Skip to content

Production-readiness: hosted E2E smoke harness + audit (WIP)#37

Draft
cooper (czxtm) wants to merge 1 commit into
mainfrom
claude/peaceful-volta-DJMmq
Draft

Production-readiness: hosted E2E smoke harness + audit (WIP)#37
cooper (czxtm) wants to merge 1 commit into
mainfrom
claude/peaceful-volta-DJMmq

Conversation

@czxtm
Copy link
Copy Markdown
Member

@czxtm cooper (czxtm) commented Jun 1, 2026

Production-readiness workflow (WIP)

Running an end-to-end "ultracode" workflow to get StackPanel production-ready: a parallel audit of the three runtime planes plus a browser-driven E2E against the hosted studio.

Landed in this PR so far

  • Hosted E2E smoke harness (apps/web/e2e-hosted/): a Playwright config that drives a deployed studio (production or staging) rather than a local dev server, plus a read-only, unauthenticated smoke spec:
    • landing renders with no uncaught page errors
    • /dashboard auth-gates unauthenticated visitors to /login
    • /login presents a sign-in affordance
    • /studio responds without a 5xx or crash
  • SMOKE_BASE_URL selects the target; SMOKE_IGNORE_HTTPS_ERRORS=1 tolerates TLS-intercepting egress proxies while staying strict in clean CI so a genuine production cert regression still fails.
  • Verified 4/4 green against https://stackpanel.com via Chromium.

Observations already surfaced

  • Auth gating is inconsistent: /dashboard redirects unauthenticated users server-side to /login, but /studio returns 200 and stays put (client-gated). Likely benign (studio data comes from the local agent), but flagged for review.

Coming next (same branch)

  • Consolidated production-readiness audit — web · Go agent/CLI · cloud API · CI/deploy · cross-cutting — prod-blockers first.
  • Safe fixes for the highest-severity findings.
  • Authenticated studio↔agent E2E against staging (deferred while staging is down: staging.stackpanel.com not responding, staging API returning 503).

https://claude.ai/code/session_01TMCMpDmbLomRBZbg3FpvMV


Generated by Claude Code


View with Codesmith Autofix with Codesmith
Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.

Adds apps/web/e2e-hosted/: a Playwright config that drives a DEPLOYED
studio (production or staging) instead of a local dev server, plus a
read-only, unauthenticated smoke spec:
  - landing renders with no uncaught page errors
  - /dashboard auth-gates unauthenticated visitors to /login
  - /login presents a sign-in affordance
  - /studio responds without a 5xx or crash

SMOKE_BASE_URL selects the target; SMOKE_IGNORE_HTTPS_ERRORS=1 tolerates
TLS-intercepting egress proxies while staying strict in clean CI so a
genuine production cert regression still fails. README documents the
deferred authenticated studio<->agent flow for when staging is healthy.

Verified: 4/4 green against https://stackpanel.com via Chromium.

https://claude.ai/code/session_01TMCMpDmbLomRBZbg3FpvMV
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 1, 2026

Preview deployed to pr-37https://pr-37.stackpanel.com

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 1, 2026

Docs preview deployed to pr-37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants