fix(e2e): make authenticated browser stack reproducible - #1010
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Owner-boundary note: protected-main foundation #899 is the canonical LineageWeave→contextual-orchestrator separation lane and removes the repository-local orchestrator wrapper entirely. This #831-stack repair does not supersede or copy that owner implementation; it only makes the existing historical stack honor its already-documented optional/fail-closed contract. When this serialized report stack later converges with #899 or its accepted successor, #899's external-service boundary wins and the transitional |
Keycloak 26 hostname v2 derives the iss claim from the request host. With a bare KC_HOSTNAME=localhost, the in-network call the seed makes to keycloak:8080 mints iss=http://localhost:8080/... while the backend validates KEYCLOAK_ISSUER=http://localhost:18080/... -- so every seeded post-content warm-up 401s and the authenticated browser gate cannot start. Pin KC_HOSTNAME to the full public URL so one issuer serves browser and in-network callers alike, and lock the invariant with a compose contract test.
The keycloak_issuer comment still described hostname-strict=false reflecting the request Host into the iss claim. Compose now pins KC_HOSTNAME to the public URL, so the issuer no longer varies by caller.
93e1b4f
into
feat/leftover-map-compare-cross-share-v2530
Outcome
This bounded repair is complete and was normally merged into #831.
b013b8b7bc717c543b0d2ca8458c60dcc1f2144eac50985c681bb3184af53803e460ef918d60107634612342413— terminal SUCCESS on the unchanged repair head93e1b4fb5601b5733e9a4b0f7b4a9f63ff44354eCausal repairs retained
The lane repaired the clean-checkout authenticated browser path without provider/model substitution, copied contextual-orchestrator source, timeout inflation, test skipping, or gate weakening:
The exact-head SUCCESS covered the PostgreSQL full suite plus frontend lint/tests, production build, Storybook, Chromium installation, authenticated product startup, synthetic seed, persisted cross-share fixture, desktop/responsive pointer and keyboard/focus checks, locale iteration, and Pixel-7 touch acceptance.
No predecessor receipt transfers to the moved #831 head. Fresh #831 exact-head validation is tracked on merge result
93e1b4fb...before descendant semantic reconstruction.