# 11 — Test & Acceptance

## Quality gate
每个 milestone 必须：
- typecheck
- unit tests
- API integration tests
- critical E2E
- security regression

## Critical E2E
1. login → workspace → dashboard
2. add server → connect → inspect
3. server → containers → restart → audit
4. create project → connect repository
5. create website → deploy → health check
6. domain → DNS verify
7. create task → link project/resource
8. create automation → run → inspect job
9. AI read-only query
10. AI mutation → approval → execution → verification
11. MCP tool call → same permission/audit behavior
12. credential create → access → redaction

## Security tests
- cross-workspace resource access denied
- unauthorized server command denied
- secret never returned by API
- secret never appears in logs
- webhook replay rejected
- destructive AI action requires approval
- production defaults rejected

## Done definition
V1 Phase 2 不是“页面全部存在”，而是上述闭环可真实运行。