Implement test run

openframe-api-lib/src/main/java/com/openframe/api/dto/rmm/schedule/ScriptScheduleResponse.java

@@ -54,4 +54,5 @@ public class ScriptScheduleResponse {
     private Instant statusChangedAt;
     private Instant createdAt;
     private Instant updatedAt;
+    private boolean testScript;
 }

openframe-api-lib/src/main/java/com/openframe/api/dto/rmm/script/ScriptResponse.java

@@ -36,4 +36,5 @@ public class ScriptResponse {
     private Instant statusChangedAt;
     private Instant createdAt;
     private Instant updatedAt;
+    private boolean testScript;
 }

openframe-api-lib/src/main/java/com/openframe/api/mapper/ScriptMapper.java

@@ -8,21 +8,17 @@
 import com.openframe.data.document.rmm.script.Script;
 import com.openframe.data.document.rmm.script.ScriptEnvVar;
 import com.openframe.data.document.rmm.script.ScriptStatus;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
 import java.util.List;
 
-/**
- * Pure entity ↔ DTO mapping for scripts. Lives in {@code openframe-api-lib}
- * so it can be reused by any service that talks to the script repository,
- * regardless of transport (GraphQL / REST / messaging).
- *
- * <p>GraphQL-specific concerns (cursor pagination, Relay Connection / Edge
- * envelope) live in {@code GraphQLScriptMapper} alongside the DGS resolver.
- */
 @Component
 public class ScriptMapper {
 
+    @Value("${openframe.rmm.test-mode.enabled}")
+    private boolean testModeEnabled;
+
     public Script toEntity(String tenantId, CreateScriptInput input) {
         return Script.builder()
                 .tenantId(tenantId)
@@ -35,6 +31,7 @@
                 .defaultTimeoutSeconds(input.getDefaultTimeoutSeconds())
                 .defaultArgs(input.getDefaultArgs())
                 .envVars(ScriptEnvVarMapper.toEntity(input.getEnvVars()))
+                .testScript(testModeEnabled)
                 .build();
     }
 
@@ -50,25 +47,26 @@
         existing.setEnvVars(ScriptEnvVarMapper.toEntity(input.getEnvVars()));
     }
 
     public ScriptResponse toResponse(Script entity) {
         return ScriptResponse.builder()
                 .id(entity.getId())
                 .name(entity.getName())
                 .description(entity.getDescription())
                 .shell(entity.getShell())
                 .privilegeLevel(entity.getPrivilegeLevel() != null ? entity.getPrivilegeLevel() : PrivilegeLevel.USER)
                 .scriptBody(entity.getScriptBody())
                 .supportedPlatforms(entity.getSupportedPlatforms())
                 .defaultTimeoutSeconds(entity.getDefaultTimeoutSeconds())
                 .defaultArgs(entity.getDefaultArgs())
                 .envVars(mapEnvVarsToResponse(entity.getEnvVars()))
                 .createdBy(entity.getCreatedBy())
                 .status(entity.getStatus() != null ? entity.getStatus() : ScriptStatus.ACTIVE)
                 .statusChangedAt(entity.getStatusChangedAt())
                 .createdAt(entity.getCreatedAt())
                 .updatedAt(entity.getUpdatedAt())
+                .testScript(entity.isTestScript())
                 .build();
     }
 
     private List<ScriptEnvVarInput> mapEnvVarsToResponse(List<ScriptEnvVar> envVars) {
         if (envVars == null) {

openframe-api-lib/src/main/java/com/openframe/api/mapper/ScriptScheduleMapper.java

@@ -11,6 +11,7 @@
 import com.openframe.data.document.rmm.schedule.ScheduleScriptTrigger;
 import com.openframe.data.document.rmm.schedule.ScheduleTimeReference;
 import com.openframe.data.document.rmm.script.ScriptStatus;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
 import java.util.List;
@@ -23,6 +24,9 @@
 @Component
 public class ScriptScheduleMapper {
 
+    @Value("${openframe.rmm.test-mode.enabled}")
+    private boolean testModeEnabled;
+
     public ScheduleScript toEntity(String tenantId, CreateScriptScheduleInput input) {
         return ScheduleScript.builder()
                 .tenantId(tenantId)
@@ -37,6 +41,7 @@
                 .reconnectWindowSeconds(input.getReconnectWindowSeconds())
                 .startAt(input.getStartAt())
                 .repeat(input.getRepeat())
+                .testScript(testModeEnabled)
                 .build();
     }
 
@@ -71,31 +76,32 @@
         return mode != null ? mode : ScheduleDeviceSelectionMode.SPECIFIC;
     }
 
     public ScriptScheduleResponse toResponse(ScheduleScript entity) {
         return ScriptScheduleResponse.builder()
                 .id(entity.getId())
                 .name(entity.getName())
                 .description(entity.getDescription())
                 .supportedPlatforms(entity.getSupportedPlatforms())
                 .scriptIds(entity.getScriptIds())
                 .scriptCustomParams(entity.getScriptCustomParams())
                 .selectionMode(defaultSelectionMode(entity.getSelectionMode()))
                 .deviceCriteria(entity.getDeviceCriteria())
                 .trigger(defaultTrigger(entity.getTrigger()))
                 .timeReference(defaultTimeReference(entity.getTimeReference()))
                 .offlineBehavior(defaultOfflineBehavior(entity.getOfflineBehavior()))
                 .reconnectWindowSeconds(entity.getReconnectWindowSeconds())
                 .startAt(entity.getStartAt())
                 .repeat(entity.getRepeat())
                 .nextRunAt(entity.getNextRunAt())
                 .lastRunAt(entity.getLastRunAt())
                 .createdBy(entity.getCreatedBy())
                 .status(entity.getStatus() != null ? entity.getStatus() : ScriptStatus.ACTIVE)
                 .statusChangedAt(entity.getStatusChangedAt())
                 .createdAt(entity.getCreatedAt())
                 .updatedAt(entity.getUpdatedAt())
+                .testScript(entity.isTestScript())
                 .build();
     }
 
     private static List<ScheduledScriptCustomParams> toCustomParams(List<ScheduledScriptCustomParamsInput> input) {
         if (input == null) {

openframe-api-lib/src/main/java/com/openframe/api/service/rmm/command/CommandDispatchService.java

@@ -10,6 +10,7 @@
 import com.openframe.data.nats.rmm.publisher.CommandNatsPublisher;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.stereotype.Service;
 
@@ -37,6 +38,9 @@
     private final DeviceService deviceService;
     private final CommandExecutionService commandExecutionService;
 
+    @Value("${openframe.rmm.test-mode.enabled}")
+    private boolean testModeEnabled;
+
     public DispatchResponse runCommand(RunCommandInput input) {
         deviceService.verifyDispatchable(input.getMachineId());
 
@@ -76,7 +80,8 @@
         // Persist one RUNNING row per machine (tenant-scoped, via the service) before
         // anything hits the wire — the agent's result transitions each row later.
         commandExecutionService.createBatch(executionId, input.getCommand(), input.getShell(),
-                machineIds, input.getPrivilegeLevel(), input.getTimeoutSeconds(), initiatedBy);
+                machineIds, input.getPrivilegeLevel(), input.getTimeoutSeconds(), initiatedBy,
+                testModeEnabled);
 
         // Fan out the same payload (one executionId) to every machine.
         CommandMessage message = CommandMessage.builder()

openframe-api-lib/src/main/java/com/openframe/api/service/rmm/command/CommandExecutionService.java

@@ -32,17 +32,18 @@
      * shared {@code executionId} — backs batch command dispatch. Unique constraint is
      * {@code (tenantId, executionId, machineId)}.
      */
     public List<CommandExecution> createBatch(String executionId,
                                               String command,
                                               ScriptShell shell,
                                               List<String> machineIds,
                                               PrivilegeLevel privilegeLevel,
                                               Integer timeoutSeconds,
-                                              String initiatedBy) {
+                                              String initiatedBy,
+                                              boolean testCommand) {
         Instant now = Instant.now();
         List<CommandExecution> rows = machineIds.stream()
                 .map(machineId -> buildRunningRow(executionId, command, shell, machineId,
-                        privilegeLevel, timeoutSeconds, initiatedBy, now))
+                        privilegeLevel, timeoutSeconds, initiatedBy, now, testCommand))
                 .toList();
         List<CommandExecution> saved = commandExecutionRepository.saveAll(rows);
         log.info("Persisted batch command execution rows: executionId={} machineCount={} initiatedBy={} status=RUNNING",
@@ -72,7 +73,8 @@
                                              PrivilegeLevel privilegeLevel,
                                              Integer timeoutSeconds,
                                              String initiatedBy,
-                                             Instant now) {
+                                             Instant now,
+                                             boolean testCommand) {
         return CommandExecution.builder()
                 .tenantId(tenantIdProvider.getTenantId())
                 .executionId(executionId)
@@ -85,6 +87,7 @@
                 .status(ExecutionStatus.RUNNING)
                 .dispatchedAt(now)
                 .statusChangedAt(now)
+                .testCommand(testCommand)
                 .build();
     }
 }

openframe-api-lib/src/main/java/com/openframe/api/service/rmm/script/ScriptDispatchService.java

@@ -27,6 +27,7 @@
 import com.openframe.data.service.TenantIdProvider;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.stereotype.Service;
 
@@ -64,6 +65,8 @@ public class ScriptDispatchService {
     private final ScheduleScriptExecutionRepository scheduleScriptExecutionRepository;
     private final TenantIdProvider tenantIdProvider;
     private final ScriptTimeoutValidator timeoutValidator;
+    @Value("${openframe.rmm.test-mode.enabled}")
+    private boolean testModeEnabled;
 
     public DispatchResponse runScript(RunScriptInput input, String initiatedBy, ExecutionSource source) {
         timeoutValidator.validate(input.getTimeoutSeconds());
@@ -77,7 +80,8 @@ public DispatchResponse runScript(RunScriptInput input, String initiatedBy, Exec
         // Persist the effective timeout on the row so the watchdog can derive a
         // per-execution stuck-threshold from it.
         scriptExecutionService.create(executionId, script.getId(),
-                input.getMachineId(), input.getPrivilegeLevel(), timeoutSeconds, initiatedBy, source);
+                input.getMachineId(), input.getPrivilegeLevel(), timeoutSeconds, initiatedBy, source,
+                testModeEnabled);
 
         ScriptMessage message = ScriptMessage.builder()
                 .executionId(executionId)
@@ -185,6 +189,7 @@ public DispatchResponse runSchedule(String scheduleId, String initiatedBy) {
                 .status(ExecutionStatus.RUNNING)
                 .totalMachineCount(machineIds.size())
                 .dispatchedAt(now)
+                .testScript(testModeEnabled)
                 .build());
 
         // 2. Leaves: N × M ScriptExecution rows (persist per-script batch), so the watchdog
@@ -196,7 +201,7 @@ public DispatchResponse runSchedule(String scheduleId, String initiatedBy) {
             scriptExecutionService.createBatch(executionId, script.getId(), scheduleId, machineIds,
                     script.getPrivilegeLevel(),
                     effectiveTimeout(null, script.getDefaultTimeoutSeconds()),
-                    initiatedBy, ExecutionSource.SCHEDULED);
+                    initiatedBy, ExecutionSource.SCHEDULED, testModeEnabled);
         }
 
         // 3. Build the batched agent payload once — shared across every target machine. Per-script
@@ -245,7 +250,8 @@ private DispatchResponse dispatchBatch(String executionId, ScriptResponse script
 
         // Persist the effective timeout per row so the watchdog can derive a
         // per-execution stuck-threshold from it.
-        scriptExecutionService.createBatch(executionId, script.getId(), null, machineIds, privilegeLevel, timeoutSeconds, initiatedBy, source);
+        scriptExecutionService.createBatch(executionId, script.getId(), null, machineIds, privilegeLevel,
+                timeoutSeconds, initiatedBy, source, testModeEnabled);
 
         List<String> args = ScriptArgsTokenizer.tokenize(argsOverride != null ? argsOverride : script.getDefaultArgs());
         List<ScriptEnvVar> envVars = mergeEnvVars(script.getEnvVars(), envVarsOverride);

openframe-api-lib/src/main/java/com/openframe/api/service/rmm/script/ScriptExecutionService.java

@@ -63,13 +63,14 @@
      * later rename of the source {@code Script} is reflected in History without
      * duplicating the name onto every row.
      */
     public ScriptExecutionResponse create(String executionId,
                                           String scriptId,
                                           String machineId,
                                           PrivilegeLevel privilegeLevel,
                                           Integer timeoutSeconds,
                                           String initiatedBy,
-                                          ExecutionSource source) {
+                                          ExecutionSource source,
+                                          boolean testScript) {
         // Single ad-hoc run (runScript) never originates from a schedule → scheduleId null.
         List<ScriptExecution> saved = scriptExecutionRepository.saveRunning(RunningExecutionRows.builder()
                 .tenantId(tenantIdProvider.getTenantId())
@@ -80,6 +81,7 @@
                 .timeoutSeconds(timeoutSeconds)
                 .initiatedBy(initiatedBy)
                 .source(source)
+                .testScript(testScript)
                 .build());
         log.info("Persisted execution row: executionId={} scriptId={} machineId={} initiatedBy={} source={} status=RUNNING",
                 executionId, scriptId, machineId, initiatedBy, source);
@@ -101,7 +103,8 @@
                                                      PrivilegeLevel privilegeLevel,
                                                      Integer timeoutSeconds,
                                                      String initiatedBy,
-                                                     ExecutionSource source) {
+                                                     ExecutionSource source,
+                                                     boolean testScript) {
         List<ScriptExecution> saved = scriptExecutionRepository.saveRunning(RunningExecutionRows.builder()
                 .tenantId(tenantIdProvider.getTenantId())
                 .executionId(executionId)
@@ -112,6 +115,7 @@
                 .timeoutSeconds(timeoutSeconds)
                 .initiatedBy(initiatedBy)
                 .source(source)
+                .testScript(testScript)
                 .build());
         log.info("Persisted batch execution rows: executionId={} scriptId={} scheduleId={} machineCount={} initiatedBy={} source={} status=RUNNING",
                 executionId, scriptId, scheduleId, machineIds.size(), initiatedBy, source);
@@ -149,10 +153,11 @@
                 .timeoutSeconds(timeoutSeconds)
                 .initiatedBy(initiatedBy)
                 .source(source)
                 .packageManager(packageManager)
                 .packageName(packageName)
                 .softwareAction(softwareAction)
+                .testScript(false)
                 .build());
         log.info("Persisted software batch rows: executionId={} scriptId={} packageManager={} packageName={} action={} machineCount={} initiatedBy={} source={} status=RUNNING",
                 executionId, scriptId, packageManager, packageName, softwareAction, machineIds.size(), initiatedBy, source);
         return saved.stream().map(scriptExecutionMapper::toResponse).toList();

openframe-api-service-core/src/main/resources/schema/script-schedule.graphqls

@@ -152,6 +152,9 @@ type ScriptSchedule implements Node {
     updatedAt: Instant
     """The creating user (resolved from the internal createdBy id via the user DataLoader)."""
     author: User
+    """When true, this is a monitoring / QA fixture. Dispatch still runs, user-facing reads hide it.
+    Immutable at create-time."""
+    testScript: Boolean!
 }
 
 enum ScriptScheduleTrigger {

openframe-api-service-core/src/main/resources/schema/script.graphqls

@@ -110,6 +110,10 @@ type Script implements Node {
     updatedAt: Instant
     """The creating user (resolved from the internal createdBy id via the user DataLoader). The raw createdBy id is not exposed — filter by author via authorIds."""
     author: User
+    """When true, this is a monitoring / QA fixture created by the monitoring pipeline. Immutable at
+    create-time. Set by the pipeline via createScript; hidden from user-facing list/facets/getById
+    reads (query-builder shield) — visible only on direct id lookup performed by the pipeline itself."""
+    testScript: Boolean!
 }
 
 type ScriptEnvVar {

openframe-api-service-core/src/test/java/com/openframe/api/service/rmm/CommandDispatchServiceTest.java

@@ -216,7 +216,7 @@ void batchRunCommand_persistsPendingThenFansOut() {
         // carrying the shared executionId + command/shell/privilege/timeout + initiatedBy.
         verify(commandExecutionService).createBatch(
                 eq(response.getExecutionId()), eq("uptime"), eq(ScriptShell.BASH),
-                eq(machines), eq(PrivilegeLevel.ADMIN), eq(30), eq(INITIATED_BY));
+                eq(machines), eq(PrivilegeLevel.ADMIN), eq(30), eq(INITIATED_BY), eq(false));
 
         // One publish per machine — every published payload must carry the FULL wire contract
         // (executionId, code, shell, privilegeLevel, timeout), not just executionId+code, so a
@@ -242,7 +242,7 @@ void batchRunCommand_savesBeforePublishing() {
 
         InOrder order = inOrder(commandExecutionService, commandNatsPublisher);
         order.verify(commandExecutionService).createBatch(any(), any(), any(),
-                org.mockito.ArgumentMatchers.anyList(), any(), any(), any());
+                org.mockito.ArgumentMatchers.anyList(), any(), any(), any(), org.mockito.ArgumentMatchers.anyBoolean());
         order.verify(commandNatsPublisher).publishCommand(eq("machine-1"), any(CommandMessage.class));
     }
 
@@ -253,7 +253,7 @@ void batchRunCommand_dedupsMachineIds() {
         commandDispatchService.batchRunCommand(batchInput(List.of("machine-1", "machine-1")), INITIATED_BY);
 
         verify(commandExecutionService).createBatch(any(), any(), any(),
-                eq(List.of("machine-1")), any(), any(), any());
+                eq(List.of("machine-1")), any(), any(), any(), org.mockito.ArgumentMatchers.anyBoolean());
         verify(commandNatsPublisher).publishCommand(eq("machine-1"), any(CommandMessage.class));
     }
 

openframe-api-service-core/src/test/java/com/openframe/api/service/rmm/CommandExecutionServiceTest.java

@@ -48,7 +48,7 @@ void createBatch_persistsOneRunningRowPerMachine() {
         when(commandExecutionRepository.saveAll(anyList())).thenAnswer(inv -> inv.getArgument(0));
 
         service.createBatch(EXECUTION_ID, "uptime", ScriptShell.BASH, List.of("m-1", "m-2"),
-                PrivilegeLevel.ADMIN, 30, "alice");
+                PrivilegeLevel.ADMIN, 30, "alice", false);
 
         @SuppressWarnings("unchecked")
         ArgumentCaptor<List<CommandExecution>> captor = ArgumentCaptor.forClass(List.class);

openframe-api-service-core/src/test/java/com/openframe/api/service/rmm/ScriptDispatchServiceTest.java

@@ -147,7 +147,8 @@ void runScript_persistsExecutionRowBeforeNatsPublish() {
                 eq(PrivilegeLevel.ADMIN),
                 eq(60),                      // effective timeout (script default, no override) — persisted for the watchdog
                 eq(USER_ID),
-                eq(ExecutionSource.MANUAL));
+                eq(ExecutionSource.MANUAL),
+                eq(false));
         inOrder.verify(scriptNatsPublisher).publishScript(eq(MACHINE_ID), any(ScriptMessage.class));
     }
 
@@ -163,7 +164,8 @@ void runScript_nullInitiatedBy_persistedAsNull() {
                 eq(PrivilegeLevel.ADMIN),
                 eq(60),
                 eq((String) null),
-                eq(ExecutionSource.MANUAL));
+                eq(ExecutionSource.MANUAL),
+                eq(false));
     }
 
     @Test
@@ -232,7 +234,7 @@ void runScript_persistsEffectiveTimeoutOnRow() {
         scriptDispatchService.runScript(input, USER_ID, ExecutionSource.MANUAL);
 
         verify(scriptExecutionService).create(
-                any(String.class), eq(SCRIPT_ID), eq(MACHINE_ID), eq(PrivilegeLevel.ADMIN), eq(90), eq(USER_ID), eq(ExecutionSource.MANUAL));
+                any(String.class), eq(SCRIPT_ID), eq(MACHINE_ID), eq(PrivilegeLevel.ADMIN), eq(90), eq(USER_ID), eq(ExecutionSource.MANUAL), eq(false));
         assertThat(capturePublished().getTimeoutSeconds()).isEqualTo(90);
     }
 
@@ -344,7 +346,8 @@ void batchRunScript_fansOutWithSharedExecutionId() {
                 eq(PrivilegeLevel.ADMIN),
                 eq(60),
                 eq(USER_ID),
-                eq(ExecutionSource.MANUAL));
+                eq(ExecutionSource.MANUAL),
+                eq(false));
 
         ArgumentCaptor<ScriptMessage> captor = ArgumentCaptor.forClass(ScriptMessage.class);
         for (String id : machines) {
@@ -398,7 +401,7 @@ void batchRunScript_dedupsMachineIds() {
         scriptDispatchService.batchRunScript(batchInput(List.of("machine-1", "machine-1")), USER_ID, ExecutionSource.MANUAL);
 
         verify(scriptExecutionService).createBatch(
-                any(), eq(SCRIPT_ID), eq((String) null), eq(List.of("machine-1")), eq(PrivilegeLevel.ADMIN), eq(60), eq(USER_ID), eq(ExecutionSource.MANUAL));
+                any(), eq(SCRIPT_ID), eq((String) null), eq(List.of("machine-1")), eq(PrivilegeLevel.ADMIN), eq(60), eq(USER_ID), eq(ExecutionSource.MANUAL), eq(false));
         verify(scriptNatsPublisher, times(1)).publishScript(eq("machine-1"), any(ScriptMessage.class));
     }