Restore canonical frontend behavior coverage and SAM parity gates

[alexeygrigorev]

Restore canonical frontend behavior coverage and SAM parity gates

Status: accepted — current-main integration delta passed Architecture, Tester, and PM on frozen fingerprint a0d7171096014709e5f3f1722033195131e64872ca586a6aebc8fd3a9f0e1019; ready for Software Engineer integration commit
Tags: bug, portal, frontend, backend, infra, testing, design, P0
Parent: #148
Depends on: None for local source implementation — the #156 prerequisite is satisfied at exact current main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902
Blocks: #158, final deployed acceptance in #155, and closure of #148
Next owner: Software Engineer — commit the exact accepted integration candidate on base f8b4a19a521d18f878e92af65d998e9af99a5b17 with Closes #159; do not change the frozen fingerprint

Scope

Restore the verification that was lost during the canonical-frontend cutover, without restoring any retired SPA. Top-level frontend/ remains the only browser UI and the existing TypeScript backend remains its only server. This issue adds a public-safe capability/coverage contract, behavior-level tests for every retained operator surface, a deterministic deployment allowlist, and a mandatory post-SAM-build parity/runtime gate.

The implementation baseline is exact clean main at 3ad9e9c3e81243b30f42aed5b72b6c9b34777902, containing shipped #157 and accepted/integrated #156. Its Check DataOps v1 app source job passed in run 31541797073, covering backend tests, the Sponsor gate, typecheck, backend build, the full E2E suite, and SAM validation/build. #159 runs next because it owns the shared frontend test harness, packaging verifier, Makefile, and normal CI gate. #158 follows #159 and remains the sole owner of assistant lifecycle, concurrency, provider mediation, and artifact-access product changes; this issue proves only the retained assistant list/detail/deep-link baseline and must not preimplement or redefine #158.

Canonical capability and coverage matrix

All fixtures, names, IDs, documents, providers, and evidence are synthetic and public-safe. O/A means an enabled authenticated operator or admin unless a stricter role is stated. Signed-out, expired, and disabled sessions must be denied by the shared browser-cookie boundary; /api/* and /work/api/* failures remain JSON and never return SPA HTML.

Capability / canonical route	Real API seam	Role and states that must be proved	Required behavior coverage
Session and Settings (/#/, Settings)	/login, /logout, /api/me	signed out, expired/disabled, O/A	browser-cookie login redirect, visible logout, no bearer/local-storage fallback, desktop/mobile Settings focus and close
Home (/#/)	/api/tasks, /api/bundles, /api/notifications, /docs/process-quality	O/A; loading, empty, ready, partial failure	dashboard counts/links come from real records; one failed feed stays honest without suppressing successful feeds
Inbox (/#/inbox?intakeId=)	/api/intake	O/A; empty, filtered exact item, each retained intake state, validation/conflict/server failure	exact detail, one state-valid mutation, retry-preserved input, humanized history; full action/state semantics remain #156
Tasks and proof (/#/tasks?...)	/api/tasks, /api/files, /api/artifacts, /docs, /content/*	O/A; empty, waiting, blocked, done, stale/not-found, conflict/failure	create/select/update/follow-up, file/proof behavior, workflow/date/return context and SOP link; combined route semantics remain #156
Workflows (/#/bundles?...)	/api/bundles, /api/tasks, /api/artifacts	O/A; empty, active/staged/completed, mismatch/not-found/failure	real persisted workflow/detail/task order, stage mutation, proof summary, exact deep link and return navigation
Runtime templates and recurring (/#/templates, /#/recurring)	/api/templates, /api/recurring	operator read/instantiate; admin create/edit/delete/pause/resume; clean/dirty/validation/conflict/409/failure	retain the shipped #157 real save/reload/instantiate and role boundary plus recurring pause/resume and referenced/unreferenced delete behavior
Assistants (/#/assistants?assistantJobId=)	/api/assistant-jobs, /api/artifacts	O/A; loading, empty, list, exact detail, stale/unavailable	non-mutating list/detail/deep-link/reload baseline only; #158 exclusively owns lifecycle mutations, versioning, provider access, and review safety
Artifacts (/#/artifacts)	/api/artifacts, /api/files	O/A; empty, available, unavailable/not-found/error	real list/detail relationship and currently authorized action result; do not add or weaken artifact-access policy owned by #158
Notifications (/#/notifications)	/api/notifications	O/A; empty, task-linked, dismiss success/failure	open exact target, dismiss exactly one without also navigating, counts update; full interaction semantics remain #156
Bookkeeping (/#/bookkeeping)	/api/bookkeeping/*	O/A; empty, configured, validation, upload/link/report failure	real account/transaction/report flow and a synthetic PDF evidence upload/link result; no external transfer
Sponsors (/#/sponsors?bookingId=)	/api/sponsor-crm/*	operator-safe reads/evaluation; admin-only finance/communication writes; empty/ready/conflict/denied/failure	real organization/contact/booking detail, safe role projection, one permitted mutation and one denied mutation; no send/provider call
Newsletter (/#/newsletter)	/api/newsletter-slots	O/A; empty, populated, validation/conflict/failure	create/edit/reload a synthetic slot and render schedule/status honestly
Calendar (/#/calendar)	/api/calendar-items	O/A; empty, populated, validation/conflict/failure	create/edit/reload a synthetic item, overlays/alerts, deterministic week/date navigation
Mailing exports (/#/mailing-exports)	/api/mailing-exports	O/A; no configs, ready, running/completed/failed	deterministic configured run and honest status/history; no external list/provider write
Process Docs and search (/#/processes)	/docs, /search, /content/*, /docs/registry, /docs/backlinks	O/A; loading, empty, result/detail, edit validation/Git failure	real synthetic create/read/search/edit/backlink round trip and safe error; no raw operational content or external GitHub mutation
Admin/process quality (/#/admin)	/docs/process-quality, /git/status, /git/log	O/A read-only diagnostics; loading/empty/failure	reachable diagnostics/configuration, honest unavailable state, no publish/pull/commit action in this issue
Users (/#/users)	/api/users, /api/me	operator read-only; admin create/edit/disable; validation/403/failure	server-derived role controls, a real admin mutation and spoofed/operator denial without side effect

For every row, the focused browser suite must use the normal local backend and in-memory DynamoDB/docs fixture path. It must assert route, accessible visible state, API response/side effect, reload or return navigation, and a meaningful empty/error/recovery state. Request interception, browser-only payload mocks, source-string/selector-presence assertions, snapshots without behavior assertions, and screenshots alone do not count. Existing stronger suites such as #156 and #157 may satisfy a cell when they are retained and run in the normal E2E command; the matrix must point to the exact test title/file. No cell may say “covered later.”

Deterministic artifact contract

The deployment UI allowlist is exactly:

dist/frontend/index.html
dist/frontend/src/app.js
dist/frontend/src/styles.css

frontend/DESIGN.md and frontend/Dockerfile remain source/development files and must not be packaged. There is no transform: each packaged allowlisted file must be byte-identical to its top-level frontend/ source counterpart. Within the deployable UI subtree dist/frontend/, the inventory is exactly the three allowlisted regular files: there is no other entry, symlink, or non-regular file. Outside that subtree, no application-owned alternate UI candidate or browser entry may exist under pages/, public/, static/, assets/, or another frontend directory.

Actual SAM dependency contents under node_modules/ legitimately include HTML files and symlinks such as node_modules/.bin/ entries and package links. Dependency-owned entries are not browser entrypoints merely because of their filename or extension. They must be inventoried deterministically, with dependency symlinks/non-regular entries recorded and never followed; they must never satisfy the UI allowlist, mask or alias an alternate UI root, or cause legitimate dependency HTML to be misclassified as an application frontend.

backend/scripts/verify-frontend-artifact.mjs must require explicit --source and --artifact roots and recursively inventory the artifact deterministically using normalized relative POSIX paths. It must compare the exact UI allowlist and bytes and fail closed on unreadable/missing roots, missing allowlisted source/artifact files, and byte drift. Extra entries, duplicate content or filename, symlinks/non-regular files, alternate entrypoints, and forbidden trees fail when they occur in the deployable UI subtree or an application-owned alternate-UI candidate. The verifier must distinguish the dependency inventory under node_modules/: legitimate dependency HTML and expected dependency symlinks are inventoried but not followed and are not rejected solely for being dependency entries. It must never silently default to backend/dist, the current working directory, or a neighboring checkout.

The same verifier gates both backend/dist after npm --prefix backend run build and .aws-sam/build/BackendFunction immediately after make sam-build. make ci and the normal .github/workflows/deploy-dataops-v1.yml checks and deploy jobs must run the post-build SAM gate before any deploy step. A build or workflow cannot continue if parity fails.

An isolated copy of .aws-sam/build/BackendFunction under .tmp/issue-159/ must run with FRONTEND_ROOT unset and no access to repository frontend/. Its compiled handler must serve /, an extensionless/hash deep link, /src/app.js, and /src/styles.css from the packaged files with correct content and type. Missing assets, traversal, unknown static paths, /public/*, and /api/* must fail with their explicit safe page/static/JSON semantics and never fall through to another shell.

Acceptance Criteria

• The capability matrix above is implemented as durable repository-owned test mapping with no missing/unclassified retained surface; every row has real API/browser behavior coverage and an exact test pointer.
• Marker-only convergence assertions are removed or narrowed to inventory plumbing; they are not counted as product coverage. The full normal E2E suite retains all Complete canonical frontend deep-link and operator parity #156 and Secure and structure runtime-template administration #157 behavior tests.
• The deployable UI inventory is exactly the three allowlisted regular files, byte-identical to frontend/. Within that UI subtree, development-only files, extras, duplicates, symlinks/non-files, and alternate entrypoints are absent; no application-owned alternate-UI candidate exists elsewhere. Dependency-owned node_modules/ entries do not count toward or weaken this UI allowlist.
• Focused verifier tests prove exact success plus fail-closed missing source/artifact, byte drift, duplicate, alternate pages/public/other HTML, extra frontend file, symlink/non-file, bad root, and omitted-argument cases, with UI faults scoped to the deployable UI subtree and application-owned alternate-UI candidates. A representative dependency tree containing legitimate node_modules/ HTML plus node_modules/.bin/ and package symlinks passes classification only when those entries are inventoried and never followed.
• backend/dist parity passes immediately after backend build and actual .aws-sam/build/BackendFunction parity passes immediately after SAM build.
• Local make ci and both normal deploy-workflow build paths enforce the post-SAM-build verifier before deployment. Workflow/Makefile contract tests fail if that ordering or command is removed.
• The isolated positive/negative packaged-runtime tests prove self-contained serving and no page/API fallback as specified.
• The same behavior/evidence spec runs against source mode and the isolated SAM artifact with identical synthetic fixture seed, IDs, Europe/Berlin clock, locale, fonts, reduced motion, animation disablement, and browser engine; route, visible state, mutation result, accessible-name summary, console/page errors, and asset hashes match.
• The exact paired screenshot inventory below is captured from the final frozen candidate; dimensions, target/state identity, and pairing are machine-checked, and Designer and Tester read every image.
• Architecture PASS, Designer PASS, Tester PASS, and PM ACCEPTED are bound to the exact same final candidate fingerprint.
• Tests, logs, manifests, and screenshots remain synthetic/public-safe and gitignored under .tmp/; no raw SOP, private link, contact, credential, production identifier, sponsor/finance detail, or generated operational artifact enters the public repo.

Exact paired browser evidence

Run these ten evidence states against both targets source and sam, and both viewports desktop-1440x900 and mobile-390x844:

home-ready
inbox-blocked-detail
task-proof-waiting-return
workflow-detail
assistant-detail-baseline
template-admin-saved
notifications-dismissed
sponsor-booking-role-safe
docs-search-detail
settings-users-role

The output directory is .tmp/screenshots/issue-159/. Its inventory must be exactly the 40-file cross-product named <target>-<state>-<viewport>.png (for example source-home-ready-desktop-1440x900.png and sam-home-ready-desktop-1440x900.png), with no stale extra image. Each source/SAM pair uses the same seeded state immediately before capture. Pixel similarity is supporting evidence only; DOM, behavior, asset-byte, console, and accessibility assertions are mandatory.

Test Scenarios

Scenario: Every retained surface has real coverage

Given: the synthetic O/A role fixtures and matrix states above
When: the normal browser suite drives each route through the real local API and reload/return path
Then: every matrix row proves its visible behavior, side effect or denial, and recovery state without request interception or marker-only assertions

Scenario: Exact source/build/SAM inventory

Given: a clean backend build and SAM build
When: the explicit verifier inventories backend/dist and .aws-sam/build/BackendFunction
Then: the deployable UI subtree contains only the three allowlisted regular files, each matches source bytes, and no application-owned alternate UI entrypoint exists; dependency-owned entries are inventoried separately and no dependency link is followed or used to satisfy the UI contract

Scenario: Artifact faults fail closed

Given: isolated copies with, one at a time, a missing UI file, changed UI byte, UI-subtree duplicate or extra file, UI symlink/non-file, application-owned alternate HTML/public/pages/UI tree, invalid root, or omitted argument, plus a positive dependency copy containing legitimate node_modules/ HTML and node_modules/.bin/ or package symlinks
When: verification and relevant runtime requests run
Then: every fault case exits non-zero or returns the specified safe non-success response with no fallback shell or leaked file, while the dependency-positive case passes only with those dependency entries inventoried, classified outside the UI allowlist, and never followed

Scenario: Source and SAM browser parity

Given: identical deterministic fixtures and the exact final candidate
When: the same evidence journey runs from source and the isolated SAM handler at both viewports
Then: assets, route/state, mutation outcome, accessible summary, console/error result, and the exact 40-image evidence inventory match

Required Verification

Run in this order and report exact commands, exit codes, test counts, artifact inventory/digests, and screenshot paths:

npm --prefix backend test
npm --prefix backend run typecheck
npm --prefix backend run build
node backend/scripts/verify-frontend-artifact.mjs --source frontend --artifact backend/dist
npm --prefix backend run test:e2e
npm --prefix backend run test:frontend-artifact
make sam-validate
make sam-build
node backend/scripts/verify-frontend-artifact.mjs --source frontend --artifact .aws-sam/build/BackendFunction
npm --prefix backend run test:e2e:frontend-parity
make ci
git diff --check

The named focused scripts are deliverables of this issue and must be non-interactive. test:frontend-artifact owns isolated verifier/runtime positive and negative cases. test:e2e:frontend-parity owns the same-source/same-SAM behavior and exact evidence run. All SAM operations are local builds/validation with project-local empty AWS config where applicable; they must not deploy or call AWS APIs.

Dependency Resume Condition

#157 is shipped and the #156 source prerequisite is satisfied. #156 received Tester PASS and PM ACCEPTED, was committed at acdd2c8ccfa88f1d46fd0221b90713f84a1046f3, and was integrated by merge 45d98c5de65466ea2f7d8a0ce2da1eaa8acfbedb. Exact current main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902, which contains that integration on top of #157, passed the Check DataOps v1 app source job in run 31541797073: backend tests, Sponsor gate, typecheck, backend build, full E2E, and SAM validation/build all succeeded. This is the applicable source On-Call result and formally resumes #159.

The Software Engineer must create a fresh #159 worktree from exact clean main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902; do not reuse the stale 56a1e2abd3f803172ea78bc9cd511bacc3733c31 baseline or any pre-integration candidate. Later deployment attempts and the external/pre-existing deployment blockers tracked by #155/#136/#143/#147/#160 do not block local #159 implementation, review, merge, or source CI, and this resume does not claim deployed acceptance.

#159 must integrate before #158 starts because both touch canonical frontend/E2E infrastructure and #158 should extend the final parity baseline rather than fork it. #158 remains the owner of all assistant lifecycle/access-policy behavior.

Lifecycle Gates

• Complete canonical frontend deep-link and operator parity #156 accepted, integrated, and source-gated on top of main containing shipped Secure and structure runtime-template administration #157 — exact current main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902, run 31541797073
• Software Engineer implementation, uncommitted
• Architecture PASS on capability coverage, artifact inventory, isolated runtime, auth/API fail-closed behavior, and CI ordering
• Designer PASS on all 40 exact paired screenshots at native dimensions
• Tester PASS with commands, exit codes, counts, matrix mapping, digests/inventory, runtime negatives, accessibility/console results, and screenshots
• PM ACCEPTED from the operator perspective
• Software Engineer commit with Closes #159
• Orchestrator local merge and push
• On-Call source CI/CD result; external deploy blockage is reported honestly and does not reopen this source gate
• Make assistant output review safe and lifecycle-complete #158 may start from the integrated Restore canonical frontend behavior coverage and SAM parity gates #159 baseline
• Verify the canonical frontend through normal DataOps deployment #155 later owns normal deployed acceptance when its external blockers permit

Out of Scope

• Restoring backend/src/pages/, backend/src/public/, retired tests/selectors as product code, the legacy SPA/router, a fallback switch, a parallel/third UI, or another frontend framework.
• Changing the supported route contract or Complete canonical frontend deep-link and operator parity #156 operator behavior except when a real retained-surface test exposes a regression that must be fixed within the existing contract.
• Assistant create/edit/submit/run/retry/review/cancel semantics, version concurrency, provider mediation, storage-URI redaction, or conversational/plugin behavior; all remain Make assistant output review safe and lifecycle-complete #158 scope.
• Broad visual/IA redesign, new product capabilities, new roles/ACLs, data migration, operational/private knowledge, or edits to source repos outside dataops.
• Manual deploy, workflow dispatch/rerun, AWS/IAM/CloudFormation mutation, external provider call, real assistant execution, publishing, sending, or GitHub content mutation.
• Any [HUMAN] gate: all Restore canonical frontend behavior coverage and SAM parity gates #159 acceptance is local and agent-verifiable. Deployed acceptance remains separately tracked in Verify the canonical frontend through normal DataOps deployment #155.

[alexeygrigorev]

PM GROOMED — dependency blocked

Rewrote #159 as a self-contained P0 source/parity spec after reviewing the process and PM contracts, full #159 intake, the canonical cutover history, current source/build/SAM paths at exact main 56a1e2abd3f803172ea78bc9cd511bacc3733c31, in-progress #156, shipped #157, and groomed #158.

The issue now requires:

• a public-safe canonical route/API/role/state/test matrix with real local API/browser coverage for every retained operator surface, not source-marker assertions;
• an exact three-file deployable allowlist (index.html, src/app.js, src/styles.css), excluding development-only DESIGN.md and Dockerfile;
• byte-identical source, backend-build, and actual .aws-sam/build/BackendFunction assets;
• fail-closed tests for missing files/roots/arguments, byte drift, duplicates, symlinks/non-files, alternate HTML/public/pages/UI trees, and extra artifacts;
• an isolated packaged-handler positive/negative runtime gate and mandatory post-SAM-build enforcement in local make ci and both normal deployment-workflow build paths;
• the same deterministic behavior/evidence run against source and isolated SAM targets, with an exact 40-image source/SAM × desktop/mobile inventory at 1440x900 and 390x844;
• Architecture, Designer, Tester, and PM gates bound to one frozen candidate, with synthetic/public-safe evidence only.

Dependency order is explicit: #157 is already shipped; #156 must finish acceptance, commit, integration, and its applicable source gate first; #159 then starts from that clean converged main and integrates before #158. #159 covers only the retained assistant list/detail/deep-link baseline. #158 remains the sole owner of assistant lifecycle, concurrency, provider mediation, storage-URI redaction, review safety, and conversational boundaries.

needs grooming was removed. The existing bug, portal, frontend, backend, infra, testing, design, and P0 labels are the appropriate type/area/priority set. No repository source, commit, push, deploy, workflow dispatch, AWS call, external provider action, or HUMAN-only gate was added or performed.

Next owner: Software Engineer after #156's integration resume condition is recorded; then Architect and Designer, Tester, and PM.

[alexeygrigorev]

PM RESUMED — #156 source prerequisite satisfied

#159 is groomed, unblocked, and ready for Software Engineer implementation from exact clean current main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902.

The baseline contains shipped #157 and accepted/integrated #156 (SWE commit acdd2c8ccfa88f1d46fd0221b90713f84a1046f3, merge 45d98c5de65466ea2f7d8a0ce2da1eaa8acfbedb). At that exact current-main SHA, run 31541797073 completed the Check DataOps v1 app source job successfully: backend tests, Sponsor gate, typecheck, backend build, full E2E, SAM validation, and SAM build passed. That is the applicable source result required by #159. Later deployment attempts are separate external/pre-existing infrastructure work and do not block this local source issue; this handoff does not claim deployed acceptance.

The Architect preflight ambiguity is resolved without reducing scope:

• the deployable UI subtree remains an exact three-regular-file allowlist: dist/frontend/index.html, dist/frontend/src/app.js, and dist/frontend/src/styles.css, byte-identical to source;
• extras, duplicates, symlinks/non-files, alternate HTML/browser entries, and pages/public/static/assets/other frontend candidates still fail closed when they occur in the deployable UI subtree or an application-owned alternate-UI candidate;
• legitimate dependency HTML and node_modules/.bin or package symlinks are inventoried as dependency entries, never followed, never used to satisfy the UI allowlist, and not misclassified as alternate application frontends solely by filename or extension;
• focused tests now require both the negative UI/alternate-root cases and a representative positive dependency-tree classification case.

All canonical capability coverage, source/build/SAM parity, isolated runtime, exact 40-image evidence, role/state, review, and boundary requirements remain in scope. Existing labels remain appropriate; needs grooming was already absent.

Next owner: Software Engineer. Create a fresh worktree from exact clean main 3ad9e9c3e81243b30f42aed5b72b6c9b34777902; do not reuse the stale pre-#156 baseline. No repository file, commit, push, deployment, workflow dispatch, or AWS action was performed during this PM resume.

[alexeygrigorev]

ARCHITECTURE PASS — canonical coverage and packaged-runtime gate

Role identity: Architecture specialist reviewing the frozen, uncommitted #159 candidate.

Candidate binding

• Base / HEAD: 3ad9e9c3e81243b30f42aed5b72b6c9b34777902
• Candidate: 26 paths — 19 tracked modifications and 7 untracked additions
• Independently recomputed tracked-plus-sorted-untracked binary-patch fingerprint before and after review: f4f019bdd12a928f009171547af6a50a181697ac01324fb9e8241aa4891796aa
• The fingerprint remained exact after all review commands. No approval is transferred from any superseded candidate.

Architecture findings

• Capability/evidence contract — PASS. The durable matrix classifies exactly 19 capabilities, 17 retained hash routes, five role/session identities, and 141/141 states with zero gaps. Its contract test resolves every pointer to one exact normal Playwright title, requires browser behavior/assertions, rejects API-only/marker/source-string/parity/screenshot evidence, rejects browser request interception in counted tests, and keeps the assistant baseline non-mutating.
• Canonical artifact — PASS. backend/dist and the actual SAM BackendFunction contain the same exact allowlisted UI bytes as top-level frontend/: index.html SHA-256 b3f73a83336f…, src/app.js 477f858bba8d…, and src/styles.css 8f7a02e6b51a…. The SAM dependency inventory is separate and deterministic: 8,944 entries, including 8 recorded/unfollowed symlinks and 3 legitimate dependency HTML files. No dependency entry satisfies or weakens the UI allowlist.
• Verifier and isolated runtime — PASS. The 8 focused tests cover explicit arguments, missing/bad roots and files, byte drift, duplicates, alternate UI trees/HTML, extras, symlinks/non-files, ambiguous layouts, dependency classification, and the isolated copied SAM handler. The handler uses a real opaque browser-cookie session, resolves no module outside the copy, serves only the packaged shell/two assets, and fails safely for traversal, missing/unknown/forbidden static paths and API paths.
• Auth and route boundaries — PASS. The 28 focused portal/auth tests prove browser-cookie and legacy bearer separation, raw x-user-id spoof rejection, persisted role resolution, /work/api/* JSON denial, exact authenticated /work/api JSON/non-HTML behavior, safe markdown deep-link reload, and forbidden alternate namespaces. During review I found the exact /work/api shell fallback; the final candidate rewrites that exact path before the broad /work/* shell branch and adds the passing regression.
• CI enforcement — PASS. The contract verifies that make ci and both checks and deploy workflow paths run the explicit SAM verifier immediately after sam-build, and that deploy cannot precede the gate.
• Runtime/test seams — PASS. Bookkeeping uses the atomic prepare/upload/complete contract with hash/idempotency ownership; task follow-up UI uses the existing atomic task-action endpoints and structured history; recurring writes resolve the persisted actor and require admin while reads/instantiation remain available; Home process quality and Admin diagnostics use authenticated local docs/read-only seams and preserve honest partial failure; mailing and object-store providers are injected only by the local test server. No __e2e__, route-fault, synthetic-failure, or parity seam appears in backend/dist or the SAM runtime.
• Parity evidence integrity — PASS. The frozen manifest SHA-256 is c4e58c5d4777…; it contains exactly 40 records for the required 10 states × 2 viewports × source/SAM targets, one common asset-hash triple, fixed 2026-08-12T10:15:00.000Z, Europe/Berlin, en-GB, reduced motion, Arial, Chromium, and zero console/page/failed-response entries. The screenshot directory is exactly 40 PNGs and every file has the required 1440×900 or 390×844 dimensions. Visual reading remains the Designer gate.
• Ownership boundaries — PASS. No schema, DynamoDB table, IAM, CloudFormation resource, secret flow, external provider action, source-repository edit, or operational/private-knowledge artifact is introduced. Git-backed process knowledge, DynamoDB execution state, test fixtures, and packaged frontend assets remain separate.

Independent command evidence

• Both explicit verifier invocations — PASS, matching source/build/SAM bytes and the dependency inventory above.
• node --test backend/scripts/frontend-capabilities.test.mjs — 5/5 PASS.
• node --test backend/scripts/frontend-artifact.test.mjs — 8/8 PASS.
• Focused docs-portal.test.ts + portal-auth.test.ts — 28/28 PASS.
• Parity manifest/inventory/dimension/hash audit — 40/40 PASS; zero runtime/browser errors.
• cmp across all three source/build/SAM assets — PASS.
• Static deployable test-seam audit — no matches.
• node --check for the canonical frontend, capability behavior spec, and both parity scripts — PASS.
• git diff --check HEAD — PASS.

Verdict: ARCHITECTURE PASS for fingerprint f4f019bdd12a928f009171547af6a50a181697ac01324fb9e8241aa4891796aa. No architecture fix is required. Designer, Tester, and PM gates remain required on this same fingerprint.

No source/test file was edited, committed, pushed, deployed, or used to dispatch a workflow; no AWS action was performed during this review.

[alexeygrigorev]

DESIGN PASS — final frozen parity candidate

Reviewer identity: Designer role agent, posting through GitHub account alexeygrigorev.

This verdict is bound only to the uncommitted tracked-plus-sorted-untracked full-index binary-patch fingerprint:

f4f019bdd12a928f009171547af6a50a181697ac01324fb9e8241aa4891796aa

I independently reproduced that exact fingerprint before and after review from base/HEAD 3ad9e9c3e81243b30f42aed5b72b6c9b34777902. The candidate inventory is 19 tracked modifications plus 7 sorted untracked files.

Screenshot inventory and visual inspection

I read every final PNG under .tmp/screenshots/issue-159/ at its native dimensions. The inventory is the exact 40-file cross-product with no missing or extra image:

• source and isolated SAM targets;
• all 10 required states: Home ready, blocked Inbox detail, task proof/waiting/return, workflow detail, assistant baseline detail, saved admin template, dismissed Notifications, role-safe sponsor booking, docs search/detail, and Settings/Users role;
• desktop: 20 images at 1440×900;
• mobile: 20 images at 390×844.

All reviewed screens show the intended route and state. There is no 404/error shell, broken layout, overlap, horizontal spill, unreadable control, or missing state. The corrected five-item mobile header stays on one row at 390 px, including Inbox detail. Task and workflow panels now show the clean numeric Step 1 process relationship; no NaN, error-object text, or misleading process-quality warning remains. Dialogs, drawers, task/workflow panels, notification overlay, role-safe sponsor detail, document editor, and Settings remain readable and appropriately layered at both viewports.

Source/SAM parity and evidence

• Manifest SHA-256: c4e58c5d4777c80336219b895c8b642c11f6804834439826cd9f1cfce8f78818.
• Sorted screenshot content-ledger SHA-256: ee530287823834c5be7832f147073dc8f14bfda70895a2c30296b4b80cdaacb1.
• All 20 source/SAM state-viewport pairs have exact route, title, mutation result, visible summary/hash, accessibility summary/hash, font, and asset-hash parity.
• Fourteen PNG pairs are byte-identical. I separately inspected both images for each of the six non-identical PNG pairs; they are visually and semantically equivalent.
• All 40 records report zero console errors, page errors, and failed responses.
• The one asset set is byte-identical across source, backend build, and SAM: index.html b3f73a83…, app.js 477f858b…, and styles.css 8f7a02e6….
• Fixtures, labels, IDs, URLs, emails, documents, organizations, and workflow content are visibly synthetic/public-safe. Assistant evidence remains the non-mutating list/detail baseline owned by Restore canonical frontend behavior coverage and SAM parity gates #159.

Verdict: DESIGN PASS. The source/SAM evidence is visually coherent and responsive for the exact frozen fingerprint. This is parity/evidence hardening, not a broad redesign, and no additional design change is required.

No source or candidate file was edited, committed, pushed, deployed, or used for an AWS or workflow action during this review.