ThothII/docs/testing/p1-manual-acceptance.md

P1 manual configuration acceptance

This walkthrough is an independent human gate for the P1 workspace configuration process. The reviewer—not the helper—performs the HTTP, Git, export, rendering, and tht checks and judges the result. Automation never creates VERDICT.md, never records PASS, and never consumes or copies .artifacts/p1-integration.

Prerequisites

From a clean repository checkout, Task 8 must already be implemented. Install Node/npm and Git, curl, unzip/zipinfo, lsof, and the harness development environment so harness/.venv/bin/tht is executable. Port 127.0.0.1:8791 must be free. The helper builds and serves only the production backend; it does not start Docker or the frontend.

Lifecycle

Run these commands from the repository root:

./scripts/p1-manual-acceptance.sh prepare
./scripts/p1-manual-acceptance.sh serve
./scripts/p1-manual-acceptance.sh stop
./scripts/p1-manual-acceptance.sh cleanup

prepare exclusively creates .artifacts/manual-acceptance/p1/, with fresh Git history, fixtures, secret files, concrete request/inspection commands, and GUIDE.md. It leaves status PENDING and the server stopped. It refuses an existing root; use the guarded stop and cleanup actions rather than deleting or reusing state manually.

serve exclusively reserves the lifecycle and PID records before checking the fixed port, then starts an owned Node supervisor that imports the production backend configuration and app in the same process and binds it to 127.0.0.1:8791. Readiness and backend.pid bind that exact process to a random nonce and an ephemeral loopback control endpoint. stop revalidates the exact executable, arguments, repository cwd/root, and process start identity, then requests shutdown over the nonce-authenticated cooperative channel and requires the exact acknowledgement. It never sends a numeric terminating signal. serve, stop, and cleanup are serialized; ambiguous, stale, or starting records remain for operator inspection. cleanup removes only the exact stopped owned fixed root. Foreign siblings and automated integration artifacts are outside its cleanup boundary.

After prepare, follow the 14 ordered steps in the generated absolute-path GUIDE.md. Personally run each generated http-01 through http-14 curl script in numeric order; they save the exact status, three validation, three sequential publication, pull, three read responses, and three ZIP exports. Each publication derives its current base commit with a bounded parser from the preceding saved API response, with no placeholder base. Run the five numbered negative validation scripts separately at checklist step 10. The render commands validate the bounded saved read response, its commit-addressed owned snapshot path, the saved publish commit, and the installed Git HEAD before calling the acceptance-only production renderer. The renderer imports the built ThtRunner, resolves bindings from environment paths, copies one lease atomically with mode 0600, and releases it in finally. For each exported ZIP, invoke the generated extractor with the exact expected workspace ID (p1-filesystem, p1-http, or p1-s3); it stages one immutable owned copy, confines extraction, and binds both the manifest and parsed descriptor identity to that expected ID. The generated secret scan checks bounded bytes from every Git object, including unreachable blobs and dangling commits. Do not inspect or print raw secret-file contents; only inspect ownership/mode/path metadata and canary absence outside fixture-secrets.

Failures and verdict

On failure, run stop if the owned server is running and preserve the entire fixed root for review. Do not run cleanup until evidence is no longer needed. A reviewer creates VERDICT.md only after the walkthrough, containing:

• reviewer identity;
• UTC timestamp;
• an explicit result for every one of the 14 generated checklist steps;
• observations and failure evidence;
• exactly manual acceptance: PASS or manual acceptance: FAIL.

Passing bash scripts/test-p1-manual-acceptance.sh proves only that the tooling guards work. It does not perform or approve manual acceptance and leaves the project-level manual status PENDING.

Expected safe outcomes are one listener on 127.0.0.1:8791; 2xx positive responses; non-2xx negative validations without Git or snapshot mutation; an empty render diff; two successful tht config check calls; no manifest, Evidence/export, secret, or out-of-scope-artifact finding; and no PID or listener after stop.