Dashboard updated: 2026-08-10 — Hooks hardening (field-level write guards, WS session resolution dedup, 18-hook READY pipeline, SSE + Yjs real-time stack with session-validated /ws, svelte-check 0 errors / 0 warnings) ; full unit suite 368 files / 3285 tests green. Prior hot areas (lane router, findPage/count, session/RBAC) still in force. Local SQLite integration last measured 617 pass / 0 fail.

---

1. Snapshot

Question	Answer
Are the gates healthy?	Design A++: pre-commit (unit + risk:audit) → pre-push (build 4 adapters + tenant + SQLite integration) → CI multi-DB + E2E
Where to look first when red?	Failing CI job name → matching hot area below or route control map
Biggest recent win	Field write guards + real-time truth-pass (schema-level writeRoles enforced with 403 + audit; WS sessions share the HTTP resolution pipeline; SSE+Yjs collaboration actually round-trips; svelte-realtime dead layer removed)
Biggest open risk (product)	Multi-tenant browser isolation (MULTI_TENANT=true env gate; E2E spec exists, needs dedicated CI job); E2E still CI-only (not pre-commit)

---

2. Health by layer

Layer	Confidence	What it proves	How to run
Unit (Vitest)	A++	368 files / 3285 tests — auth, lanes/turbo cache, CacheService, page gates, widgets, security, field write guards	bun run test:unit · coverage: test:unit:coverage
Security regression	A++	Hooks + RBAC defense-in-depth + full risk:audit (security-risk, secrets, slop, OSV) on pre-commit	bun run test:security · bun run risk:audit
Integration (black-box)	A++	~65 files / ~617 tests SQLite local; multi-adapter matrix in CI; lane headers + session page-load canaries	bun run test:integration (SQLite) · bun run test:matrix (all 4 DBs)
E2E (Playwright)	A++	~44 specs — browser goldens / P0 journeys; hooks-lane smoke; CI-parity preview :4173	bun run test:e2e (not Vite). Dev-only: test:e2e:dev
Benchmarks	Selective	Perf matrix + lane-router attribution; full suite is long — not every PR	See benchmarks

3. Testing tiers

Tier	Command	Time	Coverage (approx., drifts — trust CI)
Pre-commit	git commit / hooks	~40–60s	Unit (3285) + risk:audit + format/lint + SBOM when lock changes
Pre-push	bun run gate	~5–8min	Build 4 adapters + backdoor/bundle gates + tenant + SQLite integ (~617)
Pre-CI (local)	bun run test:matrix	~8–15min	All 4 DBs via Docker profiles
CI	GitHub Actions	~30min	Whitebox + build + db-tests matrix + E2E + benchmarks

Gates (local → CI) — source of truth: .githooks/pre-commit, .githooks/pre-push, .github/workflows/ci.yml

When	What runs (summary)
Pre-commit	1. DB safety 2. Format + lint (check) 3. Lint-staged 4. risk:audit 5. Unit 6. SBOM sync (if lock/package changed)
Pre-push	1. Build (COMPILE_ALL_ADAPTERS=true) 2. Backdoor verify (bench) 3. Bundle size 4. check 5. Secret scan 6. test:tenant 7. SQLite integration
Manual	bun run test:doctor · bun run test:security · bun run test:e2e
CI	Whitebox (format/lint/check/unit/tenant/secrets/probe) → build → db-tests (4 DBs) → E2E prep + groups → benchmarks

CI smart reporting (job Summary tab + annotations):

Job	Reporter
E2E prep / E2E shards	scripts/ci-report-playwright.ts — pass/fail counts, first error, fix hints, preview.log tail
bun test tests/integration/	bun test native output — per-file ✓/×, summary, no custom JSON
All Green	scripts/ci-report-all-green.ts — job matrix + fix order

Details: git-workflow.mdx

---

3. Hot areas (recent)

Hooks hardening — field write guards, session dedup, real-time (2026-08-10)

Status	Shipped — field-level write guards wired into the mutation path; WS session resolution deduped onto the HTTP pipeline; 18-hook READY pipeline; real-time stack is SSE + Yjs; full unit suite green (366 files / 3302 tests)
Product	assertWriteAllowed / hasGuardedFields / getCollectionFields (30s schema memo) in handle-api-requests — 403 + UNAUTHORIZED_ACCESS audit for guarded-field writes; resolveSessionForWebSocket shares the HTTP session pipeline (LRU→store→Redis→DB, negative cache, single-flight); yjs:sync SSE bridge makes multi-editor updates round-trip; /ws upgrades session-validated (fail-closed)
Unit	tests/unit/services/field-write-guard.test.ts (15) · field-permission-service.test.ts (19) · tests/unit/live/client-import-boundary.test.ts (2) · hooks/auth/security suites (615)
Integration	tests/integration/api/rtc.test.ts (SSE /api/events happy + 401)
Bench	tests/benchmarks/hooks-performance.test.ts — full auth pipeline 0.612 ± 0.010 ms (3-run mean, ~1,363 RPS) vs 0.856 ms July baseline (~29% faster); post-tweak re-run within noise
Docs	field-level-access-control · collaborative-editing · real-time updates · server-hooks
Open	GraphQL mutations bypass the field write-guard (documented boundary)

Request Lane Router + response cache (2026-08-06)

Status	Shipped — O(1) classifyRequest in hooks.server.ts; x-svelty-lane on responses; turbo GET + GraphQL/REST user-scoped responseCache; fixed session cookie name (auth_sessions, not svelty_session) for HYPER_TURBO
Product	Lanes: FAST_STATIC, HEALTH, HYPER_TURBO, API_READ/WRITE, APP_SSR, BOOTSTRAP, FILES, PUBLIC_SITE; health/static fast-paths; handleTurboGet TURBO-HIT when warm turbo-auth + L1 body
Unit	tests/unit/core/request-classifier-and-response-cache.test.ts · tests/unit/hooks/handle-turbo-get-lane.test.ts
Integration	tests/integration/api/request-lane-headers.test.ts (x-svelty-lane, health JSON, dashboard __data.json) · session-page-load still P0 for auth→SSR
E2E	tests/e2e/routes/system/hooks-lane-smoke.spec.ts — admin session shell + /health
Bench	tests/benchmarks/lane-router-attribution.test.ts
Docs	performance-architecture (operator guide + lane table)
Open	Optional: assert TURBO-HIT under live integration with seeded turbo-auth warm path; multi-node Redis L2 load tests

List / count product layer (2026-08-04)

Status	Shipped adapter + service wiring — not “full UI polish”; E2E only after more list surfaces adopt findPage
Product	findPage (hasMore + keyset), CountMode, L1 count cache; CollectionService limit+1 + cached count; media getByFolder; users listUsers findPage; facets via crud.count
Unit	tests/unit/core/page-utils.test.ts, count-cache.test.ts
Integration	tests/integration/databases/find-page-count-contract.test.ts (SQLite local; multi-DB in CI matrix)
Bench	tests/benchmarks/database-performance.test.ts (FIND PAGE / LIST+COUNT / COUNT ESTIMATE / CACHED / keyset)
Docs	performance-architecture · database-tests · roadmap
Open	Saved views on users/media; marketplace install pipeline; OIDC PKCE + login UI; published DB packages

Marketplace + OIDC (2026-08-04)

Status	Partial product — in-app catalog tab + OIDC login/callback + JWKS verify
Product	Extensions Marketplace tab; GET /api/marketplace; oidc-login / oidc-callback
Unit/E2E	No dedicated E2E yet — add seed-backed golden when install + IdP UI ship
Docs	roadmap-2026

Session & RBAC hardening (2026-08-04)

Status	Shipped — three hardening rounds; full unit suite green (3073)
Product	Device policy (single-per-device / single-per-user / allow-multiple), SESSION_TTL_HOURS, SESSION_IDLE_HOURS, block propagation purge, credential-free session snapshots, log-only IP/UA anomaly detection, SESSION_MAX_PER_USER LRU cap, step-up re-auth for cross-session revoke, admin session console API
Unit	tests/unit/auth/auth-lockout.test.ts (device policy, TTL, max sessions) · tests/unit/auth/session-user.test.ts (snapshot stripping, store hygiene, anomaly evaluation) · tests/unit/hooks/authentication.test.ts (stripping, warm-cache, anomaly) · tests/unit/api/user.test.ts (reauth proof, admin console)
Integration	Covered by existing auth integration suites (session create/revoke/rotate)
Bench	tests/benchmarks/hooks-performance.test.ts — full auth pipeline 0.612 ± 0.010 ms (3-run mean, ~1,363 RPS) vs 0.856 ms July baseline (~29% faster)
Docs	login-security · cache-system · hook-test-coverage · roadmap
Open	Admin session console UI (Access Management); browser golden for revoke flow; anomaly → alerting integration

ContentSync / compilation / Collection Builder (2026-07-31)

Status	Unified coordinator — IDE edit + GUI save + boot share one path; soft HMR; surgical client patch when possible
Product	syncContentState reasons: boot · watcher · collection-save · gui-save · sidebar-reorder; GUI compile lock; atomic .js; hash-backed drift; tenant paths via tenant.server
Unit	sync-content-state (13+), collection-save-sync (2), schema-contract (6+ Valibot), compile-manifest (atomic/noOp/changedJsPaths), collection-store-reactive (patchActiveSchema)
E2E	collection-builder/builder.spec.ts — shell + soft-refresh (in-page mark survives save) + golden schema→entry→API
Docs	compilation-pipeline · content-system · collection-builder

/user — profile & management (2026-07-19)

Status	100% control map — product + unit + integration + E2E
E2E	7 specs: smoke, profile, management, invite, complete-coverage, p0-journeys, coverage-100
Product	Profile update: command remote + email fallback when session user_id stale after re-seed; plain-text toasts for assertions
Docs	routes/user.mdx · e2e-coverage-matrix §3

/dashboard — shell + licensing (2026-08-04)

Status	Shell 100% (widget catalog is install-specific — never fixed list) + server-side license gates
E2E	dashboard.spec.ts — empty/grid, add/search/reset, pointer + keyboard reorder, toolbar, plugin slot
Unit	page.server permissions, widget-defaults categories, dashboard-license-gate (map + 403 paths)
Integration	dashboard.test.ts health/metrics/logs/… APIs widgets consume (premium endpoints pass during trial)
Docs	routes/dashboard.mdx

/mediagallery (2026-07-18)

Status	Shell + upload/delete + editor save + folders + bulk + move + remote upload
E2E	mediagallery, image-editor, folders-bulk, move-remote
Unit	mediagallery-page-server.test.ts
Docs	routes/mediagallery.mdx

/config/access-management (2026-07-19)

Status	Tabs + create role + save/reset + admin/tokens; sticky action .first(); tokens panel testids; permission-matrix toggle
E2E	config/access-management.spec.ts — create-role outcome, tokens panel (website-tokens-panel); system/permissions.spec.ts — matrix toggle + persistence; system/language.spec.ts — language selector
Product	Role modal response as 3rd trigger arg; website-tokens $effect loop fixed (density/columns sync + untracked fetch); fetchPageData must select the page __data.json node (not the layout’s)
Unit	access-management-page-server.test.ts admin gate
Docs	routes/access-management.mdx

/config/system-settings (2026-07-18)

Status	Group nav/search, edit→save/discard, save+reload happy path, export/import, MT/GDPR
E2E	system/settings.spec.ts (shell + edit/discard + persistence)
Unit	page.server gate + settings-groups + settings-utils
Integration	settings.test.ts export/import
Docs	routes/system-settings.mdx

/config/redirects (2026-07-19)

Status	Admin gate + golden create→search→delete; primary store = redirectsMV (aligned with middleware)
E2E	config/redirects.spec.ts golden (MV list/search/delete)
Unit	redirects.server (MV insert/update/delete + normalizeRedirectRow) + redirects-utils + page load
Product	source/target on MV; content collection mirror best-effort; compound index idx_redirects_mv_lookup (tenantId, source, active)
Docs	routes/redirects.mdx

/config/queue + /config/monitor (2026-07-18)

Status	Admin gates, testids, queue filter URL + showConfirm; monitor resilient load
E2E	config/operations.spec.ts
Unit	queue-page-server + monitor-page-server
Docs	queue, monitor

/config/webhooks — Testing 2026 reference (2026-07-18)

Status	ADR reference — full three layers: unit + HTTP integration + golden E2E
E2E	config/webhooks.spec.ts (shell guard + golden journey only)
Unit	page.server + webhooks-utils + webhooks-api + fetchApi CSRF
Integration	tests/integration/api/webhooks.test.ts — list/create/delete + 401 unauth + editor deny
ADR	adr-testing-2026.mdx
Docs	routes/webhooks.mdx

/config/extensions (2026-07-18)

Status	Admin via isAdmin, tabs + plugins testids, toggle CSRF/toast
E2E	config/extensions.spec.ts
Unit	extensions-page-server.test.ts
Docs	routes/extensions.mdx

/config/automations (2026-07-19)

Status	automations-api + fetchApi CSRF; golden builder create→list→edit→delete; seed-search
E2E	config/automations.spec.ts — open editor via card link (not bare text / checkbox label)
Unit	page.server + automations-api
Docs	routes/automations.mdx · ADR

/config/workflows (2026-07-19)

Status	Shell + seed-workflow golden; name NOT NULL safe; states JSON normalized on read
E2E	config/workflows.spec.ts (toolbar/canvas + seed→GET by collectionId)
Product	workflow-service.saveWorkflow default name; testing API passes name; builder name fields
Docs	routes/workflows.mdx

/config/sync + /config/trash (2026-07-18)

Status	Admin gates, sync tabs/status testids, trash empty/table + restore confirm
E2E	config/data-ops.spec.ts
Unit	sync-trash-page-server.test.ts
Docs	routes/sync-trash.mdx

Ultra-smart auth & client safety (2026-07-18)

Status	P0 hardened — loopback cookies, testing dual-write, exhaustive import-boundary, session→18 admin pages
Unit	session-cookies, client-import-boundary (full client-root walk), login-cookie contract, page-guards, builder page.server, totp-encryption, registry-auth-hooks
Integration	session-page-load · webhooks · automations · config-admin-surface · collection-structure · security-negative config matrix
Docs	headless-test-inventory.mdx · auth.mdx

2FA Hardening & Plugin Auth Hooks (2026-07-30)

Status	35 new unit tests — AES-256-GCM TOTP encryption (round-trip, tamper detection, legacy compat), trusted device tokens (gen/verify/reject), afterAuthenticate hook (deny/requires2FA/fail-open/skip disabled), configurable TOTP window
Unit	tests/unit/auth/totp-encryption.test.ts (20 tests), tests/unit/plugins/registry-auth-hooks.test.ts (15 tests)
Product	TOTP secrets encrypted at rest; pending setup state (resumable enrollment); __Host-2fa-trusted-device cookie; plugin auth hooks in signInInternal
Docs	auth.mdx · authentication-system.mdx · plugin architecture

Databases whitebox + enterprise storage (2026-07-20)

Status	tests/unit/databases/ green (0 skip for soft-delete under Bun; magic-link + CacheService fixed). Real proofs — not mock-only theater for Auth lockout, credential cache, boot helpers
Unit	cache-service (always-tenant keys, pattern clear), credential-auth-cache (real L1), auth-lockout (real Auth), soft-delete (mongoose stub), database-resilience / CORRUPT_CONFIG, magic-link privacy
Product	CacheService set/get tenant default alignment; clearByPattern wildcard tenant; fail-fast CORRUPT_CONFIG → MISSING_CONFIG
Enterprise	Transactional outbox, plugin storage, schema lifecycle hooks (beforeValidate/afterValidate), media jsonPath — unit + integration seeds
Manifest	tests/critical-test-paths.ts (replaces p0-manifest/registry) · runners: scripts/run-integration.ts, run-e2e.ts, test-doctor.ts
Docs	database-tests.mdx · plugin-storage · outbox · schema hooks

Other solid areas (summary)

Area	Notes
Auth & users API	Strong integration (login, batch, avatar, sessions, 2FA) + page-load session
Security hooks	Dedicated regression suite in pre-commit/push
Collection builder	E2E = shell + soft-refresh + golden (builder.spec.ts); structure/utils unit+integ; ContentSync unit suite
Content / compile	ContentSync coordinator + schema contract + compile manifest; see hot area above
Site starter / preview	Smoke E2E + unit; deep iframe edit still open
Data operations	Strong unit; thin browser E2E
Multi-tenant	Unit/guard coverage; E2E isolation spec exists, gated behind MULTI_TENANT=true
Stores unit	tests/unit/stores/ (reactivity, patchActiveSchema, structure fingerprint, floating-nav-store 22)
Admin chrome	command-palette (18) + floating-nav-store (22) + logger (7) + widget-naming (12) unit tests; hotkeys Mod+K/Alt+G unified

Deeper inventories: headless-test-inventory · e2e-coverage-matrix · three-layer-completeness.

---

4. Open gaps (actionable only)

Only open product/test risks. Closed items stay in route docs / ADR changelog — not duplicated here.

Gap	Priority	Why it matters
Multi-DB contract without asterisks	🟠 High	Headless ship gate — all adapters must match contract suite
Lane TURBO-HIT live warm path	🟢 Lower	Unit covers TURBO-HIT; full HTTP warm turbo-auth seed in integration optional
Multi-tenant browser isolation	🟡 Medium	E2E spec exists (isolation.spec.ts), gated behind MULTI_TENANT=true env
Session vs DB identity after wizard reset	🟡 Medium	Phase-1 wizard can race firstuser; profile has email fallback — harden setup order
Redirects/queue remotes (no REST)	✅ Closed	Remote admin + redirectsMV primary + unit; queue-actions
Config residual goldens (access/auto/wf)	✅ Closed	Local focused chromium 16/16 (2026-07-19) after product fixes
Data operations deep E2E	🟢 Lower	Sync/trash shells covered; migration wizard still plugin-gated
Cache L2 (Redis) integration	✅ Closed	L2 contract suite (cache-service-l2-contract.test.ts) — FakeRedis always-on + real Redis via TEST_REDIS_URL; fixed untagged delete propagation to remote L1
GraphQL browser E2E	❌ Skip	Integration only — do not add browser GraphQL as a gate
SSO/OAuth real IdP	🟡 Medium	OIDC login/JWKS code landed; still mock/no live IdP in CI; PKCE + login UI open
List UI full findPage adoption	🟡 Medium	Service/adapters ready; users/media saved views + more goldens still thin
Marketplace install path	🟢 Lower	Browse/catalog in-app; one-click install still incomplete
Session revoke browser golden	🟢 Lower	Re-auth proof + admin console API unit-covered; E2E golden when Access Mgmt UI ships
/ws collaboration auth	✅ Closed	/ws upgrades session-validated via ws-auth-registry → hooks.ws upgrade() (same pipeline as HTTP); fail-closed 401; session-authoritative tenant keying
Awareness over SSE	✅ Closed	Awareness POSTs to /api/collaboration/yjs (awareness: true) → yjsService applies + broadcasts yjs:awareness over SSE; client applies remote state with origin: "server" (no echo loop); yjs-awareness.test.ts covers the round-trip
Builder E2E sprawl	✅ Closed	Consolidated to shell + golden; 8 specs removed
Plugin deep E2E, breadcrumb media drag-move	🟢 Low	Optional polish

---

5. What to run locally

# Pre-commit parity (format + risk + unit)
bun run check
bun run risk:audit
bun run test:unit

# Before push (mirrors .githooks/pre-push)
bun run gate

# Unit only
bun run test:unit

# Lane router + turbo cache (2026-08-06)
bun run test:unit -- tests/unit/core/request-classifier-and-response-cache.test.ts tests/unit/hooks/handle-turbo-get-lane.test.ts
# After build: lane HTTP headers
bun run scripts/run-integration.ts --no-build tests/integration/api/request-lane-headers.test.ts

# Field write guards + field permissions (2026-08-10)
bun run test:unit -- tests/unit/services/field-write-guard.test.ts tests/unit/services/field-permission-service.test.ts

# Ultra-smart unit slice (auth, boundary, queue/redirects remotes)
bun run test:unit -- tests/unit/auth/session-cookies.test.ts tests/unit/live/client-import-boundary.test.ts tests/unit/api/testing-login-cookie-contract.test.ts tests/unit/utils/page-guards.test.ts tests/unit/routes/collectionbuilder-page-server.test.ts tests/unit/routes/queue-remote-admin.test.ts tests/unit/routes/queue-actions.server.test.ts tests/unit/routes/redirects-remote-admin.test.ts tests/unit/api/namespace-ownership.test.ts

# Databases whitebox + Auth lockout (real CacheService / Auth / boot)
bun test tests/unit/databases/ tests/unit/auth/auth-lockout.test.ts

# List/count product layer (pure + SQLite integration contract)
bun test tests/unit/core/page-utils.test.ts tests/unit/core/count-cache.test.ts
bun test --timeout 300000 tests/integration/databases/find-page-count-contract.test.ts

# 2FA encryption + trusted devices + plugin auth hooks (35 tests)
bun test tests/unit/auth/totp-encryption.test.ts tests/unit/plugins/registry-auth-hooks.test.ts

# ContentSync / compile / schema contract / builder soft-HMR slice
bun run test:unit -- tests/unit/content/sync-content-state.test.ts tests/unit/content/collection-save-sync.test.ts tests/unit/content/schema-contract.test.ts tests/unit/compilation/compile-manifest.test.ts tests/unit/stores/collection-store-reactive.test.ts tests/unit/collectionbuilder/

# Integration (SQLite) — session-page-load, lane headers, webhooks, security-negative
bun run test:integration
# reuse build: bun run scripts/run-integration.ts --no-build

# E2E CI-parity (preview :4173 — not Vite)
bun run test:e2e
# Hooks/lane smoke (needs auth-setup admin.json):
# bun run test:e2e:quick -- tests/e2e/routes/system/hooks-lane-smoke.spec.ts

# Collection Builder shell + soft-refresh + golden
bun run test:e2e --project=chromium tests/e2e/routes/collection-builder/builder.spec.ts

# Focused residual config/user goldens (example)
bun run test:e2e --project=chromium "--grep=redirects|Edit User Details|website tokens|automations|workflows|webhooks|Dashboard shell|create role"

# Smart test selector (auto-detects from git diff)
bun run test:smart

Safety: tests must never point at production DBs — see test-config safety guards in git-workflow.mdx.

---

6. Where to dig deeper

Need	Doc
Headless-first tiers & route↔layer map	headless-test-inventory.mdx
Strategy & three-layer goal	testing-strategy.mdx · three-layer-completeness.mdx
ADR (pyramid, soft-skip ban, goldens)	adr-testing-2026.mdx
Route E2E matrices	e2e-coverage-matrix.mdx · routes/webhooks.mdx
Collection Builder / ContentSync	routes/collection-builder.mdx · compilation-pipeline
/user control map	routes/user.mdx
Security testing	security-testing.mdx
Benchmarks	docs/project/benchmarks
API coverage	api-testing.mdx · api-test-coverage.mdx

---

7. How to keep this page honest

When you ship a meaningful test or stability change:

1. Update this file if health, open gaps, or hot areas change (few sentences + table rows).
2. Put deep control maps and file-level inventories in route docs or headless-test-inventory — not a separate archive.
3. Never treat static totals as CI truth — GitHub Actions is the live board.