kite/.planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-04-SUMMARY.md

phase, plan, subsystem, status, tags, dependency_graph, tech_stack, key_files, decisions, metrics

phase	plan	subsystem	status	tags	dependency_graph	tech_stack	key_files	decisions	metrics
12.1	04	cloud-browse-live-verification	complete	live-test nextcloud security-gates documentation phase-close	requires provides affects 12.1-01 12.1-02 12.1-03 owner-confirmed-nextcloud-fixture live-smoke-exact-acceptance rendered-flow-integration-tests phase-12.1-close backend/tests/test_nextcloud_live.py backend/tests/fixtures/cloud/nextcloud_expected_root.json frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js SECURITY.md README.md RUNBOOK.md CLAUDE.md backend/main.py frontend/package.json	added patterns opt-in pytest marker (live_nextcloud) excluded from ordinary CI owner_confirmed flag in fixture guards exact-acceptance gate (T-12.1-19) rendered-flow test mounts real StorageBrowser and BreadcrumbBar with only API/router stubbed	created modified backend/tests/fixtures/cloud/nextcloud_expected_root.json frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js backend/tests/test_nextcloud_live.py .planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-VALIDATION.md SECURITY.md README.md RUNBOOK.md CLAUDE.md backend/main.py frontend/package.json	owner_confirmed: true in fixture is the gate for exact-name acceptance — no inferred confirmation from live output Rendered-flow test mounts real StorageBrowser/BreadcrumbBar; only API/router stubbed (not UI components) Unexpected live provider names withheld from all artifacts, logs, and responses (T-12.1-20) Phase 13 mutations and Phase 14 byte cache are explicit exclusions from Phase 12.1 scope	duration completed_date tasks_total tasks_completed files_created files_modified commits tests_added ~15 minutes (Tasks 2-4, continuation after Task 1 checkpoint) 2026-06-22 4 4 2 8 4 8

Phase 12.1 Plan 04: Live Smoke, Exact Acceptance, and Phase Close Summary

Owner-confirmed Nextcloud root manifest fixture created, exact-acceptance test enabled, rendered-flow integration tests added, and Phase 12.1 closed with full validation, security, documentation, versioning, and push protocol.

What Was Built

Task 1 (prior session, commit 779b050)

Opt-in read-only live Nextcloud smoke test suite (backend/tests/test_nextcloud_live.py) with live_nextcloud marker excluded from ordinary CI via pytest.ini. Three tests: adapter metadata, sanitized root diagnostic, and connection-ID end-to-end browse as designated user.

Task 2 (commit 1ec5158)

Owner reconciled the 3 previously unmatched fixture names. Created backend/tests/fixtures/cloud/nextcloud_expected_root.json with owner_confirmed: true — 10 items (4 folders, 6 files) with confirmed names and kinds. Added test_nextcloud_expected_root_manifest test enforcing exact set equality and exact kind equality against the fixture (T-12.1-19 gate).

Task 3 (commit 6d294ea)

Added CloudFolderRenderedFlow.test.js — 7 integration tests mounting the real CloudFolderView with the real StorageBrowser and BreadcrumbBar (only API/router stubbed). Covers: mixed root render, opaque-reference folder navigation, breadcrumb lineage back-navigation, warning freshness with cached rows visible, fresh state, and XSS prevention. All security and regression gates ran and passed.

Task 4 (commit 46b7ea6)

Version bumped 0.2.5 → 0.2.6 in backend/main.py and frontend/package.json. Docs updated: CLAUDE.md current state, README.md Phase 12.1 corrections and live smoke variables, RUNBOOK.md live smoke invocation and warning semantics table, SECURITY.md Phase 12.1 Plan 04 threat table and gate evidence. All gates re-verified. Atomic commit and push complete.

Deviations from Plan

None — plan executed exactly as written after the checkpoint resolution.

The package-lock.json version update was skipped because the file is gitignored in this project (confirmed by git add rejecting it with .gitignore hint). Both tracked files (backend/main.py, frontend/package.json) were bumped.

Security Evidence

Gate	Result
Bandit HIGH findings	0 (10 LOW, all pre-existing)
npm audit high/critical	0 vulnerabilities
Gitleaks new findings	0 in Phase 12.1 files (3 pre-existing in May 2026 commits)
Git tracked .env files	None (only .env.example)
Docker Compose config	Resolves all required variables cleanly
Credentials in output	None — _assert_no_secrets_in_string asserts on every live test
Provider mutation/download	None — method guard + adapter method absence assertion
Admin/foreign-user IDOR	Blocked — 403/404 confirmed by live test

Test Results

Suite	Result
Backend focused cloud tests	236 pass
Backend full suite	595 pass (1 pre-existing failure: test_extract_docx, unrelated)
Frontend full suite	376 pass (7 new from CloudFolderRenderedFlow.test.js)
Frontend build	Clean
Live smoke (opt-in)	Skipped in CI — requires NEXTCLOUD_URL/USER/APP_PASSWORD

Threat Coverage

All Phase 12.1 Plan 04 threats closed:

Threat ID	Threat	Status
T-12.1-16	Credentials/URL leak through pytest	CLOSED
T-12.1-17	Live smoke mutates/downloads data	CLOSED
T-12.1-18	Live connection crosses user/admin boundary	CLOSED
T-12.1-19	Count-only test accepts wrong root	CLOSED
T-12.1-20	Unexpected provider names persisted	CLOSED
T-12.1-SC	Supply-chain / committed-secret regression	CLOSED

Phase 12.1 Phase Close

All four plans of Phase 12.1 are complete:

Plan	Description	Commit(s)
12.1-01	Restore shared adapter contract	Prior commits
12.1-02	Truthful freshness gate	Prior commits
12.1-03	Normalized cloud browser contract	7bb046a, dc3e172
12.1-04	Live smoke, exact acceptance, phase close	779b050, 1ec5158, 6d294ea, 46b7ea6

Phase 12.1 objectives achieved:

• Nextcloud root listing visible through DocuVault
• Owner-confirmed exact manifest in tracked fixture
• All four providers pass one contract suite
• complete=False cannot produce fresh or advance last_refreshed_at
• Frontend normalized to kind and provider_item_id
• Credentials and provider data remain private
• Phase 13 mutations and Phase 14 byte caching are explicit exclusions

Known Stubs

None — all live test fixtures use confirmed names. No placeholder text or empty data flows to UI rendering.

Threat Flags

None — no new network endpoints, auth paths, or schema changes introduced in Plan 04.

Self-Check: PASSED

Files created:

• backend/tests/fixtures/cloud/nextcloud_expected_root.json — exists
• frontend/src/views/__tests__/CloudFolderRenderedFlow.test.js — exists

Commits:

• 1ec5158 — owner-confirmed expected root manifest
• 6d294ea — rendered-flow integration tests and security gate evidence
• 46b7ea6 — verify live cloud browse integration (docs/version/push)
• 779b050 — prior session Task 1 live smoke scaffold