Ansible/scripts/addons/webgui/docs/CONTROLLER-PILOT.md

Controller acceptance - WebGUI2.1.0rc9 / Core3.3.0rc8

Controller prerequisite: Core rc8 requires ansible.windows >=3.8.0,<4.0.0 for Windows playbooks. Confirm it in the canonical collection path under the executor identity; WebGUI does not install collections.

Not a record of already performed managed-host tests. Use Core's SANITY.md and approved disposable targets. Preserve the actual execution UID/groups/HOME/sandbox and both staging exceptions; do not use root-shell success to certify the service.

1. Quiesce/backup, deploy Core independently, deploy new WebGUI preserving schema5 (or migrate older schema4), verify versions/permissions and installed executor preflight. Check terminal AIM remains independent. Confirm old prepared jobs did not replay and old history remains.
2. Run role detection and disk usage on a small approved scope. Verify prepared report declaration/schema, existing Unlock modal, final native facts and report payloads against authorized native observation. Verify unavailable/null/false values are distinct.
3. During a longer safe run, close the page, reopen/reload, use another authorized device and inspect the same committed timeline. Check interleaved host/task IDs, last activity and bounded internal scrolling. Manual upward scrolling stops following. No invented ETA/completion percentage.
4. Check mixed targets (one unreachable) and separate report availability. Test a controlled required-report fixture failing validation after native exit0: job stays failed/result_validation, native targets remain visible and no automatic retry occurs. Fixture/source changes require fresh review.
5. Verify all nine report types in separately approved scope. Patching/reboot/service-start/export/delete operations require dedicated test conditions, not a casual UI smoke. Reports change task totals; compare intended effects, outcomes and schemas, not old exact task counts.
6. Verify default parsed Checkmk config retention excludes sections while showing file/redaction metadata. Full content opt-in is deliberate. Check report copying/rendering and narrow mobile/short landscape; values never become HTML or automatic links.
7. Revoke session/access while streaming, check another owner's job is unavailable, and confirm admin access does not mean submitting someone else's credentials. Verify journal/report deletion cascades and Host Activity contributions disappear without recreating data from audit.
8. In a disposable run, restart a worker/executor and confirm prior recorded metadata survives but remote execution is not automatically resumed/replayed; uncommitted metadata or missing final outcome is disclosed.
9. Test retention with synthetic high-volume data, not unbounded production playbooks. Omissions must be visible; final Core facts remain independent. Monitor DB growth/backups and storage pressure.
10. Test matched schema/Core rollback with historical DB warning and sessions revoked. An incompatible restored adapter must remain stopped/disabled until independent Core rollback and explicit service enablement.

Record actual versions, UID/group context, platform, report/mode and final result. Source/browser fixtures or success on one host do not certify all9 operations, other operating systems, physical keyboards, global reports or a different security profile.

Core rc8 patch-wave and native-baseline acceptance

After the low-risk reporting checks above, use Core3.3.0rc8's current SANITY.md on separately approved disposable Windows update/reboot targets. Confirm the new catalog controls, false continuation hint, omitted inherited values and explicit true/false review. A reboot flag must not auto-enable continuation.

Verify a successful patch-triggered reboot can end with continuation_required=true, remaining_updates_known=false and no next-wave list or auto-submitted job. Verify an explicit continuation run uses the documented Core cycle bound. Test the final read-only pending discovery path, deferred reboot, pre-existing-reboot block and a bounded per-update failure. Distinguish unsigned/hex HRESULT plus reason/message from the independent pending-reboot observation. Old reports without wave fields should remain viewable and labeled as historical; no unknown value becomes false/zero.

Do not equate a Windows test with Linux or every supported Windows release. Preserve native result-validation failures, partial host outcomes, journal/report retention, modal deadlines and global SSH trust. This release does not change their policies.