test(phase6c): acceptance suite, real-k3s rehearsal, and 6A/6B staleness fixes

Adds platform/test/e2e-phase6c.js (17 checks): upgraded-module activity chains, documented-exception promotions, optional-lab non-blocking behavior, no-fake-completion-from-viewing, idempotent completion, instructor-notes exclusion and RBAC on new content, security-assessment pool/draw/cross-student isolation/completion, the capstone gate's documented indifference to ROOT 09, ROOT 11's honest partial/lesson-only rendering, and version-bump content stability — plus running validate-course-content.js as part of the suite. All 17 pass against both a warm and a freshly-reset dev stack. Adds infra/scripts/drills/{run,test}-phase6c-security-config-rehearsal — Section 22's real-k3s dress rehearsal: login -> program -> course -> lesson -> demonstration -> knowledge-check -> guided-exercise -> real Lab -> real kubectl (create Secret, apply Pod, wait for Ready) -> validation -> progress persistence across logout/login -> instructor visibility of the resulting learning state, walking root-07-m02-configuration-and-secrets (upgraded from PARTIAL this phase). 10/10 pass against a real k3s Lab, no mocking. Fixes two stale hardcoded assumptions in e2e-phase6a.js and e2e-phase6b.js that Phase 6C's own legitimate content changes broke: the gold module (root-10-m01) now has 7 activities (6 required + 1 new optional lab, not 6), and root-05-m01 now has 2 required manual-marker activities the course- completion path must also complete (its new bookending lesson/reflection). Both suites are back to green (21/21 and 24/24) against a fresh stack. Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-08-26 11:20:37 -05:00
parent 7f6e1857c0
commit 903b0ead43
5 changed files with 491 additions and 8 deletions
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Orchestrates the Phase 6C §22 curriculum-completion dress rehearsal: brings up the real dev
+# stack, bootstraps an owner, runs test-phase6c-security-config-rehearsal.js (real k3s Lab, real
+# kubectl, real instructor visibility check), tears down.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/../../../platform"
+
+export PROVISIONER_SHARED_SECRET="${PROVISIONER_SHARED_SECRET:-rehearsal-shared-secret-not-for-production}"
+export INTEGRATION_SHARED_SECRET="${INTEGRATION_SHARED_SECRET:-dev-integration-secret-not-for-production}"
+
+docker compose -f docker-compose.dev.yml up -d --build
+
+cleanup() {
+  echo "==> Tearing down"
+  docker ps -aq --filter "name=rootnode-lab-" | xargs -r docker rm -f >/dev/null 2>&1 || true
+  docker network ls --filter "name=rootnode-lab-net-" --format "{{.Name}}" | xargs -r -n1 docker network rm >/dev/null 2>&1 || true
+  docker compose -f docker-compose.dev.yml down >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+echo "==> Waiting for the stack"
+for _ in $(seq 1 60); do
+  curl -sf http://localhost:4300/healthz >/dev/null 2>&1 && curl -sf http://localhost:4200/healthz >/dev/null 2>&1 && break
+  sleep 2
+done
+
+echo "==> Bootstrapping the rehearsal owner"
+( cd api && PLATFORM_DB_URL=postgres://postgres:postgres@localhost:5433/rootnode_platform \
+    node bootstrap-owner.js [email protected] "P6C Rehearsal Owner" 'RehearsalPass!2026' )
+
+echo "==> Running the rehearsal"
+OWNER_EMAIL=[email protected] OWNER_PASSWORD='RehearsalPass!2026' \
+  node ../infra/scripts/drills/test-phase6c-security-config-rehearsal.js
@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+// Phase 6C §22 — the curriculum-completion dress rehearsal. One continuous realistic student
+// narrative through a module Phase 6C actually upgraded this phase (ROOT 07's Configuration &
+// Secrets, converted in place from a bare 5-lab bank to a full gold-pattern module), using a
+// REAL k3s Lab end to end: login -> program -> course -> lesson -> demonstration -> knowledge
+// check -> guided exercise -> real Lab -> real kubectl -> validation -> progress persistence,
+// then an instructor narrative confirming the resulting learning state is visible. Same
+// conventions as test-phase6b-root-course-rehearsal.js: assert-based, no framework, real k3s
+// boots, no mocking.
+//
+// Run via run-phase6c-security-config-rehearsal.sh, which brings up
+// platform/docker-compose.dev.yml first.
+
+const assert = require('assert');
+const { execSync } = require('child_process');
+const { makeSession } = require('../../../platform/test/session-helper');
+
+const GW = process.env.GATEWAY_URL || 'http://localhost:4200';
+const OWNER_EMAIL = process.env.OWNER_EMAIL;
+const OWNER_PASSWORD = process.env.OWNER_PASSWORD;
+if (!OWNER_EMAIL || !OWNER_PASSWORD) { console.error('Set OWNER_EMAIL and OWNER_PASSWORD'); process.exit(1); }
+const RUN_ID = Date.now();
+const PROGRAM = 'root-kubernetes-foundations';
+const CONFIG_MODULE = 'root-07-m02-configuration-and-secrets';
+
+let passed = 0, failed = 0;
+async function step(name, fn) {
+  try { await fn(); console.log(`  ok — ${name}`); passed++; }
+  catch (e) { console.error(`  FAIL — ${name}\n    ${e.stack || e.message}`); failed++; }
+}
+function moduleFrom(tree, id) { for (const c of tree) { const m = c.modules.find((x) => x.module_id === id); if (m) return m; } return null; }
+
+async function main() {
+  console.log('Phase 6C curriculum-completion dress rehearsal — slow, real k3s boots\n');
+
+  const owner = makeSession(GW);
+  await owner.request('POST', '/api/auth/instructor/login', { email: OWNER_EMAIL, password: OWNER_PASSWORD });
+
+  const { body: created } = await owner.request('POST', '/api/admin/students', {
+    display_name: 'Rehearsal 6C Student', login_identifier: `p6c-config-${RUN_ID}`,
+  });
+  const session = makeSession(GW);
+  let enrollmentId, envId;
+
+  await step('student activates credentials and logs in', async () => {
+    const { status } = await session.request('POST', '/api/student/activate', { token: created.activation_token, password: 'RehearsalPass123!' });
+    assert.equal(status, 200);
+  });
+
+  await step('an instructor enrolls the student in the ROOT_ program', async () => {
+    const { status, body } = await owner.request('POST', '/api/admin/enrollments', { student_id: created.student_id, program_id: PROGRAM, status: 'active' });
+    assert.equal(status, 201);
+    enrollmentId = body.enrollment_id;
+  });
+
+  const ROOT05_ALL = ['namespaces-basics', 'pod-basics-mcq', 'kubectl-essentials-mcq', 'labels-selectors-mcq', 'init-containers-mcq',
+    'multi-container-pod-basics', 'pod-labeling-basics', 'jsonpath-basics', 'dry-run-manifest-basics', 'delete-by-label-basics',
+    'annotate-resource-basics', 'init-container-task-basics', 'restart-policy-mcq', 'kubectl-output-format-mcq',
+    'kubectl-explain-basics', 'kubectl-patch-basics', 'field-selector-basics', 'sort-by-basics', 'kubectl-diff-basics', 'static-pods-mcq'];
+  const ROOT06_ALL = ['deploy-nginx', 'scale-deployment', 'rolling-update-task', 'liveness-probe-task', 'jobs-cronjobs-mcq',
+    'daemonset-mcq', 'edit-deployment-basics', 'deployment-strategy-mcq', 'deployment-rollback', 'job-task', 'cronjob-task'];
+  const ROOT07_SERVICES = ['services-mcq', 'expose-service-basics'];
+
+  await step('student launches a REAL Lab and completes ROOT 05/06 plus ROOT 07\'s Services module to unlock Configuration & Secrets', async () => {
+    const launch = await session.request('POST', `/api/student/programs/${enrollmentId}/launch`);
+    assert.equal(launch.status, 200);
+    assert.equal(launch.body.status, 'running');
+    const envRow = (await owner.request('GET', `/api/admin/students/${created.student_id}/environment`)).body.find((e) => e.status === 'running');
+    envId = envRow.environment_id;
+    for (const sid of [...ROOT05_ALL, ...ROOT06_ALL, ...ROOT07_SERVICES]) {
+      const r = await session.request('POST', '/api/progress/record', { scenario_id: sid, status: 'completed', environment_id: envId });
+      assert.equal(r.status, 200, `completing ${sid} should 200`);
+    }
+    for (const suffix of ['a01-lesson-mental-model', 'a02-demonstration-desired-state', 'a03-knowledge-check', 'a04-guided-exercise-namespaces', 'a06-reflection']) {
+      assert.equal((await session.request('POST', `/api/student/activities/root-05-m00-${suffix}/complete`)).status, 200);
+    }
+    for (const suffix of ['a00-lesson-kubectl-fluency', 'a21-reflection']) {
+      assert.equal((await session.request('POST', `/api/student/activities/root-05-m01-${suffix}/complete`)).status, 200);
+    }
+    for (const suffix of ['a01-lesson-deployments', 'a02-demonstration-rollout', 'a03-knowledge-check', 'a04-guided-exercise-rollout-strategy', 'a06-reflection']) {
+      assert.equal((await session.request('POST', `/api/student/activities/root-06-m02-${suffix}/complete`)).status, 200);
+    }
+    for (const suffix of ['a01-lesson-jobs-cronjobs-daemonsets', 'a01b-demonstration-job-lifecycle', 'a02-knowledge-check', 'a02b-guided-exercise-choosing-primitive', 'a05-reflection']) {
+      assert.equal((await session.request('POST', `/api/student/activities/root-06-m03-${suffix}/complete`)).status, 200);
+    }
+    for (const suffix of ['a01-lesson-services', 'a02-demonstration-zero-endpoints', 'a03-knowledge-check', 'a04-guided-exercise-service-type', 'a06-reflection']) {
+      assert.equal((await session.request('POST', `/api/student/activities/root-07-m03-${suffix}/complete`)).status, 200);
+    }
+  });
+
+  await step('the Phase 6C-upgraded Configuration & Secrets module is now unlocked with real lesson content', async () => {
+    const { body } = await session.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    const mod = moduleFrom(body.courses, CONFIG_MODULE);
+    assert.equal(mod.locked, false);
+    assert.equal(mod.activities[0].activity_type, 'lesson');
+    assert.ok(mod.activities[0].body.includes('Secret'), 'the real lesson content must actually be served');
+  });
+
+  await step('student reads the lesson and demonstration, completes the knowledge check and guided exercise', async () => {
+    for (const suffix of ['a00-lesson-configuration', 'a00b-demonstration-secret-not-encrypted', 'a00c-knowledge-check', 'a00d-guided-exercise-choosing-mechanism']) {
+      const { status } = await session.request('POST', `/api/student/activities/root-07-m02-${suffix}/complete`);
+      assert.equal(status, 200);
+    }
+  });
+
+  await step('student launches the module\'s Secrets Lab for real and runs real kubectl against it', async () => {
+    const { body } = await session.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    const mod = moduleFrom(body.courses, CONFIG_MODULE);
+    const lab = mod.activities.find((a) => a.scenario_id === 'secrets-basics');
+    assert.equal(lab.complete, false);
+
+    const launch = await session.request('POST', `/api/student/programs/${enrollmentId}/launch`);
+    const labToken = launch.body.launch_path.match(/\/lab\/([^/]+)\//)[1];
+    const setup = await session.request('POST', `/lab/${labToken}/api/scenarios/secrets-basics/setup`);
+    assert.equal(setup.status, 200);
+
+    const containerName = execSync(
+      `docker compose -f docker-compose.dev.yml exec -T postgres psql -U postgres -d rootnode_platform -t -c "SELECT container_name FROM environments WHERE environment_id = '${envId}'"`,
+      { cwd: `${__dirname}/../../../platform`, stdio: 'pipe' }
+    ).toString().trim();
+    // Real kubectl, run inside the student's actual disposable Lab container.
+    execSync(`docker exec ${containerName} kubectl create secret generic app-secret --from-literal=api-key=supersecret`, { stdio: 'pipe' });
+    execSync(`docker exec ${containerName} sh -c "cat <<'EOF' | kubectl apply -f -
+apiVersion: v1
+kind: Pod
+metadata:
+  name: secret-reader
+spec:
+  containers:
+  - name: reader
+    image: busybox:1.36
+    command: [\\"sleep\\",\\"3600\\"]
+    env:
+    - name: API_KEY
+      valueFrom:
+        secretKeyRef:
+          name: app-secret
+          key: api-key
+EOF"`, { stdio: 'pipe' });
+
+    // Give the Pod a moment to reach Running before validating, same as a real student would.
+    execSync(`docker exec ${containerName} kubectl wait --for=condition=Ready pod/secret-reader --timeout=60s`, { stdio: 'pipe' });
+
+    const validate = await session.request('POST', `/lab/${labToken}/api/scenarios/secrets-basics/validate`);
+    assert.equal(validate.status, 200);
+    assert.equal(validate.body.passed, true, `expected the real validation to pass: ${JSON.stringify(validate.body)}`);
+
+    const record = await session.request('POST', '/api/progress/record', { scenario_id: 'secrets-basics', status: 'completed', environment_id: envId });
+    assert.equal(record.status, 200);
+  });
+
+  await step('the remaining labs and reflection complete the module', async () => {
+    for (const sid of ['configmap-volume', 'resource-limits-task', 'env-vars-configmap', 'pod-env-vars-inline']) {
+      const r = await session.request('POST', '/api/progress/record', { scenario_id: sid, status: 'completed', environment_id: envId });
+      assert.equal(r.status, 200);
+    }
+    const { body: before } = await session.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    assert.equal(moduleFrom(before.courses, CONFIG_MODULE).activities.find((a) => a.scenario_id === 'secrets-basics').complete, true);
+    await session.request('POST', '/api/student/activities/root-07-m02-a99-reflection/complete');
+    const { body: after } = await session.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    assert.equal(moduleFrom(after.courses, CONFIG_MODULE).complete, true);
+  });
+
+  await step('logout, login, Resume Learning — the Phase 6C module\'s progress survives all of it', async () => {
+    await session.request('POST', '/api/logout');
+    const returning = makeSession(GW);
+    await returning.request('POST', '/api/student/login', { identifier: `p6c-config-${RUN_ID}`, password: 'RehearsalPass123!' });
+    const { body: resumed } = await returning.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    assert.equal(moduleFrom(resumed.courses, CONFIG_MODULE).complete, true, 'progress must survive a real logout/login');
+  });
+
+  // ── Instructor narrative — Section 22's "an instructor can see the resulting learning state" ─
+  await step('instructor inspects the Phase 6C module structure and its instructor notes', async () => {
+    const { status, body } = await owner.request('GET', `/api/admin/programs/${PROGRAM}/courses`);
+    assert.equal(status, 200);
+    const mod = moduleFrom(body, CONFIG_MODULE);
+    assert.equal(mod.activities.length, 10);
+    assert.ok(mod.activities[0].instructor_notes, 'instructor must see instructor notes the student view never does');
+  });
+
+  await step('instructor sees this specific student\'s real, completed progress through the Phase 6C module', async () => {
+    const { status, body } = await owner.request('GET', `/api/admin/students/${created.student_id}/courses?program_id=${PROGRAM}`);
+    assert.equal(status, 200);
+    assert.equal(moduleFrom(body, CONFIG_MODULE).complete, true);
+  });
+
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed > 0) process.exit(1);
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });