V2 Release Smoke Testing

Clean Estimate V2 includes a zero-dependency smoke gate for checking the deployed web boundary before deeper workflow QA begins. Run it against the same preview or production deployment that will receive manual testing:

node qa/ui-smoke.mjs <target-deployment-url>

Replace <target-deployment-url> with the exact preview or production URL being approved. A pass against a different deployment is not a release gate for the target build.

If the exact preview uses Vercel Deployment Protection, provide the project's automation bypass secret without placing it in the command history or shared QA output:

# SMOKE_VERCEL_BYPASS must already be injected by the secret manager.
node qa/ui-smoke.mjs <target-deployment-url>

The harness sends the value only in Vercel's protection-bypass request header and never prints it. A Vercel SSO redirect means the smoke gate did not reach the app and is not a pass.

Each page or API probe has a 15-second deadline. A deployment that accepts a connection but stalls therefore records a failed assertion and lets the gate finish instead of waiting indefinitely. Receiving redirect headers does not count as a pass when that response body then stalls.

The gate fails unless all of these contracts are exact:

• Every named office page redirects an anonymous request directly to the

same-origin /sign-in page and preserves the full requested URL for return after authentication. This contract also applies to direct HTTP probes and link scanners that do not send browser-navigation headers; a Clerk 404 protection rewrite is not a pass.

• The public home renders the CleanEstimate application shell and its dedicated

root-page bundle. The sign-in page must include both the mounted Clerk browser loader and its dedicated sign-in route bundle. Generic HTML, another app route, or a page containing the words "sign in" does not pass these public-surface checks.

• A random invalid proposal token reaches the mounted public API and returns

its structured not-found response. A generic HTML 404 or ordinary 200 page does not pass.

• Tasks, Price Book, and Plans reach their real mounted tRPC procedures and

return that procedure's structured UNAUTHORIZED response. A missing procedure or anonymously readable response does not pass.

The current protected route inventory includes Clients, Pipeline, Leads, Estimates, Approvals, Inbox, Tasks, Price Book, Jobs, Plans, Ops, Reports, and Settings. The shared schedule currently lives inside Jobs > Schedule. The standalone appointment Calendar and V2 Invoices routes remain parity work; the PR that ships each one must add its routes and public APIs to this inventory. Public proposal (/q/...) links, customer account entry, authentication pages, and the home page are explicitly outside the office-route guard.

For customer-link rendering checks with approved QA records, provide the optional token variables:

SMOKE_QUOTE_TOKEN=<qa-proposal-token> \
node qa/ui-smoke.mjs <target-deployment-url>

Do not use a real customer's link in automated or shared QA output. The smoke gate is read-only, but opening a valid customer link may record an engagement view. When SMOKE_QUOTE_TOKEN is present, the gate calls the proposal JSON API directly and requires its successful customer-safe contract, including the organization, customer block, status, immutable revision, sent time, and selectable options. The customer block must contain only the supported name, service-address, and location-name fields with their documented nullable text types; unexpected internal fields fail the gate. A 200 customer-page shell is not enough to pass.

Release order

1. Run the automated smoke gate against the target deployment.
2. Walk the money path, Jobs schedule, plans, tasks, Price Book, and customer portal

on that same deployment using approved QA records.

1. Spot-check the role and location permission matrix with separate accounts.
2. Confirm the deployment's error monitoring is clean before release.

This smoke gate checks reachability and anonymous access boundaries. It does not replace authenticated workflow testing, database authorization tests, or the stress-testing readiness drill.