Iterion

Appearance

Like what we’re building? Star on GitHub
<!-- e2e-coverage-matrix: v1 — machine-parsed; see the coverage-matrix skill of the e2e-coverage bot -->

E2E coverage matrix ​

The single feature×coverage inventory for iterion. One row per operator-observable promise, at the granularity a regression report would name it. Every row is terminal (covered-deterministic / covered-live / unit-only / excluded) or an honest uncovered gap with the plan.

A citation must be the test that would FAIL if the promise broke. The deterministic gate greps every reference, so it catches a citation that does not exist — it cannot catch one that exists but tests something else. Two adversarial audits sampled 70 rows and found 11 such mis-citations (mostly: a row citing the mechanics of a helper while the WIRING that invokes it went untested). When you touch a row, re-read the cited test and ask what its failure would actually mean.

This file supersedes the three partial coverage docs it reconciles:

  • docs/e2e_coverage.md — the iterion×claw-code-go live matrix + the deliberate claw-side gaps (folded into the backends, tools-mcp and observability families below).
  • docs/live-e2e-coverage.md — the opt-in real-LLM layer (how it works, the quality-judge panel, the per-bot targets). Still the reference for running the live layer; its bot/feature tables are mirrored here as covered-live rows.
  • e2e/SCENARIOS.md — the flagship-workflow stub-executor scenarios (folded into runtime and dsl).

Legend ​

StatusMeaning
covered-deterministicA CI-runnable, credential-free test drives the real seams and asserts observable outcomes
covered-liveOnly exercised in the opt-in live-tagged layer (needs a real model/credential)
unit-onlyDeliberately terminal at unit level — an e2e would only re-test the harness
excludedNot exercisable in this repo's harness (needs a third-party tenant / cloud control plane)
uncoveredReal gap — backlog

What "the front door" means per family ​

  • dsl — the front door is .bot source text: parse → compile → the diagnostic or IR an operator sees from iterion validate. Rows whose behaviour only shows at execution time cite a runtime/e2e test instead.
  • runtime — the public engine API (runtime.Engine.Run/Resume) against a real store.RunStore, asserting persisted status, checkpoint, artifacts and the event stream. e2e/ additionally enters through .bot fixtures.
  • cli — cli.Run* entry points with a real store and (where an LLM would be involved) a stub runtime.NodeExecutor injected at the documented seam.
  • server-api / cloud — httptest against the real wired handler.
  • studio-ui — Playwright (studio/e2e/, task test:e2e:ui) drives a real Chromium against the REAL server: the built iterion binary serving the embedded SPA over a throwaway store that studio/e2e/serve.mjs seeds with genuine artifacts — runs the engine actually executed (tool + compute fixtures, no LLM credential) and a board card created through the CLI. The suite asserts rendered content and interactions, never HTTP status codes. It is deliberately NOT wired into the blocking CI job yet (the browser download is opt-in; task test:e2e:ui skips cleanly without it).

Scope of the current campaign ​

Pass 1 built this inventory and closed the highest-value CLI quick wins (run --preset, run --max-*, secret, runs questions|answer, report). Pass 2 closed the remaining CLI quick wins: issue, diagram, skill, memory, run --recipe. Pass 3 closed the four CLI rows earlier passes had written off as needing a seam or a live model — the cli family is now terminal end to end. Each turned out to have a deterministic front door:

  • run --model/--backend — drive the REAL executor at fixtures whose backend/model cannot resolve; the failure text quotes whichever value won the resolution chain, offline.
  • run --auto-resume — the loop's only wait is the reset-aware USAGE_LIMIT_BLOCKED delay, and the run's own retry policy clamps it, so a 1ms horizon removes the sleep without a clock seam.
  • bench asymptote — the command re-runs nothing; stub-driven runs of a judge-in-a-loop fixture supply the exact events it parses.
  • dispatch — boot the daemon in-process on a loopback port, assert the served surface, stop it with SIGTERM.

Everything still uncovered is deliberate backlog for later scoped runs, family by family. What is left, and why it is not a quick win:

Pass 5 introduced the browser harness the studio-ui family was waiting on and closed its rows (see the family note above).

Pass 4 closed the three remaining cloud rows — dlq, migrate-blobs, valkey-state — which earlier passes had written off as needing a live Mongo/S3/Valkey. Each had a deterministic front door after all:

  • valkey-state — two servers built through the real New() wiring over one miniredis; each flow starts on replica A and finishes on replica B.
  • migrate-blobs — the walker between two real stores, plus the real AWS SDK against an in-process path-style S3 gateway.
  • dlq — the admin REST surface behind a narrow QueueBackend seam; the JetStream-side semantics are covered separately by the live-broker nats-conformance job (TestSchemaRolloutMixedFleet).
IDFeatureFamilyStatusTestsNotes
dsl.node-agentagent node: LLM node with structured I/O executes and publishesdslcovered-deterministicTestSingleModel_HappyPath (e2e/e2e_test.go)
dsl.node-judgejudge node: verdict-producing LLM nodedslcovered-deterministicTestSingleModel_HappyPath (e2e/e2e_test.go)
dsl.node-tooltool node: direct shell command, no LLMdslcovered-deterministicTestExecutorToolNodeShellCommand (pkg/backend/model/executor_test.go), TestToolNodeShellMaterializesSecret (pkg/backend/model/secrets_materialize_test.go)the shell path needs the REAL executor: the e2e scenario stub replaces every node — agent and tool alike — so a tool node rerouted through the LLM path would still pass there
dsl.node-computecompute node: deterministic expression outputdslcovered-deterministicTestToolAndComputePublishArtifact (pkg/runtime/engine_test.go)
dsl.node-humanhuman node: pause/resume with interaction recorddslcovered-deterministicTestCompliance_HumanGate (e2e/e2e_test.go)
dsl.node-subbotsubbot node: nested child run, outputs read backdslcovered-deterministicTestRunSubbotsPersistNestedLineage (pkg/cli/run_subbot_test.go)
dsl.node-emit-waitemit/wait: in-bot event pair with mandatory timeoutdslcovered-deterministicTestEventsEmitWait (e2e/events_emit_wait_test.go)
dsl.node-await-answersawait_answers node parks its branch until answers landdslcovered-deterministicTestAwaitAnswersReleasedByAnswer (e2e/async_interaction_test.go)
dsl.node-donedone terminal node ends the run finisheddslcovered-deterministicTestSingleModel_HappyPath (e2e/e2e_test.go)
dsl.node-failfail terminal node ends the run non-resumable faileddslcovered-deterministicTestFailNode (pkg/runtime/engine_test.go)
dsl.router-fan-out-allrouter fan_out_all spawns parallel branchesdslcovered-deterministicTestDualParallel_HappyPath (e2e/e2e_test.go)
dsl.router-fan-out-eachrouter fan_out_each: per-item branches with a dep DAGdslcovered-deterministicTestFanOutEach_DAG_DiamondOrderingAndParallelism (pkg/runtime/fan_out_each_test.go)
dsl.router-conditionrouter condition mode picks the matching edgedslcovered-deterministicpkg/dsl/ir/validate_test.go, TestElseEdge_Routing (pkg/runtime/else_edge_test.go)
dsl.router-round-robinrouter round_robin alternates targets across iterationsdslcovered-deterministicpkg/runtime/round_robin_test.go
dsl.router-llmrouter llm mode: model picks the routedslcovered-deterministicTestLLMRouterSelectsOtherRoute (pkg/runtime/llm_router_test.go)
dsl.edges-conditionaledge when / when not conditions on a boolean output fielddslcovered-deterministicTestSingleModel_RefineLoop (e2e/e2e_test.go)
dsl.edges-elseedge else fires only when no sibling when matcheddslcovered-deterministicTestElseEdge_PreferredOverStrayUnconditional (pkg/runtime/else_edge_test.go)
dsl.edges-loopbounded loop edge as name(n)dslcovered-deterministicTestBoundedLoop (pkg/runtime/engine_test.go)
dsl.edges-loop-templated-caploop cap templated from an upstream outputdslcovered-deterministicTestLoopTemplatedCap_FromOutput (pkg/runtime/engine_test.go)
dsl.edges-loop-in-parallelbounded as loop / as foreach wholly owned by one fan_out_all, fan_out_each, or llm multi branch is accepted; boundary-crossing cycles remain C244dslcovered-deterministicTestValidateLoopInFanOutAllBody_Allowed (pkg/dsl/ir/validate_exec_branch_loops_test.go)also fan_out_each, llm-multi, foreach, and template-head acceptance; TestValidateLoopReenteringBodyFromJoin_Rejected and TestValidateLoopOnFanOutRouterEdge_Rejected pin boundary diagnostics; TestValidateLoopStraddlingLLMMultiPerEdgeCollector_Rejected / TestValidateLoopBeforeNonElectedAwaitInFanOutAll_Allowed pin the llm-multi rule that each branch is bounded by the collector its OWN edge can elect, since the model may select that edge alone
dsl.edges-data-mappingedge with {…} data mapping and reference interpolationdslcovered-deterministicTestResolveMapping_InterpolatesSurroundingLiterals (pkg/runtime/engine_resolve_mapping_test.go)
dsl.refsreference syntax: input/vars/outputs/artifacts substitutiondslcovered-deterministicpkg/dsl/ir/ref_test.go
dsl.refs-edge-inputedge with {{input.x}} is the source output (C034 and the resolver agree; no run-input fallback; router pass-through preserved, including llm; mid-graph routers warn C032 when the field is not incoming)dslcovered-deterministicTestEdgeInputRef_CompileAndRuntimeAgree (pkg/runtime/edge_input_ref_test.go)also TestEdgeInputRef_RouterPassThrough, TestEdgeInputRef_LLMRouterPassThrough, TestEdgeInputRef_SchemalessSourceWarnsAndDoesNotFallBack, TestEdgeInputRef_MidGraphRouterDoesNotFallBack, TestEdgeInputRef_MidGraphRouterPassThrough; TestValidateRefInputOnEdge_SourceInputOnly_C034 / TestValidateRefInputOnEdge_RunInputOnly_C034VarsHint / TestValidateRefInputOnEdge_RouterPassThrough_NoSchemaSkip / TestValidateRefInputOnEdge_SchemalessSource_C032Warn / TestValidateRefInputOnEdge_MidGraphRouter_NoIncomingWith_C032 / TestValidateRefInputOnEdge_MidGraphRouter_IncomingWith_OK (pkg/dsl/ir/validate_test.go)
dsl.vars-defaultsvars: defaults applied when no override is supplieddslcovered-deterministicpkg/dsl/ir/validate_var_default_test.go
dsl.vars-enumvars: enum constraint rejects an out-of-set value at launchdslcovered-deterministicTestRunRejectsInvalidEnumVar (pkg/runtime/engine_var_enum_test.go)
dsl.presetsin-source presets: block resolves named value setsdslcovered-deterministicpkg/dsl/ir/presets_test.goCLI wiring covered by cli.run-preset
dsl.promptsprompt <name>: blocks and prompt includesdslcovered-deterministicpkg/dsl/ir/prompt_include_test.go
dsl.schemasschema <name>: typed node output contractsdslcovered-deterministicpkg/backend/model/schema_test.go
dsl.cursorscursor <name>: calibration fragments reach the system promptdslcovered-deterministicTestBuildSystemPromptCursorsOnly (pkg/backend/delegate/cursors_test.go), pkg/backend/model/cursors_test.go, pkg/dsl/ir/cursor_resolve_test.go
dsl.attachmentsattachments: block: files resolved and passed to nodesdslcovered-deterministicpkg/dsl/ir/attachments_test.go, pkg/runtime/attachment_path_test.go
dsl.skills-fieldskills: field pulls library skills into the run mirrordslcovered-deterministicpkg/dsl/ir/validate_skills_test.go, pkg/runtime/library_skills_test.go
dsl.mcp-server-blockmcp_server: block declares stdio/http/sse MCP serversdslcovered-deterministicTestMCPServer_SSETransport (pkg/dsl/parser/parser_mcp_test.go)
dsl.capabilitiescapabilities: list opens the board tool surfacedslcovered-deterministicpkg/dsl/ir/validate_capabilities_test.go, TestBoardDispatcher_E2E_CapabilityGate (e2e/board_dispatcher_test.go)
dsl.supervisor-blocksupervisor <name>: declaration compiles and spawns a coordinatordslcovered-deterministicpkg/dsl/ir/compile_supervisors_test.go, pkg/supervise/coordinator_test.go
dsl.compress-fieldcompress: precedence (CLI → node → workflow → env → default)dslcovered-deterministicTestResolveWithDefault (pkg/backend/rewrite/rewrite_test.go), TestResolveWithDefaultSourced (pkg/backend/rewrite/rewrite_test.go), pkg/dsl/ir/compress_test.go
dsl.auto-memory-fieldauto_memory: per-node MEMORY.md switch, off by defaultdslcovered-deterministicpkg/dsl/ir/auto_memory_test.go, pkg/backend/model/executor_auto_memory_test.go
dsl.permission-fieldpermission: mode + allow/ask/deny rule listsdslcovered-deterministicpkg/dsl/ir/permission_test.go, pkg/backend/permission/permission_test.go
dsl.budget-blockbudget: block fields compile onto the workflowdslcovered-deterministicpkg/dsl/ir/budget_ceiling_test.go
dsl.sandbox-blocksandbox: block (image/build/network/host_state) compilesdslcovered-deterministicpkg/dsl/ir/sandbox_test.go, pkg/dsl/parser/parser_sandbox_test.go
dsl.worktree-fieldworktree: mode default resolutiondslcovered-deterministicpkg/dsl/ir/worktree_default_test.go
dsl.session-modessession modes (fresh / inherit / artifacts_only)dslcovered-deterministicTestSessionInherit (pkg/runtime/session_test.go), TestSessionFork (pkg/runtime/session_test.go), TestSessionInheritIfAvailable_FallsBackToFreshWhenNoSession (pkg/runtime/session_test.go)the modes are a RUNTIME behaviour; pkg/backend/model/session_test.go is the session store (persistence + compaction), a different contract
dsl.secrets-blocksecrets: declarations + optional-secret semanticsdslcovered-deterministicpkg/dsl/ir/secrets_test.go, pkg/dsl/ir/optional_secret_test.go
dsl.memory-blockmemory: block scopes/visibility validationdslcovered-deterministicpkg/dsl/ir/memory_visibility_test.go
dsl.verified-actionVerified Action quad (goal/postcondition/policy/recovery)dslcovered-deterministicTestVerifiedActionEngineEmitsAndStrips (e2e/verified_action_test.go)
dsl.groups-iterationgroup: expansion / iteration sugardslcovered-deterministicpkg/dsl/ir/expand_groups_test.go, pkg/dsl/ir/foreach_test.go
dsl.diagnosticscompile diagnostics C001–C2xx codes and severitiesdslcovered-deterministicpkg/dsl/ir/diag_codes_test.go, TestValidate_Invalid (pkg/cli/cli_test.go)
dsl.unparse-roundtripIR → .bot serialization round-tripsdslcovered-deterministicpkg/dsl/unparse/roundtrip_test.go
dsl.ast-jsonAST JSON encode/decode (MarshalFile/UnmarshalFile)dslcovered-deterministicpkg/dsl/ast/jsonenc_test.go
dsl.exprexpression evaluator for compute nodes and when conditionsdslunit-onlypkg/dsl/expr/expr_test.go, pkg/dsl/expr/overflow_test.gopure evaluator, exhaustively asserted at unit level; its e2e effect is already covered by dsl.node-compute — an extra pipeline test would re-assert a pure function
dsl.parser-fuzzlexer/parser robustness on malformed inputdslunit-onlypkg/dsl/parser/fuzz_test.gofuzzing is by nature a unit-level property test; the operator-visible surface (a diagnostic, not a panic) is dsl.diagnostics
runtime.linear-executionsequential node execution to a terminal noderuntimecovered-deterministicTestLinearPath (pkg/runtime/engine_test.go)
runtime.selected-incoming-edgesa node input is built only from incoming edges routing selected for this visit; unselected conditional siblings do not clobber, fan-out joins still merge every selected branch, and the set survives pause/resume (issue #484)runtimecovered-deterministicTestSelectedIncoming_ExclusiveSiblingsIgnoreUnselectedElse (pkg/runtime/incoming_test.go)also TestSelectedIncoming_ExclusiveSiblingsIgnoreUnselectedElseRegardlessOfOrder, TestSelectedIncoming_ElsePathStillApplies, TestSelectedIncoming_UntrackedFallbackMergesAllWithOutput, TestSelectedIncoming_FanOutJoinMergesBothSelected, TestSelectedIncoming_SurvivesFailedResume; loop-head back-edge precedence remains TestLoopHeadSelfRefBackEdgeAdvances (pkg/runtime/loop_head_selfref_test.go)
runtime.await-wait-allconvergence await: wait_all waits for every branchruntimecovered-deterministicTestDualParallel_HappyPath (e2e/e2e_test.go)
runtime.await-best-effortconvergence await: best_effort proceeds on partial branchesruntimecovered-deterministicTestChaos_FailMidFanOut_BestEffort (pkg/runtime/chaos_test.go)also TestSharedTargetFanOut_BranchFailure (pkg/runtime/convergence_fires_once_test.go): the survivor's output reaches the collector and the failure is named on join_ready, while wait_all fails the run before the collector
runtime.await-fires-oncethe collector of a fan-out fires exactly once, after every branch has settled, under both await modes — including when a fan-out target is ALSO reachable from outside the fan-out (the mono/dual review topology, issue #741), across a branch pause + resume, and across a failure downstream of the collectorruntimecovered-deterministicTestSharedTargetFanOut_CollectorFiresOnce (pkg/runtime/convergence_fires_once_test.go), TestReviewPRDual_CollectorChainFiresOnce (e2e/review_pr_convergence_test.go)also TestSharedTargetFanOut_ResumeAfterBranchPauseFiresCollectorOnce, TestSharedTargetFanOut_ResumeAfterTailFailureDoesNotRefireCollector, TestSharedTemplateHeadFanOutEach_ReplaysEveryItemAndFiresCollectorOnce (fan_out_each, same class); the election itself is TestFindConvergencePoint_TargetFedFromOutsideTheFanOutIsNotTheCollector (pkg/runtime/fan_out_internal_test.go) and TestShippedDualTopologies_ElectTheDeclaredCollector (e2e/review_pr_convergence_test.go) for review-pr + evolve
runtime.local-looplocal loop re-executes and versions artifactsruntimecovered-deterministicTestSingleModel_RefineLoop (e2e/e2e_test.go)
runtime.global-reloopglobal reloop restarts the recipe from an upstream noderuntimecovered-deterministicTestSingleModel_GlobalReloop (e2e/e2e_test.go)
runtime.loop-exhaustionloop cap exhaustion fails the run with LOOP_EXHAUSTEDruntimecovered-deterministicTestCIFix_LoopExhaustion (e2e/e2e_test.go), TestLoopExhaustionRuntimeError (pkg/runtime/hardening_test.go)
runtime.budget-costmax_cost_usd exceeded past the graced ceiling stops the run and emits budget_exceededruntimecovered-deterministicTestBudgetCostExceeded (pkg/runtime/budget_test.go)with the default grace on, 100% alone no longer stops a run — see runtime.budget-exit-grace
runtime.budget-tokensmax_tokens exceeded past the graced ceiling stops the runruntimecovered-deterministicTestBudgetTokensExceeded (pkg/runtime/budget_test.go)
runtime.budget-durationmax_duration exceeded past the graced ceiling stops the runruntimecovered-deterministicTestBudgetDurationExceeded (pkg/runtime/budget_test.go)
runtime.budget-warningbudget warning event at the soft threshold, advisory onlyruntimecovered-deterministicTestBudgetWarningEmitted (pkg/runtime/budget_test.go), TestWarnTokensAdvisoryNeverBlocks (pkg/runtime/budget_test.go)
runtime.budget-sharedbudget accounting shared across parallel branchesruntimecovered-deterministicTestBudgetSharedFirstComeFirstServed (pkg/runtime/budget_test.go)
runtime.budget-exit-gracea spent cap still walks FORWARD to a terminal node, inside a proportional ceiling, so banked work is deliveredruntimecovered-deterministicTestBudgetGraceDeliversBankedWork (pkg/runtime/budget_test.go), TestBudgetGraceIsBounded (pkg/runtime/budget_test.go), TestBudgetGraceCoversDuration (pkg/runtime/budget_test.go), TestBudgetGraceCoversImmediateRecordPath (pkg/runtime/budget_test.go), TestBudgetGraceEdgeErrorStillDiesOnBudget (pkg/runtime/budget_test.go)the delivery promise AND its bound: past cap × (1+ratio) the run fails as before, the duration axis gets a real graced deadline rather than none, and an in-grace overrun with no matching edge still dies as BUDGET_EXCEEDED (the sentinel the runner acks terminal). The fan-out path is its own row below
runtime.budget-exit-grace-refusalsthe grace is refused when the loop guard is off, when the ratio is 0, and on an externally-imposed cap; a bad ratio fails closedruntimecovered-deterministicTestBudgetGraceRefusedWhenLoopGuardOff (pkg/runtime/budget_test.go), TestBudgetGraceAbsoluteWhenZero (pkg/runtime/budget_test.go), TestBudgetGraceRefusedOnImposedCap (pkg/runtime/budget_test.go), TestBudgetGraceInvalidEnvFailsClosed (pkg/runtime/budget_test.go), TestBudgetClampToCeilingMarksImposedCap (pkg/dsl/ir/budget_ceiling_test.go)the safety half: the grace borrows "no further iteration" from the loop guard, and a cap clamped by the platform ceiling or a pool donor's allowance is absolute — the clamp choke point marking it is covered too
runtime.budget-exit-grace-eventevery graced node is auditable: one budget_exit_grace event naming the exceeded axis and its own used/limitruntimecovered-deterministicTestBudgetGraceEventIsCoherentAndSingular (pkg/runtime/budget_test.go)a deliberate overspend must be visible in the events, not discovered on the invoice — and the triple must not mix one dimension's ratio under another's name
runtime.budget-exit-grace-outranks-hard-limiton the SEQUENTIAL pre-exec path a granted grace decides and returns: the 90% hard limit on another axis gets no second opinionruntimecovered-deterministicTestBudgetGraceSurvivesHardLimitOnAnotherAxis (pkg/runtime/budget_test.go)the max_cost_usd + max_duration pairing late in a long run; refusing a node at 90% of axis B while permitting 110% of axis A would defeat the grace exactly where it matters. checkBudgetBeforeExec returns the grace verdict (pkg/runtime/budget.go:600-602)
runtime.budget-exit-grace-refused-in-branchesa parallel branch never receives the exit grace, and the wait_all death that follows still carries the BUDGET_EXCEEDED sentinelruntimecovered-deterministicTestBudgetGraceStopsBeforeFanOutBranches (pkg/runtime/budget_test.go), TestBudgetGraceFanOutWaitAllKeepsBudgetSentinel (pkg/runtime/budget_test.go)sibling spend lands on one shared budget concurrently, so no branch can price its own next node — the same reason predictive loop pricing is off there. checkPreExecBudget (pkg/runtime/branch.go) now refuses on exceeded and returns, so the earlier grace/hard-limit fall-through that could write a contradicting event pair is gone by construction. The stop-path shape matters as much as the refusal: a naked convergence error would go back to JetStream as retryable and loop resume/refail against the same spent cap
runtime.loop-budget-guarda loop back-edge the remaining budget cannot fund is declined, so the run leaves through its own exit path with the work it bankedruntimecovered-deterministicTestLoopBudgetGuard_FallsThroughToDeliveryTail (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_OffRestoresTheStrandingFailure (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_ConditionalBackEdgeIsNotPricedWhenItDoesNotMatch (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_IgnoresUnenforcedAxes (pkg/runtime/loop_budget_test.go)the guard the exit grace borrows its "no further iteration" half from; emits budget_warning with reason loop_budget_guard
runtime.loop-budget-guard-pricingan iteration is priced from the loop's own ENTRY and re-priced on re-entry, and the prices ride the checkpointruntimecovered-deterministicTestLoopBudgetGuard_LateEnteredLoopIsPricedFromItsEntry (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_ReEnteredLoopReBasesItsPrice (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_MarksSurviveResume (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_UnpricedLoopIsNotDeclined (pkg/runtime/loop_budget_test.go)so a second-phase or nested loop is never charged for the work that preceded it
runtime.loop-budget-guard-precedence--loop-budget-guard → workflow loop_budget_guard: → ITERION_LOOP_BUDGET_GUARD → on, and the run-level override travels onto the cloud queueruntimecovered-deterministicTestLoopBudgetGuard_PrecedenceChain (pkg/runtime/loop_budget_test.go), TestLoopBudgetGuard_WorkflowOffIsHonouredEndToEnd (pkg/runtime/loop_budget_test.go), TestValidateLoopBudgetGuardMode (pkg/runtime/loop_budget_test.go)C133 rejects an invalid mode
runtime.budget-unpriced-costa delegate that reports no cost is advertised as a FLOOR, not a total, rather than silently counting as $0runtimecovered-deterministicTestSharedBudget_UnpricedSpend (pkg/runtime/budget_test.go)the cost_usd_unpriced advisory documented in docs/dsl.md; warns at most once per run and never blocks
runtime.max-parallel-branchesmax_parallel_branches semaphore bounds concurrencyruntimecovered-deterministicTestFanOutEach_DAG_BoundedParallelism (pkg/runtime/fan_out_each_test.go)
runtime.branch-local-loopsloops/foreach inside parallel branches use independent durable counters, outputs, artifact allocations, human-resume cursors, and rewind invalidationruntimecovered-deterministicTestFanOutEachBranchLocalLoopsKeepIndependentCounters (pkg/runtime/branch_local_loop_test.go)also TestFanOutAllBranchLocalLoopRunsBeforeWaitAll, TestFanOutEachBranchLocalForeachUsesPrivateIndex, TestResolveLoopAndEachSeeEnclosingTrunkNamespaces, TestFanOutInsideTrunkLoopResolvesEnclosingPreviousOutput, TestFanOutInsideTrunkForeachResolvesEnclosingItem, TestFanOutEachBranchLocalLoopHumanResumeKeepsScope, TestFanOutEachSiblingHumanGatesResumeOneScopeAtATime, TestFanOutEachBranchCanPauseAtSequentialHumanGates, and TestRewind_PromotesFanOutBodyToRouter; race-covered
runtime.daily-cap-branch-resumea branch that pauses and resumes contributes BOTH passes' spend to the per-day cap ledgerruntimecovered-deterministicTestBranchDailyCapLedgerSurvivesResume (pkg/runtime/branch_local_loop_test.go), TestBranchDailyCapLedgerKeyStableAcrossSiblingResume (pkg/runtime/branch_local_loop_test.go), the BranchCheckpoint round-trip in pkg/store/storetest/conformance.gothe ledger key is <run>#<branch>#<loop-path> and AddSpend keeps the monotonic MAX per key; the loop path is restored from the checkpoint, so a resumed branch re-uses its pre-pause key even when sibling goroutine order changes. With branch-local cursors the resumed pass runs only the nodes after the gate, so an accumulator restarting at zero would be max()'d away and every post-resume dollar would vanish from the cap
runtime.workspace-safetyonly one mutating branch may run concurrentlyruntimecovered-deterministicTestWorkspaceSafetyRejectsDualMutation (pkg/runtime/budget_test.go)
runtime.checkpointa checkpoint is saved after every successful noderuntimecovered-deterministicTestCheckpointPreservesUpstreamOutputs (pkg/runtime/engine_test.go)
runtime.resume-failedresume from failed_resumable restarts at the failing noderuntimecovered-deterministicTestResumeFromFailed (pkg/runtime/engine_test.go), TestResumeDoesNotReplayUpstream (pkg/runtime/engine_test.go)
runtime.resume-hash-guardresume refuses a changed .bot unless --forceruntimecovered-deterministicTestForceResumeBypassesHashCheck (pkg/runtime/engine_test.go), pkg/runview/service_resume_hash_test.go
runtime.resume-humanresume a paused_waiting_human run with answersruntimecovered-deterministicTestHumanPauseAndResume (pkg/runtime/engine_test.go), TestResume_Success (pkg/cli/cli_test.go)
runtime.mission-receipt-casdurable mission resume claims one exact status and stamps its host receipt on run_resumed; rewind resolves a non-mutating final pivot, guards it before mutation, and stamps run_rewoundruntimecovered-deterministicTestResumeFromFailure_MissionClaimUsesExactStatusAndStampsReceipt (pkg/runtime/resume_failure_char_test.go), TestResolveRewindPivotIsNonMutatingAndGuardedReceiptIsAuditable (pkg/runview/rewind_test.go), TestSubmitResume_MissionExpectedStatusAndReceiptCrossPublisherCAS (pkg/server/cloudpublisher/publisher_resume_test.go)cloud publisher consumes expected status before queued; runner keeps receipt identity
runtime.cancelcancellation produces a cancelled status with a checkpointruntimecovered-deterministicTestCancelProducesCancelledStatus (pkg/runtime/hardening_test.go)
runtime.timeoutouter deadline produces a TIMEOUT failureruntimecovered-deterministicTestTimeoutProducesFailedStatus (pkg/runtime/hardening_test.go)
runtime.interaction-modeshuman interaction: llm / llm_or_human / async escalationruntimecovered-deterministicTestInteractionLLMOrHumanEscalation (pkg/runtime/engine_test.go), TestInteractionLLMAutoRespond (pkg/runtime/engine_test.go)
runtime.async-backend-capabilityasync nodes refuse incapable primary/fallback routes and Pi print transport before dispatch, without retriesruntimecovered-deterministicpkg/dsl/ir/async_backend_test.go, pkg/backend/model/async_backend_test.go, TestCapabilityUnsupportedDoesNotRetry (pkg/runtime/recovery/capability_test.go)
runtime.ask-user-conversationask_user relays prior Q/A and persists the conversationruntimecovered-deterministicTestInteractionAskUserPersistsConversation (pkg/runtime/engine_test.go)
runtime.worktree-finalizeworktree: auto creates a branch and fast-forwards the checkoutruntimecovered-deterministicpkg/runtime/worktree_test.go
runtime.worktree-early-refusalterminal compute/fail refusal releases a pristine checkout and rewind restores its original baselineruntimecovered-deterministicpkg/runtime/worktree_refusal_test.go, pkg/runview/rewind_reclaimed_test.go
runtime.rewinditerion rewind re-anchors a run and invalidates downstream stateruntimecovered-deterministicTestRewindThenResume_SkipsUpstreamNodes (e2e/rewind_resume_test.go)
runtime.run-document-concurrencyrename and rewind refuse stale document writes instead of overwriting a concurrent resumeruntimecovered-deterministicTestRenameDoesNotUndoConcurrentResume (pkg/runview/run_version_test.go), TestRewindDoesNotOverwriteConcurrentResume (pkg/runview/run_version_test.go), TestRewindDoesNotOverwriteCheckpointAfterFinalSave (pkg/runview/run_version_test.go)Shared FS/Mongo SaveRunVersionConflicts conformance and cross-store FS contention pin the persistence boundary. A rewind conflict after file restoration does not roll files back.
runtime.rewind-workspacerewind restores workspace files for non-worktree runs, scoped to what the run recorded changing (issue #380)runtimecovered-deterministicTestRewindRestoresWorkspaceEndToEnd (e2e/rewind_workspace_test.go)
runtime.rewind-workspace-failed-nodea node that dies mid-execution still has its debris undone, via the fail: boundaryruntimecovered-deterministicTestRewindScopeCoversAFailedNodesDebris (e2e/rewind_workspace_test.go)
runtime.rewind-workspace-stop-windowedits made while a run is stopped (fail → triage → resume, a human gate, a delegate ask_user pause) are not attributed to the runruntimecovered-deterministicTestRewindAfterResumeKeepsTriageEdits, TestRewindScopeAfterHumanGatePause, TestRewindScopeAfterDelegatePause (e2e/rewind_workspace_test.go)
runtime.forkfork a run at a prior LLM turn into a resumable child runruntimecovered-deterministicpkg/runview/fork_test.go
runtime.event-streamevent sequence coherence (ordering, pairing, monotonic seq)runtimecovered-deterministicTestEventSequenceCoherence (e2e/e2e_test.go)
runtime.artifact-versioningrepeated node executions version their artifactsruntimecovered-deterministicTestSingleModel_GlobalReloop (e2e/e2e_test.go)
runtime.publish-gateonly a publish:-declared node leaves an artifactruntimecovered-deterministicTestOnlyAPublishedNodeLeavesAnArtifact (e2e/handoff_publish_test.go)
runtime.skills-mirrorbundle/plugin/library skills mirrored into .claude/skills/runtimecovered-deterministicTestMirrorBundleSkills_CopiesIntoClaudeSkills (pkg/runtime/bundle_test.go)
runtime.devbox-provisiona bot's/target's devbox.json is installed and put on PATHruntimecovered-deterministicTestEngineRun_HostDevbox_RepoProjectInstallsInPlace (pkg/runtime/devbox_host_test.go)
runtime.subbot-depth-guardnested subbot recursion depth guardruntimecovered-deterministicTestSubbotRunnerForCLI_RecursionDepthGuard (pkg/cli/subbot_nested_test.go)
runtime.supervisorsupervisor steers a watched node via the message inboxruntimecovered-liveTestLive_Feat_Supervisor (e2e/live_feat_supervisor_test.go)the composed steer decision is LLM-driven (Coordinator → GenerateObjectDirect), so only the live layer exercises the full watch→decide→inject path; the bricks are unit-tested (pkg/supervise/coordinator_test.go, pkg/backend/model/inbox_test.go)
runtime.recovery-dispatchadaptive recovery ladder for verified action nodesruntimecovered-deterministicTestVerifiedActionEngineEmitsAndStrips (e2e/verified_action_test.go), pkg/backend/model/executor_verified_action_test.go
runtime.privacy-redactionsecret/PII redaction across the run pipelineruntimecovered-deterministicTestE2E_PrivacyPipeline (e2e/privacy_test.go)
persistence.run-jsonrun.json metadata, status transitions, format versionpersistencecovered-deterministicTestFormatVersionPersisted (pkg/runtime/hardening_test.go), pkg/store/store_test.go
persistence.events-jsonlevents.jsonl append + monotonic seq + replaypersistencecovered-deterministicpkg/store/store_test.go
persistence.artifactsversioned per-node artifacts under artifacts/persistencecovered-deterministicpkg/store/store_test.go
persistence.interactionsinteraction records (questions/answers) persisted per runpersistencecovered-deterministicTestAwaitAnswersAlreadyAnswered (e2e/async_interaction_test.go), pkg/store/store_test.go
persistence.child-runsparent/child run lineage for subbotspersistencecovered-deterministicTestRunSubbotsPersistNestedLineage (pkg/cli/run_subbot_test.go)
persistence.workspace-versioningcontent-addressed workspace snapshots + restorepersistencecovered-deterministicpkg/workspacetrack/native_test.go
persistence.store-anchoringstore dir resolution (project .iterion vs $ITERION_HOME/projects)persistencecovered-deterministicTestStoreAnchorDir_BotInsideProjectResolvesProjectStore (pkg/cli/storeanchor_test.go)
persistence.mongo-storecloud Mongo-backed run store conformancepersistencecovered-deterministicTestConformance_Mongo (pkg/store/mongo/conformance_test.go)CI job mongo-conformance; skips without a Mongo endpoint. The board (kanban) Mongo store is a different contract — see dispatcher.native-tracker
persistence.mongo-future-fieldsan older replica renames a run without truncating additive run/checkpoint/branch fields; intentional deletes, stale saves and future schema versions remain guardedpersistencecovered-deterministicTestSaveRunPreservesFutureStateAcrossOldReaderRename, TestSaveRunRefusesStaleCopyWithFutureState, TestSaveRunRefusesFutureSchema (pkg/store/mongo/runs_unknown_test.go)Real Mongo under mongo-conformance; includes BSON type preservation and reordered edge records. Skips without a Mongo endpoint.
cli.validateiterion validate parses, compiles and reports diagnosticsclicovered-deterministicTestValidate_Valid (pkg/cli/cli_test.go), TestValidate_Invalid (pkg/cli/cli_test.go)
cli.validate-bundleiterion validate cross-checks a bundle manifest (C2xx)clicovered-deterministicTestRunValidate_BundleVarTypoWarns (pkg/cli/validate_bundle_test.go)
cli.runiterion run executes a .bot and persists the runclicovered-deterministicTestRun_Success (pkg/cli/cli_test.go)
cli.run-varsiterion run --var key=value overrides workflow varsclicovered-deterministicTestRun_WithVars (pkg/cli/cli_test.go)
cli.run-presetiterion run --preset applies an in-source preset, --var wins over itclicovered-deterministicTestRunPresetAppliesValuesAndVarWins (e2e/cli_launch_overrides_test.go)
cli.run-budget-overrideiterion run --max-* re-budgets the workflow for this runclicovered-deterministicTestRunBudgetOverrideCapsTheRun (e2e/cli_budget_override_test.go)
cli.run-model-backend-overrideiterion run --model/--backend selector=… re-target nodesclicovered-deterministicTestRunBackendOverrideRetargetsNodes (e2e/cli_model_backend_override_test.go), TestRunModelOverrideRetargetsNodes (e2e/cli_model_backend_override_test.go)drives the REAL ClawExecutor (no stub) against fixtures whose backend/model cannot resolve, so the resolved value is readable from the failure text — credential-free and offline (unknown backend dies at registry lookup, unknown provider inside claw's spec parse)
cli.run-human-pauseiterion run returns at a human pause (--no-interactive)clicovered-deterministicTestRun_HumanPause (pkg/cli/cli_test.go)
cli.run-json--json machine output mode for runclicovered-deterministicTestRun_SuccessJSON (pkg/cli/cli_test.go)
cli.run-recipeiterion run --recipe <file> applies a recipe overlayclicovered-deterministicTestRunRecipeAppliesPresetVarsAndVarStillWins (e2e/cli_recipe_test.go), TestRunRecipeBudgetOverridesTheWorkflowBudget (e2e/cli_recipe_test.go), TestRunRecipeRefusesAMismatchedWorkflow (e2e/cli_recipe_test.go), TestRunRecipeRefusesAnUnloadableFile (e2e/cli_recipe_test.go)preset vars reaching the run, --var precedence over the recipe, workflow_ref.path resolving the .bot, the recipe budget changing the run outcome, and the mismatch/unloadable refusals
cli.run-auto-resume--auto-resume N re-drives a retryable failed_resumable runclicovered-deterministicTestRunAutoResumeRecoversRetryableFailure (e2e/cli_auto_resume_test.go), TestRunAutoResumeStaysOffByDefault (e2e/cli_auto_resume_test.go), TestRunAutoResumeRefusesNonRetryableCause (e2e/cli_auto_resume_test.go), TestRunAutoResumeStopsAtTheAttemptBudget (e2e/cli_auto_resume_test.go)no clock seam needed: a USAGE_LIMIT_BLOCKED cause takes the reset-aware wait, which the run's own Retry policy (the field iterion schedule sets) clamps — a 1ms horizon collapses it, so the whole suite runs in <0.5s
cli.resumeiterion resume continues a paused/failed/cancelled runclicovered-deterministicTestResume_Success (pkg/cli/cli_test.go)
cli.resume-answers-fileiterion resume --answers-file / --answer @fileclicovered-deterministicTestResolveFileAnswerFlags_AttachesLocalFile (pkg/cli/resume_file_answers_test.go), TestParseAnswersFile (pkg/cli/cli_test.go)
cli.resume-subbotresume a run that owns subbot childrenclicovered-deterministicTestResume_RunWithSubbot (pkg/cli/resume_subbot_test.go)
cli.inspectiterion inspect lists runs and shows a run's stateclicovered-deterministicTestInspect_ListRuns (pkg/cli/cli_test.go), TestInspect_SingleRun (pkg/cli/cli_test.go)
cli.inspect-eventsiterion inspect --events renders the stored event streamclicovered-deterministicTestInspect_WithEvents (pkg/cli/cli_test.go)
cli.inspect-nodeiterion inspect --node per-node trace/artifacts/log sectionsclicovered-deterministicTestInspect_SectionTrace (pkg/cli/cli_test.go), TestInspect_SectionArtifactsIncludesBody (pkg/cli/cli_test.go)
cli.reportiterion report renders a run's chronological markdown reportclicovered-deterministicTestReportRendersChronologicalRunReport (e2e/cli_report_test.go), TestReportHonoursOutputPathAndJSON (e2e/cli_report_test.go)
cli.diagramiterion diagram emits a Mermaid graph for a .botclicovered-deterministicTestDiagramRendersEveryNodeAndEdgeOfTheWorkflow (e2e/cli_diagram_test.go), TestDiagramViewsDifferAndUnknownViewIsRefused (e2e/cli_diagram_test.go), TestDiagramJSONCarriesTheRenderedGraph (e2e/cli_diagram_test.go)every node + edge of e2e/testdata/diagram_mini.bot, the condition/loop/mapping labels, the compact↔detailed↔full deltas, and the typo'd --view refusal
cli.runs-pruneiterion runs prune age/status/keep-last retention + dry-runclicovered-deterministicTestRunPrune_AgeFiltering (pkg/cli/runs_prune_test.go), TestRunPrune_DryRunDeletesNothing (pkg/cli/runs_prune_test.go)
cli.runs-async-questionsiterion runs questions / runs answer drive an async question to deliveryclicovered-deterministicTestRunsQuestionsThenAnswerReleasesAwaitGate (e2e/cli_async_questions_test.go), TestRunsAnswerRejectsBadInput (e2e/cli_async_questions_test.go)
cli.forkiterion fork creates a resumable fork at a prior turnclicovered-deterministicpkg/runview/fork_test.goCLI layer is a thin wrapper over runview.Service.Fork
cli.rewinditerion rewind (incl. --auto bot-diff targeting)clicovered-deterministicTestRewind_RefusesRunningRun_E2E (e2e/rewind_resume_test.go)
cli.importiterion import lowers a Claude-Code workflow script to a draft .botclicovered-deterministicTestRunImport_WritesDraft (pkg/cli/import_test.go)
cli.bots-listiterion bots list discovers .bot/.botz bundlesclicovered-deterministicTestBotsList_Bundle (pkg/cli/bots_test.go)
cli.bots-createiterion bots create scaffolds a discoverable bundleclicovered-deterministicTestBotsCreate_ProducesDiscoverableBundle (pkg/cli/bots_create_test.go)
cli.bots-create-shapes--template <shape> renders a complete workflow of that form (bounded loop, reviewer fan-out, human gate, verified action, …) with its annex files, compiled through the bundle loader and held to its formclicovered-deterministicTestGalleryShapes (pkg/botscaffold/shapes_test.go)
cli.bots-regen-catalogiterion bots regen-catalog regenerates Nexie's catalog skillclicovered-deterministicbots/catalog_freshness_test.go
cli.bundle-packiterion bundle pack produces a loadable .botzclicovered-deterministicTestBundle_SecAuditSource_PackOpenCompile (e2e/bundle_sec_audit_source_test.go)
cli.marketplaceiterion marketplace submit/install/uninstall (bot + plugin kinds)clicovered-deterministicTestMarketplaceCLI_SubmitInstallUninstall_KindAware (pkg/cli/marketplace_test.go)
cli.pluginiterion plugin list/enable/disable/install/uninstall/configclicovered-deterministicpkg/plugin/install_test.go, pkg/plugin/config_test.go
cli.skill-libraryiterion skill list/show/add/rm/export (layered global/project)clicovered-deterministicTestSkillLibraryAddListShowExportRemove (e2e/cli_skill_test.go), TestSkillLibraryProjectScopeShadowsGlobal (e2e/cli_skill_test.go)round-trip against an isolated ITERION_HOME, cross-checked through the same skilllib.LocalStoreForProject().Resolve the runtime mirror calls. skill import (git URL) is covered as plugins.install
cli.secretiterion secret set/list/rm local sealed-secret lifecycleclicovered-deterministicTestSecretSetListRemoveRoundTrip (e2e/cli_secret_test.go), TestSecretProjectScopeOverridesGlobal (e2e/cli_secret_test.go)
cli.memoryiterion memory export/import/duclicovered-deterministicTestMemoryExportImportRoundTripsASpace (cmd/iterion/memory_test.go), TestMemoryImportStrategyDecidesWhoWinsOnConflict (cmd/iterion/memory_test.go), TestMemoryDuReportsTheSpaceUsageAndQuota (cmd/iterion/memory_test.go), TestMemoryRefusesAnUnaddressableSpace (cmd/iterion/memory_test.go)archive round-trip into a different space, the skip/overwrite conflict strategies, usage/quota reporting, and the unaddressable-space refusal — all through the real rootCmd against an isolated ITERION_HOME
cli.modelsiterion models resolves capabilities and their sourceclicovered-deterministicTestRunModels_JSONSingleModel (pkg/cli/models_test.go)
cli.openapiiterion openapi emits this build's OpenAPI 3.1 spec offlineclicovered-deterministicpkg/server/openapi_test.go
cli.scheduleiterion schedule add/list/remove/install/uninstall crontab manifestclicovered-deterministicTestRunScheduleAddListRemove (pkg/cli/schedule_test.go), TestRunScheduleInstallUninstall_SeamRoundTrip (pkg/cli/schedule_test.go)
cli.schedule-gateschedule overlap policy + pre-launch guard + tick auditclicovered-deterministicTestScheduleRun_OverlapSkipsAndAuditsBlockingRun (pkg/cli/schedule_gate_test.go), TestScheduleRun_GuardNonZeroBlocks (pkg/cli/schedule_gate_test.go)
cli.issueiterion issue create/list/show/move/update/close/boardclicovered-deterministicTestIssueCLILifecycleCreateMoveUpdateClose (e2e/cli_issue_test.go), TestIssueCloseRefusesABoardWithNoTerminalState (e2e/cli_issue_test.go)create → list/show → move → update → close read back through a fresh native.Store, plus the events.jsonl audit trail
cli.issue-importiterion issue import pulls forge issues onto the boardclicovered-deterministicTestRunIssueImport_CreatesCardsAndIsIdempotent (e2e/cli_issue_import_test.go), TestRunIssueImport_RejectsUnsupportedForge (e2e/cli_issue_import_test.go)drives the real CLI against a fake forge, then re-opens the board through a FRESH store: the cards that landed are the oracle, and a re-import proves idempotence
security.disable-auth-switchITERION_DISABLE_AUTH bypasses authentication on every /api/* endpointserver-apicovered-deterministicTestDisableAuthSwitchGovernsEveryProtectedRoute (pkg/server/disable_auth_switch_test.go)both positions asserted as one contract — only the PAIR is meaningful, since pinning one alone passes for a switch welded shut
security.origin-gateevery state-changing /api route refuses a foreign Origin (403), while same-origin, loopback, wails and no-Origin callers passserver-apicovered-deterministicTestEveryStateChangingAPIRouteRefusesForeignOrigin (pkg/server/origin_gate_sweep_test.go), TestOriginGateAdmitsLegitimateCallers (pkg/server/origin_gate_sweep_test.go), TestOriginGateSweepBites (pkg/server/origin_gate_sweep_test.go), TestKillSwitchReachesHandlerLevelCallsToo (pkg/server/origin_gate_observability_test.go), TestSameWSOrigin (pkg/server/hub_origin_test.go)the CSRF boundary, and the promise is "every route", so the sweep reads the LIVE routing table (174 rows) instead of a hand-kept list — a route added tomorrow is asserted with no edit here. Driven through the composed srv.handler, so it proves the gate is WIRED and not merely correct. Two properties keep it honest: it names the endpoints it exists for (a refactor that stops registering them fails rather than silently shrinking the sweep), and …SweepBites flips ITERION_REQUIRE_ORIGIN=0 to prove the 403s come from the gate rather than from some other refusal. The kill switch is asserted on BOTH callers, because it is read inside requireSafeOrigin rather than in the middleware: ~70 handlers call that directly, and a switch reaching only the middleware left the documented emergency rollback working for some routes and silently not for run cancel/merge, project writes, platform settings, bot sources and marketplace writes
security.origin-gate-diagnosticsa refusal is logged naming method/path/Origin (at info, so it cannot evict Sentry breadcrumbs), an admitted request logs nothing, and ITERION_ALLOWED_ORIGINS names extra hosts — normalised the way a browser serialises an Origin, malformed entries reported rather than droppedserver-apicovered-deterministicTestOriginGateNamesWhatItRefused (pkg/server/origin_gate_observability_test.go), TestOriginGateStaysQuietWhenItAdmits (pkg/server/origin_gate_observability_test.go), TestRefusalLogCannotForgeARecord (pkg/server/origin_gate_observability_test.go), TestRefusalLogIsBounded (pkg/server/origin_gate_observability_test.go), TestExtraAllowedOriginsAdmitsASecondPublicHost (pkg/server/origin_gate_observability_test.go), TestExtraAllowedOriginsIsOffByDefault (pkg/server/origin_gate_observability_test.go), TestExtraAllowedOriginsReachesTheGateOnTheCloudServerToo (pkg/server/origin_gate_observability_test.go), TestMalformedAllowedOriginIsReportedNotSwallowed (pkg/server/origin_gate_observability_test.go), TestRefusalDoesNotFireTheLogHook (pkg/server/origin_gate_observability_test.go), TestRefusalIsLoggedAtInfoExactly (pkg/server/origin_gate_observability_test.go), TestAllowlistEntriesAreNormalisedTheWayABrowserSerialisesAnOrigin (pkg/server/origin_gate_observability_test.go), TestWildcardOriginIsRefusedLoudly (pkg/server/origin_gate_observability_test.go), TestTrailingSlashIsAcceptedNotScolded (pkg/server/origin_gate_observability_test.go)the gate answers the caller and nothing else, so "nothing legitimate is refused" and "we cannot see one" were the same empty grep — which is how the board-MCP no-Origin claim stayed an inference. The env-var half drives the WHOLE chain from BOTH constructors (env → New / BrowserGuard → allowlist → verdict on a real request): asserting the parser alone stays green with the wiring deleted, and pinning only BrowserGuard leaves the cloud server — the surface the variable exists for — free to regress to inert while green. Both log values go through logSafe and NOT %q, whose escaping would neutralise a CRLF on its own and mask a removed sanitiser — the first version of the forging test did exactly that and passed inert. Normalisation is asserted through the GATE and over PublicURL as well as the env var, since both build an entry from a URL and matching is ==: an entry that merely parses is not an entry that works. The LEVEL is pinned in both directions rather than left to the call site, because it is written down in docs an operator greps by: at warn the refusal would evict Sentry breadcrumbs, below info it is invisible in production, and a runbook naming the wrong level rebuilds the false negative the line exists to kill
security.cookie-host-prefixsession cookies carry __Host-, so a sibling host under a shared registrable domain cannot toss one; legacy bare-named sessions still authenticate through the migrationserver-apicovered-deterministicTestHostPrefixOnProductionCookieShape (pkg/server/auth_cookie_prefix_test.go), TestHostPrefixWithheldWhenItsTermsCannotBeMet (pkg/server/auth_cookie_prefix_test.go), TestPrefixedCookieWinsOverATossedBareCookie (pkg/server/auth_cookie_prefix_test.go), TestHostPrefixedSessionRoundTrip (pkg/server/auth_cookie_prefix_test.go), TestClearAuthCookiesExpiresBothSpellings (pkg/server/auth_cookie_prefix_test.go)covers the shape production runs (Secure + no Domain), which the older TestSetAuthCookiesAttributes never exercised — both its cases fall outside the prefix's terms, so they passed whichever way this resolved. The round trip is the composition guard: register through the real handler, replay the minted cookie on /api/auth/me. Write-only and read-only tests would both stay green if the two disagreed on the name
security.response-headersthe studio serves nosniff / Referrer-Policy / X-Frame-Options / Permissions-Policy and an enforced CSP, on served AND short-circuited responsesserver-apicovered-deterministicTestSecurityHeadersOnDocuments (pkg/server/middleware_security_headers_test.go), TestSecurityHeadersRideShortCircuitedResponses (pkg/server/middleware_security_headers_test.go), TestSecurityHeadersKillSwitch (pkg/server/middleware_security_headers_test.go), studio/e2e/specs/security-headers.spec.tsscript-src is asserted by exact source list, not substring: 'unsafe-inline' there would turn an injected string back into running code. The kill-switch test proves the headers come from THIS middleware and not from a layer that happens to set them. Browser half in studio-ui.csp
studio-ui.dsl-vocabularyMonaco paints every generated lexer keyword and registered property, list markers and arrow chains while preserving prompt textstudio-uicovered-deterministicstudio/src/lib/iterLanguage.test.ts, TestGeneratedDSLDocsAreFresh (pkg/dsl/spec/docs_fresh_test.go)The real Monarch engine consumes the generated module; dsl:check compares it with the parser registry.
studio-ui.cspthe SPA boots and mounts Monaco under the enforced CSP with zero violations and zero third-party-CDN requestsstudio-uicovered-deterministicstudio/e2e/specs/security-headers.spec.tsthe only honest oracle for a CSP is a browser: a policy is worth its directives only if the app still works under it. Real chromium against the real binary. It also pins the editor's self-hosting — Monaco used to be fetched from cdn.jsdelivr.net at runtime — and asserts the editor actually rendered the fixture's source, so a blank page (what a too-strict CSP produces) cannot pass
security.origin-gate-dispatcheriterion dispatch's own mux refuses a cross-origin state-changing POST while still serving its board UI and no-Origin callersclicovered-deterministicTestDispatchDaemonRefusesCrossOriginWrites (e2e/cli_dispatch_daemon_test.go)the daemon builds its HTTP surface by hand rather than through Server.routes(), so the studio's protections reached none of it — a drive-by page could create a board card, move it into the dispatcher-eligible state and force the poll, which runs a workflow with tools on the host. Drives the real daemon over loopback; reverting the BrowserGuard wrap reproduces the 201/202 an adversarial review measured live
security.agent-binding-cookiesthe per-flow OIDC / forge binding cookies (RFC 9700 §4.7.1 login-CSRF guard) carry __Host-, refuse a tossed bare cookie outright, and clear both spellingsserver-apicovered-deterministicTestAgentBindingCookiesCarryTheHostPrefix (pkg/server/agent_binding_cookie_test.go), TestTossedAgentBindingCookieIsRefused (pkg/server/agent_binding_cookie_test.go), TestAgentBindingCookiesClearBothSpellings (pkg/server/agent_binding_cookie_test.go)these were left bare on the in-code reasoning that a cross-site script "can't set a cookie for iterion's origin" — the claim a shared registrable domain falsifies. No legacy fallback here, deliberately: an interrupted flow is a re-login, a defeated CSRF guard is an account takeover
security.desktop-cookie-handoffthe desktop harvests a rotated refresh token, and strips the cloud's session cookies from its webview, under either cookie spellingclicovered-deterministicTestCloudLoginHarvestsEitherCookieSpelling (cmd/iterion-desktop/cloud_cookie_prefix_test.go), TestHarvestRefreshCookieMatchesBothSpellings (cmd/iterion-desktop/cloud_cookie_prefix_test.go), TestProxyStripsBothSpellingsFromTheWebview (cmd/iterion-desktop/cloud_cookie_prefix_test.go)the row exists because a private copy of the cookie literal drifted from the server's: the harvest silently returned "", the jar kept the PREVIOUS token, and replaying it made the server revoke every session that user held, on every device, on a ~13-minute loop. The fake cloud is parameterised over both spellings — it only ever emitted the bare one, which is why nothing caught it
studio-ui.first-paintthe editor stays off the critical path: the runs list does not fetch Monaco, and opening the editor doesstudio-uicovered-deterministicstudio/e2e/specs/first-paint.spec.tsmeasured in the browser, not read off the bundle — a chunk name in the entry file may be a lazy import() specifier. Both halves are asserted so "lazy" cannot degrade into "never": one static import from app chrome had put 4.2 MB of JS plus a render-blocking 158 KB stylesheet on every page
cli.sandbox-doctoriterion sandbox doctor [--strict] host/run pre-flight diagnosisclicovered-deterministicTestRunSandboxDoctorStrictNoSandbox (pkg/cli/sandbox_strict_test.go), TestRunNetworkStrictChecks (pkg/cli/sandbox_strict_test.go)
cli.studioiterion studio boots the server and reports its portclicovered-deterministicTestRunStudio_OnReady_RandomPort (pkg/cli/studio_test.go), TestIsLoopbackBindHost (pkg/cli/studio_bind_test.go)
cli.serveriterion server boots the HTTP server without the studio launcherclicovered-deterministicTestServerCommandBootsLocalModeAndShutsDownOnSignal (e2e/cli_server_boot_test.go), TestServerCommandFailsLoudlyOnBusyPort (e2e/cli_server_boot_test.go)spawns the built binary as a subprocess and signals THAT child (not the test binary), so the daemon-SIGTERM aliasing of cli.dispatch is not reproduced
cli.runneriterion runner boots a cloud runner pod from its configclicovered-deterministicTestRunnerCommandRefusesLocalMode (e2e/cli_server_boot_test.go), TestRunnerCommandRefusesBrokenConfig (e2e/cli_server_boot_test.go)the entry-point posture (mode gate + config loader) is what is deterministic; the claim/execute loop IS a NATS/Mongo/S3 consumer and is covered by cloud.runner-pod
cli.bots-templatesiterion bots templates lists the templates bots create acceptsclicovered-deterministicTestBotsTemplates_MatchesStudioGallery (pkg/cli/bots_create_test.go)pins the CLI list against botscaffold.Templates(), the same source the studio gallery renders
bots.installbot bundle install from a git URL or local path (layout validation, name override, existing-needs-force)botscovered-deterministicTestInstall_SingleBundleRoot (pkg/botinstall/install_test.go), TestInstall_MalformedRejected (pkg/botinstall/install_test.go), TestInstall_ExistingNeedsForce (pkg/botinstall/install_test.go)iterion bots install and the studio install endpoint are both thin wrappers over this core
plugins.lifecycle-runiterion plugin run <name> <phase> executes a plugin's lifecycle commandpluginscovered-deterministicTestRunLifecycle (pkg/plugin/lifecycle_test.go), pkg/server/plugins_routes_test.go
cli.dispatchiterion dispatch daemon boots from a config with the bot catalogueclicovered-deterministicTestDispatchDaemonBootsServesAndStopsOnSignal (e2e/cli_dispatch_daemon_test.go), TestDispatchDaemonFailsLoudlyOnABusyPort (e2e/cli_dispatch_daemon_test.go), TestDispatchDaemonRejectsAnInvalidConfig (e2e/cli_dispatch_daemon_test.go)in-process boot on a temp store + loopback port: asserts /healthz, the server-info advertisement, the started actor's state and the YAML it runs, the mounted native-board routes, then the SIGTERM clean exit and the non-zero exit on a bind failure
cli.migrate-to-clouditerion migrate to-cloud local store → Mongo/S3clicovered-deterministicTestMigrateToCloud_TransfersEveryVersionAndIsIdempotent (cmd/iterion/migrate_to_cloud_test.go), TestMigrateToCloud_DryRunWritesNothing (cmd/iterion/migrate_to_cloud_test.go), TestMigrateToCloud_MissingRunIsAnError (cmd/iterion/migrate_to_cloud_test.go), pkg/cli/migrate_orgs_test.go, pkg/cli/migrate_run_paths_test.gothe command's own walker between two real stores (every artifact version, --dry-run writes nothing, re-runs don't duplicate, an unknown run is an error), plus the sibling migrate orgs backfill and run-path rewrite. The S3 upload half is cloud.migrate-blobs
cli.mcp-serveriterion mcp operator MCP server (local_/remote_ tools)clicovered-deterministicTestMCPServer_DetachedRunSurvivesServerExit (e2e/mcp_server_test.go), pkg/operatormcp/tools_local_test.go
cli.superviseiterion supervise attaches to a managed run or a raw claude sessionclicovered-deterministicpkg/supervise/coordinator_test.go, pkg/supervise/transcript_test.go
cli.remoteiterion remote typed subcommands against a cloud instanceclicovered-deterministicTestRemoteRunsLaunch_SendsSourceAndVars (pkg/cli/remote_test.go), TestRemoteRunsFollow_CursorAndTerminal (pkg/cli/remote_test.go)
cli.remote-assistant-mission`iterion remote runs mission startgetliststop` exposes the durable target-scoped mission API and JSON outputcli
cli.remote-loginbrowser loopback CLI-auth token mint + persistenceclicovered-deterministicTestResolveRemoteConfig_EnvMode (pkg/cli/remote_test.go), pkg/server/auth_routes_test.go
cli.versioniterion version [--commit]clicovered-deterministiccmd/iterion/version_test.go
cli.bench-asymptoteiterion bench asymptote convergence benchmarkclicovered-deterministicTestBenchAsymptoteMeasuresTheConvergenceCurve (e2e/cli_bench_asymptote_test.go), TestBenchAsymptoteComparesTwoGroups (e2e/cli_bench_asymptote_test.go), TestBenchAsymptoteWritesTheMarkdownReport (e2e/cli_bench_asymptote_test.go), TestBenchAsymptoteRefusesAnIncompleteRequest (e2e/cli_bench_asymptote_test.go)the command re-runs nothing — it derives the curve from what past runs persisted — so real stub-driven runs of a judge-in-a-loop fixture supply the same events an operator's runs would
backends.selection-explicitnode backend: / workflow default_backend: selects the delegatebackendscovered-deterministicpkg/backend/model/resolve_backend_test.go
backends.autodetectcredential probing picks a backend when none is declaredbackendscovered-deterministicpkg/backend/detect/detect_test.go, pkg/backend/model/resolve_backend_test.golive variant: TestLive_Feat_BackendAutodetect
backends.clawclaw in-process client: generation, retry, cache observabilitybackendscovered-deterministicpkg/backend/model/claw_backend_test.go, pkg/backend/model/generation_test.goreal-provider behaviour: covered-live by TestLive_Lite_ClawComprehensive
backends.claude-codeclaude_code CLI delegate: append-system-prompt, setting sourcesbackendscovered-deterministicpkg/backend/delegate/claude_code_cred_test.go
backends.pipi delegate incl. the RPC session + embedded extensionbackendscovered-deterministicpkg/backend/delegate/pi_rpc_test.go, pkg/backend/delegate/pi_mcp_test.go
backends.kimikimi CLI delegate through the generic CLI-agent seambackendscovered-deterministicpkg/backend/delegate/cliagent_test.go
backends.grokgrok CLI delegate through the generic CLI-agent seambackendscovered-deterministicpkg/backend/delegate/grok_test.go
backends.codexCodex CLI delegate and supported DSL selection, including explicit native web_searchbackendscovered-livepkg/dsl/ir/compile_test.go, pkg/backend/delegate/delegate_test.go, pkg/backend/delegate/codex_web_search_test.go, TestLive_Feat_CodexWebSearcha real hosted search cannot be exercised deterministically without a provider credential and network; the live test proves current URLs + readonly write refusal + WebSearch lifecycle, while deterministic tests pin live/disabled config, distinct WebSearch/Bash names, and incompatible-version refusal
backends.system-prompt-compositionper-backend SystemPromptMode (Standalone/Append/AuthoredBase)backendscovered-deterministicpkg/backend/delegate/delegate_test.go
backends.reasoning-effortreasoning_effort propagation and wire remappingbackendscovered-deterministicpkg/backend/model/effort_test.go
backends.ultracodeultracode mode: xhigh + orchestration prerogative + C089backendscovered-deterministicpkg/dsl/ir/ultracode_test.go, pkg/backend/model/effort_test.golive behaviour on 4.8: TestLive_Feat_Ultracode
backends.retry-classificationtransient vs fatal backend errors, retry + feedbackbackendscovered-deterministicpkg/backend/model/executor_retry_classification_test.go, pkg/backend/model/network_retry_test.go
backends.cost-accountingper-call cost/token accounting reaching the run totalsbackendscovered-deterministicTestMetricsEmitter_delegateFinished_costReachesRunTotals (pkg/runner/metrics_test.go), TestMetricsEmitter_clawCostIsNotCountedTwice (pkg/runner/metrics_test.go), TestRunBudgetOverrideCapsTheRun (e2e/cli_budget_override_test.go), pkg/backend/cost/cost_test.go, pkg/backend/model/executor_hooks_cost_test.gothe whole money path: the delegate prices a call, the executor carries it on the event, the emitter accumulates it into RunTotals (and does NOT double-charge claw, which emits both a step and a delegation total), and the accumulated cost is what trips the run's own budget cap
backends.oauth-forfaitsubscription OAuth paths (Anthropic auth token, ChatGPT codex)backendscovered-deterministicpkg/backend/model/openai_forfait_ctx_test.go, pkg/secrets/subscription_oauth_test.gocredential resolution is deterministic; a real forfait call is excluded (needs a live subscription)
backends.bedrock-vertex-foundryAWS Bedrock / GCP Vertex / Azure Foundry providersbackendsexcludedneeds real cloud credentials for AWS/GCP/Azure; claw's SDK paths are unit-tested with mocked clients and iterion adds no logic of its own
backends.model-qualityreal model output quality / value-for-money gradingbackendscovered-livee2e/live_quality_test.gothe essence of the feature IS the live model; the judge panel is report-only by default
tools-mcp.tool-registrytool registry + per-node allow lists (claw-native names)tools-mcpcovered-deterministicpkg/backend/tool/registry_test.go
tools-mcp.claw-builtinsclaw built-in tools (read/write/bash/glob/grep/edit/web_fetch)tools-mcpcovered-deterministicpkg/backend/tool/claw_builtins_test.golive variant: TestLive_Lite_ClawBuiltinTools
tools-mcp.mcp-lifecycleMCP server startup, health check and --skip-mcp-healthtools-mcpcovered-deterministicpkg/backend/mcp/config_test.go, TestSkipMCPHealthFromEnv (pkg/cli/run_skipmcp_test.go)
tools-mcp.mcp-transportsMCP stdio / streamable-http / legacy-sse transportstools-mcpcovered-deterministicpkg/backend/mcp/config_test.go, pkg/backend/delegate/pi_mcp_test.go
tools-mcp.mcp-oauthMCP OAuth broker / PKCE wiringtools-mcpcovered-deterministicpkg/backend/mcp/oauth_test.goa real third-party OAuth consent flow is excluded (see integrations.third-party-oauth)
tools-mcp.strict-mcp-isolationclaude_code nodes get ONLY the resolved MCP set (--strict-mcp-config); host ~/.claude.json servers excluded, ITERION_CLAUDE_CODE_STRICT_MCP=0 opts back intools-mcpcovered-deterministicTestClaudeCodeSpawn_StrictMCPConfigByDefault (pkg/backend/delegate/claude_code_strict_mcp_test.go), TestBuildArgs_StrictMCPConfig (pkg/backend/delegate/claudesdk/buildargs_test.go)
tools-mcp.board-toolsboard capability tools over stdio, HTTP and in-process clawtools-mcpcovered-deterministicTestBoardDispatcher_E2E_BotCreatesAndDispatches (e2e/board_dispatcher_test.go), pkg/backend/tool/claw_board_tools_test.go
tools-mcp.ask-userask_user / ask_user_async / await_answers MCP surfacetools-mcpcovered-deterministicpkg/askusermcp/http_test.go, TestAwaitAnswersReleasedByAnswer (e2e/async_interaction_test.go)
tools-mcp.permission-gatepermission gate blocks/asks on a non-allow-listed tool calltools-mcpcovered-deterministicpkg/backend/model/permission_gate_test.go, pkg/backend/permission/permission_test.golive variants: TestLive_Feat_Permission_Deny / _Ask
tools-mcp.permission-gate-external-hookthe gate holds on a CLI backend through its native PreToolUse hook (grok, kimi), deny-onlytools-mcpcovered-deterministicpkg/backend/permissionhook/hook_test.go, pkg/backend/delegate/cliagent_test.go, pkg/dsl/ir/validate_fallbacks_test.golive proof (filesystem sentinel, not model prose): TestLive_Feat_Permission_Deny_Grok / _Kimi
tools-mcp.secret-guardsecret placeholders never leak into tool input/outputtools-mcpcovered-deterministicpkg/backend/model/hooks_secretguard_test.go, pkg/backend/model/secretguard_binding_hosts_test.go
tools-mcp.computer-useread_image / screenshot / computer_use dispatchtools-mcpcovered-deterministicpkg/backend/tool/claw_builtins_test.goheadless-unavailable propagation is the deterministic half; live use is TestLive_Lite_ClawReadImage
tools-mcp.tool-displayhuman-readable rendering of tool calls in console/reporttools-mcpunit-onlypkg/backend/tooldisplay/display_test.gopure formatter over an event payload; an e2e would assert string shape through the whole stack without adding risk coverage
observability.report-generationreport.md chronological rendering from events + artifactsobservabilitycovered-deterministicTestReportRendersChronologicalRunReport (e2e/cli_report_test.go)the artifact table lifts each artifact's conventional summary: field; node outputs without one are intentionally not inlined
observability.metricsbenchmark.CollectMetrics over a finished runobservabilitycovered-deterministicTestCIFix_HappyPath (e2e/e2e_test.go), pkg/benchmark/benchmark_test.go
observability.alertsstall/budget/failure alerting + liveness heartbeatobservabilitycovered-deterministicpkg/alert/manager_test.go
observability.completion-webhooksrun-completion webhooks behind the SSRF guardobservabilitycovered-deterministicpkg/notify/completion_test.go, pkg/secure/httpdial/httpdial_test.go
observability.user-notificationsrun-outcome web-push notifications with per-episode dedupobservabilitycovered-deterministicpkg/usernotify/dispatcher_test.go
observability.otlp-tracingOTLP exporter wiring for runs/serverobservabilitycovered-deterministicpkg/cloud/tracing/tracing_test.go, pkg/benchmark/otlp_test.goan end-to-end span assertion needs a real collector; setup/shutdown/no-endpoint paths are asserted here
observability.effective-modelthe model that actually ran is recorded on delegate_started/delegate_finished, run.json nodes_served, and a model_drift event when it differs from the declared model:observabilityunit-onlyTestDelegateModelReachesStore (pkg/backend/model/delegate_observability_test.go), TestRecordNodeServedRoundTrips (pkg/store/nodes_served_test.go)CLI backends never emit llm_request.model, so these surfaces ARE the durable record; claw still also emits llm_request
observability.facade-routinga node served through an Anthropic-shaped facade says so: nodes_served[<node>].fingerprint plus one model_served_via_facade event per node and facade, raised from the success path only, with no credential from the operator-supplied base URL in the recorded labelobservabilityunit-onlyTestDelegateFacadeRoutingReachesStore (pkg/backend/model/delegate_observability_test.go), TestDelegateFacadeRoutingSilentOnFailure (pkg/backend/model/delegate_observability_test.go), TestProviderFingerprint_FacadeBaseURLCarriesNoCredential (pkg/backend/delegate/claude_code_cred_test.go)the facade aliases the model id silently, so declared and effective AGREE and model_drift cannot fire — the fingerprint is the only evidence; exercising it live needs a real facade credential
sandbox.docker-driverdocker driver: container lifecycle, workspace bind-mountsandboxcovered-livee2e/live_feat_sandbox_net_test.goneeds a container runtime; the deterministic half is spec construction (pkg/sandbox/spec_test.go)
sandbox.spec-resolutionsandbox spec resolution (auto / devcontainer / image / none)sandboxcovered-deterministicpkg/sandbox/spec_test.go, pkg/sandbox/factory_test.go
sandbox.network-policynetwork: allowlist/denylist CONNECT proxy enforcementsandboxcovered-deterministicTestSandboxNetworkAllowlist_DeclarationStartsAnEnforcingProxy (pkg/runtime/sandbox_network_policy_test.go), TestSandboxNetworkDenylist_BlocksOnlyTheListedHosts (pkg/runtime/sandbox_network_policy_test.go), TestSandboxNetworkOpen_StartsNoProxy (pkg/runtime/sandbox_network_policy_test.go), pkg/sandbox/netproxy/proxy_test.go, e2e/live_feat_sandbox_net_test.gothe proxy runs on the HOST, so the whole wire is deterministic after all: the declaration compiled from real .bot source starts an enforcing proxy, an allowed host tunnels to a loopback echo server, a host outside the policy is refused AND emits the network_blocked event the operator sees, an un-tokened client is refused (not an open relay), and network: open / no block at all start no proxy. Forcing ResolveNetworkPolicy to open turns both policy tests red. Only the container-side half — the sandboxed process actually routing its egress through the injected HTTPS_PROXY — still needs the live layer
sandbox.host-statehost_state: auto / none mounts of ~/.iterion and ~/.claudesandboxcovered-deterministicTestApplyHostStateMounts_ClaudeConfigFile (pkg/runtime/sandbox_mounts_test.go), TestApplyHostStateMounts_HomeNestedBindParentsWritable (pkg/runtime/sandbox_mounts_test.go)pkg/sandbox/spec_test.go only validates the enum string; the mounts themselves are asserted in the runtime tests cited here
sandbox.kubernetes-driverkubernetes driver: capabilities, pod/network manifests, mounts, GC, orphan sweepsandboxcovered-deterministicTestPodManifestStructure (pkg/sandbox/kubernetes/driver_test.go), TestBuildNetworkPolicyShape (pkg/sandbox/kubernetes/driver_test.go), TestValidateSpecMatchesPrepare (pkg/sandbox/kubernetes/validate_test.go), pkg/sandbox/kubernetes/gc_test.go, pkg/sandbox/kubernetes/mounts_test.gothe manifest/spec/GC half is deterministic (57 unit tests, same shape as the docker driver); only the real pod lifecycle needs a cluster — see sandbox.kubernetes-pod-lifecycle
sandbox.kubernetes-pod-lifecyclea k8s sandbox pod is actually created, executed against and torn downsandboxexcludedneeds a live cluster + registry; no fake apiserver harness exists in this repo. The manifest/spec/GC half is covered — see sandbox.kubernetes-driver
sandbox.buildkitsandbox.build: via docker buildx on the local driversandboxexcludedneeds a Docker daemon with BuildKit; rejected by design on the k8s driver
plugins.registryplugin discovery, enable state, builtin embeddingpluginscovered-deterministicpkg/plugin/plugin_test.go, pkg/plugin/inspect_test.go
plugins.installplugin install from a git URL or path (incl. bare skills repos)pluginscovered-deterministicpkg/plugin/install_test.go, pkg/plugin/skilllib_test.go
plugins.rewritersrewriter chain rewrites shell commands (rtk compression)pluginscovered-deterministicpkg/plugin/plugin_test.go, pkg/dsl/ir/compress_test.golive end-to-end with the rtk binary: TestLive_Feat_Compress
plugins.contributed-skillsplugin skills/commands/agents mirrored into the workspacepluginscovered-deterministicTestMirrorInjectedPluginFiles_WritesEachKind (pkg/runtime/contributions_test.go)
plugins.hooks-mergeplugin hook fragments idempotently merged into settings.jsonpluginscovered-deterministicTestMergePluginHooks_InjectIdempotentRemove (pkg/runtime/plugin_hooks_test.go), pkg/backend/model/settings_hooks_test.go
plugins.private-sourceteam-scoped private plugin source binding (git + secret ref)pluginscovered-deterministicpkg/pluginsource/pluginsource_test.go
server-api.run-consolerun console REST: run detail, events, log, node sectionsserver-apicovered-deterministicpkg/server/runs_test.go, pkg/runview/service_test.go
server-api.run-launchlaunch a run over HTTP with vars/overridesserver-apicovered-deterministicpkg/runview/service_launch_budget_test.go, pkg/runview/service_launch_dispatch_fields_test.go, pkg/runview/service_launch_pause_test.go, pkg/runview/service_launch_operator_resume_test.go, pkg/server/runs_test.gobudget overrides (local + forwarded on the cloud path) and invalid durations, dispatch fields, the paused-launch and operator-resume shapes, and the HTTP surface itself
server-api.run-controlpause / cancel / resume / rewind / bump-loop / raise-budgetserver-apicovered-deterministicpkg/runview/service_commands_test.go
server-api.assistant-missionsauthenticated target-scoped mission create/reattach/list/get/stop; generic proposal allowlist, durable FS claims, one-shot rewind execution and receipt reconciliationserver-apicovered-deterministicTestAssistantMissionCreateReattachesTerminalInvocationWithoutRenewal (pkg/server/assistant_mission_test.go), TestAssistantMissionCoordinatorExecutesOnlyPersistedRewindProposal (pkg/server/assistant_mission_test.go), TestFSStoreRejectsConcurrentTargetAndFencesClaims (pkg/assistantmission/fs_test.go), TestValidateMissionProposalRejectsWatchAndSourceMutation (pkg/server/assistant_mission_test.go)Mongo shares the same store contract and adds unique partial indexes for invocation/active target
server-api.run-wslive run WebSocket streamserver-apicovered-deterministicpkg/server/runs_ws_test.go
server-api.review-scopereview scope + diff since the previous human gateserver-apicovered-deterministicpkg/server/runs_review_scope_test.go
server-api.run-filesrun workspace file browse/read/write with path containmentserver-apicovered-deterministicpkg/server/runs_files_test.go
server-api.run-commitsper-run commit list + commit detailserver-apicovered-deterministicpkg/server/runs_commits_test.go
server-api.preview-proxyrun preview proxy behind the SSRF guardserver-apicovered-deterministicpkg/server/runs_preview_test.go
server-api.answer-humananswer a human gate / async question over HTTPserver-apicovered-deterministicpkg/server/runs_answer_uploads_test.go
server-api.queued-messagesoperator chat messages queued into a running node's inboxserver-apicovered-deterministicpkg/backend/model/inbox_test.go, pkg/server/runs_steer_test.go
server-api.botsbot catalog listing + per-bot metadata over HTTPserver-apicovered-deterministicpkg/server/bots_routes_test.go, pkg/botregistry/registry_test.go
server-api.boardnative kanban REST (CRUD, transitions, labels, views)server-apicovered-deterministicpkg/dispatcher/native/http_test.go, pkg/dispatcher/native/store_test.go
server-api.dispatcher-dashboarddispatcher state/refresh/cancel HTTP surfaceserver-apicovered-deterministicTestDispatcherE2E_HTTPSurface (e2e/dispatcher_test.go), pkg/dispatcher/http_test.go
server-api.server-info/api/server/info capability flags gate the SPA featuresserver-apicovered-deterministicTestServerInfo (pkg/server/runs_uploads_test.go), TestServerInfo_SkillsEnabledLocal (pkg/server/local_skills_routes_test.go), TestMarketplace_ServerInfoFlag (pkg/server/marketplace_routes_test.go), TestMarketplace_ServerInfoFlagFalseWhenNil (pkg/server/marketplace_routes_test.go), pkg/server/backends_routes_test.goeach flag is asserted against the wiring that decides it — present when the store/feature is wired, false when it is nil
server-api.openapigenerated OpenAPI 3.1 spec matches the wired routesserver-apicovered-deterministicpkg/server/openapi_test.go
server-api.pipeline-board/api/v1/pipeline-board/* control centre (columns, folding, actions, bulk ops)server-apicovered-deterministicTestPipelineBoardColumnBucketing (pkg/server/pipeline_boards_test.go), TestPipelineBoardFoldsDescendantsAndCollectsReviews (pkg/server/pipeline_boards_test.go), pkg/server/pipeline_board_actions_test.gothe REST layer behind studio-ui.pipelines
server-api.limits-cost/api/v1/limits/cost + /override admin cost-cap surfaceserver-apicovered-deterministicTestCostCapStatusDisabledByDefault (pkg/server/limits_test.go), TestCostCapStatusAndOverride (pkg/server/limits_test.go)
server-api.backends-detect/api/backends/detect credential auto-detection the toolbar readsserver-apicovered-deterministicTestBackendsDetectRouteShape (pkg/server/backends_routes_test.go), TestBackendsDetect_NoSensitiveLeak (pkg/server/backends_routes_test.go)the no-leak assertion is the one that matters: the endpoint reports availability, never a credential
server-api.effort-capabilities/api/effort-capabilities per-backend/model effort lookupserver-apicovered-deterministicTestEffortCapabilities_ClawOpus48 (pkg/server/effort_test.go), TestEffortCapabilities_UltracodeOnlyOnOpus48 (pkg/server/effort_test.go), TestEffortCapabilities_UnknownModel (pkg/server/effort_test.go)also covers the sibling /api/resolve-effort. The ultracode-only-on-4.8 case is the one that would catch a capability table drifting
server-api.resolve-model/api/resolve-model env-expands a node model: literal for the studio canvasserver-apicovered-deterministicTestResolveModel_EnvSubstitutionUsesSetValue (pkg/server/effort_test.go), TestResolveModel_InvalidExpansionYieldsEmpty (pkg/server/effort_test.go), TestLooksLikeModelSpec (pkg/dsl/ir/validate_test.go)the canvas used to replace ${VAR:-openai-codex/gpt-5.6-sol} with the word "env"; this endpoint returns the live spec (sol/terra/luna) and refuses expansions that don't look like a model so it cannot leak process env
server-api.editor-endpoints/api/parse, /api/unparse, /api/validate DSL round-trip surfaceserver-apicovered-deterministicTestUnparse_RoundTripIsSemanticallyStable (pkg/server/server_dsl_test.go), TestValidate_UnknownNodeReferenceIsC001 (pkg/server/server_dsl_test.go), TestParse_UnparseableSource (pkg/server/server_dsl_test.go)round-trip fidelity (parse -> unparse -> parse is byte-identical) and the diagnostic CODE, not the message text
server-api.local-secrets/api/local/secrets desktop/CLI secret surfaceserver-apicovered-deterministicTestLocalSecrets_CreateListDeleteSealsAndNeverEchoesTheValue (pkg/server/local_secrets_routes_test.go), TestLocalSecrets_RenameOntoAnExistingNameIsRefused (pkg/server/local_secrets_routes_test.go)the real routes on a New()-built local-mode server with the sealed store FILE as the oracle: create → the plaintext is absent from disk and from every response (only name/last4/fingerprint), list, re-post rotates in place without duplicating or widening the egress lock, delete removes it from both API and file; rename collision 409 leaves both records intact, unknown id 404. The previous citation (local_skills_routes_test.go) was a mis-citation — it holds no secrets coverage
server-api.run-shell/api/ws/runs/{id}/shell post-mortem PTY shell in a preserved worktreeserver-apicovered-deterministicTestRunShell_Gates (pkg/server/runs_shell_test.go), TestShellEligible (pkg/server/runs_shell_test.go)the gate (which runs may be shelled into) is the part that matters; the PTY itself is Unix-only with a Windows stub
cloud.oauth-connections/api/me/oauth/* connect / authorize / refresh a subscription credential for cloud runscloudcovered-deterministicTestOAuthConnections_SealsAndNeverEchoesTheCredential (pkg/server/oauth_routes_test.go)the store is the oracle: the persisted payload must not contain the plaintext token, no response may echo it, and a second account is isolated from the first one's credential
server-api.static-spaembedded studio SPA served from the binaryserver-apicovered-deterministicpkg/server/spa_test.go
dispatcher.poll-dispatchpoll a tracker and dispatch one run per eligible issuedispatchercovered-deterministicTestDispatcherE2E_DispatchAndRelease (e2e/dispatcher_test.go)
dispatcher.retryretry with backoff after a failed run, give up at max attemptsdispatchercovered-deterministicTestDispatcherE2E_RetryAfterFailure (e2e/dispatcher_test.go), TestDispatcherGivesUpAfterMaxAttempts (pkg/dispatcher/dispatcher_test.go)
dispatcher.cancelcancel an in-flight dispatched rundispatchercovered-deterministicTestDispatcherE2E_CancelInFlight (e2e/dispatcher_test.go)
dispatcher.state-transitionsissue state transitions around dispatch + revert on failuredispatchercovered-deterministicTestDispatch_TransitionsToInProgress (pkg/dispatcher/loop_state_test.go), TestDispatcherE2E_RespectsTerminalStateChange (e2e/dispatcher_test.go)
dispatcher.hookshook mechanics (script, env, timeout, failure, validation) + the before_remove hook FIRESdispatchercovered-deterministicpkg/dispatcher/hooks_test.go, TestCleanupWorkspace_RunsBeforeRemoveBeforeDeletingDir (pkg/dispatcher/cleanup_workspace_test.go)
dispatcher.hooks-lifecycle-firingthe after_create / before_run / after_run hooks actually FIRE at their lifecycle pointdispatchercovered-deterministicTestRunWorker_FiresLifecycleHooksInOrder (pkg/dispatcher/hooks_lifecycle_test.go), TestRunWorker_AfterRunFiresEvenWhenRunnerFails (pkg/dispatcher/hooks_lifecycle_test.go)every phase appends to one shared order log, so the assertion is the ORDER of what actually fired — deleting any of the three Run() calls turns it red
dispatcher.per-ticket-botper-ticket bot override + assignee routingdispatchercovered-deterministicTestBuildSpec_PerTicketBotSetsRouteKey (pkg/dispatcher/loop_bot_override_test.go)
dispatcher.concurrencyper-state concurrency caps + claim conflict handlingdispatchercovered-deterministicTestDispatcherRespectsClaimConflict (pkg/dispatcher/dispatcher_test.go), TestDispatch_SlotCountedFromClaimTime (pkg/dispatcher/loop_setup_offload_test.go)
dispatcher.cost-capdaily cost cap gate blocks further dispatchdispatchercovered-deterministicTestRefreshCostCapGatesWhenExceeded (pkg/dispatcher/cost_cap_test.go)
dispatcher.workspace-cleanupper-run workspace/worktree teardown policiesdispatchercovered-deterministicTestCleanupWorkspace_RemovesLinkedWorktreeRegistration (pkg/dispatcher/cleanup_workspace_test.go)
dispatcher.pr-lookup-retryboard PR lookup outage, recovery, drain and terminal refusalsdispatchercovered-deterministicTestBoardDispatcher_PRLookupFailureRetriesAfterRecovery, TestBoardDispatcher_PRLookupDrainReturnsUnlaunchedCard, TestBoardDispatcher_PRLookupFailureHonoursAttemptCap, TestBoardDispatcher_PRLookupForkRemainsTerminal, TestBoardDispatcher_PRLookupForeignGrantRemainsTerminal (pkg/server/boarddispatch_pr_lookup_test.go)real PR context resolution and dispatcher; durable retry ledger and no launch on refusal
dispatcher.native-trackernative filesystem kanban tracker (board.json/issues/events)dispatchercovered-deterministicpkg/dispatcher/native/store_test.go, TestNativeStore_Conformance (pkg/dispatcher/boardmongo/conformance_test.go)
dispatcher.github-trackerGitHub Issues tracker adapterdispatchercovered-deterministicpkg/dispatcher/tracker/github_test.goreal GitHub API is stubbed at the HTTP boundary
dispatcher.forgejo-trackerForgejo/Gitea tracker adapterdispatchercovered-deterministicpkg/dispatcher/tracker/forgejo_test.goreal Forgejo API is stubbed at the HTTP boundary
triggers.subscription-registrysubscription CRUD through the REST surfacetriggerscovered-deterministicpkg/server/triggers_routes_test.gomatching/mode semantics: pkg/trigger/subscription_test.go
triggers.subscription-querysubscription query by repo / by bot (tenant-scoped; by-repo also returns the workspace-wide ones)triggerscovered-deterministicTestSubscriptionStoreQueries (pkg/trigger/store_query_test.go)
triggers.evaluatorevaluator matches an event to subscriptions and launchestriggerscovered-deterministicpkg/trigger/evaluator_test.go
triggers.board-sourceboard transition promotes a card / direct-launches a bottriggerscovered-deterministicpkg/trigger/board_integration_test.go, TestIssueTriageTrigger_E2E_ConsumeAndLaunch (e2e/issue_triage_trigger_test.go)
triggers.consume-labelsconsume_labels strips the matcher labels atomically pre-launchtriggerscovered-deterministicpkg/trigger/consume_labels_test.go, TestIssueTriageTrigger_E2E_ConsumeAndLaunch (e2e/issue_triage_trigger_test.go)
triggers.run-outcomerun completion events chain the next bottriggerscovered-deterministicTestEvaluatorRunCompletionChaining (pkg/trigger/evaluator_test.go), pkg/runview/trigger_emit_test.go, pkg/trigger/runoutcome_test.gothe chaining itself (a finished run's event matches a direct-mode subscription and launches the next bot), the emitter that publishes it from runview, and the envelope/episode-id builder shared with the runner
triggers.assistant-run-watchdurable target lifecycle → safe assistant diagnostic turns until Done or explicit Stoptriggerscovered-deterministicpkg/runwatch/fs_test.go, pkg/server/assistant_run_watch_test.go, pkg/server/assistant_run_watch_autoarm_test.go, studio runChat/action-request testspins episode dedup/CAS lease recovery, persistence across recoverable assistant failures, repeated target outcomes, cancellations and old pending episodes, chat-only wake eligibility (ask_user and paused_operator excluded), host-selected assistant binding and host-event transcript semantics. A live LLM outcome→diagnostic smoke remains manual; Mongo/NATS use the same store/claim and outcome-bus contracts
triggers.schedulerschedule-kind subscriptions tick on their crontriggerscovered-deterministicpkg/trigger/scheduler_test.go, pkg/trigger/scheduler_gate_test.go
triggers.eventbus-inprocin-process event bus deliverytriggerscovered-deterministicpkg/eventbus/inproc_test.go
triggers.eventbus-natsNATS event bus on the separate ITERION_EVENTS streamtriggerscovered-deterministicpkg/eventbus/nats_test.goneeds a NATS endpoint; skips cleanly without one
triggers.cloudschedcloud recurring-bot scheduler with a multi-replica CAS tickertriggerscovered-deterministicpkg/cloudsched/cloudsched_test.go
triggers.retry-policyusage_window retry policy resolution across all layerstriggerscovered-deterministicpkg/retrypolicy/policy_test.go
webhooks.gitlabGitLab MR open/reopen + /revi note re-review launcheswebhookscovered-deterministicpkg/server/webhooks_gitlab_test.go, pkg/webhooks/webhooks_test.go
webhooks.githubGitHub PR events launch the configured botwebhookscovered-deterministicpkg/server/webhooks_github_test.go
webhooks.forgejoForgejo/Gitea PR events launch the configured botwebhookscovered-deterministicpkg/server/webhooks_forgejo_test.go
webhooks.genericgeneric JSON inbound triggerwebhookscovered-deterministicTestGenericWebhook_HappyPath_VarsPrecedence (pkg/server/webhooks_generic_test.go), TestGenericWebhook_MissingBotIs400 (pkg/server/webhooks_generic_test.go), TestGenericWebhook_BodyHashIdempotency (pkg/server/webhooks_generic_test.go), pkg/webhooks/generic/generic_test.go, pkg/webhooks/router_test.gothe endpoint itself: var precedence on launch, 400 without a bot, body-hash idempotency, oversized-var refusal; the parser in pkg/webhooks/generic and the command routing in router_test.go
webhooks.rerequest-reviewforge-native "Re-request review" on the bot reviewer relaunches the review (repeatable per click, bot-actor echo filtered, publish self-assigns the GitLab reviewer)webhookscovered-deterministicTestGitLabWebhook_ReRequestReviewLaunches (pkg/server/webhooks_gitlab_test.go), TestGitHubWebhook_ReviewRequestedLaunches (pkg/server/webhooks_github_test.go), TestGitLabAddSelfAsPullReviewer (pkg/forge/gitlab/reviews_test.go), TestForgePublishReview_SelfAssignsReviewer (pkg/server/forge_publish_gate_test.go)gate opt-out releasing forced review_on_sync: TestProvision_GateDisabledPin* (pkg/forge/orchestrator_botrules_test.go)
webhooks.authiwh_ token / HMAC admission, rate limits, idempotent deliverywebhookscovered-deterministicpkg/webhooks/match_test.go, pkg/server/webhooks_routes_test.go
webhooks.authz-outagea forge authorization outage is acknowledged, audited as launch_error, and launches no botwebhookscovered-deterministicTestWebhookAuthzErrorsAreAcknowledgedWithoutLaunching (pkg/server/webhooks_authz_error_test.go)Six real handler lanes; even an authorized=true result accompanied by an error refuses execution.
webhooks.handoffproduces/consumes hand-off stamps the next run's launch varswebhookscovered-deterministicpkg/server/webhooks_handoff_test.go, bots/handoff_declarations_test.go
webhooks.merge-gateRevi posts a deterministic revi/review commit statuswebhookscovered-deterministicTestForgePublishReview_GatePostedEvenWhenTheReviewFails (pkg/server/forge_publish_test.go), pkg/server/forge_gate_relaunch_test.go, pkg/server/forge_gate_autofix_test.gopkg/forge/reviews_test.go is a PR-URL parser + markdown folder — orthogonal to the gate
forge.connectionsforge connection / repo-integration / OAuth-app storesforgecovered-deterministicpkg/forge/oauth_app_store_test.go
forge.admin-clientsper-provider admin clients (repos, hooks, permissions)forgecovered-deterministicpkg/forge/forgelive_test.go, pkg/forge/command_map_test.goprovider APIs stubbed at the HTTP boundary
forge.github-appGitHub App manifest flow + installation-token mintingforgecovered-deterministicpkg/server/forge_app_resolution_test.gothe interactive App-creation consent screen is excluded (needs a real GitHub org)
forge.bot-avatarthe iterion-bot avatar on a connection's account — auto on a GitLab bot identity at connect, explicit apply (force on an unflagged account), refusals on OAuth / GitHub, /brand/ public routeforgecovered-deterministicpkg/server/forge_avatar_routes_test.go, pkg/server/brand_routes_test.go, TestSetAvatar_MultipartShape (pkg/forge/gitlab/client_test.go), TestSetAvatar_JSONBase64 (pkg/forge/forgejo/client_test.go), pkg/brand/brand_test.goTestLiveGitLabAvatar (pkg/forge/forgelive_test.go, tag forgelive) proved on 2026-09-05 that a project-token bot user takes the avatar on GitLab 19.2; Forgejo's endpoint is swagger-verified, not live-tested
forge.orchestratorprovision/deprovision: webhook + secret + bindings + schedulesforgecovered-deterministicpkg/forge/orchestrator_test.go
forge.token-refreshbackground token refresh workerforgecovered-deterministicpkg/forge/refresh_test.go
forge.config-shareshared-config read/write under a synthetic share grantforgecovered-deterministicpkg/configshare/configshare_test.go
cloud.auth-sessionlogin / logout / refresh / session cookies + JWT claimscloudcovered-deterministicpkg/auth/service_test.go, pkg/server/auth_routes_test.go
cloud.run-login-returnsigned-out run links offer sign-in, then restore the full run URLstudiocovered-deterministicstudio/src/tests/runSignIn.test.tsx, studio/src/auth/returnTo.test.ts, studio/src/views/auth/tests/ForcedPasswordChange.test.tsxreal App routes + AuthProvider + Login with HTTP and destination chrome stubbed; password retry, existing session, restricted account, query/hash, forced password rotation and unsafe return paths covered
cloud.sso-oidcOIDC SSO providers + domain verificationcloudcovered-deterministicpkg/auth/oidc/generic_test.go, pkg/server/org_sso_routes_test.goa real IdP consent round-trip is excluded (see integrations.third-party-oauth)
cloud.password-resetpassword reset request/confirm + mail delivery fallbackcloudcovered-deterministicpkg/auth/password_reset_test.go, pkg/mail/mail_test.go
cloud.orgs-teamstwo-level tenancy: org membership, team scoping, context switchcloudcovered-deterministicpkg/identity/team_test.go, pkg/server/auth_teams_test.go
cloud.invitationsteam/org invitations: create, lookup, acceptcloudcovered-deterministicTestInvitations_AdminIssuesAnonymousLookupAcceptGrantsMembership (pkg/server/invitations_e2e_test.go), TestInvitations_DeletingAPendingInviteKillsItsToken (pkg/server/invitations_e2e_test.go), TestInvitationFlow (pkg/auth/service_test.go)the whole grant path over real HTTP: a plain member is refused (403, nothing created), an admin's token is looked up ANONYMOUSLY (the invitee has no session yet), accepting creates the membership — proven by the outsider's 403 on the team turning into a 200 that lists them at the invited role — and the token is single-use, login-gated, and dead once the admin deletes the invitation. The previous citation (auth_views_test.go) holds only an org-tree test
cloud.patpersonal access tokens (iap_ bearers)cloudcovered-deterministicTestPATBearer_AuthenticatesProgrammaticClientsThroughTheRealServer (pkg/server/pat_bearer_e2e_test.go), TestPATBearer_DiesWithTheMembershipItResolvesThrough (pkg/server/pat_bearer_e2e_test.go), pkg/server/pat_routes_test.go, pkg/pat/pat_test.gothe promise is programmatic access, and it lives in the auth MIDDLEWARE: the token is minted over real HTTP and then presented as a bearer to a server built by the real New() wiring — identity + pinned team served back, a protected endpoint reachable, cross-team read 403, unknown iap_ failing closed (never falling through to JWT parsing), revoke and membership removal each turning the next call into a 401 while the JWT session survives. Deleting the iap_ branch from requireAuth leaves the store and handler tests green and turns these red
cloud.audit-logtenant + platform audit log of control-plane mutationscloudcovered-deterministicTestAuditEndToEnd (pkg/server/audit_routes_test.go), pkg/audit/audit_test.goa control-plane mutation through the routes leaves the row an operator reads back on /api/teams/{id}/audit; the store half (TTL, filters) in pkg/audit
cloud.quotasper-org monthly run/cost counters gate the launchcloudcovered-deterministicpkg/orgusage/orgusage_test.go, pkg/server/launch_gate_test.go
cloud.usage-cap-runtimeusage-cap percentages retunable at runtime via the super-admin API: env stays the default, a DB record overrides it on BOTH enforcement points within the resolver TTL, /healthz echoes the effective value, non-admin and invalid input rejected, update auditedcloudcovered-deterministicTestAdminUsageCaps_EnvFallback (pkg/server/admin_settings_routes_test.go), TestAdminUsageCaps_UpdateOverridesEnvAndAudits (pkg/server/admin_settings_routes_test.go), TestAdminUsageCaps_NonAdminRejected (pkg/server/admin_settings_routes_test.go), TestAdminUsageCaps_InvalidValuesRejected (pkg/server/admin_settings_routes_test.go), TestUsageCapPreflight_RuntimeSettingsChangeIsLive (pkg/runner/usage_cap_test.go), TestResolver_UpdatePropagatesWithinTTL (pkg/usagecap/settings_test.go)the server half runs over real HTTP through the production auth middleware; the runner half proves the tightened cap refuses the next claim on the SAME Runner value (no restart); the resolver half pins the TTL as the propagation bound with a fake clock (ADR-090)
cloud.usage-cap-trust-windowa stored usage reading is trusted for a bounded time (ITERION_USAGE_CAP_TRUST_WINDOW, default 3h) after it was observed, not until its reset instant: a pre-reset reading cannot lock a credential out through a reset the provider made early, a recent one still parks, and a malformed window refuses to startcloudcovered-deterministicTestReadingFresh_TrustWindowBoundsADatedReading (pkg/usagecap/usagecap_test.go), TestPreflight_StaleDatedReadingDoesNotBlock (pkg/usagecap/usagecap_test.go), TestTrustFromEnv (pkg/usagecap/usagecap_test.go), TestUsageCapPreflight_StaleReadingDoesNotRefuseAdmission (pkg/runner/usage_cap_trust_test.go)the runner half replays the production shape of #690 (0.99 on seven_day, reset four days out, observed 17h37m earlier) at the admission gate that refused every claude_code run; a run refused there never fires the hook that would refresh the reading, which is why the bound is on AGE
cloud.usage-readings-cleara super-admin forgets ONE credential's stored usage readings by fingerprint (DELETE /api/admin/usage-readings/{fingerprint}, iterion remote admin usage-readings clear): every key the credential was metered under, nothing else, audited with the count, idempotent, non-admin refusedcloudcovered-deterministicTestAdminUsageReadings_ClearForgetsOneCredential (pkg/server/admin_usage_readings_routes_test.go), TestAdminUsageReadings_NonAdminRejected (pkg/server/admin_usage_readings_routes_test.go), TestMemStore_Conformance (pkg/usagecap/store_conformance_test.go), TestMongoStore_Conformance (pkg/usagecap/store_conformance_test.go)over real HTTP through the production auth middleware; the store half is one conformance suite run against both twins (the Mongo one under the mongo-conformance job)
cloud.usage-retry-skipped-credentialthe usage-window retry arms on the EARLIER of the failed credential's reset and the reopening of the earliest credential the launch's walk passed over (run.skipped_cred_reopens_at, reset_source: skipped_credential), re-stamped on every resume — EXCEPT on the last attempt the budget allows, which is reserved for the failed credential's own reset when that reset is still ahead and inside max_wait (reset_source: <evidence>+last_attempt_pinned)cloudcovered-deterministicTestUsageWindowRetryAt_ArmsOnTheEarliestReopeningCredential (pkg/runner/usage_retry_skipped_test.go), TestArmUsageWindowRetry_ReadsTheSkippedCredentialFromTheRun (pkg/runner/usage_retry_skipped_test.go), TestUsageWindowRetryAt_BudgetOutlastsTheAuthoritativeWall (pkg/runner/usage_retry_budget_test.go), TestUsageWindowRetryAt_SpeculativeWakeSurvivesWhileTheBudgetCanSpareIt (pkg/runner/usage_retry_budget_test.go), TestArmUsageWindowRetry_ReadsTheSpentAttemptsFromTheRun (pkg/runner/usage_retry_budget_test.go), TestRunRetry_SpentAttemptsAreReadableFromTheRunDocument (pkg/store/mongo/runs_retry_test.go), TestResolve_ReportsWhenTheSkippedForfaitReopens (pkg/server/cloudpublisher/skipped_reopens_test.go), TestApiKeyUsable_ReportsTheEarliestReopening (pkg/server/cloudpublisher/skipped_reopens_test.go)the production shape of #684: a team key refused on its five-hour window (reopens 16:40Z) and a platform forfait walled until Monday — armed at 16:41Z, not Monday; #922 is the budget half — both clocks spend one max_attempts purse, so five wakes on a five-hour cycle used to retire a run six days before a seven-day wall fell; the store field rides the CredFingerprintMeter conformance row
cloud.credential-ceiling-countinga key's max_concurrent_runs counts only alive runs whose RESOLVED routes can spend it (the stamp is narrowed through model.EffectiveProviders) and which are executing a model node (run.llm_idle_since toggled by the runner at model-node boundaries, cleared by every re-stamp)cloudcovered-deterministicTestResolve_StampsOnlyTheSpendableFingerprints (pkg/server/cloudpublisher/stamp_narrowing_test.go), TestCredSlotTracker_IdleBetweenModelNodes (pkg/runner/cred_slot_test.go), TestCredSlotObserver_WiresWorkflowAndStore (pkg/runner/cred_slot_test.go), TestConformance_FilesystemShared (pkg/store/conformance_test.go)the two production shapes of #661: a rite pinned to the forfait holding a facade-key slot (next launch died AUTH_FAILED), and a finished agent node sitting in a sixty-minute tool-only gate; the count filter is the CredFingerprintMeter row of the shared store conformance, run on both twins
cloud.credential-observabilitythe run API exposes the credential stamp (cred_fingerprints, llm_idle_since, skipped_cred_reopens_at), the key views report alive_runs from the SAME count the ceiling asks, and last_used_at is bumped under the run's tenant for a tenant's own key and across tenants for a platform/pool keycloudcovered-deterministicTestHeaderFromRun_ExposesTheCredentialStamp (pkg/runview/snapshot_cred_test.go), TestListApiKeys_ReportsAliveRuns (pkg/server/byok_alive_runs_test.go), TestMarkCredFingerprintsUsed_ScopesByTier (pkg/runner/loop_spend_scope_test.go), TestMemoryApiKey_MarkFingerprintUsed_ScopesToTheContextTenant (pkg/secrets/byok_fp_scope_test.go), TestMongoApiKey_MarkFingerprintUsed_ScopesToTheContextTenant (pkg/secrets/byok_mongo_fp_scope_test.go)#659 pt 3; the Mongo twin of the scoping runs under the mongo-conformance job
cloud.queue-dispatchNATS work queue: enqueue, claim, schema-version handlingcloudcovered-deterministicpkg/queue/types_test.go, TestSchemaVersionMismatchIsATypedTransientError (pkg/queue/schema_version_transient_test.go)
cloud.runner-podrunner claims a queued run, executes, reports status backcloudcovered-deterministicpkg/runner/loop_test.go
cloud.runner-credentialscredential injection + sealing into a runner podcloudcovered-deterministicpkg/runner/git_credentials_test.go, pkg/secrets/run_secrets_test.go
cloud.probes-readiness/readyz gates on CRITICAL dependencies only (a non-critical blip stays 200 degraded), /healthz never follows a dependencycloudcovered-deterministicTestReadyzCriticalVsDegraded (pkg/server/health_test.go), TestHealthzAlwaysOK (pkg/server/health_test.go)every replica pings the same backends, so a critical check on a shared one converts a blip into a fleet-wide outage — the split is the promise, and the table drives all three outcomes through the real mux
cloud.probes-resiliencea dependency ping that panics, hangs, or is already in flight cannot kill the pod, hang the probe, or evict a healthy onecloudcovered-deterministicTestReadyzSurvivesAPanickingCheck (pkg/server/health_test.go), TestReadyzDoesNotHangOnAContextIgnoringCheck (pkg/server/health_test.go), TestReadyzDoesNotRelaunchAWedgedCheck (pkg/server/health_test.go), TestReadyzConcurrentProbesShareOneAnswer (pkg/server/health_test.go)the probe runs pings concurrently in their own goroutines, i.e. outside net/http's recover and outside the request's lifetime — each test pins one way that turned into an un-drained exit (panic → process death, hang → wedged handler + blocked Shutdown, relaunch → goroutine leak → OOMKill) or into evicting a healthy pod (overlapping probes). All four were found by adversarial review, not by the original tests
cloud.probes-lame-duckSIGTERM flips /readyz to 503 draining while the listener still accepts, for ITERION_SHUTDOWN_DELAY, with /healthz still 200cloudcovered-deterministicTestServerCommandBootsLocalModeAndShutsDownOnSignal (e2e/cli_server_boot_test.go), TestReadyzDrainingIs503AndSkipsChecks (pkg/server/health_test.go), TestBeginDrainWaitsButRespectsContext (pkg/server/health_test.go)the e2e half polls the REAL binary between SIGTERM and exit — the only place the window is observable; drop the draining branch and it fails within the 5s window (verified by mutation)
cloud.probes-runnerrunner /healthz tells a busy consume loop from a wedged one; /readyz reports the whole lame-duck draincloudcovered-deterministicTestHealthAliveDistinguishesBusyFromWedged (pkg/runner/health_test.go), TestShutdown_CompleteMode_LetsRunFinish (pkg/runner/loop_test.go), TestShutdown_NoInFlight_NoOp (pkg/runner/loop_test.go)replaces a tcpSocket probe that could not distinguish them; the Shutdown tests are the WIRING half (flag actually flipped at drain start), the health tests the policy half
cloud.credential-poolpledge/lease broker as the fourth credential tiercloudcovered-deterministicpkg/credpool/broker_test.go, pkg/server/cloudpublisher/credpool_tier_test.go, pkg/server/credpool_routes_test.go
cloud.secrets-sealingAES-256-GCM sealing + BYOK/generic/bot-binding domainscloudcovered-deterministicpkg/secrets/sealer_test.go, pkg/secrets/run_secrets_test.go
cloud.bot-sourcesteam-authored bot bundles (fork a catalog bot, author a new one)cloudcovered-deterministicpkg/botsource/botsource_test.go, pkg/server/bot_sources_routes_test.go
cloud.platform-bot-overridesplatform bot overrides: super-admin push/delete under the platform: sentinel, resolution team → platform → baked at every launch surface, digest-audited, size-cappedcloudcovered-deterministicTestAdminBots_PlatformOverrideLifecycle (pkg/server/admin_bots_routes_test.go), TestAdminBots_SuperAdminOnly (pkg/server/admin_bots_routes_test.go), TestAdminBots_SizeLimits (pkg/server/admin_bots_routes_test.go), TestEffectiveEntries_PlatformOverlay (pkg/server/platform_settings_test.go), TestBotResolutionSweep_NoRawRegistryReads (pkg/server/bot_resolver_sweep_test.go)the sweep test is what keeps NEW pkg/server code from bypassing the resolver — the class stays closed
cloud.platform-bot-runner-rebuilda stored-bot run rebuilds its bundle from the DB ref on the runner, verifying the version (drift/missing row fail loudly, never a stale-baked fallback)cloudcovered-deterministicTestMaterializeBotBundle (pkg/runner/botbundle_test.go), TestValidate_DualAcceptWindow (pkg/queue/types_test.go)the dual-accept test pins the v8/v9 rolling-deploy guarantee
cloud.platform-bot-roleswebhook role→bot bindings runtime-mutable (bot_roles settings family; consts stay defaults)cloudcovered-deterministicTestRoleBots_DefaultsAndOverride (pkg/server/platform_settings_test.go), TestAdminBotRoles_PutMergeAndOrigin (pkg/server/platform_settings_test.go), TestBotRoleSweep_ConstsOnlyInDefaults (pkg/server/bot_resolver_sweep_test.go)
cloud.platform-sandbox-imagesandbox: auto default image runtime-mutable, resolved at publish and pinned on the RunMessagecloudcovered-deterministicTestAdminSandboxSettings (pkg/server/platform_settings_test.go), pkg/platformcfg/platformcfg_test.gothe runner consumes msg.SandboxImage via runtime.WithSandboxDefaultImage; publish-time pinning is what makes a redelivery rerun identically
cloud.marketplacehosted registry entries (bot + plugin), moderation, visibilitycloudcovered-deterministicTestMarketplace_SubmitListGetInstall (pkg/server/marketplace_routes_test.go), TestMarketplace_InstallThenUninstall (pkg/server/marketplace_routes_test.go), pkg/marketplace/moderation_test.go, pkg/marketplace/visibility_test.go, pkg/marketplace/jsonstore_test.go, pkg/cli/marketplace_test.gosubmit → list → get → install/uninstall over the REST surface (plus the disabled/404/malformed-bundle refusals), with moderation status and visibility scope asserted at store level and the CLI half in pkg/cli
cloud.memory-storecloud MemoryStore adapter + quotacloudcovered-deterministicpkg/knowledge/scope_test.go, pkg/memory/space_test.go, pkg/server/memory_routes_test.go
cloud.dlqdead-letter queue show/replay/delete (admin REST surface)cloudcovered-deterministicTestDLQAdmin_ListPeekReplayLeavesAuditTrail (pkg/server/dlq_admin_routes_test.go), TestDLQAdmin_NonSuperAdminCannotReplayOrDiscard (pkg/server/dlq_admin_routes_test.go)the endpoints behind iterion remote admin dlq: super-admin gate (an unprivileged caller never reaches the queue), list/peek/replay/discard state transitions, the platform audit row naming the replayed run, and 400/404/502 mapping. Driven through the real New()/routes()/auth middleware with an in-process QueueBackend double (the seam added for it); the broker-side half is cloud.dlq-jetstream
cloud.dlq-jetstreamDLQ transport semantics: park with headers, inspect verbatim payload, replay/discard, report depthcloudcovered-deterministicTestSchemaRolloutMixedFleet (pkg/runner/schema_rollout_integration_test.go)CI's nats-conformance job supplies a real JetStream service container and verifies delayed redelivery, final park headers/reason, ListDLQ, PeekDLQ byte identity, RepublishDLQ/DiscardDLQ and DLQDepth.
cloud.lock-delivery-exhaustiona delivery that cannot take the run lock reaches the DLQ at MaxDeliver without changing the runcloudcovered-deterministicTestHeldLockFinalDeliveryArchivesOnNATS (pkg/runner/lock_delivery_test.go), TestHeldLockDoesNotSpendFinalDeliverySilently (pkg/runner/lock_delivery_test.go), TestHeldLockArchiveFailureLeavesDurableEvidence (pkg/runner/lock_delivery_test.go), TestLockFailureReasonSeparatesHeldFromUnconfirmed (pkg/runner/lock_delivery_test.go), TestExhaustedPublishDeadlineStillRecordsTheAuditRow (pkg/runner/lock_delivery_test.go)Real JetStream payload round trip in the NATS one (CI's nats-conformance service container). The pure-Go ones cover the failure halves it cannot reach: an archive failure stays visible on the run timeline, the archived reason separates CONFIRMED contention from a lock error that leaves ownership unconfirmed, and a publish deadline exhausted by a broker outage still records run_delivery_exhausted — the only confirmed trail when the DLQ copy is not. Every one asserts the run doc is untouched.
cloud.migrate-blobsmigrate to-cloud artifact/blob upload to S3cloudcovered-deterministicTestMigrateToCloud_TransfersEveryVersionAndIsIdempotent (cmd/iterion/migrate_to_cloud_test.go), TestMigrateToCloud_DryRunWritesNothing (cmd/iterion/migrate_to_cloud_test.go), TestS3Client_ArtifactUploadRoundTripAndLayout (pkg/store/blob/s3_roundtrip_test.go), TestS3Client_DeleteRunSweepsOnlyThatRunsPrefix (pkg/store/blob/s3_roundtrip_test.go)both halves of the one-way door: the walker (migrateRun between two real stores — every artifact VERSION, events, interactions, --dry-run writes nothing, re-runs don't duplicate) and the S3 upload driven by the REAL AWS SDK against an in-process path-style gateway (canonical key layout on the wire, byte round-trip, ErrArtifactNotFound mapping, prefix-scoped DeleteRun). Not covered: the Mongo store's own WriteArtifact→blob glue, which needs a live Mongo (mongo-conformance CI job)
cloud.desktop-exchangedesktop auth token exchange endpointcloudcovered-deterministicpkg/server/desktop_sso_test.go
cloud.valkey-stateephemeral cross-replica state (OAuth/CSRF, board tokens, rate buckets)cloudcovered-deterministicTestValkeyCrossReplica_ForgeOAuthStartedOnACompletesOnB (pkg/server/valkey_cross_replica_test.go), TestValkeyCrossReplica_BoardTokenMintedOnAAuthorizesWriteOnB (pkg/server/valkey_cross_replica_test.go), TestValkeyCrossReplica_LoginRateBudgetIsSharedNotPerPod (pkg/server/valkey_cross_replica_test.go), pkg/server/valkey_stores_test.gotwo servers built through the real New() wiring over ONE miniredis: each flow starts on replica A and finishes on replica B (OAuth connect → callback creates the connection, board token → board write, login burst → 429). Give each replica its own Valkey and all three fail. store-level TTL/GETDEL/write-failure surfacing in valkey_stores_test.go. Not covered: valkey.New's Sentinel-HA topology (needs a real Sentinel quorum; the single-node client is what miniredis speaks)
bots.catalog-universalitycatalog bots stay repo- and stack-agnosticbotscovered-deterministicbots/catalog_universality_test.go
cloud.bot-bundle-snapshotcloud launch and resume freeze resources plus transitive subbots; a divergent runner catalog cannot replace the snapshotcloudcovered-deterministicTestSnapshotCatalogLaunchAndResume (pkg/server/bot_snapshot_test.go), TestSnapshotChildUsesServerAuthorityAndRefusesMissingChild (pkg/server/bot_snapshot_test.go), TestSnapshotRunnerIgnoresDivergentCatalog (pkg/runner/bot_snapshot_test.go), TestSnapshotRunnerFetchesAndChecksStoredBytes (pkg/runner/bot_snapshot_test.go), TestSnapshotOffloadIsImmutableAcrossResume (pkg/server/cloudpublisher/bundle_snapshot_test.go), TestSnapshotPromptsTravelInCompiledPayload (pkg/server/cloudpublisher/bundle_snapshot_test.go)real child execution against conflicting runner catalog; object transport tested with fake blob backend; live coordinated rollout not covered
bots.catalog-compilesevery catalog bot parses + compiles cleanbotscovered-deterministicbots/catalog_parse_compile_test.go, bots/catalog_typing_test.go
bots.catalog-freshnessthe generated bot-catalog skill matches the manifestsbotscovered-deterministicbots/catalog_freshness_test.go
bots.golden-replaybot golden replay revalidates frozen LLM outputsbotscovered-deterministicTestGoldens (pkg/botreplay/goldens_test.go)
bots.feature-devfeature-dev (Featurly): campaign + gate convergencebotscovered-deterministicTestVibeFeatureDev_ConvergesFirstPass (e2e/feature_dev_test.go), TestVibeFeatureDev_RedVerifyRoutesBackToCampaign (e2e/feature_dev_test.go)
bots.whole-improve-loopwhole-improve-loop (Willy)botscovered-deterministicTestWholeImproveLoop_ContinuesUntilComplete (e2e/whole_improve_loop_test.go)
bots.branch-improve-loopbranch-improve-loop (Billy)botscovered-deterministicTestBranchImproveLoop_ContinuesUntilClean (e2e/branch_improve_loop_test.go)
bots.docs-refreshdocs-refresh (Doki)botscovered-deterministicTestDocsRefresh_ConvergesFirstPass (e2e/docs_refresh_test.go)
bots.whats-nextwhats-next (Nexie) chat loop + dispatchbotscovered-deterministicTestWhatsNextV2_ChatLoop_PauseResumeClose (e2e/whats_next_loop_test.go)
bots.secured-renovacysecured-renovacy (Renovacy) patch/minor/fix-loop pathsbotscovered-deterministicTestSecuredRenovacy_PatchFastTrack (e2e/secured_renovacy_test.go)
bots.sec-audit-sourcesec-audit-source (Seki): cap_findings + scan_health gatesbotscovered-deterministicTestSecAuditSource_ScanHealth_GuardsAgainstFacade (e2e/sec_audit_scan_health_test.go), TestSecAuditSource_CapFindings_BoundsScannerOutput (e2e/sec_audit_cap_findings_test.go)
bots.sec-audit-depssec-audit-deps (Depsy): per-ecosystem + generic CVE heuristicsbotscovered-deterministicTestSecAuditDeps_GenericHeuristic_DetectsMalwareSignals (e2e/sec_audit_deps_heuristics_test.go)
bots.e2e-coveragee2e-coverage (Endy): matrix gate + continuation loopbotscovered-deterministicTestE2ECoverage_ContinuesUntilComplete (e2e/e2e_coverage_bot_test.go), bots/e2e_coverage_matrix_gate_test.go
bots.review-prreview-pr (Revi): finding ids, stale anchors, gate status, concise publication and collapsed AI run detailsbotscovered-deterministicbots/review_pr_finding_id_test.go, bots/review_pr_stale_anchor_test.go, TestReviewPRRunDetails (bots/review_pr_run_details_test.go), TestReviewPRConcisePublication and TestReviewPRConciseScope (bots/review_pr_concise_test.go)brief visible verdict; authenticated instance run link strips callback query/fragment; full findings/replacements survive missing anchors; gaps and decisions stay visible; verification limits are collapsed; served model/harness, run tokens and audited scope are collapsed; missing telemetry remains unavailable
bots.dep-update-guarddep-update-guard (Vetty): prepare/gate/automerge routingbotscovered-deterministicbots/dep_update_guard_gate_test.go, bots/dep_update_guard_automerge_test.go
bots.feed-watchfeed-watch: state machine, routing, SSRF-safe fetchbotscovered-deterministicTestFeedWatch_ScriptsStateMachine (e2e/feed_watch_test.go), TestFeedWatch_FetchRejectsSSRF (e2e/feed_watch_test.go)
bots.feed-watch-splitfeed-watch (Vigie): a digest over the per-message budget is delivered whole as consecutive numbered messages — per-sink max_chars, max_messages ceiling, no orphaned heading, intra-sink partial failure does not fail the run, nothing delivered doesbotscovered-deterministicTestFeedWatch_NotifySplitsLongDigest (e2e/feed_watch_test.go)drives the real python notify script against an httptest webhook that records every payload; the reassembly assertion is what proves no content is lost
bots.vuln-watchvuln-watch (Senti): exploitation-driven alert policy, KEV re-fire, alias dedup, word-boundary inventory matching, explicit token failure, SSRF posture, at-least-once delivery, zero-LLM invariantbotscovered-deterministicTestVulnWatch_PolicyAndRefire (e2e/vuln_watch_test.go), TestVulnWatch_WordBoundaryMatching, TestVulnWatch_MissingTokenFailsHard, TestVulnWatch_FetchRejectsSSRF, TestVulnWatch_DryRunAndNoSinksDoNotConsume, TestVulnWatch_ZeroLLMInvariantthe real python tool scripts run against httptest GitHub/advisory/webhook fakes + a file:// KEV; the engine-side dependabot_tokens flow is covered by pkg/forge/security_read_test.go
bots.issue-triageissue-triage (Triagy): author trust gate + label consumptionbotscovered-deterministicTestIssueTriageTrigger_E2E_ConsumeAndLaunch (e2e/issue_triage_trigger_test.go)
bots.golden-master-syncthe golden-master bot and its oracle harness stay in sync (same functions, same report fields)botscovered-deterministicbots/golden_master_harness_sync_test.go
bots.review-topologymono/dual review topology injected only into opting-in botsbotscovered-deterministicTestReviewTopology_MonoClaudeSingleFamily (e2e/review_topology_test.go)
bots.verify-gatethe deterministic verify_build/verify_run gate resists driftbotscovered-deterministicbots/verify_run_drift_test.go, bots/verify_probe_wiring_test.go
bots.live-covered-catalogthe catalog bots that HAVE a live test (evolve, adr-cartograph, adr-rechallenge, rgaa-audit, bmady, devbox-setup, revi-converse, feature-gap-fill, test-coverage)botscovered-livee2e/live_bot_adr_cartograph_test.go, e2e/live_bot_adr_rechallenge_test.go, e2e/live_bot_evolve_test.go, e2e/live_bot_rgaa_audit_test.go, e2e/live_bot_bmady_test.go, e2e/live_bot_devbox_setup_test.go, e2e/live_bot_revi_converse_test.go, e2e/live_bot_feature_gap_fill_test.go, e2e/live_bot_test_coverage_test.gothese bots' value IS the LLM work product (a review, an ADR map, an accessibility audit); they have no deterministic graph gate to assert against, so the live layer + quality panel is the honest coverage. Their graphs are compile-checked by bots.catalog-compiles
bots.uncovered-catalogthe catalog bots with NO test beyond parse+compile (modernize, wiki-gen, app-dev, supply-shield, supply-shield-cve, smoke)botsuncoveredplan: one e2e/live_bot_<name>_test.go each, on the runBotLive harness, with the quality panel — same shape as the live-covered row. Compile-only coverage (bots.catalog-compiles) is NOT coverage of what these bots produce
studio-ui.run-consolerun console view: timeline, node detail, diffs, chatstudio-uicovered-deterministicstudio/e2e/specs/run-console.spec.tsPlaywright against the real server: the seeded run's IR graph (node ids, kinds, per-node status incl. the never-reached fail), its declared budget, its replayed edge-selection log lines and a published artifact's real payload all render. Chat needs a live agent — out of this row's deterministic reach
studio-ui.launch-modalLaunch modal: bot picker, vars, overrides, target repostudio-uicovered-deterministicstudio/e2e/specs/launch.spec.tsPlaywright: ?bot= resolves through the catalog to the workflow, the vars: block splits into required primaries vs defaulted Bot options, missing-required validation blocks the launch, and Engine options offers the workflow's own agent node for model retargeting. The "target repo" attach needs a forge connection (covered at REST level by the forge rows). The same spec found a REAL BUG — preview-cost answers nodes: null for a workflow with NO agent/judge node and CostPreviewChip dereferenced it, dropping the whole view into its error boundary — fixed in 457374dd; the test now asserts the positive contract (such a workflow still renders a launchable view)
studio-ui.board/board kanban with drag-and-dropstudio-uicovered-deterministicstudio/e2e/specs/board.spec.tsPlaywright: the native board's real columns + the CLI-seeded card render, and moving the card through the UI is asserted against the native store's REST read AND a reload (an optimistic-only client update fails). The move uses the selection toolbar rather than an HTML5 drag gesture — same mutation, same endpoint, no synthetic-DnD flake
studio-ui.pipelines/pipelines control-center board + concurrency capstudio-uicovered-deterministicstudio/e2e/specs/pipelines.spec.tsPlaywright: the banner renders the cap the server actually booted with (--max-concurrent-pipelines, read back from /api/server/info — changing one side alone turns it red), and the seeded finished runs land as Closed cards linking to their own run console
studio-ui.dispatcher/dispatcher live dashboardstudio-uicovered-deterministicstudio/e2e/specs/dispatcher.spec.tsPlaywright drives the whole lifecycle: Start refused without a config, settings saved, dispatcher started, then the dashboard asserted against THAT instance's real settings (name, tracker, poll interval, slots) and lane counters, then stopped through its confirm dialog. A second test asserts the server's own config-validation error reaches the dialog. Poll pinned to 1h so the actor never claims the seeded card mid-test
studio-ui.bots-gallery/bots gallery, per-bot home, guided builder /bots/newstudio-uicovered-deterministicstudio/e2e/specs/bots-gallery.spec.tsPlaywright: the gallery lists what botregistry discovered on disk (and its search filters that set), the per-bot home renders the manifest fields + "declares no vars", and the guided builder is driven end to end — the assertion is the bundle it WRITES (main.bot + manifest.yaml under bots/scaffold-probe/) and the registry picking it up, not a toast
studio-ui.editorworkflow editor + /api/parse round-tripstudio-uicovered-deterministicstudio/e2e/specs/editor.spec.tsPlaywright: the canvas + inspector are asserted against what the Go parser produced (node kinds, the tool node's command, entry node, budget) plus the real compiler diagnostic (C128), and an inspector edit is followed through save into the REWRITTEN .bot source on disk and back out through a fresh parse
studio-ui.editor-llm-metaagent/judge canvas cards show the resolved model and the authored fallbacks: chainstudio-uiunit-onlystudio/src/lib/modelLabel.test.tsdisplayModel never emits "env"; shortenModel keeps gpt-5.6-sol/terra/luna readable on a 160px card; displayFallbackChain joins routes in declaration order
studio-ui.secrets-viewSecrets view gated on server_info.secrets_enabledstudio-uicovered-deterministicstudio/e2e/specs/secrets.spec.tsPlaywright: the gate flag is asserted, then add → list → delete is driven through the UI with the SEALED store file on disk as the oracle (name + last4 present, plaintext absent). ITERION_HOME/HOME/ITERION_SECRETS_KEY are redirected into the throwaway workspace so the operator's own store and keychain are never touched
studio-ui.browser-paneBrowser pane / preview attachstudio-uicovered-deterministicstudio/e2e/specs/browser-pane.spec.tsPlaywright: a fixture tool node prints [iterion] preview_url=…, the runtime turns it into a preview_url_available event, and the pane auto-reveals carrying exactly that URL (bar + open link). The negative case — a run that published none has no Browser tab — pins the trigger. The URL is the suite's own loopback origin, so the iframe never leaves the test server. Live CDP attach needs a real Chromium session and stays out of the deterministic layer
desktop.wails-appWails desktop wrapper (window, runtime bridge, packaging)desktopunit-onlystudio/src/tests/desktopBridge.test.tsthe Go half is cgo + build-tagged (desktop,webkit2_41) and excluded from lint/CI; an e2e needs a GUI session — the bridge contract is the testable seam
integrations.third-party-oauthreal third-party OAuth consent flows (GitHub App, IdP, MCP OAuth)integrationsexcludedneeds a real provider tenant and a human consent screen; iterion's side (state/PKCE, callback handling, token storage) is covered by cloud.sso-oidc, forge.github-app and tools-mcp.mcp-oauth
integrations.claude-md-autoloadclaw TUI CLAUDE.md auto-loadintegrationsexcludeda claw-code-go TUI-boot behaviour with no iterion workflow surface; iterion uses its own command registry (carried over from docs/e2e_coverage.md)
integrations.claw-lifecycle-hooksclaw lifecycle hooks / ctx propagation into hook handlersintegrationsexcludediterion installs no lifehooks.Runner on its claw client, so there is no iterion-level behaviour to exercise; wiring one is a separate feature (carried over from docs/e2e_coverage.md)
integrations.permission-modes-autoclaw permission modes auto / dontAskintegrationsexcludediterion runs headless (workflow mode) and never surfaces these modes; the two it does use are covered by tools-mcp.permission-gate
</content> </invoke>