spec(service-credential-tester): sync into new canonical domain

New canonical openspec/specs/service-credential-testing/spec.md (21 reqs CT-101..121). Change-side delta + sync-report. web-ui/prometheus-charting/ service-storage canonicals untouched.
2026-07-09 23:22:53 +00:00
parent 98bf496a98
commit 6bcb60a74d
3 changed files with 591 additions and 0 deletions
@@ -0,0 +1,183 @@
+# Sync Report — `service-credential-tester`
+
+> Phase: **sync** · Change: `service-credential-tester` · Repo: `/home/user/manage`
+> Mode: file-backed (`artifactStore: openspec`). No source-code edits; only OpenSpec artifacts were
+> written. Not committed (parent owns the commit). The change folder was **not** moved (that is
+> `sdd-archive`'s job).
+
+**Status: SYNCED.** A new canonical domain
+`openspec/specs/service-credential-testing/spec.md` was created from the verified change, and the
+change-side domain delta spec that unblocks the native status engine's `sync`/`archive` gates is
+also in place.
+
+---
+
+## 1. Executive summary
+
+The `service-credential-tester` change shipped a **complete but flat**
+`openspec/changes/service-credential-tester/spec.md` (21 requirements, CT-101 … CT-121) with **no**
+per-domain delta spec under `openspec/changes/service-credential-tester/specs/<domain>/`. `sdd-sync`
+requires a domain delta spec; the flat spec alone does not satisfy the canonical-merge contract.
+
+Verify already returned a **functional PASS** — verdict in `verify-report.md`: all 21 requirements
+CT-101 … CT-121 PASS against source, and all five gates are green (backend `pytest` 362 passed,
+`ruff` clean, frontend `npm run build`, `npm run lint` 0 errors, `npx vitest run` 158 passed). The
+verify report's two CRITICAL items are **archive-only** blockers (B-1 missing `apply-progress.md`,
+B-2 unchecked task checkboxes); the parent confirms `apply-progress.md` is now present and
+reconciled. These are lifecycle-hygiene items, not verification-integrity blockers, and they do not
+block `sdd-sync` of the green code.
+
+This sync **reconciles** the flat-spec-vs-domain-spec gap:
+
+1. Authored the missing **change-side domain delta spec** —
+   `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` — using a
+   clean `## ADDED Requirements` structure that preserves the exact requirement IDs (CT-101 …
+   CT-121) and text from the verified flat `spec.md`. This is what flips the native status engine's
+   `specs` artifact from partial → done.
+2. **Synced** the end-state into the **canonical store** —
+   `openspec/specs/service-credential-testing/spec.md` — the actual sync target. Because the
+   canonical `service-credential-testing` domain did not previously exist, the native helper rule
+   applies: *when the canonical spec does not exist, the change spec becomes the new canonical
+   spec.* The two files therefore carry identical requirement bodies (delta under
+   `## ADDED Requirements`; canonical under `## Requirements`).
+
+Domain name **`service-credential-testing`** was chosen (per the dispatch brief) because it scopes
+the full new capability: the `POST /api/services/test` endpoint, the closed `test_callable`
+dispatch registry, the seven per-type connection-test routines, the no-persistence /
+no-secret-logging guarantees, and the frontend test UI. It is distinct from the existing canonical
+domains `web-ui` (MUI→shadcn migration), `prometheus-charting` (direct Prometheus metric
+visualization), and `service-storage` (per-service data lifecycle layer) — none of which was
+**touched**.
+
+## 2. Structured status & actionContext findings
+
+The native `gentle-pi.sdd-status` passed by the parent reports `changeName: null` with
+`blockedReasons: ["Change selection is ambiguous: per-instance-hook-scoping,
+service-credential-tester."]` because the engine auto-detected more than one active change. This
+sync task was **explicitly assigned** `service-credential-tester`; the ambiguity is a
+parent-resolution artifact and does not block this phase (`isNonAuthoritative: false`).
+
+- `artifactStore: openspec`; change root `openspec/changes/service-credential-tester/`.
+- Artifacts present: `proposal.md`, `spec.md`, `design.md`, `tasks.md`, `apply-progress.md`,
+  `verify-report.md`.
+- `verify: PASS` (functional verdict; gates green at `f6c67bd`).
+- `actionContext`: `mode: repo-local`, `workspaceRoot: /home/user/manage`,
+  `allowedEditRoots: ["/home/user/manage"]`, `warnings: []`. All three files written are inside the
+  authoritative workspace / allowed edit roots. ✓
+- `relationships.sameDomainActiveChanges: []`, `collisions: []` — **no active same-domain
+  collisions**, so no archive/sync ordering decision was required.
+- The new `service-credential-testing` domain is distinct from the existing `web-ui`,
+  `prometheus-charting`, and `service-storage` canonical domains; all three were left untouched
+  (verified via `git status --porcelain`).
+
+**Verify verdict nuance (archive-only blockers):** the verify report's verdict is "PASS
+(functionally) — every requirement CT-101 … CT-121 is met … ARCHIVE IS BLOCKED on a task-hygiene /
+missing-`apply-progress` issue." The two CRITICAL findings (B-1, B-2) are explicitly **archive**
+blockers, not verification failures: the code is functionally complete and all gates are green.
+`sdd-sync`'s stop conditions target *verification integrity* (unresolved FAIL/BLOCKED/CRITICAL
+**verification** blockers), and these are lifecycle-hygiene items. The parent states
+`apply-progress.md` is now reconciled. Sync therefore proceeds; the unchecked-tasks item is
+forwarded to `sdd-archive` (§7).
+
+**Post-sync structural change:**
+`openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` now exists
+(`hasDomainSpecs` → true), resolving the missing-domain-spec condition that gated sync. The flat
+`spec.md` is intentionally **left in place** as the authoritative planning artifact the work was
+built against (the archive convention keeps flat specs too); it no longer triggers the "flat spec
+without domain specs" condition now that a domain delta sits alongside it.
+
+## 3. Domains synced & canonical files updated
+
+| Domain | Change-side delta (source) | Canonical (sync target) | Action |
+|---|---|---|---|
+| `service-credential-testing` | `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` | `openspec/specs/service-credential-testing/spec.md` | **NEW domain** — `## ADDED Requirements` copied into canonical as a new spec |
+
+- **Canonical file created:** `openspec/specs/service-credential-testing/spec.md` (21 requirements).
+- **Change-side delta created:**
+  `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md`
+  (21 requirements, all `## ADDED Requirements`).
+
+## 4. Requirement delta (ADDED / MODIFIED / REMOVED)
+
+- **ADDED (21)** — all to the new `service-credential-testing` domain (canonical did not exist
+  pre-change). IDs and text preserved verbatim from the verified flat `spec.md`. Grouped logically:
+  - *Endpoint shape, validation, dispatch* — CT-101, CT-102, CT-103
+  - *Per-type test routines* — CT-104, CT-105, CT-106, CT-107, CT-108, CT-109, CT-110, CT-111
+  - *No-persistence + security* — CT-112, CT-113
+  - *Frontend test UI* — CT-114, CT-115, CT-116, CT-117, CT-118
+  - *Tests + gate greenness* — CT-119, CT-120, CT-121
+- **MODIFIED (0)** — none (new domain; no pre-existing canonical requirements to replace).
+- **REMOVED (0)** — none.
+- **RENAMED (0)** — none (RENAMED is intentionally unsupported by the native delta helper; not used).
+
+## 5. Guardrails, approvals & destructive-sync assessment
+
+- **Same-domain collisions:** none (`sameDomainActiveChanges: []`, `collisions: []`). The new
+  `service-credential-testing` domain does not overlap the existing `web-ui`,
+  `prometheus-charting`, or `service-storage` canonical domains. No ordering decision was needed.
+- **Destructive sync:** **not applicable.** There are zero REMOVED requirements and zero large
+  MODIFIED blocks (new domain; everything is ADDED). No destructive-sync parent approval was
+  required beyond the explicit reconciliation instruction in the task.
+- **Legacy flat spec:** detected pre-sync; resolved by adding the domain delta spec alongside it
+  (the block condition is specifically "flat spec *without* domain specs"). The flat spec was left
+  in place as a planning artifact.
+- **`web-ui` / `prometheus-charting` / `service-storage` canonical isolation:** the existing
+  `openspec/specs/web-ui/spec.md`, `openspec/specs/prometheus-charting/spec.md`, and
+  `openspec/specs/service-storage/spec.md` were **not modified** — verified untouched by
+  `git status --porcelain openspec/specs/web-ui openspec/specs/prometheus-charting
+  openspec/specs/service-storage` (empty). The four domains are independent.
+
+## 6. Validation / checks performed (file-backed, read-only)
+
+Run from `/home/user/manage` (no source edits, no test re-runs — those are owned by verify and were
+already green at `f6c67bd`):
+
+| Check | Command | Result |
+|---|---|---|
+| Canonical store populated | `ls openspec/specs/service-credential-testing/spec.md` | present ✓ |
+| Change-side domain spec present | `ls openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` | present ✓ |
+| Requirement-ID parity (flat ↔ delta ↔ canonical) | `grep -oE 'CT-[0-9]+' … \| sort -u \| wc -l` | **21 == 21 == 21**, identical IDs CT-101…CT-121 ✓ |
+| ID-set parity (flat ↔ canonical) | `diff <(…flat…) <(…canonical…)` | **PARITY OK** — identical ID sets ✓ |
+| Body-text parity (delta ↔ canonical) | `### Requirement:` regions compared | identical prose ✓ |
+| Delta is pure ADDED | count `## ADDED/MODIFIED/REMOVED Requirements` | ADDED=1, MODIFIED=0, REMOVED=0 ✓ (no destructive sync) |
+| Other canonicals untouched | `git status --porcelain openspec/specs/web-ui openspec/specs/prometheus-charting openspec/specs/service-storage` | empty (not modified) ✓ |
+| Flat spec left in place | `ls openspec/changes/service-credential-tester/spec.md` | present (not moved/deleted) ✓ |
+| No edits outside openspec | `git status --porcelain` (filtered) | only `openspec/specs/service-credential-testing/`, `openspec/changes/service-credential-tester/specs/`, and this report added ✓ |
+| Markdown validity | write-time lint | all three files "Markdown clean" ✓ |
+
+## 7. Carry-over items for the archive summary
+
+These verify-phase findings are non-blocking for sync and should land in the archive summary:
+
+1. **[CRITICAL-process, archive-only] Unchecked task checkboxes.** At verify time, all 29 tasks in
+   `tasks.md` were unchecked (`- [ ]`) and `apply-progress.md` was missing (verify findings B-1/B-2).
+   The parent states `apply-progress.md` is now present and reconciled. `sdd-archive` should re-scan
+   the native status engine to confirm `tasks: done` / `applyProgress: present` and tick any
+   remaining unchecked boxes before moving the change to archive.
+2. **[INFO] Stale-proposal correction carried into the spec.** The flat spec documents that
+   `jellyseerr` is no longer a distinct service type (merged into Jellyfin config by
+   `services-as-hub-ia`); the 7 remote types + `backups` are the active coverage. No `jellyseerr`
+   requirement exists.
+3. **[INFO] `prometheus` routes through the Grafana gateway.** CT-105's canonical text (verbatim
+   from the flat spec) references `grafana-metric-gateway`. This is a pre-existing design assumption
+   recorded faithfully; it does not affect sync.
+4. **[INFO] List-marker normalization.** The flat source uses `-` bullets; the linter normalized
+   list markers in the delta/canonical files (cosmetic only — requirement prose is verbatim and the
+   delta helper matches by `### Requirement:` blocks, not marker style).
+
+## 8. Next recommended phase
+
+→ **`sdd-archive`** (clean). Confirm the native status re-scan reports `specs: done` / `sync: ready`
+/ `archive: ready`, then move the change to
+`openspec/changes/archive/2026-07-09-service-credential-tester`, carrying over the items in §7 into
+the archive summary. Do **not** commit or push — the parent owns the commit with explicit paths.
+
+---
+
+### Appendix — Files written by this sync (OpenSpec only; no source code)
+
+- `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` —
+  **change-side domain delta (`## ADDED Requirements`), 21 requirements CT-101…CT-121.**
+- `openspec/specs/service-credential-testing/spec.md` — **canonical spec (new domain), 21
+  requirements.**
+- `openspec/changes/service-credential-tester/sync-report.md` — this report.