Files
backup-tool/docs/release/m17-operator-workflows-evidence.md

28 lines
1.9 KiB
Markdown

# M17 operator workflow evidence
## Delivered workflows
- Routed shell: protected, lazy, URL-addressable dashboard, resource, operation, notification, security, audit, and administration views.
- Resources: repository create/inspect; local and SSH source create, probe, typed archive; job create/enable/disable; schedule create/update/delete; manual enqueue.
- Operations: named execution SSE events, reconnect status, polling fallback, state-gated retry/cancel; backup verification/deletion impact preview; restore dry-run and exact-destination overwrite confirmation.
- Notifications: subscription creation, selected-only test, signing-key rotation input, delivery attempts/retry; webhook signing secrets are write-only.
- Administration: write-only secret creation, one-time token rendering, and user-state update.
## Deliberate boundaries and remaining API gaps
- Backup deletion has no v2 delete endpoint, so the UI stops at its impact preview and directs the operator to the CLI.
- Recovery bundles, passphrases, and recovery imports/exports remain CLI-only.
- User/token metadata list endpoints and generated response ETags are not available. Therefore user/token discovery and ETag-required subscription edit/disable/archive controls are not exposed rather than implemented unsafely.
- Audit filtering and cursor navigation await their corresponding authenticated API query parameters.
## Verification
```text
npm --prefix frontend test -- --run # 8 passed
npm --prefix frontend run typecheck # passed
.venv/bin/python -m pytest tests/integration/test_sources_jobs.py -q # 4 passed
make check # passed
```
The expected generated artifacts (`openapi/v2.json` and `frontend/src/api/generated/client.ts`) are staged so `make check` can verify API generation drift without staging unrelated workspace changes.