create-workframe 0.1.12 → 0.1.14

package/workframe-api/test_credential_store.py

@@ -0,0 +1,27 @@
+"""WF-032 credential_store self-check."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import credential_store  # noqa: E402
+
+
+def test_quote_env_value() -> None:
+    assert credential_store._quote_env_value("sk-abc123") == "sk-abc123"
+    assert credential_store._quote_env_value('has "quotes"') == '"has \\"quotes\\""'
+
+
+def test_remove_env_secret_missing_file(tmp_path: Path) -> None:
+    path = tmp_path / ".env"
+    credential_store._remove_env_secret(path, "OPENROUTER_API_KEY")
+    assert not path.exists()
+
+
+if __name__ == "__main__":
+    test_quote_env_value()
+    test_remove_env_secret_missing_file(Path("/tmp/wf-cred-store-check"))
+    print("test_credential_store: ok")

package/workframe-api/test_dogfood_flows.py

@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+"""Dogfood API smoke — rooms, mention, session, invite, OTP, agent, project.
+
+Run against live stack:
+  python test_dogfood_flows.py --base http://127.0.0.1:18644
+
+Mention tests default to invoke_agents=False (routing only, no LLM spend).
+Pass --live-mention to invoke agents; dogfood should bill via Codex gpt-5.4-mini.
+
+Requires WORKFRAME_E2E=1 + install window OR DEV_LOCAL_UNSAFE for OTP in auth/start response.
+Falls back to zk session mint when --data-dir points at install data (same host as API).
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sqlite3
+import sys
+import time
+import urllib.error
+import urllib.request
+import uuid
+from pathlib import Path
+from typing import Any
+
+ROOT = Path(__file__).resolve().parent
+sys.path.insert(0, str(ROOT))
+
+
+def _resolve_install_id(data_dir: Path) -> str:
+    env_id = os.environ.get("WORKFRAME_INSTALL_ID", "").strip()
+    if env_id:
+        return env_id
+    env_file = data_dir.parent.parent / ".env"
+    if env_file.is_file():
+        for line in env_file.read_text(encoding="utf-8").splitlines():
+            if line.startswith("WORKFRAME_INSTALL_ID="):
+                return line.split("=", 1)[1].strip().strip("'\"")
+    raise RuntimeError("WORKFRAME_INSTALL_ID not set — export it or pass --data-dir with install .env")
+
+
+def _req(
+    base: str,
+    method: str,
+    path: str,
+    *,
+    body: dict | None = None,
+    cookie: str = "",
+    session_id: str = "",
+    timeout: float = 60,
+) -> tuple[int, dict[str, Any]]:
+    url = f"{base.rstrip('/')}{path}"
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Content-Type": "application/json", "Accept": "application/json"}
+    if session_id and not cookie:
+        import zk_auth
+
+        if not os.environ.get("WORKFRAME_INSTALL_ID", "").strip():
+            raise RuntimeError("WORKFRAME_INSTALL_ID required when passing session_id without cookie")
+        cookie = f"{zk_auth.session_cookie_name()}={session_id}"
+    if cookie:
+        headers["Cookie"] = cookie
+    if session_id:
+        headers["X-Workframe-Session"] = session_id
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            raw = resp.read().decode("utf-8")
+            return resp.status, json.loads(raw) if raw else {}
+    except urllib.error.HTTPError as exc:
+        raw = exc.read().decode("utf-8")
+        try:
+            payload = json.loads(raw) if raw else {"error": exc.reason}
+        except json.JSONDecodeError:
+            payload = {"error": raw or str(exc)}
+        return exc.code, payload
+
+
+def _mint_session_cookie(data_dir: Path, user_id: str) -> tuple[str, str]:
+    """Return (cookie_header, session_id) for API auth."""
+    import zk_auth
+
+    os.environ["WORKFRAME_API_DATA_DIR"] = str(data_dir)
+    os.environ["WORKFRAME_INSTALL_ID"] = _resolve_install_id(data_dir)
+
+    # Read-only sqlite — avoid WAL sidecars on the shared data mount.
+    db_path = data_dir / "zk_auth.db"
+    conn = sqlite3.connect(f"file:{db_path.as_posix()}?mode=ro", uri=True, timeout=5.0)
+    conn.row_factory = sqlite3.Row
+    try:
+        row = conn.execute(
+            """
+            SELECT s.id
+            FROM sessions s
+            JOIN users u ON u.id = s.user_id
+            WHERE s.user_id = ?
+              AND s.revoked_at IS NULL
+              AND s.expires_at > datetime('now')
+              AND u.status = 'active'
+            ORDER BY s.created_at DESC
+            LIMIT 1
+            """,
+            (user_id,),
+        ).fetchone()
+    finally:
+        conn.close()
+
+    session_id = str(row["id"]) if row else ""
+    if not session_id:
+        raise RuntimeError(f"no valid session for user {user_id}")
+    cookie_name = zk_auth.session_cookie_name()
+    return f"{cookie_name}={session_id}", session_id
+
+
+def _pick_user(data_dir: Path) -> tuple[str, str]:
+    db = data_dir / "workframe.db"
+    conn = sqlite3.connect(db)
+    conn.row_factory = sqlite3.Row
+    row = conn.execute(
+        """
+        SELECT u.id, u.email
+        FROM users u
+        JOIN workspace_memberships m ON m.user_id = u.id AND m.deleted_at IS NULL
+        WHERE u.deleted_at IS NULL AND m.role IN ('owner', 'admin')
+        ORDER BY CASE m.role WHEN 'owner' THEN 0 ELSE 1 END, u.created_at ASC
+        LIMIT 1
+        """
+    ).fetchone()
+    if not row:
+        row = conn.execute(
+            "SELECT id, email FROM users WHERE deleted_at IS NULL ORDER BY created_at ASC LIMIT 1"
+        ).fetchone()
+    conn.close()
+    if not row:
+        raise SystemExit("no users in workframe.db")
+    return str(row["id"]), str(row["email"])
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--base", default="http://127.0.0.1:18644")
+    ap.add_argument("--data-dir", default=os.environ.get("WORKFRAME_API_DATA_DIR", ""))
+    ap.add_argument("--email", default="")
+    ap.add_argument("--live-mention", action="store_true", help="invoke agents on @mention (Codex gpt-5.4-mini; costs tokens)")
+    args = ap.parse_args()
+    base = args.base
+    failures: list[str] = []
+
+    def check(name: str, ok: bool, detail: str = "") -> None:
+        mark = "ok" if ok else "FAIL"
+        print(f"[{mark}] {name}" + (f" — {detail}" if detail else ""))
+        if not ok:
+            failures.append(name)
+
+    code, meta = _req(base, "GET", "/api/meta")
+    check("meta", code == 200 and meta.get("ok"), str(meta.get("error") or meta.get("project_name")))
+
+    cookie = ""
+    session_id = ""
+    user_id = ""
+    email = args.email.strip().lower()
+
+    def api(method: str, path: str, body: dict | None = None, *, timeout: float = 60) -> tuple[int, dict[str, Any]]:
+        return _req(base, method, path, body=body, cookie=cookie, session_id=session_id, timeout=timeout)
+
+    if args.data_dir:
+        data_dir = Path(args.data_dir)
+        user_id, db_email = _pick_user(data_dir)
+        if not email:
+            email = db_email
+        try:
+            cookie, session_id = _mint_session_cookie(data_dir, user_id)
+            check("session mint", bool(session_id), user_id)
+        except Exception as exc:  # noqa: BLE001
+            check("session mint", False, str(exc))
+
+    if not session_id and not cookie:
+        if not email:
+            email = f"smoke-{uuid.uuid4().hex[:8]}@workframe.test"
+        code, start = api("POST", "/api/auth/start", body={"email": email})
+        otp = str(start.get("otp_code") or "")
+        check("auth/start", code == 200 and start.get("ok"), start.get("error") or ("otp" if otp else "no otp"))
+        if otp:
+            code, verify = api("POST", "/api/auth/verify", body={"email": email, "code": otp})
+            check("auth/verify", code == 200 and verify.get("ok"), verify.get("error") or "")
+            user_id = str(verify.get("user_id") or "")
+            session_id = str(verify.get("session_id") or "")
+            if session_id:
+                import zk_auth
+
+                cookie = f"{zk_auth.session_cookie_name()}={session_id}"
+            elif args.data_dir and user_id:
+                cookie, session_id = _mint_session_cookie(Path(args.data_dir), user_id)
+
+    if not session_id:
+        raise SystemExit("no session — pass --data-dir or enable OTP exposure")
+
+    code, me = api("GET", "/api/me")
+    me_user = me.get("user") if isinstance(me.get("user"), dict) else me
+    check("me", code == 200 and (me.get("ok", True) or me_user.get("id")), me.get("error") or str(me_user.get("email") or me_user.get("id")))
+    user_id = str(me_user.get("id") or me_user.get("user_id") or user_id)
+
+    workspaces = me.get("workspaces") if isinstance(me.get("workspaces"), list) else []
+    current_ws = me.get("current_workspace") if isinstance(me.get("current_workspace"), dict) else None
+    ws_id = str((current_ws or {}).get("id") or (workspaces[0].get("id") if workspaces else "") or "")
+    if not ws_id and args.data_dir:
+        conn = sqlite3.connect(str(Path(args.data_dir) / "workframe.db"))
+        conn.row_factory = sqlite3.Row
+        row = conn.execute(
+            "SELECT workspace_id FROM workspace_memberships WHERE user_id = ? AND deleted_at IS NULL LIMIT 1",
+            (user_id,),
+        ).fetchone()
+        conn.close()
+        if row:
+            ws_id = str(row["workspace_id"])
+    if not ws_id:
+        code, snap = api("GET", "/api/snapshot")
+        ws = snap.get("workspace") if isinstance(snap.get("workspace"), dict) else {}
+        ws_id = str(ws.get("id") or "")
+    check("workspace", bool(ws_id), ws_id or "missing")
+
+    code, rooms_payload = api("GET", f"/api/workspace/{ws_id}/rooms")
+    if rooms_payload.get("error") == "workspace_not_found":
+        slug_candidates = ["default"]
+        if workspaces:
+            slug_candidates.extend(str(ws.get("slug") or "") for ws in workspaces)
+        for alt in slug_candidates:
+            if not alt or alt == ws_id:
+                continue
+            code, rooms_payload = api("GET", f"/api/workspace/{alt}/rooms")
+            if code == 200:
+                ws_id = str(rooms_payload.get("workspace_id") or ws_id)
+                break
+    rooms = rooms_payload.get("rooms") or []
+    check("list rooms", code == 200 and isinstance(rooms, list), f"count={len(rooms)}")
+
+    channel = next((r for r in rooms if r.get("room_type") == "channel"), rooms[0] if rooms else None)
+    room_id = str(channel.get("id") if channel else "")
+    check("pick channel room", bool(room_id), room_id)
+
+    # Create project (room)
+    proj_slug = f"smoke-{int(time.time())}"
+    code, proj = api(
+        "POST",
+        f"/api/workspace/{ws_id}/rooms/create",
+        body={"name": f"Smoke {proj_slug}", "slug": proj_slug, "topic": "smoke test", "room_type": "channel"},
+    )
+    check("create project", code in (200, 201) and proj.get("ok"), proj.get("error") or str(proj.get("room_id")))
+
+    # Create agent
+    agent_slug = f"smoke-agent-{int(time.time()) % 100000}"
+    code, agent = api(
+        "POST",
+        "/api/hermes/profiles/create",
+        body={
+            "name": agent_slug,
+            "display_name": "Smoke Agent",
+            "workspace_id": ws_id,
+            "role": "helper",
+            "model": "gpt-5.4-mini",
+        },
+        timeout=180,
+    )
+    check("create agent", code == 200 and agent.get("ok"), agent.get("error") or str(agent.get("profile")))
+
+    # Invite email
+    invite_email = f"invite-{uuid.uuid4().hex[:6]}@workframe.test"
+    code, inv = api(
+        "POST",
+        f"/api/workspace/{ws_id}/invites",
+        body={"email": invite_email, "role": "member"},
+    )
+    check("invite email", code in (200, 201) and inv.get("ok"), inv.get("error") or invite_email)
+
+    # Add contact = bootstrap DM with native agent template
+    native = str(meta.get("native_profile") or "workframe-agent")
+    code, dm = api(
+        "POST",
+        f"/api/hermes/profiles/{native}/bootstrap-dm",
+        body={"workspace_id": ws_id},
+        timeout=120,
+    )
+    check("add contact (bootstrap-dm)", code == 200 and dm.get("ok"), dm.get("error") or str(dm.get("room_id")))
+
+    # New session — UI uses room bind with new_session, not activate with a fresh uuid.
+    if room_id:
+        code, sessions = api("GET", f"/api/rooms/{room_id}/sessions")
+        check("list sessions", code == 200, str(len(sessions.get("sessions") or [])))
+        code, bound = api(
+            "POST",
+            f"/api/rooms/{room_id}/bind",
+            body={
+                "source_id": "room",
+                "client_id": room_id,
+                "new_session": True,
+            },
+            timeout=120,
+        )
+        new_sid = str(bound.get("session_id") or "")
+        check("new session", code == 200 and bound.get("ok") and bool(new_sid), bound.get("error") or new_sid)
+        if new_sid:
+            code, activated = api(
+                "POST",
+                f"/api/rooms/{room_id}/sessions/activate",
+                body={"session_id": new_sid, "source_id": "room", "client_id": room_id},
+            )
+            check("activate session", code == 200 and activated.get("ok"), activated.get("error") or "")
+
+        # @mention message
+        mention_slug = agent_slug if agent.get("ok") else native
+        content = f"Hello @{mention_slug} — smoke mention {int(time.time())}"
+        code, sent = api(
+            "POST",
+            f"/api/rooms/{room_id}/messages/send",
+            body={"content": content, "invoke_agents": bool(args.live_mention)},
+        )
+        mentions = sent.get("agent_mentions") or []
+        check(
+            "mention send",
+            code == 200 and sent.get("ok"),
+            f"mentions={mentions} err={sent.get('error')}",
+        )
+
+        # Reply (thread)
+        if sent.get("message_id"):
+            code, reply = api(
+                "POST",
+                f"/api/rooms/{room_id}/messages/send",
+                body={
+                    "content": "Reply in thread — smoke",
+                    "parent_message_id": sent["message_id"],
+                    "invoke_agents": False,
+                },
+            )
+            check("reply send", code == 200 and reply.get("ok"), reply.get("error") or "")
+
+    print("---")
+    if failures:
+        print(f"FAILED ({len(failures)}): {', '.join(failures)}")
+        raise SystemExit(1)
+    print("dogfood flows smoke: all ok")
+
+
+if __name__ == "__main__":
+    main()

package/workframe-api/test_domain_entities.py

@@ -0,0 +1,152 @@
+"""WF-039 domain entity self-check — fails if round-trip or imports break."""
+
+from __future__ import annotations
+
+import json
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from domain.entities import (  # noqa: E402
+    ActorType,
+    AgentIdentity,
+    Cell,
+    CredentialPolicy,
+    CredentialRef,
+    DeploymentMode,
+    FundingSource,
+    Grant,
+    GrantCapability,
+    Lease,
+    LeaseStatus,
+    Run,
+    RunEvent,
+    RunStatus,
+    RunSurface,
+    RuntimeBinding,
+    RuntimeBindingStatus,
+    RuntimeKind,
+    User,
+    Workspace,
+)
+
+
+def _ts() -> datetime:
+    return datetime(2026, 7, 6, 12, 0, 0, tzinfo=timezone.utc)
+
+
+def test_round_trip() -> None:
+    cell = Cell(
+        cell_id="cell-1",
+        install_root="/tmp/wf/MyBusiness",
+        manifest_path="/tmp/wf/MyBusiness/workframe-manifest.json",
+        package_name="create-workframe",
+        package_version="0.1.12",
+        deployment_mode=DeploymentMode.SINGLE_USER_LOCAL,
+        created_at=_ts(),
+    )
+    payload = cell.to_dict()
+    assert payload["deployment_mode"] == "single_user_local"
+    assert payload["cell_id"] == "cell-1"
+    json.dumps(payload)
+
+    run = Run(
+        run_id="run-1",
+        workspace_id="ws-default",
+        surface=RunSurface.CHAT,
+        actor_type=ActorType.USER,
+        actor_id="user-1",
+        triggering_user_id="user-1",
+        agent_id="agent-native",
+        runtime_binding_id="bind-1",
+        status=RunStatus.PENDING,
+        payer_user_id="user-1",
+        funding_source=FundingSource.BYOK,
+        created_at=_ts(),
+    )
+    run_payload = run.to_dict()
+    assert run_payload["surface"] == "chat"
+    assert run_payload["status"] == "pending"
+
+    lease = Lease(
+        lease_id="wf_rt_test",
+        run_id="run-1",
+        workspace_id="ws-default",
+        payer_user_id="user-1",
+        provider="openrouter",
+        profile_slug="u-user-1-native",
+        credential_ref_id="cred-1",
+        status=LeaseStatus.ACTIVE,
+        expires_at=_ts(),
+    )
+    assert Lease.from_dict(lease.to_dict()).provider == "openrouter"
+
+
+def test_schema_file_present() -> None:
+    schema = Path(__file__).resolve().parent / "domain" / "schema" / "workframe-domain.schema.json"
+    data = json.loads(schema.read_text(encoding="utf-8"))
+    defs = data["$defs"]
+    for name in (
+        "Cell",
+        "User",
+        "Workspace",
+        "AgentIdentity",
+        "RuntimeBinding",
+        "Run",
+        "RunEvent",
+        "Lease",
+        "Grant",
+        "CredentialRef",
+    ):
+        assert name in defs, f"missing schema def: {name}"
+
+
+def test_agent_runtime_seam_types() -> None:
+    agent = AgentIdentity(
+        agent_id="agent-1",
+        workspace_id="ws-1",
+        template_slug="dev",
+        display_name="Dev",
+    )
+    binding = RuntimeBinding(
+        binding_id="bind-1",
+        agent_id=agent.agent_id,
+        runtime_kind=RuntimeKind.HERMES_MANAGED,
+        profile_slug="u-alice-dev",
+        status=RuntimeBindingStatus.ACTIVE,
+    )
+    assert binding.agent_id == agent.agent_id
+
+    grant = Grant(
+        grant_id="grant-1",
+        run_id="run-1",
+        capability=GrantCapability.LLM_TURN,
+    )
+    assert grant.capability == GrantCapability.LLM_TURN
+
+    user = User(
+        user_id="u-1",
+        workspace_id="ws-1",
+        email="a@example.com",
+        display_name="Alice",
+    )
+    ws = Workspace(workspace_id="ws-1", cell_id="cell-1", slug="default", name="Workframe")
+    cred = CredentialRef(
+        ref_id="cred-1",
+        workspace_id=ws.workspace_id,
+        provider="openrouter",
+        policy=CredentialPolicy.BYOK,
+    )
+    assert cred.provider == "openrouter"
+
+    event = RunEvent(event_id="ev-1", run_id="run-1", event_type="run.authorized")
+    assert event.event_type == "run.authorized"
+
+
+if __name__ == "__main__":
+    test_round_trip()
+    test_schema_file_present()
+    test_agent_runtime_seam_types()
+    print("test_domain_entities: ok")

package/workframe-api/test_exception_hygiene.py

@@ -0,0 +1,12 @@
+#!/usr/bin/env python3
+"""WF-035 smoke: auth/vault handler paths log structured errors."""
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent
+src = (ROOT / "server.py").read_text(encoding="utf-8")
+messaging_src = (ROOT / "workspace_messaging.py").read_text(encoding="utf-8")
+assert "_log_handler_error" in src
+assert 'POST /api/auth/start' in src
+assert 'POST /api/admin/vault/init' in src
+assert "_sync_workspace_messaging_gateway restart" in messaging_src
+print("exception hygiene self-check ok")

package/workframe-api/test_hermes_admin.py

@@ -0,0 +1,72 @@
+"""WF-032 hermes_admin self-check."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+API_DIR = Path(__file__).resolve().parent
+if str(API_DIR) not in sys.path:
+    sys.path.insert(0, str(API_DIR))
+
+os.environ.setdefault("WORKFRAME_API_DATA_DIR", str(API_DIR / ".tmp-test-data"))
+os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
+os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
+
+import hermes_admin  # noqa: E402
+
+
+def test_resolve_command_known() -> None:
+    entry = hermes_admin._resolve_command("/help")
+    assert entry is not None
+    assert entry["name"] == "/help"
+    assert entry["dispatch"] == "client:openHelp"
+
+
+def test_resolve_command_alias() -> None:
+    entry = hermes_admin._resolve_command("reset")
+    assert entry is not None
+    assert entry["name"] == "/new"
+
+
+def test_resolve_command_unknown() -> None:
+    assert hermes_admin._resolve_command("/not-a-real-command") is None
+
+
+def test_commands_catalog_shape() -> None:
+    catalog = hermes_admin.hermes_commands_catalog()
+    assert catalog["ok"] is True
+    assert isinstance(catalog["categories"], list)
+    assert isinstance(catalog["entries"], list)
+    assert all(entry.get("wired") is True for entry in catalog["entries"])
+    assert not any(entry.get("wip") for entry in catalog["entries"])
+
+
+def test_commands_exec_client_dispatch() -> None:
+    result = hermes_admin.hermes_commands_exec("/help")
+    assert result["ok"] is True
+    assert result["dispatched"] == "client"
+    assert result["handler"] == "openHelp"
+
+
+def test_commands_exec_not_slash() -> None:
+    result = hermes_admin.hermes_commands_exec("hello")
+    assert result["ok"] is False
+    assert result["error"] == "not a slash command"
+
+
+def test_gquota_stub() -> None:
+    result = hermes_admin.hermes_gquota()
+    assert result["ok"] is False or "configured" in result
+
+
+if __name__ == "__main__":
+    test_resolve_command_known()
+    test_resolve_command_alias()
+    test_resolve_command_unknown()
+    test_commands_catalog_shape()
+    test_commands_exec_client_dispatch()
+    test_commands_exec_not_slash()
+    test_gquota_stub()
+    print("test_hermes_admin: ok")

package/workframe-api/test_install_wizard_resume.py

@@ -0,0 +1,78 @@
+"""Install wizard resume + admin verify persistence self-check."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import install_api  # noqa: E402
+import stack_config  # noqa: E402
+
+td = Path(tempfile.mkdtemp())
+stack_config.DATA_DIR = td
+stack_config.CONFIG_PATH = td / "stack_config.json"
+db_path = str(td / "workframe.db")
+
+# SMTP saved + tested
+stack_config.patch_stack_config(
+    {
+        "deployment_mode": "public_multi_user",
+        "app_base_url": "https://dev.example.com",
+        "smtp": {
+            "host": "smtp.example.com",
+            "port": 587,
+            "user": "relay@example.com",
+            "password": "secret",
+            "from": "noreply@example.com",
+        },
+    }
+)
+stack_config.mark_smtp_tested()
+stack_config.patch_stack_config({"smtp": {"admin_email": "owner@example.com"}})
+
+assert stack_config.smtp_setup_complete()
+assert not stack_config.install_admin_verified()
+assert install_api.resolve_install_wizard_step(db_path) == "smtp"
+
+stack_config.mark_install_admin_verified("owner@example.com")
+assert stack_config.install_admin_verified()
+raw = stack_config.read_stack_raw()
+assert raw["smtp"]["admin_email"] == "owner@example.com"
+assert raw.get("wizard_step") == "workframe"
+
+payload = stack_config.public_stack_payload()
+assert payload["smtp"]["admin_email"] == "owner@example.com"
+assert payload["smtp"]["admin_verified"] is True
+
+wizard = install_api.install_wizard_public_payload(db_path)
+assert wizard["admin_verified"] is True
+assert wizard["resume_step"] == "workframe"
+
+# Workspace progress → billing
+import sqlite3
+
+conn = sqlite3.connect(db_path)
+conn.executescript(
+    """
+    CREATE TABLE workspaces (
+        id TEXT PRIMARY KEY, slug TEXT, display_name TEXT, owner_id TEXT,
+        settings_json TEXT, deleted_at INTEGER, status TEXT, created_at TEXT, updated_at TEXT
+    );
+    """
+)
+settings = {"admin_onboarding_done": True}
+conn.execute(
+    "INSERT INTO workspaces (id, slug, display_name, owner_id, settings_json, deleted_at, status, created_at, updated_at) "
+    "VALUES ('ws1', 'default', 'Workframe', 'u1', ?, NULL, 'active', '1', '1')",
+    (json.dumps(settings),),
+)
+conn.commit()
+conn.close()
+
+assert install_api.resolve_install_wizard_step(db_path) == "billing"
+
+print("test_install_wizard_resume: ok")