Merge branch 'main' into scanner/fix-19276

Author: clubanderson

CONTRIBUTING.md

@@ -104,6 +104,11 @@ Starts backend on `:8080` and frontend on `:5174` with a mock `dev-user` account
 - Update documentation when changing behavior
 - Keep PRs focused on a single concern
 
+### Review and Auto-QA Triage
+
+The project tracks proposed review and triage expectations in [docs/plans/PR-TRIAGE-SLA.md](docs/plans/PR-TRIAGE-SLA.md).
+Issues or PRs labeled `ai-needs-human` need a human decision rather than more automation. For Auto-QA issues, the expected decision is to accept, defer, or close the finding so contributors know whether follow-up work, including PRs, is welcome.
+
 ### Netlify Functions parity for API changes
 
 If your PR changes shared API behavior, update both sides of the production architecture:

docs/README.md

@@ -32,6 +32,7 @@ This index covers the Markdown and YAML documentation files in `docs/` and group
 | [components/component-criteria.md](components/component-criteria.md) | Defines the criteria and review checklist for dashboard components. |
 | [plans/PLUGIN-ARCHITECTURE-RFC.md](plans/PLUGIN-ARCHITECTURE-RFC.md) | RFC defining plugin scope, extension points, security constraints, and phased rollout. |
 | [plans/GITOPS-INTEGRATION-RFC.md](plans/GITOPS-INTEGRATION-RFC.md) | Concrete mid-term RFC for Flux + Argo CD integration, declarative Console config, and Mission Control deep links. |
+| [plans/PR-TRIAGE-SLA.md](plans/PR-TRIAGE-SLA.md) | Proposed review and Auto-QA triage SLA for `ai-needs-human` PRs and issues. |
 | [plans/UNIFIED-DEMO-SKELETON-PLAN.md](plans/UNIFIED-DEMO-SKELETON-PLAN.md) | Implementation plan for the unified demo-data and loading-skeleton system. |
 | [plans/planjan21.md](plans/planjan21.md) | Plan for console filtering and data-consistency improvements from January 2026. |
 | [qa/AI-UX-ISSUE-AGENT-BRIEF.md](qa/AI-UX-ISSUE-AGENT-BRIEF.md) | Operating brief for the agent that turns Playwright UX findings into issues. |

docs/plans/PR-TRIAGE-SLA.md

@@ -2,20 +2,20 @@
 
 > Status: proposed
 > Horizon: v0.4 — AI-Native Observability (Q3 2026)
-> Related issue: #17587
+> Related issues: #17587, #19256
 
 ## Problem statement
 
-KubeStellar Console uses Claude Code GitHub Actions for AI-assisted PR review and issue triage. PRs labeled `ai-needs-human` indicate cases where the AI agent has identified issues that require human judgment, but without a defined service level agreement (SLA) or escalation path, these PRs can remain stuck indefinitely. This creates contributor friction, slows down the review pipeline, and undermines the effectiveness of the AI triage system.
+KubeStellar Console uses Claude Code GitHub Actions for AI-assisted PR review and issue triage. PRs and issues labeled `ai-needs-human` indicate cases where the AI agent has identified work that requires human judgment, but without a defined service level agreement (SLA) or escalation path, these items can remain stuck indefinitely. This creates contributor friction, slows down the review pipeline, and undermines the effectiveness of the AI triage system.
 
-Without clear expectations for human review latency, contributors cannot estimate when their PRs will be merged, and maintainers lack prioritization signals to focus their limited review bandwidth.
+Without clear expectations for human review latency, contributors cannot estimate when their PRs will be merged or when Auto-QA findings will be accepted, deferred, or closed. Maintainers also lack prioritization signals to focus their limited review bandwidth.
 
 ## Goals
 
 1. Establish measurable SLA targets for PR triage across all states (`needs-review`, `ai-needs-human`, `changes-requested`).
-2. Define a clear escalation path for `ai-needs-human` PRs that exceed the SLA threshold.
+2. Define a clear escalation path for `ai-needs-human` PRs and issues that exceed the SLA threshold.
 3. Automate SLA monitoring and alerting to surface stuck PRs before they become stale.
-4. Provide contributors with visibility into expected review timelines.
+4. Provide contributors with visibility into expected review and triage timelines.
 5. Generate weekly triage reports to track SLA adherence and identify bottlenecks.
 
 ## Non-goals
@@ -24,6 +24,7 @@ Without clear expectations for human review latency, contributors cannot estimat
 - Guaranteeing immediate reviews for all PRs — the SLA establishes targets, not hard commitments.
 - Auto-merging PRs without human approval, even when AI review passes.
 - Applying SLAs to draft PRs or PRs explicitly marked as work-in-progress.
+- Requiring maintainers to implement every Auto-QA finding. The SLA requires a clear decision, not automatic acceptance.
 
 ## Current foundation
 
@@ -69,6 +70,36 @@ When a PR receives the `ai-needs-human` label, the following escalation sequence
 4. **Day 7** — If still unreviewed, label added to bi-weekly contributor sync agenda; maintainer availability evaluated.
 5. **Day 14** — Project lead makes merge/close/defer decision; outcome documented in PR comment.
 
+## Auto-QA issue triage SLA
+
+Auto-QA issues can represent real quality gaps, noisy thresholds, or work that is too broad for a single PR. When an issue receives both `auto-qa` and `ai-needs-human`, the goal is to record a human decision within 14 days.
+
+### Required decision
+
+Each stuck Auto-QA issue should receive one of these outcomes:
+
+- **Accept**: confirm the finding is actionable, remove `ai-processing`, assign or decompose the work, and leave the issue open.
+- **Defer**: keep the finding but move it to a milestone, roadmap item, or child issues with a clear follow-up path.
+- **Close**: close as not planned when the finding is noisy, too broad, or not worth the maintenance cost.
+
+### Current backlog queue
+
+Issue #19256 tracks four Auto-QA items that need this decision path:
+
+| Issue | Decision needed |
+| --- | --- |
+| #18599 | Accept or defer the missing component test coverage work. If accepted, keep work in focused child issues. |
+| #18598 | Accept oversized test-file refactoring, tune the threshold, or close if large test files are acceptable. |
+| #19077 | Accept bundle-size work, tune the chunk-size threshold, or defer to a performance milestone. |
+| #19161 | Audit major dependency updates and decide whether to schedule, defer, or close each upgrade path. |
+
+### Escalation path
+
+1. **Day 0**: `ai-needs-human` is added; issue comment states the decision needed.
+2. **Day 7**: If no maintainer response, add the issue to the weekly triage agenda and tag a reviewer.
+3. **Day 14**: Maintainer records an accept/defer/close decision and removes `ai-processing`.
+4. **After Day 14**: If no owner exists to take the work, record **Defer** by closing as **not planned** with a short note to reopen when ownership exists.
+
 ## Automation implementation
 
 Deliver SLA enforcement through GitHub Actions workflows:

web/e2e/Dashboard.spec.ts

@@ -33,6 +33,7 @@ const MOBILE_VIEWPORT_HEIGHT_PX = 667
 const TABLET_VIEWPORT_WIDTH_PX = 768
 const TABLET_VIEWPORT_HEIGHT_PX = 1024
 const KEYBOARD_FOCUS_SEQUENCE_LENGTH = 5
+const WEBKIT_MIN_FOCUS_SEQUENCE_LENGTH = 3
 const STANDARD_TAB_KEY = 'Tab'
 const WEBKIT_FULL_KEYBOARD_TAB_KEY = 'Alt+Tab'
 const REFRESH_BUTTON_TITLE = 'Refresh cluster data'
@@ -68,6 +69,13 @@ const FOCUSABLE_SELECTOR = [
   'textarea:not([disabled])',
   '[tabindex]:not([tabindex="-1"])',
 ].join(', ')
+const WEBKIT_FOCUSABLE_SELECTOR = [
+  'a[href]',
+  'input:not([disabled])',
+  'select:not([disabled])',
+  'textarea:not([disabled])',
+  '[tabindex]:not([tabindex="-1"])',
+].join(', ')
 
 type MockCluster = {
   name: string
@@ -479,6 +487,10 @@ test.describe('Dashboard Page', () => {
       await expect(page.getByTestId('dashboard-page')).toBeVisible({ timeout: ACCESSIBILITY_ASSERT_TIMEOUT_MS })
 
       const tabKey = browserName === 'webkit' ? WEBKIT_FULL_KEYBOARD_TAB_KEY : STANDARD_TAB_KEY
+      const focusableSelector = browserName === 'webkit' ? WEBKIT_FOCUSABLE_SELECTOR : FOCUSABLE_SELECTOR
+      const requiredFocusCount = browserName === 'webkit'
+        ? WEBKIT_MIN_FOCUS_SEQUENCE_LENGTH
+        : KEYBOARD_FOCUS_SEQUENCE_LENGTH
       const expectedFocusOrder = await page.evaluate(({ selector, limit }) => {
         const isVisible = (element: Element) => {
           const htmlElement = element as HTMLElement
@@ -518,11 +530,11 @@ test.describe('Dashboard Page', () => {
           label: getLabel(element),
         }))
       }, {
-        selector: FOCUSABLE_SELECTOR,
+        selector: focusableSelector,
         limit: KEYBOARD_FOCUS_SEQUENCE_LENGTH,
       })
 
-      expect(expectedFocusOrder.length).toBe(KEYBOARD_FOCUS_SEQUENCE_LENGTH)
+      expect(expectedFocusOrder.length).toBeGreaterThanOrEqual(requiredFocusCount)
       await page.evaluate(() => {
         (document.activeElement as HTMLElement | null)?.blur?.()
       })

web/e2e/Sidebar.spec.ts

@@ -116,11 +116,13 @@ test.describe('Sidebar Navigation', () => {
     test('dashboard link navigates to home', async ({ page }) => {
       await expect(page.getByTestId('sidebar')).toBeVisible({ timeout: SIDEBAR_TIMEOUT_MS })
 
-      // Navigate away first — clicking the home link while already on "/"
-      // would not exercise any real routing behavior.
-      await page.goto('/clusters')
+      // Navigate away first using the real sidebar link instead of a deep-link
+      // goto(). Firefox/WebKit nightly runs use Vite preview and can race on
+      // direct sub-route loads, whereas in-app navigation is deterministic.
+      const clustersLink = page.locator('[data-testid="sidebar-primary-nav"] a[href="/clusters"], [data-testid="sidebar"] a[href="/clusters"]').first()
+      await expect(clustersLink).toBeVisible({ timeout: SIDEBAR_TIMEOUT_MS })
+      await clustersLink.click({ force: true })
       await page.waitForLoadState('domcontentloaded')
-      await expect(page.getByTestId('sidebar')).toBeVisible({ timeout: SIDEBAR_TIMEOUT_MS })
       await expectDashboardNavigation(page, '/clusters', 'My Clusters')
 
       const dashboardLink = page.locator('[data-testid="sidebar-primary-nav"] a[href="/"], [data-testid="sidebar"] a[href="/"]').first()

web/e2e/responsive-regression.spec.ts

@@ -1,4 +1,6 @@
 import { test, expect, Page } from '@playwright/test'
+import { mockApiFallback, mockLocalAgentUnavailable, mockApiMe } from './helpers/setup'
+import { setupDemoMode as setupSharedDemoMode } from './helpers/storage-setup'
 
 /**
  * Responsive Breakpoint Regression Tests
@@ -39,35 +41,13 @@ const KEY_ROUTES = [
 ]
 
 async function setupDemoMode(page: Page) {
-  // Seed localStorage BEFORE any page script runs so the auth guard sees
-  // the token on first execution. page.evaluate() runs after the page has
-  // already parsed and executed scripts, which is too late for webkit/Safari
-  // where the auth redirect fires synchronously on script evaluation.
-  // page.addInitScript() injects the snippet ahead of any page code (#9096).
-  await page.addInitScript(() => {
-    localStorage.setItem('token', 'demo-token')
-    localStorage.setItem('kc-demo-mode', 'true')
-    localStorage.setItem('demo-user-onboarded', 'true')
-  })
-
-  // Mock /api/me so AuthProvider has a deterministic user without a backend.
-  // Without this, WebKit may redirect to /login before the page renders. #10200
-  await page.route('**/api/me', (route) =>
-    route.fulfill({
-      status: 200,
-      contentType: 'application/json',
-      body: JSON.stringify({
-        id: '1',
-        github_id: '12345',
-        github_login: 'testuser',
-        email: 'test@example.com',
-        onboarded: true,
-      }),
-    })
-  )
+  await setupSharedDemoMode(page)
+  await mockApiFallback(page)
+  await mockLocalAgentUnavailable(page)
+  await mockApiMe(page)
 
-  // Mock MCP endpoints to prevent unmocked requests hitting a non-existent
-  // backend, which causes WebKit CORS errors and slow timeouts. #10200
+  // Keep the MCP override explicit so responsive tests always receive a stable
+  // shape for cluster-backed views, regardless of helper evolution.
   await page.route('**/api/mcp/**', (route) =>
     route.fulfill({
       status: 200,
@@ -182,10 +162,14 @@ test.describe('Responsive Breakpoint Tests', () => {
           const mobileNav = page.locator('[data-testid="mobile-menu-toggle"]')
             .or(page.locator('button[aria-label*="menu" i]'))
             .or(page.locator('[data-testid="sidebar-toggle"]'))
+            .or(page.getByTestId('navbar-home-btn'))
 
           const hasHamburger = await mobileNav.first().isVisible({ timeout: MOBILE_NAV_PROBE_TIMEOUT_MS }).catch(() => false)
 
-          // Either hamburger menu is present OR nav items are visible
+          // Either a primary navbar control is present OR nav items are visible.
+          // On narrow viewports the app can collapse into a compact header with
+          // a home button before the full nav items render, and that still
+          // satisfies "navigation is accessible" for this regression guard.
           if (!hasHamburger) {
             const navItems = page.locator('nav a, nav button')
             const navCount = await navItems.count()

web/e2e/smoke.spec.ts

@@ -154,13 +154,17 @@ test.describe('Smoke Tests', () => {
     test('clicking navbar logo navigates to home from non-home route', async ({ page }) => {
       await setupDemoMode(page)
 
-      // Navigate to a non-home route
-      await page.goto('/settings')
-      
-      // Use regex-based URL assertion for cross-browser compatibility.
-      // Glob-based waitForURL('**/settings') fails on Firefox/WebKit. (#18588)
-      await expect(page).toHaveURL(/\/settings/, { timeout: 10000 })
-      await expect(page.locator('h1:has-text("Settings")')).toBeVisible({ timeout: 10000 })
+      // Navigate via the in-app sidebar instead of a deep-link goto().
+      // The nightly workflow runs against Vite preview, where direct sub-route
+      // entry can be flaky across Firefox/WebKit. In-app navigation exercises
+      // the actual router path without relying on preview-server rewrites.
+      await page.goto('/', { waitUntil: 'domcontentloaded' })
+      const settingsLink = page.locator('[data-testid="sidebar-primary-nav"] a[href="/settings"], [data-testid="sidebar"] a[href="/settings"]').first()
+      await expect(settingsLink).toBeVisible({ timeout: 10000 })
+      await settingsLink.click({ force: true })
+
+      await expect(page).toHaveURL(/\/settings(?:[?#].*)?$/, { timeout: 10000 })
+      await expect(page.locator('main [data-testid="settings-title"]').first()).toBeVisible({ timeout: 10000 })
 
       // Click the logo button (has aria-label "Go to home dashboard").
       // The navbar renders two such buttons — the logo and the wordmark —