Close iteration 013 release confidence operator journey repairs

docs/implplan/SPRINT_20260314_003_Platform_scratch_iteration_013_full_route_action_audit.md

@@ -0,0 +1,83 @@
+# Sprint 20260314_003 - Platform Scratch Iteration 013 Release Confidence Operator Journey Audit
+
+## Topic & Scope
+- Use Stella Ops as an end-user release operator who is trying to decide whether a release can be promoted with confidence.
+- Drive the product through real operator journeys first: release overview, deployment evidence, findings and VEX review, reachability and exposure review, approval or rejection, promotion, and hotfix follow-through.
+- Treat automated wipe/setup and retained Playwright sweeps as guardrails, not the purpose of the iteration; every newly discovered manual gap must become retained Playwright coverage afterward.
+- Group any fresh failures by root cause before implementing fixes so the commit closes a full release-confidence iteration rather than isolated page patches.
+- Working directory: `.`.
+- Expected evidence: journey notes, Playwright artifacts for the operator flows, retained scenario updates for newly discovered steps, grouped defect analysis, focused tests, and rebuilt-stack retest results.
+
+## Dependencies & Concurrency
+- Depends on local commit `ac817a059` as the closed baseline from scratch iteration 012.
+- Safe parallelism: none during wipe/setup because the environment reset is global to the machine.
+
+## Documentation Prerequisites
+- `AGENTS.md`
+- `docs/INSTALL_GUIDE.md`
+- `docs/dev/DEV_ENVIRONMENT_SETUP.md`
+- `docs/qa/feature-checks/FLOW.md`
+
+## Delivery Tracker
+
+### PLATFORM-SCRATCH-ITER13-001 - Define and run release-confidence operator journeys
+Status: DONE
+Dependency: none
+Owners: QA, Product Manager
+Task description:
+- Act as an operator using Stella Ops to decide whether a release is safe to promote. The baseline journey must cover: release overview, release/deployment detail, security posture, triage, advisories/VEX, reachability, evidence threads/capsules/proofs, approvals/promotions, and hotfix handling.
+
+Completion criteria:
+- [x] The primary operator journeys are explicitly listed before fixes begin.
+- [x] Playwright is used to execute those journeys as a user would, not only as route sweeps.
+- [x] Every broken route, page-load, data-load, or action encountered on the operator path is recorded before any fix starts.
+
+### PLATFORM-SCRATCH-ITER13-002 - Convert newly discovered manual steps into retained coverage
+Status: DONE
+Dependency: PLATFORM-SCRATCH-ITER13-001
+Owners: QA, Test Automation
+Task description:
+- After the operator journey exposes gaps, add or deepen retained Playwright so the exact end-user steps become part of future iterations instead of being rediscovered manually.
+
+Completion criteria:
+- [x] Every newly discovered operator step is mapped to retained Playwright coverage or an explicit backlog gap.
+- [x] Retained coverage additions are scoped by user journey, not just by route.
+- [x] The next aggregate run would exercise the newly discovered operator path automatically.
+
+### PLATFORM-SCRATCH-ITER13-003 - Repair grouped release-confidence defects and retest
+Status: DONE
+Dependency: PLATFORM-SCRATCH-ITER13-002
+Owners: 3rd line support, Architect, Developer
+Task description:
+- Diagnose the grouped failures exposed by the operator journey, choose the clean product/architecture-conformant fix, implement it, add retained Playwright coverage for the new behavior when needed, and rerun the affected journeys plus the aggregate audit before committing.
+
+Completion criteria:
+- [x] Root causes are recorded for the grouped failures.
+- [x] Fixes land with focused regression coverage and retained Playwright scenario updates where practical.
+- [x] The rebuilt stack is retested through the same operator journeys before the iteration commit.
+
+## Execution Log
+| Date (UTC) | Update | Owner |
+| --- | --- | --- |
+| 2026-03-14 | Sprint created immediately after local commit `ac817a059` closed scratch iteration 012 cleanly at `24/24` suites and `111/111` routes. | QA |
+| 2026-03-14 | Iteration reframed from aggregate-only scratch QA to release-confidence operator journeys after the explicit requirement to use Stella Ops as an end user deciding whether a release is safe. | QA / Product Manager |
+| 2026-03-14 | Added a retained Playwright operator journey in `src/Web/StellaOps.Web/scripts/live-release-confidence-journey.mjs` that walks release overview, deployment evidence and replay, decision capsules, security posture to triage, advisories/VEX, reachability, security reports, promotion submission, and hotfix creation as a release operator would. The first live run exposed four real failures before any fixes started: releases overview -> deployments dropped ambient scope, security posture -> triage dropped ambient scope, advisories/VEX tabs dropped ambient scope, and reachability tab navigation dropped ambient scope. | QA |
+| 2026-03-14 | Diagnosed the grouped root cause as inconsistent context-scope propagation between declarative router links and programmatic tab navigation. The clean fix was to centralize scope query handling in `context-route-state.ts`, add `queryParamsHandling=\"merge\"` to the affected release and security links, and teach reachability tab navigation to merge ambient scope instead of rebuilding query params from only local state. | 3rd line support / Architect |
+| 2026-03-14 | Converted the new operator steps into retained coverage by wiring the release-confidence journey into `live-full-core-audit.mjs`, adding focused Angular regressions for release overview and reachability scope preservation, and modernizing the Angular feature-spec harness (`src/test-setup.ts`, `tsconfig.spec.features.json`, and `src/app/types/node-test-setup-shim.d.ts`) so the retained specs run under the current Vitest-based setup. | QA / Test Automation / Developer |
+| 2026-03-14 | Focused verification passed: `npx ng test --watch=false --progress=false --ts-config tsconfig.spec.features.json --include=src/app/features/releases/release-ops-overview-page.component.spec.ts --include=src/app/features/reachability/reachability-center.component.spec.ts` returned `5/5`, `npm run build` passed, the rebuilt browser dist was synced into `compose_console-dist`, `stellaops-router-gateway` was restarted healthy, and `node ./scripts/live-release-confidence-journey.mjs` reran clean with `failedStepCount=0` and `runtimeIssueCount=0`. | QA / Developer |
+| 2026-03-14 | The first post-fix aggregate run surfaced two retained-coverage defects, not product regressions: `live-watchlist-action-sweep.mjs` was asserting the trust watchlist route before the shell finished hydrating on direct entry, and `live-uncovered-surface-action-sweep.mjs` still matched exact query strings after ambient scope preservation intentionally added extra query keys. Both harnesses were corrected to wait for real ready-state and to validate required path/query subsets instead of brittle full-URL substrings. | QA / 3rd line support |
+| 2026-03-14 | A second aggregate run exposed one more retained journey defect on the deployment-detail step of `live-release-confidence-journey.mjs`: the detail page was healthy on direct load, but the journey asserted the heading before the deployment shell was fully ready under aggregate load. The journey now waits for deployment detail readiness (`DEP-2026-050`, plan hash, evidence/replay controls) before asserting or branching into evidence and replay. | QA / 3rd line support / Developer |
+| 2026-03-15 | Final full-stack rerun closed clean after the retained fixes: `node ./scripts/live-full-core-audit.mjs` finished `25/25` suites passed, `0` failed, `0` retried, `0` stabilized-after-retry; the release-confidence journey, admin/trust checks, integrations fixture onboarding, topology actions, watchlist CRUD, uncovered-surface actions, and search-result actions all passed on the same live stack. | QA |
+
+## Decisions & Risks
+- Decision: route sweeps and retained aggregate audits remain necessary, but they are regression guardrails. The source of truth for this iteration is the end-user release-confidence workflow.
+- Decision: any newly discovered manual operator step must become retained Playwright coverage before iteration 013 may close.
+- Risk: some currently green surfaces may still be shallow if they have not been exercised through a real operator journey; those gaps must be surfaced explicitly instead of hidden behind aggregate passes.
+- Decision: the grouped defect family for this iteration is "ambient scope preservation across release-confidence handoffs"; fixing it at the shared routing/state layer is preferable to page-by-page patches because the operator journey crosses releases, security posture, VEX, and reachability in one flow.
+- Decision: the retained reachability scope regression belongs in `reachability-center.component.spec.ts`, not a duplicate one-off spec, so the revived component keeps one canonical focused coverage file.
+- Decision: retained Playwright checks that validate navigations must compare path plus required query-param subsets, not brittle full URL strings, because operator scope propagation is intentionally additive across the shell.
+- Decision: direct-entry trust/watchlist and deployment-detail journeys require explicit ready-state waits in retained coverage; asserting too early creates false negatives that mask the real product state.
+
+## Next Checkpoints
+- Start the next operator-first iteration from fresh Stella state and widen retained behavior coverage for surfaces that are still mostly route-verified rather than journey-verified.
+- Keep adding dedicated user journeys for remaining setup/admin and integration-management surfaces as they are exercised manually.