Plan Hermes WebUI live smoke

.sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md

@@ -0,0 +1,51 @@
+---
+name: CTO Hermes WebUI Live Smoke Issues
+status: candidate
+lifecycle_classification: sot
+owner: jp
+created: 2026-06-01
+last_reviewed: 2026-06-01
+core_promotion_status: not-promoted
+---
+
+# CTO Hermes WebUI Live Smoke Issues
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## CTO-WORK-060: Hermes WebUI Live Smoke PRD
+
+Status: validated.
+
+Acceptance criteria:
+
+- PRD defines Hermes WebUI live smoke scope.
+- PRD keeps Cortex as SOT authority.
+- PRD states Harness-backed summary data remains the source of truth.
+- PRD forbids upstream `hermes-webui` edits.
+- PRD forbids upstream `hermes-agent` edits.
+- PRD forbids Case default activation.
+- PRD forbids target repository mutation.
+
+## CTO-WORK-061: Hermes WebUI CTO Live Smoke Coverage
+
+Status: candidate.
+
+Implementation route:
+
+- Use existing plugin smoke machinery.
+- Add smoke coverage for `/api/cto/control-summary`.
+- Add smoke coverage for `/plugins/svrnty/cto_control_panel.js`.
+- Add smoke coverage for `/plugins/svrnty/cto_control_panel.css`.
+- Add focused test coverage proving the smoke list includes these paths.
+- Record validation evidence in CTO SOT after implementation.
+
+Acceptance criteria:
+
+- Hermes WebUI live smoke coverage includes `/api/cto/control-summary`.
+- Hermes WebUI live smoke coverage includes `/plugins/svrnty/cto_control_panel.js`.
+- Hermes WebUI live smoke coverage includes `/plugins/svrnty/cto_control_panel.css`.
+- Harness-backed summary data remains the source of truth.
+- Do not edit upstream `hermes-webui`.
+- Do not edit upstream `hermes-agent`.
+- Do not activate Case as default backend.
+- Do not mutate target repositories.

.sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-PRD.md

@@ -0,0 +1,62 @@
+---
+name: CTO Hermes WebUI Live Smoke PRD
+status: validated
+lifecycle_classification: sot
+owner: jp
+created: 2026-06-01
+last_reviewed: 2026-06-01
+core_promotion_status: not-promoted
+---
+
+# CTO Hermes WebUI Live Smoke PRD
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Problem
+
+`CTO-WORK-059` proved the Hermes WebUI CTO panel by unit and aggregate plugin tests. The next useful proof is a Hermes WebUI live smoke path that proves the route and assets are present through existing plugin smoke machinery.
+
+## Scope
+
+Add Hermes WebUI live smoke coverage for:
+
+- `/api/cto/control-summary`
+- `/plugins/svrnty/cto_control_panel.js`
+- `/plugins/svrnty/cto_control_panel.css`
+
+The smoke may accept normal auth-gated status codes when the WebUI is protected. It must still prove the route/static paths are wired into the Hermes-owned plugin surface.
+
+## Non-goals
+
+- Do not edit upstream `hermes-webui`.
+- Do not edit upstream `hermes-agent`.
+- Do not activate Case as default backend.
+- Do not mutate target repositories.
+- Do not introduce a new browser automation stack if existing plugin smoke machinery is enough.
+- Do not move authority from Cortex SOT to Hermes or Case.
+
+## Acceptance Criteria
+
+- Existing plugin smoke machinery includes the CTO route and panel assets.
+- `/api/cto/control-summary` is represented in deterministic smoke coverage.
+- `/plugins/svrnty/cto_control_panel.js` is represented in deterministic smoke coverage.
+- `/plugins/svrnty/cto_control_panel.css` is represented in deterministic smoke coverage.
+- Harness-backed summary data remains the source of truth.
+- Case default activation remains false.
+- Target repository mutation remains false.
+
+## Validation
+
+- Focused: run the plugin tests that cover smoke route registration and CTO panel assets.
+- Aggregate before commit: run plugin connection-map check and full plugin tests once.
+- Aggregate after merge: run plugin connection-map check and full plugin tests once.
+- CTO evidence: record commit and validation output in child-local SOT.
+
+## Risks
+
+- A live WebUI process may be password-gated or unavailable. Treat that as an allowed smoke status if the route is registered and protected, not as a product failure.
+- Starting the full WebUI may be slower than unit checks. Do not over-expand beyond existing smoke coverage.
+
+## Success Definition
+
+Hermes WebUI live smoke coverage can prove the CTO panel route and assets are wired without changing upstream vendor source, activating Case default behavior, or mutating any target repository.

WORKBOARD.yaml

@@ -296,3 +296,13 @@ items:
     status: validated
     source: .sot/03-PROTOCOLS/CTO-HERMES-WEBUI-CONTROL-PANEL-ISSUES.md
     owner: ""
+  - id: CTO-WORK-060
+    title: Hermes WebUI CTO Live Smoke PRD
+    status: validated
+    source: .sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-PRD.md
+    owner: ""
+  - id: CTO-WORK-061
+    title: Hermes WebUI CTO Live Smoke Coverage
+    status: candidate
+    source: .sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md
+    owner: ""

tools/validate_cto_child.py

@@ -51,6 +51,8 @@ REQUIRED_FILES = [
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-CONTROL-PANEL-PRD.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-CONTROL-PANEL-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-CONTROL-PANEL-EVIDENCE.md",
+    ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-PRD.md",
+    ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-PRD.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-FIRST-REAL-GOVERNED-WORKFLOW-APPROVAL-PACKET.md",
@@ -170,6 +172,20 @@ REQUIRED_HERMES_WEBUI_CONTROL_PANEL_EVIDENCE_PHRASES = [
     "Harness-backed summary data remains the source of truth.",
 ]
 
+REQUIRED_HERMES_WEBUI_LIVE_SMOKE_PHRASES = [
+    "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
+    "Hermes WebUI live smoke",
+    "existing plugin smoke machinery",
+    "/api/cto/control-summary",
+    "/plugins/svrnty/cto_control_panel.js",
+    "/plugins/svrnty/cto_control_panel.css",
+    "Harness-backed summary data remains the source of truth.",
+    "Do not edit upstream `hermes-webui`.",
+    "Do not edit upstream `hermes-agent`.",
+    "Do not activate Case as default backend.",
+    "Do not mutate target repositories.",
+]
+
 REQUIRED_HERMES_REAL_REFRESH_CONTROL_REPLAY_EVIDENCE_PHRASES = [
     "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
     "CTO-WORK-057",
@@ -1193,6 +1209,26 @@ def main() -> int:
             if phrase not in text:
                 errors.append(f"missing_hermes_webui_control_panel_evidence_phrase:{phrase}")
 
+    hermes_webui_live_smoke_prd = ROOT / ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-PRD.md"
+    if hermes_webui_live_smoke_prd.is_file():
+        text = hermes_webui_live_smoke_prd.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("hermes_webui_live_smoke_prd_missing_not_promoted_frontmatter")
+        for phrase in REQUIRED_HERMES_WEBUI_LIVE_SMOKE_PHRASES:
+            checked.append(f"hermes_webui_live_smoke_prd_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_hermes_webui_live_smoke_prd_phrase:{phrase}")
+
+    hermes_webui_live_smoke_issues = ROOT / ".sot/03-PROTOCOLS/CTO-HERMES-WEBUI-LIVE-SMOKE-ISSUES.md"
+    if hermes_webui_live_smoke_issues.is_file():
+        text = hermes_webui_live_smoke_issues.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("hermes_webui_live_smoke_issues_missing_not_promoted_frontmatter")
+        for phrase in ["CTO-WORK-060", "CTO-WORK-061", *REQUIRED_HERMES_WEBUI_LIVE_SMOKE_PHRASES]:
+            checked.append(f"hermes_webui_live_smoke_issue_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_hermes_webui_live_smoke_issue_phrase:{phrase}")
+
     hermes_real_refresh_control_replay_evidence = ROOT / ".sot/03-PROTOCOLS/CTO-HERMES-REAL-REFRESH-CONTROL-REPLAY-EVIDENCE.md"
     if hermes_real_refresh_control_replay_evidence.is_file():
         text = hermes_real_refresh_control_replay_evidence.read_text(encoding="utf-8")
@@ -1803,6 +1839,8 @@ def main() -> int:
             "CTO-WORK-057": "validated",
             "CTO-WORK-058": "validated",
             "CTO-WORK-059": "validated",
+            "CTO-WORK-060": "validated",
+            "CTO-WORK-061": "candidate",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")