test(e2e): add desktop verification lanes

[wibus-wee]

Problem / pressure

Lody Desktop had unit and renderer coverage but no deterministic application-level suite spanning the built Electron main process, preload bridge, renderer, IPC, bundled CLI, and child-process cleanup. Resource exploration, delivery evidence, and deterministic regression also have different reliability requirements and should not share one blocking lane.

The repository has no model API key. Journey growth must therefore use a maintainer's existing local Codex login, keep credentials off GitHub, and never execute generated code before human review.

Summary

• Add an isolated Playwright Electron + Cucumber harness with synthetic ACP and Git fixtures, stable scenario IDs, Page Objects, and per-scenario evidence.
• Add P0 smoke and P0/P1 full regression suites, immutable acceptance rounds, and a non-blocking Scout that measures post-cleanup resource trends.
• Add a validated journey registry and generated coverage matrix with two-way checks against executable scenarios.
• Add a local Journey Foundry that selects one evidence-backed gap, produces a checksummed review bundle, and validates an approved candidate in a disposable worktree.
• Require an assertion counterfactual, exact source restoration, three fresh focused runs, and the full desktop suite before applying a frozen journey patch.
• Record every Daily scenario at 640x360, delete passing recordings, and retain one failure.webm for every failed scenario.
• Add a trusted default-branch reconciler that validates the untrusted evidence artifact and uploads every retained WebM into one durable failure Issue as independently retryable inline video comments. A successful Daily closes the Issue.

Before / after

Before	After
Electron behavior stopped at Node tests and renderer stories.	P0/P1 journeys launch the built OSS Electron app and bundled CLI.
Resource monitoring exposed snapshots only.	Scout repeats Session, Review, and Work cleanup cycles and classifies post-cleanup slopes.
Coverage was a hand-maintained Markdown snapshot.	A validated registry generates the matrix and maps intent to executable scenarios in both directions.
Journey growth depended on memory or a repository model secret.	A maintainer command selects and authors one risk-ranked gap using local Codex authentication.
Daily artifacts required downloading and unpacking before diagnosis.	Every failed journey is attached directly as a playable WebM; multiple failures produce multiple videos.
A multi-file upload could become ambiguous after partial success.	Each scenario video has its own marker and retry boundary, so only incomplete uploads are retried.

Trust boundaries

• Pull-request journeys use synthetic fixtures and never receive product or model credentials.
• Daily execution is read-only. The workflow_run reconciler checks out the trusted default branch and never executes artifact content.
• Artifact paths, file types, size limits, symlinks, run identity, and issue/comment ownership are validated before upload.
• The reconciler pins GitHub CLI v2.100.0 and verifies the official Linux archive checksum before using gh issue comment --attach.
• Journey authoring stops at a human-readable bundle. Validation needs explicit approval and runs with a temporary home and scrubbed environment.

Test plan

• pnpm --filter @lody/e2e check (suite contract plus support, Scout, reporter, and policy tests)
• pnpm --filter @lody/e2e smoke (3 scenarios, 18 steps passed)
• pnpm e2e:full (4 scenarios, 25 steps passed)
• pnpm e2e:acceptance -- --subject desktop-lifecycle
• pnpm e2e:scout and pnpm e2e:scout:ablation
• Daily reporter/policy suite: 11 tests, including two and 51 failed-video cases, deduplication, missing/oversized files, final and parent symlinks, bot ownership, and incomplete-upload retry
• Real recording ablation: a forced onboarding assertion failure retained a valid WebM; restoring the assertion made the journey pass and removed the recording
• actionlint for Daily, Daily reconciler, and PR smoke workflows
• pnpm check:public-boundary, targeted Oxlint and Prettier, and git diff --check

Review focus

• Electron/video lifecycle in e2e/src/support/electron-harness.ts and e2e/src/support/hooks.ts
• Artifact validation and one-video retry semantics in .github/scripts/e2e-daily-failure.mjs
• Bot-owned Issue/comment policy in .github/scripts/e2e-daily-policy.mjs
• Trusted/untrusted workflow boundary in .github/workflows/e2e-daily-reconcile.yml
• Local-author review and disposable-validation boundary

Residual scope

• CI currently executes desktop journeys on macOS. Windows pipe behavior is unit-tested, but a Windows Electron lane remains follow-up work.
• Scout findings are informational until a leak is reproducible and converted into a narrow deterministic regression.
• The first real GitHub-hosted attachment is exercised after this workflow reaches the default branch and a Daily journey fails; the pinned CLI capability, reporting contract, retry policy, and real WebM production are covered independently in this PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T16:14:40.861653Z	d944fe6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9fa5f7864

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid closing the All Changes tab twice

openChangedFile() explicitly leaves All Changes as the active tab, so this click removes that fixed panel and its diff viewers. The journey then immediately calls closeChangesPanel(), which expects the same All Changes tab to remain active and tries to click its now-absent close button; therefore the P1 review journey—and the daily full and Scout review lanes that execute it—will time out before completing cleanup. Close a specific viewer tab first, or remove the second close operation.

AGENTS.md reference: e2e/AGENTS.md:L39-L41

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d944fe65e5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Close full-suite failures only after a full run

When a scheduled full run has opened this Issue, a maintainer can dispatch the exposed smoke option in e2e-daily.yml; if those P0 scenarios pass, this unconditional success branch marks the shared Daily failure Issue recovered even though the P1 scenario that originally failed was not rerun. Carry the selected suite into reconciliation and only close a full-suite failure after an equivalent full run succeeds.

Useful? React with 👍 / 👎.