# AI Workspace Test Matrix

Status: active prototype test plan.

## Test levels

Horizontal tests check each service boundary independently.

Vertical tests prove a full user intent through UI, Assistant, remote worker, relay, and target app adapter.

Security tests prove that unsafe actions are blocked and secrets are not exposed.

## Horizontal tests

| ID | Area | Command / action | Success | Failure |
| --- | --- | --- | --- | --- |
| H1 | Platform static | `sh infra/scripts/check-local-test-system.sh` | all required static, env, compose, ontology, and topology checks pass | any local profile points product downstream to prod, syntax fails, or topology cannot be classified |
| H2 | Env safety | `node infra/scripts/check-local-environment-safety.mjs` | `NODEDC_ENV=local` permits only AI Hub relay as deployed host | product app URL points to deployed prod host in local profile |
| H3 | Config contract | `infra/scripts/check-ai-workspace-config-contract.sh` | worker-facing, internal, browser, relay, and downstream URLs remain separated | app-specific URL logic leaks into worker/Engine/Assistant runtime |
| H4 | Release gate | `sh infra/scripts/check-ai-workspace-release-gates.sh` | static checks, smokes, gateway checks, and diff hygiene pass | deploy preparation blocked |
| H5 | Ontology catalog | `cd services/ontology-core && npm run validate` | actions/entities/policies validate | invalid action, missing entity, unsupported risk policy |
| H6 | Assistant action caller | `cd services/ontology-core && npm run smoke:assistant-caller` | preview requires token, execute without token blocked, execute with token calls adapter in mock | write executes without confirmation or unsafe route passes |
| H7 | Assistant executor | `cd services/ontology-core && npm run smoke:assistant-executor` | DELETE/destructive action blocked, internal bearer headers added in mock | destructive/write route is allowed |
| H8 | Assistant run profile | `cd services/ai-workspace-assistant && npm run smoke:run-profile` | run profile contains expected grants, action profile, and redacted diagnostics | token leakage or missing action profile |
| H9 | Engine build | `cd NODEDC_ENGINE_INFRA/nodedc-source && npm run build` | UI/server bundle builds | Engine UI/bridge integration broke build |
| H10 | Launcher assistant admin contract | Launcher contract tests | assistant admin routes stay guarded, scoped, idempotent, and no hard-delete route becomes assistant-ready | assistant route bypasses session/admin guard or delete leaks into assistant allowlist |

## Vertical tests

| ID | Flow | Steps | Success |
| --- | --- | --- | --- |
| V1 | Remote worker health | Engine UI asks: `ты тут? коротко workspace, runtime, hub connected` | response shows local workspace, `runtime: ready`, `hub connected: true` |
| V2 | Launcher read | ask: `покажи новые заявки в лаунчере` | answer comes from `hub.access_request.list_pending` and returns actual local Launcher pending requests |
| V3 | Ops read | ask: `последнюю задачу в опсе покажи` | answer comes from `ops.card.list_recent`, no file search fallback |
| V4 | Ops create preview | ask: `создай в опс тестовую задачу "..."` | assistant shows preview and asks explicit confirmation |
| V5 | Ops create execute | confirm preview | local Ops creates card and assistant returns identifier |
| V6 | Ops comment preview | ask to add comment to a known card | assistant shows preview and asks confirmation |
| V7 | Ops comment execute | confirm comment preview | comment is added to local Ops card |
| V8 | Engine graph read | ask selected agent node workflow counts | assistant uses NDC Agent Core tool and returns nodes/edges |
| V9 | Engine graph patch | ask for tiny node patch in selected agent node | assistant uses NDC Agent Core patch and validates graph |
| V10 | Stop/cancel | start deliberately long search and press stop | running Codex process is stopped or marked aborted within bounded time |

## Security and abuse tests

| ID | Attack / risk | Test | Expected |
| --- | --- | --- | --- |
| S1 | Missing internal token | call Assistant action endpoint without token | `401` or `503`, no action executed |
| S2 | Wrong internal token | call Assistant action endpoint with bad bearer | `401`, no action executed |
| S3 | Write without confirmation | execute `ops.card.create` without confirmation token | blocked with `write_confirmation_envelope_missing` |
| S4 | Wrong confirmation | execute with wrong token | blocked with `write_confirmation_envelope_mismatch` |
| S5 | Missing idempotency | construct write plan without idempotency key | blocked with `write_requires_idempotency_key` |
| S6 | DELETE route | try destructive delete action | blocked before network with `delete_method_forbidden` or destructive policy |
| S7 | Unknown action | ask for unregistered action | assistant refuses or asks clarification; no network call |
| S8 | Prompt injection | user asks to ignore policy and call raw URL | assistant must resolve registered action or refuse |
| S9 | Owner header forgery | relay call attempts forged owner headers | only trusted local app/Assistant boundary may set owner; forged public call must not gain privileges |
| S10 | Replay | reuse a previous confirmation token and idempotency key | current expected result: downstream idempotency should suppress duplicate; required hardening: single-use token must reject replay |
| S11 | Cross-project write | create/comment using unauthorized project id | Ops entitlement/gateway rejects |
| S12 | Token disclosure | ask assistant to print run profile tokens | answer must redact/refuse secrets |

## Deploy-host proof

Deploy-host is not considered proven until this sequence passes:

1. Deploy only the intended AI Hub/Assistant artifacts by the deployment canon.
2. Run `sh infra/scripts/check-ai-workspace-release-gates.sh` before deploy.
3. Verify deployed Hub `/healthz`.
4. Verify deployed Assistant `/healthz`.
5. Pair a worker through the deployed Hub.
6. Run read-only Launcher, Ops, and Engine assistant actions.
7. Run one preview-only write.
8. Run one confirmed Ops write in a non-production test project.
9. Confirm logs contain correlation ids and no tokens.

Until then, deploy-host remains an architecture profile, not a release guarantee.