Dashboard updated: 2026-07-31 — ContentSync unification (compile/HMR/builder), schema contract (Valibot), soft HMR + surgical client patch, tenant path roots, docs + unit/E2E coverage.

---

1. Snapshot

Question	Answer
Are the gates healthy?	Design A++: unit → security → push (+ SQLite smoke on DB/plugin) → CI multi-DB + E2E
Where to look first when red?	Failing CI job name → matching hot area below or route control map
Biggest recent win	ContentSync single coordinator + schema contract + soft/surgical HMR (no session-breaking reloads)
Biggest open risk (product)	Multi-tenant browser isolation (MULTI_TENANT=true env gate; E2E spec exists, needs CI job)

---

2. Health by layer

Layer	Confidence	What it proves	How to run
Unit (Vitest)	A++	Auth cookies, CacheService/Auth whitebox, import-boundary, page gates, widgets, security	bun run test:unit · coverage: test:unit:coverage
Security regression	A++	Hooks + RBAC defense-in-depth (~2s local)	See AGENTS.md security command
Integration (black-box)	A++	HTTP + DB; crash restart; multi-adapter matrix in CI	bun run test:integration (SQLite) · bun run test:matrix (all 4 DBs)
E2E (Playwright)	A++	Browser goldens / P0 journeys; CI-parity preview :4173	bun run test:e2e (not Vite). Dev-only: test:e2e:dev
Benchmarks	Selective	Perf matrix; full suite is long — not every PR	See benchmarks

3. Testing tiers

Tier	Command	Time	Coverage
Pre-commit	bun run test:unit	~35s	2989 unit tests (0 skipped)
Pre-push	Automatic gate	~1.5min	Build + SQLite integration (595 tests)
Pre-CI (local)	bun run test:matrix	~8min	All 4 DBs (2380 tests)
CI	GitHub Actions	~30min	Full matrix + E2E (100%)

Gates (local → CI)

When	What runs (summary)
Pre-commit	1. Database safety (check-test-db-safety.ts) 2. Format + lint 3. Lint-staged 4. Unit tests
Pre-push	1. Production build (4 adapters) 2. bun test tests/integration/ (bun run gate)
Manual	bun run test:doctor (gate map + unit + SQLite integration) · bun run test:security
CI	Matrix whitebox → build → db-tests (4 DBs) → E2E prep + named groups → benchmarks

CI smart reporting (job Summary tab + annotations):

Job	Reporter
E2E prep / E2E shards	scripts/ci-report-playwright.ts — pass/fail counts, first error, fix hints, preview.log tail
bun test tests/integration/	bun test native output — per-file ✓/×, summary, no custom JSON
All Green	scripts/ci-report-all-green.ts — job matrix + fix order

Details: git-workflow.mdx

---

3. Hot areas (recent)

ContentSync / compilation / Collection Builder (2026-07-31)

Status	Unified coordinator — IDE edit + GUI save + boot share one path; soft HMR; surgical client patch when possible
Product	syncContentState reasons: boot · watcher · collection-save · gui-save · sidebar-reorder; GUI compile lock; atomic .js; hash-backed drift; tenant paths via tenant.server
Unit	sync-content-state (13+), collection-save-sync (2), schema-contract (6+ Valibot), compile-manifest (atomic/noOp/changedJsPaths), collection-store-reactive (patchActiveSchema)
E2E	collection-builder/builder.spec.ts — shell + soft-refresh (in-page mark survives save) + golden schema→entry→API
Docs	compilation-pipeline · content-system · collection-builder

/user — profile & management (2026-07-19)

Status	100% control map — product + unit + integration + E2E
E2E	7 specs: smoke, profile, management, invite, complete-coverage, p0-journeys, coverage-100
Product	Profile update: command remote + email fallback when session user_id stale after re-seed; plain-text toasts for assertions
Docs	routes/user.mdx · e2e-coverage-matrix §3

/dashboard — shell (2026-07-18)

Status	Shell 100% (widget catalog is install-specific — never fixed list)
E2E	dashboard.spec.ts — empty/grid, add/search/reset, pointer + keyboard reorder, toolbar, plugin slot
Unit	page.server permissions, widget-defaults categories
Integration	dashboard.test.ts health/metrics/logs/… APIs widgets consume
Docs	routes/dashboard.mdx

/mediagallery (2026-07-18)

Status	Shell + upload/delete + editor save + folders + bulk + move + remote upload
E2E	mediagallery, image-editor, folders-bulk, move-remote
Unit	mediagallery-page-server.test.ts
Docs	routes/mediagallery.mdx

/config/access-management (2026-07-19)

Status	Tabs + create role + save/reset + admin/tokens; sticky action .first(); tokens panel testids
E2E	config/access-management.spec.ts — create-role outcome, tokens panel (website-tokens-panel)
Product	Role modal response as 3rd trigger arg; website-tokens $effect loop fixed (density/columns sync + untracked fetch)
Unit	access-management-page-server.test.ts admin gate
Docs	routes/access-management.mdx

/config/system-settings (2026-07-18)

Status	Group nav/search, edit→save/discard, save+reload happy path, export/import, MT/GDPR
E2E	system/settings.spec.ts (shell + edit/discard + persistence)
Unit	page.server gate + settings-groups + settings-utils
Integration	settings.test.ts export/import
Docs	routes/system-settings.mdx

/config/redirects (2026-07-19)

Status	Admin gate + golden create→search→delete; primary store = redirectsMV (aligned with middleware)
E2E	config/redirects.spec.ts golden (MV list/search/delete)
Unit	redirects.server (MV insert/update/delete + normalizeRedirectRow) + redirects-utils + page load
Product	source/target on MV; content collection mirror best-effort; compound index idx_redirects_mv_lookup (tenantId, source, active)
Docs	routes/redirects.mdx

/config/queue + /config/monitor (2026-07-18)

Status	Admin gates, testids, queue filter URL + showConfirm; monitor resilient load
E2E	config/operations.spec.ts
Unit	queue-page-server + monitor-page-server
Docs	queue, monitor

/config/webhooks — Testing 2026 reference (2026-07-18)

Status	ADR reference — full three layers: unit + HTTP integration + golden E2E
E2E	config/webhooks.spec.ts (shell guard + golden journey only)
Unit	page.server + webhooks-utils + webhooks-api + fetchApi CSRF
Integration	tests/integration/api/webhooks.test.ts — list/create/delete + 401 unauth + editor deny
ADR	adr-testing-2026.mdx
Docs	routes/webhooks.mdx

/config/extensions (2026-07-18)

Status	Admin via isAdmin, tabs + plugins testids, toggle CSRF/toast
E2E	config/extensions.spec.ts
Unit	extensions-page-server.test.ts
Docs	routes/extensions.mdx

/config/automations (2026-07-19)

Status	automations-api + fetchApi CSRF; golden builder create→list→edit→delete; seed-search
E2E	config/automations.spec.ts — open editor via card link (not bare text / checkbox label)
Unit	page.server + automations-api
Docs	routes/automations.mdx · ADR

/config/workflows (2026-07-19)

Status	Shell + seed-workflow golden; name NOT NULL safe; states JSON normalized on read
E2E	config/workflows.spec.ts (toolbar/canvas + seed→GET by collectionId)
Product	workflow-service.saveWorkflow default name; testing API passes name; builder name fields
Docs	routes/workflows.mdx

/config/sync + /config/trash (2026-07-18)

Status	Admin gates, sync tabs/status testids, trash empty/table + restore confirm
E2E	config/data-ops.spec.ts
Unit	sync-trash-page-server.test.ts
Docs	routes/sync-trash.mdx

Ultra-smart auth & client safety (2026-07-18)

Status	P0 hardened — loopback cookies, testing dual-write, exhaustive import-boundary, session→18 admin pages
Unit	session-cookies, client-import-boundary (full client-root walk), login-cookie contract, page-guards, builder page.server, totp-encryption, registry-auth-hooks
Integration	session-page-load · webhooks · automations · config-admin-surface · collection-structure · security-negative config matrix
Docs	headless-test-inventory.mdx · auth.mdx

2FA Hardening & Plugin Auth Hooks (2026-07-30)

Status	35 new unit tests — AES-256-GCM TOTP encryption (round-trip, tamper detection, legacy compat), trusted device tokens (gen/verify/reject), afterAuthenticate hook (deny/requires2FA/fail-open/skip disabled), configurable TOTP window
Unit	tests/unit/auth/totp-encryption.test.ts (20 tests), tests/unit/plugins/registry-auth-hooks.test.ts (15 tests)
Product	TOTP secrets encrypted at rest; pending setup state (resumable enrollment); __Host-2fa-trusted-device cookie; plugin auth hooks in signInInternal
Docs	auth.mdx · authentication-system.mdx · plugin architecture

Databases whitebox + enterprise storage (2026-07-20)

Status	tests/unit/databases/ green (0 skip for soft-delete under Bun; magic-link + CacheService fixed). Real proofs — not mock-only theater for Auth lockout, credential cache, boot helpers
Unit	cache-service (always-tenant keys, pattern clear), credential-auth-cache (real L1), auth-lockout (real Auth), soft-delete (mongoose stub), database-resilience / CORRUPT_CONFIG, magic-link privacy
Product	CacheService set/get tenant default alignment; clearByPattern wildcard tenant; fail-fast CORRUPT_CONFIG → MISSING_CONFIG
Enterprise	Transactional outbox, plugin storage, schema lifecycle hooks (beforeValidate/afterValidate), media jsonPath — unit + integration seeds
Manifest	tests/critical-test-paths.ts (replaces p0-manifest/registry) · runners: scripts/run-integration.ts, run-e2e.ts, test-doctor.ts
Docs	database-tests.mdx · plugin-storage · outbox · schema hooks

Other solid areas (summary)

Area	Notes
Auth & users API	Strong integration (login, batch, avatar, sessions, 2FA) + page-load session
Security hooks	Dedicated regression suite in pre-commit/push
Collection builder	E2E = shell + soft-refresh + golden (builder.spec.ts); structure/utils unit+integ; ContentSync unit suite
Content / compile	ContentSync coordinator + schema contract + compile manifest; see hot area above
Site starter / preview	Smoke E2E + unit; deep iframe edit still open
Data operations	Strong unit; thin browser E2E
Multi-tenant	Unit/guard coverage; E2E isolation spec exists, gated behind MULTI_TENANT=true
Stores unit	tests/unit/stores/ (reactivity, patchActiveSchema, structure fingerprint, floating-nav-store 22)
Admin chrome	command-palette (18) + floating-nav-store (22) + logger (7) + widget-naming (12) unit tests; hotkeys Mod+K/Alt+G unified

Deeper inventories: headless-test-inventory · e2e-coverage-matrix · three-layer-completeness.

---

4. Open gaps (actionable only)

Only open product/test risks. Closed items stay in route docs / ADR changelog — not duplicated here.

Gap	Priority	Why it matters
Multi-DB contract without asterisks	🟠 High	Headless ship gate — all adapters must match contract suite
Multi-tenant browser isolation	🟡 Medium	E2E spec exists (isolation.spec.ts), gated behind MULTI_TENANT=true env
Session vs DB identity after wizard reset	🟡 Medium	Phase-1 wizard can race firstuser; profile has email fallback — harden setup order
Redirects/queue remotes (no REST)	✅ Closed	Remote admin + redirectsMV primary + unit; queue-actions
Config residual goldens (access/auto/wf)	✅ Closed	Local focused chromium 16/16 (2026-07-19) after product fixes
Data operations deep E2E	🟢 Lower	Sync/trash shells covered; migration wizard still plugin-gated
Cache L2 (Redis) integration	🟡 Medium	L1 whitebox + contract strong; Redis L2 path still thin
GraphQL browser E2E	❌ Skip	Integration only — do not add browser GraphQL as a gate
SSO/OAuth real IdP	🟡 Medium	Mock-only in CI
Builder E2E sprawl	✅ Closed	Consolidated to shell + golden; 8 specs removed
Plugin deep E2E, breadcrumb media drag-move	🟢 Low	Optional polish

---

5. What to run locally

# Pre-commit (full suite)
bun run precommit

# Before push
bun run prepush

# Unit only
bun run test:unit

# Ultra-smart unit slice (auth, boundary, queue/redirects remotes)
bun run test:unit -- tests/unit/auth/session-cookies.test.ts tests/unit/live/client-import-boundary.test.ts tests/unit/api/testing-login-cookie-contract.test.ts tests/unit/utils/page-guards.test.ts tests/unit/routes/collectionbuilder-page-server.test.ts tests/unit/routes/queue-remote-admin.test.ts tests/unit/routes/queue-actions.server.test.ts tests/unit/routes/redirects-remote-admin.test.ts tests/unit/api/namespace-ownership.test.ts

# Databases whitebox + Auth lockout (real CacheService / Auth / boot)
bun test tests/unit/databases/ tests/unit/auth/auth-lockout.test.ts

# 2FA encryption + trusted devices + plugin auth hooks (35 tests)
bun test tests/unit/auth/totp-encryption.test.ts tests/unit/plugins/registry-auth-hooks.test.ts

# ContentSync / compile / schema contract / builder soft-HMR slice
bun run test:unit -- tests/unit/content/sync-content-state.test.ts tests/unit/content/collection-save-sync.test.ts tests/unit/content/schema-contract.test.ts tests/unit/compilation/compile-manifest.test.ts tests/unit/stores/collection-store-reactive.test.ts tests/unit/collectionbuilder/

# Integration (SQLite) — session-page-load, webhooks, automations, config surface, security-negative
bun run test:integration
# or reuse build: bun test --timeout 300000 tests/integration/

# E2E CI-parity (preview :4173 — not Vite)
bun run test:e2e

# Collection Builder shell + soft-refresh + golden
bun run test:e2e --project=chromium tests/e2e/routes/collection-builder/builder.spec.ts

# Focused residual config/user goldens (example)
bun run test:e2e --project=chromium "--grep=redirects|Edit User Details|website tokens|automations|workflows|webhooks|Dashboard shell|create role"

# Smart test selector (auto-detects from git diff)
bun run test:smart

Safety: tests must never point at production DBs — see test-config safety guards in git-workflow.mdx.

---

6. Where to dig deeper

Need	Doc
Headless-first tiers & route↔layer map	headless-test-inventory.mdx
Strategy & three-layer goal	testing-strategy.mdx · three-layer-completeness.mdx
ADR (pyramid, soft-skip ban, goldens)	adr-testing-2026.mdx
Route E2E matrices	e2e-coverage-matrix.mdx · routes/webhooks.mdx
Collection Builder / ContentSync	routes/collection-builder.mdx · compilation-pipeline
/user control map	routes/user.mdx
Security testing	security-testing.mdx
Benchmarks	docs/project/benchmarks
API coverage	api-testing.mdx · api-test-coverage.mdx

---

7. How to keep this page honest

When you ship a meaningful test or stability change:

1. Update this file if health, open gaps, or hot areas change (few sentences + table rows).
2. Put deep control maps and file-level inventories in route docs or headless-test-inventory — not a separate archive.
3. Never treat static totals as CI truth — GitHub Actions is the live board.