# AutoShorts-style live read-only smoke lessons

Use this as a concrete example when validating a read-only command-dashboard adapter against a local creator/production backend.

## Safe local backend startup pattern

- Start only the backend/API, bound to `127.0.0.1` or `localhost`.
- Prefer temp/ignored runtime roots for local validation:
  - temp SQLite DB when the backend supports it
  - temp storage directory under the dashboard repo's ignored `.tmp/`
  - local placeholder secret only as an env var; never commit or print secrets
- Do not start frontend, browser automation, render workers, upload workers, platform integrations, import scans, seed commands, or publishing flows unless the user explicitly asks.

Example shape, redacted and portable:

```bash
cd <domain-dashboard>/backend
DOMAIN_DATABASE_URL=sqlite:////ignored-local-tmp/domain.db \
DOMAIN_STORAGE_ROOT=/ignored-local-tmp/storage \
DOMAIN_SECRET_KEY=<local-redacted> \
uv run uvicorn app.main:app --host 127.0.0.1 --port <local-port>
```

## Structural endpoint probing

Before running the command-dashboard gateway smoke, probe only approved GET endpoints and record structure, not raw values:

- endpoint reachable yes/no
- status code
- top-level keys and primitive types
- nested object/list shapes
- which fields appear safe counts/categories
- which nested objects/lists must be ignored

Keep raw responses only in ignored temp files, or do not persist them at all. Never commit raw responses.

## Mapping lessons

- Map only allowlisted counts/categories into `ModuleSnapshot`.
- Ignore optional nested objects/lists such as topics, recent packages, manifests, package records, logs, or provider details.
- Unknown live fields are ignored, not converted to labels.
- Dirty synthetic fixtures should mirror the live response shape plus blocked nested keys to prove the sanitizer drops them.
- Do not infer freshness just because a live endpoint answered. If the backend does not expose an explicit safe timestamp/status/freshness indicator, emit `pipeline_freshness=unknown` rather than `fresh`.

## Smoke assertions worth adding

For live-readonly smoke scripts:

- require `*_API_BASE_URL` when mode is `live_readonly`
- allow only `http://127.0.0.1:<port>` or `http://localhost:<port>`
- assert gateway registry/snapshot `source_type=http_api`
- assert expected safe contract version
- assert max 3 KPIs
- assert no paths, media suffixes, prompts/scripts/voiceovers/captions/descriptions, tokens/OAuth/secrets, stacktraces, or mutation/action wording
- ensure only allowlisted GET endpoints are used

## Redacted contract review doc

Document:

- backend start command without secrets and with temp paths redacted
- endpoints reachable
- response shape classes, not raw responses
- used fields vs ignored fields
- forbidden field classes
- whether sanitizer changes were required
- live smoke result