agiledancers/docs/s4-validation.md

S4 verification evidence

Date: 2026-10-28. Status: repository implementation and local container verification passed; operational Gitea acceptance remains pending. S4 is not complete.

Verified locally

• Gitea reports version 1.25.4; repository wanjakrah/agiledancers has Actions enabled and uses main as its default branch.
• Docker Desktop was started on the existing Linux x86_64 mini-PC. Its Docker daemon reports linux/x86_64 (linux/amd64). This is not evidence of the Synology's architecture.
• mvn clean verify passed, including all 20 backend tests and architecture tests.
• npm ci, all 14 frontend unit tests with JUnit output, and the production build passed in the full verification script.
• Both runtime images built successfully with the prebuilt targets. The images package the same outputs that passed verification.
• Both existing Playwright tests passed (2/2) using the built frontend and backend containers, the frontend /api/ proxy and Chromium in the version-matched Playwright container. No Angular development server was used.
• The full ci/verify.sh execution exited successfully; its trap removed all three temporary test containers and the run network.
• Eleven isolated CI tests pass: failed verification removes its success marker, feature branches do not publish, unverified commits cannot publish, reruns preserve commit tags, partial publication is recoverable, authentication and pull failures block publication, older commits do not move main, platform mismatches fail, and daemon configuration preserves existing settings.
• Shell syntax, Python compilation, workflow YAML parsing and the changed files' whitespace checks passed.
• Runner v0.2.13 was downloaded from the official source, SHA-256 checked, and installed with its user-service configuration using --prepare-only. The runner was subsequently registered and its user service started using the supplied repository administration credentials.
• The internal registry was merged into Docker Desktop's daemon configuration, preserving existing settings and a backup. Docker Desktop was restarted and the running daemon confirmed that 192.168.2.28:3000 is an active HTTP registry.

Local outputs are in ci/artifacts/ (ignored by Git): verify log, backend test reports, frontend unit JUnit report, Playwright JUnit/HTML report and container logs. These are local files, not yet artifacts uploaded by a real Gitea run. The unit JUnit report uses a separate directory so Playwright output cleanup cannot delete it.

The local test used working-tree changes on base commit e3e362c2ac30d6b365f752f3da6c8b0250c019db, with run ID s4local. These local images are test outputs, not published release images for that commit.

Local image IDs (not registry digests):

• Backend: sha256:bd77a46e3dbdcaea9662d21c608098999fe17dfdf241cd28a24a935f47401f61.
• Frontend: sha256:ce8e6ab21fb8f9cbee280ac2c4d7b4ca24a30e899a457382f1e45c6baf99dfb6.

Remaining operational acceptance

• Synology architecture confirmed by the maintainer: x86_64, linux/amd64; repository variable TARGET_PLATFORM=linux/amd64 configured.
• Activate and verify the Docker Desktop HTTP-registry setting.
• Repository REGISTRY_USER/REGISTRY_TOKEN secrets configured using the supplied token files. Registry access is verified by actual publication below.
• Runner ID 1 (agiledancers-mini-pc) registered, service started and online in Gitea. Real feature/failure jobs ran on this runner.
• Confirm server settings permit every branchpush (including messages with skip strings) and retain uploaded diagnostic artifacts for fourteen days.
• Feature run #1, API run ID 2, commit 74a5aa12377d4a62cdebe1dcd6e8a8e1443b33fb: succeeded, two container E2E tests passed, publication skipped. Diagnostic ZIP was downloaded and verified (23 files).
• Failure probe #2, API run ID 3, temporary branch feature/s4-ci-failure, commit 6d94c68756a90c5e87590e6fd137de8aa5cd9395: failed at the deliberate backend test; imagebuild/publication did not run. Diagnostic ZIP was downloaded and verified (15 files). The probe is absent from the real featurebranch.
• Real main run: record URL/run ID, both full-SHA images, successful pullback, registry digests and the two main aliases.
• Real rerun/partial-publication recovery and stale-main evidence: record run IDs and unchanged existing commit digests.

The isolated publication tests provide automated control-flow coverage; they do not substitute for real authenticated registry/Gitea acceptance runs. No application images have been published and no application has been deployed by this work.

Gitea 1.25 does not populate gitea.run_attempt; the workflow generates a unique attempt identifier for containers and diagnostic artifact names. The Gitea v3 artifact-list API returns an empty list despite successful uploads; artifacts were verified by downloading the run-page archive URLs. This is separate from artifact availability and does not require a server upgrade.