Test project-qualified extension import

.github/workflows/acceptance.yml

@@ -11,22 +11,53 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  browser-pool:
-    name: Browser pool acceptance
+  durable-resource:
+    name: ${{ matrix.name }} acceptance
     runs-on: ubuntu-latest
-    # Keep the job timeout above the go test -timeout below: the job budget
-    # also covers checkout/toolchain setup, and if it fires first it kills the
-    # test process before t.Cleanup can delete the pools it created.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Browser pool
+            package: ./internal/resources/browserpool
+            project_id_required: true
+          - name: Browser pool data source
+            package: ./internal/datasources/browserpool
+            project_id_required: true
+          - name: Project
+            package: ./internal/resources/project
+            project_id_required: false
+          - name: Project data source
+            package: ./internal/datasources/project
+            project_id_required: true
+          - name: Extension
+            package: ./internal/resources/extension
+            project_id_required: true
+          - name: Extension data source
+            package: ./internal/datasources/extension
+            project_id_required: true
+    # Keep the job timeout above the go test timeout so Go can report the test
+    # timeout before the runner stops the job. Either hard timeout can bypass
+    # t.Cleanup, so release operators still inspect for leaked test resources.
     timeout-minutes: 40
     env:
       TF_ACC: "1"
       KERNEL_ACC: "1"
-      KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
-      KERNEL_PROJECT_ID: ${{ secrets.KERNEL_PROJECT_ID }}
-      KERNEL_ALT_PROJECT_ID: ${{ secrets.KERNEL_ALT_PROJECT_ID }}
-      KERNEL_BASE_URL: ${{ secrets.KERNEL_BASE_URL }}
 
     steps:
+      - name: Check API key secret
+        env:
+          KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
+        run: |
+          : "${KERNEL_API_KEY:?Set the KERNEL_API_KEY repository secret before running acceptance tests.}"
+
+      - name: Check project secret
+        if: matrix.project_id_required
+        env:
+          KERNEL_PROJECT_ID: ${{ secrets.KERNEL_PROJECT_ID }}
+        run: |
+          : "${KERNEL_PROJECT_ID:?Set the KERNEL_PROJECT_ID repository secret before running project-scoped acceptance tests.}"
+
       - name: Checkout
         uses: actions/checkout@v6
 
@@ -42,10 +73,10 @@ jobs:
           terraform_version: "1.15.5"
           terraform_wrapper: false
 
-      - name: Check required secrets
-        run: |
-          : "${KERNEL_API_KEY:?Set the KERNEL_API_KEY repository secret before running acceptance tests.}"
-          : "${KERNEL_PROJECT_ID:?Set the KERNEL_PROJECT_ID repository secret before running acceptance tests.}"
-
-      - name: Run browser pool acceptance tests
-        run: go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc
+      - name: Run acceptance tests
+        env:
+          KERNEL_API_KEY: ${{ secrets.KERNEL_API_KEY }}
+          KERNEL_BASE_URL: ${{ secrets.KERNEL_BASE_URL }}
+          KERNEL_PROJECT_ID: ${{ matrix.project_id_required && secrets.KERNEL_PROJECT_ID || '' }}
+          KERNEL_ALT_PROJECT_ID: ${{ matrix.project_id_required && secrets.KERNEL_ALT_PROJECT_ID || '' }}
+        run: go test -count=1 -timeout=30m -v ${{ matrix.package }} -run TestAcc

README.md

@@ -4,20 +4,23 @@ Terraform provider for durable Kernel infrastructure configuration.
 
 This provider manages desired state only. Browser/session runtime operations stay in the Kernel SDK and API.
 
-## Supported In v0
+## Supported
 
 Provider configuration:
 
 - `api_key`
 - `base_url`
 - `project_id`
 
-Resource:
+Resources:
 
 - `kernel_browser_pool`
+- `kernel_extension`
+- `kernel_project`
 
 Data sources:
 
+- `kernel_app`
 - `kernel_project`
 - `kernel_profile`
 - `kernel_proxy`
@@ -26,8 +29,10 @@ Data sources:
 Import:
 
 - `kernel_browser_pool` by canonical browser pool ID
+- `kernel_extension` by canonical extension ID, optionally qualified with its project ID
+- `kernel_project` by canonical project ID
 
-## Not Supported In v0
+## Not Supported
 
 The provider intentionally does not manage:
 
@@ -37,8 +42,8 @@ The provider intentionally does not manage:
 - logs, screenshots, or live view
 - runtime status or standby state
 - force-release or recovery operations
-- API key or project resources
-- extension upload, download, delete, or Chrome Store operations
+- API key, profile, proxy, or deployment resources
+- extension download or Chrome Web Store download operations
 
 ## Quickstart
 
@@ -74,11 +79,16 @@ resource "kernel_browser_pool" "example" {
 }
 ```
 
-Import an existing browser pool. The bare form resolves the project like create (provider default, else the API key's binding); use the project-qualified form to import from a different project:
+Import existing resources by canonical ID. For browser pools, the bare form
+resolves the project like create (provider default, else the API key's binding);
+use the project-qualified form to import from a different project:
 
 ```sh
 terraform import kernel_browser_pool.example <browser-pool-id>
 terraform import kernel_browser_pool.example <project-id>/<browser-pool-id>
+terraform import kernel_extension.example <extension-id>
+terraform import kernel_extension.example <project-id>/<extension-id>
+terraform import kernel_project.example <project-id>
 ```
 
 ## Local Development
@@ -128,22 +138,27 @@ Do not run `terraform init` just to exercise this unreleased provider through `d
 
 Acceptance tests are opt-in because they can create real Kernel resources.
 
-Required environment:
+Required for all acceptance tests:
 
 ```sh
 export TF_ACC=1
 export KERNEL_ACC=1
 export KERNEL_API_KEY="..."
-export KERNEL_PROJECT_ID="..."
 ```
 
-Run the browser-pool acceptance test:
+Browser-pool acceptance tests additionally require:
 
 ```sh
-go test -v ./internal/resources/browserpool -run TestAccBrowserPoolLifecycle
+export KERNEL_PROJECT_ID="..."
 ```
 
-The acceptance test creates uniquely named browser pools and uses durable `force=false` cleanup. It does not acquire browsers or perform runtime recovery.
+The tests create uniquely named durable resources and register independent
+cleanup. Extension acceptance creates a small temporary Manifest V3 archive and
+tests checksum-driven replacement. Browser-pool deletion remains `force=false`.
+The tests do not acquire browsers or perform runtime recovery.
+
+Use the commands in the [v1 acceptance matrix](docs/acceptance.md), which is the
+single source for current coverage, tag blockers, and the release-run record.
 
 ## Architecture
 

docs/acceptance.md

@@ -0,0 +1,92 @@
+# v1 Acceptance Matrix
+
+This document is the live-API release gate for the first public v1. Unit tests
+remain the fast default; acceptance tests run only through explicit local opt-in
+or the manual GitHub Actions workflow.
+
+## Gate Rules
+
+- Set both `TF_ACC=1` and `KERNEL_ACC=1`.
+- Use unique `kernel-tf-*` names for every created fixture.
+- Register cleanup as soon as a canonical ID exists.
+- Verify deletion with a coded `not_found` response where the API supports it.
+- Never acquire, release, flush, invoke, force-release, or recover runtime state.
+- Keep live tests out of pull-request CI.
+- Record one complete green matrix run against the release commit before tagging.
+- Every registered v1 surface must have a live acceptance test and pass against
+  the release commit. A fixture blocker is a v1 tag blocker, not a release-note
+  exception. An unregistered deferred resource is not part of the live matrix.
+
+## Environment
+
+The current workflow uses:
+
+```sh
+export TF_ACC=1
+export KERNEL_ACC=1
+export KERNEL_API_KEY=...
+export KERNEL_PROJECT_ID=...
+export KERNEL_ALT_PROJECT_ID=... # optional second project
+export KERNEL_BASE_URL=...       # optional non-production API
+```
+
+Future fixture-backed data-source tests may add narrowly named variables only
+when the provider cannot create and clean up the fixture through a durable SDK
+operation. Secrets must remain GitHub Actions secrets and must not be printed.
+
+## Current Matrix
+
+| Surface | Repository test status | Acceptance scenario | Required follow-up |
+| --- | --- | --- | --- |
+| `kernel_project` resource | Test present | Create, rename, no-drift plan, import, delete, and 404 verification. | None. |
+| `kernel_browser_pool` resource | Test present | Create, durable update with stable ID, no-drift plan, bare and project-qualified import paths, explicit project scope, non-force delete, and 404 verification. | Keep leased-browser conflict behavior in unit tests; acceptance must not create runtime leases. |
+| `kernel_extension` resource | Test present | Upload, checksum state, no-drift plan, bare and project-qualified metadata-only import paths, content replacement with new ID, old-ID disappearance, delete, and 404 verification. | None. |
+| `kernel_browser_pool` data source | Test present | A uniquely created pool is read by canonical ID and byte-exact name, including normalized durable configuration, a no-drift plan, and post-destroy coded `not_found` verification. | None. |
+| `kernel_project` data source | Test present | A uniquely created project is read by canonical ID and exact name; the provider default resolves the configured project; metadata, no-drift planning, and post-destroy coded `not_found` are verified. | None. |
+| `kernel_extension` data source | Test present | A uniquely uploaded extension is read by canonical ID and exact name through explicit and provider-default project scope; metadata, no-drift planning, and post-destroy coded `not_found` are verified. | None. |
+| `kernel_profile` data source | Test missing; tag blocker | Unit and fake-client tests only. | Add durable SDK fixture create/delete helpers, then verify ID/name lookup and cleanup. Do not model runtime-written profile contents. |
+| `kernel_proxy` data source | Test missing; tag blocker | Unit and fake-client tests only. | Add a durable, non-secret-leaking proxy fixture strategy and verify ID/name lookup, masked metadata, and cleanup. |
+| `kernel_app` data source | Fixture blocked; tag blocker | Unit, SDK transport, pagination, ambiguity, project-scope, and Framework state tests only. | Provide a release-owned running deployment fixture or a deterministic durable deployment setup. Verify exact app/version lookup without invocation and without exposing env values. |
+| `kernel_api_key` data source | Deferred; unregistered | No provider surface yet. | Wait for a tagged SDK with exact-name filtering, then add masked ID/name lookup acceptance. |
+| Profile, proxy, deployment, and API-key resources | Deferred; unregistered | No provider surfaces yet. | Enter the matrix only after their documented API/SDK/state blockers are resolved and implementation lands. |
+
+"Test present" describes code in the repository; it does not claim a run
+against the release commit. The release record below supplies that evidence.
+
+## Current Commands
+
+Run the six existing packages independently for fast failure isolation:
+
+```sh
+go test -count=1 -timeout=30m -v ./internal/resources/project -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/datasources/project -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/resources/extension -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/datasources/extension -run TestAcc
+go test -count=1 -timeout=30m -v ./internal/datasources/browserpool -run TestAcc
+```
+
+The manual `Acceptance` workflow runs the same packages as separate matrix jobs
+with `fail-fast: false`. Add a package to that workflow in the same PR that adds
+its first live test.
+
+## Release Record
+
+Record this information in the v1 release PR or release issue, not in this
+repository with secrets:
+
+```text
+Commit:
+Workflow run URL:
+API environment:
+Started at:
+Completed at:
+Package results:
+Interrupted or timed-out jobs:
+Leaked-resource audit completed:
+Unregistered deferred surfaces:
+```
+
+An interrupted process can bypass `t.Cleanup`. Follow the ordered cleanup and
+404 verification procedure in [Release And Security Checklist](release.md)
+before rerunning or tagging.