Feat/sealed content manifests

[seansica]

1. Saving a relationship no longer spawns endpoint revisions

What was wrong

When a relationship was saved, the page reset its source and target objects to work-in-progress by POSTing them, which created a brand-new revision of each endpoint. Combined with the API's relationship-advancement cascade, one
relationship edit fanned out into new revisions of both endpoints and of every other relationship touching them.

What changed

Relationship.updateSourceTargetObject now updates the endpoints in place (PUT), so their workflow state resets without a new revision. The API side of the cascade is removed in the companion beta change. Exact endpoint pairing now
lives in the snapshot's graph manifest.

---

2. The track page reflects sealed content and publication settings

What was wrong

The page exposed the old model: a per-snapshot "deterministic graph" that editors could create and delete, top-level marking refs that the API never used, an include_secondary_objects setting for a feature that doesn't exist, and no way to see or set the identity and markings that end up in the emitted x-mitre-collection object. Editing a virtual track's config crashed (Cannot read properties of undefined (reading 'apiUrl')) because two service getters were referenced instead of called.

What changed

• The History tab is now Releases. Every card shows content statistics (members, relationships, dependencies) from the snapshot's manifest; released cards show the stable bundle_id and copyable SHA-256 hashes for both STIX serializations (equivalent to sha256sum command). The graph create/delete actions are gone because every snapshot is sealed.
• Snapshot notes are editable on drafts only; the API refuses edits after release.
• The Config tab gained a Publication section: collection id and creation time (locked once the track has a release), publishing identity and collection markings each with an inherit from global toggle, and the resolved values with their source (track, global, derived, content). Virtual tracks save it in the same chain as their composition.
• The release preview dialog shows the relationship changes the release would seal (added, removed, stale endpoints).
• Administrators can delete the track's most recent release from its card with a typed version confirmation.

---

3. Data Quality page: domain consistency report

What was missing

Bundles now ship a relationship only when both endpoints are members of the same track. A relationship whose objects share no domain, or an object with no domain at all, can never be published, and nothing pointed editors at that content.

What changed

Two sections on the dashboard's Data Quality page:

• a Cross-Domain Relationships table (source and target with links, their domains, and the relationship type);
• an Objects Without Domains list, backed by GET /api/reports/domain-consistency. Fix findings at the source: revise the object with the right domain, or deprecate the relationship.

---

4. The draft-then-tag UX flow

What was wrong

The track page offered too many overlapping ways to act on a draft:

1. The header had Preview & Release (tag the latest draft), Export Latest, and Delete (the whole track);
2. Each draft card on the Releases tab had its own Preview & Tag and Export….
   • Export Latest was also broken outright: it sent include=all (the workbench tier selector) to the bundle endpoint, which now rejects it. The first tab was called Details although it is where the next draft is assembled.

What changed

One linear flow, as decided in review:

1. Board tab (formerly Details): assemble the next draft — candidates, staged objects, and for virtual tracks the header's single remaining action, Create Draft.
2. Releases tab: preview and tag a draft from its card (Preview & Tag); export any snapshot from its card; delete the most recent release (administrators).
3. Config tab: everything about the track itself, ending in a danger zone that holds Delete release track with its typed-id confirmation.

Export Latest and the header's Delete and Preview & Release are gone; app-stix-page-tabs gained a detailsLabel input so the first tab can be named for what it is.

---

5. Preview & Tag is fast and visibly in progress

What was wrong

Opening a release preview took ten seconds or more with no feedback. The page was downloading the entire object catalogue with every revision (getAllObjects({ versions: 'all' })) on each preview, only to look up each tier entry's type and version for the dialog.

What changed

The workbench snapshot now carries type and x_mitre_version on every tier entry (requires companion backend change), so the catalogue download is gone and only the Workbench attack type is derived locally.

Long operations are now visibly working rather than merely disabling a button. A page-level activity bar (indeterminate progress bar plus a message naming what the server is doing) appears under the header for every multi-second operation on the page. Creating a virtual draft, preparing a release preview, committing the tag (which previously had no indicator at all), deleting a release or the track, and saving the configuration. Plus the triggering button (Create Draft, Preview & Tag) shows a spinner with a "Creating draft" / "Preparing preview" label.

---

6. Track aliases

What was missing

Track pages lived at /dashboard/release-management/release-track--<uuid>.

What changed

The Config tab's Address card edits the track's alias (validated slug, live URL preview). Track cards navigate by alias when one exists, and the route accepts either form. Because the alias is registry metadata rather than snapshot content, the config save first applies an alias change through POST /:id/meta and then performs the config write; after loading a snapshot the page adopts the canonical id it returns, so deletion confirmations and comparisons never see the alias.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 60.72235% with 174 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.02%. Comparing base (faa2d92) to head (7e3f162).
⚠️ Report is 3 commits behind head on beta.

Files with missing lines	Patch %	Lines
...release-track-page/release-track-page.component.ts	63.31%	119 Missing and 5 partials ⚠️
...hboard-page/data-quality/data-quality.component.ts	62.29%	22 Missing and 1 partial ⚠️
.../connectors/rest-api/rest-api-connector.service.ts	8.33%	11 Missing ⚠️
...preview-dialog/release-preview-dialog.component.ts	46.66%	8 Missing ⚠️
src/app/classes/release-tracks/snapshot.ts	50.00%	5 Missing ⚠️
...ices/connectors/rest-api/release-tracks.service.ts	50.00%	3 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             beta     #953      +/-   ##
==========================================
- Coverage   48.05%   46.02%   -2.03%     
==========================================
  Files         205      205              
  Lines       27110    27168      +58     
  Branches     2132     1912     -220     
==========================================
- Hits        13028    12505     -523     
- Misses      14037    14596     +559     
- Partials       45       67      +22     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.