# 07 — E2E Testing (Sprint 137 P2)

**Sprint:** 137 P2-01..04
**Date:** 2026-04-19
**Stage:** 05-test (build → integrate → test traceability)

## What lives here

| File | Purpose | Upstream artifact |
|------|---------|-------------------|
| [`scripts/smoke-endpoints.mjs`](./scripts/smoke-endpoints.mjs) | Live gateway smoke (curl+WS) | Depends on `endiorbot serve` running |
| [`owasp-api-1-6.md`](./owasp-api-1-6.md) | OWASP API1-6 triage with LOCAL-ONLY context | Gateway source |
| [`evidence/manifest.json`](./evidence/manifest.json) | G3 evidence manifest (SHA256 hashes) | Generated by `scripts/make-evidence-manifest.mjs` |

## Cross-references (Stage 03 ↔ Stage 05 traceability)

- **03-integrate artifact:** [`docs/03-integrate/02-API-Specifications/openapi.json`](../../03-integrate/02-API-Specifications/openapi.json) — single source of truth for gateway surface (9 REST + 47 JSON-RPC).
- **05-test artifacts:**
  - [`tests/e2e/openapi/openapi-contract.test.ts`](../../../tests/e2e/openapi/openapi-contract.test.ts) — asserts spec ↔ source parity (6 tests)
  - [`tests/e2e/openapi/owasp-controls.test.ts`](../../../tests/e2e/openapi/owasp-controls.test.ts) — asserts OWASP API1-6 controls still in source (11 tests)
  - [`scripts/smoke-endpoints.mjs`](./scripts/smoke-endpoints.mjs) — live reads + WS ping (manual trigger)

## How to refresh after a gateway change

```bash
# 1. Regenerate the OpenAPI spec from source
pnpm tsx scripts/generate-openapi.ts

# 2. Run the contract + OWASP tests — they break if spec drifted
pnpm vitest run tests/e2e/openapi

# 3. (Optional) refresh evidence manifest
node docs/05-test/07-E2E-Testing/scripts/make-evidence-manifest.mjs

# 4. Commit spec + manifest together
git add docs/03-integrate/02-API-Specifications/openapi.json \
        docs/05-test/07-E2E-Testing/evidence/manifest.json \
        tests/e2e/openapi
```

## Identity constraint

EndiorBot is **LOCAL-ONLY** (see [`AGENTS.md`](../../08-collaborate/01-SDLC-Compliance/AGENTS.md) → "Handoff Boundary"). Test scope is deliberately bounded to localhost:
- Remote / multi-host E2E is **out of scope** — that's MTClaw.
- OWASP findings gated by `isLocalhost` are **informational**, not action items.
- Smoke scripts assume `127.0.0.1:18790` by default.

## G3 evidence chain

Gate G3 (Stage 05-test completion) requires:
1. ✅ API surface documented (Sprint 137 P2-01 → `openapi.json`)
2. ✅ Contract tests covering ≥ 90% of both REST + JSON-RPC surfaces (Sprint 137 P2-02 → `openapi-contract.test.ts`)
3. ✅ OWASP API1-6 review with LOCAL-ONLY triage (Sprint 137 P2-03 → `owasp-api-1-6.md` + `owasp-controls.test.ts`)
4. ✅ Evidence manifest with SHA256 integrity (Sprint 137 P2-04 → `evidence/manifest.json`)

Full suite on commit day: **7974 pass, 10 skipped, 0 failures** (see Sprint 137 commit history).
