|
1217 | 1217 | "GET /api/v1/datasources; confirm qa_ds_probe appears with origin:'runtime' and its health in `status` ('ok' | 'error' | 'blocked' | 'unvalidated', with `statusReason` beside 'error' and 'blocked' — packages/services/service-datasource/src/contracts/datasource-admin-service.ts#DatasourceSummary)", |
1218 | 1218 | "GET /api/v1/datasources/qa_ds_probe; inspect the body for config + a hasSecret flag and confirm the cleartext secret value is ABSENT", |
1219 | 1219 | "POST /api/v1/datasources with a bad draft (invalid config shape / missing required); capture status + code", |
1220 | | - "POST /api/v1/datasources/qa_ds_probe/migrate-credential (#8155): the fresh, cleanly-created row has nothing to re-home, so capture the 200 whose result reports the plan outcome (the wire answers { result: { name, status } }: 'already-bound' for a row created with a `secret`, 'nothing-to-migrate' for one holding no credential, 'refused' with reason + remedy — packages/services/service-datasource/src/contracts/datasource-admin-service.ts#CredentialMigrationResult) rather than a 400; for the live 'bind' arm a stored row still carrying an inline cleartext credential must be PLANTED directly (the current create path splits `secret` out, so no parse-produced row has one — same fixture caveat as datasource-credential-refusal-matrix's legacy-alias clause); the recipe QA run #24615 proved: stop the server, insert a sys_metadata row of type 'datasource' and origin 'runtime' whose config carries the password inline and no external.credentialsRef, and restart. The detail then reads hasSecret false and redactedConfigKeys ['password'], migrate-credential answers status 'migrated' with migratedKey 'password', and a re-run answers 'already-bound'. Only a run that cannot write such a row scores that arm from the unit pin and records blocked(fixture)", |
| 1220 | + "POST /api/v1/datasources/qa_ds_probe/migrate-credential (#8155): the fresh, cleanly-created row has nothing to re-home, so capture the 200 whose result reports the plan outcome (the wire answers { result: { name, status } }: 'already-bound' for a row created with a `secret`, 'nothing-to-migrate' for one holding no credential, 'refused' with reason + remedy — packages/services/service-datasource/src/contracts/datasource-admin-service.ts#CredentialMigrationResult) rather than a 400; for the live 'bind' arm a stored row still carrying an inline cleartext credential must be PLANTED directly (the current create path splits `secret` out, so no parse-produced row has one — same fixture caveat as datasource-credential-refusal-matrix's legacy-alias clause); the recipe QA run #24615 proved: stop the server, insert a sys_metadata row of type 'datasource' and origin 'runtime' whose config carries the password inline and no external.credentialsRef, and restart. The detail then reads hasSecret false and redactedConfigKeys ['password'], migrate-credential answers status 'migrated' with migratedKey 'password', and a re-run answers 'already-bound'. Only a run that cannot write such a row records that arm blocked(fixture), with the unit pin beside it (RUNNER rule 6)", |
1221 | 1221 | "GET /api/v1/datasources/qa_ds_probe/remote-tables (an external-datasource-served route): on a stock os dev boot federation IS wired (serve.ts) so expect a WIRED answer (2xx, or a 400 EXTERNAL_DATASOURCE_ERROR from the introspector — not a 503) and score the 503 clause via its unit pin; only a boot that genuinely lacks the service (dynamic import failed / custom host without the plugin) shows the 503 — capture which service the answer names either way", |
1222 | 1222 | "GET /api/v1/datasources/does-not-exist; capture the 404" |
1223 | 1223 | ], |
|
1243 | 1243 | { |
1244 | 1244 | "clause": "POST /:name/migrate-credential re-homes a stored inline cleartext credential into the secret store and drops the inline key — afterwards the read shows hasSecret with the cleartext absent — while a row it cannot re-home safely answers 200 with the plan outcome (action 'refuse' carries operator-facing reason + remedy; action 'none' reports already-bound / nothing-to-migrate), NOT a 400: the datasource is intact and the operator asked a question (#8155). Per-datasource and operator-initiated by construction — no batch spelling exists", |
1245 | 1245 | "oracle": "api", |
1246 | | - "verify": "live: the 'none' outcome on the clean qa_ds_probe + (if a legacy row was planted) the bind outcome and its post-migration redacted read; otherwise the unit pin packages/services/service-datasource/src/__tests__/datasource-credential-migration.test.ts (plan outcomes: bind / drop-inline / none / refuse — datasource-credential-migration.ts; route: admin-routes.ts)", |
1247 | | - "evidence": "the migrate responses + the post-migration detail read (or the unit-test output for the bind arm)" |
| 1246 | + "verify": "live: the 'none' outcome on the clean qa_ds_probe + (if a legacy row was planted) the bind outcome and its post-migration redacted read; otherwise record the bind arm blocked(fixture), with the unit pin packages/services/service-datasource/src/__tests__/datasource-credential-migration.test.ts beside it (plan outcomes: bind / drop-inline / none / refuse — datasource-credential-migration.ts; route: admin-routes.ts): it drives the re-homing planner over row objects, so it is evidence of the planner only, never the door's pass (RUNNER rule 6, a pin scores only the layer it drives)", |
| 1247 | + "evidence": "the migrate responses + the post-migration detail read (or, for a bind arm recorded blocked(fixture), the unit-test output beside it)" |
1248 | 1248 | }, |
1249 | 1249 | { |
1250 | 1250 | "clause": "a runtime create lands with provenance + health: POST /api/v1/datasources creates a sqlite-file datasource (201) and the subsequent list shows it with origin:'runtime' and its health `status`", |
|
1336 | 1336 | { |
1337 | 1337 | "revision": 6, |
1338 | 1338 | "date": "2026-10-20", |
1339 | | - "change": "automated.ref narrowed per clause. PR #24891's carried finding (round 15 respelled this ref and left its scope, 'pins route behavior + envelope', unnarrowed), read under RUNNER rule 6 and the theme-B rule. Read at base feb09db14a: both pins mount registerDatasourceAdminRoutes on the real HonoHttpServer adapter over stubbed services and a fake auth service, so they score acceptance[7] (test oracle), negative[4] and negative[5] (attributions the route layer owns) whole, and hold only route-layer halves of acceptance[0], [2], [4], [6] and [8]. The capability floor has its own pin (admin-routes-auth-guard.test.ts), which this ref does not name. No clause changed", |
| 1339 | + "change": "automated.ref narrowed per clause, and the credential-migration bind arm is no longer scored from its unit pin. PR #24891's carried finding (round 15 respelled this ref and left its scope, 'pins route behavior + envelope', unnarrowed), read under RUNNER rule 6 and the theme-B rule. Read at base feb09db14a: both ref pins mount registerDatasourceAdminRoutes on the real HonoHttpServer adapter over stubbed services and a fake auth service, so they score acceptance[7] (test oracle), negative[4] and negative[5] (attributions the route layer owns) whole, and hold only route-layer halves of acceptance[0], [2], [4], [6] and [8]. The capability floor has its own pin (admin-routes-auth-guard.test.ts), which this ref does not name. acceptance[3] (verify, evidence) and steps[8] scored the bind arm from datasource-credential-migration.test.ts, which drives the re-homing planner over row objects, under an api clause; that arm is now blocked(fixture) where the row cannot be planted, with the pin beside it, as the narrowed ref implies. No clause changed", |
1340 | 1340 | "ref": "#PENDING-24579R16" |
1341 | 1341 | } |
1342 | 1342 | ] |
|
0 commit comments