# QA procedure: Integration catalogue and role-aware copy (roles sync pass 6)

Spec: features/roles_sync_integration_catalogue.feature. Vitest + Vue Test Utils under `task test:web`. Static data, no /v1 call, no live server.

## Honesty rules
0. Baseline `task test:web` first. 1. Runner cannot execute: NOT RUN. 2. Report new and edited specs and baseline failures.
3. The two section intros are the user-approved proposals, not design copy; mark them as such in the report.

## Automated (Vitest)
| Spec | Cases |
|---|---|
| data/__tests__/apiCatalogue.spec.ts (extend) | the nine routes have chip "Needs permission" and a description ending `Needs the permission "<label>"`; no route keeps "Owner or admin"; Owner only routes keep their chip; the 403 caption is `missing_permission` for the nine; the Errors table 403 row and its note; the Authentication card sentence; the two intros; the permission label equals lib/permissionNames.ts for the key the router requires |
| views/__tests__/IntegrationView.spec.ts or the existing integration spec (extend) | the chip renders, mobile shows it in the chips line, search "permission" and "missing_permission" returns the routes, "owner or admin" does not |
| data/__tests__/apiGating.spec.ts (new) | a fixed table of the nine routes (plus DELETE /v1/user/{id}) and the keys of api/router.go; fails if a label changes |

## Visual (task visual:check)
Run `task visual:check -- integration`. States of the "Integration" group: 2 (Media group, POST /v1/media/), 4 Authentication, 6 Errors, 9a to 9j Custom content types, and the search states 8c-8e. Board sample data: the origin `https://cms.renew.example`, the board's media list and purge samples. Light, dark, desktop, mobile within 10 %. Not clock-sensitive. The board is from before the new DELETE /v1/user/{id} card and the Users group count of 7, which may exceed 10 % on that group (see G5).

## Manual checks
1. Real server: call each gated route with a key whose creator's role lacks the permission and read the 403 body `missing_permission`.
2. Search palette keyboard flow with the new chip.
3. `task lint:web` green; `task test:web` exit 0.

## Design gaps and notes
- G1 screens/integration.md "Custom content types round" still says "Owner or admin" and "Only owners and admins can do this."; pass 6 supersedes it. The user should refresh that file.
- G2 Open item 5 of the change log (do owner-only routes answer `missing_permission`?) is not verified here; "Owner only" chips are unchanged.
- G3 Both intros are proposals approved by the user, not from the design.
- G4 Left alone, out of scope: screens/schema.md and the Schema frames ("Owner or admin" for Schema), states.md "Sites and authors: roles" and the 403 owner_only rows, screens/profile.md Display name copy.
- G5 The DELETE /v1/user/{id} card is not on the Integration board.