kandev/docs/plans/azure-devops-integration/task-07-e2e-security-docs.md

id, title, status, wave, depends_on, plan, spec

id	title	status	wave	depends_on	plan	spec
07-e2e-security-docs	E2E, security review, and documentation	done	4	06-frontend-browse	plan.md	../../specs/azure-devops-integration/spec.md

Task 07: E2E, Security Review, And Documentation

Acceptance

• Desktop and mobile Playwright tests prove connection, work-item browsing, PR browsing, and feedback detail against the Azure mock.
• Security review finds no cross-workspace credential use, arbitrary outbound host, secret logging, or unbounded response read.
• Public integration/setup documentation and scoped AGENTS guidance match shipped behavior; full verification passes.

Verification

• rtk make build-web and rtk make build-backend from the repository root.
• rtk pnpm e2e -- --project=chrome e2e/azure-devops/azure-devops.spec.ts from apps/web.
• rtk pnpm e2e -- --project=mobile-chrome e2e/azure-devops/mobile-azure-devops.spec.ts from apps/web.
• rtk make -C apps/backend fmt, then backend test/lint and web test/typecheck/lint commands from the plan.

Files Likely Touched

• apps/web/e2e/azure-devops/*.spec.ts
• apps/web/e2e/azure-devops/mobile-*.spec.ts
• apps/web/e2e/helpers/api-client.ts
• apps/web/e2e/fixtures/backend.ts
• docs/public/ Azure integration documentation.
• Scoped AGENTS.md files only where conventions changed.

Inputs

• Completed Tasks 01-06.
• /e2e, /mobile-parity, /qa, /verify, /docs-maintainer, and security-auditor workflows.

Output Contract

Report scenarios exercised, screenshots/viewport checks, security findings, docs changed, complete verification output, residual risks, and set this task plus its plan checkbox to done.