From d995cc1784050b79379e293626a47fc9707eb99a Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Wed, 11 Nov 2026 16:20:01 +0800 Subject: [PATCH] docs(canvas): record verified Foundry AI and resource integration --- headless/README.md | 3 ++ headless/SERVICE_ACCEPTANCE.md | 76 ++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) create mode 100644 headless/SERVICE_ACCEPTANCE.md diff --git a/headless/README.md b/headless/README.md index a4d0211..cb593c6 100644 --- a/headless/README.md +++ b/headless/README.md @@ -1195,3 +1195,6 @@ does not change `sourceURL`, canonical asset identity or the authority scope. Use `assets.authority.read` for original bytes and digest verification: a display preview may have a different encoding or size. Credentials remain in the host's fetch/transport, never in document records or generated display URLs. + +Pinned real-service results, coverage and remaining audit boundaries are recorded +in [SERVICE_ACCEPTANCE.md](SERVICE_ACCEPTANCE.md). diff --git a/headless/SERVICE_ACCEPTANCE.md b/headless/SERVICE_ACCEPTANCE.md new file mode 100644 index 0000000..55b188b --- /dev/null +++ b/headless/SERVICE_ACCEPTANCE.md @@ -0,0 +1,76 @@ +# Foundry service integration evidence + +Status: service integration evidence for step 5; overall progress remains 4/7 +until its full scope audit is closed. This does not complete migration/delivery, +the complete Draft acceptance matrix, main integration or production deployment. + +## Verified revisions and environment + +- Endoleap consumer: `580a14f508bc695bfed99d60c42f0d4df36b15b2`. +- Foundry: `1605b5a9d6f9a148c149e3577dd3a18d6ef3074a`. +- [Foundry CI #1174](https://gitea.entroia.com/Zayden-Jung/foundry-core/actions/runs/1174): + completed successfully; job 1271, all seven steps successful. +- Existing `ces-control` runner executes Go checks/build, schema migration and + isolated PostgreSQL integration, then the pinned Node 24 consumer and HTTP smoke + checks. No local backend build or Docker execution was used. +- Local frontend: 785 Node tests and full TypeScript checking passed. Tests use + the source modules; packaged SDK and application delivery remain separate gates. + +## What the checks actually prove + +| Requirement | Authoritative entry and observed assertion | +| --- | --- | +| Explicit identity migration | `TestCanonicalModelMigrationAndIncrementalLifecycle`: GET does not migrate; retry returns the same identity map; implicit partitions become owning canvases; old snapshot writers are rejected. The real Node consumer also migrates and retries. | +| Incremental writes and receipt identity | The same backend test verifies exact retries, unknown receipt semantics, logical ID coverage, participant versions, and zero writes/logical-ID consumption after a later batch condition fails. It checks canonical DB rows, not just HTTP status. | +| Real frontend coordination | `TestHeadlessClientHTTPIntegration` runs `tests/headless/foundry.integration.mjs` against authenticated HTTP and PostgreSQL. It verifies lost document ACK recovery without duplicate POST, atomic partition edits, deep copy with a parent-owned incoming edge, partial import and old stream-tail coordination. | +| Resources and authorization | The consumer verifies lost upload ACK, shared pending-image upload, original bytes, metadata, cross-project adoption and reopen. `TestOnboardingAndSharing` additionally revokes source access after warm reads, verifies no target model/version/binding changes, preserves the rejected receipt after permission restoration, and checks independent target access. | +| AI execution identity and controls | `TestCanonicalAIAdmissionAndLifecycle` covers admission/query/retry, zero-effect rejection, old incarnation callbacks, cancellation, managed image output, owner relocation, archived admission routes and execution after permission revocation. | +| Actual frontend RunPort | `tests/headless/foundry-ai.integration.mjs` exercises `createFoundryRuns`, the HTTP transport and ProjectEngine: successful admission response loss/reopen/query, queued cancellation response loss, generation-time content conflict, explicit apply response loss plus undo/reopen/redo, generated image metadata/original bytes/preview, and copy without a new run or upload. | + +The successful consumer report contains `status: "ok"`, 72 HTTP transport calls, +all 14 prior document/resource flags true, plus `runtimeAI`, `aiLostAdmission`, +`aiCancelReconciled`, `aiConflictApplyUndo`, `aiManagedImage`, `aiCopyNoRun` true. +`aiExecutionCount` is exactly 3: text, retained conflict output, image. The queued +cancelled run never calls generation. Preview fetching is a separate authenticated +host fetch and is not included in the 72 transport calls. + +## Issues exposed by the real consumer + +1. The standalone AI client omitted the v2 Accept header. The Next proxy had + supplied it, hiding the omission in application-only testing. `canvas-v2` + negotiation now belongs to the AI adapter and shared transport; regression + tests cover all three writes and receipt queries with original body/key/version. +2. Asset display URLs assumed the application's relative preview route. The + asset adapter now accepts a host `displayURL(id)` callback. Canonical source + identity and authority remain separate; preview bytes are not used as original + file digest evidence. Authentication stays in the host fetch/transport. + +The test harness also needed working controlled timers, a cancelled run's final +event drain before the next admission, and actual copy-source file persistence. +The adoption stage still asserts zero project-local file writes. The subsequent +copy stage permits source checkpoints but rejects bitmap file duplication and +asserts no extra upload or generation. Those fixes do not bypass busy, cursor, +durability or resource-sharing checks. + +## Boundaries and remaining audit + +The recovery store is an in-memory durable-batch fixture, and response loss is +injected after successful HTTP responses. Real IndexedDB/Web Locks/browser +acceptance is recorded separately in `STEP4_ACCEPTANCE.md`; this service run does +not combine every browser crash window with every server operation. + +`canvas_headless_worker_integration_test.go` supplies deterministic generation +output over the actual worker HTTP protocol. Admission, claim, events, canonical +writes, image storage and action receipts use the real service/DB. Private worker +controls are registered only in the test assembly. Production's background queue +loop, external model availability, provider billing and real CLI authentication +are not proved by that fixture. `TestCanvasAIRealWorker` remains opt-in and skipped. + +The CI log includes an early skip of `TestHeadlessClientHTTPIntegration` without +its opt-in environment and a later successful execution in the explicit Node/DB +phase. Those are different invocations. The log has 154 distinct PASS names +including subtests; that count is not 154 independent end-to-end scenarios. + +Complete the service scope audit against the Draft, then migration/delivery and +the final requirement matrix. A green feature-branch run does not merge or deploy +either repository. Foundry PR #19 remains open and Draft.