--- status: reconciled-partial coverage_depth: deep last_reconciled: 2026-07-17 specs: - apps/oshun/web/e2e/aaa-upgrade-entitlement-bounce.spec.ts - apps/oshun/web/e2e/entitlements-aaa-bff.spec.ts source: WALKTHROUGH/journeys/aaa-upgrade-entitlement-bounce.md --- # Journey result: AAA upgrade entitlement bounce - **Walked**: 2026-05-29 by Claude (Opus 4.8) against commit `bf12b0f7d8` plus the repair made during that walk. - **Reconciled**: 2026-07-17 against the current proxy, disclosure page, entitlement route, and focused Playwright suites. This is a source and automation reconciliation, not a claim that the 2026-05-29 walker was rerun. - **Verdict**: **partial** — the historical route walk passed and the shipped boundary now has deep browser, real-HTTP BFF, mobile, telemetry, safety, and offline-replay coverage. It is still partial at journey level because the web proxy and BFF entitlement resolver are independently proven rather than one joined call chain, and proxy-side structured access-log evidence remains open. - **Historical runner**: `/tmp/claude-oshun-lt-2-walkthrough/walk.mjs aaa-upgrade-entitlement-bounce`. The temporary path is retained as provenance only; the repository Playwright specs below are the portable rerun surface. ## Result at a glance | Evidence lane | Current result | Disposition | | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | | Studio Isis web boundary | AAA creator and operator-admin sessions receive a 307 disclosure redirect; contemplative, missing, and malformed sessions receive a non-leaking 404 | Proven | | Disclosure page | Safe source echo, fixed internal destinations, CTA telemetry, keyboard focus, 44 px targets, mobile standalone layout | Proven | | BFF entitlement status | Authenticated tier resolution, AAA-only surface inventory, upgrade status, anonymous 401 | Proven separately | | Offline continuity | A warmed `/aaa-upgrade` document replays from the real Chromium service worker | Proven in Chromium | | Cross-layer authority | Proxy tags are not resolved by calling `GET /v1/entitlements/aaa` | Not one joined flow | | Proxy decision observability | Structured redirect / hard-block access logs | Open | ## Evidence map The key distinction is product transfer versus entitlement status. The web boundary sends an already-AAA-tagged visitor to a disclosure because the raw surface lives in Yemaya; the BFF status route separately reports that the same tier is entitled and does not require an entitlement upgrade. ```mermaid flowchart LR A[Studio Isis AAA-only route] --> B{Web proxy tier} B -->|AAA creator or operator admin| C[307 disclosure] B -->|contemplative or invalid| D[404 app shell] C --> E[Safe source normalization] E --> F[Continue in Yemaya] E --> G[Back to generation gallery] H[BFF entitlement route] --> I{Authenticated tier} I -->|AAA tier| J[Entitled; no upgrade required] I -->|contemplative| K[Upgrade available] C -. independently tested .- H ``` ## Proven observations ### Historical walk - `/aaa-upgrade` rendered the intended “This surface lives in Yemaya AAA Studio” transfer notice. - `/billing` and `GET /v1/entitlements/aaa` no longer returned the 404s recorded before the repair. - The dead `/welcome/yemaya` destination was replaced. The current primary destination is `/studio/yemaya/studio-web` and the secondary destination is `/studio/generation-gallery`. ### Current automated evidence - The web spec drives the actual AAA-only Studio Isis URL without following the first response and pins `307`, `X-Studio-Boundary: aaa-cta`, request-source propagation, and the disclosure document. - The hard-block cases preserve the attempted URL, return `404`, ship the root document language/title shell, and do not reveal either `/aaa-upgrade` or a legacy welcome route. - `from` accepts one local `/studio/isis/…` path of at most 160 characters. External, repeated, tabbed, or newline-bearing values are dropped; no hostile value becomes text, a link, or a propagated query. - `aaa_upgrade_viewed`, `aaa_upgrade_open_yemaya_clicked`, and `aaa_upgrade_back_to_gallery_clicked` are asserted with their safe source and fixed destination. - The disclosure remains overflow-free in a 390 × 844 standalone launch, and both actions meet the minimum touch-target contract. - The BFF spec uses real HTTP to prove `aaa-creator` resolves as entitled, the default contemplative tier reports an available upgrade URL, and an unauthenticated request returns `401`. ## Boundaries and gaps - **Not a checkout.** The disclosure is a product-boundary transfer, not a billing purchase or entitlement mutation. “Upgrade” is legacy journey vocabulary; the page itself promises access to a separately hosted product. - **No proxy-to-BFF join.** The proxy resolves session tags locally. The BFF route uses authenticated scopes and the canonical Isis entitlement engine. Their agreement is regression-tested in two suites, not by a runtime call from one layer to the other. - **No structured proxy log assertion.** Browser analytics cover the page and CTA events, but the redirect and hard-block decisions do not yet have a focused structured access-log contract. - **Offline scope is read-only replay.** The service-worker case proves a warmed document is served offline; it does not make either destination navigable without a network. - **System Chrome is not the offline claim.** The service-worker test is explicitly Chromium-only. Other engines still receive the ordinary responsive disclosure coverage. ## Re-run evidence The portable focused suites are: ```bash PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \ -c apps/oshun/web/playwright.config.ts \ apps/oshun/web/e2e/aaa-upgrade-entitlement-bounce.spec.ts \ apps/oshun/web/e2e/entitlements-aaa-bff.spec.ts \ --workers=1 ``` They require the web/BFF real-development-infrastructure harness described by the application Playwright configuration. A green source audit alone must not be reported as a fresh browser walk. ## Source trail - [Web proxy boundary](../../apps/oshun/web/src/proxy.ts) - [AAA disclosure page](../../apps/oshun/web/src/app/aaa-upgrade/page.tsx) - [Disclosure actions and telemetry](../../apps/oshun/web/src/app/aaa-upgrade/AaaUpgradeActions.tsx) - [BFF entitlement routes](../../apps/oshun/bff/src/routes/entitlements.ts) - [Canonical generation entitlement service](../../apps/oshun/bff/src/entitlements/generation-entitlement-service.ts) - [Boundary browser spec](../../apps/oshun/web/e2e/aaa-upgrade-entitlement-bounce.spec.ts) - [BFF entitlement spec](../../apps/oshun/web/e2e/entitlements-aaa-bff.spec.ts) ## Cross-references - [Source-reconciled journey](../journeys/aaa-upgrade-entitlement-bounce.md) - [Journey coverage matrix](../journeys/coverage.md) - [Sign-up and crypto billing result](./sign-up-and-pay-crypto.md) - [Lilith Studio → Tara publication result](./lilith-studio-tara-scene-publish.md) ## Open questions - Should the journey and route be renamed around “AAA product transfer” so an already-entitled creator is not told they are upgrading? - Should the proxy consume a shared entitlement decision adapter, or is regression-tested agreement with the BFF the intended architecture? - Which structured event records the proxy decision, tier, safe source, request id, and hard-block/redirect disposition without leaking the protected route? - Should offline destination taps receive an explicit network-required notice before navigation?