# Journey E2E coverage matrix The single index mapping every journey in this folder to the Playwright spec(s) that guard it, with a coverage-depth grade. This is the source of truth for "is this flow tested, and how well". See [`../00-conventions.md`](../00-conventions.md) § _E2E test coverage_ for the cross-link convention and the depth rubric, reproduced here: | Depth | Meaning | | ----------- | ----------------------------------------------------------------------------------------------------------------------- | | **deep** | Drives the journey's interactions, asserts state transitions + post-conditions, exercises ≥1 failure mode. | | **partial** | Exercises some steps but skips key interactions, failure modes, or post-conditions. | | **shallow** | Smoke only — asserts a heading/URL renders; does not drive the journey's interactions. (The test-equivalent of a stub.) | | **none** | No spec meaningfully covers the journey. | Specs live under [`../../apps/oshun/web/e2e/`](../../apps/oshun/web/e2e/). Every journey-backing spec carries a `Journey:` header comment pointing back here; every journey doc carries an `## E2E coverage` section. When you add or deepen a spec, update **all three**: the spec header, the journey's section, and this row. > **Nisaba note (2026-06-26).** `nisaba-scholarly-read` now drives the compact > `/nisaba` language buttons through Pali, English, and Both, asserting > `aria-pressed`, active-language attrs, and the reading body swap against the > live `passageBodies` payload. > **Walkability note.** The journey docs were written before several backing > routes/endpoints shipped, so a number of "BFF TBD / route does not exist" > open-questions are **stale** — verified 2026-06-04 against source. Routes that > exist today: `/arete/offering`, `/arete/review`, `/veritas/retraction`, > `/atelier`, `/atelier/image`, `/aaa-upgrade`, `/billing/crypto`, > `/metis/byom`, `/metis/tutor`, `/operator/admin/isis/provenance`, > `/operator/{tenant,metis,incidents,studio,sso,audit}`. BFF routes that exist: > `customer-message-center.ts`, `user-reports.ts`, `telegram.ts`, > `admin-audit-log.ts`, `themis.ts`, `data-deletion.ts`, `data-export.ts`, > `living-scenes.ts`, `admin-tenant-console.ts`, SCIM in `domain-stubs.ts`. The > one genuinely-absent surface is the customer appeal UI > `/integrity//appeal` (themis) — that journey's appeal-form step > stays `none` until the route ships; its verdict + operator-review steps are > walkable. ## At a glance (baseline audit 2026-06-04) | Depth at baseline | Count | | ----------------- | ----- | | deep | 1 | | partial | 29 | | shallow | 11 | | none | 11 | | **total** | 52 | **Progress (2026-06-04).** 25 journeys were authored or deepened to real coverage and **verified green** against a live web + BFF stack — the entire MISSING + SHALLOW set plus the six customer-domain entries. A subsequent **deepening wave** then added **12 runtime-verified specs (53 tests green, `--workers=1`, no stubs/fixtures)** that lifted **14** previously cross-linked baselines into driven, failure-mode coverage: `scene-password-and-grants` (scene ×3 — multi-context password gate, download-grant redemption/media integrity, unlock-token tamper, abuse reports, rate-limit), `pwa-lifecycle-deepening` (PWA ×3 — cache purge, offline banner/retry, deterministic reduced-motion spinner), `notifications-preferences-api`, `editorial-release-streams`, `persona-governance` (BFF scope/validation/state-conflict gates), `nyx-event-ics`, `onboarding-deepening`, `first-time-visitor-deepening`, `first-tara-sit-deepening`, `assistant-handoff-deepening`, `multi-device-handoff-deepening`, and `sophia-grounded-deepening`. The remaining partial/deep **baseline** journeys stay bidirectionally **cross-linked** (their surface-specs cover the surface; see each journey's `## E2E coverage` for per-step gaps — the baseline suite relies on the config's `retries: 1`). The two formerly **deferred** journeys are now wired A-to-Z: `agentic-pipeline-customer-invocation` has a real customer "Run Now" surface on `/arete/review` driving the AgentRun lifecycle (request → confirm/discard) against the live BFF (`agentic-pipeline-runnow-arete`), atop the BFF execution + governance core (`agentic-pipeline-invocation`); only the downstream tool-execution loop + provenance hash-chain stay executor-bound (fail-closed without provider creds). `themis-assessment-appeal` is no longer blocked — the `/integrity//appeal` route + page shipped this session (`integrity-appeal`). Every journey now carries an `## E2E coverage` section and every journey-backing spec a `Journey:` header. Status legend: `✅ verified` (authored + green) · `✅ cross-linked` (baseline spec, partial depth) · `deferred` / `blocked` · `render-only (specimen)` (the spec is green but the surface is a server-rendered design specimen with no backend/onClick, so depth is `shallow` until the product ships the interaction). **Quality pass (2026-06-05).** An adversarial re-audit of all 52 journey specs (8 parallel read-only auditors) drove a correctness wave — see [`../results/journey-e2e-quality-audit-2026-06-05.md`](../results/journey-e2e-quality-audit-2026-06-05.md): (1) the one true **tautology** killed — `messages-center` faked its inbox via `page.route`-fulfill; the producer seam was missing, so a real `POST /v1/admin/customer-messages/dispatch` route was added and a real-HTTP `messages-center-bff` spec now drives the genuine deliver→read→archive→unsubscribe→suppressed lifecycle. (2) **Dead/misleading scaffolding removed** — the dead `stubSso` (server-component, never fired) + a dead 52-line memory conflict helper + false "Run Now not wired"/"unwired span"/grace-cancel/step-2 headers. (3) **Grade honesty** — `weekly-review-arete`, `veritas-retraction-cascade`, `metis-byom-ingest`, `atelier-image` corrected deep→**shallow** (render-only specimens); `sophia-grounded-answer`, `editorial-review-approval`, `citation-drift-resolution`, `nyx-tonight-observation` + the three scene journeys corrected deep→**partial** to match reality / the journey docs. (4) **Real depth added** — offline `/healthz` BFF-unreachable probe, user-flag all-10-categories, veritas→nisaba real-surface destination + reframed failure mode, tenant-audit bookmark/share legs, tenant-invite invalid-email + seat-capacity (409), and later invite acceptance/cockpit read-back/reuse guards. (5) **Cross-link triangle reconciled** — missing `Journey:` headers added (`metis-tutor-session`, `metis-assessment-submit`, `nyx-event-pages`→nyx-tonight) and every journey doc now carries a `**Coverage depth**` line. **Quality pass — Wave 2 (2026-06-05, "address all other gaps").** Drove the remaining FEASIBLE gaps to real tests and catalogued the rest as product gaps (documented, never faked — see [`../results/journey-e2e-quality-audit-2026-06-05.md`](../results/journey-e2e-quality-audit-2026-06-05.md) § "Resolution log — Wave 2"). Killed the nisaba search step-1 tautology with a real-BFF re-issue (+ a real WCAG fix to the WorkspaceControls count badge); added SCIM PATCH/DELETE, audit-quota (store unit), agentic approver-gate, themis appeal min-length, telegram verify-initdata HMAC (→ messages-quiet-hours binding), lilith-studio failure modes, scene embed/delete/tenant-auth/policy, metis word-count gate, cookie-accept, memory wrong-step-up-phrase, and weak-assert tightening. Confirmed PRODUCT gaps (not test gaps): incident static filter chips + localStorage fake decision panels, absent `/scene`+`/atelier` error.tsx, the citation-drift write-action gap, the tara-daily different-streak- models inconsistency, the absent operator review UIs, and the Sophia grounding pipeline. `messages-quiet-hours` corrected deep→**partial** (config + Telegram-HMAC layers, shipped bind→verify→revoke UI, and BFF quiet-hours dispatch delay/bypass now driven; external-channel replay, persona, and full revocation cascade remain unbuilt/undriven). **Quality pass — Wave 4 (2026-06-05, independent adversarial re-audit of all 52 journeys).** Full fix-list in [`../results/journey-e2e-quality-audit-2026-06-05-wave4.md`](../results/journey-e2e-quality-audit-2026-06-05-wave4.md). (1) **Fixed a BROKEN spec** — `operator-editorial-review-approval` asserted the retired `awaiting audit replay` string; Wave-3 had rewired the panel to a real admin-gated BFF write that 403'd under its non-admin session. Re-issued the decision POST with an admin bearer; asserts the real `data-decision-audit-id`. (2) **Killed two false-green tests** — the `pwa-lifecycle` cache-purge (`currentCachePresent || staleCacheAbsent`, always true in the mock-SW env) is now a real apply-handshake e2e, a genuine `sw.js` activate-eviction **unit test**, and a later real-browser ServiceWorker + Cache Storage activation proof; the `citation-drift` hash-chain core (under `if (inspectorVisible)`, silently no-op in the default no-ledger env) first moved to visible skips in Wave 4, then the 2026-06-23 pass replaced those skips with a harness-only Isis fixture ledger plus clean/broken/unavailable/empty browser assertions. (3) **Real depth added** — quiet-hours GET-after-PATCH **persistence round-trip** (the window genuinely survives, the patch response only mirrored a different store), user-flag visible min-length **error element** (empty-rationale JS guard, not the native gate), public-scene **empty-detail accepted**. (4) **Cross-link triangle completed** — replaced the generic "Backs the journey" header with accurate per-step `Covers:` lines on **33 specs**, added the missing `nisaba-scholarly-read` back-link to the two split-view/compare specs, the `tara-daily-ritual` headers to the player specs (lifting it to a legitimate cross-spec **deep**), and the `tenant-bulk-member-invite-scim` Path-B back-link to `tenant-member-actions`. (5) **Grade honesty** — `veritas-evidence-trail` deep→**partial** (now BFF-backed for the grounded-lead happy path; browser failure mode and static claim/source drill remain open), `veritas-to-nisaba-deeper` row reconciled deep→**partial** to match its doc, editorial prose de-staled (real audited BFF write, not localStorage `setTimeout`), `nyx-tonight` doc `passage=`→ `topic=night-sky` (verified against source + tightened the spec assert). **Confirmed-and-left** (verified, not faked): the audit-investigation quota is already store-unit-covered (a 100-POST e2e would be redundant); the Sophia grounding pipeline, billing-crypto paywall, and the operator review UIs stay honestly graded + documented. The formerly open SCIM `201`/Postgres path is now covered by `tenant-member-invite-scim` (2026-06-24: POST → GET → PATCH → DELETE → revive plus canonical mirror). **Quality pass — Wave 5 (2026-06-05, fresh 7-auditor adversarial re-audit of all 52 journeys + fixes verified green on a live web+BFF stack, `workers=1`).** Full fix-list in [`../results/journey-e2e-quality-audit-2026-06-05-wave5.md`](../results/journey-e2e-quality-audit-2026-06-05-wave5.md). (1) **4 new wireable tests** (all green): `first-tara-sit-deepening` ×2 — exit-at-<80% → shame-free `partially-completed` surface, and an **offline reflection queue** (navigator offline → `tara:reflection:` localStorage + "saved locally, will sync" hint); scene **`?error=missing-password`** gate render; scene **mass-share `429 mass_share_pattern`** (`x-oshun-share-burst-max` burst guard). (2) **Two prior-auditor premises were WRONG and a live run caught them** — `messages-center` mark-read refresh is served by the real **unseeded** BFF ("0 unread of 0", not a stubbed "of 2"), and the **`/nisaba` reading desk renders the SSR `unavailable` fallback** in e2e (the room fetch is unauthenticated), so the chip test's stale `'Greek'` claim and a pinned passage title were both fictional; both reverted to assert the **real** rendered state and the masking `||`-disjunction killed. (3) **Cookie-consent "rejected suppresses the PWA prompt" is fiction** across 3 PWA journeys — the gate is `cookieConsent !== null`, so reject _resolves_ consent; corrected to the **unresolved** gate the spec actually drives. (4) **Scene studio-card keep/share are client-only soft-notices** on the `auth:anon` page (no BFF persistence) — over-claim corrected in the spec header + journey doc; the real keep→share→viewer lifecycle is the authenticated request-fixture tests. (5) **Assertion tightenings**: aaa `lang`→`'en'`, metis quiz exact `1 of 4 correct`, agentic `runStatus`→`'running'`, incident heading exact `6 open · 1 critical`, SCIM DELETE 503 SCIM-Error body, nisaba-notebook unconditional format buttons (vacuous `if(count)` guards removed), assistant-invocation exact `International Energy Agency`. (6) **themis** appeal-filed Case(=verdictId)/Status read-back asserted (proves real bridge data, not a placeholder). (7) **Cross-link/doc honesty**: `explore-blended` Arete→Nisaba/Metis, `metis-byom` step-7 claim, `tenant-onboard` Covers 1–3→1–2, `assistant-handoff-deepening` outcome `applied`, two `durable`-reload tests relabelled localStorage-rehydrate, `lilith-studio` two now-covered failure modes, `tenant-scim` wired-buttons, `citation-drift` seeded-ledger prose. **Confirmed product gaps (documented, not faked)**: the `messages-center` unsubscribe test carries a pre-existing form-submit/route-capture timing flake (passes on retry). The earlier Arete streak-heatmap a11y gap was closed later: cells now carry date + state labels and are covered in `arete-streak-recovery`. **Quality pass — Wave 6 (2026-06-05, fresh 8-auditor adversarial re-audit of all 52 journeys; doc [`../results/journey-e2e-quality-audit-2026-06-05-wave6.md`](../results/journey-e2e-quality-audit-2026-06-05-wave6.md); all green, branch+main).** The audit's headline finding: several journey docs declared real, registered BFF routes "absent / product-blocked / canned" — they exist and were simply untested. **11 new real-HTTP BFF specs** now drive them (probed live before asserting): `arete-habits-bff` (POST /v1/arete/habits persist + GET round-trip + 422 — replaces arete-full-journey's page.route mock with the genuine engine), `metis-ingest-bff` (/v1/metis/ingest + /v1/metis/courses — disproves "no POST route"), `sophia-answer-bff` (/v1/sophia/answer envelope + the no-sources **abstention** contract — never fabricates), `entitlements-aaa-bff` (/v1/entitlements/aaa tier gate — the aaa-upgrade open-question #4), `psyche-tutor-memory-bff` (/v1/metis/tutor-session-memories mastery-posterior fold — disproves "route absent"), `nisaba-notebook-bff` (notebook create→rename→GET CRUD — disproves "no write endpoint"), `library-shared-resolution` (recipient share-link **resolution** grant/wrong-403/ revoked-403 — the headline opt-out invariant collection-share created links for but never resolved), `tenant-invite-role-bff` (invite roleIds round-trip + 403 non-admin), `telegram-binding-bff` (login-widget iris binding scopes + step-up gate), `persona-rehearsal-bff` (rehearsal lifecycle + tone-calibration on seeded persona-zen-guide + gates), `admin-auth-policy-bff` (auth-policy evaluate verdicts — honest sibling of the tenant-SSO journey, NOT its claim-mapping panel). Plus **deepenings**: tara Begin-sit telemetry contract (`tara-full-journey`), multi-device handoff-write **failure mode** (`workspace-multi-panel`). **Test-hygiene fixes**: repointed `veritas-nisaba-bridge`'s source-directory test off the unmounted `SourceDirectoryOverlay` dead code onto the live `VeritasSourceDirectory → SourceProfile` affordance (it now drives + navigates to the real Nisaba surface); killed silent-pass conditionals in `pwa-smoke` (theme-color/apple-meta unconditional, /sw.js served, skip-link count≥1) and the vacuous `cardCount===0` escape hatch in `library-save-collection-share`. **Stale doc claims struck** in psyche / sophia / metis-byom / nisaba-notebook journey docs. `metis-byom-ingest` lifted **shallow→partial** (real ingest/course BFF now covered; 2026-06-29 browser proof added for `/metis/ingest` text outline and `/metis/courses/new` proposal → `/metis` draft hydrate). **Strict-read grade note (transparency, not churned):** the audit graded `first-time-anonymous-visitor`, `install-as-pwa`, `offline-first-time-use`, `pwa-update-flow`, and `multi-device-workspace-handoff` **partial** on a strict reading (a key step + several failure modes are product-blocked — email verify/Mailpit, SW-reg-fail, BFF round-trip); they retain **deep** on the rubric's "exercises ≥1 failure mode" bar, with the uncovered steps documented in each journey doc. **Confirmed product gaps (documented, not faked):** onboarding has no inline-error UI on patchProfilePreferences failure; nisaba notebook item-capture needs a resolvable refId; veritas `/v1/veritas/briefing/home` 500s on an upstream fetch in e2e; telegram payments settlement is provider-env-gated. **Wave 7 (2026-06-06) — BUILT the wave-6 "deferred product-feature backlog" (the user directed "all locally-actionable, 0 deferral; build the local seam fail-closed for external-cred parts, use expert judgment for inert-button behaviors"). All shipped real + e2e-verified green, branch+main.** Product features wired A-to-Z (each: a lightweight BFF store+route over a real concept + a client island + a web→real-BFF e2e): - **arete close-the-week** (`arete-review-close`): "Close the week"/"Save as private letter" → POST /v1/arete/review/close (week-closed / kept-private) plus `/arete` continuity read-back through `/v1/arete/room`. **weekly-review-arete shallow→partial.** - **arete recovery offers** (`arete-streak-recovery`): the inert offers + "Begin · 6 min" now navigate to faithful targets (a calming /tara/sit, /arete/plan) — closes step 5. - **arete living-offering keep/send** (`arete-offering-actions`): Save draft / Send → POST /v1/arete/offerings/keep (draft-kept / delivered). - **atelier save + cast** (`atelier-plate-actions`): Save plate → web library (generated-artifact); "Cast twelve more" → POST /v1/atelier/cast, a REAL fail-closed Stability image seam (503 provider_not_configured without creds). **atelier-image-to-library shallow→partial.** - **metis operator BYOM decision** (`metis-byom-decision`): approve/request-changes/reject → POST /v1/admin/metis/byom/decision (audited, admin-scoped). 2026-06-30 addendum: the browser spec now drives the reject branch through `/operator/metis`, and the BFF assertions require non-empty audit ids for all three decision outcomes. - **AdminInbox selection-reactive** (`incident-triage` +new selection test): clicking a queue row swaps the detail card + binds the decision panel to that incident (was hardcoded to INC-2041). - **onboarding finish-error** (`onboarding-lifecycle`): a genuine 5xx preferences-sync failure is now surfaced non-blockingly (syncProfilePreferences discriminates 5xx from offline-first 401/404). - **OperatorSso/Audit empty-branch unit tests** (server-component test pattern established). - **lilith-studio scene publish** (`lilith-scene-publish`): publish → POST /v1/admin/studio/scenes/publish (dedicated, studio:editorial-scoped — the release-stream route was scope-mismatched). **Hard-won gotcha (documented for future builds):** importing the `LBtn` _component_ into a `'use client'` island BREAKS the client boundary (the page renders blank) — islands use plain `