relicario/docs/superpowers/test-runs/2026-04-24-1c-beta-manual-matrix.md

Plan 1C-β (β₁ + β₂) — Manual Test Matrix

Walkthrough for validating the typed-item forms (β₁) and the custom-fields editor + vault-settings + generator-popover surfaces (β₂) on Chrome and Firefox.

Branch: main @ 783cb7c (tags plan-1c-beta1-complete, plan-1c-beta2-complete). Pre-req: α matrix already validated — this round assumes the foundation works and focuses on the new β surfaces.

---

Pre-flight

• P1. Bundles built fresh:

  cd /home/alee/Sources/relicario/extension
  bun run build:all
  

  Expected: "compiled with 2 warnings" (WASM size only) for each of Chrome (dist/) and Firefox (dist-firefox/).

• P2. Test suites green:

  cd /home/alee/Sources/relicario && cargo test --workspace
  cd /home/alee/Sources/relicario/extension && bun run test
  

  Expected: 155 Rust + 124 Vitest, all pass.

• P3. Throwaway vault ready (don't pollute your real history). Either reuse the α-validated test vault, or do a fresh chrome.storage.local clear and re-init via setup tab.

• P4. Reference JPEG on hand for unlock.

---

Loading

Chrome

• L1. chrome://extensions → "Load unpacked" → extension/dist/. (Or "Update" if already loaded — webpack regenerated everything.)
• L2. Toolbar icon visible. Click → unlock or setup.

Firefox

• L3. about:debugging#/runtime/this-firefox → "Load Temporary Add-on" → extension/dist-firefox/manifest.json.
• L4. Toolbar icon visible. Click → unlock or setup.

Run the entire matrix on Chrome first, then re-run Section A (β₁ types) and Section B (β₂ surfaces) on Firefox. Section C (cross-cutting) needs to pass on both browsers.

---

Section A — β₁ typed-item forms

For each new type the matrix checks: add → list icon → detail render → field round-trip → edit → trash. Login was validated in α; spot-check it under A0.

A0. Login regression spot-check

• Open popup → "+ New" → Login.
• Expected: Form has title / url / username / password (with "gen" button) / TOTP secret (optional).
• Fill and save; verify it appears in the list and detail-view round-trips.
• Notes: ___

A1. SecureNote

• Do: "+ New" → SecureNote. Title wifi. Body SSID: foo<newline>Password: bar. Save.
• Expected list row: 📝 (or note icon) + wifi.
• Expected detail: Body renders preserving newlines; reveal/copy works on the body.
• Edit: Change body; save; detail reflects new body; modified time bumps.
• Trash: Disappears from list. CLI cross-check: relicario list --trashed | grep wifi.
• Notes: ___

A2. Identity

• Do: "+ New" → Identity. Title Personal. Fill at least: full name, email, phone. Leave some fields empty intentionally (e.g. address).
• Expected: Detail view renders only the fields you populated — empty fields should NOT show as blank rows. core.address === undefined not "" (verify via CLI relicario get Personal --show if curious).
• Edit: Add a field that was previously empty; save; detail shows the new row.
• Trash: Soft-deletes.
• Notes: ___

A3. Card

• Do: "+ New" → Card. Title Visa Test. Cardholder J. DOE. Number 4111111111111111 (the canonical Visa test number — brand should auto-detect to "Visa"). CVV 123. Expiry 08 / 2029. PIN 9999.
• Expected during edit: Brand chip flips to "Visa" once 4+ digits are typed (BIN match on 4).
• Expected detail: number/cvv/pin are concealed by default; reveal on each works; copy on each puts the value on clipboard. Expiry shows 08/2029.
• Wire-format check (CLI): relicario get "Visa Test" --show --json | jq '.core.expiry' should be {"month":8,"year":2029} (numbers, not strings).
• Trash: Soft-deletes.
• Notes: ___

A4. Key

• Do: "+ New" → Key. Title gh-deploy. Algorithm ed25519 (free-text). Paste a multi-line ASCII key into key_material (any junk is fine — -----BEGIN OPENSSH PRIVATE KEY-----\nblah\n-----END...).
• Expected: key_material is concealed/textarea-style; reveal shows full content with line breaks intact; copy puts the multi-line value on clipboard verbatim.
• Edit: Append to algorithm string; save; detail reflects.
• Trash: Soft-deletes.
• Notes: ___

A5. Totp — TOTP kind (6 digits)

• Do: "+ New" → Totp. Title GitHub-2FA. Secret JBSWY3DPEHPK3PXP (RFC 6238 vector). Kind: TOTP.
• Expected detail signature block: Big 6-digit code (rotates every 30s); countdown ring shrinks each tick; code refreshes at the rollover without a manual reload.
• Cross-check: oathtool --totp -b JBSWY3DPEHPK3PXP (or any TOTP authenticator) → matches what the popup shows for the same wall-clock second.
• Copy: "copy code" button puts current code on clipboard.
• Notes: ___

A6. Totp — Steam Guard kind (5 alphanumeric)

• Do: "+ New" → Totp. Title Steam. Secret JBSWY3DPEHPK3PXP (any base32 will do for the test). Toggle kind to Steam.
• Expected: Form's digits field disappears or locks (Steam is fixed at 5).
• Expected detail: 5-character alphanumeric code (e.g. H7K2C). All chars from the Steam alphabet 23456789BCDFGHJKMNPQRTVWXY (no 0, 1, A, E, I, O, S, U, Z, L).
• Edit: Switch kind to TOTP, save; detail flips to 6-digit decimal. Switch back to Steam; flips back to 5-char.
• CRITICAL: If switching kinds doesn't re-render the detail-view computed code correctly after save, that's a stale-state bug — file before continuing.
• Notes: ___

A7. Document type — gating

• Do: "+ New" → Document.
• Expected: "Coming soon" placeholder (planned for γ). Back button returns to list. Should not crash or render a partial form.
• Notes: ___

---

Section B — β₂ surfaces

B1. Custom fields editor — add path

• Do: Open any item form (Login is fine). Scroll to the disclosure labeled "custom fields ▸" (or similar). Click to expand.
• Expected: Disclosure expands; "+ section" / "+ field" controls appear.
• Do: Add a section named recovery codes. Add two fields under it: kind=password with label code 1 value aaaa-bbbb, and kind=concealed with label code 2 value cccc-dddd. Save.
• Expected: Detail view shows the typed Login rows first, then the recovery codes section header, then the two custom rows. Each concealed/password row has reveal + copy.
• CLI cross-check: relicario get <item> --show --json | jq '.sections' shows the section with both fields.
• Notes: ___

B2. Custom fields editor — edit path

• Do: Edit the same item. In the disclosure, remove code 1, edit code 2's label to recovery hash, add a new text kind field labeled notes value worked 2024-04. Save.
• Expected: Detail reflects all three changes (one removed, one renamed, one added).
• Edge: A blank label field — does β₂ render as (unnamed) or reject save? (Spec says render; verify either is acceptable but consistent.)
• Notes: ___

B3. Custom fields editor — kind sniff

• Do: On a fresh add of an Identity item (or any type), open custom fields. Add fields of each supported kind (text / password / concealed). For each, verify in detail view: text is plain visible; password and concealed are masked with reveal/copy.
• Expected: No reordering controls (β₂ scope), but adding a new field appends to end.
• Notes: ___

B4. Vault settings — open path via ⚙ picker

• Do: Click the ⚙ icon in the toolbar. β₂ split this into a picker.
• Expected: A small menu appears with two choices — device settings (capture toggle, prompt style, blacklist) and vault settings (retention/generator/origin-acks). Pick "vault settings".
• Expected: Vault settings screen renders with a back arrow.
• Notes: ___

B5. Vault settings — trash retention

• Do: In vault settings, change "trash retention" from default to 7 days.
• Expected: Save button enables (was disabled because no diff).
• Do: Save; lock; re-unlock; reopen vault settings.
• Expected: Still 7 days (decrypted from the persisted VaultSettings).
• Notes: ___

B6. Vault settings — history retention

• Do: Change "field history retention" to last 5 (or 30 days if your build offers last_n selectors). Save.
• Expected: Persists across lock/unlock.
• Notes: ___

B7. Vault settings — generator preview + "configure"

• Expected by default: Generator preview line shows current saved default (e.g. Random, 20 chars, lower+upper+digits+symbols, safe symbols).
• Do: Click "configure ▾". Popover opens inline (anchored to the preview line).
• Do: Change kind to BIP39. Set word count to 8. Set separator to -. Set capitalization to lower.
• Expected: Preview-string in the popover refreshes per-keystroke (debounced); a sample generated phrase shows.
• Do: Click "save as default". Popover closes. Preview line on the vault-settings screen now reads BIP39, 8 words, "-" separator, lower.
• Do: Lock; re-unlock; reopen vault settings.
• Expected: Preview still shows BIP39 default.
• Notes: ___

B8. Generator popover — open from Login form

• Do: "+ New" → Login. Click the "gen" button next to the password field.
• Expected: Generator popover opens inheriting the BIP39 default from B7. Sample phrase visible.
• Do: Click "use this value".
• Expected: The Login form's password field gets the BIP39 phrase. Popover closes.
• Edge: Open popover; toggle kind to Random; popover refreshes with random preview; click "use this value" — random string lands in the field. (Toggling shouldn't permanently mutate the saved default.)
• Notes: ___

B9. Generator popover — kind toggle round-trip

• Do: Open popover from a fresh Login form. Toggle Random ↔ BIP39 several times.
• Expected each toggle: Preview redraws; debounced request shape switches between generate_password and generate_passphrase.
• Smoke: No console errors on toggle.
• Notes: ___

B10. Vault settings — origin-ack revoke

• Pre-req: Have at least one acked origin (e.g. github.com from α step 6).
• Do: Vault settings → scroll to "autofill acks". Find the github.com row. Click "revoke".
• Expected: Row disappears (or shows "revoked").
• Save (β₂ batches changes). Lock; re-unlock; reopen.
• Expected: Row stays gone.
• Do: Navigate to github.com/login; click the autofill icon.
• Expected: TOFU prompt re-fires — the origin is no longer pre-acked.
• CRITICAL: If autofill silently succeeds without re-prompting, the revoke didn't actually clear VaultSettings.autofill_origin_acks.
• Notes: ___

B11. Vault settings — discard / no-op

• Do: Open vault settings. Don't change anything. Click back arrow.
• Expected: Returns to list with no save attempt (popup didn't network-request).
• Do: Open again; change something; click back without saving.
• Expected: Either a confirm prompt OR silent discard. Reopen; the change is gone (not persisted).
• Notes: ___

B12. ⚙ picker — device-settings path regression

• Do: ⚙ → "device settings".
• Expected: The α-era device settings screen appears (capture toggle, bar/toast style, blacklist). All controls still functional.
• Notes: ___

---

Section C — Cross-cutting

C1. Field history captured for new typed kinds

• Do: Edit the Card item from A3; rotate the cvv. Save.
• Do: Edit the Key item from A4; rotate key_material. Save.
• Do: Edit the Totp item from A5; rotate the secret. Save.
• Expected (CLI): relicario get <each> --show --json | jq '.field_history' has an entry for the rotated concealed/password field with old value + timestamp.
• Notes: ___

C2. List icon parity per type

• Do: Scroll the populated list.
• Expected: Each row's icon matches its type. Login 🔑, SecureNote 📝, Identity 👤, Card 💳, Key 🗝, Totp ⏱ (or whatever the implementation chose — the matrix only checks consistency, not specific glyph).
• Notes: ___

C3. Search across new types

• Do: Use the search box; type a substring of an item title for each type.
• Expected: Each type-specific item is findable; the type chip/icon is correct in the filtered list.
• Notes: ___

C4. Sync / git push round-trip

• Do: From your throwaway test vault host, after creating items A1–A6 and the custom-field item from B1, run a sync from the popup (sync icon).
• Expected: Push succeeds; git log on the test repo shows new commits.
• Do: From CLI in main worktree, relicario sync then relicario list.
• Expected: Same items visible. (Tests round-trip integrity of the new wire format on a real git host, not just localStorage.)
• Notes: ___

C5. Firefox parity

• Do: Re-run Section A (A0–A7) and Section B (B1–B12) on the Firefox-loaded dist-firefox/.
• Expected: Behavior identical to Chrome.
• Watch for: WASM-loading drift (FF uses initDefault(wasmUrl) not initSync because background.js is persistent, not SW). Anything broken on FF that works on Chrome is a WASM-init bug.
• Notes: ___

---

Final acceptance

• A1. All Section A scenarios pass on Chrome.
• A2. All Section B scenarios pass on Chrome.
• A3. All Section A + B scenarios pass on Firefox.
• A4. Section C cross-cutting all pass.
• A5. Lint sweeps green:

  git grep -n 'idfoto' extension/                                       # 0
  git grep -n '@ts-nocheck' extension/src/                              # 0
  git grep -n 'innerHTML\|insertAdjacentHTML' extension/src/content/    # 0
  git grep -n 'coming-soon\|Coming in' extension/src/popup/components/  # only 'document'
  

---

Findings / issues

Use this space to log anything weird. For each issue: file path + symptom + repro steps. Bug-fix commits go to main as you find them.

(fill in as you go)

Decision

• All clean — proceed to brainstorm 1C-γ.
• Bugs found and patched on main; re-run affected sections.
• Bugs found that warrant a worktree (>3 commits to fix).

---

Generated 2026-04-24 — sources: spec 2026-04-22-relicario-extension-1c-beta1-design.md §3.9, spec 2026-04-22-relicario-extension-1c-beta2-design.md "Manual matrix", α matrix 2026-04-20-1c-alpha-manual-matrix.md.