Validate the operator console by eye without storing secrets.
The automated owner smoke proves gated HTTP behavior. This checklist covers the human browser pass: layout clarity, action comprehension, no-script posture, privacy sentinels, and sanitized evidence before private VPS testing.
Print the checklist locally
Use the command when you want a terminal-safe, copyable review plan or a hash-ready local artifact. owner-dashboard-review-plan does not start the app, connect to a database, open a browser, or read secrets. With --artifact-file, it writes a 0600 secret-free checklist/result artifact and prints the matching owner_dashboard_visual_review evidence command. owner-dashboard-review-artifact-check re-reads that local artifact, verifies owner-review markers and secret sentinels, computes SHA-256, and prints the evidence command only when the artifact is recordable. local-owner-visual-smoke does seed disposable review fixtures and hold a loopback server open until Ctrl-C, but it still refuses production and prints no secret material.
NOCTURNE_OWNER_KEY=... cargo run --locked -- local-owner-visual-smoke
cargo run --locked -- owner-dashboard-review-plan
cargo run --locked -- owner-dashboard-review-plan --artifact-file deployment_evidence/owner-dashboard-visual-review.txt --review-result passed
cargo run --locked -- owner-dashboard-review-artifact-check --artifact-file deployment_evidence/owner-dashboard-visual-review.txt
Run automated proof before visual proof
- Start local Postgres with
docker compose up -d postgres. - Run
NOCTURNE_OWNER_KEY=... cargo run --locked -- local-owner-smoke. - Run
NOCTURNE_OWNER_KEY=... cargo run --locked -- local-owner-visual-smoke. - Open the printed loopback
/ownerreview URL in a normal browser window.
Owner actions to exercise by hand
- Confirm the locked owner gate appears before login and does not expose dashboard data.
- Submit the owner key and confirm the dashboard unlocks without confusing copy or redirect loops.
- Create one invite, copy the raw code only from the one-time custody view, refresh, and confirm the raw code is gone.
- Grant and revoke one disposable member entitlement using a pseudonymous member ID from local seed/smoke data.
- Set and clear one advisory content-drop schedule without publishing media automatically.
- Feature and unfeature one catalog item while confirming no storage key or public media URL is shown.
- Confirm the operational readiness cockpit shows derived status rows and shell command anchors only, not evidence paths, artifact paths, backup IDs, raw summaries, provider material, database URLs, CSRF tokens, raw logs, IPs, or user-agent data.
- Confirm the payment-provider readiness panel shows only provider-review evidence status, timestamp, and yes/no markers, not raw provider notes or evidence file paths.
- Replay one disposable provider-neutral webhook event created by local owner smoke.
- Review one pending participation request and one trust/safety report with short non-identifying owner notes.
- Logout and confirm
/ownerre-locks before dashboard data is visible again.
What the browser should communicate
| Area | Pass signal |
|---|---|
| Information architecture | Content operations, invite/access controls, operational readiness, payment-provider readiness, payment maintenance, catalog showcase, participation, reports, reactions, and goals are scannable as distinct sections. |
| Action clarity | Forms explain consequence and reversibility before submit controls, especially revoke, archive, quarantine, expiry, and replay actions. |
| Queue readability | Blocked, ready, live, archived, warning, and empty states are understandable without server logs. |
| Responsive practicality | Tables and action controls remain readable on a laptop-width viewport without clipped controls or unexpected horizontal scrolling. |
| No-script posture | The owner dashboard remains usable with browser JavaScript disabled because current owner operations are server-rendered forms. |
Search the rendered source before accepting the pass
- No
<scripttags on the owner dashboard. - No private media storage keys, filesystem-like private paths, or direct private-media references.
- No raw payload digests, raw webhook payloads, payment customer identity, card data, provider approvals/contracts/dashboards, deployment-evidence summaries, evidence file paths, artifact paths, backup IDs, database URLs, raw logs, emails, IP-like strings, or user-agent text.
- No raw invite code after the one-time custody view has been refreshed.
- CSRF inputs exist for owner forms, but their values are not copied into notes, screenshots, or committed evidence.
- Owner notes and references reject URL/email/IP/identity-like content rather than preserving it in dashboard output.
Record only sanitized proof
After a clean pass, write a fresh artifact with --review-result passed, run owner-dashboard-review-artifact-check against that artifact, then run the verified evidence command. Keep raw browser output and screenshots out of git unless they are fully redacted and stored as hashed artifacts.
cargo run --locked -- owner-dashboard-review-plan --artifact-file deployment_evidence/owner-dashboard-visual-review.txt --review-result passed
cargo run --locked -- owner-dashboard-review-artifact-check --artifact-file deployment_evidence/owner-dashboard-visual-review.txt
The checker prints a deployment-evidence-record --stage owner_dashboard_visual_review --artifact-file ... command only after the local artifact has the expected owner-review markers, a recordable result, and no known forbidden sentinels. The operational readiness cockpit and payment-provider readiness panel follow the same evidence discipline: they read local evidence/backup metadata but render only derived status, counts, command anchors, timestamps, and yes/no markers.