Juan DenisandClaude Opus 5 b2fd1198be test(api): ratchet the statuses derived from error prose, ahead of milestone C ...

Plan 76 milestone C, drift/bug row 3 — the ratchet only. 23 sites choose an
HTTP status by searching an error message:

    status = 403 if 'denied' in result.get('error', '').lower() else 400

That is what `{'success': False, 'error': '<prose>'}` forces on a caller: the
service knew the failure was a denial, discarded it, and the route rebuilds it
from the sentence. The status is then coupled to the wording — rephrasing
"Access denied: path not in allowed directories" to "You do not have access to
this path" turns a 403 into a 400 and nothing fails, not a test, not a lint
rule.

The migration is NOT done here on purpose. Converging these means services
raising typed errors instead of returning result dicts, and file_service alone
(12 of the 23 sites) has eight callers. Converting it to raise while its other
callers still expect a dict leaves two contracts, which is the disease rather
than the cure — that is milestone C's envelope decision, sequenced after A and
B by the plan's own execution order.

So the ratchet lands first, per second-wave rule 1, to stop the pattern
spreading in the meantime. Ceiling 23. Counts a conditional choosing between
two HTTP status codes whose test inspects string content (`in`, `.lower()`,
`.startswith()`); a status chosen from a typed exception, an enum, or a boolean
is not counted, since that is the thing being asked for. Verified non-vacuous:
an injected site fails it and it passes again on revert.

Gate: tests/test_status_sniffing_ratchet.py, 8 passed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-18 20:48:33 -04:00

..

fixtures/runtime-extension

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

api_controller_boundary_baseline.json

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

api_controller_boundary_scan.py

test(api): ratchet controller boundary debt

2026-08-18 03:11:37 -04:00

BASELINE_COUNT

refactor: finish the §G1 subprocess migration (census 195 -> 28)

2026-08-18 16:38:25 -04:00

check_test_count.py

ci(tests): add test-count ratchet + changelog recovery-parity (plan 42 ph6)

2026-07-09 05:27:22 -04:00

conftest.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

IDENTITY_DOOR_CEILING

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

identity_door_census.py

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

popen_guard.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

RAW_SUBPROCESS_CEILING

refactor: finish the §G1 subprocess migration (census 195 -> 28)

2026-08-18 16:38:25 -04:00

raw_subprocess_census.py

refactor(system): run_checked() and a ratchet on the raw subprocess surface

2026-08-18 12:05:17 -04:00

STATUS_SNIFFING_CEILING

test(api): ratchet the statuses derived from error prose, ahead of milestone C

2026-08-18 20:48:33 -04:00

status_sniffing_census.py

test(api): ratchet the statuses derived from error prose, ahead of milestone C

2026-08-18 20:48:33 -04:00

subprocess_stub.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_activity_summary_rollup.py

perf(api): stop /status/apps spawning a subprocess per app, and roll up the activity summary

2026-08-12 18:15:53 -04:00

test_agent_features_honest.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_agent_installer_endpoints.py

fix(api): honest errors for the installer routes, and the right agent repo

2026-08-16 05:27:08 -04:00

test_agent_poll_e2e.py

test(agent): end-to-end test for the panel<->agent command loop

2026-06-12 17:31:26 -04:00

test_agent_poll_ratelimit.py

fix(agent): rate-limit the poll /connect auth path

2026-05-31 14:46:47 -04:00

test_agent_registry_security.py

fix(agent): fail-closed agent registration + surface stuck-command errors

2026-05-31 16:08:13 -04:00

test_agent_update_authz.py

fix(servers): require developer role for agent self-update (audit H3)

2026-06-12 17:33:29 -04:00

test_ai_assistant.py

feat(ai): add core AI assistant primitive powered by Prompture

2026-06-01 02:39:05 -04:00

test_ai_lazy_import.py

perf(ai): keep Prompture out of the panel's boot path (-24 MB RSS)

2026-07-25 14:15:29 -04:00

test_api_authz_hardening.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_api_contracts.py

feat(api): add typed endpoint contracts and envelopes

2026-08-18 02:47:57 -04:00

test_api_controller_boundaries.py

test(api): ratchet controller boundary debt

2026-08-18 03:11:37 -04:00

test_api_error_shape.py

feat(api): centralize typed errors and request correlation

2026-08-18 02:42:25 -04:00

test_api_key_identity.py

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

test_api_scopes.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_app_deploy_jobs.py

fix(api): close IDOR/authz gaps across deployment jobs, vaults, queues, docker, databases

2026-08-04 08:53:27 -04:00

test_app_resource_limits.py

fix(deployments): stop stuck 0% installs, deploy repo apps on create, unify install UX

2026-07-21 22:57:33 -04:00

test_app_volumes.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_application_soft_delete.py

feat(recycle-bin): applications are soft-deletable, and a delete stops keeping data hostage

2026-08-12 20:26:04 -04:00

test_attach_domain.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_audit_log.py

feat(activity): audit feed filters by target_id

2026-08-09 13:53:59 -04:00

test_auth_decorator_boundaries.py

refactor(auth): enforce one policy boundary per route

2026-08-18 02:42:39 -04:00

test_authz_structural_sweep.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_available_servers.py

feat(servers): store the agent's self-reported footprint dirs

2026-07-02 22:36:34 -04:00

test_backup_alerts.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

test_backup_crypto.py

feat(backups): client-side encryption (opt-in, reuses the Fernet key)

2026-06-19 13:22:43 -04:00

test_backup_db_files_executors.py

refactor(unify): §8 Phase B2 — database + files executors in policy service

2026-06-24 14:19:32 -04:00

test_backup_drill_cadence.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

test_backup_drill_docker.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_backup_drill_honesty.py

fix(backups): a skipped restore drill no longer reads as proof

2026-08-17 21:03:06 -04:00

test_backup_drill_integrity.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

test_backup_drill_scheduling.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_backup_drill.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

test_backup_expectations.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_backup_generic_api.py

refactor(unify): §8 Phase B5 — generic backup-policy CRUD for every target

2026-06-24 14:27:08 -04:00

test_backup_global_api.py

refactor(unify): §8 Phase B3 — global backup policy/run listing API

2026-06-24 14:20:43 -04:00

test_backup_offsite.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_backup_protection.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

test_backup_target_types.py

security: hook seam lifecycle + registrant binding

2026-08-05 13:36:33 -04:00

test_backup_verify_honesty.py

fix(doctor): a failed backup verification no longer reads as verified

2026-08-17 21:15:45 -04:00

test_backup_verify.py

feat(backup): trust round 2 — restore drills, offsite/verify (plan 30)

2026-07-07 20:29:25 -04:00

test_bandwidth.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_botocore_prune_contract.py

build(docker): halve the panel image, 1.07 GB -> 501 MB

2026-07-25 12:38:56 -04:00

test_buildpacks.py

feat: Phase 2 developer experience — build packs, config snapshots, catalog certification

2026-06-23 18:49:04 -04:00

test_builtin_extension_drift.py

test(extensions): fail when a bundled extension's two copies diverge

2026-08-17 20:07:26 -04:00

test_capacity_preflight.py

feat(templates): tell people whether a template actually fits the server

2026-07-25 15:48:36 -04:00

test_cli_api.py

feat(cli): API-backed operator verbs and diagnostic support bundle

2026-07-03 15:21:22 -04:00

test_cli_json.py

feat(cli): --json output on read-only admin CLI verbs

2026-07-11 01:22:49 -04:00

test_cli_manifest.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

test_cloud_provision_extraction.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_cloudflare_extraction.py

feat(extensions): Phase 5 — extract Cloudflare zone-ops into serverkit-cloudflare-ops

2026-07-02 01:04:03 -04:00

test_cloudflare_round2.py

feat(cloudflare): restore Round 2 engine — DNSSEC, Origin CA, rules, activity (plan 42 ph2)

2026-07-09 05:02:54 -04:00

test_cloudflare_zone_settings.py

feat(extensions): Phase 5 — extract Cloudflare zone-ops into serverkit-cloudflare-ops

2026-07-02 01:04:03 -04:00

test_compose_env_overlay.py

fix(deployments): stop stuck 0% installs, deploy repo apps on create, unify install UX

2026-07-21 22:57:33 -04:00

test_compose_v1_compat.py

fix(docker): stop sending compose v1 a v2-only flag

2026-07-25 16:19:33 -04:00

test_config_checkpoint_alias.py

refactor(unify): §8 Phase B4 — surface DeploymentSnapshot as "Config Checkpoint"

2026-06-24 14:24:13 -04:00

test_config_snapshots.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

test_config_store.py

refactor(db): one SQL-exec dispatcher, and adopt the doors already built

2026-08-18 11:26:40 -04:00

test_connection_string.py

Introduce sk1 connection string format and GUI plugin

2026-05-05 14:03:31 -04:00

test_container_registry.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_container_scale.py

feat(docker): horizontal auto-scaling (CPU thresholds, min/max, cooldown)

2026-06-19 10:13:50 -04:00

test_container_sleep.py

feat(docker): container auto-sleep (policy, manual sleep/wake, idle sweep)

2026-06-19 09:54:40 -04:00

test_container_status_bulk.py

perf(api): stop /status/apps spawning a subprocess per app, and roll up the activity summary

2026-08-12 18:15:53 -04:00

test_container_status.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

test_core_blueprint_registry.py

refactor(app): register core blueprints from one manifest

2026-08-18 02:51:33 -04:00

test_cron_preview.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_cron_rbac.py

feat(security): authz hardening round 2 (plan 29)

2026-07-07 20:29:24 -04:00

test_cron_runs.py

feat(cron): rebuild /cron on the Domains list pattern

2026-07-27 22:44:40 -04:00

test_dashboards.py

feat(dashboard): one control row, and the clock becomes a widget

2026-07-25 21:23:14 -04:00

test_database_engine_extensions.py

fix(databases): scope the extension listing to apps the caller can see

2026-07-26 00:19:46 -04:00

test_database_engines.py

feat(recycle-bin): applications are soft-deletable, and a delete stops keeping data hostage

2026-08-12 20:26:04 -04:00

test_database_service_doors.py

refactor: finish the §G1 subprocess migration (census 195 -> 28)

2026-08-18 16:38:25 -04:00

test_db_admin_sso.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_db_config_tuner.py

feat(databases): curated engine config tuner

2026-07-03 14:24:03 -04:00

test_db_explorer_honesty.py

fix(databases): distinguish a connection failure from an empty database

2026-06-15 00:01:41 -04:00

test_db_processes.py

refactor(db): one SQL-exec dispatcher, and adopt the doors already built

2026-08-18 11:26:40 -04:00

test_db_snapshot_relocation.py

refactor(models): relocate DatabaseSnapshot/SyncJob; untrack stale gui/email copies

2026-07-22 17:31:18 -04:00

test_ddns.py

feat(dns): dynamic DNS — token-authenticated A/AAAA updates

2026-06-19 03:12:07 -04:00

test_demo_deploys.py

feat(deployments): simulated demo deploys through the real console pipeline

2026-07-23 16:58:46 -04:00

test_demo_mode.py

feat(auth): one-time login links and demo mode

2026-07-03 14:23:50 -04:00

test_deploy_console.py

fix(tests): stop the compose-flag test depending on the host having Docker

2026-07-25 20:04:39 -04:00

test_deploy_preflight.py

feat(deploy): prove a deploy can work before stopping the live one

2026-08-13 17:33:35 -04:00

test_deployment_jobs_authz.py

fix(api): close IDOR/authz gaps across deployment jobs, vaults, queues, docker, databases

2026-08-04 08:53:27 -04:00

test_deployments_unified.py

refactor(unify): §3 — canonical DeploymentJob links + unified /deployments surface

2026-06-24 14:52:04 -04:00

test_dns_aaaa_conflict.py

fix(dns): catch the stray AAAA record that silently breaks SSL issuance

2026-08-13 16:17:23 -04:00

test_dns_caa.py

test(ssl): let the CAA tests past the new nginx-plugin preflight

2026-08-13 16:45:38 -04:00

test_dns_change_log.py

feat(dns): change log + admin notice on failure (Phase 2 backend)

2026-06-22 16:34:17 -04:00

test_dns_cloudflare_client.py

feat(dns): unify Cloudflare credentials behind one connection + shared client

2026-06-22 16:12:31 -04:00

test_dns_credential_resolution.py

feat(dns): unify Cloudflare credentials behind one connection + shared client

2026-06-22 16:12:31 -04:00

test_dns_cutover_api.py

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

test_dns_cutover_providers.py

fix(dns-cutover): restore snapshot() staging + provider-named 501 (plan 42 D7/ph5)

2026-07-09 04:50:16 -04:00

test_dns_cutover.py

fix(recovery): rebuild DNS cutover service+API and SSH site importer

2026-07-08 01:41:22 -04:00

test_dns_give_subdomain.py

fix(sites): route every managed app type on give-subdomain, not just docker

2026-06-30 23:31:57 -04:00

test_dns_ownership.py

feat(dns): ownership ledger + never-touch-foreign guard + zone mirror (Phase 1)

2026-06-22 16:24:53 -04:00

test_dns_portfolio.py

feat(domains): unify domains & DNS into one surface + admin-only Connections

2026-06-23 00:34:55 -04:00

test_dns_providers_core.py

fix(dns): move DNS provider routes back to core

2026-07-03 23:18:08 -04:00

test_dns_subdomain_modes.py

feat(dns): per-base-domain subdomain modes — wildcard vs per-site (Phase 3)

2026-06-22 16:40:35 -04:00

test_docker_db_client.py

fix(databases): the panel could not read the MariaDB it installs

2026-07-25 22:01:15 -04:00

test_docker_protection.py

refactor(docker): route docker_service through the shared doors

2026-08-18 13:45:25 -04:00

test_docker_runner.py

refactor(docker): route docker_service through the shared doors

2026-08-18 13:45:25 -04:00

test_doctor_backup_repairs.py

fix(doctor): verify local-only backups on disk instead of hiding the button

2026-08-13 17:26:14 -04:00

test_doctor_dns.py

fix(doctor): couldn't-check is its own answer, never the negative

2026-08-17 22:48:10 -04:00

test_domain_and_encryption.py

feat: canonical domain + encryption key bootstrap

2026-06-19 01:34:02 -04:00

test_domain_attach_service.py

feat(manifest): apply engine — resolve/plan/apply + core domain attach (Phase 2)

2026-07-04 01:28:16 -04:00

test_domain_vhost_ssl.py

fix(domains): adding or removing one domain no longer drops the site to HTTP

2026-08-12 09:05:56 -04:00

test_drift_doctor.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_effective_env.py

feat: inject shared variables into the deploy env (under local precedence)

2026-06-23 21:33:53 -04:00

test_email_bounce.py

feat(notifications): restore email-bounce webhook slice (plan 42 ph3)

2026-07-09 04:55:53 -04:00

test_email_dovecot_probe.py

fix(email): a dovecot probe that cannot run reports unknown, not stopped

2026-08-18 01:56:59 -04:00

test_email_extraction.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_email_provider_usage_flags.py

refactor(unify): §6 Phase C6a — email provider usage flags

2026-06-24 14:32:41 -04:00

test_email_relay_unified.py

refactor(unify): §6 Phase C6b — Postfix relay backed by EmailProviderConnection

2026-06-24 14:36:08 -04:00

test_enhancements_integration.py

feat: Phase 4 polish & fleet — onboarding completion, fleet proxy, shared-resource depth, docs

2026-06-23 20:04:04 -04:00

test_error_logs.py

test(api): assert correlated error contract

2026-08-18 03:33:22 -04:00

test_event_subscriptions.py

refactor(webhooks): move subscription use cases behind service boundary

2026-08-18 02:56:33 -04:00

test_extension_manifests.py

fix(extensions): gate GPU auto-install on a present GPU; purge em dashes from manifests

2026-07-08 23:12:48 -04:00

test_extension_migration.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_extension_pending_requirements.py

feat(extensions): answer which Python dependencies an install skipped

2026-08-13 17:48:36 -04:00

test_extension_permission_observation.py

feat(extensions): observe permission use, and say which permissions we can't see

2026-08-13 17:44:11 -04:00

test_extension_platform.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_extension_signing.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_external_reverse_proxy.py

test(proxy): pin what an external reverse proxy depends on

2026-08-13 23:07:10 -04:00

test_fail2ban_jail_service.py

refactor(nginx): one privileged-write door, one vhost lifecycle

2026-08-18 11:26:23 -04:00

test_file_integrity.py

feat(security): scoped file-integrity monitoring

2026-07-03 15:21:34 -04:00

test_files_rbac.py

fix(security): correct PROTECTED_ROOTS path math; tighten root matching

2026-08-02 18:56:33 -04:00

test_files_readonly_roots.py

fix(files): make the File Manager's "Web config" shortcut resolve, read-only

2026-08-13 16:03:25 -04:00

test_firewall_detection.py

test(firewall): pin the honest tri-state, not the old fabrication

2026-08-17 23:50:10 -04:00

test_firewall_rule_removal_guard.py

feat(firewall): refuse to remove the last rule admitting SSH

2026-08-17 10:40:03 -04:00

test_firewall_self_block_guard.py

feat(firewall): guard self-block and default-zone lockouts

2026-08-17 19:28:24 -04:00

test_firewall_ssh_lockout.py

feat(firewall): refuse to enable ufw when it would cut off SSH

2026-08-17 10:19:45 -04:00

test_fixture_scope_guard.py

test: guard the app fixture's scope so the suite can't quietly get slow again

2026-08-06 03:01:24 -04:00

test_fleet_doctor_api.py

feat(doctor): connect the fleet doctor that was already written

2026-08-13 17:27:59 -04:00

test_fleet_doctor_dns_rotation.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_fleet_doctor.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

test_fleet_proxy.py

feat: UX hardening for the new organization/proxy/snapshot surfaces

2026-06-23 21:15:16 -04:00

test_fleet_repair.py

fix(recovery): rebuild agent-fleet survey + fleet doctor/repair services

2026-07-08 01:41:13 -04:00

test_fleet_sweep.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_ftp_extraction.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_git_deployment_authz.py

fix(git): enforce app-level authorization on deployment read endpoints

2026-08-03 23:44:56 -04:00

test_git_security.py

fix(security): close git argument injection in repo_url/app_path/branch (GHSA-8vx6-432p-h62q)

2026-08-11 19:43:46 -04:00

test_git_webhook_authz.py

feat(security): authz hardening round 2 (plan 29)

2026-07-07 20:29:24 -04:00

test_github_app_manifest.py

feat(connections): one-click GitHub setup via the GitHub App manifest flow

2026-07-10 23:06:09 -04:00

test_health_staging.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

test_host_inventory.py

feat(monitoring): detect host spec changes and inventory filesystems

2026-08-17 09:31:18 -04:00

test_htaccess_converter.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_html_sink_sweep.py

feat(security): HTML-sink sweep guard (D4) — keep XSS sinks swept

2026-07-22 19:22:43 -04:00

test_identity_door_ratchet.py

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

test_image_update.py

feat(docker): one-click apply for image updates

2026-06-19 09:37:30 -04:00

test_ingress_plane.py

feat: make the ingress-plane boundary explicit (host Nginx vs proxy stack)

2026-06-23 20:57:40 -04:00

test_install_retry_after_failure.py

fix(deploy): let a failed install be retried from the panel

2026-07-25 16:51:44 -04:00

test_invitation_service_boundary.py

test(api): ratchet controller boundary debt

2026-08-18 03:11:37 -04:00

test_jobs.py

feat(doctor): connect the fleet doctor that was already written

2026-08-13 17:27:59 -04:00

test_json_column_mixin.py

refactor(models): one JsonColumnMixin instead of 24 hand-rolled copies

2026-08-17 21:43:59 -04:00

test_linked_panel.py

fix(linked-panel): accept compose file path in project_path from remote runner

2026-07-22 00:48:13 -04:00

test_login_bruteforce.py

feat(auth): per-IP login brute-force throttle

2026-07-18 00:59:19 -04:00

test_login_links.py

feat(auth): one-time login links and demo mode

2026-07-03 14:23:50 -04:00

test_malware_scan_job.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

test_managed_database.py

docs: adopt numbered filenames for docs/plans and update references

2026-07-01 20:49:41 -04:00

test_managed_db_users.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_manifest_appliance_hardening.py

feat(manifest): reference appliance + adoption hardening (plan 35 ph6)

2026-07-09 03:35:53 -04:00

test_manifest_appliance_ports.py

feat(manifest): appliance-tier typed L4 ports + plan-time blockers rail (plan 35 ph1)

2026-07-09 02:57:23 -04:00

test_manifest_appliance_volumes_bootstrap.py

feat(manifest): finish appliance volumes + one-shot bootstrap (plan 35 ph2)

2026-07-09 03:05:08 -04:00

test_manifest_apply.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

test_manifest_drift.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

test_manifest_image_hostreq.py

feat(manifest): BYO image + host requirements (plan 35 ph4)

2026-07-09 03:21:14 -04:00

test_manifest_network_identity.py

feat(manifest): network identity — fromServer, SERVER_PUBLIC_IP, shared net (plan 35 ph5)

2026-07-09 03:28:08 -04:00

test_manifest_persistence.py

feat(manifest): persist manifest + seed env + health-check gate (Phase 1)

2026-07-04 01:16:29 -04:00

test_manifest_reach.py

feat(manifest): fleet targeting, manifest-powered previews, CLI verbs (Phase 5 backend)

2026-07-04 01:46:34 -04:00

test_manifest_reference_appliance.py

feat(manifest): reference appliance + adoption hardening (plan 35 ph6)

2026-07-09 03:35:53 -04:00

test_manifest_references.py

feat(manifest): fromSecret/fromService/generate reference binders (Phase 3)

2026-07-04 01:34:54 -04:00

test_manifest_spec.py

feat(manifest): dockerfilePath — build services from a repo Dockerfile

2026-07-10 01:13:14 -04:00

test_manifest_sync.py

feat(manifest): push re-sync, drift check family, events (Phase 4)

2026-07-04 01:39:53 -04:00

test_manifest_unit.py

feat(manifest): multi-container units (plan 35 ph3)

2026-07-09 03:13:54 -04:00

test_member_actions.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

test_metadata_guard.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_micro_cache.py

refactor(nginx): one privileged-write door, one vhost lifecycle

2026-08-18 11:26:23 -04:00

test_migration_status.py

test(migrate): pin the three states the update screen can be in

2026-07-25 20:35:19 -04:00

test_module_toggles.py

feat(extensions): Phase 5 — extract WordPress into serverkit-wordpress (backend)

2026-07-02 00:15:10 -04:00

test_monitor_service.py

refactor(utils): rename run_command -> run_unprivileged

2026-08-17 20:07:39 -04:00

test_nginx_health_and_service_status.py

refactor(services): one CompletedProcess -> dict translation (F5)

2026-08-17 23:03:39 -04:00

test_nginx_remote_upstream.py

feat(remote-access): NAT-traversing WireGuard tunnels to expose private services

2026-06-15 23:20:00 -04:00

test_nginx_write_vhost.py

refactor(nginx): one privileged-write door, one vhost lifecycle

2026-08-18 11:26:23 -04:00

test_no_background_threads.py

restore: remaining reconstructed July 5-7 changes (clean recovered files not attributable to one plan)

2026-07-07 20:29:31 -04:00

test_notification_bus.py

feat(notifications): queue-backed Notification Bus + email system

2026-06-21 19:57:02 -04:00

test_notification_chat_connections.py

fix(notifications): redact transport errors before they reach the log

2026-08-13 14:36:24 -04:00

test_notification_deep_links.py

feat(notifications): polish — digests, prefs, deep-links (plans 24/33)

2026-07-07 20:29:29 -04:00

test_notification_digest.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

test_notification_prefs_resolution.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_observability_namespace.py

refactor(status): extract status-pages backend into serverkit-status extension

2026-07-14 22:34:24 -04:00

test_observe_enforcement.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_onboarding_recommendations.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_pairing_authz.py

fix(pairing): require developer role for claim/lookup (audit L1)

2026-06-12 18:35:43 -04:00

test_pairing_pop.py

fix(pairing): verify Ed25519 proof-of-possession on pairing poll

2026-05-31 16:08:32 -04:00

test_panel_version.py

feat(files): Stack quick link follows the real install dir

2026-07-02 22:19:14 -04:00

test_per_app_read_scoping.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

test_plugin_agents_sdk.py

feat(plugins): let extensions run commands on the fleet

2026-07-25 14:02:08 -04:00

test_plugin_backups_sdk.py

test: WP hook inversion matrix (present x absent)

2026-08-05 01:18:32 -04:00

test_plugin_deploys_sdk.py

feat(plugins): let plugins own deployment-shaped work

2026-07-25 12:46:59 -04:00

test_plugin_doctor_sdk.py

feat(plugins): let extensions contribute doctor checks

2026-07-25 13:56:09 -04:00

test_plugin_preview.py

security: signature lifecycle, update-path consent gates, download hardening

2026-08-05 13:36:20 -04:00

test_plugin_search_sdk.py

feat(plugins): let extensions put their objects in global search

2026-07-25 13:40:00 -04:00

test_plugin_store_sdk.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_plugins_pipeline.py

fix(plugins): write manifests with LF instead of the platform newline

2026-08-13 14:57:51 -04:00

test_popen_guard.py

test(utils): the Popen guard trusts helper-routed calls

2026-08-17 22:58:18 -04:00

test_previews.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

test_probe_env_integration.py

test(scripts): stop the §D shim replacing the real firewall_service

2026-08-18 00:17:06 -04:00

test_probe_honesty_doctor.py

fix(doctor): couldn't-check is its own answer, never the negative

2026-08-17 22:48:10 -04:00

test_probe_honesty_fleet.py

fix(doctor): couldn't-check is its own answer, never the negative

2026-08-17 22:48:10 -04:00

test_probe_honesty_metrics.py

fix(metrics): unknown is not zero, and zero is not unknown

2026-08-17 22:40:12 -04:00

test_probe_honesty_ssl.py

fix(ssl): a failed certificate check no longer reports fine

2026-08-17 22:48:27 -04:00

test_projects.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

test_provider_secret_encryption.py

refactor(cloud): extract cloud-provision backend + add upgrade re-acquisition

2026-07-14 22:22:18 -04:00

test_proxy_stack.py

feat: Phase 3 team & scale — projects/environments, shared resources, PR previews, proxy stacks

2026-06-23 19:33:44 -04:00

test_query_layer.py

refactor(api): type shared list query inputs

2026-08-18 02:51:16 -04:00

test_queue_bus_webhooks.py

feat(queue-bus): introduce ServerKit Queue Bus under Operations

2026-06-20 22:25:06 -04:00

test_queue_bus.py

feat(queue-bus): auto-generate slugs and resolve duplicates

2026-06-20 22:38:38 -04:00

test_raw_infra_authz.py

fix(api): close IDOR/authz gaps across deployment jobs, vaults, queues, docker, databases

2026-08-04 08:53:27 -04:00

test_raw_subprocess_ratchet.py

refactor(system): run_checked() and a ratchet on the raw subprocess surface

2026-08-18 12:05:17 -04:00

test_recycle_bin.py

fix(recycle-bin): say when a restored domain comes back without HTTPS

2026-08-12 13:08:49 -04:00

test_registry_bundled_index.py

test(registry): assert bundled catalog entries match what the panel ships

2026-08-16 15:54:08 -04:00

test_registry.py

security: signature lifecycle, update-path consent gates, download hardening

2026-08-05 13:36:20 -04:00

test_remote_access_extraction.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_remote_command_dispatcher.py

refactor(agents): centralize remote command dispatch

2026-08-18 03:05:32 -04:00

test_remote_cron_update.py

feat(cron): completion — run history, project scope, cwd/run-as (plan 34)

2026-07-07 20:29:29 -04:00

test_repository_manifest_service.py

Add repository manifest detection and templates

2026-05-03 07:07:57 -04:00

test_resource_grants.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_run_log_stream.py

feat(deploy): batched RunLogStream seam + streaming compose + deploy socket channel

2026-07-22 16:36:58 -04:00

test_runtime_frontend.py

feat(extensions): deliver runtime ESM frontends to production panels (#39)

2026-07-22 17:24:36 -04:00

test_sbin_command_guard.py

docs(tests): stop the sbin guard reading as coverage

2026-08-17 21:23:00 -04:00

test_sdk_contract.py

feat(extensions): deliver runtime ESM frontends to production panels (#39)

2026-07-22 17:24:36 -04:00

test_search.py

feat(api): add typed endpoint contracts and envelopes

2026-08-18 02:47:57 -04:00

test_secrets_webhooks_authz.py

fix(api): close IDOR/authz gaps across deployment jobs, vaults, queues, docker, databases

2026-08-04 08:53:27 -04:00

test_security_clamav.py

Add ClamAV start action and UI posture fixes

2026-06-21 01:54:51 -04:00

test_security_feed.py

feat(security): daily GHSA feed check with admin notifications

2026-08-02 18:35:25 -04:00

test_security_headers.py

feat(security): gate panel HSTS on installer SSL mode (keep HTTPS optional)

2026-06-19 16:52:40 -04:00

test_security_policy.py

fix(recovery): rebuild authz-R2 policy + notification digests/chat webhooks

2026-07-08 01:41:43 -04:00

test_security_scan_jobs.py

refactor(security): run durable scans through job system

2026-08-18 03:00:22 -04:00

test_server_capacity.py

feat(setup): capacity-aware install profiles and resource advisory

2026-07-31 14:56:37 -04:00

test_server_onboarding.py

feat: Phase 4 polish & fleet — onboarding completion, fleet proxy, shared-resource depth, docs

2026-06-23 20:04:04 -04:00

test_server_permissions.py

feat(security): authz hardening round 2 (plan 29)

2026-07-07 20:29:24 -04:00

test_server_time_timezone.py

fix(system): report IANA timezone_id; guard chart formatting against bad zones

2026-07-01 22:55:11 -04:00

test_serverkit_gui_agent_gate.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_serverkit_installer.py

feat(installer): Phase 5 — additive Python bootstrap foundation

2026-06-25 01:06:44 -04:00

test_servers_api_pairing.py

Introduce sk1 connection string format and GUI plugin

2026-05-05 14:03:31 -04:00

test_servers_list_metrics.py

fix(api): GET /servers never sent the metrics the servers list renders

2026-08-12 05:52:37 -04:00

test_service_templates.py

test(services): catalog proving test for the template roadmap

2026-06-23 17:31:28 -04:00

test_services_alias.py

refactor(unify): §1 — single Services detail surface; /apps→/services

2026-06-24 14:06:05 -04:00

test_setup_health.py

feat(install): put a default-deny firewall and fail2ban on a stock install

2026-08-13 16:33:47 -04:00

test_setup_nag.py

feat(onboarding): setup health, preflight + reconcile (plan 22)

2026-07-07 20:29:23 -04:00

test_setup_preflight.py

feat(onboarding): setup health, preflight + reconcile (plan 22)

2026-07-07 20:29:23 -04:00

test_setup_reconcile.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_setup_security.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_shared_queue_authz.py

fix(api): close IDOR/authz gaps across deployment jobs, vaults, queues, docker, databases

2026-08-04 08:53:27 -04:00

test_shared_resources.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_site_base_domains.py

feat(services): pick a base domain when giving an app a subdomain

2026-07-01 00:31:22 -04:00

test_site_import.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_site_importers_extra.py

feat(imports): panel-migration pipeline with cPanel, DirectAdmin and Hestia importers

2026-07-03 14:24:29 -04:00

test_site_routing.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_sites_https.py

refactor(utils): rename run_command -> run_unprivileged

2026-08-17 20:07:39 -04:00

test_sites_publishing_gaps.py

feat(sites): warn when the site base domain overlaps the panel domain

2026-06-30 23:48:28 -04:00

test_soft_delete_leaks.py

fix(domains): stop soft-delete tombstones leaking into every read path

2026-08-12 09:27:05 -04:00

test_speed_test.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_ssh_import_wiring.py

test(ssh-import): redirect APPS_DIR to tmp so create_app step passes on CI

2026-07-08 23:58:45 -04:00

test_ssh_importer.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_ssl_acme_contact.py

feat(ssl): remember one Let's Encrypt contact instead of asking every time

2026-08-13 16:22:33 -04:00

test_ssl_certbot_resolution.py

fix(ssl): resolve certbot outside $PATH and preflight the nginx plugin

2026-08-13 15:59:47 -04:00

test_ssl_unified_surface.py

refactor(unify): §5 — single SSL surface (basic + advanced)

2026-06-24 14:40:08 -04:00

test_status_extraction.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_status_sniffing_ratchet.py

test(api): ratchet the statuses derived from error prose, ahead of milestone C

2026-08-18 20:48:33 -04:00

test_subprocess_stub.py

test(subprocess): one stub kit for subprocess seams

2026-08-18 11:24:20 -04:00

test_support_bundle.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_survey_api.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_survey_catalog.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_survey_service.py

feat(agent): V2 capability pack — survey/doctor/fleet sweep+repair (plan 28)

2026-07-07 20:29:24 -04:00

test_telemetry.py

Truncate large telemetry payloads & UI robustness fixes

2026-06-22 01:45:15 -04:00

test_template_catalog_validation.py

feat(databases): install any engine, because an engine is just a template

2026-07-25 20:09:05 -04:00

test_template_files_render.py

fix(templates): only bind-mount absolute file paths; relative files are build-context only

2026-07-21 23:26:13 -04:00

test_template_magic_vars.py

feat: Phase 1 foundation — status aggregator, API scopes, onboarding, template magic vars

2026-06-23 18:23:47 -04:00

test_template_registry_cache.py

perf(templates): cache parsed local templates on file mtime

2026-08-06 09:32:40 -04:00

test_template_repo_kind.py

Point the agentsite template at its serverkit.yaml, drop false env requirements

2026-08-18 00:45:15 -04:00

test_template_repo_sync.py

fix(templates): point the default repo at a host that exists, and verify what it sends

2026-08-06 00:33:46 -04:00

test_theme_registry.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

test_themes.py

feat(themes): hardening — preview validation, registry caching, token wiring (plan 61)

2026-07-23 09:25:01 -04:00

test_thread_ownership.py

refactor(security): run durable scans through job system

2026-08-18 03:00:22 -04:00

test_tramo_panel_core.py

refactor(extensions): extract seven builtins to standalone repos

2026-07-20 01:16:16 -04:00

test_trusted_client_ip.py

perf(tests): build the Flask app once per session, not once per test

2026-08-06 02:59:14 -04:00

test_unexpected_error_reporting.py

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00

test_unit_of_work.py

refactor(webhooks): move subscription use cases behind service boundary

2026-08-18 02:56:33 -04:00

test_unreported_crash_ratchet.py

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00

test_url_swap.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_utils_system_integration.py

Move EXPECTED_MANAGER check into pytest test

2026-02-10 16:03:19 -05:00

test_utils_system.py

refactor: finish the §G1 subprocess migration (census 195 -> 28)

2026-08-18 16:38:25 -04:00

test_views.py

feat(views): per-user saved table views API

2026-08-09 02:32:55 -04:00

test_waf.py

feat(security): per-app WAF (ModSecurity v3 + OWASP CRS)

2026-06-19 14:02:24 -04:00

test_workspace_scope.py

test: split WP suites — extension-owned move to serverkit-wordpress

2026-08-05 02:38:41 -04:00

test_workspace_scoping_matrix.py

test(recovery): restore 18 lost proving-test suites from pyc trove (plan 42 ph1)

2026-07-09 04:41:00 -04:00

test_wp_hook_inversions.py

fix(tests): the "absent extension" seam test named a real extension

2026-08-12 21:48:21 -04:00

test_yara_scan.py

feat(security): job-backed malware scans with a web-shell YARA pass

2026-07-03 15:21:23 -04:00

UNREPORTED_CRASH_CEILING

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00

unreported_crash_census.py

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00