Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "v34 (cb4caa1)",
+ "current": "v35 (0f64212)",
  "releases": [
+  {
+   "version": "v35",
+   "sha": "0f64212",
+   "date": "2026-08-21",
+   "subject": "W39 visual QA fixture"
+  },
   {
    "version": "v34",
    "sha": "cb4caa1",

VERSION

@@ -1 +1 @@
-v34 (cb4caa1)
+v35 (0f64212)

api/deps.py

@@ -515,7 +515,7 @@ def _user_for(claims):
     if not uname:
         return None
     claim_tenant = str(claims.get("t") or "").strip().lower()
-    # W39-T28 / A62.  This MUST precede the registry read: qa-runner is specifically a
+    # W39-T28 / A62.  This MUST precede the registry read: a synthetic QA principal is a
     # zero-touch qa-b identity, not an account in tenant #0's `users` document.  The helper
     # rechecks both non-production deployment flags, so removing either invalidates its cookie.
     qa = users.qa_identity(uname)
@@ -656,9 +656,10 @@ def require_session(request: Request, response: Response) -> Session:
     response.headers[_TENANT_HEADER] = str(claims["t"])
     # R4: last AFTER the session is fully resolved — a stamp is only true of a request that was
     # actually admitted, and putting it here means no failed-auth path can ever write one.
-    # qa-runner has no global account record.  Never let the normal activity telemetry create or
-    # touch one through the default tenant-#0 users store.
-    if not user.get("qa_runner"):
+    # Synthetic QA identities have no global account record.  Never let normal activity telemetry
+    # create or touch one through the default tenant-#0 users store (the visual fixture has two
+    # Members, so this must not be specific to qa-runner).
+    if not user.get("qa_fixture"):
         _touch_active(user.get("username"))
     return Session(tenant=claims["t"], user=user, claims=claims, runtime=rt)
 

api/routes_auth.py

@@ -187,15 +187,16 @@ def login(request: Request, response: Response, body: dict = Body(default=None))
     # stamping what was typed would write onto a key that does not exist. Fail-silent inside
     # `touch_login` and a no-op for the emergency-master identity (which has no record to stamp),
     # so the one thing this cannot do is turn a good credential into a failed sign-in.
-    # The synthetic QA identity has no normal account record to stamp.  More importantly, a
+    # Synthetic QA identities have no normal account record to stamp.  More importantly, a
     # registry stamp here would default to tenant #0 and make a qa-b proof touch the wrong schema.
-    if not user.get("qa_runner"):
+    # This is ``qa_fixture`` rather than ``qa_runner`` because visual sharing needs two Members.
+    if not user.get("qa_fixture"):
         users.touch_login(user["username"])
     # `touch_login` also sets `last_active`, so tell the session resolver it has been seen —
     # otherwise the very next request stamps it again and the hourly throttle is off by one write
     # per sign-in.
     import deps as _deps
-    if not user.get("qa_runner"):
+    if not user.get("qa_fixture"):
         _deps.note_active(user["username"])
     return {"user": _public_user(user)}
 

api/routes_customers.py

@@ -38,6 +38,31 @@ MODULE = "customer_data"
 _CACHE_TTL = 900       # the pool build is slow (Odoo + reconciliation); 15 min, as before
 
 
+# W39 visual QA fixture.  The staging-only QA tenant has an intentionally empty connector, so it
+# can prove tenant isolation; a browser cannot, however, exercise Map routing or a third-row Go
+# link with zero rows.  These static, non-customer coordinates are the narrowest harmless fixture:
+# three local map points, no Odoo source access, and no path for a normal tenant to receive them.
+_QA_CUSTOMER_ROWS = (
+    {"pid": 9_900_001, "name": "QA Route North", "dba": "QA", "agent": "QA",
+     "_created": "2026-08-21", "lat": 41.8884, "lon": -87.6354,
+     "revenue_ytd": 0.0, "orders_24m": 0, "balance": 0.0, "overdue": 0.0, "ar_open": 0.0},
+    {"pid": 9_900_002, "name": "QA Route Centre", "dba": "QA", "agent": "QA",
+     "_created": "2026-08-21", "lat": 41.8781, "lon": -87.6298,
+     "revenue_ytd": 0.0, "orders_24m": 0, "balance": 0.0, "overdue": 0.0, "ar_open": 0.0},
+    {"pid": 9_900_003, "name": "QA Route South", "dba": "QA", "agent": "QA",
+     "_created": "2026-08-21", "lat": 41.8677, "lon": -87.6241,
+     "revenue_ytd": 0.0, "orders_24m": 0, "balance": 0.0, "overdue": 0.0, "ar_open": 0.0},
+)
+
+
+def _qa_customer_rows(session: Session):
+    """A detached three-row fixture for the admitted non-production QA identities only."""
+    if (session.tenant == "qa-b" and isinstance(session.user, dict)
+            and session.user.get("qa_fixture") is True):
+        return [dict(row) for row in _QA_CUSTOMER_ROWS]
+    return None
+
+
 def _pool_rows(session: Session):
     """The reconciled Odoo pool for this session's SCOPE — the slow part, and the only part that
     may be shared between users.
@@ -59,6 +84,9 @@ def _pool_rows(session: Session):
     `(team_id, agent)` pair, so no two of them ever collided on the key — the test set could not
     express the bug. `verify_api.py` now carries a same-scope second user for exactly this.
     """
+    qa_rows = _qa_customer_rows(session)
+    if qa_rows is not None:
+        return qa_rows
     rt = session.runtime
     team_id, agent = _team_agent(session)
     return _pool_for(rt, team_id, agent)
@@ -245,7 +273,8 @@ def grid_assembly(session: Session, scope: str = "customer", storage_key: str =
 
     rt = session.runtime
     team_id, agent = _team_agent(session)
-    rows_src = _pool_for(rt, team_id, agent)
+    qa_rows = _qa_customer_rows(session)
+    rows_src = qa_rows if qa_rows is not None else _pool_for(rt, team_id, agent)
     # ⛔ THE ROW WALL, APPLIED BEFORE `pids` IS TAKEN. Everything downstream is bounded by that
     # frozenset — `allowed_pids` for the workspace, cohort membership, measure resolution — so
     # scoping here means a row this account may not see never enters ANY of them, rather than
@@ -333,7 +362,11 @@ def grid_assembly(session: Session, scope: str = "customer", storage_key: str =
     # picker and refuse new creates while an EXISTING Metric column kept computing and an
     # EXISTING measure condition kept resolving — a revoked capability still answering, on the
     # grain with the most of them. Three calls, one predicate.
-    may_metrics = perm_scope.may_metrics(session.user, MODULE)
+    # A QA fixture must not turn a browser proof into an Odoo measurement request.  The synthetic
+    # rows intentionally exercise grid/map/navigation only; metrics have no fixture truth and are
+    # therefore unavailable rather than silently reaching a real source.
+    may_metrics = (not bool(session.user.get("qa_fixture"))
+                   and perm_scope.may_metrics(session.user, MODULE))
     measures = measure_resolve.offer(team_id, on_error=_measure_err) if may_metrics else []
     measure_sets = measure_resolve.condition_sets(
         [v.get("config") or {} for v in (views or [])], None, team_id, pids, today, stamp,

api/routes_shares.py

@@ -282,6 +282,13 @@ def get_share(kind: str, oid: str, session: Session = Depends(require_session)):
 def _people(tenant):
     """[{username, name}] for this tenant — same population as `assignable_people`, with the
     BINDING identity alongside the display one."""
+    # W39 visual QA: qa-b is an explicitly enabled, synthetic two-Member fixture.  Its roster
+    # must resolve before the normal registry path: that registry is tenant #0 on Postgres, so
+    # even a read-only Share dialog would otherwise cross the isolation boundary the fixture is
+    # intended to prove.  ``None`` preserves the ordinary registry route for every real tenant.
+    qa = users.qa_people(tenant)
+    if qa is not None:
+        return qa
     try:
         reg = users.registry() or {}
     except Exception:

platform/core/users.py

@@ -27,12 +27,41 @@ PERMS_VERSION = 1
 # identity would make a staging QA check depend on (and potentially mutate) a production-shaped
 # account document.  The identity exists only on an explicitly-granted non-production build.
 _QA_TENANT = 'qa-b'
-_QA_USERNAME = 'qa-runner'
 _QA_TENANT_GRANT = 'AIOS_SANDBOX_TENANTS'
+_QA_IDENTITIES = {
+    # These principals are deliberately *not* records in ``users``.  They exist only to make a
+    # Staging browser proof exercise the same Member-to-Member share picker that the product
+    # serves, without enumerating tenant #0's account document.
+    'qa-runner': {'name': 'QA Runner', 'qa_runner': True},
+    'qa-member': {'name': 'QA Member', 'qa_runner': False},
+}
+
+
+def _qa_enabled():
+    """Whether the explicit non-production QA fixture is admitted, without registry I/O."""
+    if os.environ.get('AIOS_ENABLE_QA_TENANT') != '1':
+        return False
+    granted = {s.strip().lower() for s in
+               str(os.environ.get(_QA_TENANT_GRANT) or '').split(',') if s.strip()}
+    return _QA_TENANT in granted
+
+
+def qa_people(tenant):
+    """The non-production-only picker roster, or ``None`` outside the admitted fixture.
+
+    ``None`` deliberately means "use the ordinary tenant registry"; an empty list would make a
+    malformed/disabled configuration look like a real tenant with no accounts.  This is kept next
+    to ``qa_identity`` so the roster and the principals cannot drift into two admission rules.
+    """
+    if not _qa_enabled() or str(tenant or '').strip().lower() != _QA_TENANT:
+        return None
+    return sorted(({"username": uname, "name": spec["name"]}
+                   for uname, spec in _QA_IDENTITIES.items()),
+                  key=lambda person: person["name"].lower())
 
 
 def qa_identity(username, pw=None):
-    """Return the strictly staging-only QA runner, or ``None``.
+    """Return an explicitly admitted Staging QA principal, or ``None``.
 
     Both deployment knobs are required: registration without a schema grant may not authenticate
     a writer, and a typed grant without the registration flag may not mint an identity.  The
@@ -43,13 +72,8 @@ def qa_identity(username, pw=None):
     the same deployment guards still have to hold when it is read back.
     """
     uname = (username or '').strip().lower()
-    if uname != _QA_USERNAME:
-        return None
-    if os.environ.get('AIOS_ENABLE_QA_TENANT') != '1':
-        return None
-    granted = {s.strip().lower() for s in
-               str(os.environ.get(_QA_TENANT_GRANT) or '').split(',') if s.strip()}
-    if _QA_TENANT not in granted:
+    spec = _QA_IDENTITIES.get(uname)
+    if spec is None or not _qa_enabled():
         return None
     master = os.environ.get('APP_PASSWORD', '')
     if not master:
@@ -61,9 +85,9 @@ def qa_identity(username, pw=None):
     # exposing the secret; rotating APP_PASSWORD invalidates outstanding QA cookies just as an
     # account-record epoch bump would, while still doing zero registry I/O.
     qa_epoch = int.from_bytes(hashlib.sha256(master.encode('utf-8')).digest()[:4], 'big')
-    return {'username': _QA_USERNAME, 'name': 'QA Runner', 'role': 'user',
+    return {'username': uname, 'name': spec['name'], 'role': 'user',
             'bus': 'all', 'modules': ['customers'], 'tenant': _QA_TENANT,
-            'epoch': qa_epoch, 'qa_runner': True}
+            'epoch': qa_epoch, 'qa_runner': bool(spec['qa_runner']), 'qa_fixture': True}
 
 
 def _hash(pw, salt):