Local testing runbook

Make MVP validation repeatable before the first VPS test.

Local smoke, HTTP smoke, owner-dashboard smoke, and seed commands give the owner a quick way to prove the foundation still works, exercise browser-facing routes/forms over real loopback HTTP, create a login-ready test member, and reset a disposable development database without opening production-destructive behavior.

Local-only helpers Smoke evidence Explicit reset confirmation

Commands

Local helper surface

Command	Purpose	Safety boundary
`cargo run -- local-smoke`	Runs a write-through store smoke test over migrations, preview media, account/session, recovery confirmation, entitlement, checkout return, payment webhook replay, participation, reactions, and trust/safety report primitives.	Refuses production profile; writes disposable pseudonymous smoke records.
`cargo run -- local-http-smoke`	Starts an ephemeral loopback app server, creates a disposable login-ready member, and exercises browser-facing routes/forms over real HTTP.	Refuses production profile; does not print the generated recovery key; writes disposable records.
`NOCTURNE_OWNER_KEY=... cargo run -- local-owner-smoke`	Starts an ephemeral loopback app server, logs into the gated owner dashboard, exercises owner forms, verifies the operational readiness cockpit command anchors, and prints a manual browser follow-up checklist.	Refuses production profile; requires plaintext local owner key for login proof; never prints the owner key, raw invite code, recovery key, storage keys, raw payload digests, evidence paths, backup IDs, database URLs, or raw logs.
`NOCTURNE_OWNER_KEY=... cargo run -- local-owner-visual-smoke`	Seeds disposable owner-review fixtures, starts a loopback owner dashboard, prints the review URL/checklist, and keeps the server open until Ctrl-C for manual browser QA.	Refuses production profile; requires plaintext local owner key to enable login; does not print owner keys, recovery keys, raw invite codes, storage keys, raw payloads, IPs, user-agent data, or CSRF tokens.
`cargo run -- owner-dashboard-review-plan`	Prints the secret-free manual browser QA checklist for the gated owner dashboard; add `--artifact-file ... --review-result passed` after a clean browser pass to write a hash-ready artifact.	Does not start the app, connect to the database, read secrets, open a browser, or capture raw logs; artifact mode writes only checklist/result metadata.
`cargo run -- owner-dashboard-review-artifact-check --artifact-file ...`	Verifies the generated owner visual review artifact markers, recordable result, SHA-256, and forbidden sentinels before deployment evidence recording.	Read-only and local; does not require a database, owner key, browser, or raw logs.
`cargo run -- local-seed`	Creates one confirmed test member, grants local access/signals, and opens a starter poll plus unlock goal for browser testing.	Refuses production profile; prints the generated recovery key once.
`cargo run -- local-reset-seed --confirm-local-reset`	Truncates application tables in a disposable local database, reseeds preview plans/catalog/media, then creates one login-ready test member.	Refuses production profile and requires the explicit confirmation flag.
`cargo run -- invite-code-create`	Creates a one-time invite code for manually testing `/join` without default email capture.	Prints the raw code once; stores only a SHA-256 digest and optional non-identifying owner label.
`cargo run -- doctor`	Checks local readiness after seed/reset operations.	Detailed diagnostics remain local only.

Recommended loop

Clean local validation path

Start Postgres with docker compose up -d postgres.
Run cargo run -- local-reset-seed --confirm-local-reset only when local data is disposable.
Save the printed member ID and recovery key for browser testing.
Run cargo run -- local-smoke for broad store-level local flow evidence.
Run cargo run -- local-http-smoke for browser-route/form evidence over an ephemeral loopback server.
Run NOCTURNE_OWNER_KEY=... cargo run -- local-owner-smoke for gated owner-dashboard, owner-form, operational readiness cockpit, and browser-safety sentinel evidence over an ephemeral loopback server.
Run NOCTURNE_OWNER_KEY=... cargo run -- local-owner-visual-smoke and use Owner dashboard review for the human layout/privacy/evidence pass, then write and verify a hash-ready artifact with owner-dashboard-review-plan --artifact-file deployment_evidence/owner-dashboard-visual-review.txt --review-result passed plus owner-dashboard-review-artifact-check --artifact-file deployment_evidence/owner-dashboard-visual-review.txt and record the verified owner_dashboard_visual_review evidence command.
Run cargo run -- owner-dashboard-review-plan when you only need the checklist text without starting the app.
Run cargo run -- doctor to verify config/database/media posture.
Optionally run cargo run -- invite-code-create --label "local manual join" and manually exercise /join with the printed one-time code.
Run the app and manually exercise /login, /library, /media/asset_preview_still_001, /checkout, /participation, /report, and /owner when an owner key is configured.

Reset rule: reset-seed is intentionally explicit because it destroys local application rows. It is for disposable development databases, never for production, staging, or anything worth keeping.

Smoke coverage

What local-smoke proves

Migrations apply against the configured local PostgreSQL database.
Foundation preview catalog, plan, and media metadata rows exist.
Safe preview media can be opened from NOCTURNE_MEDIA_ROOT.
A pseudonymous member can be created, recovery-confirmed, authenticated, sessioned, and CSRF-validated.
Entitlement and catalog/media gates allow the confirmed local member through.
Provider-neutral checkout return state updates without granting access by browser return alone.
Provider-neutral paid webhook replay applies exactly one paid event.
Owner-created poll/options, member vote, request Signals, Hermes request screening, private request queue, predefined reactions, and aggregate goal setup are coherent.
A privacy-preserving trust/safety report case can be recorded without login, email, raw IP/user-agent, uploads, or links.

HTTP smoke coverage

What local-http-smoke proves

An ephemeral loopback Axum server can boot from the current local configuration and database.
/healthz and /docs/ respond over real HTTP without exposing private diagnostics.
Unauthenticated /library access remains blocked.
A disposable confirmed member can log in through /login and carry the session cookie through browser-facing routes.
/account, /library, and /media/asset_preview_still_001 render the expected confirmed-account, gated-catalog, and media affordances.
Authenticated media file and download routes honor byte-range requests and attachment policy headers.
Checkout start plus success return work through CSRF-protected forms while preserving the no-browser-return-access-grant rule.
Participation vote, private request, and media reaction forms work through CSRF-protected browser paths.
The public report form can open a private external case without login, email, raw IP/user-agent capture, uploads, or links.
/owner is either disabled, requires authentication, or accepts NOCTURNE_OWNER_KEY when the plaintext key is available locally; accepted owner sessions use HMAC-signed timestamped cookies with the configured max age.

Owner dashboard smoke coverage

What local-owner-smoke proves

The owner dashboard remains gated until the configured owner key is submitted.
The no-script dashboard renders content operations, invite/access controls, payment-provider readiness, checkout/webhook maintenance, content readiness, the operational readiness cockpit, catalog showcase, participation queues, report queues, aggregate reactions, and unlock goals.
The operational readiness cockpit exposes browser-safe command anchors for deployment-evidence-check, backup-manifest-check, backup-custody-check, and private-vps-readiness without rendering underlying operator artifacts.
Dashboard privacy sentinels reject accidental rendering of private storage keys, raw payload digests, raw invite codes after one-time display, payment-provider evidence file paths/summaries, deployment evidence paths, backup manifest/custody paths, backup IDs, database URLs, raw logs, and script tags.
CSRF-protected owner forms can create/revoke an invite, grant/revoke manual access, set/clear advisory content schedules, set showcase metadata, replay a provider-neutral webhook event, review a private participation request, review a trust/safety report, and logout.
The printed report includes a manual browser follow-up checklist but never prints the owner key, generated recovery key, raw invite code, storage key, raw payment payload data, evidence ledger paths, backup identifiers, database URLs, or raw operational logs.

Non-goals

What local helpers do not prove

No live payment provider integration or public webhook signature verification.
No reverse-proxy, TLS, WAF, offsite backup, or VPS disaster-recovery proof.
No production load/performance claims.
No visual QA of the final premium landing page or cinematic motion system; HTTP smoke checks responses, not pixels or motion. The owner-dashboard visual smoke/checklist adds a human browser pass for operator layout/readability but does not validate the final public brand experience.
No bypass of the need for isolated restore drills before launch.