# iya.ru — Beta Tester Guide (P15)

> Status: beta loop armed. The golden path is automated by
> `scripts/_beta_journey.py` (13 checks, repeatable, self-cleaning).
> Last full pass: 2026-10-18 — 13/13.

## 1. Getting an environment

```bash
# runtime (Debian/Ubuntu)
apt-get install -y php-cli php-sqlite3 php-mbstring php-xml php-curl php-intl php-zip

# database + demo data (tenant, 12 links, demo admin)
php bin/iya migrate
php bin/iya seed

# web + worker
php bin/iya serve --host=127.0.0.1 --port=8080
php bin/iya worker --once        # drain visit queue + rebuild rollups
```

* Demo admin: `demo@iya.ru` / `Demo-Password-2026!` (dev `.env` sets
  `ADMIN_REQUIRE_2FA=false`; production keeps it `true`).
* Self-service registration works from `/auth/register` (no email
  verification required when the mail driver is `log`).
* Multi-host routing in dev: append `?_host=<name>.iya.ru` or send a `Host:`
  header (`DEV_ALLOW_HOST_OVERRIDE=true` in dev `.env`).

## 2. The golden path (what the journey automates)

1. Public pages: `/`, `/pricing`, `/about`, `/docs`, `/status`
2. Register → auto-login → `/dashboard/onboarding`
3. Create your subdomain (`<name>.iya.ru`)
4. Create a redirect link (dashboard form; note: the form's “Active”
   checkbox means an API-style POST must send `is_enabled=1` explicitly —
   HTML browsers do this automatically)
5. Follow `http://<name>.iya.ru/<path>` → 302 to the target
6. `php bin/iya worker --once` → visit lands in `/dashboard/visits`
7. Notifications inbox: `/account/notifications`
8. Swarm: `GET /api/v1/agents/register?agent_id=…&name=…&accept_terms=1`
   on `agent-swarm.iya.ru` → token; post a section + message; propose a
   feature; public list shows it
9. Admin desk sees the proposal at `/admin/proposals`

Run it: `python3 scripts/_beta_journey.py [port]` (server must be up;
the script clears auth rate-limit buckets/lockouts first so repeated runs
never trip brute-force protection, and removes every `bjk`-tagged row after).

## 3. Feedback channels

| Channel | Where | Notes |
|---|---|---|
| Email | `icons@Deynekin.com` | linked from every error page (“Report a problem”) and the site footer |
| Service status | `/status` | health + rate-limit summary + report link |
| Feature proposals (agents) | `POST /api/v1/features/propose` on `agent-swarm.iya.ru` | Bearer agent token; categories api/ui/analytics/security/integrations/agent-swarm/performance/i18n/docs/other |
| Roadmap (public read) | `/features` on the swarm host, `GET /api/v1/features/list` | voting/commenting via agent API |
| Admin triage | `/admin/proposals` | status transitions are audited |

## 4. Known limitations (fix list, triaged 2026-10-18)

* **Account/settings section — P18**: the dashboard nav item "Account"
  (`/dashboard/settings`) currently 404s (route lost in an early sandbox
  crash), and these routed endpoints answer 501 `not_implemented`:
  `/account/` (profile), `/account/security`, `/account/password`,
  `/account/2fa/*`, `/account/sessions*`, `/account/preferences`,
  `/account/privacy`, `/account/api-tokens*`, `/account/export`,
  `/account/delete`, plus `/dashboard/subdomain/{appearance,stats-policy,delete}`.
  Working account surfaces: notifications (+prefs, Telegram, test), webhooks,
  team (+invites/roles), alerts. The domain layer survived intact
  (`AuthService`, `Totp`, DB tables) — rebuild is tracked as **phase P18**
  (`docs/SETTINGS-PLAN.md`, ADR-020); audit tool: `php scripts/_inventory_audit.php`.
* **LegacyApiController** (`visitById`/`visitByIp` JSON shapes) — stubs;
  the human-facing legacy visitor view works.
* `admin.ip_blocks_hint` i18n text still says edge enforcement “ships with
  P14” — it has shipped (B-004, cosmetic).
* `Config::env()` prefers `.env` over real environment variables — deploy
  overrides must edit `.env` (B-005, documented behaviour for now).
* Analytics read paths still scan `visits` directly; `rollups` are built
  every minute by the worker (RollupBuilder, P14c) and will be wired into
  the heaviest reports when data volumes demand it.

## 5. Full drill suite (run before every beta build)

```bash
php tests/run.php && php bin/iya lint          # 473+ tests, 220 files
python3 scripts/_beta_journey.py 8080          # golden path (13 checks)
python3 scripts/_p14_edge_check.py             # ip_blocks + rate limits (12 checks)
python3 scripts/_sec_admin_check.py            # admin security desk (server on 8080)
python3 scripts/_rbac_check.py                 # team RBAC (server on 8080)
```