# Validation Baseline

## Date

2026-07-18

## Environment

- Target toolchain: Node.js 20 and npm 10
- Executed toolchain: Node.js 20.20.2 and npm 10.9.8, supplied ephemerally through `npx`
- Docker CLI: available on Windows
- Docker engine: unavailable because Docker Desktop's Linux engine was not running
- Docker inside WSL: unavailable because WSL integration was disabled

## Dependency Installation

- Root `npm ci`: passed under the preinstalled WSL Node 18/npm 9 toolchain; reported 2 high-severity audit findings in `ajv-cli` dependencies.
- Frontend clean install initially failed because `frontend/package-lock.json` was missing `yaml@2.9.0`.
- `npm install --package-lock-only` under Node 20/npm 10 repaired the frontend lockfile.
- Frontend clean install then passed under Node 20/npm 10; npm reported 28 dependency vulnerabilities: 9 low, 6 moderate, and 13 high.
- Backend clean install passed under Node 20/npm 10; npm reported 0 vulnerabilities.

## Automated Checks

### Frontend tests

Command:

```bash
npx --yes --package=node@20 --package=npm@10 npm test -- --watchAll=false --runInBand
```

Result: Passed.

- Test suites: 7 passed, 7 total
- Tests: 433 passed, 433 total
- Snapshots: 0

### Frontend production build

Command:

```bash
npx --yes --package=node@20 --package=npm@10 npm run build
```

Result: Passed.

### Backend TypeScript build

Command:

```bash
npx --yes --package=node@20 --package=npm@10 npm run build
```

Result: Passed.

## Schema Matrix

Twelve `valid-*.json` project definitions pass validation against `shared/schemas/conductor-project.schema.json`, including the Slice 1 all-components fixture.

Two schema-invalid fixtures failed validation as expected:

- `invalid-dropdown-option-shape.json`
- `invalid-missing-required.json`

Two diagnostic-invalid fixtures passed structural schema validation as designed because their defects require semantic/runtime diagnostics:

- `invalid-template-malformed.json`
- `invalid-template-missing-component.json`
## Slice 1 Manual Acceptance

User validation completed successfully on 2026-07-18:

- All five new components can be configured and manipulated in the Visual Editor.
- Preview interaction, disabled and hidden behavior, and Status Panel tones work as expected.
- Visual Editor and JSON Editor synchronization works.
- Save/load persistence and existing-component regression checks pass.


## Slice 2 Increment 1 Validation

Validation completed on 2026-07-18 for visual anonymous REST action authoring.

### Focused editor tests

Command:

```bash
npm test -- --watchAll=false --runInBand --runTestsByPath \
  src/components/ActionInspector/actionEditorUtils.test.ts \
  src/components/ActionInspector/ActionInspector.test.tsx
```

Result: Passed.

- Test suites: 2 passed, 2 total
- Tests: 23 passed, 23 total
- Covers canonical CRUD, duplicate-ID safety, reference discovery, request-map and URL validation, anonymous duplication, immediate document synchronization, and invalid local drafts.

### Full target-toolchain checks

Commands:

```bash
npx --yes --package=node@20 --package=npm@10 npm test -- --watchAll=false --runInBand
npx --yes --package=node@20 --package=npm@10 npm run build
```

The frontend commands ran from `frontend/`. The build command also ran from `backend/`.

Results:

- Frontend tests: 9 suites and 456 tests passed; 0 snapshots.
- Frontend production build: passed.
- Backend TypeScript build: passed.

### Schema fixture matrix

Each fixture was checked with:

```bash
./node_modules/.bin/ajv validate \
  -s shared/schemas/conductor-project.schema.json \
  -d <fixture> \
  --spec=draft2020
```

Results:

- 13 of 13 `valid-*.json` fixtures passed, including `valid-visual-rest-actions.json`.
- 2 of 2 schema-invalid fixtures failed as expected.
- 2 of 2 diagnostic-invalid fixtures passed structural validation as designed.

### Standalone frontend TypeScript check

Command:

```bash
npx tsc --noEmit
```

Result: Blocked by an existing dependency/toolchain mismatch. Frontend TypeScript 4.9 cannot parse syntax in resolved `@types/node@26.1.0` (first error: `node_modules/@types/node/ffi.d.ts(94,21): TS1139`). The CRA production build performs the application TypeScript compile and passed.

### Visual QA

The frontend development server compiled successfully at `http://localhost:3000`. In-app browser automation could not start during implementation while Docker Desktop was not running; its Node REPL kernel reported `helper_unknown_error: setup refresh had errors` during Windows sandbox setup.

After Docker Desktop and the app were started, the user completed the Slice 2 Increment 1 manual acceptance on 2026-07-19. The accepted workflow covered visual anonymous REST action authoring, a Button `events` entry inserted through canonical JSON for an `onClick` action reference, and referenced-action deletion confirmation. Full Slice 2 workflow-launcher and dependent-data acceptance remains pending later increments.


## Runtime Startup

Initial backend startup against a clean SQLite database failed with:

```text
SqliteError: no such table: projects
```

Cause: `backend/src/index.ts` statically imported `app` before calling `initDatabase()`. Importing the app loaded project routes and prepared SQL statements before the `projects` table existed.

Fix: run `initDatabase()` first, then dynamically import the Express app and start listening.

After the fix, clean-database startup, HTTP health, complete CRUD, cleanup, and persistence across a backend container restart all passed.

## Docker Validation

Docker Desktop was started and validation completed. Both images built, both services started, the frontend compiled, the backend initialized SQLite, and health, CRUD, cleanup, and restart-persistence checks passed.

## Baseline Status

Passing for the current automated and Docker smoke-test scope:

- [x] Locked frontend dependencies repaired
- [x] Frontend tests pass
- [x] Frontend production build passes
- [x] Backend TypeScript build passes
- [x] Schema matrix behaves as expected
- [x] Backend starts against a clean database
- [x] Health and CRUD smoke checks pass
- [x] Persistence survives a backend container restart
- [x] Docker Compose build and integration checks pass

Remaining release work includes broader backend tests, browser end-to-end tests, security regression tests, and resolution of the frontend dependency audit findings.

## Slice 2 Increment 2 Button Event Validation

On 2026-07-19, focused tests passed (3 suites / 6 tests), full frontend tests passed (12 suites / 462 tests), the frontend and backend builds passed, and the schema matrix passed at 13 / 2 / 2. `ComponentEvent.inputMap` was documented as compatibility-only; executed request inputs continue to use component/variable REST templates. Automated Preview dispatch passed. The user then manually verified creating a REST action and assigning it visually to a Button; Increment 2 Button `onClick` acceptance passed.

## Slice 2 Request Input Validation

On 2026-07-19, focused request-input tests passed at 3 suites / 9 tests, the full frontend suite passed at 14 suites / 467 tests, frontend and backend builds passed, and the schema matrix passed at 13 / 2 / 2.

The UI writes executed component/variable templates to URL, header, query, and body fields while excluding path parameters and `inputMap`. Standalone `tsc` reproduced the recorded dependency mismatch. Manual request-input acceptance passed on 2026-07-28.

### Manual request-input acceptance checklist (completed 2026-07-28)

1. Start Docker Desktop and run Conductor through Docker Compose.
2. Open a project containing a Text Input or Dropdown, a Button, and an anonymous REST action.
3. Edit the action and add a query parameter such as `item`.
4. In Request value reference, choose the component, choose `Query: item`, and insert the reference.
5. Confirm canonical JSON immediately contains `"item": "{{components.<componentName>.value}}"` and does not add `inputMap`.
6. Assign the action to the Button, enter or select a Preview value, and execute it.
7. Confirm the outgoing request uses the runtime component value and loading, response, and error state remain ephemeral.
8. Confirm path parameters are not offered as destinations and raw URL/header/query/body template editing still works.
9. If an existing JSON-authored variable is available, repeat insertion and verify `{{variables.<name>}}` resolution.

## Slice 2 Response Binding and Variable Validation

On 2026-07-20, focused configuration tests passed under Node 20/npm 10 at 2 suites / 14 tests. The full frontend suite passed at 15 suites / 477 tests with 0 snapshots. The frontend CRA production compile and backend TypeScript build passed. The schema fixture matrix passed at 13 valid fixtures, 2 expected schema failures, and 2 diagnostic-invalid fixtures that remain structurally valid.

Automated coverage verifies canonical response-binding and variable creation/editing/deletion, the `onSuccess` default for new action-response bindings, supported and unambiguous target filtering, typed variable default parsing, canonical synchronization, binding-editor deletion lifecycle, and reference-aware variable deletion warnings. Existing legacy `onClick` compatibility remains in runtime and diagnostics and supports one-way visual migration; the UI cannot create a new `onClick` response binding. No deprecated `action.responseMapping` behavior was added.

Standalone frontend `npx tsc --noEmit` continues to fail in `node_modules/@types/node/ffi.d.ts` because the project's TypeScript 4.9 compiler cannot parse the resolved `@types/node@26.1.0` declarations. This is reported separately from the successful CRA production TypeScript compile.

Response-binding and variable manual acceptance remains pending. Docker Compose services and health passed on 2026-07-28; the prior WSL-integration blocker is resolved.

### 2026-07-29 Boolean Variable Default Fix

Manual typed-variable testing exposed a boolean editor defect: partial input was reset to false, so true could not be authored. The control was replaced by an explicit optional boolean selector. The focused Actions and Bindings tests passed at 2 suites / 14 tests, the full frontend suite passed at 15 suites / 477 tests, and the production build passed. The rebuilt frontend returned HTTP 200 and the user confirmed true is saved as a canonical JSON boolean. Typed-variable declarations and invalid-draft isolation are manually accepted; the rest of the response-binding/variable workflow remains pending.

Component response-binding manual acceptance passed on 2026-07-29. The initial httpbin.org endpoint intermittently returned 503 and correctly did not apply onSuccess. After switching to verified https://httpbingo.org/anything, the proxy returned HTTP 200 and the JSON Viewer displayed the mapped response body. Remaining response-binding/variable checks are pending. Variable response-binding manual acceptance also passed: the first response updated runtime statusText, the second request consumed it, and the canonical Not run default remained unchanged. Binding edit and selected deletion also passed, preserving the unrelated binding and restoring the add control. A deferred UI follow-up tracks clearer record boundaries and hierarchy in Actions and Bindings. Unsupported TextInput and ambiguous duplicate-name targets were manually confirmed excluded. Referenced-variable warning, cancellation, accepted deletion, and unresolved diagnostics also passed. Legacy onClick execution, diagnostics, and one-way migration to onSuccess also passed. Failure-state testing found a clipped Button error. The alert now renders below the fixed-height Button with wrapping, stale errors clear on retry/success, focused Preview tests passed at 2 suites/7 tests, the full suite at 15 suites/478 tests, and the production build passed. The user confirmed readable 503 handling, onSuccess suppression, clean canonical state, and stale-error clearing. Save/reload persistence and runtime reset passed, completing response-binding and variable manual acceptance on 2026-07-29.
### Manual request-input acceptance record

On 2026-07-20, the user confirmed that the item query-parameter row and guided Request value reference insertion into Query: item looked correct.

On 2026-07-28, Docker Compose startup, both services, and backend health passed. The user then confirmed that all remaining request-input checks passed: canonical component templates without inputMap, path-destination exclusion, execution with runtime component and variable values, ephemeral runtime-state separation, and continued raw-template editing. The complete request-input workflow is manually accepted.

## Slice 2 Page-Load Action Validation

On 2026-07-29, visual initial-page onLoad authoring and once-per-Preview initialization were implemented in the working tree. Editor coverage verifies add/change/clear behavior, unrelated-event preservation, duplicate normalization, immediate canonical updates, the no-action state, and missing-reference diagnostics. Preview integration coverage verifies once-per-mounted-initialization execution, re-entry behavior, request-template rendering from configured variable defaults, successful component and variable onSuccess delivery, failed-request suppression, missing actions, and canonical/runtime-state separation.

Validation under the documented ephemeral Node 20/npm 10 toolchain passed:

- Focused page-load and Button regression coverage: 4 suites / 9 tests.
- Full frontend suite: 18 suites / 486 tests, 0 snapshots.
- Frontend CRA production build: passed.
- Schema fixture matrix: 13 valid, 2 expected-invalid, and 2 diagnostic-invalid fixtures behaved as expected.
- Representative valid-visual-rest-actions.json: updated with canonical page onLoad configuration and validated.
- Backend build: not rerun because backend source and the shared schema were unchanged.
- Standalone frontend tsc --noEmit: retains the documented TypeScript 4.9 / @types/node 26 incompatibility and remains separate from the passing CRA compile.

Docker Compose rebuilt successfully on 2026-07-29. Both services started, the backend health endpoint returned status ok, and the frontend responded on port 3000. Proportional manual page-load acceptance passed on 2026-07-29. The accepted Table workflow exposed a non-blocking layout limitation: the white Preview page/canvas background does not grow with runtime-rendered rows beyond its configured or minimum dimensions. Responsive Preview output sizing and Table pagination design are tracked separately in TASKS.md. Final Slice 2 acceptance remains pending.

## Slice 2 Component Deletion Safety Validation

Manual baseline testing on 2026-07-29 through 2026-07-30 confirmed that deleting a referenced Table or Text Input happened immediately without warning, while the retained binding and request template correctly produced missing-component diagnostics.

The working tree now detects canonical binding source/target paths and action request-template references before component deletion. Referenced deletion requires explicit cancellation or confirmation, confirmed deletion preserves dangling configuration for diagnostics, and unreferenced deletion remains immediate.

Focused tests passed at 4 suites / 12 tests, the full frontend suite passed at 20 suites / 490 tests, and the frontend production build passed. The user manually confirmed every UI retest in `SAFETY_TEST_PLAN.md` passed on 2026-07-30.