---
id: w6/m5/t003
title: Live-cluster acceptance rerun
worker: worker6
status: done
estimate: 40m
depends_on: [w6/m5/t002]
---

## Objective

Re-run `w6/m3/t005`'s acceptance pass for real: drive the full workspace lifecycle in a real browser against real infrastructure (real Postgres, real OpenFGA, real Kratos), not the offline dev stub it was originally verified against — and pick up `w6/m4`'s explicitly-handed-off live verification of the OpenBao secrets purge (`secrets.WorkspacePurger`).

## Context

- `w6/done/m3/README.md`: *"Verified against: ... `scripts/local-bex.mjs` ... rather than a live `scripts/mock-cluster.sh` cluster — none was available in this session. ... Residual gap: a real-cluster rerun ... has not happened."*
- `w6/m1`'s own real-infra e2e test (`workspaces_e2e_test.go`) already covers the backend half — this task closes the frontend-wiring half of the risk.
- _2026-07-11 retarget:_ `scripts/mock-cluster.sh` cannot produce this environment — it installs only kind-mgmt + CAPI/CAPD + Calico + the autoscaler (no operator, no Postgres/Kratos/Hydra/OpenFGA, no bex-api, no dashboard) and still models the retired mgmt/workload pair; standing the whole platform stack up in CAPD is hours, not 40m. Target the rebuilt live prod stack with a scratch workspace instead: dashboard at dashboard.bex.co (`dashboard/deploy/ingress.yaml`), API at api.bex.co (`lego/operator/config/api/ingress.yaml`), both behind the LB on 80/443; Kratos/Hydra/OpenFGA/control-plane Postgres are live and verified there. Any t002 dashboard fix ships via the normal deploy.yml GHCR platform-image path (platform images are unaffected by the node-local App-image regime). If local isolation is preferred, the w6/m1+m4 precedent (bex-api on host + throwaway Docker Postgres/OpenFGA/Kratos) is the fallback — not mock-cluster.sh.
- m4 handoff (`.pm/w6/done/m4/README.md`): *"The OpenBao secrets-purge path (secrets.WorkspacePurger) ... was not live-verified end-to-end this session ... w6/m5 is the milestone already scoped for full live-infrastructure verification and should pick this up."* OpenBao is initialized and the tenant env-vars API is live on prod.

## Steps

1. Log into dashboard.bex.co (Playwright, real Kratos session); open switcher → **+ New Workspace** → name + Hobby plan → create a scratch workspace.
2. Drive: land in the new workspace → every page (services, databases, env vars, metrics) scoped to it → set an env var in the scratch workspace (feeds step 4's purge check) → rename via settings → propagates to switcher.
3. Verify the 6th-Hobby-workspace limit error shows inline, per `w6/m3`'s original DoD.
4. Delete (type-to-confirm) → workspace and its resources gone → lands in remaining workspace; then verify the deleted workspace's OpenBao secrets path is gone (live-verifies `secrets.WorkspacePurger`, closing m4's carried caveat).
5. Record results (pass/fail per clause) in this milestone's README or a completion note; confirm no scratch residue remains on prod.

## Files

- None (verification task; fixes go back into `dashboard/src/` if something fails).

## Acceptance criteria

- [ ] Full create → switch → rename → delete flow verified live against the prod Postgres + OpenFGA + Kratos
- [ ] 6th-Hobby-workspace limit error verified inline
- [ ] Env var set pre-delete; the workspace's OpenBao secrets path confirmed gone after DeleteWorkspace (`secrets.WorkspacePurger` live-verified — the `w6/m4` handoff)
- [ ] Any discrepancy from the offline-stub pass is fixed or filed as a follow-up, not silently ignored

## Out of scope

- GraphQL codegen verification (t004) — this task is UI/flow behavior only.
