E2E Process Map
✅ Shipped since the 08-22 assessment
The previous version of this page opened with "why postgres was missed" and a three-part Stack Contract plan. That plan shipped, was beaten into shape by eight consecutive RenewTrack proof runs, and the failure it existed for is now structurally impossible to miss silently:
Stack contract (the 08-22 P0): Specify → build → prove, all live: structured contract on the run, prompts parameterized by it, infra provisioned from it, runtime stack-verify at the assembly gate. The exact failure this page used to open with (postgres silently ignored) can no longer happen silently.
Acceptance contract + parallel verify: Entity schema + routes + testable cases before any code; verify runs them as parallel scripts with per-case FAIL events. First pipeline that has ever caught real bugs (CSV escaping, missing route) and proven their fixes 30/30.
Repair-loop discipline: Production-only repair (test runs fail with the full findings list — findings are PROCESS input, not something to patch over); extra rounds only while failures strictly decrease.
Design system + design review step: HOUSE_SHELL shared shell ended per-page style improvisation; the UI design stage now pauses for modify / approve / reject as a standard step (09-01).
Spec intelligence: The given spec is load-bearing (spec text→playbook match, spec→PRD/define prompts verbatim); PRD self-critique; acceptance-criteria lint.
Rendered-page judging (09-01): The scoring judge now boots the build, logs in, and grades the served HTML + a chromium screenshot of every page — rendered reality outranks source. Capture proven end-to-end on the factory box; screenshots recorded on the run.
Build-stage checkpoints (09-01): The scaffold and every fanned-out page module checkpoint on the run the moment they finish (repair rounds too); an interrupted build resumes with only the missing modules — worst-case loss dropped from the whole ~40-min stage to one module.
⚠️ Current top gaps (what the next proof run dies on)
Rendered evidence at the DESIGN gate: Scoring now judges rendered pages (shipped 09-01), but the design review still approves a JSON spec — the first pixels a human sees are post-build screenshots, not a pre-build preview.
Restart-survival smoke: The assembly gate still can't fail an app that loses data on process restart; persistence bugs surface two stages later in verify.
Deploy-leg key auth: Fresh VMs are still provisioned onto password SSH; fleet hardening will break this leg the same way it broke publish (which is why publish went key-first).
Edge targets: Customer-premise deploys (curl-enroll + WireGuard overlay, design doc b45a50b) are still manual — the RenewTrack preview pattern automated is the first step.
The stack (framework / store / ui / depth) is a structured contract on the run — prompts are parameterized by it, infra provisions from it, and the assembly gate verifies it at runtime.
Working: Shipped since the last assessment — and proven: RenewTrack #3–#8 all launched flask/sqlite explicitly, build logs 'stack verified', the model implements the stack instead of choosing one.
Not working: Simulate-mode API launches can still omit the stack and silently default (RenewTrack #2 defaulted python/memory and invalidated a proof run); only live mode hard-rejects a missing store.
The spec given to the factory is taken in verbatim and becomes the ground truth for the PRD; no model call, never blocks (spec-first since 2026-09-12).
Working: Deterministic and free: the spec size and acceptance time are recorded on the run, and the spec text drives the playbook match downstream.
Not working: Nothing checks the spec itself for gaps — a thin spec becomes a thin PRD; the PRD self-critique is the only backstop.
Page inventory with per-page functionality; playbook-required pages and the mandate-coverage gate force-restore anything dropped; self-critique adds missing depth features; acceptance-criteria lint rewrites vague cases.
Working: Gate remains proven (15/15, 12/12 on the old runs; 11 pages with all 5 playbook-required present on #5). Criteria lint + PRD self-critique shipped 08-31.
Not working: A worker-cache bug once served a STALE prd module (hr_people contamination) after a hot deploy — rolling restarts are now the rule, but there is no version stamp proving which prompt code produced a PRD.
Application Definition Package: requirements, observations, processes, eval suite; completeness-gated approval, risk-tiered.
Working: Fast and consistent; gives verify its eval cases; the approval card now sits on top of an explicit stack contract instead of prose.
Not working: ADP completeness is structural, not semantic — nothing checks the requirements actually cover every rule in the given spec.
Machine contract before any code: shared entity schema + routes + testable cases (RenewTrack #5: 8 entities / 79 fields, 35 routes, 20 cases). Report/aggregate row shapes added after #7.
Working: This is what made verify real — parallel scripts test the contract, not the model's memory of the PRD.
Not working: Contract classes grow reactively: each new failure class (entity fields, report row shapes) was added only after a run died on it.
The model writes a ui_design_v2 spec (tokens, house shell, typed screens bound to the contract, flows); a deterministic critic scores it with ≤2 bounded fix rounds; the run PAUSES at the design gate where the Design Studio shows wireframes, tokens, flow map and findings — edit regions/tokens, pick a direction or density, approve (zero blockers only) or request changes before a line of code exists (v2 since 09-08).
Working: HOUSE_SHELL design system killed the per-page style roulette; v2 adds tokens, typed regions (columns/fields/actions/states) and a critic, so the page generator and the judge work from the same approved screen instead of prose.
Not working: Wireframes are illustrative (server SVG from the spec) — the first real pixels still appear at step 10's screenshot; the critic is structural, not aesthetic.
VM on its own VLAN (or simulate stand-in), runtime + database role + nginx holding service from the CONTRACT (not from grepping generated code), then the frozen infrastructure checkpoint (VM + address + host facts + public surface hash) the build binds to. Runs only after the plan and the design are approved.
Working: Infra follows the declared stack now; VM/VLAN automation stays hands-off and repeatable.
Not working: Edge/customer-premise targets are a design doc (curl-enroll + WG overlay), not a target kind yet.
ASA NAT, Route53 DNS (key-first via clw-terraform), Let's Encrypt, external vantage probe; simulate runs get a preview proxy (renewtrack.enteracloud.com pattern).
Working: Worked unattended on every live run; key-first auth wired 08-31 after the password leg broke; preview hosting makes simulate output reviewable by a human.
Not working: Preview hosting is still a manual recipe (nginx site + LE + systemd on the factory box) — flagged as the next automation candidate.
Scaffold from the house kit, then one module per page fanned out in parallel (AF_BUILD_CONCURRENCY up to 8), first module seeds the idiom; since 09-01 the scaffold and every finished module CHECKPOINT on the run as they land.
Working: 22 files / 18k lines in minutes on #5; kit v2 + playbooks give consistent module shape; janitor survives restarts — and a resumed build now regenerates only the missing modules (repair rounds checkpoint too).
Not working: Huge generations still occasionally break the strict-JSON envelope ('no usable JSON, 122k chars' — recovered on retry, dumps in genfail/).
Compile + login-gate + boot smoke (/health) with up to 3 AI repair rounds, PLUS runtime verification that the mandated framework/store is actually used.
Working: Catches boot failures reliably; the stack-verify closed the 'in-memory store sails through' hole for the framework/store dimension.
Not working: Still no restart-survival smoke (create row → restart → row exists) and no security pass at this gate — persistence bugs surface later, in verify, where they are costlier.
Per-page LLM judge with a gate threshold — since 09-01 it judges the RENDERED page: the build is booted locally, logged into, every page fetched (served HTML) and screenshotted via headless chromium; both go to the judge as ground truth over source. Rebuilt pages re-render before re-judge.
Working: The gate is load-bearing (#5: min 88 → rebuild → PASSED 91/92), and the judge now sees what a user sees — an empty shell or error page can no longer hide behind rich-looking code. Screenshots are viewable on the run ('what the judge saw').
Not working: Vision inputs depend on the vendor accepting images (text-HTML fallback otherwise); no proof run has exercised the rendered judge end-to-end yet — capture machinery is proven, judge-quality delta is not.
The built artifact is pushed onto the checkpointed host (drift-checked against the frozen checkpoint id), the service unit is started with SAMPLE_DATA=0 and /health probed — deployment lands an EMPTY application on a proven host, so a failure here is the app’s, not the infrastructure’s. Sample data (13) and testing (14–16) are separate since 2026-09-08.
Working: Infra follows the declared stack and the checkpoint is reused; a failed build or ship phase re-launches onto the same host with no re-provisioning.
Not working: The deploy leg still authenticates with the fleet password on fresh VMs; only the publish leg is key-first so far.
Its own step since 2026-09-08: the deployed app is restarted once with SAMPLE_DATA=1 through a systemd drop-in (removed after the boot) so the kit seed fills the empty store exactly once; skippable on the control page, off with sample_data=false at launch; off/skipped is recorded and the test phase warns it runs against an empty store.
Working: Shipped 2026-09-08 with unit tests for the live drop-in script, the simulate stand-in path and the off/skip records; no proof run yet — graded NEW, not by evidence.
Not working: The gate proves a healthy restart, not row counts; a kit that seeds nothing would still pass. Row-count evidence on /health is the next step.
TEST phase, separate from deployment since 2026-09-08: the contract's cases run as PARALLEL per-page scripts against the already-deployed app (seeded by 13, or empty), with an immediate per-case FAIL event stream.
Working: #5 ran 30 cases in 6 scripts and surfaced two REAL bugs (CSV double-escaping, a missing drill-down route). GL Forensics failed 34/47 honestly — the stage tells the truth.
Not working: Cases inherit the contract's blind spots; UI-level behavior (what a browser actually renders) is still untested.
Failing verify cases get AI repair rounds — ONLY in production mode. Simulate/E2E runs fail immediately with the full findings list (operator rule 2026-08-31); extra rounds are granted while the failure count strictly decreases.
Working: #5's round 1 landed real fixes (28/30 → 30/30). The decreasing-count rule fixed #6 dying one round short at 34/36; the prod-only rule exists because a mid-test repair regressed passing cases (#7).
Not working: Repair edits the deployed code, then the diff must be folded back — divergence between repaired-deployed and generated source remains a manual concern.
Registry entry (now with a drill-down detail page: lineage, health evidence, versions, E2E links), revision pipeline, post-live enrichment depth rounds.
Working: Registry is the durable per-app record; enrichment targets the weakest scored pages; revisions redeploy to the same VM with data preserved.
Not working: Revisions and enrichment still redo whole pipeline stages for small diffs — no incremental patch path.
Read next
Pipeline Steps — the 20-step mechanical walkthrough with per-step gates and reference-run evidence. Build Assessment — the PartnerHub v3 deep-dive this map originally drew on. E2E Tests — live checkpoint boards for tracked runs. App Registry — every deployed app, now with per-app drill-down detail pages.