fix(dashboard): onboarding pages register nothing fake and claim no success (PX-10 Wave 0)

[LamaSu]

What

PX-10 Wave 0. This answers product-steward #2386 and #2561, product-qa #31 and #32 (both P1), and shell #2544.

The onboarding pages that cannot register a machine now register nothing and claim no success. Each one says "Nothing was registered" and hands what the user typed to the canonical entry, /onboard/chat (decision D3).

Before and after, per page

Page	Before (at ac86a404)	After
/start (public)	Registered onto the hard-coded kernel_dev_001 with a mock or generic-http adapter. Never read the response, then showed "You're live … is on the network", even after a 401 (QA #31).	No network call. "Go live" becomes "Continue". The last step is "Not live yet" with the hand-off.
/onboard/wizard Step 7	Registered adapterType: 'mock' three times, onto a kernel that didn't exist. A network error became an "offline success" with an invented device id (QA #32).	Review first, then "Not registered yet" with the hand-off. No registration and no test job.
/setup/agent	Registered onto kernel_dev_001 + mock. Then showed a test result built from the HTTP status with duration: 1234, or "what the results would look like", and "Setup Complete! … added to the PCC network".	A confirmed configuration goes to the hand-off. The fake test-result and setup-complete renderers are removed.
Step 2, documents	sha256:${Math.random()…} as each document's hash; a 2.5 s pretend AI analysis; the same invented specs for every file.	The real SHA-256 of the bytes via WebCrypto (or "No hash computed"). Files are listed as not analyzed.
Step 4, space	Read-only example values (mock data) shown as the user's machine.	Says the step doesn't collect space yet, and saves nothing. Validation no longer requires it.
Step 5, pricing	Read-only example prices; an invented network average (28.5) that one click applied to the user's price; an ROI chart from made-up volumes.	Editable and starts empty. Validation needs a positive base price the user typed. No market card and no ROI chart.
Step 6, operator	Added example certifications to the user's profile.	Adds none, and says so.
/setup, identity step	An invalid or unreachable /setup/validate still marked setup complete. The copy claimed an ERC-8004 identity registration.	Validation errors and an unreachable gateway stop the step. Skip is still an explicit choice. The copy is honest.

The /start rate step also loses two claims. "Your rate is visible to anyone searching" is false once nothing registers. "You keep 100% — no platform fees" contradicts the 2.35% protocol fee (FYI launch, D0).

The hand-off

• lib/onboard-handoff.ts builds a plain-text draft from only what the user entered. Empty fields are left out; defaults and example data never appear.
• components/onboard/OnboardHandoffPanel.tsx shows:
  • "Nothing was registered";
  • the draft, with a Copy details button;
  • a link to /onboard/chat whose router state carries the draft under onboardDraft.
• The chat page does not read that state yet (shell's file), so the panel never claims the chat already has the details.
• Nothing in the hand-off talks to the network.

Not in this PR

• Clarity's Step 7 port. It still registers a mock adapter, and product-steward decided not to land it as written (#2386). R40 is the real kernel-creation step.
• Explicit Skip on /setup still ends at "Setup Complete". That surface retires in PX-10.
• /onboard/chat reading onboardDraft, which is shell's call.

Tests

• Dashboard: 270 passed, 0 failed (14 files). tsc --noEmit is clean.
• New, 50 tests in 5 files:
  • onboard-handoff: the draft keeps only entered values;
  • file-sha256: FIPS "abc" and empty-input vectors; null, never a fake value, without WebCrypto;
  • OnboardHandoffPanel.render: static render. It says nothing was registered, links to /onboard/chat, and claims no success;
  • wizard-draft: the draft, pricing input, and store validation;
  • onboarding-wave0: the source is read as text with comments stripped. No registration or test-job endpoint and no mock or dev-kernel patterns on the three surfaces. No false-success copy. No mock data or Math.random in Steps 2, 4, 5 and 6. /setup does not complete on an invalid or unreachable validation.
• Mutation check: I reverted each behaviour in turn (10 mutants). Every mutant fails the new tests.

Merging with shell's #368 (N50)

There is one expected conflict, in SetupAgentPage.tsx, and it is trivial. #368 moves this page to authorizedFetch, including the register-device call this PR deletes.

I checked the resolution locally: the merged tree gives 314 passed and tsc is clean. Whichever PR merges second applies it:

1. SetupAgentPage.tsx imports: keep authorizedFetch (fix(dashboard): N50 — /setup and /setup/agent never send the API key to localhost:3200 #368) and this PR's OnboardHandoffPanel and machineConfigDraft imports. getAuthHeaders is no longer used.
2. SetupAgentPage.tsx body: take this PR's machine_config_preview branch. It has no register-device call.
3. fix(dashboard): N50 — /setup and /setup/agent never send the API key to localhost:3200 #368's no-direct-auth-headers.test.ts: remove "pages/StartPage.tsx" from KNOWN. StartPage no longer builds an auth header, and that shrink-only ratchet says so.
4. fix(dashboard): N50 — /setup and /setup/agent never send the API key to localhost:3200 #368's setup-key-origin.test.tsx: check only /api/ai/identify-machine. Add expect(calls.some((c) => c.url.endsWith("/api/setup/register-device"))).toBe(false).

#354 merges cleanly.

Shell's no-prod-mock ratchet (#2544): when this lands, remove the known-offender entries for StartPage, Step7_Review, SetupAgentPage and Steps 2, 4, 5 and 6.

Review

Shell offered to review (#2544). Product-steward owns the dispositions.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkeiQMnVePeBGU9svhREFy