conductor/BASELINE.md

Validation Baseline

Date

2026-07-18

Environment

• Target toolchain: Node.js 20 and npm 10
• Executed toolchain: Node.js 20.20.2 and npm 10.9.8, supplied ephemerally through npx
• Docker CLI: available on Windows
• Docker engine: unavailable because Docker Desktop's Linux engine was not running
• Docker inside WSL: unavailable because WSL integration was disabled

Dependency Installation

• Root npm ci: passed under the preinstalled WSL Node 18/npm 9 toolchain; reported 2 high-severity audit findings in ajv-cli dependencies.
• Frontend clean install initially failed because frontend/package-lock.json was missing yaml@2.9.0.
• npm install --package-lock-only under Node 20/npm 10 repaired the frontend lockfile.
• Frontend clean install then passed under Node 20/npm 10; npm reported 28 dependency vulnerabilities: 9 low, 6 moderate, and 13 high.
• Backend clean install passed under Node 20/npm 10; npm reported 0 vulnerabilities.

Automated Checks

Frontend tests

Command:

npx --yes --package=node@20 --package=npm@10 npm test -- --watchAll=false --runInBand

Result: Passed.

• Test suites: 7 passed, 7 total
• Tests: 433 passed, 433 total
• Snapshots: 0

Frontend production build

Command:

npx --yes --package=node@20 --package=npm@10 npm run build

Result: Passed.

Backend TypeScript build

Command:

npx --yes --package=node@20 --package=npm@10 npm run build

Result: Passed.

Schema Matrix

Twelve valid-*.json project definitions pass validation against shared/schemas/conductor-project.schema.json, including the Slice 1 all-components fixture.

Two schema-invalid fixtures failed validation as expected:

• invalid-dropdown-option-shape.json
• invalid-missing-required.json

Two diagnostic-invalid fixtures passed structural schema validation as designed because their defects require semantic/runtime diagnostics:

• invalid-template-malformed.json
• invalid-template-missing-component.json

Slice 1 Manual Acceptance

User validation completed successfully on 2026-07-18:

• All five new components can be configured and manipulated in the Visual Editor.
• Preview interaction, disabled and hidden behavior, and Status Panel tones work as expected.
• Visual Editor and JSON Editor synchronization works.
• Save/load persistence and existing-component regression checks pass.

Slice 2 Increment 1 Validation

Validation completed on 2026-07-18 for visual anonymous REST action authoring.

Focused editor tests

Command:

npm test -- --watchAll=false --runInBand --runTestsByPath \
  src/components/ActionInspector/actionEditorUtils.test.ts \
  src/components/ActionInspector/ActionInspector.test.tsx

Result: Passed.

• Test suites: 2 passed, 2 total
• Tests: 23 passed, 23 total
• Covers canonical CRUD, duplicate-ID safety, reference discovery, request-map and URL validation, anonymous duplication, immediate document synchronization, and invalid local drafts.

Full target-toolchain checks

Commands:

npx --yes --package=node@20 --package=npm@10 npm test -- --watchAll=false --runInBand
npx --yes --package=node@20 --package=npm@10 npm run build

The frontend commands ran from frontend/. The build command also ran from backend/.

Results:

• Frontend tests: 9 suites and 456 tests passed; 0 snapshots.
• Frontend production build: passed.
• Backend TypeScript build: passed.

Schema fixture matrix

Each fixture was checked with:

./node_modules/.bin/ajv validate \
  -s shared/schemas/conductor-project.schema.json \
  -d <fixture> \
  --spec=draft2020

Results:

• 13 of 13 valid-*.json fixtures passed, including valid-visual-rest-actions.json.
• 2 of 2 schema-invalid fixtures failed as expected.
• 2 of 2 diagnostic-invalid fixtures passed structural validation as designed.

Standalone frontend TypeScript check

Command:

npx tsc --noEmit

Result: Blocked by an existing dependency/toolchain mismatch. Frontend TypeScript 4.9 cannot parse syntax in resolved @types/node@26.1.0 (first error: node_modules/@types/node/ffi.d.ts(94,21): TS1139). The CRA production build performs the application TypeScript compile and passed.

Visual QA

The frontend development server compiled successfully at http://localhost:3000. In-app browser automation could not start during implementation while Docker Desktop was not running; its Node REPL kernel reported helper_unknown_error: setup refresh had errors during Windows sandbox setup.

After Docker Desktop and the app were started, the user completed the Slice 2 Increment 1 manual acceptance on 2026-07-19. The accepted workflow covered visual anonymous REST action authoring, a Button events entry inserted through canonical JSON for an onClick action reference, and referenced-action deletion confirmation. Full Slice 2 workflow-launcher and dependent-data acceptance remains pending later increments.

Runtime Startup

Initial backend startup against a clean SQLite database failed with:

SqliteError: no such table: projects

Cause: backend/src/index.ts statically imported app before calling initDatabase(). Importing the app loaded project routes and prepared SQL statements before the projects table existed.

Fix: run initDatabase() first, then dynamically import the Express app and start listening.

After the fix, clean-database startup, HTTP health, complete CRUD, cleanup, and persistence across a backend container restart all passed.

Docker Validation

Docker Desktop was started and validation completed. Both images built, both services started, the frontend compiled, the backend initialized SQLite, and health, CRUD, cleanup, and restart-persistence checks passed.

Baseline Status

Passing for the current automated and Docker smoke-test scope:

• Locked frontend dependencies repaired
• Frontend tests pass
• Frontend production build passes
• Backend TypeScript build passes
• Schema matrix behaves as expected
• Backend starts against a clean database
• Health and CRUD smoke checks pass
• Persistence survives a backend container restart
• Docker Compose build and integration checks pass

Remaining release work includes broader backend tests, browser end-to-end tests, security regression tests, and resolution of the frontend dependency audit findings.

Slice 2 Increment 2 Button Event Validation

On 2026-07-19, focused tests passed (3 suites / 6 tests), full frontend tests passed (12 suites / 462 tests), the frontend and backend builds passed, and the schema matrix passed at 13 / 2 / 2. ComponentEvent.inputMap was documented as compatibility-only; executed request inputs continue to use component/variable REST templates. Automated Preview dispatch passed. The user then manually verified creating a REST action and assigning it visually to a Button; Increment 2 Button onClick acceptance passed.

Slice 2 Request Input Validation

On 2026-07-19, focused request-input tests passed at 3 suites / 9 tests, the full frontend suite passed at 14 suites / 467 tests, frontend and backend builds passed, and the schema matrix passed at 13 / 2 / 2.

The UI writes executed component/variable templates to URL, header, query, and body fields while excluding path parameters and inputMap. Standalone tsc reproduced the recorded dependency mismatch. Manual request-input acceptance passed on 2026-07-28.

Manual request-input acceptance checklist (completed 2026-07-28)

1. Start Docker Desktop and run Conductor through Docker Compose.
2. Open a project containing a Text Input or Dropdown, a Button, and an anonymous REST action.
3. Edit the action and add a query parameter such as item.
4. In Request value reference, choose the component, choose Query: item, and insert the reference.
5. Confirm canonical JSON immediately contains "item": "{{components.<componentName>.value}}" and does not add inputMap.
6. Assign the action to the Button, enter or select a Preview value, and execute it.
7. Confirm the outgoing request uses the runtime component value and loading, response, and error state remain ephemeral.
8. Confirm path parameters are not offered as destinations and raw URL/header/query/body template editing still works.
9. If an existing JSON-authored variable is available, repeat insertion and verify {{variables.<name>}} resolution.

Slice 2 Response Binding and Variable Validation

On 2026-07-20, focused configuration tests passed under Node 20/npm 10 at 2 suites / 14 tests. The full frontend suite passed at 15 suites / 477 tests with 0 snapshots. The frontend CRA production compile and backend TypeScript build passed. The schema fixture matrix passed at 13 valid fixtures, 2 expected schema failures, and 2 diagnostic-invalid fixtures that remain structurally valid.

Automated coverage verifies canonical response-binding and variable creation/editing/deletion, the onSuccess default for new action-response bindings, supported and unambiguous target filtering, typed variable default parsing, canonical synchronization, binding-editor deletion lifecycle, and reference-aware variable deletion warnings. Existing legacy onClick compatibility remains in runtime and diagnostics and supports one-way visual migration; the UI cannot create a new onClick response binding. No deprecated action.responseMapping behavior was added.

Standalone frontend npx tsc --noEmit continues to fail in node_modules/@types/node/ffi.d.ts because the project's TypeScript 4.9 compiler cannot parse the resolved @types/node@26.1.0 declarations. This is reported separately from the successful CRA production TypeScript compile.

Response-binding and variable manual acceptance remains pending. Docker Compose services and health passed on 2026-07-28; the prior WSL-integration blocker is resolved.

2026-07-29 Boolean Variable Default Fix

Manual typed-variable testing exposed a boolean editor defect: partial input was reset to false, so true could not be authored. The control was replaced by an explicit optional boolean selector. The focused Actions and Bindings tests passed at 2 suites / 14 tests, the full frontend suite passed at 15 suites / 477 tests, and the production build passed. The rebuilt frontend returned HTTP 200 and the user confirmed true is saved as a canonical JSON boolean. Typed-variable declarations and invalid-draft isolation are manually accepted; the rest of the response-binding/variable workflow remains pending.

Component response-binding manual acceptance passed on 2026-07-29. The initial httpbin.org endpoint intermittently returned 503 and correctly did not apply onSuccess. After switching to verified https://httpbingo.org/anything, the proxy returned HTTP 200 and the JSON Viewer displayed the mapped response body. Remaining response-binding/variable checks are pending. Variable response-binding manual acceptance also passed: the first response updated runtime statusText, the second request consumed it, and the canonical Not run default remained unchanged. Binding edit and selected deletion also passed, preserving the unrelated binding and restoring the add control. A deferred UI follow-up tracks clearer record boundaries and hierarchy in Actions and Bindings. Unsupported TextInput and ambiguous duplicate-name targets were manually confirmed excluded. Referenced-variable warning, cancellation, accepted deletion, and unresolved diagnostics also passed. Legacy onClick execution, diagnostics, and one-way migration to onSuccess also passed. Failure-state testing found a clipped Button error. The alert now renders below the fixed-height Button with wrapping, stale errors clear on retry/success, focused Preview tests passed at 2 suites/7 tests, the full suite at 15 suites/478 tests, and the production build passed. The user confirmed readable 503 handling, onSuccess suppression, clean canonical state, and stale-error clearing. Save/reload persistence and runtime reset passed, completing response-binding and variable manual acceptance on 2026-07-29.

Manual request-input acceptance record

On 2026-07-20, the user confirmed that the item query-parameter row and guided Request value reference insertion into Query: item looked correct.

On 2026-07-28, Docker Compose startup, both services, and backend health passed. The user then confirmed that all remaining request-input checks passed: canonical component templates without inputMap, path-destination exclusion, execution with runtime component and variable values, ephemeral runtime-state separation, and continued raw-template editing. The complete request-input workflow is manually accepted.

Slice 2 Page-Load Action Validation

On 2026-07-29, visual initial-page onLoad authoring and once-per-Preview initialization were implemented in the working tree. Editor coverage verifies add/change/clear behavior, unrelated-event preservation, duplicate normalization, immediate canonical updates, the no-action state, and missing-reference diagnostics. Preview integration coverage verifies once-per-mounted-initialization execution, re-entry behavior, request-template rendering from configured variable defaults, successful component and variable onSuccess delivery, failed-request suppression, missing actions, and canonical/runtime-state separation.

Validation under the documented ephemeral Node 20/npm 10 toolchain passed:

• Focused page-load and Button regression coverage: 4 suites / 9 tests.
• Full frontend suite: 18 suites / 486 tests, 0 snapshots.
• Frontend CRA production build: passed.
• Schema fixture matrix: 13 valid, 2 expected-invalid, and 2 diagnostic-invalid fixtures behaved as expected.
• Representative valid-visual-rest-actions.json: updated with canonical page onLoad configuration and validated.
• Backend build: not rerun because backend source and the shared schema were unchanged.
• Standalone frontend tsc --noEmit: retains the documented TypeScript 4.9 / @types/node 26 incompatibility and remains separate from the passing CRA compile.

Docker Compose rebuilt successfully on 2026-07-29. Both services started, the backend health endpoint returned status ok, and the frontend responded on port 3000. Proportional manual page-load acceptance passed on 2026-07-29. The accepted Table workflow exposed a non-blocking layout limitation: the white Preview page/canvas background does not grow with runtime-rendered rows beyond its configured or minimum dimensions. Responsive Preview output sizing and post-MVP Table pagination are tracked in ROADMAP.md. Final Slice 2 acceptance remains pending.

Slice 2 Component Deletion Safety Validation

Manual baseline testing on 2026-07-29 through 2026-07-30 confirmed that deleting a referenced Table or Text Input happened immediately without warning, while the retained binding and request template correctly produced missing-component diagnostics.

The working tree now detects canonical binding source/target paths and action request-template references before component deletion. Referenced deletion requires explicit cancellation or confirmation, confirmed deletion preserves dangling configuration for diagnostics, and unreferenced deletion remains immediate.

Focused tests passed at 4 suites / 12 tests, the full frontend suite passed at 20 suites / 490 tests, and the frontend production build passed. The user manually confirmed every component-deletion safety retest passed on 2026-07-30.

Slice 2 Final Workflow Manual Acceptance

On 2026-07-30, the user completed the final Slice 2 workflow-launcher and dependent-data manual acceptance. The launcher was configured entirely through visual controls with canonical component request templates, a Button onClick event, and an onSuccess JSON Viewer binding. Successful execution echoed current Dropdown and Text Input values; HTTP 503 handling was readable, suppressed onSuccess delivery, and cleared after a successful retry.

The dependent-data workflow used a page onLoad POST to https://httpbingo.org/anything with Content-Type application/json and a body template of ["dev","stage","prod"]. Mapping body.json to Dropdown.options populated the choices, [] produced a usable empty state without stale options, status/503 produced a readable failure without false success, and restoring the successful endpoint recovered. The loaded selection drove the later launcher request.

Save, load, and fresh Preview execution preserved page onLoad, Button onClick, request templates, and top-level bindings while resetting runtime state. Canonical JSON gained no inputMap, action.responseMapping, secrets, responses, loading flags, errors, selected runtime values, or loaded runtime options.

This is manual acceptance evidence, not an automated-validation result. Subsequent increments completed diagnostics confirmation, Preview sizing, remaining property/style controls, Actions & Bindings information architecture, the timeout decision, and consolidated validation. Explicit final Slice 2 sign-off remains pending.

Slice 2 Page-Load Diagnostics Correction

The Actions & Bindings diagnostics now count page events as well as component events when determining whether an action can execute and a response binding can receive a response. The remediation wording names supported component events and page onLoad without prescribing JSON or a Button-only fix.

Focused ActionInspector coverage passed at 1 suite / 11 tests, including page onLoad suppression of both false diagnostics, revised messages for a genuinely untriggered action and binding, and the existing component-event trigger path. The complete frontend suite passed at 20 suites / 493 tests with 0 snapshots, and the frontend production build compiled successfully under the documented Node 20/npm 10 toolchain.

Automated validation is complete. On 2026-07-30, the user proportionally confirmed that the rebuilt Actions & Bindings view no longer shows either false diagnostic for the page onLoad action or its response binding. The initial browser view retained the old development bundle; a hard refresh loaded the rebuilt frontend and the check passed.

Slice 2 Runtime-Aware Preview Canvas Sizing

Preview now observes the rendered dimensions of its absolutely positioned component wrappers and expands the white canvas beyond design-time bounds when runtime content grows. Measurements remain ephemeral and do not modify canonical component positions or sizes. The canvas can contract back to its design minimum after content becomes smaller or empty.

Focused Preview component validation passed at 1 suite / 9 tests, including expansion, unchanged in-bounds sizing, and contraction. The complete frontend suite passed at 20 suites / 496 tests with 0 snapshots, and the frontend production build compiled successfully under the documented Node 20/npm 10 toolchain.

Proportional manual confirmation passed on 2026-07-30. The user confirmed that populated runtime rows remain inside the expanded white Preview page, the expanded page remains scrollable, an empty runtime result contracts to a usable empty Table state, and canonical Table size.height remains unchanged.

Slice 2 MVP Component Properties and Basic Appearance

The property audit added the missing JSON Viewer design-time default control, Table column-width authoring/rendering, required semantics for Text Input, Text Area, and Dropdown, and canonical per-component properties.style with font size, text color, and background color. Appearance overrides render in both the Visual Editor canvas and Preview; absence of an override preserves existing defaults.

The shared schema now validates style.fontSize from 8 through 72 and six-digit hexadecimal text/background colors. Runtime input values remain separate from these canonical configuration properties.

Focused Preview property coverage passed at 1 suite / 13 tests. The complete frontend suite passed at 20 suites / 500 tests with 0 snapshots, the frontend production build passed, the backend TypeScript build passed, and the schema fixture matrix passed at 13 valid / 2 expected-invalid / 2 diagnostic-invalid.

Proportional manual authoring, canvas, Preview, reset, and save/reload confirmation passed on 2026-07-31. The user accepted all five sections after Docker rebuild and hard refresh. This manual evidence is separate from automated validation.

Slice 2 Actions & Bindings Information Architecture and Timeout Decision

Actions, response bindings, and variables now render as distinct bordered records with clearer section descriptions and record labels, attached edit forms, and improved variable/target summaries. Focused ActionInspector validation passes at 1 suite / 12 tests. Proportional manual acceptance passed on 2026-07-31, including record separation, editor ownership, canonical edit isolation, resolved variable-target labeling, and diagnostic recovery.

The v0.1.0 timeout decision retains the backend's fixed 30-second proxy timeout and documents that REST actions have no canonical timeout field. Configurable bounded timeouts are deferred to proxy-policy work.

The user explicitly granted final Slice 2 sign-off on 2026-07-31 after all implementation, consolidated automation, Docker health, documentation reconciliation, and proportional manual acceptance passed. Slice 2 is complete; Slice 2a is authorized as a separate usability increment.

Slice 2a Request-Reference Usability Validation

Automated validation passed under Node 20/npm 10 at 4 focused suites / 23 tests and 21 complete frontend suites / 507 tests with 0 snapshots. The frontend production build passed. Backend build and schema validation were not rerun because this increment changes frontend authoring only and preserves the canonical document shape.

Proportional manual acceptance passed on 2026-08-01 in isolated Chromium against project Slice 2 Final (#12) at http://localhost:3000/. Testing used a 1440 x 1100 normal viewport and a 700 x 1000 responsive viewport; saved project #12 was not updated. Contextual suggestions, ambiguous-name filtering and recovery, common and custom header names, guided-control order/alignment/responsive stacking, canonical insertion, replace/append behavior, path exclusion, continued free-form editing, and canonical/runtime-state separation all passed. Recursive canonical JSON inspection found none of the prohibited mapping or runtime-state properties. This is manual acceptance evidence, separate from automated validation. The user granted explicit final Slice 2a sign-off on 2026-08-01; Slice 2a is complete.

Slice 3 Encrypted Secret Lifecycle Increment

On 2026-08-01, the user approved AES-256-GCM encryption in SQLite with a server-only 32-byte master key and opaque reference-only canonical JSON. The initial backend increment added an encrypted secret table, metadata-only create/list/lookup/update/delete APIs, internal-only resolution, and structured fail-closed key configuration behavior. docs/SECRETS.md records the threat assumptions and key lifecycle.

The backend TypeScript build passed. A controlled Docker check created a disposable Bearer credential and returned metadata without its token. A plaintext scan did not find the test token in SQLite. Metadata survived a backend restart using the same key. Deletion returned HTTP 204 and subsequent lookup returned HTTP 404. The disposable record was removed, and the disposable key was removed from the running configuration. Canonical references, authoring UI, credential injection, compatibility validation, comprehensive automated tests, and redaction remain pending.

The next execution increment added canonical secretReferenceId, protected-mode action authoring, all four server-side credential injection modes, structured missing/type-mismatch errors, and recursive response-body credential redaction. Controlled httpbingo checks returned HTTP 200 for Basic, Bearer, API-key header, and API-key query execution while reflected Authorization, header values, query values, and query-bearing URLs contained [REDACTED] instead of credential material. Missing references and type mismatches returned structured HTTP 400 responses. The full frontend suite passed at 21 suites / 507 tests, focused authoring suites passed at 2 suites / 32 tests, and frontend/backend production builds passed. Guided secret management UI, reference-aware deletion, durable automated backend security coverage, and final manual acceptance remain pending.

The management increment added guided create/replace/delete controls with masked credential entry, metadata-only records, compatible-secret selection, and deletion protection for both unsaved actions and references found in saved project JSON. Durable backend tests cover encrypted round-trip, missing-key failure, and wrong-key authentication failure. Backend tests/build, the full 21-suite / 507-test frontend run, focused 2-suite / 32-test authoring run, and frontend production build passed. Route-level automated injection/redaction coverage, persistent deployment-key validation, and final manual acceptance remain pending.

Final pre-manual Slice 3 validation extracted durable tests for all four protected injection modes, missing/not-found/type-mismatch failures, recursive reflected-value redaction, and conservative URL sanitization. A Docker credential remained usable after backend restart with the same key and its reflected Authorization header was [REDACTED]; the disposable record and key were removed afterward. Consolidated validation passed at 22 frontend suites / 509 tests, backend security tests and TypeScript build, frontend production build, the 13-valid / 2-expected-invalid / 2-diagnostic-invalid schema matrix, Docker health, and git diff --check. Proportional manual acceptance remains the next gate.

Proportional manual acceptance passed on 2026-08-01 in isolated Chromium using an unsaved browser copy of Slice 2 Final (#12). All four steps passed: masked lifecycle and metadata-only display; type-compatible choices and opaque-only canonical state; protected Preview execution with reflected credential redaction; and referenced deletion protection, cleanup, and missing-reference failure safety. The saved project was unchanged and the final server-side secret list was empty. The blocked-deletion warning remained visible after later successful cleanup; this was non-blocking and is tracked for stale-feedback cleanup in ROADMAP.md. The user granted explicit final Slice 3 sign-off on 2026-08-02; Slice 3 is complete.

Slice 4 Proxy Security and Observability — 2026-08-02

The initial Slice 4 implementation added the documented public-destination/default-deny policy, exact-origin server-side internal exceptions, pinned DNS results, redirect revalidation, cross-origin credential stripping, header and resource controls, safe errors, persistent bounded SQLite execution history, filtering/clearing APIs, and the Execution History UI.

Validation passed with cd backend && npm test (six compiled test files), cd frontend && npm test -- --watchAll=false (22 suites / 509 tests), cd frontend && npm run build, the 13-valid / 2-expected-invalid / 2-diagnostic-invalid schema matrix, Docker Compose rebuild/status/health, frontend HTTP, an approved public HTTPS execution, a blocked loopback execution, history retrieval across backend recreation, and history cleanup. The first public Docker request exposed and led to correction of Node's lookup({all:true}) callback handling; the rebuilt repeat returned HTTP 200. Disposable history was cleared with HTTP 204. See SLICE4.md for exact command/result detail. Proportional manual workflows remain pending and are not implied by this automated baseline.

Proportional manual verification subsequently passed all five workflows on 2026-08-02 after one failed redaction check and two initially unavailable DNS checks were remediated and repeated. Failure logs now exclude destination URLs and private addresses; backend automation passes seven compiled test files. A disposable Docker authoritative-DNS fixture proved mixed public/private answers are rejected and address pinning prevents a rebinding lookup between validation and connection. IPv6 literals now classify directly and return PROXY_DESTINATION_FORBIDDEN. Focused log searches returned zero private literal or raw transport-error matches. Cleanup restored empty secrets, history, secret-key configuration, internal-origin configuration, and removed all fixtures. At that checkpoint, explicit final Slice 4 sign-off was still pending.

Independent re-test evidence supplied on 2026-08-02 confirmed the rebuilt deployment and all previously failed/unavailable checks pass, with proportional approved-destination, credential, response-binding, and canonical/runtime separation regressions. Exact searches found no disposable credentials, query markers, private literals, transport details, or stack traces in the tested surfaces. The re-test reported 18/18 backend tests passing, complete fixture/secret/history/configuration cleanup, healthy services, and a passing git diff --check. It made no source edits, commits, or pushes and explicitly did not grant final sign-off.

The user granted explicit final Slice 4 sign-off on 2026-08-03 with the exact wording: “I grant explicit final Slice 4 sign-off.” Final consolidated validation passed: backend TypeScript build and 7 compiled test files, 22 frontend suites / 509 tests, frontend production build, the schema fixture matrix at 13 valid / 2 expected-invalid / 2 diagnostic-invalid, rebuilt Docker Compose services, backend health, frontend HTTP 200, empty execution history and secrets, empty secret-key/internal-origin configuration, and git diff --check. Slice 4 is complete. No commit or push was performed or authorized.

Slice 5 Validation and Error Handling — 2026-08-04

The implementation inventory found that JSON Apply used the schema endpoint while create, update, load, and database writes lacked an unconditional gate. Slice 5 now uses one backend schema and semantic validator at every boundary, accepts exactly schema version 0.1.0, rejects invalid stored documents without mutating them, and returns stable codes, JSON Pointer-style paths, severities, and messages. The persistence layer repeats validation immediately before insert/update, so rejected updates cannot partially change metadata or JSON.

Semantic validation covers duplicate identities/names, dangling references, runtime-supported events/binding paths/triggers/targets, component-specific properties, variable defaults, templates, and default-page references. Compatibility-only inputMap, action.responseMapping, component binding references, and Binding.transform are non-blocking warnings and cannot be newly authored by guided UI. Canonical examples were reconciled, project settings received schema-matching TypeScript types, and path-parameter values now use the same component/variable interpolation contract as other request inputs before backend URL substitution.

Automated validation passed: backend build and 8 compiled test files, frontend 23 suites / 512 tests, frontend production build, structural schema matrix at 13 valid / 2 expected-invalid / 2 diagnostic-invalid, and semantic validation of all 13 valid fixtures with no errors or warnings. Rebuilt Docker services were healthy and returned backend health plus frontend HTTP 200. A disposable valid project was created; an invalid update returned PROJECT_VALIDATION_FAILED with actionable paths; the subsequent GET proved the original name and JSON were unchanged; cleanup deleted the disposable record with HTTP 204. Manual acceptance remains the only Slice 5 gate.

The first manual run found that 422 validation responses omitted warnings, causing JSON Editor to throw while rendering Tests 1B–1D. The route now returns the full validation result and the frontend normalizes absent arrays defensively. Consolidated remediation validation passed at 8 backend test files and 23 frontend suites / 513 tests plus the frontend production build. Docker was rebuilt, and direct API checks returned complete error and warning arrays for unsupported version, dangling action, and incompatible binding cases. Manual retest remains pending.

The retest passed Tests 1B–1D. Public httpbingo then returned HTTP 402 during Test 3B, demonstrating that an external dependency could not provide deterministic acceptance evidence. A separate manual-test Compose override now runs the repository mock server and grants only its exact internal origin. Direct proxy checks passed for HTTP 200 success, a measured one-second delay, and a controlled HTTP 503 response. The normal Compose definition remains unchanged; cleanup removes the override and internal exception.

Manual Tests 1–5 subsequently passed. Test 6A exposed that JSON Editor lacked the shared validation summary used by Visual Editor, Actions & Bindings, and Preview. The summary is now rendered in JSON Editor and has blocking-error and compatibility-warning regression coverage. Frontend validation passes at 24 suites / 515 tests plus production build. A complete structurally valid Test 6B fixture was also added and semantically validates with exactly one non-blocking BINDING_TRANSFORM_DEFERRED warning.

The final manual continuation passed Test 6A and Test 6B; the user confirmed all Slice 5 manual tests pass. Cleanup removed seven execution records, disposable project #14, the mock container, and its exact internal-origin exception. Standard Compose was restored with backend health, frontend HTTP 200, empty execution history/secrets/configuration, and project #14 absent. Explicit final Slice 5 sign-off remains the only gate.

Slice 6 Automated Release Baseline — 2026-08-05

• Supported Node 20/npm 10 clean-source installs passed for root, frontend, and backend. The backend native dependency must be installed with the documented wrapper; system Node 18/npm produced an incompatible native build and is outside the supported baseline.
• Backend build and 27 tests passed. The new HTTP integration suite uses isolated ports/data and covers health, schema/semantic validation, CRUD atomicity, canonical persistence, five auth modes, proxy success/upstream/policy results, redaction/history, secrets, backend restart, and offline database backup/restore.
• Frontend standalone TypeScript, 25 suites / 517 tests, and production build passed.
• Schema matrix passed at 14 valid / 2 expected-invalid / 2 diagnostic-invalid. The deterministic release demo also passed backend semantic validation without warnings.
• Playwright Chromium passed 1/1 against rebuilt Docker and the controlled repository mock server: dependent options, runtime request values, focused/full results, inventory refresh, selected-row details, save, reload, and rerun readiness.
• Docker restart preserved a disposable demo project; cleanup deleted it and cleared history. Standard Compose was restored with backend health, frontend HTTP 200, empty executions/secrets, and empty secret/internal-origin configuration.
• Tracked-source credential-pattern scan found no private-key or common token signatures. Backend production dependency audit reports zero vulnerabilities after non-breaking lockfile fixes.
• Frontend Create React App transitive build/development advisories remain a documented Slice 8 packaging/toolchain risk.
• Remaining gate: proportional manual acceptance in SLICE6_MANUAL_TEST.md, final cleanup evidence, and explicit user sign-off.

The user granted explicit final Slice 5 sign-off on 2026-08-04 with the wording: “Confirm slice5 signoff.” Slice 5 is complete.