johannes
32bc8e7440
CD - Develop (guide → bcos.dev) / build-and-deploy (push) Failing after 34m48s
"Deploy = smoke test" only told you to curl the endpoint. An SPA returns 200 + index.html for any path, so a curl proves nothing about a frontend feature — which is how dashboard#15 got called "verified" on the strength of a container healthcheck and a bundle grep. Documents hiveiq-src/hiveops-e2e and, more importantly, the trap in front of it: these SPAs cannot be driven by a plain browser. They need X-HiveIQ-Browser: true (nginx's browser gate 302s anything else to the marketing site) and Authorization: Bearer <jwt> (the SPAs carry no auth code; the Electron shell injects it). The headers must be injected at the network layer, not via Playwright's extraHTTPHeaders — those land in the CORS preflight, nginx rejects X-HiveIQ-Browser there, and every XHR fails. The app then renders and says "Failed to load...", which reads as a broken feature and is not. States plainly that coverage is one spec, so nobody assumes the suite has them covered. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>