# Archive Report — `service-credential-tester`

> Phase: **archive** · Change: `service-credential-tester` · Repo: `/home/user/manage`
> Mode: file-backed (`artifactStore: openspec`). No source-code edits; only OpenSpec artifacts
> were touched. **Not committed** — the parent/orchestrator owns the archive commit. No push, no `gh`.

**Status: ARCHIVED.** All eight lifecycle phases are complete (proposal → spec → design → tasks →
apply → verify → sync → **archive**). Every archive precondition is verified PASS (see §2). The
canonical `openspec/specs/service-credential-testing/spec.md` (a **new** domain created by
`sdd-sync` — pure `## ADDED Requirements`, 21 requirements CT-101 … CT-121) remains in place as the
durable end-state spec and is **not** moved (archive never moves canonical specs). The change folder
was moved to `openspec/changes/archive/2026-07-09-service-credential-tester/` via `git mv` to
preserve history.

---

## 0. Archive disposition

- **Disposition: `archived`.** The parent explicitly requested the `git mv` and owns the commit, so
  the move is executed here and left staged for the parent's explicit-path commit.
- **Archive convention:** OpenSpec SDD archive contract for `openspec` mode — completed file-backed
  sync → write the in-folder archive report → move the change folder to
  `openspec/changes/archive/YYYY-MM-DD-{change}/`. No standalone manifest/index exists under
  `openspec/` (only `config.yaml`, `changes/`, `specs/`), so the folder move **is** the archive
  mechanism. No `rules.archive` override exists in `openspec/config.yaml` (verified: no `archive`
  key under `rules`).
- **Target archived path:** `openspec/changes/archive/2026-07-09-service-credential-tester/`
- **Archive date:** `2026-07-09` (ISO).
- **Canonical spec left in place (not moved):** `openspec/specs/service-credential-testing/spec.md` —
  21 requirements (CT-101 … CT-121). Verified present and untouched after the move (sha256
  `edcdfecc54fafb3729a9c4f5bcbe48a2f6b6b430336e20823bb363b9a2c2e330`, unchanged pre/post move).
- **The other canonical domains are also left untouched:** `openspec/specs/web-ui/spec.md`,
  `openspec/specs/prometheus-charting/spec.md`, `openspec/specs/service-storage/spec.md`.
- **Audit-trail integrity:** the change folder was moved as a whole, including the legacy flat
  `spec.md`, the per-domain delta `specs/service-credential-testing/spec.md`, `apply-progress.md`,
  `verify-report.md`, and `sync-report.md`, which travel with the record. Nothing was silently
  deleted or rewritten.

## 1. Native `sdd-status` read & discrepancy statement

The native `gentle-pi.sdd-status` engine supplied by the parent reports **non-actionable state for
this archive** because it was resolved without a change context: `changeName: null`,
`artifacts: all missing`, `applyState: blocked`, `dependencies.archive: blocked`,
`blockedReasons: ["Change selection is ambiguous: per-instance-hook-scoping,
service-credential-tester."]`, `isNonAuthoritative: false`. This is a **parent-resolution artifact**:
the engine auto-detected two active changes and could not pick one. The ambiguity does **not**
reflect the state of `service-credential-tester`, which this archive task was **explicitly
assigned**.

**Discrepancy with the parent's authoritative confirmed state — RESOLVED in favor of the parent.**
The parent physically verified (and this executor re-confirmed directly against the filesystem in
§2) that all 29 tasks are ticked, `apply-progress.md` is present and records the work, the verify
report confirms functional completion (21/21 PASS), and the sync report confirms a SYNCED canonical
domain. Per the archive contract's non-authoritative-store carve-out guidance and the parent's
explicit instruction ("native sdd-status may report stale blockers — DISREGARD; parent verified.
PROCEED"), the stale `archive: blocked` / "ambiguous" labels are **disregarded** and the archive
**proceeds**.

Direct filesystem re-validation (§2) is the source of truth for this report.

## 2. Archive preconditions (validated directly against the filesystem)

| Precondition | Evidence | Result |
|---|---|---|
| Verify report present | `verify-report.md` | ✓ verdict **PASS (functionally)** — 21/21 requirements PASS |
| Verify clearly passing — no unresolved `FAIL`/`BLOCKED`/`CRITICAL` | the two verify CRITICALs were **reconcilable archive-only** items (missing `apply-progress.md` + 29 unchecked boxes), now **resolved**; no unresolved critical verification issue remains | ✓ |
| Sync report present & successful | `sync-report.md` → **Status: SYNCED** | ✓ |
| Canonical spec exists (sync target, created) | `openspec/specs/service-credential-testing/spec.md` (21 requirements, CT-101 … CT-121) | ✓ |
| Change-side domain delta exists | `specs/service-credential-testing/spec.md` (`## ADDED Requirements`) | ✓ |
| Delta op-class = pure additive (ADDED; new domain; no MODIFIED/REMOVED) | ADDED=21, MODIFIED=0, REMOVED=0, RENAMED=0 | ✓ |
| Requirement-ID parity (flat ↔ delta ↔ canonical) | 21 == 21 == 21; identical IDs CT-101 … CT-121 | ✓ |
| proposal / design / tasks artifacts present | all populated | ✓ |
| **Final Task Completion Gate — zero unchecked `- [ ]`** | `grep -cE '^\s*- \[ \]' tasks.md` → **0**; `grep -cE '^\s*- \[x\]'` → **29** | ✓ |
| `apply-progress.md` present & records the work | present; status "complete — all 29 tasks done, all gates green"; 2 slices documented | ✓ |
| No active same-domain (`service-credential-testing`) collision | new domain; the only other active change (`per-instance-hook-scoping`) carries no `service-credential-testing` delta; `sameDomainActiveChanges: []`, `collisions: []` (per sync-report §5) | ✓ |

**Stale-checkbox reconciliation note.** At verify time, all 29 implementation/verification checkboxes
were unchecked and `apply-progress.md` did not exist (verify findings B-1/B-2). That condition was
reconciled **before** archive: `apply-progress.md` was authored documenting the two landed slices
(`3391fbc` slice-1 backend, `f6c67bd` slice-2 frontend) and the gate results, and all 29 boxes are
now ticked. `apply-progress.md` plus the verify report prove every previously-unchecked task
complete. No archive-time mechanical checkbox repair was needed — the gate now passes on the
persisted `tasks.md` as-is (0 unchecked). No partial-archive approval applies.

## 3. Artifacts read (archive preflight)

- `openspec/changes/service-credential-tester/proposal.md`
- `openspec/changes/service-credential-tester/spec.md` (flat, authoritative planning artifact — 21 requirements CT-101 … CT-121)
- `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` (change-side domain delta — `## ADDED Requirements`)
- `openspec/changes/service-credential-tester/design.md`
- `openspec/changes/service-credential-tester/tasks.md`
- `openspec/changes/service-credential-tester/apply-progress.md`
- `openspec/changes/service-credential-tester/verify-report.md`
- `openspec/changes/service-credential-tester/sync-report.md`
- `openspec/specs/service-credential-testing/spec.md` (canonical, sync target — verified present and untouched)
- `openspec/config.yaml` (rules: proposal/tasks; no `rules.archive` override)
- House-style reference: `openspec/changes/archive/2026-07-09-grafana-metric-gateway/archive-report.md`

> The legacy flat `spec.md` is **not** the only spec artifact: a per-domain delta
> (`specs/service-credential-testing/spec.md`) and a canonical spec both exist, so the "legacy flat
> spec as the *only* artifact" archive-block condition does not apply. The flat spec travels with the
> archived folder as part of the audit trail.

## 4. Domains synced & requirement delta

| Domain | Change-side delta | Canonical | Action |
|---|---|---|---|
| `service-credential-testing` | `specs/service-credential-testing/spec.md` | `openspec/specs/service-credential-testing/spec.md` | **NEW domain — ADDED** — 21 requirements copied into the canonical store as a brand-new spec |

- **ADDED (21)** — all to the new `service-credential-testing` domain (canonical did not exist
  pre-change). IDs and text preserved verbatim from the verified flat `spec.md`. Grouped logically:
  - *Endpoint shape, validation, dispatch* — CT-101, CT-102, CT-103
  - *Per-type test routines* — CT-104, CT-105, CT-106, CT-107, CT-108, CT-109, CT-110, CT-111
  - *No-persistence + security* — CT-112, CT-113
  - *Frontend test UI* — CT-114, CT-115, CT-116, CT-117, CT-118
  - *Tests + gate greenness* — CT-119, CT-120, CT-121
- **MODIFIED (0)** — none (new domain; no pre-existing canonical requirements to replace).
- **REMOVED (0)** · **RENAMED (0)** — nothing destructive.

## 5. Final lifecycle status (all 8 phases done)

| Phase | Status | Evidence |
|---|---|---|
| Proposal | ✅ done | `proposal.md` |
| Spec | ✅ done | flat `spec.md` (21) + domain delta `specs/service-credential-testing/spec.md` (21 ADDED) |
| Design | ✅ done | `design.md` |
| Tasks | ✅ done | `tasks.md` — **29/29** checked, zero `- [ ]` |
| Apply | ✅ done | 2 slices delivered (commits `3391fbc` slice-1 backend, `f6c67bd` slice-2 frontend) |
| Verify | ✅ PASS | `verify-report.md` — 21/21 PASS; gates green (verify's two CRITICALs were archive-only hygiene, now resolved) |
| Sync | ✅ done | `sync-report.md` — SYNCED; canonical `service-credential-testing` domain ADDED (now 21 requirements) |
| Archive | ✅ done | this report + folder move performed |

## 6. Gate results (per verify-report / apply-progress)

| Gate | Command | Result |
|---|---|---|
| Backend tests | `cd backend && PYTHONPATH=src python3 -m pytest -q` | **PASS** — 362 passed (2 pre-existing warnings) |
| Backend lint | `cd backend && PYTHONPATH=src python3 -m ruff check src tests` | **PASS** — All checks passed |
| Frontend build | `cd frontend && npm run build` | **PASS** — exit 0 (pre-existing chunk-size advisory) |
| Frontend lint | `cd frontend && npm run lint` | **PASS** — 0 errors (1 pre-existing unrelated warning) |
| Frontend tests | `cd frontend && npx vitest run` | **PASS** — 158 passed / 45 files |

## 7. Carry-over follow-ups & non-blocking notes (recorded for the record)

1. **[RESOLVED — verify N-2] No-secret-logs test was strengthened.** Verify flagged the original
   `test_secrets_not_logged` as weak/misleading because it sent an empty `secrets: {}` payload (the
   assertion was then trivially satisfied). The test was rewritten (`backend/tests/test_api.py`)
   to drive the **full endpoint path** (validate → dispatch to the real `test_callable` → success
   log) with **real-looking secret payloads** — `grafana_api_key: "glc_somethingverysecret"` and
   `password: "SUPER-SECRET-PW-12345"` — mocking at the network boundary so both requests succeed,
   then asserting that neither the full values nor meaningful fragments (`"verysecret"`, `"SUPER"`)
   leak into `caplog.text`. This genuinely proves CT-113 (secrets never logged). The verify finding
   is closed.
2. **[DESIGN — intentional improvement, verify N-6] `ServiceTestPanel` is presentational.** The
   design proposed a stateful panel (`useEffect([input])`); the shipped component is deliberately
   **presentational** (props `{ input, onResult, disabled }`), with the parent owning `testResult`
   - `saveAnyway` state and the store-previous pattern that clears the result on input change. This
   avoids the React `setState`-in-effect footgun and works identically in both surfaces. All of
   CT-114 … CT-118 are still satisfied via parent wiring. Documented in the component docstring and
   `apply-progress.md`. Informational only.
3. **[DESIGN — source-finding] Edit surface is `Settings.tsx::ServiceConfigEditor`, not
   `ServicePage.tsx`.** The spec's literal CT-115 named `ServicePage.tsx`, but that file is
   read-only (it renders tab content for a configured service). The actual service add/edit dialog
   surfaced by the app is `ServiceConfigEditor` inside `Settings.tsx` (create surface:
   `CreateServiceDialog` in `ServicesPage.tsx`). The design's §0 source-finding corrected this, and
   tasks targeted the right file. `ServiceTestPanel` is wired into **both** `CreateServiceDialog`
   and `ServiceConfigEditor`. `ServicePage.tsx` was correctly left untouched.
4. **[USER VALUE — pain resolved] qBittorrent "login failed" surfaced at the UI layer (CT-104).**
   Previously a wrong qBittorrent username/password produced only a generic `RuntimeError` /
   "login failed" buried in backend logs, leaving the operator to dig through logs to diagnose a
   credential problem. The credential tester now logs into qBittorrent + probes `maindata()` during
   the live Test, and specifically translates the `"Fails."` / `"login failed"` response into
   *"Authentication failed — qBittorrent rejected the credentials."*, shown directly in the result
   pill (✗ red detail). The credential-error pain is resolved at the UI layer — the operator gets
   an actionable message without touching logs.
5. **[INFO — non-blocking, verify N-3] Defensive `logger.exception`.** `services.py` emits a full
   traceback via `logger.exception` only on the rare path where a `test_callable` itself raises
   (all routines catch internally). Low risk; a future change may switch to a truncated
   `logger.warning`. Not blocking.
6. **[INFO — non-blocking, verify N-4] Edit flow requires re-typing secrets to test.** In
   `ServiceConfigEditor`, stored secrets are encrypted at rest and are not sent as plaintext on the
   test request, so testing an existing authed service without re-entering its secret yields a
   "required" validation error. This is inherent to the no-persistence design (the test operates on
   request-body plaintext) and is hinted by the "Leave blank to keep the current value" copy.
   Non-blocking UX note; a future change may document it more prominently in the UI/user docs.
7. **[INFO — non-blocking, verify N-5] Page-level gating proven by source, not a page test.**
   `ServiceTestPanel.test.tsx` covers the presentational panel (button states, success/failure
   pills, checkbox toggle). Because the panel is stateless, there is no explicit automated test that
   the Create/Save confirm button enables only after a passing test, or that editing a field clears
   `testPassed`. The logic is correct by source inspection (store-previous pattern in both parents);
   a future change may add a page-level integration test.
8. **[INFO]** The working tree carries unrelated dirty/untracked items **not owned by this archive**:
   an uncommitted cosmetic (indentation/prettier reflow, no functional diff) modification to
   `frontend/src/pages/ServicesPage.tsx` and untracked `.pi-tmp/*` scratch files (other-change
   strays). Per discipline these were **left untouched**.

## 8. Residual risks & destructive-merge statement

- **Destructive sync / merge:** **none destructive.** This was a brand-new canonical domain
  (`service-credential-testing`) — a pure `## ADDED Requirements` delta. Zero MODIFIED and zero
  REMOVED requirements, so no destructive-removal guard was triggered and no destructive-sync parent
  approval was required.
- **Backend / data-contract impact:** none. The `POST /api/services/test` endpoint is
  **side-effect-free** (no persistence, no cache invalidation) and **sanitized** (logs only
  `type` + `ok`, never secrets). It gates on the existing validation path (`_validate_input`) and
  dispatches through the closed `test_callable` registry that mirrors `SERVICE_DEFINITIONS`. Archive
  touched only OpenSpec docs + the folder move.
- **No critical verification issues** remain (CRITICAL issues are non-overridable; the two verify
  CRITICALs were the reconcilable checkbox/apply-progress gap, now resolved; N-2's weak-test gap was
  strengthened and closed).
- **No browser/visual smoke** was performed (out of scope); the panel is covered by Vitest component
  tests only.
- **Memory observation IDs:** none — `artifactStore: openspec`; traceability lives in the filesystem
  archive + canonical spec.

## 9. Move performed

```
git mv openspec/changes/service-credential-tester openspec/changes/archive/2026-07-09-service-credential-tester
```

- **All 9 artifacts confirmed present at the archived path:** `proposal.md`, `spec.md`,
  `specs/service-credential-testing/spec.md` (delta), `design.md`, `tasks.md`, `apply-progress.md`,
  `verify-report.md`, `sync-report.md`, `archive-report.md` (this file).
- **Canonical `openspec/specs/service-credential-testing/spec.md` remains in place** (verified
  untouched after the move — sha256 unchanged). `openspec/specs/web-ui/spec.md`,
  `openspec/specs/prometheus-charting/spec.md`, and `openspec/specs/service-storage/spec.md` also
  untouched.
- Renames were left **staged** (R100 detection preserved) for the parent's explicit-path commit.
  `git restore --staged` was **not** run after the `git mv`.

---

### Appendix — Files written/moved by this archive (OpenSpec only; no source code)

- **Written:** `openspec/changes/service-credential-tester/archive-report.md` (this file) — at the
  active path before the move; travels with the move into the archive.
- **Moved (via `git mv`):** the entire
  `openspec/changes/service-credential-tester/` directory →
  `openspec/changes/archive/2026-07-09-service-credential-tester/`.
- **Left in place (durable canonical):** `openspec/specs/service-credential-testing/spec.md`.
- **Not committed / not pushed** — the parent owns the commit with explicit paths.