Skip to main content
Inspect listeners and choose a free port, such as PORT=3738 pnpm dev. Use that port in your browser, MCP bridge and submission CLI URLs. Leave processes from other tasks running.
Node does not automatically load .env. Export values in the process environment or inject them through your secret manager. Compose’s interpolation behavior is separate. Verify which process/checkout you started before changing configuration.
Check QA_SUITE_PUBLIC_URL, the HTTPS origin, admin password length and REST token length. Remote binding requires deliberate access control. Ensure built assets exist. Follow the Node guide; do not bypass validation.
Use the exact configured public origin and review proxy forwarding. Do not mix localhost and 127.0.0.1 when the configured origin is explicit. A failed boundary check is not a reason to disable request guards.
Fetch /api/findings/schema, read field-level errors and verify multipart metadata is JSON text. MCP has stricter verified-reporting requirements. An execution-disabled deployment cannot perform validation-gated repro submission. Preserve the draft and correct the actual failure.
Install Chromium using pnpm exec playwright install chromium. Check recording dependencies (ffmpeg, and Xvfb for Linux native capture), the explicit execution flag and profile readiness. Use a dedicated profile and product-action-only scripts. A profile failure is not permission to copy cookies into evidence.
Reconnect your client, verify the correct deployment URL and discover its capabilities. Local/hosted/bridge toolsets differ. Sampling requires an established negotiated host; stateless hosted sessions may not support it. Review MCP reference.
Verify discovery configuration, selected repository/product and signed relevant PR delivery. Configuration does not backfill old PRs. Refresh reads status rather than forcing import. A provider outage leaves freshness unverified; a changed PR head supersedes historical inventory. Retain exact bindings.
Read current head/base/input/catalog/policy and environment diagnostics. An expired independent approval, changed deployment or missing authenticated artifact can invalidate current evidence. Do not relabel a historical pass as current or dispatch automatically after ambiguous delivery. See PR validation.
The current Dockerfile installs before copying required vendored inputs. Resolve that packaging prerequisite and validate the image. Use the documented Node path meanwhile; these docs do not claim the current Compose image builds.
Stop and preserve the current state. Keep SQLite, artifacts, profiles, configuration and keys together in recovery planning. Do not delete the database or data directory. Follow upgrade and recovery against isolated restored data.
When reporting a problem, include the exact source commit, runtime version, deployment mode, sanitized error and steps. Keep tokens, profile sessions, private URLs and customer evidence out of public reports. Use the repository’s current security policy for sensitive findings.