From 3784593ba96df2adc949fcc6cea5edfdbb974fae Mon Sep 17 00:00:00 2001 From: Dotta Date: Wed, 7 Oct 2026 07:03:13 -0500 Subject: [PATCH] Isolate callback recovery fixtures and record gateway qualification --- doc/plans/2026-10-06-github-app-wizard.md | 14 +++++++++----- .../__tests__/chat-channels.integration.test.ts | 5 +++-- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/doc/plans/2026-10-06-github-app-wizard.md b/doc/plans/2026-10-06-github-app-wizard.md index aaec161787f..f65780409e9 100644 --- a/doc/plans/2026-10-06-github-app-wizard.md +++ b/doc/plans/2026-10-06-github-app-wizard.md @@ -147,11 +147,15 @@ and routing/sleep/wake smoke checks pass. The revised stack passes workspace typecheck and build. Focused tests cover local manifest exchange, interrupted vault storage without repeated exchange, secret rotation without disclosing it to Cloud, original-signature verification, -and nested-envelope binding. A subsequent database run is blocked by the host's -exhausted shared-memory identifiers (`shmget`: No space left on device), including -the disposable Cloud Postgres concurrency qualification. These skipped or blocked -runs do not establish database qualification. The new PR heads require fresh CI -and review. No real provider calls or deployments were used for this revision. +and nested-envelope binding. Initial follow-up database attempts were blocked by +exhausted host shared-memory identifiers (`shmget`: No space left on device). +After slots became available, disposable Cloud Postgres qualification passed all +seven tests, including independent-pool quota races and lease/acknowledgment. +The focused stack cases also execute again; the added recovery case requires all +manifest credentials, including OAuth client credentials, after a partial vault +write. Full-suite local failures remain separately reported rather than treated +as a green run. The current PR heads require fresh CI and review. No real +provider calls or deployments were used for this revision. Before rollout, apply the additive Cloud migration, enable the dedicated-App capability, then deploy the synchronized instance migration and wizard through diff --git a/server/src/__tests__/chat-channels.integration.test.ts b/server/src/__tests__/chat-channels.integration.test.ts index fddd1c557de..41d42ac88d5 100644 --- a/server/src/__tests__/chat-channels.integration.test.ts +++ b/server/src/__tests__/chat-channels.integration.test.ts @@ -2372,6 +2372,7 @@ describeEmbeddedPostgres("chat channel control-plane integration", () => { }); it("wizard retains recovery when a manifest vault write saved App credentials but lost OAuth credentials", async () => { const f = await reviewBotFixture(); + const returnState = randomUUID(); const [connection] = await db .select() .from(toolConnections) @@ -2401,13 +2402,13 @@ describeEmbeddedPostgres("chat channel control-plane integration", () => { companyId: f.companyId, endpointId: f.endpoint.id, userId: "owner-user", - stateHash: createHash("sha256").update("bound").digest("hex"), + stateHash: createHash("sha256").update(returnState).digest("hex"), trustedOrigin: "http://127.0.0.1:3104", status: "failed", expiresAt: new Date(Date.now() + 60000), handoff: { cloudId: "partial-oauth", - returnState: "bound", + returnState, redemptionId: "receipt", manifestClaimId: "claim", },