@@ -442,6 +442,12 @@ following:
4424425. **No outbound dependencies.** Smoke runs on air-gapped hosts. Specs must
443443 not call `fetch('https://...')` for any host other than the WebUI endpoint
444444 itself.
445+ 6. **Describe-level tags apply to every nested test.** The role tag must
446+ reflect the highest privilege any test inside the describe needs. If a
447+ describe mixes `loginAsAdmin` and `loginAsUser` calls, tag it
448+ `@smoke-admin` — admin credentials are the broader superset and the
449+ describe is only runnable in admin mode. Splitting into two describes is
450+ preferred when feasible; pragmatic tagging is acceptable for MVP.
445451
446452### How to apply
447453
@@ -456,7 +462,7 @@ test.describe(
456462 () => { /* ... */ },
457463);
458464
459- // After — added @smoke and @smoke-user
465+ // After — added @smoke and @smoke-admin (beforeEach uses loginAsAdmin)
460466test.describe(
461467 'Session Lifecycle Management',
462468 {
@@ -465,7 +471,7 @@ test.describe(
465471 '@session',
466472 '@functional',
467473 '@smoke',
468- '@smoke-user ',
474+ '@smoke-admin ',
469475 ],
470476 },
471477 () => { /* ... */ },
@@ -479,8 +485,8 @@ A spec without a `tag:` option needs one added — never strip existing tags.
479485The initial smoke set covers the highest-signal flows:
480486
481487- Login / authentication → `@smoke-any`
482- - Dashboard render → `@smoke-any`
483- - Session lifecycle (create → running → terminate) → `@smoke-user`
488+ - Dashboard render → `@smoke-admin` (describe mixes admin + user logins)
489+ - Session lifecycle (create → running → terminate) → `@smoke-admin` (uses `loginAsAdmin`)
484490- VFolder basic CRUD → `@smoke-user`
485491- Agent list (admin signal) → `@smoke-admin`
486492
0 commit comments