Add integration tests verifying that GroupService.delete_group(),
TenantService.delete_tenant(), and DataSourceService.delete() fully
roll back on transaction failure — no partial state survives.

Each test creates a real aggregate in the database, instantiates the
service with a FailingRepository subclass that raises inside delete(),
and asserts the record still exists after the exception propagates.
The DataSourceService test overrides get_by_id() to return a pre-loaded
aggregate, avoiding SQLAlchemy autobegin interference with the service's
explicit session.begin() block.

Fixes check-cascade-delete-rollback-test.sh failures on alpha that
blocked all branch merges.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The check-no-repo-port-mocks.sh check was failing on alpha because
repository ports and probe protocols were tested with AsyncMock()/MagicMock()
instead of concrete in-memory implementations.

Changes:
- tests/fakes/authorization.py: add check_permission_calls recording to
  InMemoryAuthorizationProvider so call-verification tests can assert
  on what was called without using mock.assert_called_once_with()
- tests/fakes/management.py: add RecordingDataSourceServiceProbe
  (implements DataSourceServiceProbe protocol with per-method call lists)
  and InMemoryDataSourceSyncRunRepository (implements IDataSourceSyncRunRepository
  with saved list for assertions)
- test_tenant_service.py: add _RecordingTenantServiceProbe class; replace
  inline mock_probe = MagicMock() with the concrete recording probe
- test_data_source_service.py: rename all mock_* fixtures to non-prohibited
  names (ds_repo, kg_repo, authz, probe, etc.); replace AsyncMock()/MagicMock()
  fixture bodies with InMemory* fakes; rewrite all 33 test bodies to use
  fake-specific state and recording APIs

Fixes check-no-repo-port-mocks.sh failures on alpha that blocked all
branch merges.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… approval payload

Spec FAIL 1 — Scenario: Agent-proposed ontology:
- Backend: 8 unit tests for POST /management/ontology-proposals verifying the
  endpoint accepts intent text, returns node/edge types for GitHub adapter, and
  returns empty types for unknown adapters.
- Frontend: 4 unit tests verifying beginOntologyProposal() calls the backend API
  with intent text (not a setTimeout simulation) and populates node/edge types
  from the API response.

Spec FAIL 2 — Scenario: Ontology review and approval:
- Backend: 3 unit tests verifying CreateDataSourceRequest accepts an optional
  ontology field and merges it into connection_config['_ontology'] so the
  approved types are not silently discarded.
- Frontend: 3 unit tests verifying approveOntology() includes the finalized
  node_types and edge_types in the createDataSource payload, including any
  user edits, and that extraction is not triggered before approval.

Spec PARTIAL — Scenario: Credential handling:
- Frontend: 3 unit tests verifying connToken is never written to localStorage,
  sessionStorage, or the URL during the wizard flow.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…proval payload

Spec FAIL 1 — Agent-proposed ontology (tracer bullet):
- Backend: Add POST /management/ontology-proposals endpoint.
  Accepts adapter_type, intent (required), and optional connection_config.
  Returns NodeTypeDefinition[] and EdgeTypeDefinition[] for the GitHub adapter
  (deterministic proposal based on adapter type — full AI inference is the next
  iteration). The intent text is accepted and will be used when the AI backend
  is wired up.
- Frontend: Replace the setTimeout simulation in beginOntologyProposal() with a
  real apiFetch call to /management/ontology-proposals, passing adapter_type,
  intent, and connection_config. Node/edge types are populated from the API
  response rather than hardcoded GITHUB_PROPOSAL_* constants.

Spec FAIL 2 — Ontology review and approval:
- Backend: Add NodeTypeDefinition, EdgeTypeDefinition, OntologyDefinition Pydantic
  models. Extend CreateDataSourceRequest with optional ontology field.
  build_connection_config_with_ontology() merges the approved types into
  connection_config['_ontology'] so they travel with the DS config without
  requiring a DB migration.
- Frontend: approveOntology() now serialises proposedNodes and proposedEdges
  (including all user edits from step 4) into the ontology field of the
  createDataSource payload. The approved types are no longer silently discarded.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

check-no-check-script-deletions.sh requires all grep-based check scripts
to include --exclude-dir=.venv to avoid false positives from third-party
packages in the virtual environment. check-no-api-simulation.sh was
introduced without this flag, causing check-no-check-script-deletions.sh
to FAIL and blocking the branch from merging.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045

check-process-agent-not-on-task-branch.sh and
check-process-improvement-commit-is-clean.sh are pre-commit gates
designed to block process-improvement agents from committing on
task branches.  However, the orchestrator also runs all check scripts
during merge verification — where they always failed because the
current branch IS a task branch, even when no PI commits exist.

Root cause of "Merge failed": these checks had no awareness of context
(pre-commit vs. verification).  They unconditionally exited 1 on any
hyperloop/task-NNN branch, blocking the squash merge.

Fix: add a dual-mode strategy to both scripts.

PRE-COMMIT MODE (staged files present):
  Fail immediately if on a task branch — the commit is blocked.

VERIFICATION MODE (no staged files, called by orchestrator):
  Scan branch history (merge-base..HEAD) for commits with
  "Task-Ref: process-improvement".  Fail only if such commits
  are actually present (the bad outcome occurred).  Pass otherwise —
  the check's goal (no PI commits on the task branch) was achieved.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045

Add backend-api-alignment.test.ts with 30 tests covering:
- Group CRUD endpoint URLs (GET/POST/PATCH/DELETE /iam/groups, /members)
- API key endpoint URLs (GET/POST /iam/api-keys, DELETE /iam/api-keys/{id})
- Reactive list refresh after every mutation (no manual page reload)
- Workspace parent_workspace_id preserved in creation payload
- End-to-end operation patterns: validate → API call → reload → toast

Fix api-keys.test.ts: revoke tests used wrong endpoint
POST /iam/api-keys/{id}/revoke → correct: DELETE /iam/api-keys/{id}

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Cherry-picks sync-logs.test.ts from the diverged task-044 branch
to bring the dedicated sync log tests onto hyperloop/task-045.

Tests cover:
- Both dsId and runId captured when viewLogs() is called
- logSheetOpen set before fetch completes (immediate UX feedback)
- Stale logs cleared before each new fetch
- logsLoading state transitions (true during fetch, false after)
- Empty API response and missing logs key handled gracefully
- closeLogs() resets all six state fields in one call

Sync log scenarios were already covered by knowledge-graphs.test.ts;
this file provides explicit, focused attribution to the spec scenario.

Spec-Ref: specs/ui/experience.spec.md@86a2b5c71ec6c6af7ed222eae46139acec3974b3
Task-Ref: task-045

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>