ROADMAP.md

@@ -18,10 +18,39 @@ Living plan for product quality, auth/email reliability, and automation.
 
 ## Next (near-term)
 
+### Ops / docs debt (do these before more feature e2e)
+
+- [ ] **Commit ansible FastAPI-e2e work** — `provision-punimtag-e2e-user.py` (FastAPI upsert), `punimtag-sync-smtp.py` (quote fix), `vault.example.yml`, `SECRETS.md`, `vaultwarden-sync.yml` are live/tested but may still sit on a cluttered local branch — PR onto `feat/mailpit-playkit-secrets` or a clean cherry-pick branch
+- [ ] **Infisical `/playkit/punimtag` keys** — create `E2E_API_USERNAME`/`PASSWORD` + `E2E_API_VIEWER_*` once in the UI (plaintext raw POST 422 on this Infisical build; Gitea Actions secrets are already set and are what CI uses)
+- [ ] **Vaultwarden sync** — `eval "$(make -s bw-unlock)"; make vault-sync-bitwarden GROUP=punimtag-e2e` after ansible group entries land
 - [ ] **Wire QA/PROD SMTP on live guests** when LXCs 9102/9103 exist (`make punimtag-sync-smtp ENV=qa|prod`)
+- [ ] **Stop seeding `admin@admin.com` in docs** as the day-to-day login; keep bootstrap scripts but point operators at Vaultwarden `PunimTag e2e`
+
+### Playkit adoption (pin is `v0.3.0` today)
+
+| Kit feature | In pin? | PunimTag use |
+|-------------|---------|--------------|
+| Zod `schema` on `ApiClient` | yes | health + people/tags catalog only |
+| `saveStorageState` / `storageStateUse` | yes | setup uses `saveStorageState`; specs use raw `test.use({ storageState })` (`storageStateUse` optional cosmetic) |
+| `playkitFailureArtifacts()` | yes | `playwright.config.ts` |
+| Mailpit / `createMailInbox` | yes | mail specs |
+| **`interceptNetworkCall` / `startNetworkErrorMonitor`** | **no** — HEAD only (post-`v0.3.0`) | **not used** — bump pin after playkit tags `v0.3.1`+ |
+| Timing → Pushgateway | yes API | **not wired** — needs `make deploy-observability` + CI `PLAYKIT_METRICS_*` |
+
+Highest-value new tests once pinned past `v0.3.0`:
+
+1. **`startNetworkErrorMonitor` on gallery / search / upload / manage-users** — fail if the UI stays green while `/api/search` or NextAuth silently 5xxs (exclude expected 401s on public surfaces)
+2. **`interceptNetworkCall` on upload** — replace brittle waitForResponse + text scrape with a typed spy on `**/api/photos/upload` (status + JSON shape)
+3. **`interceptNetworkCall` on search filter UI** — assert the browser actually POSTs/GETs `/api/search?tags=` after checkbox click
+4. **Widen Zod schemas** — `/api/v1/auth/me`, login `TokenResponse`, search response — after FastAPI login (already have tokens in CI)
+
+### Product / coverage gaps
+
 - [ ] **admin-frontend Vitest** (or Playwright admin project)
 - [ ] **PROD smoke** — health + public login page only (no mutating tests)
-- [ ] **Stop seeding `admin@admin.com` in docs** as the day-to-day login; keep bootstrap scripts but point operators at Vaultwarden `PunimTag e2e`
+- [ ] **Favorites filter e2e** (logged-in only in FilterPanel) — uses storageState
+- [ ] **People filter UI e2e** (logged-in) — counterpart to the public tag UI test
+- [ ] **Viewer (NextAuth) write gates** — `hasWriteAccess` / non-admin auth-DB user if/when we provision one (today FastAPI role gates are covered; NextAuth admin vs write is thinner)
 
 ## Later
 
@@ -30,6 +59,7 @@ Living plan for product quality, auth/email reliability, and automation.
 - [ ] OpenAPI-driven contract suite (playkit / consumer)
 - [ ] Multi-browser matrix (firefox/webkit)
 - [ ] Hermes/Mattermost report on e2e failure
+- [ ] Enable playkit timing metrics in CI once Pushgateway is live
 
 ## Test map
 
@@ -39,9 +69,11 @@ Living plan for product quality, auth/email reliability, and automation.
 | Backend unit/integration | `tests/` pytest | existing |
 | E2E browser + mail | `e2e/tests/*` | CI `e2e` |
 | E2E API (unauth + catalog) | `e2e/tests/api.*` | CI |
-| E2E FastAPI authed | `api.fastapi-login.spec.ts` | skips without `E2E_API_*` |
-| E2E role-permission gates | `api.role-permissions.spec.ts` | skips without `E2E_API_*` + `E2E_API_VIEWER_*` |
+| E2E FastAPI authed | `api.fastapi-login.spec.ts` | CI (secrets set) |
+| E2E role-permission gates | `api.role-permissions.spec.ts` | CI (secrets set) |
 | E2E gallery search filters | `gallery.search-filters.spec.ts` | CI (public, no login) |
+| E2E network silent-failure monitor | — | gap (needs playkit > `v0.3.0`) |
 | Admin UI | — | gap |
+| Timing metrics push | — | gap (ops + CI env) |
 
-See also: `e2e/README.md`, playkit `ROADMAP.md` (kit-level).
+See also: `e2e/README.md`, playkit `ROADMAP.md` / `docs/NETWORK.md` / `docs/IDEAS.md`.

e2e/README.md

@@ -34,6 +34,13 @@ Never commit lockfile URLs that embed tokens.
 **Secrets:** Infisical `LevkinOps` → `dev` → `/playkit/punimtag` + Gitea Actions.
 See ansible `docs/hardening/SECRETS.md`.
 
+**Playkit pin:** `@levkin/playkit@v0.3.0` (git tag). Zod schema option, storageState helpers,
+`playkitFailureArtifacts`, and Mailpit are in that pin. Network helpers
+(`interceptNetworkCall`, `startNetworkErrorMonitor` — see playkit `docs/NETWORK.md`)
+landed on playkit HEAD **after** `v0.3.0` — bump the pin when a new tag ships, then
+add silent-4xx/5xx monitors on gallery/search/upload. Timing → Pushgateway is supported
+by the kit but not enabled in this CI job yet.
+
 ## What we assert
 
 1. Login page loads on the public hostname