manage/openspec/changes/service-credential-tester/sync-report.md

# Sync Report — `service-credential-tester`

> Phase: **sync** · Change: `service-credential-tester` · Repo: `/home/user/manage`
> Mode: file-backed (`artifactStore: openspec`). No source-code edits; only OpenSpec artifacts were
> written. Not committed (parent owns the commit). The change folder was **not** moved (that is
> `sdd-archive`'s job).

**Status: SYNCED.** A new canonical domain
`openspec/specs/service-credential-testing/spec.md` was created from the verified change, and the
change-side domain delta spec that unblocks the native status engine's `sync`/`archive` gates is
also in place.

---

## 1. Executive summary

The `service-credential-tester` change shipped a **complete but flat**
`openspec/changes/service-credential-tester/spec.md` (21 requirements, CT-101 … CT-121) with **no**
per-domain delta spec under `openspec/changes/service-credential-tester/specs/<domain>/`. `sdd-sync`
requires a domain delta spec; the flat spec alone does not satisfy the canonical-merge contract.

Verify already returned a **functional PASS** — verdict in `verify-report.md`: all 21 requirements
CT-101 … CT-121 PASS against source, and all five gates are green (backend `pytest` 362 passed,
`ruff` clean, frontend `npm run build`, `npm run lint` 0 errors, `npx vitest run` 158 passed). The
verify report's two CRITICAL items are **archive-only** blockers (B-1 missing `apply-progress.md`,
B-2 unchecked task checkboxes); the parent confirms `apply-progress.md` is now present and
reconciled. These are lifecycle-hygiene items, not verification-integrity blockers, and they do not
block `sdd-sync` of the green code.

This sync **reconciles** the flat-spec-vs-domain-spec gap:

1. Authored the missing **change-side domain delta spec** —
   `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` — using a
   clean `## ADDED Requirements` structure that preserves the exact requirement IDs (CT-101 …
   CT-121) and text from the verified flat `spec.md`. This is what flips the native status engine's
   `specs` artifact from partial → done.
2. **Synced** the end-state into the **canonical store** —
   `openspec/specs/service-credential-testing/spec.md` — the actual sync target. Because the
   canonical `service-credential-testing` domain did not previously exist, the native helper rule
   applies: *when the canonical spec does not exist, the change spec becomes the new canonical
   spec.* The two files therefore carry identical requirement bodies (delta under
   `## ADDED Requirements`; canonical under `## Requirements`).

Domain name **`service-credential-testing`** was chosen (per the dispatch brief) because it scopes
the full new capability: the `POST /api/services/test` endpoint, the closed `test_callable`
dispatch registry, the seven per-type connection-test routines, the no-persistence /
no-secret-logging guarantees, and the frontend test UI. It is distinct from the existing canonical
domains `web-ui` (MUI→shadcn migration), `prometheus-charting` (direct Prometheus metric
visualization), and `service-storage` (per-service data lifecycle layer) — none of which was
**touched**.

## 2. Structured status & actionContext findings

The native `gentle-pi.sdd-status` passed by the parent reports `changeName: null` with
`blockedReasons: ["Change selection is ambiguous: per-instance-hook-scoping,
service-credential-tester."]` because the engine auto-detected more than one active change. This
sync task was **explicitly assigned** `service-credential-tester`; the ambiguity is a
parent-resolution artifact and does not block this phase (`isNonAuthoritative: false`).

- `artifactStore: openspec`; change root `openspec/changes/service-credential-tester/`.
- Artifacts present: `proposal.md`, `spec.md`, `design.md`, `tasks.md`, `apply-progress.md`,
  `verify-report.md`.
- `verify: PASS` (functional verdict; gates green at `f6c67bd`).
- `actionContext`: `mode: repo-local`, `workspaceRoot: /home/user/manage`,
  `allowedEditRoots: ["/home/user/manage"]`, `warnings: []`. All three files written are inside the
  authoritative workspace / allowed edit roots. ✓
- `relationships.sameDomainActiveChanges: []`, `collisions: []` — **no active same-domain
  collisions**, so no archive/sync ordering decision was required.
- The new `service-credential-testing` domain is distinct from the existing `web-ui`,
  `prometheus-charting`, and `service-storage` canonical domains; all three were left untouched
  (verified via `git status --porcelain`).

**Verify verdict nuance (archive-only blockers):** the verify report's verdict is "PASS
(functionally) — every requirement CT-101 … CT-121 is met … ARCHIVE IS BLOCKED on a task-hygiene /
missing-`apply-progress` issue." The two CRITICAL findings (B-1, B-2) are explicitly **archive**
blockers, not verification failures: the code is functionally complete and all gates are green.
`sdd-sync`'s stop conditions target *verification integrity* (unresolved FAIL/BLOCKED/CRITICAL
**verification** blockers), and these are lifecycle-hygiene items. The parent states
`apply-progress.md` is now reconciled. Sync therefore proceeds; the unchecked-tasks item is
forwarded to `sdd-archive` (§7).

**Post-sync structural change:**
`openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` now exists
(`hasDomainSpecs` → true), resolving the missing-domain-spec condition that gated sync. The flat
`spec.md` is intentionally **left in place** as the authoritative planning artifact the work was
built against (the archive convention keeps flat specs too); it no longer triggers the "flat spec
without domain specs" condition now that a domain delta sits alongside it.

## 3. Domains synced & canonical files updated

| Domain | Change-side delta (source) | Canonical (sync target) | Action |
|---|---|---|---|
| `service-credential-testing` | `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` | `openspec/specs/service-credential-testing/spec.md` | **NEW domain** — `## ADDED Requirements` copied into canonical as a new spec |

- **Canonical file created:** `openspec/specs/service-credential-testing/spec.md` (21 requirements).
- **Change-side delta created:**
  `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md`
  (21 requirements, all `## ADDED Requirements`).

## 4. Requirement delta (ADDED / MODIFIED / REMOVED)

- **ADDED (21)** — all to the new `service-credential-testing` domain (canonical did not exist
  pre-change). IDs and text preserved verbatim from the verified flat `spec.md`. Grouped logically:
  - *Endpoint shape, validation, dispatch* — CT-101, CT-102, CT-103
  - *Per-type test routines* — CT-104, CT-105, CT-106, CT-107, CT-108, CT-109, CT-110, CT-111
  - *No-persistence + security* — CT-112, CT-113
  - *Frontend test UI* — CT-114, CT-115, CT-116, CT-117, CT-118
  - *Tests + gate greenness* — CT-119, CT-120, CT-121
- **MODIFIED (0)** — none (new domain; no pre-existing canonical requirements to replace).
- **REMOVED (0)** — none.
- **RENAMED (0)** — none (RENAMED is intentionally unsupported by the native delta helper; not used).

## 5. Guardrails, approvals & destructive-sync assessment

- **Same-domain collisions:** none (`sameDomainActiveChanges: []`, `collisions: []`). The new
  `service-credential-testing` domain does not overlap the existing `web-ui`,
  `prometheus-charting`, or `service-storage` canonical domains. No ordering decision was needed.
- **Destructive sync:** **not applicable.** There are zero REMOVED requirements and zero large
  MODIFIED blocks (new domain; everything is ADDED). No destructive-sync parent approval was
  required beyond the explicit reconciliation instruction in the task.
- **Legacy flat spec:** detected pre-sync; resolved by adding the domain delta spec alongside it
  (the block condition is specifically "flat spec *without* domain specs"). The flat spec was left
  in place as a planning artifact.
- **`web-ui` / `prometheus-charting` / `service-storage` canonical isolation:** the existing
  `openspec/specs/web-ui/spec.md`, `openspec/specs/prometheus-charting/spec.md`, and
  `openspec/specs/service-storage/spec.md` were **not modified** — verified untouched by
  `git status --porcelain openspec/specs/web-ui openspec/specs/prometheus-charting
  openspec/specs/service-storage` (empty). The four domains are independent.

## 6. Validation / checks performed (file-backed, read-only)

Run from `/home/user/manage` (no source edits, no test re-runs — those are owned by verify and were
already green at `f6c67bd`):

| Check | Command | Result |
|---|---|---|
| Canonical store populated | `ls openspec/specs/service-credential-testing/spec.md` | present ✓ |
| Change-side domain spec present | `ls openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` | present ✓ |
| Requirement-ID parity (flat ↔ delta ↔ canonical) | `grep -oE 'CT-[0-9]+' … \| sort -u \| wc -l` | **21 == 21 == 21**, identical IDs CT-101…CT-121 ✓ |
| ID-set parity (flat ↔ canonical) | `diff <(…flat…) <(…canonical…)` | **PARITY OK** — identical ID sets ✓ |
| Body-text parity (delta ↔ canonical) | `### Requirement:` regions compared | identical prose ✓ |
| Delta is pure ADDED | count `## ADDED/MODIFIED/REMOVED Requirements` | ADDED=1, MODIFIED=0, REMOVED=0 ✓ (no destructive sync) |
| Other canonicals untouched | `git status --porcelain openspec/specs/web-ui openspec/specs/prometheus-charting openspec/specs/service-storage` | empty (not modified) ✓ |
| Flat spec left in place | `ls openspec/changes/service-credential-tester/spec.md` | present (not moved/deleted) ✓ |
| No edits outside openspec | `git status --porcelain` (filtered) | only `openspec/specs/service-credential-testing/`, `openspec/changes/service-credential-tester/specs/`, and this report added ✓ |
| Markdown validity | write-time lint | all three files "Markdown clean" ✓ |

## 7. Carry-over items for the archive summary

These verify-phase findings are non-blocking for sync and should land in the archive summary:

1. **[CRITICAL-process, archive-only] Unchecked task checkboxes.** At verify time, all 29 tasks in
   `tasks.md` were unchecked (`- [ ]`) and `apply-progress.md` was missing (verify findings B-1/B-2).
   The parent states `apply-progress.md` is now present and reconciled. `sdd-archive` should re-scan
   the native status engine to confirm `tasks: done` / `applyProgress: present` and tick any
   remaining unchecked boxes before moving the change to archive.
2. **[INFO] Stale-proposal correction carried into the spec.** The flat spec documents that
   `jellyseerr` is no longer a distinct service type (merged into Jellyfin config by
   `services-as-hub-ia`); the 7 remote types + `backups` are the active coverage. No `jellyseerr`
   requirement exists.
3. **[INFO] `prometheus` routes through the Grafana gateway.** CT-105's canonical text (verbatim
   from the flat spec) references `grafana-metric-gateway`. This is a pre-existing design assumption
   recorded faithfully; it does not affect sync.
4. **[INFO] List-marker normalization.** The flat source uses `-` bullets; the linter normalized
   list markers in the delta/canonical files (cosmetic only — requirement prose is verbatim and the
   delta helper matches by `### Requirement:` blocks, not marker style).

## 8. Next recommended phase

→ **`sdd-archive`** (clean). Confirm the native status re-scan reports `specs: done` / `sync: ready`
/ `archive: ready`, then move the change to
`openspec/changes/archive/2026-07-09-service-credential-tester`, carrying over the items in §7 into
the archive summary. Do **not** commit or push — the parent owns the commit with explicit paths.

---

### Appendix — Files written by this sync (OpenSpec only; no source code)

- `openspec/changes/service-credential-tester/specs/service-credential-testing/spec.md` —
  **change-side domain delta (`## ADDED Requirements`), 21 requirements CT-101…CT-121.**
- `openspec/specs/service-credential-testing/spec.md` — **canonical spec (new domain), 21
  requirements.**
- `openspec/changes/service-credential-tester/sync-report.md` — this report.