agent-desk-ng/docs/hardening/VALIDATION.md

Validation status: isolated checks, not a production release

Validated on 2026-10-16 against the integrated public-source baseline: Gitea main 299ea50fb5bb6874c3fca96277fce187205ac20a and hardening-review 63e045788623e88f7fd7b44102e649e08f4c1f1c, merged as 3868181, with the follow-up corrections listed below. This baseline does not include later knowledge-base localization or operator-availability feature work. Its historical results are retained below; the final combined-tree checks are recorded separately at the end of this document.

Isolation and toolchain

• Go 1.26.9, Node 24.19.0, pnpm 10.30.2, locked TypeScript 6.0.3/Next 16.2.11.
• Official Go archive checksum and downloaded Go module checksums verified. Frontend dependencies installed with the frozen lockfile and lifecycle scripts disabled. Dependency manifests/lockfiles were not changed.
• Tests ran with a cleared application environment, dedicated temporary/cache directories, temporary or in-memory SQLite fixtures, mocked frontend APIs and loopback WebSocket fixtures. No production configuration, credentials, databases, application server, or external support messages were used.
• The service test harness rejects non-loopback HTTP requests before the underlying transport/DNS, including redirects. Concrete Slack, Telegram, Discord, Zalo and HTTP email clients were inspected to confirm their default transport usage. The only test WebSocket dialer targets its own loopback server.
• Service fixtures explicitly replace the transitive AI-runtime hook with a test-only no-op. Dedicated hook tests still install their own spy; AI-runtime behavior is not claimed as covered by the service suite.
• TestHandleRequest* email/SMTP cases were excluded from the expanded service run: raw SMTP does not use the HTTP guard. No unrestricted go test ./... was run. This exclusion is an isolation limit, not a passing result.

Historical baseline completed checks

• gofmt on all changed Go files and git diff --check.
• go test ./internal/pkg/openidentity: passed, including scoped issuer/channel, signed-policy and signature-boundary tests.
• GOMAXPROCS=2 go test -p 2 -race -tags dev ./internal/pkg/eventbus ./internal/pkg/openidentity: passed.
• Focused service security/setup/realtime suite with -race -tags dev: 46 top-level tests, 102 successful test/subtest events, no failures or skips. Covers identity collisions/concurrent claims, live session revocation, permission boundaries, actual WebSocket pumps, channel CAS, preview/apply, rollback and dispatch outcomes, plus the transport guard and redirect check.
• GOMAXPROCS=2 go test -p 2 -tags dev ./internal/services -skip '^TestHandleRequest' -count=1: passed, 217 top-level tests and 295 successful test/subtest events.
• GOMAXPROCS=2 go build -p 2 -tags dev -buildvcs=false ./...: passed. The dev embedding mode is the repository CI test mode. VCS stamping was unavailable in the isolated worktree and was disabled only for this compile check.
• cd web && pnpm typecheck: passed with declared locked dependencies before the later six-file lint cleanup. The post-cleanup retry was killed with exit 137 without a TypeScript diagnostic; the final combined tree must rerun it.
• All frontend Node test files under app/components/hooks/i18n/lib: 226 tests passed, no failures or skips. This includes the SDK, draft revisions, account/customer-session isolation, setup contract, abortable realtime recovery, hidden/unmounted lifecycle and navigation checks.
• Four additional offline component-lifecycle regressions passed after the six-file lint cleanup (bulk-move selection/stale responses, palette snapshots, notification cleanup, editor/origin initialization). The earlier 226-test full run predates these four additions.
• Full pnpm lint: exit 0 after localized lifecycle corrections, with zero errors and 45 existing warnings. No lint rules were disabled.

Corrections found by execution

• The old realtime test fixture lacked required conversation counters. It now matches the DTO; the history/realtime merge assertion was retained unchanged.
• Async assignment notifications could outlive their test database. The eventbus now exposes a drain for already-published handlers, and the fixture waits before restoring global state. Nested publishes/error callbacks have a regression test. No sleep or disabled race check is used.
• Setup background responses are fenced by effect lifetime/request generation. The staff realtime hook captures its user ID in the effect rather than writing a ref during render. VM test harness variable names satisfy Next ESLint rules.
• Four missing generic setup locale keys were supplied in English, Russian and Chinese. Existing locale-integrity assertions are unchanged.
• Three stale source-test harnesses were aligned to current route groups and component ownership while retaining realtime placement, accessible label, trigger-style and collapsed-navigation checks.
• Seven existing lint errors across six components were corrected without rule suppressions: browser-origin/palette hydration now uses external snapshots; bulk-move targets reset on dialog/base changes and obsolete directory results are ignored; initial notification requests cannot update after cleanup; fullscreen initialization and toolbar construction no longer need the flagged mount-state effect or mutable ref-bearing action list.

Historical baseline remaining release gates

• Full-project lint has 45 existing warnings. The final feature integration must rerun lint, typecheck and the complete Node suite after all source changes.
• The canonical frontend export (pnpm build) did not complete. An initial cross-worktree node_modules symlink was replaced by a local offline frozen-lock installation. The subsequent default Turbopack build reached optimized compilation, then was killed with exit 137 and no source diagnostic while the shared environment had little free memory. This is not a successful build; a low-concurrency build on the final combined tree remains required. No build, typecheck or security checks were disabled to bypass this result.
• Actual MySQL CAS/nullable-unique-index behavior and additive schema upgrade/ identity reconciliation on an approved staging backup have not been run.
• Browser acceptance at desktop/narrow widths in Russian, English and Chinese has not been performed for this integrated baseline.
• Production migration, service startup and deployment have not been performed.

SQLite results do not establish MySQL behavior. Automated tests do not establish visual acceptance or a safe production upgrade. Preserve the identity/token upgrade precautions in CUSTOMER_IDENTITY_UPGRADE.md and preview/apply contract in SETUP_PREVIEW.md before any rollout.

Final combined source validation (2026-10-16)

The combined canonical checkout at 1ec72508cdda2dfe3b3eed3158f8ba930d76d260 includes security/realtime integration, knowledge localization, operator availability/calendar/presence, final locale changes and the two fixture-only corrections described below. These results are distinct from the historical baseline above and from the separately integrated CoverIt vendor tree.

The same sanitized toolchain, temporary SQLite fixtures and loopback-only test transport were used. No application server, production database, credentials, migration or external support message was used. Raw SMTP TestHandleRequest* cases remain excluded, and the service-suite AI hook remains a test-only no-op; neither scope is claimed as covered. No unrestricted go test ./... was run.

Completed combined checks

• All changed Go files are gofmt-clean; git diff --check passed.
• GOMAXPROCS=2 go test -p 2 -tags dev ./internal/services -skip '^TestHandleRequest' -count=1 -timeout=5m -json: passed, 240 top-level tests / 333 test-and-subtest events, no failures or skips. The same audited scope with -race passed with identical counts and no race report (181.272 seconds).
• Full race suites for internal/pkg/eventbus, internal/pkg/openidentity and internal/pkg/i18nx: 48 top-level tests / 78 successful events.
• Focused dashboard availability permission/ACL race tests: 4 tests passed.
• Focused knowledge handler, builder and RAG localization race tests: 12 top-level tests / 18 successful events, with mocked provider callbacks and no external application calls.
• GOMAXPROCS=2 go build -p 2 -tags dev -buildvcs=false ./...: passed. This is a complete source compile in the repository's test embedding mode, not a binary containing the production web export. VCS stamping was disabled only for the local compile environment.
• NODE_OPTIONS=--max-old-space-size=1024 pnpm typecheck: passed.
• Every frontend *.test.mjs under app/components/hooks/i18n/lib, run with node --test --test-concurrency=1: 262 tests in 14 suites passed; zero failures, cancellations or skips.
• Full pnpm lint: exit 0, zero errors and 42 warnings. No rules were disabled.

The first combined service run identified two obsolete fixture assumptions, not production-code failures. The realtime operator fixture now reuses the existing conversation.view permission without changing its state. Only the readiness success scenario that expects an eligible human now seeds an employee, current permission, login session and bounded live-presence lease. Negative permission scenarios and all original behavior assertions were retained. The full normal and race results above were obtained after these fixture repairs.

Asset assembly and packaging limit

• Both frontend projects used unchanged frozen lockfiles with dependency lifecycle scripts disabled. Web dependencies totalled 978 locked packages; Flowgram dependencies totalled 953. Official Go/module integrity checks passed.
• Flowgram's production pnpm build passed and generated its complete public assets. Third-party parser warnings were reported, without build errors.
• The SDK's official pnpm build:sdk ran twice; both outputs were deterministic and byte-identical to the tracked bundle. No generated SDK change is required.
• The default Next 16.2.11 Turbopack production build did not complete: optimized compilation ended with exit 137 (Killed), without a source diagnostic.
• A sequential supported next build --webpack attempt, with a 1 GiB Node heap and bounded workers, ended with a build-worker SIGKILL, also without a source diagnostic. This was not a successful alternate export.
• One distinct experiment used the documented memory optimization experimental.webpackMemoryOptimizations option and a 640 MiB Node heap. It ended with an explicit JavaScript heap-out-of-memory error and worker SIGABRT. The temporary config was restored byte-for-byte afterward. No build check, typecheck, security setting, font or application asset was bypassed or mocked. Official Google font CSS and a real font asset were reachable through the existing trusted proxy configuration.
• Dependency manifest and lockfile hashes, and the tracked SDK hash, remained unchanged by assembly; no production source/config edit was retained. No native production-embedded binary was assembled because a complete Next export was not available. Flowgram/SDK success and the -tags dev Go compile do not satisfy that packaging gate.

The default frontend export and complete native assembly therefore still need a suitably provisioned isolated build environment. These failures do not prove a source defect, and the passed tests do not establish a deployable release. Actual MySQL behavior, approved staging upgrade/identity reconciliation, real browser desktop/narrow-width acceptance in Russian/English/Chinese and production migration/startup/deployment remain unverified. Preserve all upgrade precautions above. No cross-platform or LanceDB release assembly was attempted.