test(e2e): local-backend Playwright suite for workplace, with advisory CI

[camreeves]

Adds an end-to-end test suite for workplace that runs only against a local backend, the
isolated stack to run it against, and an advisory CI job on a self-hosted runner.

Nothing here gates merges. See Not a gate.

What's in it

e2e/support/	The engine: headless PKCE mint → storageState, a real-login driver, worker-scoped auth fixtures, idempotent API-driven seeding, stack preflight
e2e/stack/	A self-contained 10-service PlaceOS deployment — own compose project, own volumes, ports 9443/9080 — so it coexists with your own local stack and cannot disturb it
apps/workplace/e2e/local/	3 specs: boot + org data, real login (scope and sub surviving refresh), a non-admin booking a desk through the full UI
E2E_USER_STORIES.md	The coverage contract — what's covered, what isn't, and why
.github/workflows/e2e-advisory.yml	Advisory CI on a self-hosted macOS runner
config/proxy.conf.js	Only change to shared code — makes the dev-server proxy target env-driven. Defaults unchanged.

e2e/stack/up.sh                                  # backend, seeded, from nothing
export E2E_BACKEND_URL=https://localhost:9443
bunx playwright test --config apps/workplace/playwright.config.ts

7 passing, ~3 min in CI, ~26s locally. Verified green from a genuine cold start
(up.sh --fresh, volumes destroyed) and on the runner.

Local backend only

assertLocalOnly() throws at config load if E2E_BACKEND_URL/E2E_APP_URL resolve to anything
but a loopback host — an allowlist, not a prod blocklist, because a suite that creates and deletes
real data should not be one typo from doing it to a deployment.

The only surface needing anything external is room/calendar events, which is marked out of scope
and must never enter a gate. Desks, lockers, parking and visitors all work against a placeholder
tenant with no outbound calls.

Not a gate

Deliberately advisory until it has earned trust:

• No pull_request trigger. This repo is public and the runner is self-hosted, so a fork PR
  could run arbitrary code on a machine on an internal network. Every trigger requires write access.
• Not a required status check, and nothing in the workflow can make it one.
• Cannot delay builds. build.yml runs on ubuntu-latest, a different runner pool, and
  Actions has no cross-workflow needs.
• The job is named "advisory — does not block builds" so a red X beside the build jobs can't be
  misread.
• Triggers are staged. Stage 1 (this PR): nightly + manual + e2e/** — nobody sees a new check
  on their commits. Stage 2, once the nightly has a record: add push: develop. Three-line change.

Note the nightly only starts once this is on develop — schedule fires from the default branch
only. That's what breaks the chicken-and-egg of proving it before merging it.

Two real bugs found, both filed

• PPT-2642 — one burst of concurrent
  POST /bookings permanently poisons staff-api's connection pool; every later booking-create
  returns 500 until the service restarts. Reproducer kept at
  e2e/support/repro/reg09-concurrent-bookings.ts.
• PPT-2643 — the booking form discards
  typed input while still initialising (title / All Day / Require locker revert).

Neither is fixed here: PPT-2642's likely fix is in pg-orm, shared by every service in a
transactional path; PPT-2643's fix embeds a UX decision in a service used by every booking flow.

⚠️ bookDeskViaUI works around PPT-2643, so this suite no longer detects it. When it's fixed,
remove the workaround and replace it with a spec asserting input survives init. Flagged in the
contract.

Review notes

Worth a look at config/proxy.conf.js (shared dev config) and the workflow. The rest is new files.

Things learned the hard way, all documented in code comments rather than lost:

• GET /bookings is caller-scoped — an admin sees none of another user's bookings, so a leak
  check run as admin proves nothing.
• The list query param is type, not booking_type.
• Desks are Zone metadata, not systems.
• A fresh authority gets a relative login_url, which ts-client resolves without the port —
  dead-ends the login redirect on any non-443 deployment. seed.ts patches it.
• ES 7.17.6 crashes under cgroup v2; pinned to 7.17.28. Do not downgrade.
• frontend-loader is required even though the dev server serves the SPA — it supplies /login.

🤖 Generated with Claude Code

[vercel]

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/placeos?upgradeToPro=build-rate-limit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
frontend-templates	Ignored	Preview	Aug 5, 2026 6:22am

[MrYuion]

Thanks for putting this together — the isolation work, worker-scoped auth, API-backed assertions, and failure artifacts are a strong foundation. I found a few issues I think should be addressed before merging.

Requested changes

1. [P1] Pin the third-party action used on the self-hosted runner

.github/workflows/e2e-advisory.yml:209 uses fjogeleit/http-request-action@master. That mutable ref executes on an internal self-hosted runner and receives STATUS_URL and CHAT_URL as inputs. A compromised or unexpectedly changed upstream ref could therefore execute code inside the runner's network and access those inputs.

Please pin a reviewed full commit SHA, or replace this step with a small curl invocation. An explicit least-privilege workflow permissions block would also reduce exposure.

2. [P2] Replace the PPT-2643 workaround with its regression test

bookDeskViaUI repeatedly reapplies the title and checkbox values to work around form initialization rebuilding the model. PPT-2643 has now been fixed on develop by #478, so this workaround is stale and means the E2E suite will continue to pass if that fix regresses.

As the PR description already proposes, please remove the workaround and add an E2E assertion that input entered during initialization survives.

3. [P2] Keep the mock project genuinely backend-free

The config installs globalSetup unconditionally, and that setup always calls assertStackUp(). Consequently:

bunx playwright test --config apps/workplace/playwright.config.ts --project=mock

still fails when the PlaceOS stack is absent, despite being documented as “no backend.” Please make preflight conditional on the selected local project, or model it as a setup-project dependency used only by local.

4. [P2] Fail the boot smoke test on unexpected API errors

boot.spec.ts collects every /api/ and /auth/ 4xx/5xx response but only logs the list. A regression in a required endpoint can therefore leave the smoke test green as long as the shell still renders.

Please explicitly allowlist the known calendar-related failure and fail on unexpected API/auth errors, or assert the required boot requests individually.

5. [P2] Pin the backend inputs used to establish the nightly track record

Most PlaceOS services default to latest, and a fresh www volume lets frontend-loader repopulate www-core. This means a nightly result can change without any frontend commit, making it difficult to distinguish test flakiness from moving backend inputs.

Please pin known service tags/digests and a known frontend source revision, then update them intentionally.

6. [P2] Preserve the existing Firefox and WebKit coverage

The previous config ran the landing spec in Chromium, Firefox, and WebKit. Both replacement projects use Desktop Chrome, removing the other two browsers and breaking existing --project=firefox / --project=webkit invocations.

Unless that reduction is intentional and agreed, please retain browser variants for the mock smoke test.

7. [P3] Correct the CI documentation

e2e/README.md says the workflow runs on PRs into develop at 15:10 UTC. The workflow deliberately has no pull_request trigger and schedules 01:10 UTC. The README should match the workflow, especially because the absence of a PR trigger is a security decision.

Validation performed

I reviewed head a06d1bbe7 and also tested its merge result against current develop:

• clean automatic merge
• TypeScript check passed after postinstall
• Playwright config loaded successfully and discovered all 7 tests
• YAML, Bash syntax, and diff whitespace checks passed

I did not start the ten-service PlaceOS stack, so I did not execute the full E2E suite.

[camreeves]

Thanks — this was a genuinely useful review, and one of your points turned out to be more
important than either of us thought. Every factual claim checked out. Pushed as c0c4c69,
which also merges develop in.

Done

Least-privilege CI. You were right, and the sub-point you tacked on the end is the bigger
half: default_workflow_permissions on this repo is write, so with no permissions: block
this job was running with a write-capable token, and actions/checkout persists it to
.git/config — on the one runner that isn't a fresh VM. Added permissions: contents: read
and persist-credentials: false.

The notification step is now plain curl rather than a pinned SHA. Same request, no
third-party code, and nothing to bump later. Worth noting for context: that action with that
exact secrets payload already runs six times across build.yml and pull-request.yml, so it
isn't new exposure — what is new is running it on a machine inside the internal network,
which is why it's worth not extending the pattern here. I've left the other six alone; that's a
repo-wide change and doesn't belong in this PR. If you want it done, MrYuion/git-publish-subdir-action@develop
is arguably the better target of the two, since it receives GITHUB_TOKEN.

Backend-free mock project. Fixed the way you suggested second, because the first isn't
actually available: Playwright never exposes the CLI project filter to globalSetup (it hands
over the full config, and cliProjectFilter isn't on it), so a conditional guard would have to
sniff process.argv and would break under --ui and the VS Code extension. Preflight is now a
setup project that only local depends on. Verified by running --project=mock with the stack
down — passes. Bonus: a missing stack now surfaces as a named failing test instead of a runner
crash.

Boot smoke test. Agreed, it was only logging. It now fails on unexpected server errors.
Three deliberate narrowings: 5xx only (a 4xx during boot is often benign — optional-resource
probes, permission-shaped answers for a non-admin), same-origin only (the old substring test for
/api/ would match any third-party URL containing that segment), and the tolerated set derived
from an actual CI run rather than from the README — the observed list is exactly one entry,
500 GET /api/staff/v1/calendars. Writing that allowlist from the docs would have been writing
it blind, which is how you get flakes on a suite that's trying to earn a track record.

Backend inputs. Right that a nightly can change with no frontend commit. I've gone with
recording rather than pinning: the job summary now lists the resolved image IDs and the
www-core HEAD, so a changed result is attributable in seconds. keydb is pinned by multi-arch
digest — it's not the system under test, so a moving tag there is pure noise (it had no tag at
all; upstream publishes only arch-specific version tags, so a digest is the only pin that
doesn't break either the Intel runner or an Apple Silicon laptop).

I'd push back on pinning the PlaceOS services themselves. They ship together on a rolling tag,
and an advisory nightly against current backends catching a regression before a customer does is
worth more than reproducibility we can get on demand — PLACEOS_TAG is already threaded through
every service, so pinning while bisecting is one env: line. Happy to be overruled if you'd
rather have the determinism.

README. Corrected. You were right to flag it above cosmetic: it claimed a pull_request
trigger eighteen lines above the section explaining why that trigger must never exist, which is
pointing straight at the trap.

Not done, with evidence

The PPT-2643 workaround stays, because #478 does not fix this route.

This is the interesting one. Two things:

First, sequencing — this branch didn't contain a0360486 (it was 154 commits behind), so
removing the workaround before merging develop would just have turned desk-booking red for the
wrong reason. That part's now moot, develop is merged.

Second, and this is the part worth your attention: with your fix present I removed the
converging block and ran the suite. Desk booking still fails, at all_day.isChecked() — the
same assertion and the same symptom as before the fix. I then reverted booking-form.service.ts
to its pre-fix state and ran again: it fails identically. So the flow is a real detector, and
the app behaviour on this path simply hasn't changed.

Best guess at why, though you know that service far better than I do: #478 guards newForm's
deferred re-entry, but loadForm and resetForm keep the same unguarded pattern, loadForm
runs first on /#/book/desk/form, and the unconditional model.set() / form().reset() in
newForm is untouched.

I also tried the spec you asked for — type during initialisation, assert it survives — and
deliberately did not keep it. It passed with and without the fix, because the rebuild is a
race that a warm local run wins before you can type; I tried forcing the condition by holding the
API responses and it still couldn't be made to fail. A spec that cannot fail is worse than no
spec. The honest detector is the flow itself with the workaround removed, which is a two-line
change the day the app path is genuinely fixed. REG-10 in E2E_USER_STORIES.md now records all
of this, including the measurement.

Might be worth reopening PPT-2643, or splitting the remaining paths into a follow-up.

Note for whoever merges

#477 is stacked on this branch, so it'll want develop merged into it too once this lands.

[camreeves]

Both changes in be3ce21 are right — thanks, the first one fixes a real hole in what I pushed.

The networkidle wait. You're right that the assertion was running too early: the shell
renders before the org/zone calls finish, so a slow 500 could have landed after the check and
left it green — an assertion that only catches fast failures isn't much of one. Checked the two
things that could have made this a bad trade and both hold up:

• Does it hang? No. Three consecutive boot runs, 2.8–3.1s each, no timeouts. If the realtime
  WebSocket counted against networkidle we'd be seeing the 90s backstop instead, so your note
  about that is borne out empirically.
• Does the assertion still bite? Yes — I red-checked it rather than assuming. Forcing a 500 on
  /api/engine/v2/systems fails the spec with the three offending entries listed, while the
  tolerated 500 GET /api/staff/v1/calendars is still correctly ignored.

The preflight hint. Straightforwardly right, and my mistake — it was pointing developers at
cd local && ./placeos start, which is their own personal stack rather than this suite's
isolated one. Following that message would have started the wrong thing and left the suite
failing for a reason the message had just ruled out.

Full suite is 8/8 green locally on your head, and the advisory run on be3ce21 is green on the
runner.

One thing I noticed while probing that's worth writing down, though I'd leave it as-is for now:
the set of API calls made during boot varies between runs. /api/staff/v1/bookings and
/api/staff/v1/calendars appear in some runs and not others, depending on how far the landing
page gets. It doesn't affect correctness — a tolerated entry never fails and your networkidle
wait widens the window — but it does mean the tolerated list describes "what boot can do", not
"what boot always does". Worth remembering if that allowlist ever looks stale.

Also saw you took the curl swap repo-wide in 9fc04af and 82695eb, including your own
publish action. Nice — that closes the bit I'd deliberately left out of scope here.

Which leaves PPT-2643 as the only open thread: the workaround is still load-bearing, since
removing it with #478 present still turns desk booking red on the same assertion. Your call
whether that's a reopen or a follow-up ticket.

[camreeves]

Correction on the PPT-2643 thread, since I got there via two wrong turns and the record should be straight.

My earlier evidence was wrong. I said removing the converging block turned desk booking red at all_day.isChecked(), and that this proved #478 had not covered the route. That red was a Playwright strict-mode violation: opening the desk-select modal puts a second "All Day" checkbox in the DOM (desk-filters, bound to the same field), so an unscoped locator matched two elements and threw — with both of them checked. Scoping the locator to desk-flow-form then broke it a second way, because setCheckbox returns silently when its locator matches nothing, so a narrower scope became a no-op and the form genuinely was invalid. Both experiments are reverted; the helper on this branch is unchanged.

The conclusion still holds, for a different reason. Reading the code rather than chasing the race: newForm's protected branch is never taken by the flows. The current user is restored from the localStorage cache ~50ms after bootstrap, while NewDeskFlowComponent.ngOnInit awaits org init plus a 300ms settle before calling loadForm('desk') and then newForm('desk'). So currentUserIsLoaded() is already true, the deferral is skipped, and the replay never runs — and loadForm, which goes first, had no capture at all.

Fixed in #479, with two unit specs seen red first. PPT-2643 reopened.

What this means for this PR: the converging block stays, and REG-10 stays blocked even after #479 lands. Not because the app is broken, but because this suite passed 8/8 in six consecutive runs with the bug present — the race needs initialisation to be slow relative to typing, and the runner is not slow enough to lose it. Your original request to replace the workaround with a real assertion is right in principle; it just cannot be honoured with an e2e assertion that only fails on hardware we do not have. The unit specs are the guard instead, and E2E_USER_STORIES.md now says so explicitly rather than leaving a to-do that reads as achievable.

Everything else from your review is addressed and CI is green, so this is ready for another look whenever you are.