[EL-36] Create the desktop contract, security, accessibility, E2E, and performance test matrix

[sodejm]

Catalog ID: EL-36

Public issue: #131

Reviewed baseline: 71abaf4067d4118f28910a22c20524b4e0282b28

Core objective: Build independent release verification for renderer,
preload, main, sidecar, contracts, security, accessibility, workflows, and
performance, including generated-contract drift detection.

Priority / phase: P0 / Verification; starts early and gates release

Publication status: Published as #131.

Dependency mapping

• Blocks: #132
• Depends On: #99, #11
• Relates To: Release process: create security and interoperability evidence checklist #19, Hardening: add complete one-shot and REPL command-parity tests #28, Add end-to-end REPL parity and responsiveness tests #59, Hardening: bound file-backed inputs and test safe failure at every ingestion boundary #76, Hardening: add adversarial GEDCOM parse, validation, and lossless serialization fixtures #77, Hardening: test RootsMagic reader and export against corrupt, incomplete, and hostile SQLite inputs #78

UX/UI requirements

• Test keyboard-only use, screen readers, contrast, reduced motion, zoom, high
  DPI, narrow windows, state transitions, restart, and cancellation.
• Treat accessibility failures in release-critical workflows as blockers.
• Measure realistic large GEDCOM, chat streaming, and job scenarios.

Public interfaces

• Establish OpenAPI snapshots, generated TypeScript/bridge drift checks,
  fixture schemas, and coded-error inventories.
• Define fixtures for capabilities, grants, jobs, chat, GEDCOM, plugins, and
  artifacts.
• Add a machine-readable release-evidence manifest.

Underlying app changes

• Add contract, integration, fuzz, XSS, E2E, accessibility, packaged-smoke,
  and performance harnesses.
• Assert sandbox flags, absent Node globals, sender/origin checks, CSP,
  protocol, navigation/window/permission denial, fuses, sidecar authentication,
  and forbidden logs/crash artifacts.
• Own generated OpenAPI verification and coordinate client updates.

Acceptance criteria

• CI fails on OpenAPI, generated-client, bridge, or coded-error drift.
• API/IPC tests cover wrong senders, hostile origins/hosts, unknown fields,
  sizes, auth failures, redirects, readiness/shutdown, sequence gaps,
  reload, restart, and crash.
• Canary-secret scans prove values never reappear in responses, storage,
  history, logs, telemetry, support bundles, or crash evidence.
• XSS tests cover scripts, handlers, HTML, SVG, data URLs,
  javascript: links, malicious Markdown, and navigation.
• Streaming covers order, sequence ranges, batching, acknowledgement,
  backpressure, replay, cancellation, timeout, terminal delivery, and
  idempotent audit reconciliation.
• GEDCOM covers limits, round trips, loss minimization, atomic output,
  roots, GEDCOM 5.5.5, GEDCOM 5.5.1 fallback, Ancestry, Geni, MyHeritage,
  worker failure, and network denial.
• Budgets cover startup, first token, sustained delivery, grant handling,
  large files, cancellation, and renderer responsiveness.
• All artifacts use fictional data and privacy-minimal diagnostics.

Security mitigations and rejected anti-patterns

• Applies every Phase 1 control and verifies STRIDE, abuse cases, architecture
  risks, and secure-development gates.
• Reject snapshot-only claims, tests that disable hardening, real genealogy
  fixtures, credentials, payload traces, flaky unbounded timing assertions,
  and manual-only release evidence.

Workspace mapping

• Exclusive owned paths: tests/desktop_matrix/**,
  desktop/tests/security/**, desktop/tests/e2e/**,
  desktop/tests/accessibility/**, desktop/tests/performance/**,
  scripts/validate_desktop_contracts.*, and
  .github/workflows/desktop-quality.yml.
• Shared-file rule: Feature owners supply fixtures by change request.
  #131 coordinates generated OpenAPI/clients but not feature code,
  dependency manifests, or release workflows.
• Base rule: Branch after #99 and #11; rebase as contracts land.
• Branch: feature/electron-el-36-desktop-test-matrix
• Worktree: /Users/justinsoderberg/Development/worktrees/ancestryllm-electron-el-36-desktop-test-matrix
• Validation: make test; make lint; make typecheck; make security;
  desktop unit, E2E, accessibility, fuzz, XSS, contract, and performance suites

[sodejm]

Recommended Codex configuration

• Planning: gpt-5.6-sol with xhigh reasoning
• Implementation: gpt-5.6-sol with max reasoning
• Rationale: This is release-, sandbox-, plugin-, backup-, architecture-, or writeback-critical work where a subtle error could compromise security, user data, or release integrity; maximum implementation verification is warranted.
• Delivery: Use test-case-driven development: translate the acceptance criteria into failing or characterization tests first, implement incrementally, then run the applicable tests, lint, typecheck, security, integration, and hosted gates.