añadido karpathy y refactorizacion del proyecto

testcases/pbx/core/security/core-security-check-auto_enrollment_certificate_management_process.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.902Z
+# Source of truth: this YAML file
+
+id: core-security-check-auto_enrollment_certificate_management_process
+project: pbx
+module: core
+group: core-security
+title: Verify auto-enrollment certificate management (ACME/Let's Encrypt) is configured and functional
+description: Verify auto-enrollment certificate management (ACME/Let's Encrypt) is configured and functional
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)

testcases/pbx/core/security/core-security-check-encryption_of_sensitive_data_at_rest_and_in_transit.yaml

@@ -0,0 +1,62 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.904Z
+# Source of truth: this YAML file
+
+id: core-security-check-encryption_of_sensitive_data_at_rest_and_in_transit
+project: pbx
+module: core
+group: core-security
+title: Verify sensitive data is encrypted at rest (DB) and in transit (HTTPS/TLS)
+description: Verify sensitive data is encrypted at rest (DB) and in transit (HTTPS/TLS)
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: partial
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Portal UI configuration and verification steps (already partially automated)
+    - Data extraction and reporting of current settings
+  original_notYet:
+    - >-
+      HTTPS/TLS configuration verified via portal; DB-level at-rest encryption requires SSH/CLI
+      access
+    - Requires external SIP endpoints or physical phones for media/audio validation
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)
+  partialNotes: HTTPS/TLS configuration verified via portal; DB-level at-rest encryption requires SSH/CLI access

testcases/pbx/core/security/core-security-check-ip_access_control_lists.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.905Z
+# Source of truth: this YAML file
+
+id: core-security-check-ip_access_control_lists
+project: pbx
+module: core
+group: core-security
+title: Verify IP Access Control Lists are properly configured and enforced
+description: Verify IP Access Control Lists are properly configured and enforced
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)

testcases/pbx/core/security/core-security-check-known_vulnerable_dependencies_in_release_artifacts.yaml

@@ -0,0 +1,63 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.905Z
+# Source of truth: this YAML file
+
+id: core-security-check-known_vulnerable_dependencies_in_release_artifacts
+project: pbx
+module: core
+group: core-security
+title: Verify release artifacts do not contain known vulnerable dependencies (CVE scan)
+description: Verify release artifacts do not contain known vulnerable dependencies (CVE scan)
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: partial
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Portal UI configuration and verification steps (already partially automated)
+    - Data extraction and reporting of current settings
+  original_notYet:
+    - >-
+      Vulnerability report page in portal automated; actual CVE scanning requires Trivy/OWASP-DC in
+      CI
+    - Requires external SIP endpoints or physical phones for media/audio validation
+    - Full CVE / dependency scanning (Trivy, Grype, OWASP Dependency-Check) in CI pipeline
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)
+  partialNotes: Vulnerability report page in portal automated; actual CVE scanning requires Trivy/OWASP-DC in CI

testcases/pbx/core/security/core-security-check-obtain_formal_security_team_sign_off_for_the_new_version.yaml

@@ -0,0 +1,59 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.906Z
+# Source of truth: this YAML file
+
+id: core-security-check-obtain_formal_security_team_sign_off_for_the_new_version
+project: pbx
+module: core
+group: core-security
+title: Obtain formal written sign-off from the Security team approving the release
+description: Obtain formal written sign-off from the Security team approving the release
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: false
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: false
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: false
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: false
+automation_status: manual
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Most UI-driven configuration and verification steps via Playwright
+  original_notYet:
+    - Governance gate requiring human decision and formal sign-off document; cannot be automated
+    - Requires external SIP endpoints or physical phones for media/audio validation
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)
+  manualReason: Governance gate requiring human decision and formal sign-off document; cannot be automated

testcases/pbx/core/security/core-security-check-previous_security_findings_have_been_remediated_before_release.yaml

@@ -0,0 +1,61 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.907Z
+# Source of truth: this YAML file
+
+id: core-security-check-previous_security_findings_have_been_remediated_before_release
+project: pbx
+module: core
+group: core-security
+title: Verify all previously identified security findings are remediated before release
+description: Verify all previously identified security findings are remediated before release
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: false
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: false
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: false
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: false
+automation_status: manual
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Most UI-driven configuration and verification steps via Playwright
+  original_notYet:
+    - >-
+      Requires access to security issue tracker and cross-referencing CVEs with the release
+      changelog
+    - Requires external SIP endpoints or physical phones for media/audio validation
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)
+  manualReason: Requires access to security issue tracker and cross-referencing CVEs with the release changelog

testcases/pbx/core/security/core-security-check-security_event_logging_and_audit_trail_is_active.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.908Z
+# Source of truth: this YAML file
+
+id: core-security-check-security_event_logging_and_audit_trail_is_active
+project: pbx
+module: core
+group: core-security
+title: Verify security event logging and audit trail are active and recording events
+description: Verify security event logging and audit trail are active and recording events
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)

testcases/pbx/core/security/core-security-check-sip_tls_and_srtp_encryption_enabled_by_default.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.909Z
+# Source of truth: this YAML file
+
+id: core-security-check-sip_tls_and_srtp_encryption_enabled_by_default
+project: pbx
+module: core
+group: core-security
+title: Verify SIP TLS and SRTP media encryption are enabled by default
+description: Verify SIP TLS and SRTP media encryption are enabled by default
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)

testcases/pbx/core/security/core-security-check-unnecessary_services_and_ports_are_disabled.yaml

@@ -0,0 +1,60 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.910Z
+# Source of truth: this YAML file
+
+id: core-security-check-unnecessary_services_and_ports_are_disabled
+project: pbx
+module: core
+group: core-security
+title: Verify unnecessary services and network ports are disabled
+description: Verify unnecessary services and network ports are disabled
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: partial
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Portal UI configuration and verification steps (already partially automated)
+    - Data extraction and reporting of current settings
+  original_notYet:
+    - Service status via admin portal automated; port scanning requires nmap from external host
+    - Requires external SIP endpoints or physical phones for media/audio validation
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)
+  partialNotes: Service status via admin portal automated; port scanning requires nmap from external host

testcases/pbx/core/security/core-security-check-verify_role_based_access_control_and_least_privilege_principle.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.910Z
+# Source of truth: this YAML file
+
+id: core-security-check-verify_role_based_access_control_and_least_privilege_principle
+project: pbx
+module: core
+group: core-security
+title: Verify RBAC roles are correctly defined and least-privilege principle is enforced
+description: Verify RBAC roles are correctly defined and least-privilege principle is enforced
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: check
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)

testcases/pbx/core/security/core-security-write-strong_password_policy.yaml

@@ -0,0 +1,57 @@
+# Updated via Autotest Editor - 2026-05-25T17:39:33.911Z
+# Source of truth: this YAML file
+
+id: core-security-write-strong_password_policy
+project: pbx
+module: core
+group: core-security
+title: Navigate to security settings and record the current password policy configuration
+description: Navigate to security settings and record the current password policy configuration
+priority: Medium
+tags: []
+references: []
+dependencies:
+  - label: Admin Portal
+    value: https://pbx.local:4443 (configure via $BASE_URL)
+  - label: Repository URL
+    value: ${BASE_URL}/downloads or $REPO_URL
+  - label: Protocol
+    value: HTTPS (admin portal) + optional SSH/CLI
+  - label: Credentials
+    value: Admin user with sufficient privileges (portal + SSH where needed)
+  - label: Test Data
+    value: Clean test tenant or lab PBX instance (recommended isolated environment)
+preconditions: []
+postconditions: []
+steps:
+  - action: Open admin portal or repository URL in browser context
+    expected: ''
+    automatable: true
+  - action: Log in to the admin portal (if required)
+    expected: ''
+    automatable: true
+  - action: Navigate to the relevant settings section
+    expected: ''
+    automatable: true
+  - action: Read current configuration values via UI or API
+    expected: ''
+    automatable: true
+automation_status: automated
+file: tests/core/security.spec.ts
+custom_fields:
+  original_action: write
+  original_automatable:
+    - Full end-to-end execution via Playwright against the admin portal UI
+    - Navigation, form interaction, and assertions are scriptable
+  original_notYet: []
+  original_dependencies:
+    - label: Admin Portal
+      value: https://pbx.local:4443 (configure via $BASE_URL)
+    - label: Repository URL
+      value: ${BASE_URL}/downloads or $REPO_URL
+    - label: Protocol
+      value: HTTPS (admin portal) + optional SSH/CLI
+    - label: Credentials
+      value: Admin user with sufficient privileges (portal + SSH where needed)
+    - label: Test Data
+      value: Clean test tenant or lab PBX instance (recommended isolated environment)