code, and OpenClaw can use CortexPilot today without fake official-plugin claims.
- -Start with the API and builder quickstarts if you want OpenAPI, contract-facing types, thin client helpers, and the shared frontend substrate.
-Open API and contract quickstart · Open builder quickstart
+Start here once the boundary is clear and you need read-only MCP, OpenAPI, contract-facing types, or the thin builder surfaces.
+Open read-only MCP · Open API quickstart · Open builder quickstart
- Need the repo-owned playbook layer? Open the skills quickstart. Need the broader ecosystem framing? - Open the ecosystem map. Need exact Codex / Claude Code / OpenClaw starter files? Open - agent starter kits. Need the operator-layer overview? Open - AI + MCP + API surfaces. + Need exact starter files? Open agent starter kits. Need the truthful Codex / Claude Code / OpenClaw map? + Open integrations. Need repo-owned playbooks? Open skills quickstart. + Need the broader market framing? Open the ecosystem map.
- Prompt 4 now adds two ecosystem-facing layers on top of this spine: a read-only MCP server for - structured control-plane reads, and an AI operator brief that explains current run state without - creating a second truth source. -
-- Current boundary: MCP is read-only only, and CortexPilot is not a hosted operator product today. - Write-capable MCP remains gated, and `cortexpilot.ai` should not be treated as a live hosted front door. + Read-only MCP and the AI operator brief sit on top of this spine as inspection layers, not as second execution truths.
- This file is the tracked source for the live GitHub Pages landing surface. The main calls to - action intentionally point to stable public Pages and GitHub URLs so the repo, releases, and docs map stay - verifiable. The host-compatible quickstart stays: + The shortest honest start is still repo-local. The host-compatible path stays:
npm run bootstrap:hostCORTEXPILOT_HOST_COMPAT=1 bash scripts/test_quick.sh --no-relatednpm run dashboard:dev+ In practice, a clean first pass should take about 5-10 minutes and end with four visible signals: + one request created from PM, one case visible in Command Tower, one Workflow Case you can confirm, + and one Proof & Replay surface you can inspect before trusting the result. +
Official first public path: start with news_digest if you want the smallest release-proven
- proof loop, then use topic_brief and page_brief as public showcase expansions.
+ proof loop. Treat topic_brief and page_brief as showcase expansions, not equally
+ proven baselines.
- See the public distribution loop in - the use-case and share-ready asset guide. + See the full proof pack, benchmark summary, and share-ready Workflow Case recap in + the first proven workflow guide.
Need the fastest proof-first walkthrough instead of the deeper integration map? - Open use-case guide. + See the first proven workflow.
diff --git a/docs/releases/assets/news-digest-proof-pack-2026-03-27.json b/docs/releases/assets/news-digest-proof-pack-2026-03-27.json new file mode 100644 index 0000000..60af803 --- /dev/null +++ b/docs/releases/assets/news-digest-proof-pack-2026-03-27.json @@ -0,0 +1,35 @@ +{ + "artifact_type": "news_digest_public_proof_pack", + "task_template": "news_digest", + "status": "official_release_proven_baseline", + "baseline_scope": "single-run public baseline", + "summary": "This pack is the smallest truthful public trust bundle for CortexPilot today. It combines the official news_digest healthy proof summary, the tracked single-run benchmark summary, the share-ready Workflow Case recap, and the storefront demo-status ledger.", + "truth_boundary": { + "healthy_public_baseline": true, + "equally_proven_topic_brief": false, + "equally_proven_page_brief": false, + "healthy_live_capture_gif_present": true, + "healthy_english_first_public_capture_set_present": true, + "broader_multi_round_benchmark_present": false + }, + "primary_assets": { + "proof_summary_markdown": "docs/releases/assets/news-digest-healthy-proof-2026-03-27.md", + "proof_summary_json": "docs/releases/assets/news-digest-healthy-proof-summary-2026-03-27.json", + "benchmark_summary_markdown": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md", + "benchmark_summary_json": "docs/releases/assets/news-digest-benchmark-summary-2026-03-27.json", + "workflow_case_recap_markdown": "docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md", + "demo_status_markdown": "docs/assets/storefront/demo-status.md" + }, + "supporting_assets": { + "gemini_proof_screenshot": "docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png", + "grok_proof_screenshot": "docs/releases/assets/news-digest-healthy-proof-grok-2026-03-27.png", + "dashboard_home_capture": "docs/assets/storefront/dashboard-home-live-1440x900.png", + "dashboard_command_tower_capture": "docs/assets/storefront/dashboard-command-tower-live-1440x900.png", + "dashboard_runs_capture": "docs/assets/storefront/dashboard-runs-live-1440x900.png", + "healthy_live_capture_gif": "docs/assets/storefront/dashboard-live-healthy-loop.gif" + }, + "known_gaps": [ + "No broader multi-round benchmark artifact beyond the current single-run baseline summary yet.", + "topic_brief and page_brief still need their own healthy proof and benchmark bundles." + ] +} diff --git a/docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md b/docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md index 90ce449..c564939 100644 --- a/docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md +++ b/docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md @@ -84,6 +84,5 @@ Avoid wording like: - `topic_brief` and `page_brief` remain showcase paths until they have their own healthy proof and benchmark bundles. - The missing storefront gaps still remain: - - no tracked healthy live-capture GIF - no broader multi-round public benchmark artifact - no confirmed live GitHub social preview upload diff --git a/docs/runbooks/onboarding-30min.md b/docs/runbooks/onboarding-30min.md index e54ef2b..752ab43 100644 --- a/docs/runbooks/onboarding-30min.md +++ b/docs/runbooks/onboarding-30min.md @@ -15,6 +15,7 @@ npm run bootstrap ## 2. Run the main checks ```bash +npm run ci npm run test npm run test:quick bash scripts/check_repo_hygiene.sh diff --git a/docs/runbooks/storefront-share-kit.md b/docs/runbooks/storefront-share-kit.md index 34f4039..dc1da2b 100644 --- a/docs/runbooks/storefront-share-kit.md +++ b/docs/runbooks/storefront-share-kit.md @@ -17,6 +17,12 @@ replay, read-only MCP access, and explainable operator guidance. 2. Watch it move through Command Tower. 3. Open the Workflow Case and inspect proof, replay, or the operator brief. +## Current Public Framing + +- **First proven workflow**: `news_digest` +- **Public proof pack**: healthy proof summary + benchmark summary + Workflow Case recap + demo-status ledger +- **Showcase expansions**: `topic_brief` and `page_brief` until they earn their own healthy proof bundles + ## Current Tracked Assets - `docs/assets/storefront/hero-command-tower.svg` @@ -25,6 +31,7 @@ replay, read-only MCP access, and explainable operator guidance. - `docs/assets/storefront/dashboard-home-live-1440x900.png` - `docs/assets/storefront/dashboard-command-tower-live-1440x900.png` - `docs/assets/storefront/dashboard-runs-live-1440x900.png` +- `docs/assets/storefront/dashboard-live-healthy-loop.gif` - `docs/assets/storefront/dashboard-live-degraded-loop.gif` - `docs/assets/storefront/desktop-shell-live-1440x900.png` - `docs/assets/storefront/social-preview-source.svg` @@ -34,6 +41,7 @@ replay, read-only MCP access, and explainable operator guidance. - `docs/releases/assets/news-digest-healthy-proof-gemini-2026-03-27.png` - `docs/releases/assets/news-digest-healthy-proof-grok-2026-03-27.png` - `docs/releases/assets/news-digest-benchmark-summary-2026-03-27.md` +- `docs/releases/assets/news-digest-proof-pack-2026-03-27.json` - `docs/releases/assets/news-digest-workflow-case-recap-2026-03-27.md` ## Proof Status By Asset Type @@ -41,16 +49,16 @@ replay, read-only MCP access, and explainable operator guidance. | Asset type | Current status | Safe public use | | --- | --- | --- | | Hero and storyboard art | tracked | use as explanation and storytelling | -| Local degraded dashboard captures | tracked | use only with degraded/local wording | +| Local degraded dashboard captures | tracked historical fallback | use only with degraded/local wording | | Desktop snapshot preview | tracked | use as a UI preview, not as end-to-end proof | -| Healthy backend-backed `news_digest` capture set | present | safe to reference as repo-tracked proof, not as proof of live GitHub publication | +| Healthy backend-backed dashboard capture set | present | safe to reference as repo-tracked proof, not as proof of live GitHub publication | +| Healthy backend-backed live GIF | present | safe to reference as repo-tracked proof of the local first public happy path | | Public benchmark artifact | present | safe to quote as a single-run baseline only | | Workflow Case recap asset | present | safe to reuse as the strongest public recap for the official first-run path | | GitHub Release card | present | safe to reference the live release page and the tracked draft together | ## Current Gaps -- no tracked healthy live-capture GIF yet - no broader multi-round public benchmark figure yet - no live GitHub social preview upload yet @@ -64,8 +72,9 @@ replay, read-only MCP access, and explainable operator guidance. - anchor first-look copy on the `news_digest` path when referring to a public first run - use the storyboard GIF only as a process explainer, not as proof of live runtime behavior -- describe `dashboard-home-live-1440x900.png` as a local degraded dashboard capture unless a healthy backend-backed capture replaces it -- describe `dashboard-live-degraded-loop.gif` as a local degraded dashboard capture unless a healthy backend-backed capture replaces it +- describe `dashboard-home-live-1440x900.png`, `dashboard-command-tower-live-1440x900.png`, and `dashboard-runs-live-1440x900.png` as healthy English-first local captures from the same verified path +- describe `dashboard-live-healthy-loop.gif` as the healthy backend-backed local walkthrough for the official first public baseline +- describe `dashboard-live-degraded-loop.gif` as a historical degraded dashboard capture, not the current public proof default - quote the current benchmark artifact only as a single-run `news_digest` baseline until a broader benchmark summary replaces it - if mentioning the first release, link the live GitHub Release page first and diff --git a/docs/skills/index.html b/docs/skills/index.html index 5b7b2a4..75e83fe 100644 --- a/docs/skills/index.html +++ b/docs/skills/index.html @@ -206,7 +206,7 @@Need the fastest proof-first walkthrough before you adopt repo-owned skills? - Open use-case guide. + See the first proven workflow.
diff --git a/docs/use-cases/index.html b/docs/use-cases/index.html index b73634b..abcd6fc 100644 --- a/docs/use-cases/index.html +++ b/docs/use-cases/index.html @@ -3,101 +3,340 @@ -
+
- CortexPilot already has three public first-run cases. The goal here is - to make them easier to discover, explain, and reuse as proof-first - assets. -
+ + ++ Start here if you want the shortest honest CortexPilot story. + What can I run, inspect, and trust today before I dive into + the deeper protocol and builder surfaces? +
+
+ The answer is still: start with news_digest. It is the
+ only official release-proven public baseline. topic_brief and
+ page_brief stay useful, but they remain showcase expansions
+ until they each have their own healthy proof and benchmark bundles.
+
If you arrived here from the agent starter kits, - this page is the post-install proof target. In plain English: after you - paste one starter file into Codex, Claude Code, or OpenClaw, come back - here and make sure the same proof-first story still holds instead of - assuming the copied config already proved a real integration. + this page is the post-install proof target. In plain English: do not + assume the starter file already proved a real integration. Come back + here and make sure the same proof pack still holds.
-One task exists in PM and one Workflow Case exists for that run. You are not relying on a shell success line alone.
+You can open proof, replay, and recap artifacts without guessing where they went or whether the run is real.
+You can clearly explain why news_digest is proven today and why the other two paths are not yet equivalent.
+| Case | -Current proof state | -What to inspect today | +Case | +Current proof state | +What to inspect today |
|---|---|---|---|---|---|
| news_digest | -Official release-proven first public baseline | -+ | news_digest | +Official release-proven first public baseline | +healthy proof summary · single-run benchmark summary |
| topic_brief | -Public showcase only; not yet equally release-proven | -Treat as discovery/story surface until a dedicated healthy proof and benchmark bundle exists. | +topic_brief | +Public showcase only; not yet equally release-proven | +Treat as discovery/story surface until a dedicated healthy proof and benchmark bundle exists. |
| page_brief | -Public showcase only; browser-backed path, not yet equally release-proven | -Treat as discovery/story surface until a dedicated healthy proof and benchmark bundle exists. | +page_brief | +Public showcase only; browser-backed path, not yet equally release-proven | +Treat as discovery/story surface until a dedicated healthy proof and benchmark bundle exists. |
- For starter-kit users, the quickest truthful check today is still: - prove the repo-local path first, keep the host-tool integration - read-only, then confirm the same news_digest - proof/baseline/recap trio still makes sense for your setup. -
+news_digest| Artifact | +Why it matters | +Open now | +
|---|---|---|
| Healthy proof summary | +Shows the tracked healthy result path for the official public baseline. | +Open proof summary | +
| Single-run benchmark summary | +Shows the current public performance baseline without pretending it is a broad benchmark campaign. | +Open benchmark summary | +
| Workflow Case recap | +Shows the strongest share-ready artifact for why Workflow Cases matter outside the operator UI. | +Open recap asset | +
| Proof-pack manifest | +Shows the machine-readable directory of what is in the public trust bundle today and what is still missing. | +Open proof-pack manifest | +
| Global proof-pack index | +Shows the storefront-wide index of proven bundles, showcase bundles, and current public proof gaps. | +Open proof-pack index | +
| Demo-status ledger | +Shows which storefront captures are healthy, degraded, missing, or still only explanation assets. | +Open demo-status ledger | +
@@ -119,6 +358,9 @@
news_digestnews_digestnews_digestnews_digest
diff --git a/package.json b/package.json
index 38e97ec..5dd7995 100644
--- a/package.json
+++ b/package.json
@@ -19,7 +19,7 @@
"truth:triage": "bash scripts/truth_triage.sh",
"precommit:quality": "CORTEXPILOT_HOST_COMPAT=1 bash scripts/pre_commit_quality_gate.sh",
"docs:render": "bash scripts/run_governance_py.sh scripts/render_docs.py",
- "docs:check": "bash scripts/run_governance_py.sh scripts/check_docs_navigation_registry.py && bash scripts/run_governance_py.sh scripts/check_docs_manual_fact_boundary.py && bash scripts/run_governance_py.sh scripts/check_docs_render_freshness.py",
+ "docs:check": "bash scripts/run_governance_py.sh scripts/check_docs_navigation_registry.py && bash scripts/run_governance_py.sh scripts/check_docs_manual_fact_boundary.py && bash scripts/run_governance_py.sh scripts/check_frontdoor_contract.py && bash scripts/run_governance_py.sh scripts/check_storefront_proof_assets.py && bash scripts/run_governance_py.sh scripts/check_docs_render_freshness.py",
"scan:secrets": "bash scripts/security_scan.sh",
"scan:workflow-security": "bash scripts/check_workflow_static_security.sh",
"scan:trivy": "bash scripts/check_trivy_repo_scan.sh",
@@ -101,8 +101,10 @@
"bench:e2e:speed:report-only": "bash scripts/bench_e2e_speed.sh --report-only",
"e2e:pm-chat": "bash scripts/e2e_pm_chat_command_tower_success.sh",
"e2e:pm-chat:real": "CORTEXPILOT_E2E_RUN_MODE=real CORTEXPILOT_E2E_RUNNER=agents CORTEXPILOT_E2E_REEXEC_STRICT=true bash scripts/e2e_pm_chat_command_tower_success.sh",
- "ci": "bash scripts/docker_ci.sh ci",
- "ci:host": "CORTEXPILOT_HOST_COMPAT=1 bash scripts/ci.sh",
+ "ci": "bash scripts/ci_local_fast.sh",
+ "ci:host": "bash scripts/ci_local_fast.sh",
+ "ci:strict": "bash scripts/docker_ci.sh ci",
+ "ci:strict:host": "CORTEXPILOT_HOST_COMPAT=1 bash scripts/ci.sh",
"ci:nightly:full": "bash scripts/ci_nightly_full.sh",
"dashboard:install": "bash scripts/run_workspace_app.sh dashboard typecheck",
"dashboard:dev": "bash scripts/run_workspace_app.sh dashboard dev",
diff --git a/packages/frontend-shared/uiCopy.js b/packages/frontend-shared/uiCopy.js
index 449f5c9..ff0c81f 100644
--- a/packages/frontend-shared/uiCopy.js
+++ b/packages/frontend-shared/uiCopy.js
@@ -8,7 +8,7 @@ const UI_COPY = {
homePhase2: {
heroTitle: "Command Tower for Codex and Claude Code workflows",
heroSubtitle:
- "Start one workflow case, watch Command Tower, then inspect Proof & Replay. CortexPilot keeps Codex and Claude Code work, MCP tools, evidence, and replay on one governed operator path.",
+ "See one proven workflow first, then choose the right adoption path. CortexPilot keeps Codex and Claude Code work, evidence, and replay on one governed operator path instead of scattered local scripts and logs.",
startFirstTaskLabel: "Start first task",
startNewTaskLabel: "Start new task",
viewLatestRunsLabel: "View latest runs",
@@ -34,11 +34,11 @@ const UI_COPY = {
desc: "Inspect evidence bundles, compare reruns, and replay failures before you trust the result.",
},
],
- publicTemplatesTitle: "Three public first-run cases",
+ publicTemplatesTitle: "One proven workflow, two showcase expansions",
publicTemplatesDescription:
- "Start with one public, read-only workflow case. `news_digest` is the official first public baseline; `topic_brief` and `page_brief` are showcase paths from the same front door.",
- publicTemplatesActionLabel: "Open task creation",
- publicTemplatesActionHref: "/pm",
+ "Start with `news_digest` first. It is the official public baseline. `topic_brief` and `page_brief` stay useful, but they are still showcase paths until they earn their own healthy proof bundles.",
+ publicTemplatesActionLabel: "Open proof pack",
+ publicTemplatesActionHref: "/use-cases/",
publicTemplateCards: [
{
href: "/pm?template=news_digest",
@@ -127,8 +127,8 @@ const UI_COPY = {
],
integrationTitle: "Choose the right adoption path",
integrationDescription:
- "Use the compatibility matrix as the front-door router, keep the use-case guide as the lighter proof-first side door, then open protocol, playbooks, packages, or AI surfaces only after the real job is clear.",
- proofFirstActionLabel: "Open use-case guide",
+ "Use the compatibility matrix as the main router, keep the proof-first guide as the fastest way to believe the product story, then open protocol, playbooks, packages, or AI surfaces only after the real job is clear.",
+ proofFirstActionLabel: "See first proven workflow",
proofFirstActionHref: "/use-cases/",
integrationCards: [
{
@@ -722,7 +722,7 @@ const UI_COPY = {
homePhase2: {
heroTitle: "面向 Codex 和 Claude Code 工作流的指挥塔",
heroSubtitle:
- "先启动一个工作流案例，再观察指挥塔，最后核对证明与回放。CortexPilot 把 Codex / Claude Code 工作、MCP 工具、证据和回放放进同一条受治理的操作路径。",
+ "先看一个已证明的工作流，再决定采用路径。CortexPilot 把 Codex / Claude Code 工作、证据和回放收进同一条受治理的操作路径，而不是散落在本地脚本和日志里。",
startFirstTaskLabel: "启动首个任务",
startNewTaskLabel: "启动新任务",
viewLatestRunsLabel: "查看最近 runs",
@@ -748,11 +748,11 @@ const UI_COPY = {
desc: "在真正信任结果前，先检查证据包、对比重跑和失败回放。",
},
],
- publicTemplatesTitle: "三个公开首跑 use case",
+ publicTemplatesTitle: "一个已证明工作流，两个展示扩展",
publicTemplatesDescription:
- "从一个公开、只读的 workflow case 开始。`news_digest` 是官方首个公开基线；`topic_brief` 和 `page_brief` 是同一前门下的展示路径。",
- publicTemplatesActionLabel: "打开任务创建",
- publicTemplatesActionHref: "/pm",
+ "先从 `news_digest` 开始。它是官方公开基线。`topic_brief` 和 `page_brief` 仍然有用，但在拿到各自健康证明包之前，它们仍属于展示路径。",
+ publicTemplatesActionLabel: "打开证明包",
+ publicTemplatesActionHref: "/use-cases/",
publicTemplateCards: [
{
href: "/pm?template=news_digest",
@@ -841,8 +841,8 @@ const UI_COPY = {
],
integrationTitle: "选择正确的采用路径",
integrationDescription:
- "先把 compatibility matrix 当成前门主路由，把 use-case guide 当成更轻的 proof-first 侧门，再在真正任务已经明确后进入协议、playbook、package 或 AI 页面，而不是在首页一次性读完所有说明。",
- proofFirstActionLabel: "打开 use-case 指南",
+ "先把 compatibility matrix 当成主路由，把 proof-first 指南当成最快建立信任的入口，再在任务真正明确后进入协议、playbook、package 或 AI 页面。",
+ proofFirstActionLabel: "查看首个已证明工作流",
proofFirstActionHref: "/use-cases/",
integrationCards: [
{
diff --git a/packages/frontend-shared/uiCopy.ts b/packages/frontend-shared/uiCopy.ts
index 9246120..a7faec4 100644
--- a/packages/frontend-shared/uiCopy.ts
+++ b/packages/frontend-shared/uiCopy.ts
@@ -844,7 +844,7 @@ const UI_COPY: Record