e2e: live-instance verification for the 2026-07-23 market-gap wave UI

[rubenvdlinde]

The eight changes of the 2026-07-23 market-gap wave were built and unit/vitest-verified locally, but no live Nextcloud instance was available, so several UI-observable scenarios carry honest @e2e exclude annotations or unexecuted Playwright specs. Needs one live-instance pass:

• sbom-import (feat: sbom-import — CycloneDX/SPDX SBOM import with vulnerability matching #385): tests/e2e/sbom-import.spec.ts lists correctly but was never executed — confirm the getByRole('tab', {name: 'Components'}) sidebar-tab locator and the upload flow.
• organisation-merge (feat: organisation-merge — merge orgs after herindeling/leveranciersovername #381): merge panel + confirm dialog never browser-verified; no vitest for the new Vue components.
• gemma-faceted-search (feat: gemma-faceted-search — faceted catalog search on GEMMA dimensions #382): Playwright E2E + live Newman run outstanding.
• portfolio-rationalization-time (feat: portfolio-rationalization-time — Gartner TIME classification + rationalization report #384): report page screenshots.
• bio-compliance-assessment: BIO pages + coverage matrix.
• eol-feed-integration (feat: eol-feed-integration — data-driven end-of-life dates from the endoflife.date register #383): admin settings panel.

Also: docs/features/*.md pages for this wave have no screenshots (this repo has no docs/images capture pipeline — see ADR-010).

[rubenvdlinde]

Partially closed by a live-instance pass on 2026-07-24 (NC 34 on :8080, development head deployed, register force-imported).

Verified working live ✅

• Schema deployment — bioMaatregel (5036) + sbomComponent (5037) created, magic tables auto-created, all 7 new module properties and all 3 gebruik TIME fields present.
• BIO measures page — 5 seeded BIO 2.0 measures render with Code / Naam / Thema / BIO-versie / BBN-niveau.
• gemma-faceted-search — page renders with the GEMMA facet sidebar; GET /api/facets/module returns 200 (totalMatched: 18, ~35 ms) after the fix in fix: four production defects found by live testing the market-gap wave #392.
• BBN/DPIA quick filters — All / BBN1 / BBN2 / BBN3 / "Without DPIA (BBN2+)" render on the faceted Applications page (confirms the bio→facets reconciliation).
• portfolio-rationalization-time — GET /api/portfolio-report returns TIME quadrants + page-size ceiling + truncation flag; CSV export returns the correct header row; org picker lists all 17 organisations after the fix in fix: four production defects found by live testing the market-gap wave #392.
• eol-feed-integration — /api/eol-sync/config returns the spec'd defaults (openconnector / eolProduct / eolCycle); /api/eol-sync/status correctly reports graceful degradation (available:false, reason:"not-yet-run").
• sbom-import — endpoint now returns a proper 404 for a missing moduleVersie after the fix in fix: four production defects found by live testing the market-gap wave #392.

The pass found 4 production defects (all fixed in #392) and the systemic deploy gap in #391.

Still pending ⏳

• Visual/interaction pass on: SBOM Components tab, organisation merge panel + confirm dialog, BIO coverage matrix (ComplianceMatrixView BIO scope).
• Actually executing the Playwright specs (tests/e2e/sbom-import.spec.ts lists correctly but has never run; selector correctness unconfirmed).
• docs/features/*.md screenshots for the wave.

[rubenvdlinde]

Starting a dedicated live-verification pass (2026-07-24) for the six changes merged from the roadmap (#394): #395 schema-rbac-hardening, #396+#400 register import, #398 suite-wizard, #399 catalog-ratings, #401 multi-org-membership.

Two things worth recording up front, because they change what 'verified' means here:

1. The hydra gate runner was aborting at gate-49 outside CI (set -u + unguarded HYDRA_GATE_PR_BODY), so gates 49–57 never ran and the aborted run read as green. Fixed in ConductionNL/hydra#377. Any earlier claim in this repo of the form 'all gates pass' from a local run should be treated as covering gates 1–48 only. The newly visible failures are filed as quality: 12 hydra-gate failures — 4 were invisible while the gate runner aborted at gate-49 #403.

2. Every UI surface in those six changes currently carries a reason-bearing @e2e exclude — they are unit/vitest-verified but were never driven in a browser. That is what this pass is for.

[rubenvdlinde]

Live-verification pass results — 2026-07-24

Deployed the development head to a real NC 34 instance and drove the UI in a browser.

Verified working ✅

• Security fixes are real in the database, not just in tests: gebruik/koppeling/organisatie now carry zero bare gebruik-beheerder grants (all org-scoped) — security follow-up: OR schema-level RBAC grants gebruik-beheerder unscoped read on gebruik/koppeling/organisatie schemas #379's cross-org read is genuinely closed. The ratings fragment landed with fail-closed public read {"group":"public","match":{"status":"approved"}}.
• Multi-organisation membership / samenwerkingsverbanden (deferred) #371 organisation switcher — lists all 7 organisations; clicking one switches the server-side active organisation (verified Amsterdam → Utrecht) and reloads. Backend set-active returns 200 and membership is server-derived.
• Suite wizard: guided registration of application suites (deferred) #372 suite wizard — full 3-step flow completed end-to-end after the fix below; suite persisted with its applicaties relation populated. Test object deleted.
• Ratings & testimonials on catalog entries (deferred) #375 reviews index — the previously dead auteur column now renders real values, and the new Status column is present.

Defect found and fixed 🔴 → ✅ (#405)

The wizard's Applications step was completely blank — TypeError: (…).map is not a function, because getCollection() returns the paginated envelope, not an array. No application could ever be attached to a suite. Shipped green because no test touched that computed. Fixed with a testable mapApplicationOptions() + 4 regression cases pinning both shapes.

Defect found, filed upstream 🔴 (ConductionNL/openregister#2082)

Anonymous reads of beoordeeling return HTTP 500: column t.status does not exist. The schema definition has status, and the table got auteur, but the magic-table column for status was never created — and a forced re-import does not repair it. The fail-closed RBAC rule matches on that column, so every public read throws. Fail-closed still holds (no data leak) but public review reading is unusable. Not a reserved-name conflict (gebruik/organisatie tables both have status).

Correction to an earlier claim

I initially reported the org switcher as broken. That was wrong — my Playwright click wasn't activating the NcActionButton; isolating frontend from backend showed the switcher works. Recorded here so the earlier note isn't taken at face value.

Still not covered

Grant-access modal (#371), ratings submit + moderation queue (#375) — blocked behind the openregister#2082 500 for the public path; BIO coverage matrix; SBOM Components tab. Playwright specs still unexecuted.

[rubenvdlinde]

Final e2e pass, part 2 (2026-07-25) — partial; one real bug found + fixed, remainder blocked

Deployed the development head to 8080 and drove the features via UI + API.

✅ Fully verified

• Multi-organisation membership / samenwerkingsverbanden (deferred) #371 organisation switcher + grant-access — end-to-end: the switcher lists and switches the active org (server-side); the grant-access modal opens (correctly gated on the beheerder group — which didn't exist on this instance and had to be created), renders Current members with per-user Revoke. Exercised the endpoints: grant → member added, revoke → member removed, and the negative security case is denied 403 ("Only a beheerder … may grant or revoke access"). The UI isBeheerder hint and the backend guard check the same group (no mismatch).
• Ratings & testimonials on catalog entries (deferred) #375 ratings — found a real dead-feature bug and fixed it (fix(ratings): resolve beoordeeling register+schema — reviews were 100% dead (#375) #407). Every review submit/aggregate/moderation returned "register/schema not configured" because SettingsService didn't map beoordeeling (register OR schema). After the fix, verified the full lifecycle live: submit → 202 pending (client-supplied auteur/status ignored, author server-stamped, status forced pending) → excluded from the approved-only public aggregate → moderation approve → visible (avg 5, count 1). The feature's original unit tests mocked the resolver, which is exactly why this needed a live pass.

⏳ Still not verified (blocked)

• feat: sbom-import — CycloneDX/SPDX SBOM import with vulnerability matching #385 SBOM Components tab / import, feat: bio-compliance-assessment — BIO measures, BBN level, DPIA tracking #389 BIO coverage matrix, and the Playwright specs could not be completed. Two blockers:
  1. A concurrent OpenRegister session's in-progress work left the shared checkout referencing a class it hasn't created yet (Service\Integration\LeafRegistry), which 500s the SPA page render instance-wide. Browser UI testing of those surfaces is impossible until that WIP is resolved. (I did not touch the other agent's work.)
  2. SBOM import returns 404 for a moduleVersie that demonstrably exists (row _register=11,_schema=52, found fine via OR's objects API) — ObjectService::find(id,register,schema) returns null in SbomImportService. This may be a real bug, but I can't attribute it reliably while the live OpenRegister is in the concurrent agent's inconsistent WIP state. Needs re-verification on a consistent OpenRegister checkout before filing/fixing. Also noted: SbomImportService::getStatus() returns 200-with-null-fields when the moduleVersie isn't found rather than 404 — worth tightening.

Keeping this issue open. Net from the pass: grant-access and ratings are now genuinely e2e-verified (ratings via a shipped fix, #407); SBOM/BIO/Playwright remain, gated on a clean OpenRegister.

[rubenvdlinde]

Live-instance e2e pass — 2026-07-25 (on 8080)

Ran the outstanding UI-observable scenarios against a live Nextcloud 34 instance. Two real, shipped defects found and fixed in the SBOM path, plus four test-infra fixes that were blocking the specs from ever executing. All changes merged to development.

SBOM import (#385) — 2 real defects fixed

1. Stale voorzieningen_config → import 404'd. sbomComponent_schema was never mapped into the app config (the config predated the schema being added to the voorzieningen register), so resolveCoordinates() resolved the component schema to 0 and saveObjects() threw "Schema not found" — surfaced to the user as a misleading 404 moduleVersie not found (the controller's catch (\RuntimeException) catch-all). Fixed live via re-running consolidated auto-configure; the register version bump re-triggers configureVoorzieningen() fleet-wide.
2. SBOM provenance authored on the wrong schema (green-but-dead). sbomLastImportedAt / sbomFormat / sbomFileName / sbomComponents sat on the organisatie schema instead of moduleVersie. recordProvenance() writes them onto the moduleVersie and getStatus() reads them back — but the moduleVersie magic table had no such columns, so the writes were silently dropped and the status endpoint always reported "never imported". Moved all four properties to moduleVersie + bumped register to 2.4.2. (commit f6bca7b)

Live-verified end to end: import 200 → component persisted in magic table → provenance columns populated → status endpoint returns the import metadata → replace-previous soft-deletes the prior set → CycloneDX VEX + license extraction populate vex_cve_ids/licenses. The rendered Components tab shows "Imported 3 components", the 3-row table, the summary tiles, and the "Last imported … from cyclonedx-1.6-valid" provenance line.

tests/e2e/sbom-import.spec.ts — 2/2 green. Four fixes were needed to make it executable: API fixtures now send basic auth pre-emptively (NC returns 401 without a WWW-Authenticate challenge, so Playwright's reactive httpCredentials never authenticated); the Components tab is deep-linked via the hash route (a bare path fell back to the Dashboard); the onboarding walkthrough overlay is dismissed; and the collapsed detail sidebar (which holds the Components tab) is opened first. Added SbomRegisterShapeTest (4 tests / 28 assertions) as a regression guard for the provenance-placement defect. (commit 12f0128)

bio-compliance-assessment (#389) — verified, no defects

• BIO measures catalog page renders (5 seeded measures, Code/Theme/BIO-version/BBN columns).
• Compliance matrix Standards↔BIO scope toggle works; BIO scope renders modules × measures with BBN level + DPIA status columns.
• Coverage computation proven: creating a compliancy claim (module↔bioMaatregel, no evidence) flips the cell from "None" to "Claimed" on refresh.
• Module BBN/DPIA columns provisioned on the magic table; bioMaatregel (schema 5036) wired into the voorzieningen register.
• tests/e2e/spec-coverage/compliance-matrix.spec.ts — 2/2 green after a shared nav-helper fix (expand collapsed submenus + dismiss the walkthrough before clicking nav entries). (commit 8add861)

Remaining wave items — smoke-verified rendering (0 console errors)

• gemma-faceted-search (feat: gemma-faceted-search — faceted catalog search on GEMMA dimensions #382): /modules renders the faceted catalogue with GEMMA facet filters and the feat: bio-compliance-assessment — BIO measures, BBN level, DPIA tracking #389 BBN1/2/3 + "Without DPIA (BBN2+)" quick filters, plus BBN LEVEL / DPIA STATUS columns.
• portfolio-rationalization-time (feat: portfolio-rationalization-time — Gartner TIME classification + rationalization report #384): /portfolio-report renders the TIME (Tolerate/Invest/Migrate/Eliminate) report with Refresh / Export CSV and a filter-first org selector.
• organisation-merge (feat: organisation-merge — merge orgs after herindeling/leveranciersovername #381): /organisaties renders the list with the bulk-select / merge affordance (merge dialog reachable from the Actions menu).
• eol-feed-integration (feat: eol-feed-integration — data-driven end-of-life dates from the endoflife.date register #383): the admin settings panel renders the "End-of-life feed sync" section.

Unit / component

• vitest: complianceMatrix.spec.js + sbomVulnerabilityMatch.spec.js — 39/39.
• PHPUnit: SbomRegisterShapeTest — 4/4.

All commits on origin/development: f6bca7b, 8add861, 12f0128.