Skip to content

fix(e2e): make authenticated browser stack reproducible - #1010

Merged
seonghobae merged 15 commits into
feat/leftover-map-compare-cross-share-v2530from
fix/compose-orchestrator-null-startup-831
Sep 11, 2026
Merged

fix(e2e): make authenticated browser stack reproducible#1010
seonghobae merged 15 commits into
feat/leftover-map-compare-cross-share-v2530from
fix/compose-orchestrator-null-startup-831

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Outcome

This bounded repair is complete and was normally merged into #831.

Causal repairs retained

The lane repaired the clean-checkout authenticated browser path without provider/model substitution, copied contextual-orchestrator source, timeout inflation, test skipping, or gate weakening:

  • repository-local contextual-orchestrator is explicit/optional while backend/MCP remain Null/fail-closed by default;
  • disposable synthetic seeding uses the committed dependency lock while the long-running backend runtime stays lean;
  • the synthetic Keycloak issuer is pinned to the public product-auth boundary;
  • Playwright Pixel-7 setup uses only supported browser-context fields instead of spreading worker-scoped device options;
  • browser artifacts/logs are retained only when the browser step itself fails;
  • locale options are enumerated with a real browser callback;
  • the existing semantic WorkspaceNav and language tools remain reachable below 768px with touch-sized responsive layout, closing the buyer-visible gap caused by hiding the nav for a drawer that did not exist.

The exact-head SUCCESS covered the PostgreSQL full suite plus frontend lint/tests, production build, Storybook, Chromium installation, authenticated product startup, synthetic seed, persisted cross-share fixture, desktop/responsive pointer and keyboard/focus checks, locale iteration, and Pixel-7 touch acceptance.

No predecessor receipt transfers to the moved #831 head. Fresh #831 exact-head validation is tracked on merge result 93e1b4fb... before descendant semantic reconstruction.

@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6569f7ed-b107-42d7-818f-cbadccd84e8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@seonghobae
seonghobae marked this pull request as ready for review September 11, 2026 08:00

Copy link
Copy Markdown
Contributor Author

Owner-boundary note: protected-main foundation #899 is the canonical LineageWeave→contextual-orchestrator separation lane and removes the repository-local orchestrator wrapper entirely. This #831-stack repair does not supersede or copy that owner implementation; it only makes the existing historical stack honor its already-documented optional/fail-closed contract. When this serialized report stack later converges with #899 or its accepted successor, #899's external-service boundary wins and the transitional llm profile/wrapper must disappear rather than become a competing canonical runtime.

@seonghobae seonghobae changed the title fix(compose): keep optional orchestrator out of clean default startup fix(e2e): make authenticated browser stack reproducible Sep 11, 2026
Keycloak 26 hostname v2 derives the iss claim from the request host.
With a bare KC_HOSTNAME=localhost, the in-network call the seed makes to
keycloak:8080 mints iss=http://localhost:8080/... while the backend
validates KEYCLOAK_ISSUER=http://localhost:18080/... -- so every seeded
post-content warm-up 401s and the authenticated browser gate cannot start.

Pin KC_HOSTNAME to the full public URL so one issuer serves browser and
in-network callers alike, and lock the invariant with a compose contract
test.
The keycloak_issuer comment still described hostname-strict=false
reflecting the request Host into the iss claim. Compose now pins
KC_HOSTNAME to the public URL, so the issuer no longer varies by caller.
@seonghobae
seonghobae marked this pull request as ready for review September 11, 2026 14:06
@seonghobae
seonghobae marked this pull request as draft September 11, 2026 14:15
@seonghobae
seonghobae marked this pull request as ready for review September 11, 2026 14:21
@seonghobae
seonghobae marked this pull request as draft September 11, 2026 14:23
@seonghobae
seonghobae marked this pull request as ready for review September 11, 2026 14:24
@seonghobae
seonghobae marked this pull request as draft September 11, 2026 14:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant