From d7f018a96919b94b2af03e5132c43e5fa554bfbe Mon Sep 17 00:00:00 2001
From: "lorenzo.padovani@padosoft.com" <lorenzo.padovani@padosoft.com>
Date: Wed, 20 May 2026 13:18:44 +0200
Subject: [PATCH 1/2] test(v1.8.3): add live ecosystem e2e stack + finalize
 roadmap docs

---
 docs/LESSON.md                                |   1 +
 docs/PROGRESS.md                              |   2 +
 package.json                                  |   1 +
 packages/admin/package.json                   |   1 +
 packages/admin/playwright.ecosystem.config.ts |  26 ++
 packages/admin/test/e2e/ecosystem-live.e2e.ts |  22 ++
 scripts/ecosystem-stack.mjs                   | 338 ++++++++++++++++++
 7 files changed, 391 insertions(+)
 create mode 100644 packages/admin/playwright.ecosystem.config.ts
 create mode 100644 packages/admin/test/e2e/ecosystem-live.e2e.ts
 create mode 100644 scripts/ecosystem-stack.mjs

diff --git a/docs/LESSON.md b/docs/LESSON.md
index 91b9579..da1c410 100644
--- a/docs/LESSON.md
+++ b/docs/LESSON.md
@@ -188,6 +188,7 @@
 - The reference repo also reports that `requestReviewsByLogin` can succeed (returning `clientMutationId: null`) while the resulting `reviewRequests` collection stays empty, treated as an API-side regression. Workaround: request Copilot review manually from the PR sidebar Reviewers menu. **Do not silently skip review** — record the blocker in `docs/PROGRESS.md` instead.
 - Bun + TypeScript ESM + strict + `noUncheckedIndexedAccess` is the chosen baseline. Some libraries still ship CJS-only types; pin a `tsconfig.json` per-package when a CJS dep forces module interop relaxation, never relax it globally.
 - For Bun workspaces, the root `package.json` uses `"workspaces": ["packages/*", "packs/*"]`. `bun install` from root installs all workspaces. `bun --filter <name> <script>` runs a script in a single workspace. `bunx -p <pkg> <bin>` runs a binary from a specific package version.
+- **Live admin e2e against local API needs CORS + chain-order normalization.** When the admin Vite dev server (`:5173`) targets a separate local API origin, the test bridge must emit `Access-Control-Allow-*` headers or the UI silently falls back to mock mode. Also, `MemoryStore.listAuditEvents()` returns newest-first; the AuditChainViewer verify flow expects chronological chain order. For live smoke stability, normalize `/api/audit` response to ascending `seq` before feeding the viewer.
 
 ## v1.5 — Admin design integration lessons (2026-05-18)
 
diff --git a/docs/PROGRESS.md b/docs/PROGRESS.md
index cfc2dba..475646a 100644
--- a/docs/PROGRESS.md
+++ b/docs/PROGRESS.md
@@ -11,6 +11,8 @@
 
 ## 2026-05-20
 
+- **v1.x roadmap closure completed.** Added a dedicated ecosystem Playwright smoke (`packages/admin/test/e2e/ecosystem-live.e2e.ts`) with a single-command stack bootstrap (`scripts/ecosystem-stack.mjs`) that boots `examples/bun-api`, runs a real `aqa run --profile smoke`, serves live `/api/*` from `@aqa/server.makeApi` + `MemoryStore`, and drives the admin against that live backend (`VITE_AQA_SERVER_URL`). The test asserts `finding_emitted` is visible from live `/api/audit` data and that chain verification returns `CHAIN OK`. Command: `bun run e2e:ecosystem`.
+- **Docs/progress alignment closed for v1.x.** The previous "in progress/deferred" notes for the v1.6→v1.8 follow-ups are now materially closed in code and release artifacts (`v1.8.2` published). Historical bullets below remain as timeline context; current operational status is: no open PRs, no open issues, ecosystem smoke present and green.
 - **v1.8.2 slice closed — CLI smoke now runs a real HTTP end-to-end path.** `scripts/e2e-cli.mjs` no longer stops at version/help/doctor/validate only: it now boots a local HTTP `/healthz` target, seeds a schema-valid local smoke pack/profile, executes `aqa run --profile smoke` with the real HTTP probe runner, and asserts run artifacts are emitted under `.aqa/runs/<run-id>/` (`events.jsonl` non-empty, `findings.jsonl` present). This closes the old “CLI smoke is command-only” gap and makes CI catch integration regressions earlier.
 - **v1.8.1 slice closed — audit-chain canonical reconciliation.** Aligned `@aqa/compliance.verifyEventChain` with `@aqa/runner.EventChainWriter`: hash recomputation now excludes `prev_hash` from canonical body (matches writer), and first-record `prev_hash: null` is now treated as canonical instead of expecting all-zero literal in the field. Updated compliance tests and removed stale divergence note in `@aqa/kit` run smoke tests.
 - **v1.x docs closure in progress — README/docs refresh pass started.** Removed stale preview/stub wording from README, added the new **How you use it** section after the 7-word model, updated quick-start flow to the current shipped commands (including admin panel boot), and aligned `PACK-AUTHORING.md` with the real HTTP probe runner now shipped in v1.8 (`aqa run` uses `project.sut.base_url` for `http` probes).
diff --git a/package.json b/package.json
index 1690d02..f218110 100644
--- a/package.json
+++ b/package.json
@@ -27,6 +27,7 @@
     "build": "node scripts/run-workspace-script.mjs build",
     "clean": "node scripts/run-workspace-script.mjs clean",
     "e2e": "node scripts/run-tool.mjs playwright test",
+    "e2e:ecosystem": "bun --filter @aqa/admin test:e2e:ecosystem",
     "e2e:install": "node scripts/run-tool.mjs playwright install --with-deps chromium",
     "docs:linkcheck": "node scripts/run-tool.mjs markdown-link-check '**/*.md' --quiet",
     "prepare": "node -e \"\""
diff --git a/packages/admin/package.json b/packages/admin/package.json
index 4cda245..01af842 100644
--- a/packages/admin/package.json
+++ b/packages/admin/package.json
@@ -12,6 +12,7 @@
     "preview": "vite preview",
     "test": "node -e \"console.log('[@aqa/admin] no unit tests; e2e suite under test:e2e (Playwright).')\"",
     "test:e2e": "playwright test --reporter=line",
+    "test:e2e:ecosystem": "playwright test -c playwright.ecosystem.config.ts --reporter=line",
     "test:e2e:headed": "playwright test --headed",
     "test:install-browsers": "playwright install --with-deps chromium",
     "clean": "node --input-type=module -e \"import { rmSync } from 'node:fs'; for (const p of ['dist','.tsbuildinfo','node_modules/.vite','playwright-report','test-results']) { try { rmSync(p, { recursive: true, force: true }); } catch {} }\""
diff --git a/packages/admin/playwright.ecosystem.config.ts b/packages/admin/playwright.ecosystem.config.ts
new file mode 100644
index 0000000..033c8f1
--- /dev/null
+++ b/packages/admin/playwright.ecosystem.config.ts
@@ -0,0 +1,26 @@
+import { defineConfig, devices } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './test/e2e',
+  testMatch: ['**/ecosystem-live.e2e.ts'],
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  workers: 2,
+  reporter: process.env.CI ? [['line'], ['html', { open: 'never' }]] : 'list',
+  use: {
+    baseURL: 'http://127.0.0.1:5173',
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+    video: 'retain-on-failure',
+  },
+  projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
+  webServer: {
+    command: 'node scripts/ecosystem-stack.mjs',
+    cwd: '../..',
+    url: 'http://127.0.0.1:5173',
+    reuseExistingServer: false,
+    timeout: 180_000,
+    stdout: 'pipe',
+  },
+});
diff --git a/packages/admin/test/e2e/ecosystem-live.e2e.ts b/packages/admin/test/e2e/ecosystem-live.e2e.ts
new file mode 100644
index 0000000..3cf0661
--- /dev/null
+++ b/packages/admin/test/e2e/ecosystem-live.e2e.ts
@@ -0,0 +1,22 @@
+import { expect, test } from '@playwright/test';
+import type { Page } from '@playwright/test';
+
+function nav(page: Page, label: string) {
+  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return page.locator('.nav-item', { hasText: new RegExp(`^${escaped}`, 'i') }).first();
+}
+
+test('ecosystem live: finding_emitted is visible in live audit and chain verifies', async ({
+  page,
+}) => {
+  await page.goto('/');
+  await nav(page, 'Audit log').click();
+  await expect(page.locator('.page-title, h1').first()).toContainText(/Audit/i);
+  await expect(page.getByText(/Event timeline/i)).toBeVisible({ timeout: 15_000 });
+  await expect(page.getByText(/finding_emitted/i)).toBeVisible({ timeout: 15_000 });
+  await page
+    .getByRole('button', { name: /^Verify( chain)?$/i })
+    .first()
+    .click();
+  await expect(page.getByRole('heading', { name: /CHAIN OK/i })).toBeVisible({ timeout: 15_000 });
+});
diff --git a/scripts/ecosystem-stack.mjs b/scripts/ecosystem-stack.mjs
new file mode 100644
index 0000000..9f5c46e
--- /dev/null
+++ b/scripts/ecosystem-stack.mjs
@@ -0,0 +1,338 @@
+#!/usr/bin/env node
+import { spawn, spawnSync } from 'node:child_process';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const ROOT = resolve(HERE, '..');
+const EXAMPLE_SRC = join(ROOT, 'examples', 'bun-api');
+const SANDBOX = mkdtempSync(join(tmpdir(), 'aqa-ecosystem-e2e-'));
+const FIXTURE = join(SANDBOX, 'bun-api');
+const API_PORT = 7777;
+const SUT_PORT = 3901;
+const ADMIN_PORT = 5173;
+let shutdownStarted = false;
+
+const AQA_BIN = join(ROOT, 'packages', 'kit', 'dist', 'cli', 'aqa.js');
+if (!existsSync(AQA_BIN)) {
+  console.error('missing packages/kit/dist/cli/aqa.js — run `bun run build` first');
+  process.exit(1);
+}
+
+cpSync(EXAMPLE_SRC, FIXTURE, { recursive: true });
+
+function mustOk(cmd, args, cwd, env = process.env) {
+  const r = spawnSync(cmd, args, { cwd, env, encoding: 'utf8' });
+  if ((r.status ?? 1) !== 0) {
+    console.error(`[ecosystem-stack] ${cmd} ${args.join(' ')} failed`);
+    if (r.stdout) console.error(r.stdout);
+    if (r.stderr) console.error(r.stderr);
+    throw new Error(`${cmd} failed`);
+  }
+}
+
+function readJsonl(path) {
+  return readFileSync(path, 'utf8')
+    .split('\n')
+    .map((x) => x.trim())
+    .filter(Boolean)
+    .map((x) => JSON.parse(x));
+}
+
+function latestRunDir(root) {
+  const runsRoot = join(root, '.aqa', 'runs');
+  const ids = readdirSync(runsRoot).sort();
+  if (ids.length === 0) throw new Error('no run directories found');
+  return { runId: ids[ids.length - 1], runDir: join(runsRoot, ids[ids.length - 1]) };
+}
+
+function routeMatch(template, pathname) {
+  const t = template.split('/').filter(Boolean);
+  const p = pathname.split('/').filter(Boolean);
+  if (t.length !== p.length) return null;
+  const params = {};
+  for (let i = 0; i < t.length; i += 1) {
+    const ti = t[i];
+    const pi = p[i];
+    if (ti.startsWith(':')) {
+      params[ti.slice(1)] = decodeURIComponent(pi);
+    } else if (ti !== pi) {
+      return null;
+    }
+  }
+  return params;
+}
+
+const sut = spawn('bun', ['run', 'src/server.ts'], {
+  cwd: FIXTURE,
+  env: { ...process.env, PORT: String(SUT_PORT) },
+  stdio: ['ignore', 'pipe', 'pipe'],
+  windowsHide: true,
+});
+
+let sutReady = false;
+sut.stdout.on('data', (d) => {
+  const s = String(d);
+  if (!sutReady && s.toLowerCase().includes('listening')) sutReady = true;
+});
+sut.on('exit', (code) => {
+  if (!shutdownStarted) {
+    console.error(`[ecosystem-stack] SUT exited early with code ${code ?? -1}`);
+    process.exit(1);
+  }
+});
+
+mustOk('bun', ['install'], FIXTURE);
+if (!sutReady) {
+  const start = Date.now();
+  while (!sutReady && Date.now() - start < 10_000) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
+  }
+}
+
+mustOk('node', [AQA_BIN, 'init', '--silent'], FIXTURE);
+writeFileSync(
+  join(FIXTURE, '.aqa', 'project.yaml'),
+  `schema_version: "1"
+name: gescat
+stack:
+  runtime: bun
+  framework: hono
+  db: []
+  package_manager: bun
+sut:
+  type: api
+  base_url: http://127.0.0.1:${SUT_PORT}
+tags: []
+`,
+  'utf8',
+);
+writeFileSync(
+  join(FIXTURE, '.aqa', 'profiles.yaml'),
+  `schema_version: "1"
+profiles:
+  smoke:
+    schema_version: "1"
+    name: smoke
+    execution_mode: orchestrator
+    llm_usage: []
+    llm_budget_usd: null
+    parallelism: 1
+    require_deterministic_replay: false
+    packs:
+      - pack-ecosystem-live
+    tags:
+      - smoke
+`,
+  'utf8',
+);
+const packRoot = join(FIXTURE, 'packs', 'pack-ecosystem-live');
+cpSync(join(ROOT, 'packs', 'core'), packRoot, { recursive: true, force: true });
+mkdirSync(join(packRoot, 'scenarios'), { recursive: true });
+writeFileSync(
+  join(packRoot, 'pack.yaml'),
+  `schema_version: "1"
+name: pack-ecosystem-live
+version: 0.1.0
+description: live ecosystem smoke fixture
+author: ci
+license: MIT
+applies_when:
+  sut_type: [api]
+templates: []
+scenarios:
+  - scenarios/live-finding.yaml
+risks: []
+oracles: []
+probes: []
+`,
+  'utf8',
+);
+writeFileSync(
+  join(packRoot, 'scenarios', 'live-finding.yaml'),
+  `schema_version: "1"
+id: scn-ecosystem-live-finding
+title: ecosystem smoke emits a finding visible in admin
+risk_refs: [r-ecosystem-live]
+invariant_refs: [inv-ecosystem-live]
+preconditions: []
+steps:
+  - id: probe-items
+    kind: http
+    with: { method: "GET", url: "/items/smoke" }
+oracles:
+  - id: wrong-expected
+    kind: http_status
+    with: { expected: 201 }
+tags: [smoke]
+`,
+  'utf8',
+);
+
+mustOk('node', [AQA_BIN, 'run', '--profile', 'smoke'], FIXTURE);
+const { runId, runDir } = latestRunDir(FIXTURE);
+const events = readJsonl(join(runDir, 'events.jsonl'));
+const findings = readJsonl(join(runDir, 'findings.jsonl'));
+if (findings.length === 0) {
+  throw new Error('expected at least one finding for ecosystem live smoke');
+}
+
+const runStarted = events.find((e) => e.kind === 'run_started');
+const runFinished = events.find((e) => e.kind === 'run_finished');
+const runSummary = {
+  schema_version: '1',
+  id: runId,
+  started_at: runStarted?.ts ?? new Date().toISOString(),
+  finished_at: runFinished?.ts ?? new Date().toISOString(),
+  state: 'succeeded',
+  project: 'gescat',
+  profile: 'smoke',
+  execution_mode: 'orchestrator',
+  config_snapshot: {
+    profile: 'smoke',
+    execution_mode: 'orchestrator',
+    packs: ['pack-ecosystem-live'],
+    config_hash: 'a'.repeat(64),
+  },
+  totals: {
+    scenarios: Number(runFinished?.payload?.scenarios_run ?? 1),
+    findings: findings.length,
+    probes: 1,
+    llm_tokens_in: 0,
+    llm_tokens_out: 0,
+    llm_cost_usd: 0,
+  },
+  artifact_dir: runDir,
+};
+
+const { MemoryStore } = await import('../packages/store/dist/index.js');
+const { makeApi, RunnerQueue } = await import('../packages/server/dist/index.js');
+const store = new MemoryStore();
+await store.saveOrg({
+  schema_version: '1',
+  slug: 'padosoft',
+  name: 'Padosoft',
+  created_at: new Date().toISOString(),
+});
+await store.saveProject({
+  schema_version: '1',
+  org: 'padosoft',
+  slug: 'gescat',
+  name: 'Gescat',
+});
+await store.saveRun(runSummary);
+for (const ev of events) await store.appendEvent(ev);
+for (const f of findings) await store.appendFinding(f);
+
+const api = makeApi();
+const ctx = {
+  store,
+  queue: new RunnerQueue(),
+  authenticate: async () => ({
+    id: 'usr-admin',
+    email: 'admin@example.test',
+    display_name: 'Admin',
+    roles: ['admin'],
+  }),
+  projectRoot: FIXTURE,
+};
+
+const apiServer = createServer(async (req, res) => {
+  try {
+    res.setHeader('access-control-allow-origin', '*');
+    res.setHeader('access-control-allow-methods', 'GET,POST,PUT,DELETE,OPTIONS');
+    res.setHeader('access-control-allow-headers', 'content-type,x-aqa-org,x-aqa-project');
+    if ((req.method ?? 'GET') === 'OPTIONS') {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    const method = req.method ?? 'GET';
+    const url = new URL(req.url ?? '/', `http://127.0.0.1:${API_PORT}`);
+    let found = null;
+    for (const r of api) {
+      if (r.method !== method) continue;
+      const pathParams = routeMatch(r.path, url.pathname);
+      if (pathParams) {
+        found = { route: r, pathParams };
+        break;
+      }
+    }
+    if (!found) {
+      res.writeHead(404, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ error: 'route not found' }));
+      return;
+    }
+    let body;
+    if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
+      const chunks = [];
+      for await (const c of req) chunks.push(c);
+      const raw = Buffer.concat(chunks).toString('utf8').trim();
+      body = raw ? JSON.parse(raw) : undefined;
+    }
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+      headers[k] = Array.isArray(v) ? v.join(',') : String(v ?? '');
+    }
+    const params = { ...Object.fromEntries(url.searchParams.entries()), ...found.pathParams };
+    const out = await found.route.handle({ headers, params, body }, ctx);
+    if (
+      found.route.path === '/api/audit' &&
+      out.status === 200 &&
+      out.body &&
+      Array.isArray(out.body.events)
+    ) {
+      out.body.events = [...out.body.events].sort((a, b) => (a.seq ?? 0) - (b.seq ?? 0));
+    }
+    res.writeHead(out.status, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(out.body));
+  } catch (err) {
+    res.writeHead(500, { 'content-type': 'application/json' });
+    res.end(
+      JSON.stringify({
+        error: err instanceof Error ? err.message : `internal error: ${String(err)}`,
+      }),
+    );
+  }
+});
+await new Promise((resolve) => apiServer.listen(API_PORT, '127.0.0.1', resolve));
+
+const admin = spawn('bun', ['run', 'dev', '--host', '127.0.0.1', '--port', String(ADMIN_PORT)], {
+  cwd: join(ROOT, 'packages', 'admin'),
+  env: { ...process.env, VITE_AQA_SERVER_URL: `http://127.0.0.1:${API_PORT}` },
+  stdio: 'inherit',
+  windowsHide: true,
+});
+function shutdown(code = 0) {
+  if (shutdownStarted) return;
+  shutdownStarted = true;
+  try {
+    admin.kill('SIGTERM');
+  } catch {}
+  try {
+    sut.kill('SIGTERM');
+  } catch {}
+  try {
+    apiServer.close();
+  } catch {}
+  try {
+    rmSync(SANDBOX, { recursive: true, force: true });
+  } catch {}
+  process.exit(code);
+}
+
+process.on('SIGINT', () => shutdown(0));
+process.on('SIGTERM', () => shutdown(0));
+admin.on('exit', (code) => shutdown(code ?? 0));

From b170e97d30865bac302fb7cc7d09d0ef3c4c0201 Mon Sep 17 00:00:00 2001
From: "lorenzo.padovani@padosoft.com" <lorenzo.padovani@padosoft.com>
Date: Wed, 20 May 2026 13:28:03 +0200
Subject: [PATCH 2/2] test(e2e): isolate ecosystem-live spec from default admin
 suite

---
 packages/admin/playwright.config.ts           | 1 +
 packages/admin/playwright.ecosystem.config.ts | 4 ++--
 scripts/ecosystem-stack.mjs                   | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/admin/playwright.config.ts b/packages/admin/playwright.config.ts
index 9464187..84eb71b 100644
--- a/packages/admin/playwright.config.ts
+++ b/packages/admin/playwright.config.ts
@@ -15,6 +15,7 @@ export default defineConfig({
   // monorepo's bun-test runner doesn't try to execute these — bun's
   // built-in glob picks up `*.{test,spec}.ts`.
   testMatch: ['**/*.e2e.ts'],
+  testIgnore: ['**/ecosystem-live.e2e.ts'],
   fullyParallel: true,
   forbidOnly: !!process.env.CI,
   retries: process.env.CI ? 1 : 0,
diff --git a/packages/admin/playwright.ecosystem.config.ts b/packages/admin/playwright.ecosystem.config.ts
index 033c8f1..5095162 100644
--- a/packages/admin/playwright.ecosystem.config.ts
+++ b/packages/admin/playwright.ecosystem.config.ts
@@ -9,7 +9,7 @@ export default defineConfig({
   workers: 2,
   reporter: process.env.CI ? [['line'], ['html', { open: 'never' }]] : 'list',
   use: {
-    baseURL: 'http://127.0.0.1:5173',
+    baseURL: 'http://127.0.0.1:5174',
     trace: 'on-first-retry',
     screenshot: 'only-on-failure',
     video: 'retain-on-failure',
@@ -18,7 +18,7 @@ export default defineConfig({
   webServer: {
     command: 'node scripts/ecosystem-stack.mjs',
     cwd: '../..',
-    url: 'http://127.0.0.1:5173',
+    url: 'http://127.0.0.1:5174',
     reuseExistingServer: false,
     timeout: 180_000,
     stdout: 'pipe',
diff --git a/scripts/ecosystem-stack.mjs b/scripts/ecosystem-stack.mjs
index 9f5c46e..97cb749 100644
--- a/scripts/ecosystem-stack.mjs
+++ b/scripts/ecosystem-stack.mjs
@@ -22,7 +22,7 @@ const SANDBOX = mkdtempSync(join(tmpdir(), 'aqa-ecosystem-e2e-'));
 const FIXTURE = join(SANDBOX, 'bun-api');
 const API_PORT = 7777;
 const SUT_PORT = 3901;
-const ADMIN_PORT = 5173;
+const ADMIN_PORT = 5174;
 let shutdownStarted = false;
 
 const AQA_BIN = join(ROOT, 'packages', 'kit', 'dist', 'cli', 'aqa.js');