kandev/docs/plans/repository-secrets/task-07-e2e-docs-verification.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
07-e2e-docs-verification	Prove and document repository secrets	done	5	04-runtime-environment-propagation 06-repository-binding-settings	plan.md	../../specs/workspaces/requirements/repository-secrets.md

Task 07: Prove and Document Repository Secrets

Acceptance

• Desktop E2E proves Global/Workspace filtering, repository binding persistence, conflict failure, deleted-ref failure, and local runtime/terminal injection without exposing plaintext in UI.
• mobile-repository-secrets.spec.ts proves the complete phone settings flow and no overflow.
• Container E2E proves Docker propagation and SSH approved-key forwarding plus the negative unrelated env case.
• Public docs accurately describe scope, inheritance, conflicts, snapshots/reset, terminal exposure, and SSH behavior.
• Broad backend/frontend/i18n checks pass and plan/task results record exact commands.

Files likely touched

• apps/web/e2e/tests/settings/repository-secrets.spec.ts
• apps/web/e2e/tests/settings/mobile-repository-secrets.spec.ts
• apps/web/e2e/tests/docker/repository-secrets.spec.ts
• apps/web/e2e/tests/ssh/repository-secrets.spec.ts
• E2E API client/page helpers as needed
• docs/public/agents-and-profiles.md
• docs/public/executors.md
• docs/public/authentication.md
• docs/public/security.md
• This plan and task file result/status sections

Inputs

• Completed backend/runtime Tasks 01–04.
• Completed frontend Tasks 05–06.
• E2E skill conventions and apps/web/e2e/README.md project routing.

Dependencies

Tasks 04 and 06.

TDD/E2E sequence

1. Add desktop and mobile browser scenarios against the real per-worker backend.
2. Add focused Docker and SSH container scenarios using their dedicated fixtures.
3. Fix only feature-owned testability gaps such as stable test IDs; do not duplicate backend policy in Playwright helpers.
4. Update public docs from verified behavior, then run broad checks and record results.

Verification

make -C apps/backend test
make -C apps/backend lint
cd apps && pnpm --filter @kandev/web test -- --run
cd apps/web && pnpm run typecheck
cd apps && pnpm --filter @kandev/web lint
cd apps && pnpm run i18n:check && pnpm run i18n:ratchet
cd apps/web && pnpm e2e:run tests/settings/repository-secrets.spec.ts
cd apps/web && pnpm e2e:run --project mobile-chrome tests/settings/mobile-repository-secrets.spec.ts
cd apps/web && KANDEV_E2E_CONTAINERS=1 pnpm e2e --project=containers tests/docker/repository-secrets.spec.ts tests/ssh/repository-secrets.spec.ts

Risks

• E2E diagnostics and assertions must never print secret plaintext.
• Container tests require Docker and belong only to the containers project; contributors without Docker still need deterministic unit coverage for the transport matrix.
• Public docs must distinguish user-global from instance-global when authentication is enabled.

Output contract

Report each desktop/mobile/runtime scenario, exact command results, any Docker availability limit, documentation updated, files changed, and residual risks. Mark the spec shipped and plan/tasks done only when implementation and required verification genuinely pass.

Result

Added desktop, mobile, Docker, and SSH repository-secret E2E coverage plus public documentation for scope, inheritance, fail-closed conflicts, snapshots, and SSH forwarding. Successful verification:

• make -C apps/backend test — passed.
• make -C apps/backend lint — passed with 0 issues.
• Full web Vitest — 1,089 files passed; 8,309 tests passed and 4 skipped.
• Focused web tests — 6 files and 41 tests passed; typecheck and lint passed.
• pnpm run i18n:pseudo, i18n:check, and i18n:ratchet — passed.
• pnpm run build:vite — passed.
• Chromium repository-secret E2E — 3 passed; mobile-chrome — 1 passed.
• Containers Docker repository-secret E2E — 1 passed; SSH repository-secret E2E — 1 passed.
• Public-doc validation — 58 tests passed and 41 published pages validated.

Fresh desktop and mobile PR assets were generated from synthetic data, visually inspected, and compressed. The env-gated PostgreSQL tests remain available but were skipped because this workspace has no KANDEV_TEST_POSTGRES_DSN.