From 8db5b236c46bf9e398577cace9b53e2725b40b3c Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Mon, 15 Jun 2026 15:22:18 -0400
Subject: [PATCH] test(12): persist human verification items as UAT

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../phases/12-initial-setup-wizard/12-UAT.md  | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 .planning/phases/12-initial-setup-wizard/12-UAT.md

diff --git a/.planning/phases/12-initial-setup-wizard/12-UAT.md b/.planning/phases/12-initial-setup-wizard/12-UAT.md
new file mode 100644
index 0000000..d16727d
--- /dev/null
+++ b/.planning/phases/12-initial-setup-wizard/12-UAT.md
@@ -0,0 +1,55 @@
+---
+status: testing
+phase: 12-initial-setup-wizard
+source: [12-VERIFICATION.md]
+started: 2026-06-15T19:22:00Z
+updated: 2026-06-15T19:22:00Z
+---
+
+## Current Test
+
+number: 1
+name: Complete the setup wizard end-to-end against a real Fastmail account
+expected: |
+  With the rebuilt API container running and the dev DB unconfigured (no setup_complete,
+  no member_credentials), navigating to http://localhost:5173/ redirects to /setup. The
+  operator advances Welcome → Instance (App URL / OIDC issuer / OIDC client ID / VAPID
+  public key → Save & Validate shows DB, OIDC, and VAPID validation rows all passing
+  against a reachable Authelia) → Calendar (Fastmail email + app password → CalDAV PROPFIND
+  validation succeeds) → Complete. POST /api/setup/complete returns 200 and the "Setup
+  complete" terminal surface renders.
+awaiting: user response
+
+## Tests
+
+### 1. Complete the setup wizard end-to-end against a real Fastmail account
+expected: |
+  Redirect-to-/setup gate fires; Instance step's Save & Validate shows DB + OIDC + VAPID
+  rows all green (needs a reachable Authelia + correct VAPID env); Calendar step validates
+  a real Fastmail app password via live CalDAV PROPFIND; POST /api/setup/complete returns
+  200; "Setup complete" terminal screen appears.
+result: [pending]
+
+### 2. Step-2 validation rows reflect real backend results
+expected: |
+  With a reachable Authelia and correct VAPID_PUBLIC_KEY/VAPID_PRIVATE_KEY env, the OIDC
+  and VAPID validation rows pass. With a wrong/swapped VAPID key, the VAPID row fails and
+  the Continue button stays disabled (the gap-closure guard — db AND oidc AND vapid).
+result: [pending]
+
+### 3. Setup endpoints lock once complete (423)
+expected: |
+  After completing setup, re-navigating to /setup shows the "setup already complete"
+  surface, and POST to any /api/setup/* mutating route returns HTTP 423 Locked.
+result: [pending]
+
+## Summary
+
+total: 3
+passed: 0
+issues: 0
+pending: 3
+skipped: 0
+blocked: 0
+
+## Gaps