test: add browser smoke coverage for dashboard

.github/workflows/frontend.yml

@@ -16,6 +16,7 @@ jobs:
           cache: npm
           cache-dependency-path: apps/web/package-lock.json
       - run: npm ci
+      - run: npx playwright install --with-deps chromium
       - run: npm run lint
       - run: npm test
       - run: npm run build

CHANGELOG.md

@@ -8,6 +8,8 @@ PubMed parsing remains conservative: direct XML parsing and injected transports
 
 The TypeScript dashboard now presents the origin and synthetic boundaries added to the API instead of flattening persisted publications and fixture evidence into the same visual treatment. Evidence cards label synthetic fixture status, review status, level, confidence, and citation boundary; publication cards label `origin`, tri-state `synthetic`, revision, provider identifier, parser version, retrieval time, and retraction status. The knowledge-graph view now matches the implemented `/api/v1/graph` response shape, and API text is rendered through DOM nodes instead of interpolated into raw HTML.
 
+The frontend package now uses Vite for a real production build and a Playwright-powered smoke script for rendered browser checks. The smoke test serves the built artifact, mocks API responses, exercises evidence, graph, sources, unavailable-API, desktop, and mobile states, and exits cleanly for CI. The frontend workflow installs the required Chromium browser before running these checks.
+
 Evidence list, detail, and citation export now reconstruct current review metadata from the latest persisted event by ID. Historical events remain intact, synthetic origin remains authoritative, and configured storage failures return an error instead of stale fixture review metadata. Integration coverage exercises successive review states, deliberately backdated timestamps, and recovery through a fresh application instance.
 
 Review-event history now uses bounded cursor pagination with a default page size of fifty and a maximum of one hundred. Clients follow `next_after_id` to retrieve subsequent pages. PostgreSQL integration coverage verifies persisted review payloads, event-ID ordering, record isolation, and continued exclusion of reviewed fixtures from citation export.
@@ -22,7 +24,7 @@ Documentation tooling now counts prose separately from fenced code and diagrams,
 
 The abbreviated license file has been replaced with the official Apache License 2.0 text. Project attribution is recorded separately in NOTICE, and citation metadata identifies the author as an independent Romanian researcher. The existing release tag is preserved. The citation's release version is not silently advanced to an unpublished development version merely because the Python package declares that version.
 
-Known implementation issues remain visible: incomplete pathway adjustment, duplicate multi-omics handling, and the absence of an operational scientific review service. The frontend now exposes key provenance boundaries, but it still needs a real production artifact and browser interaction testing beyond compiler-only scripts. Publication origin classification is improved, but provider origin remains a retrieval-boundary label rather than scientific validation. No new deployment, clinical validation, or independent benchmark is asserted by this documentation entry.
+Known implementation issues remain visible: incomplete pathway adjustment, duplicate multi-omics handling, and the absence of an operational scientific review service. The frontend now exposes key provenance boundaries and has build-plus-browser smoke coverage, but it still needs broader accessibility, visual regression, and production deployment evidence. Publication origin classification is improved, but provider origin remains a retrieval-boundary label rather than scientific validation. No clinical validation or independent benchmark is asserted by this documentation entry.
 
 ## [0.2.0] - 2026-09-14
 

README.md

@@ -18,7 +18,7 @@ OpenLongevity develops computational tools for organizing aging research with ex
 - A transparent A–G hierarchy distinguishing in-vitro, animal, observational human, clinical, RCT, review, and computational evidence.
 - Research-gap signals for translational, replication, and source-concentration patterns.
 - A graph abstraction for gene, pathway, mechanism, biomarker, intervention, and study links.
-- Optional FastAPI routes and a typed TypeScript dashboard shell.
+- Optional FastAPI routes and a Vite-built TypeScript dashboard with browser smoke checks.
 - Read-only adapters for PubMed, Europe PMC, OpenAlex, Crossref, and ClinicalTrials.gov with provenance on every normalized record.
 - PostgreSQL-ready repositories, evidence scoring, contradiction surfacing, pathway enrichment, survival curves, biological-age baselines, and multi-omics joins.
 
@@ -56,7 +56,7 @@ The [whitepaper](WHITEPAPER.md) defines the data model, provider contract, scori
 src/openlongevity/   typed scientific core, API, and CLI
 biomarkers/          biomarker catalog and interpretation guardrails
 literature/          source adapter contracts
-apps/web/             TypeScript dashboard shell
+apps/web/             TypeScript dashboard and browser smoke checks
 packages/rust/        optional safe performance kernels
 sql/                  PostgreSQL schema
 docs/                 academic notes, architecture, evidence, and security
@@ -68,7 +68,7 @@ The project contains useful implementation work, but its parts should be assesse
 
 The publication routes use PostgreSQL when a database is configured. Search currently filters publication titles; it is not a full-text engine or a federated systematic-review search. The evidence and research-gap endpoints use synthetic fixtures, and the graph endpoint provides an illustrative response. A successful request to one of those endpoints demonstrates software behavior on that input. It does not demonstrate that live publications have traversed an automated extraction, adjudication, and scientific synthesis workflow.
 
-The existing frontend package provides TypeScript source and type-checking commands. Its current scripts named build, lint, and test invoke the compiler without emitting a production application. Consequently, successful type checking should be reported as type checking. A production website, browser interaction coverage, accessibility review, and a verified deployment are separate deliverables. Their completion requires observable artifacts rather than an inference from package names or a version string.
+The frontend package now produces a Vite production artifact and runs a Playwright-powered browser smoke script against that artifact. The smoke path verifies provenance labels, fixture boundaries, graph navigation, source navigation, an unavailable-API state, and a mobile viewport. This is stronger than compiler-only verification, but it is still not a full accessibility audit, visual-regression suite, load test, or verified production deployment. Those stronger claims require their own observed evidence.
 
 ## Installation assumptions and reproducible operation
 

ROADMAP.md

@@ -34,7 +34,7 @@ The current baseline is a research prototype with partially integrated infrastru
 
 ## Immediate integrity and documentation priorities
 
-Publication-origin classification has moved from a fixed false synthetic flag to an explicit persistence contract. Synthetic seeds, manually documented records, ordinary PubMed provider-path records, and legacy unknown records now have different API semantics. Acceptance coverage includes the CI seed, ordinary PubMed search classification, a deliberately provider-shaped synthetic payload, persistence, list/detail responses, revision history, and dashboard labels for origin and synthetic state. The remaining work is deeper presentation testing: the frontend needs rendered browser checks across success, empty, unavailable, and responsive states.
+Publication-origin classification has moved from a fixed false synthetic flag to an explicit persistence contract. Synthetic seeds, manually documented records, ordinary PubMed provider-path records, and legacy unknown records now have different API semantics. Acceptance coverage includes the CI seed, ordinary PubMed search classification, a deliberately provider-shaped synthetic payload, persistence, list/detail responses, revision history, dashboard labels for origin and synthetic state, and browser smoke checks for rendered provenance boundaries. The remaining work is deeper presentation testing: empty persisted results, accessibility checks, visual regression, and production deployment evidence.
 
 Complete the documentation expansion with distinct, source-backed explanations rather than repeated filler. Every tracked Markdown file has a minimum prose target, but accuracy and implementation alignment remain separate requirements. The automated inventory should continue to expose short documents, missing attribution, and structural problems. Code examples need execution checks, and diagrams need to identify proposed components clearly. A passing word-count gate is not a substitute for editorial review.
 
@@ -50,7 +50,7 @@ Search should remain described according to its implementation. Current title fi
 
 ## Interface and deployment acceptance
 
-The web application needs a real production build and interaction checks in addition to type checking. The current compiler-only scripts do not establish a deployable application artifact. Acceptance should demonstrate navigation, loading, empty results, unavailable services, and explicit fixture labels. Accessibility and responsive behavior need examination in rendered views, not only a successful TypeScript command.
+The web application now has a Vite production build and smoke-level browser checks in addition to TypeScript checking. Acceptance should continue expanding beyond smoke coverage: empty results, loading timing, keyboard navigation, accessibility semantics, visual regression, and provider-backed publication states need rendered evidence. Responsive behavior should be checked across more than one mobile profile before release claims become stronger.
 
 Deployment should be verified against the chosen hosting environment with actual configuration and an observed URL. Record the commit deployed, build outcome, environment assumptions, and a smoke test of the intended public experience. A hosting configuration file or authenticated command-line tool is not by itself deployment evidence. Preview deployments and production publication should remain identifiable as different environments with appropriate secrets and data scope.