e2e: read OQL rows by alias; liveness for negative-only span claims; APP-DOWN between journeys

[MendixMau]

This PR fixes #154 and #150, adds the harness half of #285, and carries a follow-up to the already-merged #302 (Refs #286). It also makes the normalizer read the per-BRD conformance reports introduced in #307.

#154: OQL rows were read by position (Closes #154)

Problem. helpers.js built each row with Object.values(r), and oqlScalar returned rows[0][0]. mxcli v0.26.0 does three things that break that:

• it prints the keys alphabetically;
• it leaves out a column that is null in every row;
• over a view entity, it adds an ID key beside the alias.

So columns shifted, and a view's count was read as its ID. The brace counter also ignored strings, so a value containing ] or } made the helper return null.

Fix.

• Rows are keyed by the SELECT aliases, in SELECT order, with explicit nulls.
• oqlScalar returns the first SELECT alias, or null rather than a guess.
• New oqlRows.
• JSON slicing is now string-aware.
• The admin preflight uses the same parser.

Behaviour change for projects. oqlScalar used to return the alphabetically-first key. Check multi-column seeds, captures and baselines that feed {{vars}}.

Golden. Captured from the real binary against a stub admin API (tests/wave2/fixtures/oql-json/). test-oql-rows.sh passes 15/15; all 15 fail on master.

#150: negative-only span claims (Closes #150)

Fix. Rung 2 is now traceRung(). A negative-only claim is judged only when there is evidence that tracing is live:

• the declared spans.liveness span, or
• any service span since this journey's own start (2 s clock-skew margin).

Without that evidence the claim reads INVALID. Three more INVALID cases are now named instead of failing silently or throwing:

• a project whose otel.js is older and lacks liveness();
• a spans block that declares neither field;
• the old array shape or {}.

The trace-negative mutant injects the forbidden name after the liveness check.

Also changed.

• validate-journeys.js accepts negative-only claims and checks liveness and regex validity.
• journey-examples.md and journey-proof.md are updated.
• example.journey.json is rewritten into the runner's shape: 0 validator problems, and all 7 mutants supported.

#285, harness half: APP-DOWN between journeys (Refs #285)

Fix. The runner probes baseUrl before each journey (3 tries).

• If the app is down before a journey, that journey is recorded as APP-DOWN INVALID and not walked.
• If it is down after a journey, that journey's FAIL rows are flagged.
• APP_PROBE=0 turns the probe off.

The upstream bundler race is not addressed here.

#302 follow-up (Refs #286), plus #307 per-BRD conformance

• Credentials. config.js now reports passSource. Only the template placeholder Demo2025! is refused. A password the project set in project.config.js is accepted, the env still wins, and ALLOW_CONFIG_CREDENTIALS=1 still overrides. Before this, every journeys rung would have failed after the next sync.
• SIGINT/SIGTERM now write the findings slot as aborted: "signal …".
• report-normalize.js:
  • setup rows keep kind setup; the schema enum is updated.
  • It honours aborted: a top-level aborted field, kept rows flagged notAResult, and the instrument marked as a fault.
  • It reads the per-BRD report-<date>-<BRD>.tsv files from Fix graph-sweep/app-facts catalog guard and per-BRD conformance ledgers (#259, #260) #307: newest date wins, and every BRD file of that date is aggregated. Single-file projects are unchanged, and a stale older base file is never mixed in.
• CHANGELOG names ALLOW_CONFIG_CREDENTIALS and the 403 verdict change: data rungs used to go INVALID with exit 1; the suite now aborts with exit 2.

Checks run

Check	Result
test-journey-preflight.sh	75/75
test-report-normalize-two-tree.sh	9/9; the new per-BRD case fails on master
test-journey-liveness.sh	36/36
test-oql-rows.sh	15/15
test-validate-journeys-spans.sh	12/12
test-journey-control-exit.sh	7/7
test-journey-persona.sh	4/4
test-otel-capture-until.sh	4/4
report-normalize.js --selftest	all OK
journey-runner.selftest.js	OK
journey-rung4-scope.test.js	28/28
validate-journeys.js --selftest	OK
check-scripts, portability, private citations, leak guard, pr-discipline	clean

test-validate-journeys-spans.sh failed once under heavy load. The cause: under pipefail, printf | grep -q can be killed by SIGPIPE and flip a check. The new fixtures now use here-strings; 20 reruns were clean.

Field-run status

Still owed for every part. Nothing here has run against a live runtime or a real suite.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VJgWP5vEoAsNsJYqCDMGNw

[MendixMau]

Landed on master as part of the integration squash #329 (commit 31e90ae), after independent review — its Review: line is in that commit message. Closing as superseded.

---

Generated by Claude Code