cesnimda
40 lines
5.2 KiB
Markdown
40 lines
5.2 KiB
Markdown
# D: administrator processing monitor acceptance
|
|
|
|
28 October 2026. Conditional GO for cumulative development and integration QA. Production remains NO-GO. Source follows history foundation `1f87301ee9a38889c012c4fbe1c53a5b80fb9f6a` on `feature/admin-processing-monitor`; the publication commit containing this report identifies the qualified implementation.
|
|
|
|
## Delivered behaviour
|
|
|
|
The Admin-only Processing page shows actual durable operations, status counts, bounded owner/status/task filters, verified job associations and bounded source-file metadata. Detail shows UTC timestamps, elapsed duration, attempts, sanitized failure codes, a copyable operation GUID and ordered retained events. Worker configuration is explicitly configuration, not a health probe. Workers without individual durable operations are identified; historical events are not fabricated.
|
|
|
|
The existing operation store owns transactional history. Successful state changes and their events commit together; failed event insertion rolls back the transition. Same-stage heartbeats do not create events. Owner filtering, stale-lease checks, CAS recovery and terminal notifications remain intact. Events expire after 30 days, are excluded immediately at read time, are removed in bounded existing retention sweeps and participate in account export/deletion. The foundation checkpoint contains migration/startup/rollback evidence.
|
|
|
|
Read-only APIs require the server Admin role. Ordinary users retain owner-only operation/source access. Projections omit document text, raw result/failure/subject/lease values, paths, prompts, credentials and model information. Joined job/company/source ownership is checked. Names are bounded and filenames strip path/control characters. Event cursors remain decimal strings, including values above JavaScript's safe integer range. Correlation headers accept only an actual execution GUID; the sidecar validates and echoes that GUID after authentication without logging document content.
|
|
|
|
Polling is sequential, aborts on navigation or identity changes, uses a 15-second request timeout and failure backoff, and supports pause/resume, refresh and bounded older-event pages. Forbidden responses clear cached data and stop automatic retries. Errors cannot display arbitrary server content. EN/Bokmål, light/dark, keyboard focus, responsive tables and accessible status messages use existing application owners.
|
|
|
|
## Independent evidence
|
|
|
|
All paths below are relative to `.artifacts/pre-phase10-ux/`. Focused reruns are not added to full-suite totals.
|
|
|
|
| Lane | Result | Evidence |
|
|
| --- | --- | --- |
|
|
| Full .NET backend, final source | 1,424 passed, zero failed/skipped | `d-backend-final/d-backend.trx` |
|
|
| Full frontend | 1,027 passed across 112 suites | `d-frontend-full-01.json` |
|
|
| Focused final API/security/metadata bounds | 21 passed | `d-api-final/d-api-final.trx` |
|
|
| Real MariaDB, including final bounded SQL projections | 89 passed, disposable schema cleanup confirmed | `d-mariadb-04/` |
|
|
| Admin browser authentication/isolation/history/errors/pause, responsive themes/languages and axe | 2 passed | `d-browser-02.json`, `d-browser-02-results/` |
|
|
| Real Docling browser lifecycle plus PDF/DOCX review/apply/profile/editor/PDF | 3 passed | `d-docling-browser-01.json` |
|
|
| Offline sidecar including correlation validation | 81 passed; model loading disabled | `d-sidecar-offline-01.log` |
|
|
| Production frontend build, TypeScript | exit 0 | `d-build-03.log` |
|
|
| Full frontend lint | exit 0 | `d-lint-final-02.log` |
|
|
|
|
The Docling browser run uses real extraction, deterministic interpretation and synthetic documents. Its separate parser container has an internal-only network, bounded resources, read-only source/root and model loading disabled. A bounded fixed-upstream gateway provides host-loopback access; the gateway's own bridge is not an egress firewall. No production model or service was changed. The browser run preceded the final metadata-label clipping change; final API and MariaDB tests cover that change, and cumulative browser qualification remains required.
|
|
|
|
Initial failing checks remain evidence: invalid correlation headers, missing event storage, stale tracked retry, oversized identity labels, duplicate browser alert/region selectors and migration-version expectations were reproduced and corrected without weakening persistence/isolation assertions.
|
|
|
|
## Decisions and remaining qualification
|
|
|
|
History/transaction safety, bounded read-only Admin API, monitor UI, ordinary-user isolation and real deterministic import lifecycle: PASS in the recorded automated scopes. D overall: CONDITIONAL GO for integration QA. Formal security review and the complete cumulative regression/preservation/PDF lanes remain pending at this checkpoint. This does not replace the final acceptance report.
|
|
|
|
Human accessibility, physical devices, language review and manual printing remain open. B's revised large-name PDF coordinate-oracle failures remain unresolved and must be carried forward explicitly. Local synthetic model smoke tests do not qualify extraction accuracy or deployed-production model parity. Existing low-severity development-tool dependency advisories remain separate from production dependency results. No main merge, production deployment or Phase 10 cleanup is authorized by this decision.
|