shad/canvas-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qa(evidence): live production verification report #2

Merged
shad merged 1 commits from chore/evidence-bundle into main 2026-06-14 21:21:44 +00:00
Conversation 0 Commits 1 Files Changed 10
+369
shad commented 2026-06-14 21:21:37 +00:00
Owner
Copy Link
Copy Source

Real probes against the live canvas.flow-master.ai. Findings:

  • Every /api/* through canvas's nginx returns 502 Bad Gateway (proxy is broken).
  • demo.flow-master.ai upstream is alive (200 on root, 401 on EA2 endpoints) — so the proxy target itself is reachable from the public internet.
  • Frontend Login.tsx calls auth routes that return 404 even on direct probes to demo: /api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
  • The user's "live console shows non-stop 200 GETs" hypothesis is wrong — they are 502s on /api/* calls, not 200s.
  • Zero EA2 traffic actually reaches the backend right now.

Artifacts:

  • qa/evidence/REPORT.md — full writeup with root cause + four cluster-side fixes needed.
  • qa/evidence/endpoint-probe.json — raw status of each endpoint.
  • qa/evidence/network-report.json — Playwright network trace.
  • qa/evidence/01-login.png / 02-after-login.png / 03-mission.png — screenshots of the live site.
  • qa/evidence/_*.mjs — repros so anyone can re-run.

Action needed (cluster access required):

  1. Identify which deployment actually serves canvas.flow-master.ai (the live CSP signature doesn't match any nginx.conf in this repo or flowmaster-ops).
  2. Fix proxy_pass to demo from inside that pod.
  3. Verify NetworkPolicy permits egress to demo.
  4. Resolve the /api/v1/auth/* 404s — either the frontend prefix is wrong or demo isn't the auth backend canvas should target.
Real probes against the live `canvas.flow-master.ai`. Findings: - Every `/api/*` through canvas's nginx returns **502 Bad Gateway** (proxy is broken). - `demo.flow-master.ai` upstream is alive (200 on root, 401 on EA2 endpoints) — so the proxy target itself is reachable from the public internet. - Frontend Login.tsx calls auth routes that return **404 even on direct probes to demo**: `/api/v1/auth/dev-login-config`, `/api/v1/auth/microsoft/login`. - The user's "live console shows non-stop 200 GETs" hypothesis is wrong — they are 502s on `/api/*` calls, not 200s. - Zero EA2 traffic actually reaches the backend right now. Artifacts: - `qa/evidence/REPORT.md` — full writeup with root cause + four cluster-side fixes needed. - `qa/evidence/endpoint-probe.json` — raw status of each endpoint. - `qa/evidence/network-report.json` — Playwright network trace. - `qa/evidence/01-login.png` / `02-after-login.png` / `03-mission.png` — screenshots of the live site. - `qa/evidence/_*.mjs` — repros so anyone can re-run. Action needed (cluster access required): 1. Identify which deployment actually serves `canvas.flow-master.ai` (the live CSP signature doesn't match any nginx.conf in this repo or `flowmaster-ops`). 2. Fix `proxy_pass` to demo from inside that pod. 3. Verify NetworkPolicy permits egress to demo. 4. Resolve the `/api/v1/auth/*` 404s — either the frontend prefix is wrong or demo isn't the auth backend canvas should target.
shad added 1 commit 2026-06-14 21:21:38 +00:00
qa(evidence): live production verification report
build-and-publish / test (pull_request) Has been cancelled
Details
build-and-publish / image (pull_request) Has been cancelled
Details
14ae238cbb 
Captured against https://canvas.flow-master.ai with browser-style
probes + Playwright dogfood + raw fetches:

- Every /api/* through canvas's nginx returns 502 (proxy broken).
- demo.flow-master.ai upstream is alive (200/401 direct).
- Frontend calls auth routes that return 404 even direct on demo:
  /api/v1/auth/dev-login-config, /api/v1/auth/microsoft/login.
- User's 'GETs all 200' hypothesis was wrong — they're 502s.
- Zero EA2 traffic reaches the backend.

Repros in qa/evidence/_*.mjs. Screenshots + JSON dumps + full
report in qa/evidence/.
shad merged commit d68cb5b34e into main 2026-06-14 21:21:44 +00:00
shad deleted branch chore/evidence-bundle 2026-06-14 21:21:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
shad (Shad)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shad/canvas-frontend#2