| name | verify |
| description | Drive this repo's app end-to-end to verify a change at its real surfaces — boot, the /api/chat agent route, the /api/cron/tick dispatcher, and the browser UI. Use when a change needs runtime proof beyond `pnpm build` (which compiles /api/chat and /api/cron/tick but never calls either). |
| model | inherit |
Drive the app end-to-end to prove a change
Surfaces and the commands that reach them (all verified working):
- Boot:
pnpm dev (background, log to a file). Ready when the log has
Next.js's Ready in. Failure signatures to sweep: error|failed|unhandled
— expect zero on a clean boot.
- Agent route, anonymous (exercises the auth gate — the ONLY check
pnpm build can't see): curl -i -X POST localhost:3000/api/chat -H 'content-type: application/json' -d '{"messages":[]}' with no session
cookie → expect 401. This is the fail-closed check; the authed happy
path (streaming, tool calls, reasoning) is exercised via the browser below
— curl can't easily carry a real Supabase session cookie.
- Cron route smoke (
app/api/cron/tick/route.ts — the per-minute
dispatcher, no browser needed):
curl -i localhost:3000/api/cron/tick with no Authorization header →
expect 401.curl -i localhost:3000/api/cron/tick -H 'authorization: Bearer wrong'
→ expect 401.- With
CRON_SECRET unset in the running dev server's env → expect 401
even with a bearer header (fail-closed, not fail-open).
curl -i localhost:3000/api/cron/tick -H "authorization: Bearer $CRON_SECRET" → expect 200 and a JSON body of counts (due,
claimed, done, failed).- No-double-fire: fire two authorized ticks back to back while a scan
is in flight (a due agent with a long-running run) — the second tick's
claimed count for that agent must be 0; the CAS advance-at-claim on
next_run_at means only the first tick can win the row.
- Browser UI: log in at
/login with the AGENTS.md test account, then:
/agents (sidebar shell) and /agents/new (chat — send a beat
description, expect a streamed onboarding reply, a reasoning block, and
a oparax_x_search tool call round trip — the tool surface is only
oparax_x_search and save_agent; there is no handle-verify step)./agents/[id] (the desk dashboard): confirm the three tabs render as
Scans / Drafts / Agent runs; Pause/Resume flips the status badge and
clears/sets the "Next scan" label; Scan-now queues a run that (after the
next tick) appears in the Agent runs tab, whose trace card expands to
show the reasoning + drafted/executed search trace.- The prompt box submits via its ↵ button, not the Enter key. Finish with
a console-error sweep (expect none).
