#100 — DO: Documenso ADR 0038 live-proof suite (the open e-sign P0 gate, API level)
Split from #7 launch hardening / named in the #39 vendor-real runbook: the ADR 0038 field-metadata/embed stack has no repeatable live proof (the 2026-07-07 verification was manual). Add a gated documenso.live.test.ts (skip unless ESIGN_API_URL+ESIGN_API_KEY) proving against the real sign.firmary.app: two-signer create with identifier-0 fields + field metadata (prefill/readOnly/options — the exact shape that 404d pre-fix), distribute with vendor emails suppressed (zero sends), pending status round-trip, embedded signing-link mint from the distribute-time token, and idempotent void cleanup. Wire into vendor-real.yml. Scope note: this closes the API-level live proof; the visual check that fields RENDER correctly on the real embed remains a manual checklist line (browser+iframe, not adapter-testable).
4 Comments
Sign in to comment
·about 2 months agoCorrection + closure on finding 1: deeper audit shows the signature-field rule was ALREADY enforced app-side (CreateSignatureRequestInput superRefine names the Documenso rule explicitly, and the composer editor-model blocks send with per-signer messaging) — so no product flow was exposed; my earlier comment overstated it. The only real gap was the fake adapter accepting shapes the vendor rejects; fixed for parity on dev (fix(esign) commit): fake driver now throws the same rule, +unit test, adapters 73 + web esign integration 36/36 green. Finding 2 (orphaned DRAFT on distribute failure + the one existing orphan at Documenso) stands, low severity.
·about 2 months agoAgent A — done & live-verified; on dev at 326ad92.
What changed: packages/adapters/src/esign/documenso.live.test.ts — gated live suite (skips without ESIGN_API_URL+KEY) proving the ADR 0038 stack against the real sign.firmary.app, storage-free (in-memory minimal PDF via the injected presign/fetchBytes seams), zero emails (adapter's default vendor-email suppression). 4/4 passing: two-signer identifier-0 create with field metadata (TEXT prefill+readOnly, DROPDOWN options, RADIO default — the exact pre-fix 404 shape), requested-status round-trip, embedded signing-link mint from the distribute-time token, idempotent void cleanup. Wired as a weekly documenso-live job in vendor-real.yml (creds provisioned in ~/secrets/vendor-real.env); runbook table + truth-table E-sign row updated — the e-sign P0 gate narrows to the MANUAL visual check that fields render on the real embed page.
Two real findings this suite surfaced on its first run (why live proofs matter):
- Documenso rejects distribute when ANY signer lacks a SIGNATURE field (400 "Signers must have at least one signature field"). The fake driver does NOT enforce this — a staff member composing a signer with only text/dropdown fields will pass every test and fail at send in prod. The composer (or fake driver) should enforce parity. LEAVING THIS CARD'S STATUS at the owner's discretion for that follow-up, or split it.
- createSignatureRequest is create→distribute non-atomic: a distribute failure orphans a DRAFT envelope at Documenso (one such draft exists from the first run — title live-proof.pdf, ~2026-07-09 07:07 CT — safe to delete in the Documenso admin).
Verification: suite 4/4 live (run three times total incl. the workflow run-block verbatim with check-integration-ran guard OK); adapters typecheck + eslint clean; full adapters test suite 386 passed / 20 skipped (live suites gated as designed); YAML validated.
·about 2 months agoAgent A claiming this until completion or block. Working on shared dev. Cross-linking from #7 (in_progress but unclaimed by any agent — not touching that card itself). Started: 2026-07-09 07:25 America/Chicago.
Closed during the 2026-08-23 GitHub migration: shipped (documenso.live.test.ts 4/4 against sign.firmary.app, wired into vendor-real.yml, dev 326ad92; fake-driver parity fix followed). Finding 2 (create->distribute non-atomicity orphans DRAFT envelopes) was extracted to a GitHub bug issue: https://github.com/Firmary/firmary-os/issues/335.