Correct tmi-ux Playwright description: Chrome-only projects, externally-started services (tmi#655)
docs(testing): correct stale CATS facts after the plugin install and rule cleanup
Four things the CATS section asserted that are no longer true.
- **Rule count was 65; it is 48.** 84bd1430 tightened six over-broad rules to
match the server's actual rejection text and removed 17 confirmed dead across
three corpora. A stale count here is not cosmetic: the page tells readers rule
order is load-bearing and to re-verify against the baseline, so the number is
the thing they check against.
- **The plugin is installed.** The page invoked it only as
`uv run ~/Projects/skills/cats/scripts/cats_tool.py`, a path that is now the
*fallback*, not the primary. Documented the five `/cats:*` skills alongside
the make targets and the CATS_TOOL resolution order (installed plugin first,
development checkout second -- the copy the skills reach through
CLAUDE_PLUGIN_ROOT), so make and the skills provably run one engine. The
remaining mention of the checkout path is the explanation of that fallback.
- **`keep_runs` was undocumented** despite the page describing the results
directory in detail. Added it with the two properties that make it safe:
pruning runs only after a valid campaign, and latest.db's target is always
protected including when the symlink dangles.
- **`rule-baseline.json` had no provenance warning.** Added one, because the
pre-2026-07-28 baseline came from the June legacy corpus and that corpus was
since found to have lost its bearer token ~21% in -- its 52,804
OAUTH_AUTH_401_403 count is the contamination, not auth coverage. A reader
regenerating a baseline needs to know to take it from a gate-passing corpus.
Also replaced the `--identity` example: it invoked the raw checkout path and
implied a make variable that does not exist. `--identity` is a plugin flag the
make targets do not forward, so the honest options are /cats:run or changing the
default in .local/cats/config.yaml.
Verified every `make <target>` in the wiki still resolves; remaining matches are
prose ("make certain choices", "the make target").
docs: fix every documented make target that does not exist
The tmi repo swept this class in 2efc4c7c but stopped at its own boundary, so
the wiki kept 18 targets that no longer resolve. Same method: diff every
`make <target>` referenced in *.md against the real list from `make -qp`,
filtering prose hits ("make certain choices", "make threat identification
easier", "the make target").
Renames, all verified against the Makefile rather than guessed:
build-container-db -> build-db
build-container-redis -> build-redis-container
build-container-tmi -> build-server-container
build-containers-all -> build-all
containers-security-scan -> scan-containers
oauth-stub-stop -> stop-oauth-stub
start-postgres -> start-database
db-ping -> check-database
db-reset -> reset-database
restart -> dev-restart
Four needed more than a rename, because the target they named never had a
one-to-one replacement:
- `build-container-oracle` was described as "the dedicated Oracle container
target". There isn't one. Oracle support comes from the OCI build, which
uses Oracle Linux 9 with Instant Client -- build-app-oci.
- `build-containers-multiarch{,-local}` don't exist either; multi-arch is the
build script's `--arch` flag. Pointed at build-app-aws (the target that page
is actually deploying to) and build-app for the local case.
- `check-grype` implied a preflight target. Grype is invoked by `--scan`
inside the build scripts, so the line now says scan-containers needs Grype
and Syft installed instead of pretending a check target exists.
- `build-wstest` claimed a separate build step. scripts/run-wstest.py runs
`go build -o wstest` on every invocation, so `make wstest` already builds;
the standalone step was never real. `clean-wstest` -> clean-process, which
is what actually stops the harness ("Stop OAuth stub and wstest processes").
Two blocks ended up invoking scan-containers twice, since the old scan and
report targets both map to it; collapsed with a note that it writes to
security-reports/ itself.
`make start-server` in Local-Development-Cluster.md is deliberately left: that
page documents the target as retired, so the reference is correct prose.
Every `make <target>` reference in the wiki now resolves.
docs(testing): document CATS run-validity gates, skip_paths and refData mechanics
Records what this round of CATS work established:
- Both run-validity gates are now enforced by the tooling, not just the
connection-error one. Adds max_unauthenticated_pct and the concrete case it
exists for: a campaign that fuzzed POST /me/logout, got a 204, and ran its
remaining 52,340 authenticated requests unauthenticated while reporting as
complete.
- cats.skip_paths, and why /me/logout is in it — plus how to still fuzz such an
endpoint on its own.
- cats.headers replacing the raw -H in extra_args.
- Why seeding goes over loopback while the campaign uses the NodePort.
- Per-path refData sections, and why the /admin/groups family needs them.
- cats_remove_field, the two upstream CATS payload-generation defects it works
around, and its top-level-only limitation.
docs(testing): rewrite CATS documentation for the portable cats plugin
The pages still described the pre-migration pipeline: three scripts that
no longer exist (run-cats-fuzz.py, parse_cats_results.py,
query-cats-results.py), a make build-cats-seed target and cmd/cats-seed/
tree that are both gone, an is_oauth_false_positive column that is now
is_false_positive/fp_rule, and five dead docs/migrated/ pointers.
Rewrites the fuzzing section around the plugin and its gitignored
.local/cats/config.yaml, corrects the results layout to test/results/cats
with per-run databases and a latest.db that only tracks valid completed
runs, and documents the declarative rule file (65 rules, file order,
first match wins) managed through the fp skill.
Adds a Run Validity section, which the page lacked entirely: check the
connection-error rate and the non-false-positive 401 rate before drawing
any conclusion from a run. Both failure modes silently produce a run that
looks clean while most of the API was never reached or never
authenticated.
Corrects the vendor-extension counts (21 public, 7 cacheable) and drops
the kind-cluster topology text, which no longer describes any live
cluster. Fuzzer counts are replaced with a query rather than a number,
since they vary per run.
Refs ericfitz/tmi#588
docs(testing): document supported CATS fuzzing topology (#463)
Add a "Supported Fuzzing Topology" subsection: server reached via NodePort (not
kubectl port-forward), tolerant dev health probes, and the host.docker.internal
DB-URL rewrite for the in-cluster server. Update the Connection Errors (999/953)
note: a large fraction of connection errors means a wrong dev topology, not an
API bug; a healthy full run has effectively zero (validated: 76 of 121,934).
docs: add database security strategies, rename seed tool to dbtool
New page: Database Security Strategies with cloud-isolated and
least-privilege strategies for database privilege separation.
Renamed Seed Tool Reference to Database Tool Reference with
updated CLI interface (--schema, --import-config, --import-test-data,
--input-file flags). Updated cross-references in Config Migration
Guide, Configuration Management, Testing, and Sidebar.
Refs ericfitz/tmi#251
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docs: add config management, migration guide, and seed tool reference
New pages: Configuration Management, Config Migration Guide, Seed Tool
Reference. Updated Testing page for unified seeder. Updated sidebar.
Refs ericfitz/tmi#212
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docs: update remaining wiki pages and remove MIGRATION-INSTRUCTIONS
Revise all wiki pages for accuracy, readability, and consistency with
current codebase. Remove MIGRATION-INSTRUCTIONS.md (no longer needed).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docs(testing): add comprehensive CATS fuzzer coverage analysis
- Document 106 fuzzers running with test counts for security-critical ones
- List 11 explicitly skipped fuzzers with rationale
- Explain 4 conditionally skipped fuzzers via vendor extensions
- Document why optional categories (emoji, control chars, whitespace) are not enabled
- Add schema-specific fuzzer triggers analysis
- Include verification queries for fuzzer coverage
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: add Unit Test Implementation Checklist section
Migrated from tmi-ux docs/testing/UNIT_TEST_CHECKLIST.md
Content includes:
- Pre-implementation checklist
- Test file setup with standard header comments
- Test structure patterns for services
- Testing patterns for public methods, observables, APIs, WebSocket
- Coverage and quality checklists
- Common test patterns for observables and errors
- Pre-commit checklist
- Reference test file links
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: update service test coverage metrics from UNIT_TEST_PLAN_SUMMARY.md
- Added current test coverage metrics: 66/72 services (91.7%)
- Listed 6 services still requiring tests
- Updated from original plan's 42.9% to current 91.7% coverage
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: update Testing page with verified content
Updated Testing page with:
- Corrected E2E framework from Cypress to Playwright (matches actual codebase)
- Added TMI-UX Testing Utilities section documenting src/testing/ directory
- Updated E2E troubleshooting commands
- Added comprehensive documentation for mock services, graph helpers, and matchers
Migrated from: docs/developer/testing/README.md and testing-utilities.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
docs: integrate verified documentation from TMI repository
Migrated and updated wiki pages with verified content from 66 docs:
Updated pages:
- Testing.md: CATS fuzzing, coverage reporting, false positives
- Architecture-and-Design.md: User identification, authorization rules
- Database-Schema-Reference.md: Redis patterns, GORM migration info
- API-Integration.md: OAuth token delivery, PKCE implementation
- Setting-Up-Authentication.md: SAML, environment configuration
- WebSocket-API-Reference.md: Collaboration protocol updates
- API-Rate-Limiting.md: Corrected quota defaults
- Deploying-TMI-Server.md: Updated deployment procedures
- Database-Operations.md: Heroku operations, schema management
- And 15+ other pages with corrections and enhancements
New pages:
- Principal-Based-Identity-Migration.md
- WebSocket-Test-Harness.md
Key corrections applied:
- OAuth provider references: idp=test -> idp=tmi
- Framework: Echo -> Gin
- Health endpoint: /version -> /
- Default quotas aligned with source code
- Migration system: SQL files -> GORM AutoMigrate
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Complete TMI wiki with comprehensive documentation
Created comprehensive wiki organized by task area and audience:
- Home page with ecosystem overview and role-based navigation
- Getting Started (9 pages): End user guides for threat modeling
- Deployment (7 pages): Operator guides for deploying TMI
- Operation (5 pages): SRE/DevOps guides for running TMI
- Troubleshooting (4 pages): Common issues and debugging
- Development (6 pages): Contributor guides and architecture
- Integrations (4 pages): Issue trackers, webhooks, addons
- Tools (3 pages): API clients, Terraform analyzer, Promtail
- API Reference (4 pages): REST, WebSocket, workflows
- Reference (6 pages): Configuration, schema, specs, glossary, FAQ
Total: 48 pages (~27,000 lines, 1.0 MB)
Documentation migrated from:
- tmi/docs/developer/, tmi/docs/operator/
- tmi/docs/reference/architecture/
- tmi-ux/docs/developer/
- tmi-clients, tmi-tf, tmi-promtail README files
Preserved in tmi repo (used in builds):
- docs/reference/apis/tmi-openapi.json
- docs/reference/apis/tmi-asyncapi.yml
- docs/reference/apis/api-workflows.json
🤖 Generated with Claude Code (https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>