re-uploading work

tests/e2e/tier1/__init__.py

@@ -0,0 +1,30 @@
+"""
+Tier 1 E2E Tests - Core Automation Flows
+
+This package contains Tier 1 end-to-end tests that validate the fundamental
+automation lifecycle. These tests are critical for MVP and must all pass
+before release.
+
+Test Coverage:
+- T1.1: Interval Timer Automation
+- T1.2: Date Timer (One-Shot Execution)
+- T1.3: Cron Timer Execution
+- T1.4: Webhook Trigger with Payload
+- T1.5: Workflow with Array Iteration (with-items)
+- T1.6: Action Reads from Key-Value Store
+- T1.7: Multi-Tenant Isolation
+- T1.8: Action Execution Failure Handling
+
+All tests require:
+- All 5 services running (API, Executor, Worker, Sensor, Notifier)
+- PostgreSQL database
+- RabbitMQ message queue
+- Test fixtures in tests/fixtures/
+
+Run with:
+    pytest tests/e2e/tier1/ -v
+    pytest tests/e2e/tier1/test_t1_01_interval_timer.py -v
+    pytest -m tier1 -v
+"""
+
+__all__ = []

tests/e2e/tier1/test_t1_01_interval_timer.py

@@ -0,0 +1,279 @@
+#!/usr/bin/env python3
+"""
+T1.1: Interval Timer Automation
+
+Tests that an action executes repeatedly on an interval timer trigger.
+
+Test Flow:
+1. Register test pack via API
+2. Create interval timer trigger (every 5 seconds)
+3. Create simple echo action
+4. Create rule linking timer → action
+5. Wait for 3 trigger events (15 seconds)
+6. Verify 3 enforcements created
+7. Verify 3 executions completed successfully
+
+Success Criteria:
+- Timer fires every 5 seconds (±500ms tolerance)
+- Each timer event creates enforcement
+- Each enforcement creates execution
+- All executions reach 'succeeded' status
+- Action output captured in execution results
+- No errors in any service logs
+"""
+
+import time
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_echo_action,
+    create_interval_timer,
+    create_rule,
+    wait_for_event_count,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.timer
+@pytest.mark.integration
+@pytest.mark.timeout(60)
+class TestIntervalTimerAutomation:
+    """Test interval timer automation flow"""
+
+    def test_interval_timer_creates_executions(
+        self, client: AttuneClient, pack_ref: str
+    ):
+        """Test that interval timer creates executions at regular intervals"""
+
+        # Test parameters
+        interval_seconds = 5
+        expected_executions = 3
+        test_duration = interval_seconds * expected_executions + 5  # Add buffer
+
+        print(f"\n=== T1.1: Interval Timer Automation ===")
+        print(f"Interval: {interval_seconds}s")
+        print(f"Expected executions: {expected_executions}")
+        print(f"Test duration: ~{test_duration}s")
+
+        # Step 1: Create interval timer trigger
+        print("\n[1/5] Creating interval timer trigger...")
+        trigger = create_interval_timer(
+            client=client,
+            interval_seconds=interval_seconds,
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Created trigger: {trigger['label']} (ID: {trigger['id']})")
+        assert trigger["ref"] == "core.intervaltimer"
+        assert "sensor" in trigger
+        assert trigger["sensor"]["enabled"] is True
+
+        # Step 2: Create echo action
+        print("\n[2/5] Creating echo action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 3: Create rule linking trigger → action
+        print("\n[3/5] Creating rule...")
+
+        # Capture timestamp before rule creation for filtering
+        import time
+        from datetime import datetime, timezone
+
+        rule_creation_time = datetime.now(timezone.utc).isoformat()
+
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            enabled=True,
+            action_parameters={
+                "message": f"Timer fired at interval {interval_seconds}s"
+            },
+        )
+        print(f"✓ Created rule: {rule['label']} (ID: {rule['id']})")
+        print(f"  Rule creation timestamp: {rule_creation_time}")
+        assert rule["enabled"] is True
+        assert rule["trigger"] == trigger["id"]
+        assert rule["action_ref"] == action_ref
+
+        # Step 4: Wait for events to be created
+        print(
+            f"\n[4/5] Waiting for {expected_executions} timer events (timeout: {test_duration}s)..."
+        )
+        start_time = time.time()
+
+        events = wait_for_event_count(
+            client=client,
+            expected_count=expected_executions,
+            trigger_id=trigger["id"],
+            timeout=test_duration,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start_time
+        print(f"✓ {len(events)} events created in {elapsed:.1f}s")
+
+        # Sort events by created timestamp (ascending order - oldest first)
+        events_sorted = sorted(events[:expected_executions], key=lambda e: e["created"])
+
+        # Verify event timing
+        event_times = []
+        for i, event in enumerate(events_sorted):
+            print(f"  Event {i + 1}: ID={event['id']}, trigger={event['trigger']}")
+            assert event["trigger"] == trigger["id"]
+            event_times.append(event["created"])
+
+        # Check event intervals (if we have multiple events)
+        if len(event_times) >= 2:
+            from datetime import datetime
+
+            for i in range(1, len(event_times)):
+                t1 = datetime.fromisoformat(event_times[i - 1].replace("Z", "+00:00"))
+                t2 = datetime.fromisoformat(event_times[i].replace("Z", "+00:00"))
+                interval = (t2 - t1).total_seconds()
+                print(
+                    f"  Interval {i}: {interval:.1f}s (expected: {interval_seconds}s)"
+                )
+
+                # Allow ±1 second tolerance for timing
+                assert abs(interval - interval_seconds) < 1.5, (
+                    f"Event interval {interval:.1f}s outside tolerance (expected {interval_seconds}s ±1.5s)"
+                )
+
+        # Step 5: Verify executions completed successfully
+        print(f"\n[5/5] Verifying {expected_executions} executions completed...")
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=expected_executions,
+            rule_id=rule["id"],
+            created_after=rule_creation_time,
+            timeout=30,
+            poll_interval=1.0,
+            verbose=True,
+        )
+
+        print(f"✓ {len(executions)} executions created")
+
+        # Verify each execution
+        succeeded_count = 0
+        for i, execution in enumerate(executions[:expected_executions]):
+            exec_id = execution["id"]
+            status = execution["status"]
+
+            print(f"\n  Execution {i + 1} (ID: {exec_id}):")
+            print(f"    Status: {status}")
+            print(f"    Action: {execution['action_ref']}")
+
+            # Wait for execution to complete if still running
+            if status not in ["succeeded", "failed", "canceled"]:
+                print(f"    Waiting for completion...")
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=exec_id,
+                    expected_status="succeeded",
+                    timeout=15,
+                )
+                status = execution["status"]
+                print(f"    Final status: {status}")
+
+            # Verify execution succeeded
+            assert status == "succeeded", (
+                f"Execution {exec_id} failed with status '{status}'"
+            )
+
+            # Verify execution has correct action
+            assert execution["action_ref"] == action_ref
+
+            # Verify execution has result
+            if execution.get("result"):
+                print(f"    Result: {execution['result']}")
+
+            succeeded_count += 1
+
+        print(f"\n✓ All {succeeded_count} executions succeeded")
+
+        # Final verification
+        print("\n=== Test Summary ===")
+        print(f"✓ Trigger created and firing every {interval_seconds}s")
+        print(f"✓ {len(events)} events generated")
+        print(f"✓ {succeeded_count} executions completed successfully")
+        print(f"✓ Total test duration: {time.time() - start_time:.1f}s")
+        print(f"✓ Test PASSED")
+
+    def test_interval_timer_precision(self, client: AttuneClient, pack_ref: str):
+        """Test that interval timer fires with acceptable precision"""
+
+        # Use shorter interval for precision test
+        interval_seconds = 3
+        expected_fires = 5
+        test_duration = interval_seconds * expected_fires + 3
+
+        print(f"\n=== T1.1b: Interval Timer Precision ===")
+        print(f"Testing {interval_seconds}s interval over {expected_fires} fires")
+
+        # Create automation
+        trigger = create_interval_timer(
+            client=client, interval_seconds=interval_seconds, pack_ref=pack_ref
+        )
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        print(f"✓ Setup complete: trigger={trigger['id']}, action={action['ref']}")
+
+        # Record event times
+        print(f"\nWaiting for {expected_fires} events...")
+        events = wait_for_event_count(
+            client=client,
+            expected_count=expected_fires,
+            trigger_id=trigger["id"],
+            timeout=test_duration,
+            poll_interval=0.5,
+        )
+
+        # Calculate intervals
+        from datetime import datetime
+
+        event_times = [
+            datetime.fromisoformat(e["created"].replace("Z", "+00:00"))
+            for e in events[:expected_fires]
+        ]
+
+        intervals = []
+        for i in range(1, len(event_times)):
+            interval = (event_times[i] - event_times[i - 1]).total_seconds()
+            intervals.append(interval)
+            print(f"  Interval {i}: {interval:.2f}s")
+
+        # Calculate statistics
+        if intervals:
+            avg_interval = sum(intervals) / len(intervals)
+            min_interval = min(intervals)
+            max_interval = max(intervals)
+
+            print(f"\nInterval Statistics:")
+            print(f"  Expected: {interval_seconds}s")
+            print(f"  Average:  {avg_interval:.2f}s")
+            print(f"  Min:      {min_interval:.2f}s")
+            print(f"  Max:      {max_interval:.2f}s")
+            print(f"  Range:    {max_interval - min_interval:.2f}s")
+
+            # Verify precision
+            # Allow ±1 second tolerance
+            tolerance = 1.0
+            assert abs(avg_interval - interval_seconds) < tolerance, (
+                f"Average interval {avg_interval:.2f}s outside tolerance"
+            )
+
+            print(f"\n✓ Timer precision within ±{tolerance}s tolerance")
+            print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_02_date_timer.py

@@ -0,0 +1,328 @@
+#!/usr/bin/env python3
+"""
+T1.2: Date Timer (One-Shot Execution)
+
+Tests that an action executes once at a specific future time.
+
+Test Flow:
+1. Create date timer trigger (5 seconds from now)
+2. Create action with unique marker output
+3. Create rule linking timer → action
+4. Wait 7 seconds
+5. Verify exactly 1 execution occurred
+6. Wait additional 10 seconds
+7. Verify no additional executions
+
+Success Criteria:
+- Timer fires once at scheduled time (±1 second)
+- Exactly 1 enforcement created
+- Exactly 1 execution created
+- No duplicate executions after timer expires
+- Timer marked as expired/completed
+"""
+
+import time
+from datetime import datetime, timedelta
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_date_timer,
+    create_echo_action,
+    create_rule,
+    timestamp_future,
+    wait_for_event_count,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.timer
+@pytest.mark.integration
+@pytest.mark.timeout(30)
+class TestDateTimerAutomation:
+    """Test date timer (one-shot) automation flow"""
+
+    def test_date_timer_fires_once(self, client: AttuneClient, pack_ref: str):
+        """Test that date timer fires exactly once at scheduled time"""
+
+        fire_in_seconds = 5
+        buffer_time = 3
+
+        print(f"\n=== T1.2: Date Timer One-Shot Execution ===")
+        print(f"Scheduled to fire in: {fire_in_seconds}s")
+
+        # Step 1: Create date timer trigger
+        print("\n[1/5] Creating date timer trigger...")
+        fire_at = timestamp_future(fire_in_seconds)
+        trigger = create_date_timer(
+            client=client,
+            fire_at=fire_at,
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Created trigger: {trigger['label']} (ID: {trigger['id']})")
+        print(f"  Scheduled for: {fire_at}")
+        assert trigger["ref"] == "core.datetimetimer"
+        assert "sensor" in trigger
+        assert trigger["sensor"]["enabled"] is True
+        assert trigger["fire_at"] == fire_at
+
+        # Step 2: Create echo action with unique marker
+        print("\n[2/5] Creating echo action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        unique_message = f"Date timer fired at {fire_at}"
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 3: Create rule linking trigger → action
+        print("\n[3/5] Creating rule...")
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            enabled=True,
+            action_parameters={"message": unique_message},
+        )
+        print(f"✓ Created rule: {rule['label']} (ID: {rule['id']})")
+
+        # Step 4: Wait for timer to fire
+        print(
+            f"\n[4/5] Waiting for timer to fire (timeout: {fire_in_seconds + buffer_time}s)..."
+        )
+        print(f"  Current time: {datetime.utcnow().isoformat()}Z")
+        print(f"  Fire time:    {fire_at}")
+
+        start_time = time.time()
+
+        # Wait for exactly 1 event
+        events = wait_for_event_count(
+            client=client,
+            expected_count=1,
+            trigger_id=trigger["id"],
+            timeout=fire_in_seconds + buffer_time,
+            poll_interval=0.5,
+            operator=">=",
+        )
+
+        fire_time = time.time()
+        actual_delay = fire_time - start_time
+
+        print(f"✓ Timer fired after {actual_delay:.2f}s")
+        print(f"  Expected: ~{fire_in_seconds}s")
+        print(f"  Difference: {abs(actual_delay - fire_in_seconds):.2f}s")
+
+        # Verify timing precision (±2 seconds tolerance)
+        assert abs(actual_delay - fire_in_seconds) < 2.0, (
+            f"Timer fired at {actual_delay:.1f}s, expected ~{fire_in_seconds}s (±2s)"
+        )
+
+        # Verify event
+        assert len(events) >= 1, "Expected at least 1 event"
+        event = events[0]
+        print(f"\n  Event details:")
+        print(f"    ID: {event['id']}")
+        print(f"    Trigger ID: {event['trigger']}")
+        print(f"    Created: {event['created']}")
+        assert event["trigger"] == trigger["id"]
+
+        # Step 5: Verify execution completed
+        print(f"\n[5/5] Verifying execution completed...")
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=action_ref,
+            timeout=15,
+            poll_interval=0.5,
+            operator=">=",
+        )
+
+        assert len(executions) >= 1, "Expected at least 1 execution"
+        execution = executions[0]
+
+        print(f"✓ Execution created (ID: {execution['id']})")
+        print(f"  Status: {execution['status']}")
+
+        # Wait for execution to complete if needed
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=10,
+            )
+
+        assert execution["status"] == "succeeded", (
+            f"Execution failed with status: {execution['status']}"
+        )
+        print(f"✓ Execution succeeded")
+
+        # Step 6: Wait additional time to ensure no duplicate fires
+        print(f"\nWaiting additional 10s to verify no duplicate fires...")
+        time.sleep(10)
+
+        # Check event count again
+        final_events = client.list_events(trigger_id=trigger["id"])
+        print(f"✓ Final event count: {len(final_events)}")
+
+        # Should still be exactly 1 event
+        assert len(final_events) == 1, (
+            f"Expected exactly 1 event, found {len(final_events)} (duplicate fire detected)"
+        )
+
+        # Check execution count again
+        final_executions = client.list_executions(action_ref=action_ref)
+        print(f"✓ Final execution count: {len(final_executions)}")
+
+        assert len(final_executions) == 1, (
+            f"Expected exactly 1 execution, found {len(final_executions)}"
+        )
+
+        # Final summary
+        total_time = time.time() - start_time
+        print("\n=== Test Summary ===")
+        print(f"✓ Date timer fired once at scheduled time")
+        print(
+            f"✓ Timing precision: {abs(actual_delay - fire_in_seconds):.2f}s deviation"
+        )
+        print(f"✓ Exactly 1 event created")
+        print(f"✓ Exactly 1 execution completed")
+        print(f"✓ No duplicate fires detected")
+        print(f"✓ Total test duration: {total_time:.1f}s")
+        print(f"✓ Test PASSED")
+
+    def test_date_timer_past_date(self, client: AttuneClient, pack_ref: str):
+        """Test that date timer with past date fires immediately or fails gracefully"""
+
+        print(f"\n=== T1.2b: Date Timer with Past Date ===")
+
+        # Step 1: Create date timer with past date (1 hour ago)
+        print("\n[1/4] Creating date timer with past date...")
+        past_date = timestamp_future(-3600)  # 1 hour ago
+        print(f"  Date: {past_date} (past)")
+
+        trigger = create_date_timer(
+            client=client,
+            fire_at=past_date,
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Trigger created: {trigger['label']} (ID: {trigger['id']})")
+
+        # Step 2: Create action and rule
+        print("\n[2/4] Creating action and rule...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+            action_parameters={"message": "Past date timer"},
+        )
+        print(f"✓ Action and rule created")
+
+        # Step 3: Check if timer fires immediately
+        print("\n[3/4] Checking timer behavior...")
+        print("  Waiting up to 10s to see if timer fires immediately...")
+
+        try:
+            # Wait briefly to see if event is created
+            events = wait_for_event_count(
+                client=client,
+                expected_count=1,
+                trigger_id=trigger["id"],
+                timeout=10,
+                poll_interval=0.5,
+                operator=">=",
+            )
+
+            print(f"✓ Timer fired immediately (behavior: fire on past date)")
+            print(f"  Events created: {len(events)}")
+
+            # Verify execution completed
+            executions = wait_for_execution_count(
+                client=client,
+                expected_count=1,
+                action_ref=action["ref"],
+                timeout=10,
+            )
+
+            execution = executions[0]
+            if execution["status"] not in ["succeeded", "failed", "canceled"]:
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=execution["id"],
+                    expected_status="succeeded",
+                    timeout=10,
+                )
+
+            assert execution["status"] == "succeeded"
+            print(f"✓ Execution completed successfully")
+
+        except TimeoutError:
+            # Timer may not fire for past dates - this is also acceptable behavior
+            print(f"✓ Timer did not fire (behavior: skip past date)")
+            print(f"  This is acceptable behavior - past dates are ignored")
+
+        # Step 4: Verify no ongoing fires
+        print("\n[4/4] Verifying timer is one-shot...")
+        time.sleep(5)
+
+        final_events = client.list_events(trigger_id=trigger["id"])
+        print(f"✓ Final event count: {len(final_events)}")
+
+        # Should be 0 or 1, never more than 1
+        assert len(final_events) <= 1, (
+            f"Expected 0 or 1 event, found {len(final_events)} (timer firing repeatedly)"
+        )
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Past date timer handled gracefully")
+        print(f"✓ No repeated fires detected")
+        print(f"✓ Test PASSED")
+
+    def test_date_timer_far_future(self, client: AttuneClient, pack_ref: str):
+        """Test creating date timer far in the future (doesn't fire during test)"""
+
+        print(f"\n=== T1.2c: Date Timer Far Future ===")
+
+        # Create timer for 1 hour from now
+        future_time = timestamp_future(3600)
+
+        print(f"\n[1/3] Creating date timer for far future...")
+        print(f"  Time: {future_time} (+1 hour)")
+
+        trigger = create_date_timer(
+            client=client,
+            fire_at=future_time,
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Trigger created: {trigger['label']} (ID: {trigger['id']})")
+
+        # Create action and rule
+        print("\n[2/3] Creating action and rule...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Setup complete")
+
+        # Verify timer doesn't fire prematurely
+        print("\n[3/3] Verifying timer doesn't fire prematurely...")
+        time.sleep(3)
+
+        events = client.list_events(trigger_id=trigger["id"])
+        executions = client.list_executions(action_ref=action["ref"])
+
+        print(f"  Events: {len(events)}")
+        print(f"  Executions: {len(executions)}")
+
+        assert len(events) == 0, "Timer fired prematurely"
+        assert len(executions) == 0, "Execution created prematurely"
+
+        print("\n✓ Timer correctly waiting for future time")
+        print("✓ Test PASSED")

tests/e2e/tier1/test_t1_03_cron_timer.py

@@ -0,0 +1,410 @@
+#!/usr/bin/env python3
+"""
+T1.3: Cron Timer Execution
+
+Tests that an action executes on a cron schedule.
+
+Test Flow:
+1. Create cron timer trigger (at 0, 3, 6, 12 seconds of each minute)
+2. Create action with timestamp output
+3. Create rule linking timer → action
+4. Wait for one minute + 15 seconds
+5. Verify executions at correct second marks
+
+Success Criteria:
+- Executions occur at seconds: 0, 3, 6, 12 (first minute)
+- Executions occur at seconds: 0, 3, 6, 12 (second minute if test runs long)
+- No executions at other second marks
+- Cron expression correctly parsed
+- Timezone handling correct
+"""
+
+import time
+from datetime import datetime
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_cron_timer,
+    create_echo_action,
+    create_rule,
+    wait_for_event_count,
+    wait_for_execution_count,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.timer
+@pytest.mark.integration
+@pytest.mark.timeout(90)
+class TestCronTimerAutomation:
+    """Test cron timer automation flow"""
+
+    def test_cron_timer_specific_seconds(self, client: AttuneClient, pack_ref: str):
+        """Test cron timer fires at specific seconds in the minute"""
+
+        # Cron: Fire at 0, 15, 30, 45 seconds of every minute
+        # We'll wait up to 75 seconds to catch at least 2 fires
+        cron_expression = "0,15,30,45 * * * * *"
+        expected_fires = 2
+        max_wait_seconds = 75
+
+        print(f"\n=== T1.3: Cron Timer Execution ===")
+        print(f"Cron expression: {cron_expression}")
+        print(f"Expected fires: {expected_fires}+ in {max_wait_seconds}s")
+
+        # Step 1: Create cron timer trigger
+        print("\n[1/5] Creating cron timer trigger...")
+        trigger = create_cron_timer(
+            client=client,
+            cron_expression=cron_expression,
+            pack_ref=pack_ref,
+            timezone="UTC",
+        )
+        print(f"✓ Created trigger: {trigger['label']} (ID: {trigger['id']})")
+        print(f"  Expression: {cron_expression}")
+        print(f"  Timezone: UTC")
+        assert trigger["ref"] == "core.crontimer"
+        assert "sensor" in trigger
+        assert trigger["sensor"]["enabled"] is True
+        assert trigger["cron_expression"] == cron_expression
+
+        # Step 2: Create echo action with timestamp
+        print("\n[2/5] Creating echo action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 3: Create rule
+        print("\n[3/5] Creating rule...")
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            enabled=True,
+            action_parameters={"message": "Cron timer fired"},
+        )
+        print(f"✓ Created rule: {rule['label']} (ID: {rule['id']})")
+
+        # Step 4: Wait for events
+        print(
+            f"\n[4/5] Waiting for {expected_fires} cron events (max {max_wait_seconds}s)..."
+        )
+        current_time = datetime.utcnow()
+        print(f"  Start time: {current_time.isoformat()}Z")
+        print(f"  Current second: {current_time.second}")
+
+        # Calculate how long until next fire
+        current_second = current_time.second
+        next_fires = [0, 15, 30, 45]
+        next_fire_second = None
+        for fire_second in next_fires:
+            if fire_second > current_second:
+                next_fire_second = fire_second
+                break
+        if next_fire_second is None:
+            next_fire_second = next_fires[0]  # Next minute
+
+        wait_seconds = (next_fire_second - current_second) % 60
+        print(
+            f"  Next expected fire in ~{wait_seconds} seconds (at second {next_fire_second})"
+        )
+
+        start_time = time.time()
+
+        events = wait_for_event_count(
+            client=client,
+            expected_count=expected_fires,
+            trigger_id=trigger["id"],
+            timeout=max_wait_seconds,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start_time
+        print(f"✓ {len(events)} events created in {elapsed:.1f}s")
+
+        # Verify event timing
+        print(f"\n  Event timing analysis:")
+        for i, event in enumerate(events[:expected_fires]):
+            event_time = datetime.fromisoformat(event["created"].replace("Z", "+00:00"))
+            second = event_time.second
+            print(f"    Event {i + 1}: {event_time.isoformat()} (second: {second:02d})")
+
+            # Verify event fired at one of the expected seconds (with ±2 second tolerance)
+            expected_seconds = [0, 15, 30, 45]
+            matched = False
+            for expected_second in expected_seconds:
+                if (
+                    abs(second - expected_second) <= 2
+                    or abs(second - expected_second) >= 58
+                ):
+                    matched = True
+                    break
+
+            assert matched, (
+                f"Event fired at second {second}, not within ±2s of expected seconds {expected_seconds}"
+            )
+
+        # Step 5: Verify executions completed
+        print(f"\n[5/5] Verifying {expected_fires} executions completed...")
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=expected_fires,
+            action_ref=action_ref,
+            timeout=30,
+            poll_interval=1.0,
+        )
+
+        print(f"✓ {len(executions)} executions created")
+
+        # Verify each execution succeeded
+        succeeded_count = 0
+        for i, execution in enumerate(executions[:expected_fires]):
+            exec_id = execution["id"]
+            status = execution["status"]
+
+            print(f"\n  Execution {i + 1} (ID: {exec_id}):")
+            print(f"    Status: {status}")
+
+            # Most should be succeeded by now, but wait if needed
+            if status not in ["succeeded", "failed", "canceled"]:
+                print(f"    Waiting for completion...")
+                from helpers import wait_for_execution_status
+
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=exec_id,
+                    expected_status="succeeded",
+                    timeout=15,
+                )
+                status = execution["status"]
+                print(f"    Final status: {status}")
+
+            assert status == "succeeded", (
+                f"Execution {exec_id} failed with status '{status}'"
+            )
+            succeeded_count += 1
+
+        print(f"\n✓ All {succeeded_count} executions succeeded")
+
+        # Final summary
+        total_time = time.time() - start_time
+        print("\n=== Test Summary ===")
+        print(f"✓ Cron expression: {cron_expression}")
+        print(f"✓ {len(events)} events at correct times")
+        print(f"✓ {succeeded_count} executions completed successfully")
+        print(f"✓ Total test duration: {total_time:.1f}s")
+        print(f"✓ Test PASSED")
+
+    def test_cron_timer_every_5_seconds(self, client: AttuneClient, pack_ref: str):
+        """Test cron timer with */5 expression (every 5 seconds)"""
+
+        cron_expression = "*/5 * * * * *"  # Every 5 seconds
+        expected_fires = 3
+        max_wait = 20  # Should get 3 fires in 15 seconds
+
+        print(f"\n=== T1.3b: Cron Timer Every 5 Seconds ===")
+        print(f"Expression: {cron_expression}")
+
+        # Create automation
+        trigger = create_cron_timer(
+            client=client, cron_expression=cron_expression, pack_ref=pack_ref
+        )
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        print(f"✓ Setup complete: trigger={trigger['id']}")
+
+        # Wait for events
+        print(f"\nWaiting for {expected_fires} events...")
+        start = time.time()
+
+        events = wait_for_event_count(
+            client=client,
+            expected_count=expected_fires,
+            trigger_id=trigger["id"],
+            timeout=max_wait,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start
+        print(f"✓ {len(events)} events in {elapsed:.1f}s")
+
+        # Check timing - should be roughly 0s, 5s, 10s
+        event_times = [
+            datetime.fromisoformat(e["created"].replace("Z", "+00:00"))
+            for e in events[:expected_fires]
+        ]
+
+        print(f"\nEvent timing:")
+        intervals = []
+        for i in range(len(event_times)):
+            if i == 0:
+                print(f"  Event {i + 1}: {event_times[i].isoformat()}")
+            else:
+                interval = (event_times[i] - event_times[i - 1]).total_seconds()
+                intervals.append(interval)
+                print(
+                    f"  Event {i + 1}: {event_times[i].isoformat()} (+{interval:.1f}s)"
+                )
+
+        # Verify intervals are approximately 5 seconds
+        if intervals:
+            avg_interval = sum(intervals) / len(intervals)
+            print(f"\nAverage interval: {avg_interval:.1f}s (expected: 5s)")
+            assert abs(avg_interval - 5.0) < 2.0, (
+                f"Average interval {avg_interval:.1f}s not close to 5s"
+            )
+
+        # Verify executions
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=expected_fires,
+            action_ref=action["ref"],
+            timeout=20,
+        )
+
+        succeeded = sum(
+            1 for e in executions[:expected_fires] if e["status"] == "succeeded"
+        )
+        print(f"✓ {succeeded}/{expected_fires} executions succeeded")
+
+        assert succeeded >= expected_fires
+        print(f"✓ Test PASSED")
+
+    def test_cron_timer_top_of_minute(self, client: AttuneClient, pack_ref: str):
+        """Test cron timer that fires at top of each minute"""
+
+        cron_expression = "0 * * * * *"  # Every minute at second 0
+
+        print(f"\n=== T1.3c: Cron Timer Top of Minute ===")
+        print(f"Expression: {cron_expression}")
+        print("Note: This test may take up to 70 seconds")
+
+        # Create automation
+        trigger = create_cron_timer(
+            client=client, cron_expression=cron_expression, pack_ref=pack_ref
+        )
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        print(f"✓ Setup complete")
+
+        # Calculate wait time until next minute
+        now = datetime.utcnow()
+        current_second = now.second
+        wait_until_next = 60 - current_second + 2  # +2 for processing time
+
+        print(f"\n  Current time: {now.isoformat()}Z")
+        print(f"  Current second: {current_second}")
+        print(f"  Waiting ~{wait_until_next}s for top of next minute...")
+
+        # Wait for at least 1 event (possibly 2 if test spans multiple minutes)
+        start = time.time()
+        events = wait_for_event_count(
+            client=client,
+            expected_count=1,
+            trigger_id=trigger["id"],
+            timeout=wait_until_next + 5,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start
+        print(f"✓ {len(events)} event(s) created in {elapsed:.1f}s")
+
+        # Verify event occurred at second 0 (±2s tolerance)
+        event = events[0]
+        event_time = datetime.fromisoformat(event["created"].replace("Z", "+00:00"))
+        event_second = event_time.second
+
+        print(f"\n  Event time: {event_time.isoformat()}")
+        print(f"  Event second: {event_second}")
+
+        # Allow ±3 second tolerance (sensor polling + processing)
+        assert event_second <= 3 or event_second >= 57, (
+            f"Event fired at second {event_second}, expected at/near second 0"
+        )
+
+        # Verify execution
+        executions = wait_for_execution_count(
+            client=client, expected_count=1, action_ref=action["ref"], timeout=15
+        )
+
+        assert len(executions) >= 1
+        print(f"✓ Execution completed")
+        print(f"✓ Test PASSED")
+
+    def test_cron_timer_complex_expression(self, client: AttuneClient, pack_ref: str):
+        """Test complex cron expression (multiple fields)"""
+
+        # Every 10 seconds between seconds 0-30
+        # This will fire at: 0, 10, 20, 30 seconds
+        cron_expression = "0,10,20,30 * * * * *"
+
+        print(f"\n=== T1.3d: Complex Cron Expression ===")
+        print(f"Expression: {cron_expression}")
+        print("Expected: Fire at 0, 10, 20, 30 seconds of each minute")
+
+        # Create automation
+        trigger = create_cron_timer(
+            client=client, cron_expression=cron_expression, pack_ref=pack_ref
+        )
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        print(f"✓ Setup complete")
+
+        # Wait for at least 2 fires
+        print(f"\nWaiting for 2 events (max 45s)...")
+        start = time.time()
+
+        events = wait_for_event_count(
+            client=client,
+            expected_count=2,
+            trigger_id=trigger["id"],
+            timeout=45,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start
+        print(f"✓ {len(events)} events in {elapsed:.1f}s")
+
+        # Check that events occurred at valid seconds
+        valid_seconds = [0, 10, 20, 30]
+        print(f"\nEvent seconds:")
+        for i, event in enumerate(events[:2]):
+            event_time = datetime.fromisoformat(event["created"].replace("Z", "+00:00"))
+            second = event_time.second
+            print(f"  Event {i + 1}: second {second:02d}")
+
+            # Check within ±2 seconds of valid times
+            matched = any(abs(second - vs) <= 2 for vs in valid_seconds)
+            assert matched, (
+                f"Event at second {second} not near valid seconds {valid_seconds}"
+            )
+
+        # Verify executions
+        executions = wait_for_execution_count(
+            client=client, expected_count=2, action_ref=action["ref"], timeout=20
+        )
+
+        assert len(executions) >= 2
+        print(f"✓ {len(executions)} executions completed")
+        print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_04_webhook_trigger.py

@@ -0,0 +1,423 @@
+#!/usr/bin/env python3
+"""
+T1.4: Webhook Trigger with Payload
+
+Tests that a webhook POST triggers an action with payload data.
+
+Test Flow:
+1. Create webhook trigger (generates unique URL)
+2. Create action that echoes webhook payload
+3. Create rule linking webhook → action
+4. POST JSON payload to webhook URL
+5. Verify event created with correct payload
+6. Verify execution receives payload as parameters
+7. Verify action output includes webhook data
+
+Success Criteria:
+- Webhook trigger generates unique URL (/api/v1/webhooks/{trigger_id})
+- POST to webhook creates event immediately
+- Event payload matches POST body
+- Rule evaluates and creates enforcement
+- Execution receives webhook data as input
+- Action can access webhook payload fields
+"""
+
+import time
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_echo_action,
+    create_rule,
+    create_webhook_trigger,
+    wait_for_event_count,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.webhook
+@pytest.mark.integration
+@pytest.mark.timeout(30)
+class TestWebhookTrigger:
+    """Test webhook trigger automation flow"""
+
+    def test_webhook_trigger_with_payload(self, client: AttuneClient, pack_ref: str):
+        """Test that webhook POST triggers action with payload"""
+
+        print(f"\n=== T1.4: Webhook Trigger with Payload ===")
+
+        # Step 1: Create webhook trigger
+        print("\n[1/6] Creating webhook trigger...")
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        print(f"✓ Created trigger: {trigger['label']} (ID: {trigger['id']})")
+        print(f"  Ref: {trigger['ref']}")
+        print(f"  Webhook URL: /api/v1/webhooks/{trigger['id']}")
+        assert "webhook" in trigger["ref"].lower() or trigger.get(
+            "webhook_enabled", False
+        )
+
+        # Step 2: Create echo action
+        print("\n[2/6] Creating echo action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 3: Create rule linking webhook → action
+        print("\n[3/6] Creating rule...")
+
+        # Capture timestamp before rule creation for filtering
+        from datetime import datetime, timezone
+
+        rule_creation_time = datetime.now(timezone.utc).isoformat()
+
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            enabled=True,
+            action_parameters={
+                "message": "{{ trigger.data.message }}",
+                "count": 1,
+            },
+        )
+        print(f"✓ Created rule: {rule['label']} (ID: {rule['id']})")
+        print(f"  Rule creation timestamp: {rule_creation_time}")
+        assert rule["enabled"] is True
+
+        # Step 4: POST to webhook
+        print("\n[4/6] Firing webhook with payload...")
+        webhook_payload = {
+            "event_type": "test.webhook",
+            "message": "Hello from webhook!",
+            "user_id": 12345,
+            "metadata": {"source": "e2e_test", "timestamp": time.time()},
+        }
+        print(f"  Payload: {webhook_payload}")
+
+        event_response = client.fire_webhook(
+            trigger_id=trigger["id"], payload=webhook_payload
+        )
+        print(f"✓ Webhook fired")
+        print(f"  Event ID: {event_response.get('id')}")
+
+        # Step 5: Verify event created
+        print("\n[5/6] Verifying event created...")
+        events = wait_for_event_count(
+            client=client,
+            expected_count=1,
+            trigger_id=trigger["id"],
+            timeout=10,
+            poll_interval=0.5,
+        )
+
+        assert len(events) >= 1, "Expected at least 1 event"
+        event = events[0]
+
+        print(f"✓ Event created (ID: {event['id']})")
+        print(f"  Trigger ID: {event['trigger']}")
+        print(f"  Payload: {event.get('payload')}")
+
+        # Verify event payload matches webhook payload
+        assert event["trigger"] == trigger["id"]
+        event_payload = event.get("payload", {})
+
+        # Check key fields from webhook payload
+        for key in ["event_type", "message", "user_id"]:
+            assert key in event_payload, f"Missing key '{key}' in event payload"
+            assert event_payload[key] == webhook_payload[key], (
+                f"Event payload mismatch for '{key}': "
+                f"expected {webhook_payload[key]}, got {event_payload[key]}"
+            )
+
+        print(f"✓ Event payload matches webhook payload")
+
+        # Step 6: Verify execution completed with webhook data
+        print("\n[6/6] Verifying execution with webhook data...")
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            rule_id=rule["id"],
+            created_after=rule_creation_time,
+            timeout=20,
+            poll_interval=0.5,
+            verbose=True,
+        )
+
+        assert len(executions) >= 1, "Expected at least 1 execution"
+        execution = executions[0]
+
+        print(f"✓ Execution created (ID: {execution['id']})")
+        print(f"  Status: {execution['status']}")
+
+        # Wait for execution to complete
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=15,
+            )
+
+        assert execution["status"] == "succeeded", (
+            f"Execution failed with status: {execution['status']}"
+        )
+
+        # Verify execution received webhook data
+        print(f"\n  Execution details:")
+        print(f"    Action: {execution['action_ref']}")
+        print(f"    Parameters: {execution.get('parameters')}")
+        print(f"    Result: {execution.get('result')}")
+
+        # Final summary
+        print("\n=== Test Summary ===")
+        print(f"✓ Webhook trigger created")
+        print(f"✓ Webhook POST created event")
+        print(f"✓ Event payload correct")
+        print(f"✓ Execution completed successfully")
+        print(f"✓ Webhook data accessible in action")
+        print(f"✓ Test PASSED")
+
+    def test_multiple_webhook_posts(self, client: AttuneClient, pack_ref: str):
+        """Test multiple webhook POSTs create multiple executions"""
+
+        print(f"\n=== T1.4b: Multiple Webhook POSTs ===")
+
+        num_posts = 3
+
+        # Create automation
+        print("\n[1/4] Setting up webhook automation...")
+        from datetime import datetime, timezone
+
+        test_start = datetime.now(timezone.utc).isoformat()
+
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Setup complete")
+
+        # Fire webhook multiple times
+        print(f"\n[2/4] Firing webhook {num_posts} times...")
+        for i in range(num_posts):
+            payload = {
+                "iteration": i + 1,
+                "message": f"Webhook post #{i + 1}",
+                "timestamp": time.time(),
+            }
+            client.fire_webhook(trigger_id=trigger["id"], payload=payload)
+            print(f"  ✓ POST {i + 1}/{num_posts}")
+            time.sleep(0.5)  # Small delay between posts
+
+        # Verify events created
+        print(f"\n[3/4] Verifying {num_posts} events created...")
+        events = wait_for_event_count(
+            client=client,
+            expected_count=num_posts,
+            trigger_id=trigger["id"],
+            timeout=15,
+            poll_interval=0.5,
+        )
+
+        print(f"✓ {len(events)} events created")
+        assert len(events) >= num_posts
+
+        # Verify executions created
+        print(f"\n[4/4] Verifying {num_posts} executions completed...")
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=num_posts,
+            rule_id=rule["id"],
+            created_after=test_start,
+            timeout=20,
+            poll_interval=0.5,
+            verbose=True,
+        )
+
+        print(f"✓ {len(executions)} executions created")
+
+        # Wait for all to complete
+        succeeded = 0
+        for execution in executions[:num_posts]:
+            if execution["status"] not in ["succeeded", "failed", "canceled"]:
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=execution["id"],
+                    expected_status="succeeded",
+                    timeout=10,
+                )
+            if execution["status"] == "succeeded":
+                succeeded += 1
+
+        print(f"✓ {succeeded}/{num_posts} executions succeeded")
+        assert succeeded == num_posts
+
+        print("\n=== Test Summary ===")
+        print(f"✓ {num_posts} webhook POSTs handled")
+        print(f"✓ {num_posts} events created")
+        print(f"✓ {num_posts} executions completed")
+        print(f"✓ Test PASSED")
+
+    def test_webhook_with_complex_payload(self, client: AttuneClient, pack_ref: str):
+        """Test webhook with nested JSON payload"""
+
+        print(f"\n=== T1.4c: Webhook with Complex Payload ===")
+
+        # Setup
+        print("\n[1/3] Setting up webhook automation...")
+        from datetime import datetime, timezone
+
+        test_start = datetime.now(timezone.utc).isoformat()
+
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Setup complete")
+
+        # Complex nested payload
+        print("\n[2/3] Posting complex payload...")
+        complex_payload = {
+            "event": "user.signup",
+            "user": {
+                "id": 99999,
+                "email": "test@example.com",
+                "profile": {
+                    "name": "Test User",
+                    "age": 30,
+                    "preferences": {
+                        "theme": "dark",
+                        "notifications": True,
+                    },
+                },
+                "tags": ["new", "trial", "priority"],
+            },
+            "metadata": {
+                "source": "web",
+                "ip": "192.168.1.100",
+                "user_agent": "Mozilla/5.0",
+            },
+            "timestamp": "2024-01-01T00:00:00Z",
+        }
+
+        client.fire_webhook(trigger_id=trigger["id"], payload=complex_payload)
+        print(f"✓ Complex payload posted")
+
+        # Verify event and execution
+        print("\n[3/3] Verifying event and execution...")
+        events = wait_for_event_count(
+            client=client,
+            expected_count=1,
+            trigger_id=trigger["id"],
+            timeout=10,
+        )
+
+        assert len(events) >= 1
+        event = events[0]
+        event_payload = event.get("payload", {})
+
+        # Verify nested structure preserved
+        assert "user" in event_payload
+        assert "profile" in event_payload["user"]
+        assert "preferences" in event_payload["user"]["profile"]
+        assert event_payload["user"]["profile"]["preferences"]["theme"] == "dark"
+        assert event_payload["user"]["tags"] == ["new", "trial", "priority"]
+
+        print(f"✓ Complex nested payload preserved")
+
+        # Verify execution
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            rule_id=rule["id"],
+            created_after=test_start,
+            timeout=15,
+            verbose=True,
+        )
+
+        execution = executions[0]
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=10,
+            )
+
+        assert execution["status"] == "succeeded"
+        print(f"✓ Execution completed successfully")
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Complex nested payload handled")
+        print(f"✓ JSON structure preserved")
+        print(f"✓ Execution completed")
+        print(f"✓ Test PASSED")
+
+    def test_webhook_without_payload(self, client: AttuneClient, pack_ref: str):
+        """Test webhook POST without payload (empty body)"""
+
+        print(f"\n=== T1.4d: Webhook without Payload ===")
+
+        # Setup
+        from datetime import datetime, timezone
+
+        test_start = datetime.now(timezone.utc).isoformat()
+
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        # Fire webhook with empty payload
+        print("\nFiring webhook with empty payload...")
+        client.fire_webhook(trigger_id=trigger["id"], payload={})
+
+        # Verify event created
+        events = wait_for_event_count(
+            client=client,
+            expected_count=1,
+            trigger_id=trigger["id"],
+            timeout=10,
+        )
+
+        assert len(events) >= 1
+        event = events[0]
+        print(f"✓ Event created with empty payload")
+
+        # Verify execution
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            rule_id=rule["id"],
+            created_after=test_start,
+            timeout=15,
+            verbose=True,
+        )
+
+        execution = executions[0]
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=10,
+            )
+
+        assert execution["status"] == "succeeded"
+        print(f"✓ Execution succeeded with empty payload")
+        print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_05_workflow_with_items.py

@@ -0,0 +1,365 @@
+#!/usr/bin/env python3
+"""
+T1.5: Workflow with Array Iteration (with-items)
+
+Tests that workflow actions spawn child executions for array items.
+
+Test Flow:
+1. Create workflow action with with-items on array parameter
+2. Create rule to trigger workflow
+3. Execute workflow with array: ["apple", "banana", "cherry"]
+4. Verify parent execution created
+5. Verify 3 child executions created (one per item)
+6. Verify each child receives single item as input
+7. Verify parent completes after all children succeed
+
+Success Criteria:
+- Parent execution status: 'running' while children execute
+- Exactly 3 child executions created
+- Each child execution has parent_execution_id set
+- Each child receives single item: "apple", "banana", "cherry"
+- Children can run in parallel
+- Parent status becomes 'succeeded' after all children succeed
+- Child execution count matches array length
+
+Note: This test validates the workflow orchestration concept.
+Full workflow support may be in progress.
+"""
+
+import time
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_echo_action,
+    create_rule,
+    create_webhook_trigger,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.workflow
+@pytest.mark.integration
+@pytest.mark.timeout(60)
+class TestWorkflowWithItems:
+    """Test workflow with array iteration (with-items)"""
+
+    def test_basic_with_items_concept(self, client: AttuneClient, pack_ref: str):
+        """Test basic with-items concept - multiple executions from array"""
+
+        print(f"\n=== T1.5: Workflow with Array Iteration (with-items) ===")
+        print("Note: Testing conceptual workflow behavior")
+
+        # Array to iterate over
+        test_items = ["apple", "banana", "cherry"]
+        num_items = len(test_items)
+
+        print(f"\nTest array: {test_items}")
+        print(f"Expected child executions: {num_items}")
+
+        # Step 1: Create action
+        print("\n[1/5] Creating action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 2: Create trigger
+        print("\n[2/5] Creating webhook trigger...")
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        print(f"✓ Created trigger (ID: {trigger['id']})")
+
+        # Step 3: Create multiple rules (one per item) to simulate with-items
+        # In a full workflow implementation, this would be handled by the workflow engine
+        print("\n[3/5] Creating rules for each item (simulating with-items)...")
+        rules = []
+        for i, item in enumerate(test_items):
+            rule = create_rule(
+                client=client,
+                trigger_id=trigger["id"],
+                action_ref=action_ref,
+                pack_ref=pack_ref,
+                action_parameters={"message": f"Processing item: {item}"},
+            )
+            rules.append(rule)
+            print(f"  ✓ Rule {i + 1} for '{item}' (ID: {rule['id']})")
+
+        # Step 4: Fire webhook to trigger all rules
+        print("\n[4/5] Firing webhook to trigger executions...")
+        client.fire_webhook(
+            trigger_id=trigger["id"],
+            payload={"items": test_items, "test": "with-items"},
+        )
+        print(f"✓ Webhook fired")
+
+        # Step 5: Wait for all executions
+        print(f"\n[5/5] Waiting for {num_items} executions...")
+        start_time = time.time()
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=num_items,
+            action_ref=action_ref,
+            timeout=30,
+            poll_interval=1.0,
+        )
+
+        elapsed = time.time() - start_time
+        print(f"✓ {len(executions)} executions created in {elapsed:.1f}s")
+
+        # Verify each execution
+        print(f"\nVerifying executions...")
+        succeeded_count = 0
+        for i, execution in enumerate(executions[:num_items]):
+            exec_id = execution["id"]
+            status = execution["status"]
+
+            print(f"\n  Execution {i + 1} (ID: {exec_id}):")
+            print(f"    Status: {status}")
+            print(f"    Action: {execution['action_ref']}")
+
+            # Wait for completion if needed
+            if status not in ["succeeded", "failed", "canceled"]:
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=exec_id,
+                    expected_status="succeeded",
+                    timeout=15,
+                )
+                status = execution["status"]
+                print(f"    Final status: {status}")
+
+            assert status == "succeeded", (
+                f"Execution {exec_id} failed with status '{status}'"
+            )
+            succeeded_count += 1
+
+        print(f"\n✓ All {succeeded_count}/{num_items} executions succeeded")
+
+        # Test demonstrates the concept
+        print("\n=== Test Summary ===")
+        print(f"✓ Array items: {test_items}")
+        print(f"✓ {num_items} executions created (one per item)")
+        print(f"✓ All executions completed successfully")
+        print(f"✓ Demonstrates with-items iteration concept")
+        print(f"✓ Test PASSED")
+
+        print("\n📝 Note: This test demonstrates the with-items concept.")
+        print(
+            "   Full workflow implementation will handle this automatically via workflow engine."
+        )
+
+    def test_empty_array_handling(self, client: AttuneClient, pack_ref: str):
+        """Test handling of empty array in with-items"""
+
+        print(f"\n=== T1.5b: Empty Array Handling ===")
+
+        # Create action
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+
+        # Don't create any rules (simulates empty array)
+        print("\nEmpty array - no rules created")
+
+        # Fire webhook
+        client.fire_webhook(trigger_id=trigger["id"], payload={"items": []})
+
+        # Wait briefly
+        time.sleep(2)
+
+        # Should have no executions
+        executions = client.list_executions(action_ref=action["ref"])
+        print(f"Executions created: {len(executions)}")
+
+        assert len(executions) == 0, "Empty array should create no executions"
+
+        print(f"✓ Empty array handled correctly (0 executions)")
+        print(f"✓ Test PASSED")
+
+    def test_single_item_array(self, client: AttuneClient, pack_ref: str):
+        """Test with-items with single item array"""
+
+        print(f"\n=== T1.5c: Single Item Array ===")
+
+        test_items = ["only_item"]
+
+        # Create automation
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+            action_parameters={"message": f"Processing: {test_items[0]}"},
+        )
+
+        print(f"✓ Setup complete")
+
+        # Execute
+        client.fire_webhook(trigger_id=trigger["id"], payload={"items": test_items})
+
+        # Should create exactly 1 execution
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=action["ref"],
+            timeout=20,
+        )
+
+        assert len(executions) >= 1
+        execution = executions[0]
+
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=15,
+            )
+
+        assert execution["status"] == "succeeded"
+
+        print(f"✓ Single item processed correctly")
+        print(f"✓ Exactly 1 execution created and succeeded")
+        print(f"✓ Test PASSED")
+
+    def test_large_array_conceptual(self, client: AttuneClient, pack_ref: str):
+        """Test with-items concept with larger array (10 items)"""
+
+        print(f"\n=== T1.5d: Larger Array (10 items) ===")
+
+        num_items = 10
+        test_items = [f"item_{i}" for i in range(num_items)]
+
+        print(f"Testing {num_items} items: {test_items[:3]} ... {test_items[-1]}")
+
+        # Create action
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+
+        # Create rules for each item
+        print(f"\nCreating {num_items} rules...")
+        for i, item in enumerate(test_items):
+            create_rule(
+                client=client,
+                trigger_id=trigger["id"],
+                action_ref=action["ref"],
+                pack_ref=pack_ref,
+                action_parameters={"message": item},
+            )
+            if (i + 1) % 3 == 0 or i == num_items - 1:
+                print(f"  ✓ {i + 1}/{num_items} rules created")
+
+        # Fire webhook
+        print(f"\nTriggering execution...")
+        client.fire_webhook(trigger_id=trigger["id"], payload={"items": test_items})
+
+        # Wait for all executions
+        start = time.time()
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=num_items,
+            action_ref=action["ref"],
+            timeout=45,
+            poll_interval=1.0,
+        )
+        elapsed = time.time() - start
+
+        print(f"✓ {len(executions)} executions created in {elapsed:.1f}s")
+
+        # Check statuses
+        print(f"\nChecking execution statuses...")
+        succeeded = 0
+        for execution in executions[:num_items]:
+            if execution["status"] == "succeeded":
+                succeeded += 1
+            elif execution["status"] not in ["succeeded", "failed", "canceled"]:
+                # Still running, wait briefly
+                try:
+                    final = wait_for_execution_status(
+                        client=client,
+                        execution_id=execution["id"],
+                        expected_status="succeeded",
+                        timeout=10,
+                    )
+                    if final["status"] == "succeeded":
+                        succeeded += 1
+                except:
+                    pass
+
+        print(f"✓ {succeeded}/{num_items} executions succeeded")
+
+        # Should have most/all succeed
+        assert succeeded >= num_items * 0.8, (
+            f"Too many failures: {succeeded}/{num_items}"
+        )
+
+        print(f"\n=== Test Summary ===")
+        print(f"✓ {num_items} items processed")
+        print(f"✓ {succeeded}/{num_items} executions succeeded")
+        print(f"✓ Parallel execution demonstrated")
+        print(f"✓ Test PASSED")
+
+    def test_different_data_types_in_array(self, client: AttuneClient, pack_ref: str):
+        """Test with-items with different data types"""
+
+        print(f"\n=== T1.5e: Different Data Types ===")
+
+        # Array with different types (as strings for this test)
+        test_items = ["string_item", "123", "true", '{"key": "value"}']
+
+        print(f"Items: {test_items}")
+
+        # Create automation
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+
+        # Create rules
+        for item in test_items:
+            create_rule(
+                client=client,
+                trigger_id=trigger["id"],
+                action_ref=action["ref"],
+                pack_ref=pack_ref,
+                action_parameters={"message": str(item)},
+            )
+
+        # Execute
+        client.fire_webhook(trigger_id=trigger["id"], payload={"items": test_items})
+
+        # Wait for executions
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=len(test_items),
+            action_ref=action["ref"],
+            timeout=25,
+        )
+
+        print(f"✓ {len(executions)} executions created")
+
+        # Verify all succeed
+        succeeded = 0
+        for execution in executions[: len(test_items)]:
+            if execution["status"] == "succeeded":
+                succeeded += 1
+            elif execution["status"] not in ["succeeded", "failed", "canceled"]:
+                try:
+                    final = wait_for_execution_status(
+                        client=client,
+                        execution_id=execution["id"],
+                        expected_status="succeeded",
+                        timeout=10,
+                    )
+                    if final["status"] == "succeeded":
+                        succeeded += 1
+                except:
+                    pass
+
+        print(f"✓ {succeeded}/{len(test_items)} executions succeeded")
+
+        assert succeeded == len(test_items)
+
+        print(f"\n✓ All data types handled correctly")
+        print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_06_datastore.py

@@ -0,0 +1,419 @@
+#!/usr/bin/env python3
+"""
+T1.6: Action Reads from Key-Value Store
+
+Tests that actions can read configuration values from the datastore.
+
+Test Flow:
+1. Create key-value pair via API: {"key": "api_url", "value": "https://api.example.com"}
+2. Create action that reads from datastore
+3. Execute action with datastore key parameter
+4. Verify action retrieves correct value
+5. Verify action output includes retrieved value
+
+Success Criteria:
+- Action can read from attune.datastore_item table
+- Scoped to tenant/user (multi-tenancy)
+- Non-existent keys return null (no error)
+- Action receives value in expected format
+- Encrypted values decrypted before passing to action
+"""
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_echo_action,
+    create_rule,
+    create_webhook_trigger,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.datastore
+@pytest.mark.integration
+@pytest.mark.timeout(30)
+class TestDatastoreAccess:
+    """Test key-value store access from actions"""
+
+    def test_datastore_read_basic(self, client: AttuneClient, pack_ref: str):
+        """Test reading value from datastore"""
+
+        print(f"\n=== T1.6: Datastore Read Access ===")
+
+        # Step 1: Create key-value pair in datastore
+        print("\n[1/6] Creating datastore key-value pair...")
+        test_key = "test.api_url"
+        test_value = "https://api.example.com/v1"
+
+        datastore_item = client.datastore_set(
+            key=test_key,
+            value=test_value,
+            encrypted=False,
+        )
+        print(f"✓ Created datastore item:")
+        print(f"  Key: {test_key}")
+        print(f"  Value: {test_value}")
+
+        # Step 2: Verify we can read it back via API
+        print("\n[2/6] Verifying datastore read via API...")
+        retrieved_value = client.datastore_get(test_key)
+        print(f"✓ Retrieved value: {retrieved_value}")
+        assert retrieved_value == test_value, (
+            f"Value mismatch: expected '{test_value}', got '{retrieved_value}'"
+        )
+
+        # Step 3: Create action (echo action can demonstrate datastore access)
+        print("\n[3/6] Creating action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+
+        # Step 4: Create trigger and rule
+        print("\n[4/6] Creating trigger and rule...")
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            action_parameters={
+                "message": f"Datastore value: {test_value}",
+            },
+        )
+        print(f"✓ Created rule: {rule['name']}")
+
+        # Step 5: Execute action
+        print("\n[5/6] Executing action...")
+        client.fire_webhook(
+            trigger_id=trigger["id"],
+            payload={"datastore_key": test_key},
+        )
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=action_ref,
+            timeout=20,
+            poll_interval=0.5,
+        )
+
+        assert len(executions) >= 1
+        execution = executions[0]
+        print(f"✓ Execution created (ID: {execution['id']})")
+
+        # Wait for completion
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=15,
+            )
+
+        # Step 6: Verify execution succeeded
+        print("\n[6/6] Verifying execution result...")
+        assert execution["status"] == "succeeded", (
+            f"Execution failed with status: {execution['status']}"
+        )
+
+        print(f"✓ Execution succeeded")
+        if execution.get("result"):
+            print(f"  Result: {execution['result']}")
+
+        # Final summary
+        print("\n=== Test Summary ===")
+        print(f"✓ Datastore key created: {test_key}")
+        print(f"✓ Value stored: {test_value}")
+        print(f"✓ Value retrieved via API")
+        print(f"✓ Action executed successfully")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_read_nonexistent_key(self, client: AttuneClient, pack_ref: str):
+        """Test reading non-existent key returns None"""
+
+        print(f"\n=== T1.6b: Nonexistent Key ===")
+
+        # Try to read key that doesn't exist
+        print("\nAttempting to read non-existent key...")
+        nonexistent_key = "test.nonexistent.key.12345"
+
+        value = client.datastore_get(nonexistent_key)
+        print(f"✓ Retrieved value: {value}")
+
+        assert value is None, f"Expected None for non-existent key, got {value}"
+
+        print(f"✓ Non-existent key returns None (no error)")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_write_and_read(self, client: AttuneClient, pack_ref: str):
+        """Test writing and reading multiple values"""
+
+        print(f"\n=== T1.6c: Write and Read Multiple Values ===")
+
+        test_data = {
+            "test.config.timeout": 30,
+            "test.config.max_retries": 3,
+            "test.config.api_endpoint": "https://api.test.com",
+            "test.config.enabled": True,
+        }
+
+        print("\n[1/3] Writing multiple key-value pairs...")
+        for key, value in test_data.items():
+            client.datastore_set(key=key, value=value, encrypted=False)
+            print(f"  ✓ {key} = {value}")
+
+        print(f"✓ {len(test_data)} items written")
+
+        print("\n[2/3] Reading back values...")
+        for key, expected_value in test_data.items():
+            actual_value = client.datastore_get(key)
+            print(f"  {key} = {actual_value}")
+            assert actual_value == expected_value, (
+                f"Value mismatch for {key}: expected {expected_value}, got {actual_value}"
+            )
+
+        print(f"✓ All {len(test_data)} values match")
+
+        print("\n[3/3] Cleaning up...")
+        for key in test_data.keys():
+            client.datastore_delete(key)
+            print(f"  ✓ Deleted {key}")
+
+        print(f"✓ Cleanup complete")
+
+        # Verify deletion
+        print("\nVerifying deletion...")
+        for key in test_data.keys():
+            value = client.datastore_get(key)
+            assert value is None, f"Key {key} still exists after deletion"
+
+        print(f"✓ All keys deleted successfully")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_encrypted_values(self, client: AttuneClient, pack_ref: str):
+        """Test storing and retrieving encrypted values"""
+
+        print(f"\n=== T1.6d: Encrypted Values ===")
+
+        # Store encrypted value
+        print("\n[1/4] Storing encrypted value...")
+        secret_key = "test.secret.api_key"
+        secret_value = "secret_api_key_12345"
+
+        client.datastore_set(
+            key=secret_key,
+            value=secret_value,
+            encrypted=True,  # Request encryption
+        )
+        print(f"✓ Encrypted value stored")
+        print(f"  Key: {secret_key}")
+        print(f"  Value: [encrypted]")
+
+        # Retrieve encrypted value (should be decrypted by API)
+        print("\n[2/4] Retrieving encrypted value...")
+        retrieved_value = client.datastore_get(secret_key)
+        print(f"✓ Value retrieved")
+
+        # Verify value matches
+        assert retrieved_value == secret_value, (
+            f"Decrypted value mismatch: expected '{secret_value}', got '{retrieved_value}'"
+        )
+        print(f"✓ Value decrypted correctly by API")
+
+        # Execute action with encrypted value
+        print("\n[3/4] Using encrypted value in action...")
+        action = create_echo_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+            action_parameters={
+                "message": "Using encrypted datastore value",
+            },
+        )
+
+        client.fire_webhook(trigger_id=trigger["id"], payload={})
+
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=action["ref"],
+            timeout=20,
+        )
+
+        execution = executions[0]
+        if execution["status"] not in ["succeeded", "failed", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="succeeded",
+                timeout=15,
+            )
+
+        assert execution["status"] == "succeeded"
+        print(f"✓ Action executed successfully with encrypted value")
+
+        # Cleanup
+        print("\n[4/4] Cleaning up...")
+        client.datastore_delete(secret_key)
+        print(f"✓ Encrypted value deleted")
+
+        # Verify deletion
+        deleted_value = client.datastore_get(secret_key)
+        assert deleted_value is None
+        print(f"✓ Deletion verified")
+
+        # Final summary
+        print("\n=== Test Summary ===")
+        print(f"✓ Encrypted value stored successfully")
+        print(f"✓ Value decrypted on retrieval")
+        print(f"✓ Action can use encrypted values")
+        print(f"✓ Cleanup successful")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_ttl(self, client: AttuneClient, pack_ref: str):
+        """Test datastore values with TTL (time-to-live)"""
+
+        print(f"\n=== T1.6e: TTL (Time-To-Live) ===")
+
+        # Store value with short TTL
+        print("\n[1/3] Storing value with TTL...")
+        ttl_key = "test.ttl.temporary"
+        ttl_value = "expires_soon"
+        ttl_seconds = 5
+
+        client.datastore_set(
+            key=ttl_key,
+            value=ttl_value,
+            encrypted=False,
+            ttl=ttl_seconds,
+        )
+        print(f"✓ Value stored with TTL={ttl_seconds}s")
+        print(f"  Key: {ttl_key}")
+        print(f"  Value: {ttl_value}")
+
+        # Immediately read it back
+        print("\n[2/3] Reading value immediately...")
+        immediate_value = client.datastore_get(ttl_key)
+        assert immediate_value == ttl_value
+        print(f"✓ Value available immediately: {immediate_value}")
+
+        # Wait for TTL to expire
+        print(f"\n[3/3] Waiting {ttl_seconds + 2}s for TTL to expire...")
+        import time
+
+        time.sleep(ttl_seconds + 2)
+
+        # Try to read again (should be expired/deleted)
+        print(f"Reading value after TTL...")
+        expired_value = client.datastore_get(ttl_key)
+        print(f"  Value after TTL: {expired_value}")
+
+        # Note: TTL implementation may vary
+        # Value might be None (deleted) or still present (lazy deletion)
+        if expired_value is None:
+            print(f"✓ Value expired and deleted (eager TTL)")
+        else:
+            print(f"⚠️  Value still present (lazy TTL or not implemented)")
+            print(f"   This is acceptable - TTL may use lazy deletion")
+
+        # Cleanup if value still exists
+        if expired_value is not None:
+            client.datastore_delete(ttl_key)
+
+        print("\n=== Test Summary ===")
+        print(f"✓ TTL value stored successfully")
+        print(f"✓ Value accessible before expiration")
+        print(f"✓ TTL behavior verified")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_update_value(self, client: AttuneClient, pack_ref: str):
+        """Test updating existing datastore values"""
+
+        print(f"\n=== T1.6f: Update Existing Values ===")
+
+        key = "test.config.version"
+        initial_value = "1.0.0"
+        updated_value = "1.1.0"
+
+        # Store initial value
+        print("\n[1/3] Storing initial value...")
+        client.datastore_set(key=key, value=initial_value)
+        retrieved = client.datastore_get(key)
+        assert retrieved == initial_value
+        print(f"✓ Initial value: {retrieved}")
+
+        # Update value
+        print("\n[2/3] Updating value...")
+        client.datastore_set(key=key, value=updated_value)
+        retrieved = client.datastore_get(key)
+        assert retrieved == updated_value
+        print(f"✓ Updated value: {retrieved}")
+
+        # Verify update persisted
+        print("\n[3/3] Verifying persistence...")
+        retrieved_again = client.datastore_get(key)
+        assert retrieved_again == updated_value
+        print(f"✓ Value persisted: {retrieved_again}")
+
+        # Cleanup
+        client.datastore_delete(key)
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Initial value stored")
+        print(f"✓ Value updated successfully")
+        print(f"✓ Update persisted")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_complex_values(self, client: AttuneClient, pack_ref: str):
+        """Test storing complex data structures (JSON)"""
+
+        print(f"\n=== T1.6g: Complex JSON Values ===")
+
+        # Complex nested structure
+        complex_data = {
+            "api": {
+                "endpoint": "https://api.example.com",
+                "version": "v2",
+                "timeout": 30,
+            },
+            "features": {
+                "caching": True,
+                "retry": {"enabled": True, "max_attempts": 3, "backoff": "exponential"},
+            },
+            "limits": {"rate_limit": 1000, "burst": 100},
+            "tags": ["production", "critical", "monitored"],
+        }
+
+        # Store complex value
+        print("\n[1/3] Storing complex JSON structure...")
+        key = "test.config.complex"
+        client.datastore_set(key=key, value=complex_data)
+        print(f"✓ Complex structure stored")
+
+        # Retrieve and verify structure
+        print("\n[2/3] Retrieving and verifying structure...")
+        retrieved = client.datastore_get(key)
+        print(f"✓ Structure retrieved")
+
+        # Verify nested values
+        assert retrieved["api"]["endpoint"] == complex_data["api"]["endpoint"]
+        assert retrieved["features"]["retry"]["max_attempts"] == 3
+        assert retrieved["limits"]["rate_limit"] == 1000
+        assert "production" in retrieved["tags"]
+        print(f"✓ All nested values match")
+
+        # Cleanup
+        print("\n[3/3] Cleaning up...")
+        client.datastore_delete(key)
+        print(f"✓ Cleanup complete")
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Complex JSON structure stored")
+        print(f"✓ Nested values preserved")
+        print(f"✓ Structure verified")
+        print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_07_multi_tenant.py

@@ -0,0 +1,425 @@
+#!/usr/bin/env python3
+"""
+T1.7: Multi-Tenant Isolation
+
+Tests that users cannot access other tenant's resources.
+
+Test Flow:
+1. Create User A (tenant_id=1) and User B (tenant_id=2)
+2. User A creates pack, action, rule
+3. User B attempts to list User A's packs
+4. Verify User B sees empty list
+5. User B attempts to execute User A's action by ID
+6. Verify request returns 404 or 403 error
+7. User A can see and execute their own resources
+
+Success Criteria:
+- All API endpoints filter by tenant_id
+- Cross-tenant resource access returns 404 (not 403 to avoid info leak)
+- Executions scoped to tenant
+- Events scoped to tenant
+- Enforcements scoped to tenant
+- Datastore scoped to tenant
+- Secrets scoped to tenant
+"""
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_echo_action,
+    create_rule,
+    create_webhook_trigger,
+    unique_ref,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.security
+@pytest.mark.integration
+@pytest.mark.timeout(60)
+class TestMultiTenantIsolation:
+    """Test multi-tenant isolation and RBAC"""
+
+    def test_basic_tenant_isolation(self, api_base_url: str, test_timeout: int):
+        """Test that users in different tenants cannot see each other's resources"""
+
+        print(f"\n=== T1.7: Multi-Tenant Isolation ===")
+
+        # Step 1: Create two unique users (separate tenants)
+        print("\n[1/7] Creating two users in separate tenants...")
+
+        user_a_login = f"user_a_{unique_ref()}@attune.local"
+        user_b_login = f"user_b_{unique_ref()}@attune.local"
+        password = "TestPass123!"
+
+        # Client for User A
+        client_a = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_a.register(login=user_a_login, password=password, display_name="User A")
+        client_a.login(login=user_a_login, password=password, create_if_missing=False)
+        print(f"✓ User A created: {user_a_login}")
+        print(f"  Tenant ID: {client_a.tenant_id}")
+
+        # Client for User B
+        client_b = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_b.register(login=user_b_login, password=password, display_name="User B")
+        client_b.login(login=user_b_login, password=password, create_if_missing=False)
+        print(f"✓ User B created: {user_b_login}")
+        print(f"  Tenant ID: {client_b.tenant_id}")
+
+        # Verify different tenants (if tenant_id available in response)
+        if client_a.tenant_id and client_b.tenant_id:
+            print(f"\n  Tenant verification:")
+            print(f"    User A tenant: {client_a.tenant_id}")
+            print(f"    User B tenant: {client_b.tenant_id}")
+            # Note: In some implementations, each user gets their own tenant
+            # In others, users might share a tenant but have different user_ids
+
+        # Step 2: User A creates resources
+        print("\n[2/7] User A creates pack, action, and rule...")
+
+        # Register test pack for User A
+        pack_a = client_a.register_pack("tests/fixtures/packs/test_pack")
+        pack_ref_a = pack_a["ref"]
+        print(f"✓ User A created pack: {pack_ref_a}")
+
+        # Create action for User A
+        action_a = create_echo_action(client=client_a, pack_ref=pack_ref_a)
+        action_ref_a = action_a["ref"]
+        action_id_a = action_a["id"]
+        print(f"✓ User A created action: {action_ref_a} (ID: {action_id_a})")
+
+        # Create trigger and rule for User A
+        trigger_a = create_webhook_trigger(client=client_a, pack_ref=pack_ref_a)
+        rule_a = create_rule(
+            client=client_a,
+            trigger_id=trigger_a["id"],
+            action_ref=action_ref_a,
+            pack_ref=pack_ref_a,
+        )
+        print(f"✓ User A created trigger and rule")
+
+        # Step 3: User A can see their own resources
+        print("\n[3/7] Verifying User A can see their own resources...")
+
+        user_a_packs = client_a.list_packs()
+        print(f"  User A sees {len(user_a_packs)} pack(s)")
+        assert len(user_a_packs) > 0, "User A should see their own packs"
+
+        user_a_actions = client_a.list_actions()
+        print(f"  User A sees {len(user_a_actions)} action(s)")
+        assert len(user_a_actions) > 0, "User A should see their own actions"
+
+        user_a_rules = client_a.list_rules()
+        print(f"  User A sees {len(user_a_rules)} rule(s)")
+        assert len(user_a_rules) > 0, "User A should see their own rules"
+
+        print(f"✓ User A can access their own resources")
+
+        # Step 4: User B cannot see User A's packs
+        print("\n[4/7] Verifying User B cannot see User A's packs...")
+
+        user_b_packs = client_b.list_packs()
+        print(f"  User B sees {len(user_b_packs)} pack(s)")
+
+        # User B should not see User A's packs
+        user_b_pack_refs = [p["ref"] for p in user_b_packs]
+        assert pack_ref_a not in user_b_pack_refs, (
+            f"User B should not see User A's pack {pack_ref_a}"
+        )
+        print(f"✓ User B cannot see User A's packs")
+
+        # Step 5: User B cannot see User A's actions
+        print("\n[5/7] Verifying User B cannot see User A's actions...")
+
+        user_b_actions = client_b.list_actions()
+        print(f"  User B sees {len(user_b_actions)} action(s)")
+
+        # User B should not see User A's actions
+        user_b_action_refs = [a["ref"] for a in user_b_actions]
+        assert action_ref_a not in user_b_action_refs, (
+            f"User B should not see User A's action {action_ref_a}"
+        )
+        print(f"✓ User B cannot see User A's actions")
+
+        # Step 6: User B cannot access User A's action by ID
+        print("\n[6/7] Verifying User B cannot access User A's action by ID...")
+
+        try:
+            # Attempt to get User A's action by ID
+            user_b_action = client_b.get_action(action_id_a)
+            # If we get here, that's a security problem
+            pytest.fail(
+                f"SECURITY ISSUE: User B was able to access User A's action (ID: {action_id_a})"
+            )
+        except Exception as e:
+            # Expected: 404 (not found) or 403 (forbidden)
+            error_message = str(e)
+            print(f"  Expected error: {error_message}")
+
+            # Should be 404 (to avoid information leakage) or 403
+            if (
+                "404" in error_message
+                or "403" in error_message
+                or "not found" in error_message.lower()
+            ):
+                print(f"✓ User B correctly denied access (404/403)")
+            else:
+                print(f"⚠️  Unexpected error type: {error_message}")
+                print(f"   (Expected 404 or 403)")
+
+        # Step 7: Verify executions are isolated
+        print("\n[7/7] Verifying execution isolation...")
+
+        # User A executes their action
+        client_a.fire_webhook(trigger_id=trigger_a["id"], payload={"test": "user_a"})
+        print(f"  User A triggered execution")
+
+        # Wait briefly for execution
+        import time
+
+        time.sleep(2)
+
+        # User A can see their executions
+        user_a_executions = client_a.list_executions()
+        print(f"  User A sees {len(user_a_executions)} execution(s)")
+
+        # User B cannot see User A's executions
+        user_b_executions = client_b.list_executions()
+        print(f"  User B sees {len(user_b_executions)} execution(s)")
+
+        # If User A has executions, User B should not see them
+        if len(user_a_executions) > 0:
+            user_a_exec_ids = {e["id"] for e in user_a_executions}
+            user_b_exec_ids = {e["id"] for e in user_b_executions}
+
+            overlap = user_a_exec_ids.intersection(user_b_exec_ids)
+            assert len(overlap) == 0, (
+                f"SECURITY ISSUE: User B can see {len(overlap)} execution(s) from User A"
+            )
+            print(f"✓ User B cannot see User A's executions")
+
+        # Final summary
+        print("\n=== Test Summary ===")
+        print(f"✓ Two users created in separate contexts")
+        print(f"✓ User A can access their own resources")
+        print(f"✓ User B cannot see User A's packs")
+        print(f"✓ User B cannot see User A's actions")
+        print(f"✓ User B cannot access User A's action by ID")
+        print(f"✓ Executions isolated between users")
+        print(f"✓ Multi-tenant isolation working correctly")
+        print(f"✓ Test PASSED")
+
+    def test_datastore_isolation(self, api_base_url: str, test_timeout: int):
+        """Test that datastore values are isolated per tenant"""
+
+        print(f"\n=== T1.7b: Datastore Isolation ===")
+
+        # Create two users
+        user_a_login = f"user_a_{unique_ref()}@attune.local"
+        user_b_login = f"user_b_{unique_ref()}@attune.local"
+        password = "TestPass123!"
+
+        client_a = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_a.register(login=user_a_login, password=password)
+        client_a.login(login=user_a_login, password=password, create_if_missing=False)
+
+        client_b = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_b.register(login=user_b_login, password=password)
+        client_b.login(login=user_b_login, password=password, create_if_missing=False)
+
+        print(f"✓ Two users created")
+
+        # User A stores a value
+        print("\nUser A storing datastore value...")
+        test_key = "test.isolation.key"
+        user_a_value = "user_a_secret_value"
+
+        client_a.datastore_set(key=test_key, value=user_a_value)
+        print(f"  User A stored: {test_key} = {user_a_value}")
+
+        # User A can read it back
+        retrieved_a = client_a.datastore_get(test_key)
+        assert retrieved_a == user_a_value
+        print(f"  User A retrieved: {retrieved_a}")
+
+        # User B tries to read the same key
+        print("\nUser B attempting to read User A's key...")
+        retrieved_b = client_b.datastore_get(test_key)
+        print(f"  User B retrieved: {retrieved_b}")
+
+        # User B should get None (key doesn't exist in their namespace)
+        assert retrieved_b is None, (
+            f"SECURITY ISSUE: User B can read User A's datastore value"
+        )
+        print(f"✓ User B cannot access User A's datastore values")
+
+        # User B stores their own value with same key
+        print("\nUser B storing their own value with same key...")
+        user_b_value = "user_b_different_value"
+        client_b.datastore_set(key=test_key, value=user_b_value)
+        print(f"  User B stored: {test_key} = {user_b_value}")
+
+        # Each user sees only their own value
+        print("\nVerifying each user sees only their own value...")
+        final_a = client_a.datastore_get(test_key)
+        final_b = client_b.datastore_get(test_key)
+
+        print(f"  User A sees: {final_a}")
+        print(f"  User B sees: {final_b}")
+
+        assert final_a == user_a_value, "User A should see their own value"
+        assert final_b == user_b_value, "User B should see their own value"
+
+        print(f"✓ Each user has isolated datastore namespace")
+
+        # Cleanup
+        client_a.datastore_delete(test_key)
+        client_b.datastore_delete(test_key)
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Datastore values isolated per tenant")
+        print(f"✓ Same key can have different values per tenant")
+        print(f"✓ Cross-tenant datastore access prevented")
+        print(f"✓ Test PASSED")
+
+    def test_event_isolation(self, api_base_url: str, test_timeout: int):
+        """Test that events are isolated per tenant"""
+
+        print(f"\n=== T1.7c: Event Isolation ===")
+
+        # Create two users
+        user_a_login = f"user_a_{unique_ref()}@attune.local"
+        user_b_login = f"user_b_{unique_ref()}@attune.local"
+        password = "TestPass123!"
+
+        client_a = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_a.register(login=user_a_login, password=password)
+        client_a.login(login=user_a_login, password=password, create_if_missing=False)
+
+        client_b = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_b.register(login=user_b_login, password=password)
+        client_b.login(login=user_b_login, password=password, create_if_missing=False)
+
+        print(f"✓ Two users created")
+
+        # User A creates trigger and fires webhook
+        print("\nUser A creating trigger and firing webhook...")
+        pack_a = client_a.register_pack("tests/fixtures/packs/test_pack")
+        trigger_a = create_webhook_trigger(client=client_a, pack_ref=pack_a["ref"])
+
+        client_a.fire_webhook(
+            trigger_id=trigger_a["id"], payload={"user": "A", "message": "test"}
+        )
+        print(f"✓ User A fired webhook (trigger_id={trigger_a['id']})")
+
+        # Wait for event
+        import time
+
+        time.sleep(2)
+
+        # User A can see their events
+        print("\nChecking event visibility...")
+        user_a_events = client_a.list_events()
+        print(f"  User A sees {len(user_a_events)} event(s)")
+
+        # User B cannot see User A's events
+        user_b_events = client_b.list_events()
+        print(f"  User B sees {len(user_b_events)} event(s)")
+
+        if len(user_a_events) > 0:
+            user_a_event_ids = {e["id"] for e in user_a_events}
+            user_b_event_ids = {e["id"] for e in user_b_events}
+
+            overlap = user_a_event_ids.intersection(user_b_event_ids)
+            assert len(overlap) == 0, (
+                f"SECURITY ISSUE: User B can see {len(overlap)} event(s) from User A"
+            )
+            print(f"✓ Events isolated between tenants")
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Events isolated per tenant")
+        print(f"✓ Cross-tenant event access prevented")
+        print(f"✓ Test PASSED")
+
+    def test_rule_isolation(self, api_base_url: str, test_timeout: int):
+        """Test that rules are isolated per tenant"""
+
+        print(f"\n=== T1.7d: Rule Isolation ===")
+
+        # Create two users
+        user_a_login = f"user_a_{unique_ref()}@attune.local"
+        user_b_login = f"user_b_{unique_ref()}@attune.local"
+        password = "TestPass123!"
+
+        client_a = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_a.register(login=user_a_login, password=password)
+        client_a.login(login=user_a_login, password=password, create_if_missing=False)
+
+        client_b = AttuneClient(
+            base_url=api_base_url, timeout=test_timeout, auto_login=False
+        )
+        client_b.register(login=user_b_login, password=password)
+        client_b.login(login=user_b_login, password=password, create_if_missing=False)
+
+        print(f"✓ Two users created")
+
+        # User A creates rule
+        print("\nUser A creating rule...")
+        pack_a = client_a.register_pack("tests/fixtures/packs/test_pack")
+        trigger_a = create_webhook_trigger(client=client_a, pack_ref=pack_a["ref"])
+        action_a = create_echo_action(client=client_a, pack_ref=pack_a["ref"])
+        rule_a = create_rule(
+            client=client_a,
+            trigger_id=trigger_a["id"],
+            action_ref=action_a["ref"],
+            pack_ref=pack_a["ref"],
+        )
+        rule_id_a = rule_a["id"]
+        print(f"✓ User A created rule (ID: {rule_id_a})")
+
+        # User A can see their rule
+        user_a_rules = client_a.list_rules()
+        print(f"  User A sees {len(user_a_rules)} rule(s)")
+        assert len(user_a_rules) > 0
+
+        # User B cannot see User A's rules
+        user_b_rules = client_b.list_rules()
+        print(f"  User B sees {len(user_b_rules)} rule(s)")
+
+        user_b_rule_ids = {r["id"] for r in user_b_rules}
+        assert rule_id_a not in user_b_rule_ids, (
+            f"SECURITY ISSUE: User B can see User A's rule"
+        )
+        print(f"✓ User B cannot see User A's rules")
+
+        # User B cannot access User A's rule by ID
+        print("\nUser B attempting direct access to User A's rule...")
+        try:
+            client_b.get_rule(rule_id_a)
+            pytest.fail("SECURITY ISSUE: User B accessed User A's rule by ID")
+        except Exception as e:
+            error_message = str(e)
+            if "404" in error_message or "403" in error_message:
+                print(f"✓ Access correctly denied (404/403)")
+            else:
+                print(f"⚠️  Unexpected error: {error_message}")
+
+        print("\n=== Test Summary ===")
+        print(f"✓ Rules isolated per tenant")
+        print(f"✓ Cross-tenant rule access prevented")
+        print(f"✓ Direct ID access blocked")
+        print(f"✓ Test PASSED")

tests/e2e/tier1/test_t1_08_action_failure.py

@@ -0,0 +1,398 @@
+#!/usr/bin/env python3
+"""
+T1.8: Action Execution Failure Handling
+
+Tests that failed action executions are handled gracefully.
+
+Test Flow:
+1. Create action that always exits with error (exit code 1)
+2. Create rule to trigger action
+3. Execute action
+4. Verify execution status becomes 'failed'
+5. Verify error message captured
+6. Verify exit code recorded
+7. Verify execution doesn't retry (no retry policy)
+
+Success Criteria:
+- Execution status: 'requested' → 'scheduled' → 'running' → 'failed'
+- Exit code captured: exit_code = 1
+- stderr captured in execution result
+- Execution result includes error details
+- Worker marks execution as failed
+- Executor updates enforcement status
+- System remains stable (no crashes)
+"""
+
+import time
+
+import pytest
+from helpers import (
+    AttuneClient,
+    create_failing_action,
+    create_rule,
+    create_webhook_trigger,
+    wait_for_execution_count,
+    wait_for_execution_status,
+)
+
+
+@pytest.mark.tier1
+@pytest.mark.integration
+@pytest.mark.timeout(30)
+class TestActionFailureHandling:
+    """Test action failure handling"""
+
+    def test_action_failure_basic(self, client: AttuneClient, pack_ref: str):
+        """Test that failing action is marked as failed with error details"""
+
+        print(f"\n=== T1.8: Action Failure Handling ===")
+
+        # Step 1: Create failing action
+        print("\n[1/5] Creating failing action...")
+        action = create_failing_action(client=client, pack_ref=pack_ref, exit_code=1)
+        action_ref = action["ref"]
+        print(f"✓ Created action: {action_ref} (ID: {action['id']})")
+        print(f"  Expected exit code: 1")
+
+        # Step 2: Create webhook trigger (easier to control than timer)
+        print("\n[2/5] Creating webhook trigger...")
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        print(f"✓ Created trigger: {trigger['label']} (ID: {trigger['id']})")
+
+        # Step 3: Create rule
+        print("\n[3/5] Creating rule...")
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action_ref,
+            pack_ref=pack_ref,
+            enabled=True,
+        )
+        print(f"✓ Created rule: {rule['name']} (ID: {rule['id']})")
+
+        # Step 4: Fire webhook to trigger execution
+        print("\n[4/5] Triggering action execution...")
+        client.fire_webhook(trigger_id=trigger["id"], payload={"test": "failure_test"})
+        print(f"✓ Webhook fired")
+
+        # Wait for execution to be created
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=action_ref,
+            timeout=15,
+            poll_interval=0.5,
+        )
+
+        assert len(executions) >= 1, "Expected at least 1 execution"
+        execution = executions[0]
+        exec_id = execution["id"]
+
+        print(f"✓ Execution created (ID: {exec_id})")
+        print(f"  Initial status: {execution['status']}")
+
+        # Step 5: Wait for execution to complete (should fail)
+        print(f"\n[5/5] Waiting for execution to fail...")
+
+        final_execution = wait_for_execution_status(
+            client=client,
+            execution_id=exec_id,
+            expected_status="failed",
+            timeout=20,
+        )
+
+        print(f"✓ Execution failed as expected")
+        print(f"\nExecution details:")
+        print(f"  ID: {final_execution['id']}")
+        print(f"  Status: {final_execution['status']}")
+        print(f"  Action: {final_execution['action_ref']}")
+
+        # Verify execution status is 'failed'
+        assert final_execution["status"] == "failed", (
+            f"Expected status 'failed', got '{final_execution['status']}'"
+        )
+
+        # Check for exit code if available
+        if "exit_code" in final_execution:
+            exit_code = final_execution["exit_code"]
+            print(f"  Exit code: {exit_code}")
+            assert exit_code == 1, f"Expected exit code 1, got {exit_code}"
+
+        # Check for error information
+        result = final_execution.get("result") or {}
+        print(f"  Result available: {bool(result)}")
+
+        if "error" in result:
+            print(f"  Error: {result['error']}")
+
+        if "stderr" in result:
+            stderr = result["stderr"]
+            if stderr:
+                print(f"  Stderr captured: {len(stderr)} characters")
+
+        # Final summary
+        print("\n=== Test Summary ===")
+        print(f"✓ Action executed and failed")
+        print(f"✓ Execution status: failed")
+        print(f"✓ Error information captured")
+        print(f"✓ System handled failure gracefully")
+        print(f"✓ Test PASSED")
+
+    def test_multiple_failures_independent(self, client: AttuneClient, pack_ref: str):
+        """Test that multiple failures don't affect each other"""
+
+        print(f"\n=== T1.8b: Multiple Independent Failures ===")
+
+        # Create failing action
+        action = create_failing_action(client=client, pack_ref=pack_ref)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        print(f"✓ Setup complete")
+
+        # Trigger 3 executions
+        print(f"\nTriggering 3 executions...")
+        for i in range(3):
+            client.fire_webhook(trigger_id=trigger["id"], payload={"run": i + 1})
+            print(f"  ✓ Execution {i + 1} triggered")
+            time.sleep(0.5)
+
+        # Wait for all 3 executions
+        executions = wait_for_execution_count(
+            client=client,
+            expected_count=3,
+            action_ref=action["ref"],
+            timeout=25,
+        )
+
+        print(f"✓ {len(executions)} executions created")
+
+        # Wait for all to complete
+        print(f"\nWaiting for all executions to complete...")
+        failed_count = 0
+        for i, execution in enumerate(executions[:3]):
+            exec_id = execution["id"]
+            status = execution["status"]
+
+            if status not in ["failed", "succeeded", "canceled"]:
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=exec_id,
+                    expected_status="failed",
+                    timeout=15,
+                )
+                status = execution["status"]
+
+            print(f"  Execution {i + 1}: {status}")
+            assert status == "failed"
+            failed_count += 1
+
+        print(f"\n✓ All {failed_count}/3 executions failed independently")
+        print(f"✓ No cascade failures or system instability")
+        print(f"✓ Test PASSED")
+
+    def test_action_failure_different_exit_codes(
+        self, client: AttuneClient, pack_ref: str
+    ):
+        """Test actions with different exit codes"""
+
+        print(f"\n=== T1.8c: Different Exit Codes ===")
+
+        exit_codes = [1, 2, 127, 255]
+
+        for exit_code in exit_codes:
+            print(f"\nTesting exit code {exit_code}...")
+
+            # Create action with specific exit code
+            action = create_failing_action(
+                client=client, pack_ref=pack_ref, exit_code=exit_code
+            )
+            trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+            rule = create_rule(
+                client=client,
+                trigger_id=trigger["id"],
+                action_ref=action["ref"],
+                pack_ref=pack_ref,
+            )
+
+            # Execute
+            client.fire_webhook(trigger_id=trigger["id"], payload={})
+
+            # Wait for execution
+            executions = wait_for_execution_count(
+                client=client,
+                expected_count=1,
+                action_ref=action["ref"],
+                timeout=15,
+            )
+
+            execution = executions[0]
+            if execution["status"] not in ["failed", "succeeded", "canceled"]:
+                execution = wait_for_execution_status(
+                    client=client,
+                    execution_id=execution["id"],
+                    expected_status="failed",
+                    timeout=15,
+                )
+
+            # Verify failed
+            assert execution["status"] == "failed"
+            print(f"  ✓ Execution failed with exit code {exit_code}")
+
+            # Check exit code if available
+            if "exit_code" in execution:
+                actual_exit_code = execution["exit_code"]
+                print(f"  ✓ Captured exit code: {actual_exit_code}")
+                # Note: Exit codes may be truncated/modified by shell
+                # Just verify it's non-zero
+                assert actual_exit_code != 0
+
+        print(f"\n✓ All exit codes handled correctly")
+        print(f"✓ Test PASSED")
+
+    def test_action_timeout_vs_failure(self, client: AttuneClient, pack_ref: str):
+        """Test distinguishing between timeout and actual failure"""
+
+        print(f"\n=== T1.8d: Timeout vs Failure ===")
+
+        # Create action that fails quickly (not timeout)
+        print("\nTest 1: Quick failure (not timeout)...")
+        action = create_failing_action(client=client, pack_ref=pack_ref, exit_code=1)
+        trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        rule = create_rule(
+            client=client,
+            trigger_id=trigger["id"],
+            action_ref=action["ref"],
+            pack_ref=pack_ref,
+        )
+
+        client.fire_webhook(trigger_id=trigger["id"], payload={})
+
+        executions = wait_for_execution_count(
+            client=client, expected_count=1, action_ref=action["ref"], timeout=15
+        )
+
+        execution = executions[0]
+        if execution["status"] not in ["failed", "succeeded", "canceled"]:
+            execution = wait_for_execution_status(
+                client=client,
+                execution_id=execution["id"],
+                expected_status="failed",
+                timeout=15,
+            )
+
+        # Should fail quickly (within a few seconds)
+        assert execution["status"] == "failed"
+        print(f"  ✓ Action failed quickly")
+
+        # Check result for failure type
+        result = execution.get("result") or {}
+        if "error" in result:
+            error_msg = result["error"]
+            print(f"  Error message: {error_msg}")
+
+            # Should NOT be a timeout error
+            is_timeout = (
+                "timeout" in error_msg.lower() or "timed out" in error_msg.lower()
+            )
+            if is_timeout:
+                print(f"  ⚠️  Error indicates timeout (unexpected for quick failure)")
+            else:
+                print(f"  ✓ Error is not timeout-related")
+
+        print(f"\n✓ Failure modes can be distinguished")
+        print(f"✓ Test PASSED")
+
+    def test_system_stability_after_failure(self, client: AttuneClient, pack_ref: str):
+        """Test that system remains stable after action failure"""
+
+        print(f"\n=== T1.8e: System Stability After Failure ===")
+
+        # Create two actions: one that fails, one that succeeds
+        print("\n[1/4] Creating failing and succeeding actions...")
+        failing_action = create_failing_action(client=client, pack_ref=pack_ref)
+
+        from helpers import create_echo_action
+
+        success_action = create_echo_action(client=client, pack_ref=pack_ref)
+        print(f"✓ Actions created")
+
+        # Create triggers and rules
+        print("\n[2/4] Creating triggers and rules...")
+        fail_trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+        success_trigger = create_webhook_trigger(client=client, pack_ref=pack_ref)
+
+        fail_rule = create_rule(
+            client=client,
+            trigger_id=fail_trigger["id"],
+            action_ref=failing_action["ref"],
+            pack_ref=pack_ref,
+        )
+        success_rule = create_rule(
+            client=client,
+            trigger_id=success_trigger["id"],
+            action_ref=success_action["ref"],
+            pack_ref=pack_ref,
+        )
+        print(f"✓ Rules created")
+
+        # Execute failing action
+        print("\n[3/4] Executing failing action...")
+        client.fire_webhook(trigger_id=fail_trigger["id"], payload={})
+
+        fail_executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=failing_action["ref"],
+            timeout=15,
+        )
+
+        fail_exec = fail_executions[0]
+        if fail_exec["status"] not in ["failed", "succeeded", "canceled"]:
+            fail_exec = wait_for_execution_status(
+                client=client,
+                execution_id=fail_exec["id"],
+                expected_status="failed",
+                timeout=15,
+            )
+
+        assert fail_exec["status"] == "failed"
+        print(f"✓ First action failed (as expected)")
+
+        # Execute succeeding action
+        print("\n[4/4] Executing succeeding action...")
+        client.fire_webhook(
+            trigger_id=success_trigger["id"], payload={"message": "test"}
+        )
+
+        success_executions = wait_for_execution_count(
+            client=client,
+            expected_count=1,
+            action_ref=success_action["ref"],
+            timeout=15,
+        )
+
+        success_exec = success_executions[0]
+        if success_exec["status"] not in ["failed", "succeeded", "canceled"]:
+            success_exec = wait_for_execution_status(
+                client=client,
+                execution_id=success_exec["id"],
+                expected_status="succeeded",
+                timeout=15,
+            )
+
+        assert success_exec["status"] == "succeeded"
+        print(f"✓ Second action succeeded")
+
+        # Final verification
+        print("\n=== Test Summary ===")
+        print(f"✓ Failing action failed without affecting system")
+        print(f"✓ Subsequent action succeeded normally")
+        print(f"✓ System remained stable after failure")
+        print(f"✓ Worker continues processing after failures")
+        print(f"✓ Test PASSED")