> For the complete documentation index, see [llms.txt](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase24-session09-end-to-end-validation-release-hardening/spec.md). # Session Specification **Session ID**: `phase24-session09-end-to-end-validation-release-hardening` **Phase**: 24 - Trend Finder Outlier Signal Upgrade **Status**: Not Started **Created**: 2026-06-08 *** ## 1. Session Overview This session closes Phase 24 by validating the complete Outlier-derived Trend Finder upgrade as one coherent operator workflow. Sessions 01 through 08 added source-local scoring, enrichment and spend accounting, browser-safe evidence assets, local source setup, scheduler first-run controls, Signal Workbench triage, static Brief export, and cross-surface documentation. Session 09 proves those capabilities work together without weakening browser-safety, compliance, private artifact, or generated-data boundaries. The work is validation and hardening, not new feature expansion. The session should add missing regression fixtures where coverage gaps are found, dogfood a fresh local first-run path, run the relevant unit, script, type, lint, build, and browser suites, and record exact results. Any findings should be fixed only inside the Phase 24 contracts needed for release confidence. The release hardening pass also updates the phase closeout evidence. Generated and private paths must stay ignored, static export output must exclude private runtime material, and the folded Outlier source memo should be marked complete through spec artifacts or the Phase 24 PRD without restoring stale ongoing project files. *** ## 2. Objectives 1. Prove the end-to-end Trend Finder first-run and release workflow from source setup through run progress, Engine Replay, Workbench, Brief, and static export. 2. Add missing regression fixtures for every Phase 24 feature family. 3. Verify private/generated artifacts, browser payloads, and static exports do not expose secrets, raw logs, raw source payloads, transcripts, or private paths. 4. Record command results, dogfood notes, source compliance status, and final release hardening evidence. *** ## 3. Prerequisites ### Required Sessions * [x] `phase24-session01-source-local-scoring-signals` - source-local ratios, promoted/pinned exclusions, and actionability bands exist. * [x] `phase24-session02-delta-aware-enrichment-spend-accounting` - enrichment cache, pruning, spend summaries, and budget visibility exist. * [x] `phase24-session03-browser-safe-evidence-assets-file-hardening` - evidence asset metadata, manifest validation, and file-safety rules exist. * [x] `phase24-session04-source-setup-target-configuration` - reviewed source setup and safe target configuration exist. * [x] `phase24-session05-scheduler-first-run-live-progress-controls` - scheduler status, first-run checklist, and live run progress exist. * [x] `phase24-session06-signal-workbench-local-triage` - Workbench table and local-only triage state exist. * [x] `phase24-session07-static-brief-export` - opt-in static Brief export and privacy guards exist. * [x] `phase24-session08-cross-surface-documentation-reference-mode` - manuals and in-app Reference mode align with implemented behavior. ### Required Tools/Knowledge * Bun 1.3.14 project toolchain. * Vitest, TypeScript, ESLint, Prettier, Playwright, and production build commands from `package.json`. * Existing Trend Finder source, scheduler, Engine Replay, Workbench, Brief, export, and docs contracts. * Source compliance docs under `docs/sources/`. ### Environment Requirements * Work from the repository root. * Do not require live Apify, OpenAI, Claude, scheduler, or browser bridge secrets. * Use fixture-backed and missing-credential states for repeatable validation. * Generated runtime data, private caches, logs, reports, test output, and browser artifacts remain ignored and untracked. *** ## 4. Scope ### In Scope (MVP) * Operators can rely on focused regression coverage for source-local ratios, promoted/pinned exclusions, enrichment cache hits, spend estimates, asset failures, source setup validation, scheduler status, live progress, Workbench triage, and static export. * Operators can dogfood a fresh local first-run path from no configured Trend Finder sources through source setup, run now, Engine Replay review, Workbench triage, Brief view, and static export. * Operators can run the relevant unit, component, script, type, lint, format, build, private artifact, and browser suites with exact results recorded. * Operators can verify private/generated files remain ignored and static export output contains no secrets, raw transcripts, raw logs, private snapshots, raw Actor payloads, account auth, billing payloads, local triage notes, or unsafe local paths. * Operators can review final security/compliance notes for any source whose normalizer exposes entity identity, promoted/pinned flags, or evidence asset metadata. * Operators can see the folded Outlier source memo completion state reflected in the Phase 24 artifacts without reintroducing stale project files. ### Out of Scope (Deferred) * New Trend Finder feature behavior - Reason: this session validates and hardens the implemented Phase 24 scope. * Broad refactors outside affected Trend Finder validation contracts - Reason: release hardening should keep changes focused on proof and regressions. * New public source adapters, media permissions, or collection roles - Reason: each source still requires separate compliance review. * Public deployment, scheduled self-commit, or generated artifact commit workflows - Reason: static Brief hosting remains opt-in operator work. * Shipping known security/compliance regressions as documented debt - Reason: this is the phase closeout gate. *** ## 5. Technical Approach ### Architecture Use the existing Trend Finder split: script-only runtime code owns collection, normalization, enrichment, spend, asset, scheduler, and static export behavior, while browser surfaces consume only validated and bounded Trend Finder payload fields. Regression tests should prefer existing focused test files where the behavior already has a local home, then add one release-hardening Playwright flow for the complete operator path. The dogfood path should run against deterministic fixtures and explicit missing-credential states. It should verify visible first-run guidance, reviewed source setup state, run controls and live progress labels, Engine Replay provenance, Workbench local triage behavior, Brief content, and static export output without requiring live third-party credentials. Private artifact validation should use git metadata and generated-output inspection rather than reading or exposing private file contents. Static export checks must inspect generated HTML and manifest output for unsafe strings, private path patterns, local triage notes, raw runtime data labels, and token-shaped values before the session is considered complete. ### Design Patterns * Audit before adding tests: identify missing regressions against existing coverage before expanding files. * Focused fixtures: add exact edge cases for Phase 24 contracts instead of broad synthetic payload churn. * Fail-closed privacy checks: treat suspicious private strings or paths in browser/export output as release blockers. * Documentation-as-evidence: implementation notes and security notes record commands, dogfood results, decisions, and residual risk. * Additive closeout: update phase artifacts only where completion state needs to be explicit. ### Technology Stack * TypeScript 6.0.3. * React 19 and TanStack Start route surfaces. * Vitest 4.1.6 for unit, component, and script tests. * Playwright 1.60.0 for browser dogfood coverage. * Bun 1.3.14 for scripts and command execution. *** ## 6. Deliverables ### Files to Create | File | Purpose | Est. Lines | | ------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------- | ---------- | | `.spec_system/specs/phase24-session09-end-to-end-validation-release-hardening/implementation-notes.md` | Regression matrix, dogfood notes, command results, and closeout decisions. | \~220 | | `.spec_system/specs/phase24-session09-end-to-end-validation-release-hardening/security-compliance.md` | Final Phase 24 security, privacy, compliance, and generated-artifact review. | \~170 | | `tests/e2e/trend-finder-release-hardening.spec.ts` | Browser dogfood proof for first-run through export workflow. | \~220 | ### Files to Modify | File | Changes | Est. Lines | | --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | ---------- | | `scripts/extensions/trend-finder/__tests__/source-local-signals.test.ts` | Add missing source-local ratio, promoted/pinned exclusion, and actionability regressions. | \~60 | | `scripts/extensions/trend-finder/__tests__/enrichment-cache.test.ts` | Add missing cache hit, stale, pruning, and saved-count regressions. | \~45 | | `scripts/extensions/trend-finder/__tests__/spend-accounting.test.ts` | Add missing estimated/actual spend and cadence projection regressions. | \~45 | | `scripts/extensions/trend-finder/__tests__/evidence-assets.test.ts` | Add missing asset failure, blocked, pruned, and unsafe-reference regressions. | \~45 | | `scripts/extensions/trend-finder/sources/__tests__/source-setup.test.ts` | Add missing source setup target validation and reviewed-source edge cases. | \~45 | | `scripts/lib/__tests__/trend-finder-scheduler-status.test.ts` | Add missing scheduler status and live-progress safe summary regressions. | \~45 | | `src/extensions/trend-finder/components/__tests__/signal-workbench-view.test.tsx` | Add missing local triage persistence, reset, and generated Watchlist separation regressions. | \~55 | | `scripts/extensions/trend-finder/__tests__/static-brief-export.test.ts` | Add missing static export privacy and local triage exclusion regressions. | \~60 | | `tests/e2e/fixtures/live-data.ts` | Add complete Phase 24 workflow fixture states for browser validation. | \~100 | | `src/extensions/trend-finder/fixtures.ts` | Add or adjust fixture data for cross-surface Phase 24 validation. | \~100 | | `tests/e2e/trend-finder-engine-replay.spec.ts` | Expand browser proof for live progress, spend, assets, and privacy labels. | \~60 | | `tests/e2e/trend-finder-static-brief.spec.ts` | Expand static export proof for private-string exclusions and responsive output. | \~50 | | `scripts/check-private-runtime-artifacts.sh` | Include Phase 24 cache, asset, scheduler, and static export generated paths in the ignore check. | \~30 | | `.spec_system/PRD/phase_24/PRD_phase_24.md` | Update closeout or completion notes only if implementation proves the phase is ready. | \~20 | *** ## 7. Success Criteria ### Functional Requirements * [ ] Focused regression tests cover every Phase 24 feature family named in the Session 09 stub. * [ ] Browser dogfood covers source setup, run now/live progress, Engine Replay, Workbench triage, Brief, and static export from deterministic fixture or missing-credential states. * [ ] Static export output excludes private strings, raw runtime material, local triage notes, and unsafe file paths. * [ ] Private/generated artifact paths are ignored, untracked, and invisible to git status. * [ ] Folded Outlier source memo completion state is captured in spec or phase artifacts. ### Testing Requirements * [ ] Focused unit, component, and script regressions pass. * [ ] Relevant Playwright Trend Finder specs pass. * [ ] `bun run test`, type checks, lint, format check, build, and private artifact checks pass or unrelated blockers are documented with exact output. * [ ] Manual dogfood notes are recorded with commands, route coverage, and observed states. ### Non-Functional Requirements * [ ] No new browser-visible private data, credential, auth, billing, raw log, raw transcript, raw source payload, raw Actor/Dataset, or unsafe local path channel is introduced. * [ ] Source compliance remains reviewed-source only and no new source collection role is added. * [ ] Generated artifacts remain local and opt-in; no default public deployment or generated self-commit workflow is introduced. * [ ] Regression fixture growth stays bounded and does not expand the shared extension payload beyond existing limits. ### Quality Gates * [ ] All files ASCII-encoded. * [ ] Unix LF line endings. * [ ] Code follows project conventions. *** ## 8. Implementation Notes ### Key Considerations * Session 09 should start by auditing existing tests, because many Phase 24 behaviors already have focused coverage from sessions 01 through 08. * If a validation finding requires a product fix, keep it scoped to the specific Trend Finder contract under test and record the reason. * Do not rely on live Apify, AI runtime, scheduler timers, or local secrets for release confidence. Use fixture-backed and explicitly degraded states. * The old Outlier ongoing-project file was already folded into the Phase 24 PRD and should not be recreated. ### Potential Challenges * Long command runtime: Run focused suites first to isolate failures, then run the broad gates once fixes are complete. * Dirty generated artifacts: Use git metadata checks and explicit ignored paths so private runtime outputs are not accidentally surfaced. * Browser flake: Prefer deterministic fixtures, route interception, stable visible state assertions, and overflow checks. * Privacy regressions: Treat token-shaped strings, home paths, raw logs, prompts, provider responses, raw Actor data, and local triage notes as hard blockers in export/browser assertions. ### Relevant Considerations * \[P02] **New source adapters need per-source compliance review**: This session may re-review docs and normalizer fields but must not add new source roles. * \[P06] **Apify actor outputs remain operator-dependent**: Validation should expose safe source IDs, statuses, counts, and warnings only. * \[P02] **Extension payloads and demo labels stay bounded**: Fixtures and browser payloads must remain explicit and capped. * \[P11] **Scheduler state/log privacy boundary**: Live progress may show stage markers and safe counts, not raw logs or provider/source payloads. * \[P15] **Aggregate collection must stay budgeted**: Spend and enrichment tests should preserve degraded summaries and source caps. * \[P05] **Script-only runtime boundary**: Auth, transport, prompts, responses, source payloads, private caches, and snapshots stay outside browser output. * \[P00] **Do not document planned features as implemented**: Closeout notes should distinguish implemented validation from deferred public hosting or future source expansion. *** ## 9. Testing Strategy ### Unit Tests * Source-local signal calculations, placement exclusions, and actionability bands. * Enrichment cache hit/miss/stale/pruned counts and spend accounting summaries. * Evidence asset blocked/failed/pruned cases and unsafe reference rejection. * Source setup validation, scheduler status projection, live progress summaries, Workbench local triage, and static export privacy checks. ### Integration Tests * Trend Finder schema and fixture parsing across the complete Phase 24 payload. * Static Brief export from fixture live data with safe manifest and HTML output. * Private runtime artifact ignore checks through git metadata. ### Manual Testing * First-run path with no configured sources and missing optional credentials. * Run-now/live progress review using deterministic fixtures. * Engine Replay, Workbench, Brief, and static export route checks on desktop and mobile viewports. ### Edge Cases * Missing optional credentials and degraded source states. * Pinned, promoted, sponsored, or stickied evidence excluded from baselines. * Enrichment cache hits and stale cache entries. * Asset failures, blocked asset references, and pruned asset records. * Local triage notes excluded from generated data and static export output. * Token-shaped strings, private home paths, raw logs, raw transcripts, raw Actor payloads, and account auth rejected from browser/export output. *** ## 10. Dependencies ### External Libraries * No new external libraries expected. ### Other Sessions * **Depends on**: Phase 24 Sessions 01 through 08. * **Depended by**: Phase 24 closeout, then phase transition workflow beginning with `audit` after `implement`, `validate`, and `updateprd` complete. *** ## Next Steps Run the implement workflow step to begin AI-led implementation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ai-os-and-trend-finder.gitbook.io/ai-os-and-trend-finder-docs/.spec_system/archive/sessions/phase24-session09-end-to-end-validation-release-hardening/spec.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.