Release notes

Treat missing label_mapped as unmapped in sentiment pick (W0.70.c) · ba54b47

pick_best_reflection_candidate defaulted a missing label_mapped key to True (mapped) and then indexed sent["class_index"] unconditionally, raising an uncaught KeyError instead of the documented per-row degrade when a blank/skipped candidate produces an empty sentiment row. Neither existing caller currently passes blank input, so this was a landmine, not a live incident. Default now treats a missing key as unmapped and reads class_index via .get() with an explicit None check. Closes W0.70/W0.70.c (reopened after in…

Offload blocking Mongo calls in learning routes (W0.70.a) · 56a1662

fetch_learning_wave_status ran a synchronous pymongo find directly inside an async route handler with no offload, and run_outbox_publisher_once's per-document loop did the same for its sync find/update_one calls alongside an awaited async Redis call — both stall the single uvicorn worker's event loop (including its own /health check) for the duration of a slow/loaded Mongo call, the same class of bug already fixed elsewhere in this service at W0.37.d. Wrapped both in run_blocking, matching the established pattern;…

Close quota-bypass race and unbounded profile list (W0.69) · e091474

request-conversation ran a non-atomic quota pre-check, committed the connection to conversation_requested, and only then ran the atomic daily-chat-start CAS — a losing CAS left the connection transitioned with no rollback, silently bypassing the paywall gate. The atomic CAS now runs strictly before the connection mutation, so a losing CAS rejects the request before anything is touched. GET /api/admin/profiles used a helper that returns undefined ("no cap") when limit is omitted or explicitly 0, and the shipped adm…

Regress blind-reveal chat cancel to anonymous_chat_active (W0.68.a) · 2e26a24

cancelRequest.ts inferred the chat-cancel rollback target from conversationConsent.agreedAt, which is only ever set by the explicit requestChat path — a blind-reveal chat_requested (entered via pressReveal from anonymous_chat_active) always regressed to conversation_active instead, permanently stranding the pair since recordVibeCheck and submitIcebreakerStep both require stage === anonymous_chat_active exactly. chatConsent.requestedBy (non-null only for explicit requestChat, and never overwritten through pressReve…

Refresh README/atlas after W0.67.b (W0.67.c/d) · eeb31de

Documents chatService.sendMessage.mediaRetryAfterSuccess.test.ts in tests/services/README.md and the sendMessage.ts duplicate-check reorder in the system atlas, closing the class-I/K staleness the new test file triggered, and closes W0.67 (all four sub-todos done).

Reorder chat media-send duplicate check ahead of media lookup (W0.67.b) · 4eac6ac

sendMessage's mediaId branch looked up the pending media row (throwing if absent) before checking whether a message for that mediaId was already sent. On a successful first call the media row is deleted inside the same transaction, so a client retry after a network timeout/reconnect-resend found no media row and threw a 400 even though the message had already persisted — the duplicate check was unreachable for exactly the retry-after-success scenario it exists for. The duplicate check now runs first, right after g…

Close W0.67.a — duplicate of already-fixed W0.41 · 4c8d599

Byte-identical finding (same file, same trigger scenario, same two-part fix) to W0.41, fixed via commit 9e2ec9fa2 one day before this round-5 hunt's own audit date. registerDeviceToken already releases the token from any other owner before upserting, and a logout-time DELETE /api/device/token route already exists. Cited verify tests re-run clean. Verification-only; no production code changed.

Refresh system atlas api section after W0.66.c/d (W0.66.e) · eb9407b

Documents assertSafeMongoMapKey.ts (the shared map-key guard W0.66.c/d introduced), closing the class-K staleness the new file triggered, and closes W0.66 (all five sub-todos done).

Sanitize state/analytics map keys before dotted $set (W0.66.c/d) · a795f53

StateService.saveAppState and AnalyticsService.saveAnalytics both interpolated a raw client-supplied key directly into a dotted $set path with no character/format restriction, unlike the identical- purpose journey-write path (which already sanitizes every map key via assertSafeProfileJourneyMapKey). A '.'-containing key silently creates nested subdocument structure instead of a flat field, or causes a Mongo path-conflict error. Extracted the guard into a new shared lib/db/assertSafeMongoMapKey.ts (assertSafeProfil…

Defensively cap answer length at the write layer (W0.66.b) · 4756dfe

SaveProfileAnswerRequest.answer's maxLength:2000 (W0.40.c) already guards the HTTP route via Zod validation, but ProfileJourneyWrites. saveQuestionAnswer has two non-HTTP callers (E2E/sim-user journey seeding) that bypass that boundary entirely. Added PROFILE_ANSWER_MAX_CHARS mirroring the OpenAPI SSOT value and a length check that throws before any write when exceeded, so an unbounded string can never reach the profile document from any caller. New tests prove exactly-2000 is accepted and 2001 is rejected before …

Close W0.66.a — duplicate of already-fixed W0.40.a · 9dc86e5

Byte-identical finding (same route, same non-atomic pre-check, same exploit shape) to W0.40.a, fixed via commit 65ecdf29d. saveQuestionAnswer/ saveConnectionRating already build their findOneAndUpdate filter with an atomic $expr/$size map-size guard evaluated at write time, not the stale pre-check snapshot this finding assumed was the only gate. Cited verify tests re-run clean. Verification-only; no production code changed.

Add READMEs for skill-install-output dirs (W0.121.i-l) · a7063c0

.ai/, .ai/hooks/, .claude/, .claude/hooks/ were committed without READMEs, tripping the wave-consistency-scan's class-I check. Filed via wave-compliance-bugs.py file-finding (no owning feature story — routine integrity findings route to the reserved cap:COMPLIANCE story) and drained immediately since they're mechanical, no product decision needed.

Add installed skills (first commit of install output) + update to current · 009b3ee

.ai/ and .claude/ were installed on disk but never committed here. Adding them now at current kit versions (wave-bug-hunt, wave-next, wave-plan-lib 1.37.1, wave-runner all upgraded during this same pass) rather than committing a stale snapshot. wave-plan-lib brings the new deterministic skill-freshness mechanism (kit_root tracking + wave-freshness.py + wave-skills-freshness.py SessionStart hook) and W1.8's CONTINUE-marker markdown-wrap recovery in wave-runner-continue.py.

Refresh system atlas api section after W0.65.c (W0.65.d) · 98707c1

Documents matchRecalculationGuard.ts (the shared cron overlap lock W0.65.c introduced), closing the class-K staleness the new files triggered, and closes W0.65 (all four sub-todos done).

Coordinate external cron route with in-process recalc lock (W0.65.c) · 8357e9e

W0.42.a already guarded the in-process match-recalculation cron job against overlapping itself, but that guard was a closure-local boolean inside scheduled-tasks.ts, invisible to POST /api/cron/recalculate-all- matches — an external caller holding CRON_SECRET could trigger a second concurrent full sweep while the daily job was already running, racing writes to matches. New lib/cron/matchRecalculationGuard.ts lifts the lock to a shared module used by both the cron tick handler and the HTTP route, which now returns …

Close W0.65.b — duplicate of already-fixed W0.38 · 8e21d7b

Byte-identical finding (same file, lines, exploit, four rate limiters named) to W0.38, fixed 2026-08-17 (commit bf1f146d1), one day before this round-5 hunt's own audit date. getIdentifier() already calls resolveClientIp(), not a raw XFF re-parse, with an inline comment citing the prior fix. Cited verify tests re-run clean. Verification-only; no production code changed.

Close W0.65.a — already substantially fixed by W0.61.e (2026-08-19) · 4aef2e2

Same internal.* bridge token, same bug-hunt-round SRC-BUG-INTERNAL- TOKEN-UNREVOCABLE finding, same cross-repo wire-format constraint already investigated and escalated once this session (user authorized a backend-only per-authUid revocation lever over an exp/nonce wire change). Confirmed the revocation mechanism is live, wired into both auth middleware paths, and already tested — closing this finding's actual stated impact (permanent unrevocable access) without re-litigating the same already-decided tradeoff. Ver…

Refresh system atlas ml-service section after W0.64.e (W0.64.g) · c8fd3dd

Documents the threadpool offload, math.isfinite validation, and payload size bounds (W0.64.c/d/e); removes the now-resolved "fake async job queue" flagged lead. Closes the class-K staleness the new test file triggered, and closes W0.64 (all seven sub-todos done).

Add max_length/max_items payload bounds (W0.64.e) · 7db0806

No field across /v1/entropy, /v1/fit, /v1/nlp/affect, /v1/generate had any size ceiling. Combined with no auth (W0.64.b) and a single blocking worker (W0.64.c) — both now fixed — an unauthenticated caller could force a long-running or memory-heavy computation with nothing in front of it, a straightforward resource-exhaustion path. Added maxItems/maxLength to every request field in the contract (array sizes scaled to realistic batch counts; string lengths capped, with NlpAffectTextInput.content matching the existin…

Reject NaN rating/clamp bounds instead of silently nulling (W0.64.d) · f6f64b3

entropy.py's clamp_min/clamp_max and trait_fit.py's per-rating range check were both written as a plain > / < comparison, which is False for NaN under IEEE-754 semantics — a NaN value sailed through unrejected and propagated via np.clip(np.mean(...)) into a silently null weight/theta instead of a validation error. Both now check math.isfinite() first, matching the same fix shape already established in the sibling matching service. New tests prove a NaN clampMin/clampMax/rating now raises instead of nulling; verifi…

Offload blocking compute + make /v1/jobs genuinely async (W0.64.c) · b5b4a8b

Every /v1/* route ran its inference/compute inline on the event-loop thread inside an async def handler — one slow /v1/generate or /v1/nlp/affect call blocked the entire single-worker process, including its own health/ready checks, for the call's whole duration. All four synchronous compute routes now offload via starlette.concurrency.run_in_threadpool instead of calling the domain function directly. /v1/jobs advertised a submit-then-poll async contract but executed the job synchronously inline before ever returni…

Refresh system atlas ml-service section after W0.64.a/b (W0.64.f) · ee085f6

Documents the modelId allowlist (W0.64.a) and the now-universal X-Internal-Secret requirement (W0.64.b), closing the class-K staleness the new test files triggered.

Close RCE via unvalidated modelId + wire missing auth (W0.64.a/b) · ec3b223

Two CRITICAL findings that compound: POST /v1/generate loaded any caller-supplied modelId via AutoTokenizer/AutoModelForCausalLM with trust_remote_code=True (arbitrary code execution from any HF repo id), and verify_internal_secret existed but was never attached to any router, so every inference/consumer route was reachable by anyone with network access — making the RCE remotely exploitable by anyone, not just a compromised internal caller. W0.64.a: LocalQwenGenerator.load() now rejects any model_id outside resolv…

Refresh system atlas api section after W0.63.e (W0.63.g) · 04deac6

Documents resolveProvenSessionAuthUid.ts (the session-proof guard W0.63.e introduced) in the API section's services list, closing the class-K staleness the new lib/auth file triggered.

Require session-proof bearer for e2e ensure-discovery-peers (W0.63.e) · 43bf87f

POST /api/internal/e2e/ensure-discovery-peers accepted an arbitrary caller-supplied viewerAuthUid, gated only by INTERNAL_API_SECRET — which proves the caller holds the shared secret, not that they control the identity they're asking to materialize discovery-peer writes for. Closes with the narrower invariant the earlier bug-hunt finding called for: bind viewerAuthUid to a real, currently-authenticated session via proof, not a synthetic-prefix guard (wrong fit here, since every real caller passes its own live, non…

Refresh system atlas api section after W0.63.d (W0.63.f) · 30f5cff

Documents pushAddonGrantIfPaymentVerified (the atomic add-on-grant guard W0.63.d introduced) in the API section's services list, closing the class-K staleness the new mongo-integration test file triggered.

Close check-then-act race in paid add-on grants (W0.63.d) · 3498f3d

[redacted] read the verified-payment count and the already-granted count on separate queries, then pushed the grant on a completely separate write — two concurrent calls for one verified Stripe payment (webhook retry vs original delivery, or webhook vs manual reconciliation) could both pass the check and both grant, doubling a paid unit. Folds the count guard into the grant write itself via a single atomic findOneAndUpdate ($expr/$size/$filter over the current addonGrants, matching the W0.40.a atomic-CAS shape). M…

Refresh system atlas api section after W0.63.c · 4d49e3e

Exclude phantom-zero depthScore for zero-answer users (W0.63.c) · ad98d27

calculateAnswerDepth returns a bare 0 for zero answers -- a sentinel indistinguishable from "answered everything with the shallowest possible depth". calculateEmotionalDepthAlignment only special-cased the both-sides-zero case; when only ONE side had zero answers, the phantom 0 drove depthScore toward its worst-case penalty for a user who simply hasn't answered any journey questions yet, distorting emotionalDepth match scores for every new user. depthScore is now excluded (weight redistributed by weightedAverage) …

Refresh READMEs/atlas after W0.61.e closure · 638db02

Per-authUid internal bearer token revocation, close W0.61 (W0.61.e) · 645a87c

The internal.<authUid>.<emailB64>.<sig> bridge bearer token is a pure deterministic function of (authUid, email, INTERNAL_API_SECRET) with no iat/exp/nonce -- it cannot expire, and the only way to kill one leaked token was rotating INTERNAL_API_SECRET for every user at once. A real fix (embedding iat/exp in the signed payload) would break the sibling app-infra-operator repo's Fleet Python minter without coordinated changes there, confirmed via that file's own doc comments -- explicitly out of this repo's boundary.…

Confirm W0.61.e's block is genuinely cross-repo, not just cross-app · be596f2

Re-verified the internal.<authUid>.<emailB64>.<sig> bridge token's own doc comments in both src/apps/api and src/apps/web: both independently state the wire format must stay byte-compatible with the sibling app-infra-operator repo's fleet_internal_bearer.py Python minter, which doesn't exist anywhere in this repo. Adding iat/exp claims to the signed payload -- the fix this finding calls for -- would silently break that sibling repo's minter/verifier without coordinated changes there, which is out of this repo's bo…

Normalize Stripe refund/dispute events, close W0.58 (W0.58.c) · b55cfed

No case existed for charge.refunded or charge.dispute.* anywhere in the billing tree -- both fell into normalizeEvent's default: return [], so a refunded/disputed charge never revoked the paid-tier access it paid for, for the entire stored renewsAt window (confirmed via exhaustive grep, zero refund/dispute references anywhere in services/billing). Added charge.refunded, charge.dispute.created, and charge.dispute.closed (only when status==="lost") cases. Unlike every other event, a charge/ dispute object carries no…

Refresh system atlas api section after W0.57 closure · ab1447f

Drop 2 confirmed-orphaned indexes, close W0.57 (W0.57.c) · d373d4f

biometricChallenges_userId_verified_expiresAt and profiles_platformRole_1 add write overhead with zero read benefit -- independently re-confirmed by tracing every real query against each collection (biometric challenge reads always key on the unique challengeId; no query anywhere filters by platformRole). Added a new idempotent dropManagedIndexIfPresent helper. Deviated from the finding's blanket "drop all three": did NOT drop biometricSessions_userId_expiresAt -- AdminService.ts's profile-clear cascade does a gen…

Add missing messages indexes for mediaId/receiverId reads (W0.57.b) · 620520b

messages had no index with mediaId as a prefix and none including receiverId at all -- the chat-media authorization lookup on every photo/video byte-read forced Mongo's $or optimizer into a full collection scan, and markMessagesRead's hot unread-count query could only use a conversationId-prefixed index, filtering receiverId/readAt in memory on every call. Added a non-unique mediaId index (most messages have no mediaId; a non-sparse unique index would reject the second such document) and a conversationId+receiverI…

Unique index + dedup on mobile app waitlist collection (W0.57.a) · e54e229

mobile_app_waitlist had no index at all, unlike its sibling rate-limit collection two functions below which already documents this exact gap class (AT-20.9). The upsert's own doc comment claims "idempotent per email + platform" but had no DB-level backstop -- two concurrent submissions could both observe no matching row and both insert. Added the unique (emailNormalized, platform) index and an E11000-catch-and-retry on the upsert, mirroring bumpRateLimit's identical existing pattern.

Load match item weights once per batch, close W0.56 (W0.56.c) · eb5742e

calculateProductMatch loaded item weights internally on every single pairwise invocation -- N independent full matchItemStats scans (plus N Redis reads) for a batch of N peers, for data identical across the whole batch. CalculateProductMatchOptions gained an optional itemWeights field (falls back to loading its own when omitted, so existing single-pair callers are unaffected); BulkMatchProcessor and updateMatchesForProfileChange now load once before their fan-out and pass the same lookup to every call.

Bound concurrent fan-out in match calculation (W0.56.b) · 2c259ec

BulkMatchProcessor and updateMatchesForProfileChange both ran their peer-calculation fan-outs via fully unbounded Promise.allSettled, firing every peer's pairwise calculation (and its own Mongo/Redis reads) in the same tick against a Mongo pool of only maxPoolSize:10. Added a small local worker-pool helper (mapWithConcurrencyLimit) instead of a new p-limit dependency -- keeps exactly N calls in flight with no chunk-boundary idling, and preserves Promise.allSettled's per-item isolation/ordering contract as a drop-i…

Replace blocking Redis KEYS with SCAN in match weight loader (W0.56.a) · 4261c6c

loadMatchItemWeights() called redis.keys('match:item:*:weight'), a blocking O(keyspace) full-scan on a single-threaded server, once per pairwise match calculation tenant-wide -- real Redis latency degradation under a match-calculation fan-out, not hypothetical. Now uses scanIterator() (node-redis v6's cursor-based SCAN wrapper), accumulating matched keys across non-blocking iterations.

Refresh system atlas api section after W0.55 closure · 2d12020

Platform-settings patch no longer clobbers concurrent field writes (W0.55.c) · c8fc29a

patchGlobalSettings unconditionally $set all 8 fields on every call, so two concurrent admin PATCHes changing DIFFERENT fields (both reading the same pre-race snapshot) would have whichever write landed second silently revert the other's field to its pre-change value, even though that request's own HTTP response already reported success. $set now only includes fields actually present in the partial argument; getGlobalRow()'s existing per-field undefined-fallback already handles a partially populated document safel…

Feature-flag cache no longer clobbered by a slow stale read (W0.55.a) · b261c4d

isEnabled/getFlag's cache-miss path did an async findOne then unconditionally cached whatever it read, with no check the cache wasn't already updated more recently by a concurrent upsertFlag (an emergency kill-switch). A read that started just before the write but resolved after it would overwrite the cache with the stale pre-write value stamped as fresh, serving the disabled feature as enabled for a fresh 30s window. Added a monotonic per-key write sequence counter -- a read snapshots it before the Mongo fetch an…

Refresh system atlas api section after W0.54 closure · 3564b83

Exclude synthetic profiles from entropy calibration, close W0.54 (W0.54.c) · 06ab5e0

gatherEntropyItemsFromMongo ran an unfiltered profiles scan, so sim/lab synthetic cohort rows' answers and connection ratings fed into the same production entropy/IRT calibration statistics as real users' -- persisted straight into matchItemStats, the SSOT live match-calculation reads, for every real user's match score. Synthetic answers are generated from a small, repeated set of archetype templates, so any cohort-seeding run would measurably skew item weighting. Now skips any doc whose authUid matches isSimSynth…

Wire anchor-reuse answers into complementary lab profile generation (W0.54.b) · 6c21d0c

buildComplementarySyntheticSeed computed the anchor's answers only to pick the questionAnswerStrategy label, never attached them to the returned seed (no anchorAnswers field existed on the seed type), so the anchor-reuse branch in SyntheticQuestionAnswerBuilder.buildAnswers could never fire -- every "complementary" lab profile was fresh-generated, not aligned to the anchor. Compounding: isStoredAnswerObject()'s typeof-object check would still reject a real stored answer, which is a JSON string per the wire contrac…

Synthetic reflection answers carry matchingDimension (W0.54.a) · af521fb

All 5 SyntheticQuestionAnswerBuilder builder functions read question.matchingDimension to pick answer text/level but never included it in the returned StoredQuestionAnswer, unlike real client-written answers. axisForStoredAnswer()/profileMatchingSignals.ts read rec.matchingDimension directly with no bank fallback, so every synthetic answer resolved to axis===null and was silently dropped from pairwise reflection-axis alignment and solo-signal computation on every axis, always.

Refresh system atlas api section after W0.51.e/f · 6f59abd

Cascade-clear question answers on delete, close W0.51 (W0.51.f) · d5d3216

deleteQuestion never touched profiles.questionAnswers[id] on any profile. A legacy answer with no embedded matchingDimension tag survived the delete and, if the same id was later reused for an unrelated question, would get folded into the new question's axis/item-stat calibration under a different, possibly mismatched axis. deleteQuestion now cascade-clears the answer key from every profile that has one (best-effort, logged not thrown, after the question row itself is confirmed deleted).

Per-row validation for answers-import profile batch (W0.51.e) · d2409d9

parseQuestionAnswersImportBody threw synchronously on the first invalid profiles[i].questionAnswers row, aborting the entire restore-all batch even though legacy plain-object-valued rows are a documented, expected shape. Each row now validates independently and a bad row is skipped into a new profileParseErrors array (merged into QuestionAnswersImportService's profileErrors/profilesSkipped), matching bulkUpsertQuestions's existing per-index error accumulation.

Refresh system atlas api/matching sections after W0.51.a-d · b72a00c

Question-bank active-count parity, 404 for missing journey-length report (W0.51.c/d) · 358c584

buildQuestionBankStats treated a missing `active` field as active, inflating GET /api/admin/questions/stats's activeQuestions relative to what getActiveQuestions()/serializeQuestionDocument actually show users. The journey-length-recommendation route had no special-casing for JourneyLengthReportNotFoundError and returned 500 for a routine "no such report" typo, tripping 5xx-based alerting.

Reachable low_polarization threshold, live trait-slug resolution (W0.51.a/b) · a4dbf2b

low_polarization was unreachable dead code (floor 0.2 vs threshold <0.15), silently defeating journey-length-recommendation's retirement signal. _trait_index only recognized legacy numeric matchingDimension, not the live string slugs the schema actually stores, so trait_idx was always 0 for real questions. Relabeled the module's docstring as a structural/coverage heuristic rather than a real psychometric measure (it never reads profiles.questionAnswers) and filed the larger response-distribution-based scoring gap …

Refresh system atlas API section after W0.50 · 27cb624

New test file under src/apps/api triggered finding class K (atlas staleness). Documents the atomic gate-and-mutate pattern now shared by both OTP checks.

Close W0.50 — email-OTP attempts-lockout race + request double-count · 1d7b8f8

Two independent findings against emailOtpService.ts: - verifyEmailOtpChallenge's max-attempts lockout was a check-then-act race: findPendingChallenge's attempts<MAX read and the mismatch-path updateOne's $inc were two separate operations, with no attempts filter on the increment itself. N concurrent wrong-code guesses for the same challenge could all pass the same stale read before any single increment landed, defeating the 5-attempt lockout against a 4-digit code space. Added the same attempts<MAX bound directly …

Close W0.49 — require MONGODB_URI unconditionally · 50d78c2

env.ts's schema carved out an exception letting boot skip MONGODB_URI when BINDINGS_ENABLED=true, on the premise that CNCF service-binding files supply it instead -- but the actual Mongo client (lib/db/connection/index.ts, imported by every route at process startup) always reads process.env.MONGODB_URI directly with a hard throw if unset, with zero BINDINGS_ENABLED awareness. Nothing in this repo resolves a URI from binding files; serviceBindings.ts's resolvers are dead code with zero callers. A BINDINGS_ENABLED=t…

Refresh system atlas API section after W0.48 · 110da39

New test files under src/apps/api triggered finding class K (atlas staleness). Documents the JWT algorithm pins, clock tolerance, and issuer normalization.

Three findings, all against the installed jose library: · 4788e5e

- zitadel-validator.ts: issuer trailing-slash normalization was applied for JWKS discovery but not for the strict iss claim comparison passed to jwtVerify -- a ZITADEL_ISSUER trailing-slash mismatch against the real iss claim made key fetching look healthy while every token verification failed with a generic 401. Extracted a single exported normalizeZitadelIssuer() used everywhere. - Neither the ZITADEL nor native-shell-compat jwtVerify call set clockTolerance (jose's default is exactly 0s), so any positive clock …

Refresh system atlas matching section after W0.47 · a363c84

New test files under src/apps/matching triggered finding class K (atlas staleness). Documents the phantom-zero axis fix and the Mongo-read weight floor.

Close W0.47 — phantom-zero axis score + unclamped Mongo item weight · 49d74c2

score_pairing_breakdown's per-axis loop correctly treated "no shared items" as None (no data), but treated "shared items exist, all with signal_weight <= 0" as a real 0.0 (worst possible) instead of the same "no data" None -- indistinguishable from a genuine zero match once fed into production egress (matchPercentage/connectionRing). Two independent fixes, matching the two exposure points the finding named: - calibration_calibrator.py: replaced the `... if weight_total else 0.0` fallback with an explicit early con…

Refresh system atlas API section after W0.45.c · 81fb462

Adding data-atlas-module markers means every new file under a declared module subtree needs the section re-verified in the same change as the code that added it -- this session's own new convention (W0.125). Documents the shared deleteIfPresent GridFS cleanup now reused across all three profile-delete paths.

Close W0.45.c + W0.45 — clean up GridFS blobs on generic admin document delete · d75bc39

DELETE /api/admin/collections/profiles/:documentId had no code path back to ProfilePictureService at all -- the third and final reachable route (after W0.45.a's direct replace-picture failure and W0.45.b's bulk clearAllProfiles) that could leak full/preview GridFS blobs permanently. Took the special-case option over removing "profiles" from the delete allowlist, preserving the existing admin capability: only for collectionName === "profiles", findOne's the document's profilePicture before the deleteOne (unqueryabl…

Close W0.45.b — clean up GridFS blobs on bulk admin profile delete · b85f894

clearAllProfiles (DELETE /api/admin/profiles) did a raw deleteMany on profiles with zero storage cleanup, completely bypassing ProfilePictureService -- every deleted profile that had a picture leaked its full/preview GridFS blobs permanently. The self-service DELETE /api/profile path was already correct by contrast. Exported deleteIfPresent from ProfilePictureService.ts (was private) and reused it directly instead of duplicating its swallow-and-log GridFS-cleanup logic. clearAllProfiles now projects profilePicture…

Close W0.45.a — clean up orphaned GridFS blob on failed profile-picture upload · 5a83469

replaceProfilePicture uploaded the full and preview GridFS variants sequentially with no surrounding try/catch -- if full committed and preview then threw, the already-written full blob was never cleaned up (every other failure path in this file correctly calls deleteIfPresent). Every failed second-half-of-upload permanently orphaned a full-resolution photo blob with no reconciliation job anywhere in the repo to catch it. Wrapped both uploads in a try/catch; on failure, best-effort deletes whatever succeeded befor…

Close W0.44 — explicit timeout on the learning-wave-run-once fetch · 4cb72f9

postMatchingLearningWaveRunOnce() had no timeout at all, so a legitimately slow-but-successful wave run past undici's silent ~5-minute default would time out and clear the cron's learningCycleInFlight guard while the Python route was still executing (FastAPI does not cancel synchronous work on client disconnect) -- letting the next 15-minute cron tick fire a fresh run-once call mid-flight, compounding W0.37.c's already-tracked wave-index race via a timeout mismatch. Added an explicit AbortSignal.timeout(...) just …

Close W0.125 — add data-atlas-module coverage markers to system atlas · ba2e04a

plan/system-atlas.html had real, researched content (990 lines, from a separate PR-based dev track) but zero data-atlas-module markers, so the wave-consistency-scan's finding class K couldn't check it for staleness or coverage at all. Added markers to all 9 module/foundation sections, verified against the real repo tree so every top-level tracked directory is covered. Doing this surfaced a genuine staleness finding against src/apps/api (one file added there this session via W0.39.b) -- re-verified that section's c…

Close W0.39.b — verify chat media bytes against declared content type · a54832d

Chat photo/voice uploads were only validated against the client-declared multipart Content-Type header (allowlist check) -- the bytes themselves were never checked. A malformed file trusted as genuine media risked native client-side image/audio decoder exploitation, or using chat as a disguised arbitrary-file-drop channel. Added the file-type package (magic-byte detection) and verifyChatMediaFileSignature(buffer, declaredType, normalizedMime) in chatMediaUploadPolicy.ts, called from uploadMedia.ts before anything …

Close W0.37 — wave-index atomic-claim gap, documented owner+trigger · 15ea0a5

Same resolution shape this wave already applies to identical-shape issues (W0.2.a, W0.2.b, W0.32.a): in-memory/single-process state that's only a real race under multi-worker/multi-replica deployment, which this repo has no evidence of running. Re-confirmed the matching service's Dockerfile still runs a single uvicorn worker with no --workers flag or replica config. A rushed TTL/staleness-based wave-index reservation against this codebase's single most sensitive production pipeline, with no current exploit path, i…

Close W0.35.b — credit remaining subscription value on same-tier renewal · 19fa5a0

activateSubscription unconditionally reset startedAt/renewsAt from "now" on every call; proration (crediting the still-active term's remaining value against the new term's price) only ran for the special-cased Seeker->Visionary upgrade branch. A same-tier renewal/extension or a Visionary re-activation (both allowed -- the tier-rank check only blocks downgrades) silently discarded any remaining paid time with no credit. Generalized computeSeekerToVisionaryUpgradeProration (hardcoded to seeker/visionary) into comput…

Close W0.33 — spin astrological discovery filter out to W0.123 · 3f05244

W0.33.b's sameIntentOnly fix already landed 2026-08-17; the astrological sub-item stays unresolved but is now a properly scoped standalone story (W0.123) instead of an inline "deferred" note, per explicit maintainer direction not to decide the build-vs-remove product call unilaterally.

Close W0.32.b — make ZITADEL_AUDIENCE required, close confused-deputy gap · 0e8da07

Audience validation was silently skipped whenever ZITADEL_AUDIENCE was unset (optional in the env schema) — any validly-signed token from any client registered against the same ZITADEL issuer/project could authenticate against this backend. Live merge-env content isn't verifiable from this repo (control-plane territory), but the actual gap is closable at the code layer: ZITADEL_AUDIENCE is now a required env var (z.string().min(1)), so the process fails to boot without it in any real deployment instead of degradin…

Close W0.32.a — rate-limiter multi-replica gap, documented owner+trigger · 5657106

Same evidence re-check as W0.2.a (no replicas/deploy: config anywhere in docker-compose.yml, no plan doc scaling this backend's container, deploy topology is control-plane/merge-env territory out of this repo's scope): this repo has no evidence of the multi-replica deployment the rate limiter's own top comment flags as a known simplification. Deferred with a documented owner+trigger rather than building a speculative Redis-backed store.

Close W0.28 — full react-hooks/set-state-in-effect + exhaustive-deps/immutability/preserve-manual-memoization/incompatible-library cleanup · 4adcc79

W0.28.d: 38 findings across 30 files (28 exhaustive-deps, 5 preserve-manual- memoization, 3 immutability, 1 incompatible-library, 1 no-unused-vars). Investigated each as a possible real defect per the story's own warning rather than bulk-disabling: - Real fixes: wrapped unmemoized initializers in useMemo (2 filter-chip components), hoisted optional-chain reads so React Compiler's dependency inference could track the narrower path instead of widening to the whole object (biometric/hooks.ts + 3 sibling discovery-but…

Close W0.6 acceptance gate after W0.6.f · f136e2d

Verify re-run clean (0 class-I findings) now that the 31 newly-merged folders have READMEs.

Close W0.28.b + W0.6.f — set-state-in-effect cleanup, README backlog refresh · 0e3a6c0

W0.28.b: react-hooks/set-state-in-effect 144 -> 0 across ~104 files. Extracted useResetOnAccountSwap() to centralize the ~75-site SRC-BUG-*-SWAP convention; applied React's render-time-derivation pattern (and split sync-reset-from-async where needed) for the rest; a handful of genuine external-system sites (SSE seeding, portal/hydration flags, Embla subscription, storage/DOM reads) got narrow justified disables matching existing codebase precedent. Found and filed (not silently fixed) a real bug in ConnectionsPage…

Sync local changes · 5397161

Sync local changes · dc2db3f

Refresh 2 READMEs missed in the prior W0.28.a batch · 8704517

Refresh READMEs left stale by the W0.28.a commit · fd56966

Close W0.28.a — clear react-hooks/refs (72 sites, 59 files) · f358cf9

eslint-plugin-react-hooks@7.x's react-hooks/refs rule forbids reading or writing ref.current during the render phase. 58/59 files matched the dominant "keep a ref synced to the latest render value" idiom and were fixed identically: moved the assignment into a dependency-less useEffect so it re-syncs after every render, preserving exact behavior. Four sites needed real judgment instead of the mechanical pattern: - LoginOtpFields.tsx: a ref-touching callback passed into react-hook-form's handleSubmit() during render…

Refresh READMEs left stale by the W0.26 commit · 5f88de6

Close W0.26 — slot-aware orb height cap for narrow+short phones · 5a1d9f0

The originally-reported 360x640 overlap (W0.26.f) no longer reproduces on its own, but live browser measurement found the same class of bug worse on an even smaller real device the finding never tested: iPhone SE (320x568) overlapped the landing hero orb into the CTA by 23px. getLandingHeroBrandOrbSizePx now caps against a new LANDING_HERO_NARROW_SHORT_RESERVED_CHROME_PX (420px, empirically calibrated against both measured viewports) instead of the raw viewport height, scoped to the same narrow+short breakpoint (<…

Close W0.24 — API test suite already self-contained via W0.15 · 05d0dfb

Seeded and immediately closed: W0.15 (already-closed story) independently implemented exactly this story's option (a) — a mongodb-memory-server globalSetup for the main vitest project. Fresh no-flags `npm test` confirms the suite is genuinely self-contained now: 559 files, 1695 tests, 0 failures, no external Mongo required.

Close W0.14 — full web atomic offline suite green (1169/1169) · 1272cf8

Explicit i18n authorization given in-conversation, unblocking W0.14.g/h/i. Re-verified rather than assumed: all three were already resolved by earlier work (commit d33874b3's discovery/paywall i18n localization pass covered g's hardcoded-copy fix and i's untranslated de/fr/es/ar strings; W0.15.i's dead-code deletion removed h's fix target entirely). No new code changes needed for any of the three — just running each verify command confirmed green and reconciling the plan to match reality. Story acceptance gate: np…

Refresh tests/atomic/infra README after W0.14.k · 24d1074

Close W0.14.k — stale owner-regen-command assertion · 33721fc

productReadmeContractSsot.test.ts asserted the literal substring "npm run generate:api" in src/README.md, but the README's contract-first workflow section was intentionally rewritten to document the real owner command (pnpm --filter @ifeoma-tc/openapi-client-generator generate), mentioning generate:api only as a partial web alias. Updated the test to match current reality instead of reverting accurate docs to satisfy a stale assertion. W0.14.g/h/i remain open — untranslated-copy fixes gated on this repo's standing…

Close W0.12 — delete dead backgroundStyles.ts duplicate (W0.12.k) · 4b87eca

Explicit user approval obtained in-conversation after a full side-by-side comparison: design-[redacted].ts was a drifted, zero-importer duplicate of the live, tokenized lib/utils/backgroundStyles.ts (hardcoded colors vs. design-system tokens, missing the WebGL shader-stop helpers the discovery universe actually uses, a variant API nothing ever called). Traced to the repo's initial commit, pre-dating the design-system consolidation — uncleaned scaffolding, not a parallel approach worth keeping. Also cleaned the two…

Refresh READMEs left stale by the W0.12.q commit · 0ff62bd

Close W0.12.q — re-fix merge-reintroduced tsc regression · 4d14c31

A merge combined two independent branches' fixes to the same files without deduping: one added a useTranslations import / storageUnavailableLabel prop, the other (W0.12.m, already closed) had separately fixed the same files. Result: 21 tsc errors (duplicate identifiers, missing imports) across 9 files, none touched by this session until now. Removed the redundant duplicate import in 5 discovery/paywall button files, removed the duplicate optional storageUnavailableLabel prop from both Glass* disclosure components …

Repair W0.15 grammar corruption + refresh W0.12-touched READMEs · dd84732

A prior Edit inserting W0.14.k into plan/waves/WAVE-0.html swallowed the newline before the following W0.15 story line, merging them onto one physical line. The wave-consistency-scan line parser reads story declarations one per line, so this made W0.15's own story line invisible to it — surfaced as two class-D grammar-integrity findings ("W0.11 needs unknown ID: W0.15" and "W0.15.a is a sub-todo of W0.15, which has no story line"), a hard-stop condition per the wave-next skill. Fixed by restoring the missing newli…

Close W0.12.a-e — discovery SSE, chat translate, connections contract · 4aad062

- W0.12.a: add request.prefsHydrated to the discovery SSE effect's own dependency array (guard clause already checked it, deps array didn't). - W0.12.b: reachable + secured POST /api/chat/translate — exact-path proxy exclusion (not the whole "chat" segment, which has many live Fastify routes), session check, and a new per-IP rate limiter. - W0.12.c: useConnections' `connections` field is now `Connection[] | undefined` (undefined while pending/erroring/disabled), matching useConversations' sibling contract instead …

Extend scorecard-label-parity fixture (W0.10.l) · 2228201

The CL-001 cross-repo parity gate's 8 golden cases (only just wired to actually run, per W0.10.k) left 3 branches of the shared outcome-label algorithm uncovered: the message-count depth-component clamp, a breakup_reason outside {icebreaker,chat} correctly yielding null, and a depth score near the 0.45 threshold (existing cases sat at 1.0/0.1667, far enough that a moderate threshold regression wouldn't be caught). Extends src/config/scorecard-label-parity.json (the cross-repo SSOT) with 3 new binary-exact cases; b…

Refresh README staleness from W0.9 commit (finding class I) · bb53fca

plan/waves/README.md and src/apps/api/src/routes/profile/README.md were flagged stale purely because the W0.9 commit touched sibling files in the same folders. Content still accurate for both; left a note in plan/waves/README.md for future iterations to bundle wave-plan-only touches into the same commit as substantive changes to avoid this churn.

Normalize profile-route 412 error shape (W0.9) · 8779c6e

registerProfileReadRoutes.ts and registerProfileSecureRoutes.ts sent inconsistent 412 bodies ({error} only, or {error, code} without message) while their sibling registerProfileUpdateRoutes.ts already normalized to {error, message, code?} under AT-6.1. Applies the same shape to the remaining 4 sites across both files so all "profile missing profileId/ authUid" 412 responses are consistent repo-wide.

Fix findings from W0.6 close (evidence pointer, README staleness) · 99d8f6c

W0.6.c's completion note lacked a concrete evidence pointer (finding class G); added one with a verifiable command. plan/waves/README.md was flagged stale purely because the prior commit touched WAVE-0.html in the same folder — content is still accurate, added a verified-current note.

Close W0.6 — repo-wide README compliance backlog drained · b7aa380

All sub-todos (W0.6.a-e) verified and checked: 824 folders got a new or refreshed README.md via 34 parallel batch agents, plus a handful of gitignored-tracked-content and timestamp-stale edge cases fixed by hand. wave-consistency-scan now reports "consistent" with zero findings across all classes (A-J).

W0.6.a-d stragglers — gitignored-dir READMEs + 2 stale refreshes · 0fd3a60

Force-added README.md for 4 folders that carry legacy tracked files but are otherwise gitignored (generated/ output dirs), which the scan flags as needing a README same as any other tracked-content folder. Also refreshed 2 READMEs (docs/plans/, e2e app-shell-navigation helpers) whose content was already accurate but had gone stale by the scan's git-history timestamp heuristic — added a verified-current note rather than padding with no-op changes.

W0.6.a-d — repo-wide README coverage backlog drain · 825357f

Writes/refreshes README.md across every git-tracked folder flagged by wave-consistency-scan's finding class I (780 folders missing/stale as of 2026-08-16, per CLAUDE.md's "every folder needs a README" rule). Covers src/apps/web (569 folders), src/apps/api (161), src/apps/matching (23), and remaining scattered folders (docs/, plan/, score/, scripts/, src/apps/ml-service/, src/config/, src/packages/, src/scripts/, tools/) — new READMEs where none existed, refreshed content where the existing README had drifted from …

Close W0.40/W0.43 acceptance gates, evidence W0.5's parent claim · de708d3

Both W0.40 and W0.43 had all sub-todos checked but their own story-level verify never re-ran (finding class B). Re-ran each story's verify command (both pass clean) and closed the parent boxes with a completion note. Also strengthened W0.5's parent completion note with a concrete evidence pointer (grep counts proving 19/19 subs checked) per finding class G — the claim was already true, it just lacked a verifiable citation.

System atlas: relation diagrams, live wave-topics, and navigation (#33) · 1f49135

* Add relation diagrams and navigation to the system atlas Adds five Mermaid diagrams (system topology, auth/identity resolution chain, learning-wave pipeline, background-jobs process boundary, billing dual-store disconnect) with a CDN fallback so they render standalone outside the Artifact viewer. Adds a live filter, scroll-spy nav, collapsible tables, and reading-progress/back-to-top controls so the page stays navigable at this density. * Add a Wave topics section documenting live wave-state access Surfaces the …

File 8 auth/cron bug-audit findings under W0.121 · d1e29ba

Recovered from an abandoned stash (pre-existing unlanded TODO(bug-audit) comments on live auth/cron/passkey/profile-picture code) that was about to be deleted as cleanup. Files each as a COMPLIANCE sub-todo instead of merging inline TODOs, per this repo's "every found bug goes into the wave plan" policy.

Finish repo-path fixups from vendoring, commit runtime config data · 43f428f

Vendoring moved ml-service from horizontal-services/machine-learning into src/apps/ml-service; update docs/READMEs and a script test to reference the new in-repo paths instead of the old sibling-repo layout, and commit the config data files (learning policy, intent weights, UI bands, match schema, contracts drift manifest) the service reads at runtime — previously untracked despite the repo's .gitignore already allow-listing them.

Add TrueConnection system atlas for bug-hunting (#31) · 15974d4

Repo-wide inventory of web/API/matching/ml-service routes, services, config, and infra, plus a consolidated list of self-flagged weak points, to help target specific system elements for bug hunting. Claude-Session: https://claude.ai/code/session_01B4Atyvgd8uAoJqZE4FbW2x

Add bug-hunt round 9 findings to WAVE-0 (W0.66-W0.71) · 2a5b77f

Fifth multi-agent sweep, explicitly backend-focused: six agents covering config/constants/types/generated, the remaining lib/ modules (connection-statements/matches/orbVisuals/journey-banks), the Node-side ML adapter layer, services/match internals, Zod-schema content and error-response-shape consistency, and a final targeted services/ gap-check on the two least-scrutinized directories by prior-round citation density. 15 verified findings. Most notable: NEXTAUTH_SECRET (the core auth-signing secret for compat JWTs…

Add TrueConnection system atlas for bug-hunting · b2be4a5

Repo-wide inventory of web/API/matching/ml-service routes, services, config, and infra, plus a consolidated list of self-flagged weak points, to help target specific system elements for bug hunting. Claude-Session: https://claude.ai/code/session_01B4Atyvgd8uAoJqZE4FbW2x

Add bug-hunt round 8 findings to WAVE-0 (W0.60-W0.65) · 0bbc1ee

Fourth multi-agent sweep, explicitly frontend-focused: six agents covering profile/onboarding/ratings, journey UI + design-system accessibility, discovery UI (3D universe/filters/pagination), paywall UI/pricing display, landing/public/i18n/RTL, and auth-client UI + routing + provider composition. 22 verified findings. Most notable: the shared BaseModal primitive behind 35+ modals has no focus trap or restoration at all, directly contradicting this repo's own stated accessibility rule; /dev/* operator-tooling pages…

Add bug-hunt round 7 findings to WAVE-0 (W0.54-W0.59) · c04a693

Third multi-agent sweep, this time explicitly end-to-end: six agents each traced one full user journey across every layer it touches (client -> BFF -> backend -> matching/ml-service -> Mongo, and back), hunting for bugs that only exist because of the seam between layers rather than within a single file or service. 16 verified findings. Most notable: cross-provider sign-in on the same mailbox silently orphans a user's chat/connections (they key on raw authUid, which flips on account-linking, instead of the stable p…

Close email-rebind trust gap in shared profile provisioning + admin self-registration bootstrap (W0.63.a/b) · 606f553

Bug-hunt round 11: 15 parallel sub-agents swept every backend submodule plus the web BFF layer for correctness/security defects. W0.63.a (critical): ProfileProvisioning.getOrCreateProfile — the shared SSOT used by ~10 call sites (profile read/update/picture/journey routes, passkey registration, internal get-or-create-profile) — had no emailTrustedForLinking gate at all, unlike platformRbac.ts (W0.31.b) and the /api/users pre-check (W0.62.a). Any authenticated call carrying an attacker-controlled email claim matchi…

Bug-hunt rounds 5-6: 44 findings added to WAVE-0 (#29) · 10cdf9e

* Add bug-hunt round 5 findings to WAVE-0 (W0.38-W0.45) Multi-agent audit across every backend submodule (auth/session, profile/journey, chat/push, connections/discovery/matching, admin/billing/paywall, the Python matching service, the previously unaudited ml-service, plus a lighter web/contracts/config pass). 21 verified findings, most severe: RCE via trust_remote_code with a caller-controlled modelId on a fully unauthenticated ml-service API (W0.38.a/b), non-expiring/unrevocable internal bearer tokens for non-OI…

Log bug-hunt round 6 findings (13-agent follow-up sweep) · f8393dc

Ran a second wave of 13 parallel read-only agents targeting areas the round-5 sweep hadn't reached yet: Universe3D WebGL rendering internals, chat presence/connections-consent UI, onboarding, native-shell/mobile bridge, admin's non-Questions sections, design-system forms, the compatibility radar chart, backend ProfileService/DiscoveryQueryService, backend billing/entitlement edge cases, and matching-service core scoring math. Spot-verified the two highest-severity claims directly before writing them up: the native…

Add bug-hunt round 6 findings to WAVE-0 (W0.46-W0.53) · 3152744

Second multi-agent sweep into territory rounds 4-5 didn't reach: untouched api libs ([redacted]), api sim-[redacted], the matching-service's infrastructure/jobs/application/domain layers, a deeper ml-service pass, web chat/discovery/realtime hooks, web admin/PWA/native-shell/service-worker, the repo's own scripts/ tooling, and Docker/compose config. 23 verified findings. Most notable: two new live instances of this repo's own hard "no cross-repo filesystem reach" rule in scripts/ (verify.sh and check_clean_arch_to…

Fix W0.43.b: field-allowlist admin bulk profile upload before insert · c588f3e

AdminBulkUploadProfileItem is .passthrough(), and the bulk-upload handler spread the raw validated item straight into insertOne -- any extra JSON field a caller included survived unfiltered into the profiles document. Exported ProfileService's own audited PROFILE_UPDATABLE_FIELDS allowlist and reused it (single source of truth) plus questionAnswers/connectionRatings, the two journey-map fields this bulk-insert path is specifically meant to accept. normalizeBulkProfilePayload now filters the raw item through this a…

Fix W0.40.a: close the reflection/connection-rating limit check-then-act race · 65ecdf2

POST /api/profile/answer and POST /api/profile/connection-rating gated their paid journey limits with a check-then-act race: the route read a profile snapshot, the paywall assertion counted "used" from that in-memory snapshot, and only after the check passed did an atomic per-key $set write run. Two concurrent requests for two different keys both pass the same stale check and both commit (no natural write conflict, different sub-keys), letting a free-tier user exceed unlockedReflectionMax/unlockedConnectionMax. Fi…

Fix W0.40.c: bound SaveProfileAnswerRequest.answer to 2000 chars · 7409d6c

The only prior ceiling was Fastify's ~1MiB default body limit -- unlike comparable free-text fields in the same OpenAPI file (chat message body capped at 2000) and sibling profile fields bio/interests which do have explicit bounds. That unbounded text was read verbatim by the matching service's NLP/Qwen pipeline (W0.37.e closed the matching-service side of that gap; this closes the actual ingress point). Added maxLength: 2000 to the OpenAPI SSOT and ran the full contract pipeline; the route already validates again…

Partially fix W0.37.c: make the wave-calibration outbox write idempotent · 3a5f3a3

The WAVE_CALIBRATION_COMPLETE outbox write was a plain insert_one with no uniqueness constraint -- two overlapping wave-run triggers computing the same wave_index would each create a duplicate outbox row, and run_outbox_publisher_once would process both independently (duplicate downstream fan-out for one logical wave). aggregate_id is already deterministic per wave_index, so switch to an idempotent update_one(upsert=True) keyed on it -- the second commit for a wave index becomes a no-op instead of a duplicate row.…

Fix W0.37.e: bound free text into the NLP/Qwen fact-bundle pipeline · ee93e8c

GroundedFactEntry/GroundedFactBundle had no maxLength/maxItems -- a resource-exhaustion vector into the on-VM Qwen/NLP engine, since QwenGenerateRequest.maxNewTokens only bounds the model's output, not the input prompt built from facts. Added maxLength: 200/4000/200 for key/value/source and maxItems: 100 for facts in the OpenAPI SSOT, hand-mirrored into the generated contract_models.py, plus matching bounds directly in grounded_validate.py::validate_fact_bundle -- this repo's own second independent validation gate…

Fix W0.37.d: offload blocking learning-wave/item-stats work off the event loop · fd9a4f4

learning_wave_run_once() and recompute_match_item_stats() called fully synchronous, long-running Mongo work directly inside their async def route handlers with no run_blocking offload, unlike the established affect_recompute.py/internal_qwen.py pattern. The Dockerfile runs a single uvicorn worker, so this blocks every other request -- including the health check -- for the full duration of a wave run or a full-profile-collection item-stats scan. internal_learning.py's route now wraps the wave runner in run_blocking…

Fix W0.37.b: mongo egress retry classifier missed real transient errors · b782dbb

_is_transient() matched on exception class-name substrings ("Transient"/"Connection" in name), which the real pymongo exceptions that occur in production (AutoReconnect, NetworkTimeout, NotPrimaryError, ExecutionTimeout) don't satisfy -- confirmed empirically against the installed pymongo classes. The retry/backoff loop was dead code for real transient errors: a routine Mongo blip during a wave commit surfaced as an immediate hard failure, discarding the whole computed wave. Now checks isinstance(exc, (ConnectionF…

Fix W0.37.a: reject Infinity, not just NaN, in scorecard wire parsing · 9afc42f

not float(x) == float(x) rejects NaN (self-inequality) but Infinity equals itself in Python, so it silently passed as "finite". An Infinity mirt_at_entry reaches the learning gate's Pearson-correlation check, which returns nan on an infinite input; the gate's regression comparison treats nan as "not regressed", silently disabling half of the dual-measure safety gate for that wave. Switch to math.isfinite() for mirt_at_entry, completed_at, and duration_sec in scorecard_wire.py, plus the identical anti-pattern found…

Add bug-hunt round 5 findings to WAVE-0 (W0.38-W0.45) · 3a4fdf9

Multi-agent audit across every backend submodule (auth/session, profile/journey, chat/push, connections/discovery/matching, admin/billing/paywall, the Python matching service, the previously unaudited ml-service, plus a lighter web/contracts/config pass). 21 verified findings, most severe: RCE via trust_remote_code with a caller-controlled modelId on a fully unauthenticated ml-service API (W0.38.a/b), non-expiring/unrevocable internal bearer tokens for non-OIDC logins (W0.39.a), and cross-user native push notifica…

Fix W0.60: clamp unbounded skip on GET /api/admin/match-index · 3a90289

skip had a floor (Math.max(0, ...)) but no ceiling -- the only unbounded .skip( call in src/apps/api/src, forcing an expensive full index-order Mongo traversal proportional to skip for what should be a small page. Clamp it to 10_000, matching adminUserReportsQuery.ts's existing cap for the same shape of admin-list pagination. Full suite: 558 files / 1678 tests passing. Claude-Session: https://claude.ai/code/session_01Q9dMirG3UrE1SG3VRvBuQz

Log bug-hunt round 5 findings (15-agent, frontend-weighted) · d055629

Ran 15 parallel read-only investigation agents across every submodule (web frontend weighted heaviest per explicit direction, plus api, matching, ml-service, and contracts) to find real correctness/security/ race-condition bugs beyond the 4 prior bug-hunt rounds already logged in this file. Spot-verified the three highest-severity claims directly before writing them up (report/block requests sent with no auth header due to route misclassification; missing viewerPressedReveal wiring stalling mutual chat reveal; uns…

Fix W0.46: reap dead SSE discovery/events connections on an idle timeout · 6493893

GET /api/discovery/events had no dead-peer/timeout reaping — cleanup (unsubscribe listeners, clear heartbeat interval) ran only from the socket's "close" event, which requires the kernel to notice the TCP connection died. A silently-dead connection (mobile NAT drop, backgrounded app killed without a clean FIN) leaked its listener closures and heartbeat handle for as long as Linux's TCP retransmission takes to give up (15-30+ minutes), with no cap on concurrent leaked entries. Set an explicit 75s idle timeout (3x t…

Fix W0.62.e: internal bearer token parser inconsistency + dot-guard · 2227907

The Fastify backend's internal-bearer-token verifier accepted parts.length < 4 (silently ignoring anything past the 4th segment) while the Next.js BFF-side verifier required exactly 4 — now both agree. Neither buildInternalAccessToken mint function (API-side or web-side) enforced that authUid is dot-free, even though the token format splits on "." and the web verifier's own doc comment already documented that requirement; both now throw if authUid contains a dot, matching the guard that already existed only in ens…

Fix W0.62.d: bound Qwen generate's unbounded systemInstruction field · d90a01c

POST /api/internal/qwen/generate's systemInstruction was completely free-form and unbounded, occupying the highest-trust position in the prompt with no size cap — a compromised internal caller (this route's only gate is the shared secret) could inflate prompt size/cost arbitrarily. Both real callers already hardcode fixed short strings, so add maxLength: 500 to the OpenAPI SSOT and the generated Pydantic model (no local codegen script exists for this contract in this repo, so hand-updated to match); FastAPI now re…

Fix W0.62.b: chat read-watermark regression race · b7ad947

markMessagesRead's prior-watermark findOne used to run before withMongoTransaction started, so it never participated in the transaction's write-conflict retry — a concurrent mark-read call could commit a further-advanced watermark in between this call's stale read and its write, silently regressing the stored value. Move the prior read inside the transaction (passed the session) so a write conflict forces a retry that re-reads prior fresh; watermarkKey was already max(furthestUnread, prior), so this closes the reg…

Fix W0.62.c/f: synthetic-profile bootstrap batch isolation + billing renewal EOM overflow · b503f08

W0.62.c: SyntheticProfileLifecycleService.bootstrapProfiles no longer aborts the whole batch on the first invalid seed or failed match recalc — both loops now accumulate per-item errors and return partial results, matching every sibling bulk admin route's existing pattern. Admin bootstrap/generate routes surface the new errors[] field; OpenAPI SSOT updated and contract pipeline re-run. W0.62.f: services/billing/EntitlementService.ts's applyCheckoutCompleted used raw setMonth arithmetic for its synthesized renewsAt…

Fix W0.62.a (critical): unverified-email account takeover via self-registration · d922c75

POST /api/users creates a Zitadel human user with isEmailVerified: true hard-coded, with zero actual mailbox-ownership proof, then passed that self-asserted email straight into ensureProfile — letting ProfileService.getOrCreateProfile silently rebind any EXISTING profile already keyed on that email (created via Google/Zitadel-OIDC/passkey/ magic-link, none of which mint a Zitadel "human" user, so Zitadel's own directory has no conflicting record to reject the attempt) onto the attacker's new authUid. Full account …

Fix W0.58.a and W0.58.b: handle invoice.paid and past_due Stripe events · 24dff91

W0.58.a: invoice.paid events normalized fine but applyNormalizedEvent's if-chain had no case for them, so they silently no-oped — worse, the idempotency ledger already burned the event's slot before the no-op, so a future fix could never reprocess historical deliveries. Adds an explicit, documented no-op branch (the normalized event carries no period/line-item data to reconcile against, and subscription.updated already fires for the renewal case). W0.58.b: subscription.updated with status:"past_due" matched neithe…

Fix W0.59: swallow duplicate-key race on two idempotent viewer-ack upserts · d52ac2b

recordViewerIcebreakerCompleteCelebrationSeen and recordViewerPeerDismissal both do an upsert() against a collection with a unique index on exactly their filter, but neither caught the E11000 a concurrent double-tap/ client-retry/two-tabs race produces — the loser fell through to a generic 500. For acknowledge-unavailable-peer specifically this was worse than a spurious error: by the time the race hits this write, endConnection, the matches cleanup, and the chat-session delete had already succeeded for both racing…

Fix W0.43.a: replace fragile substring error matching in paywall routes · 4e4af9d

POST /api/paywall/subscriptions and POST /api/paywall/purchases caught error instanceof Error && error.message.includes("required") and echoed the raw message at 400 — the exact fragile-substring-matching anti- pattern lib/http/README_TYPED_ERROR_ROUTING.md documents as the reason ServiceValidationError/ServiceConflictError exist. Any future throw whose message happened to contain "required" would have been silently downgraded from 500 to 400 with its raw message shown to the caller. All 5 validation-failure throw…

Fix W0.42.b: bound /api/health/ready's Mongo ping to a fixed timeout · ead120c

healthCheck()'s admin().ping() had no operation-level timeout — serverSelectionTimeoutMS only bounds finding/connecting to a server, not an already-connected server that stops responding (long stall, mid- election, GC pause). A hung-but-connected primary could make the readiness probe hang indefinitely instead of failing fast, defeating the purpose of a readiness check. healthCheck() now races the ping against a 3000ms timeout, returning false the moment the deadline passes — a scoped, health-check-local fix rathe…

Fix W0.35.d: thread Stripe's real period-end through subscription.updated · 9471e8b

applySubscriptionUpdated discarded the real Stripe billing-period end (already correctly computed by stripeWireHelpers.ts::subscriptionRenewsAt and carried on the normalized event) by delegating to applyCheckoutCompleted, which always synthesized renewsAt as "now + termMonths" regardless of what was passed. Since subscription.updated fires for many non-renewal reasons while a subscription stays active (payment-method change, coupon application, metadata edits), the mirrored renewsAt drifted later than reality on e…

Fix W0.36.a and W0.36.b: cap admin bulk-import/bootstrap payload sizes · 500ead8

W0.36.a: POST /api/admin/questions/answers-import had no cap on body.questions.length/body.profiles.length, unlike every sibling bulk endpoint (questions/bulk, connection-statements/bulk, profile bulk-upload all cap at 1000). Adds the same 1000-item cap, enforced in parseQuestionAnswersImportBody before any per-item parsing or Mongo work, for both the bare-array and {questions, profiles} body shapes. W0.36.b: POST /api/admin/synthetic-profiles/bootstrap only checked profiles.length === 0, no upper bound, unlike it…

Fix W0.40.b: bound POST /api/ratings' rating value to the documented 1-10 scale · ad04d0b

SaveRatingRequest.rating had no minimum/maximum in the OpenAPI contract even though the schema already documented "Rating value on the 1-10 scale" and the sibling connectionRatings field already defends the same range at read time — an out-of-range value like -999999 was stored and returned verbatim by GET /api/ratings. Adds minimum: 1 / maximum: 10 to both Rating.rating and SaveRatingRequest.rating in the OpenAPI SSOT, regenerated per the contract edit order (API/web zod schemas, web API types/openapi.json). The …

Fix W0.39.a: strip EXIF/GPS metadata from chat photo uploads · bd8d323

Chat photo uploads were written to storage byte-for-byte with no re-encode, unlike profile pictures which always go through a sharp re-encode pipeline that strips EXIF. A photo taken with location services on and sent as a chat message preserved its GPS EXIF tag through to the recipient byte-for-byte — a deanonymization/stalking vector on a dating app where matches are frequently strangers meeting for the first time. New lib/chat/chatPhotoMetadataStrip.ts decodes a type:"photo" upload via sharp, applies .rotate() …

Close W0.31.c web-side unverified-email account-linking gap · 7c7434f

resolveZitadelProfileEmail now only returns an email ZITADEL asserted as email_verified: true, from both the userinfo and id_token branches. This closes the NextAuth-side entry point of SRC-BUG-UNVERIFIED-EMAIL-PROFILE-REBIND (nOAuth-class account takeover): a self-controlled ZITADEL account with an unverified/spoofed email claim could otherwise have its profile lookup key match another user's verified profile, letting one authUid inherit another's data via ensureProfile/resolvePlatformRoleFromMongo. The Fastify-s…

Fix W0.42.a: add overlap guard to match-recalc and retention-purge cron jobs · 3b94929

MATCH_RECALC_CRON and CHAT_MESSAGE_RETENTION_PURGE_CRON had no overlap guard — node-cron fires the next tick regardless of whether the previous invocation finished, so a slow run (match recalc growing with profile count, retention purge slowing under storage latency) could overlap with the next tick, doubling Mongo/storage load and, for match recalc, racing writes to matches. Applies the same in-flight-boolean pattern already used by the learning cycle job in this same file to both jobs. Claude-Session: https://cl…

Fix W0.35.a and W0.34: subscription renewal EOM overflow, icebreaker race · 5541c21

W0.35.a: computeSubscriptionRenewsAt used raw setUTCMonth arithmetic with no end-of-month clamping — a subscription started 2026-01-31 with a 1-month term renewed at 2026-03-03 instead of 2026-02-28, granting bonus paid-tier days on every renewal started on the 29th-31st of a month. Now clamps the target day to the real last day of the target month before setting year/month/day atomically. W0.34: submitIcebreakerStep's CAS filter was {connectionId, stage: "conversation_active"} only, which doesn't change across a …

Close unverified-email account-takeover on the Zitadel bearer/compat-JWT path · b9a48bc

ProfileService.getOrCreateProfile and platformRbac both rebind an existing profile's authUid to whatever caller presents a matching emailNormalized, with no check that the IdP actually verified that email. The OIDC callback routes already had a named fix for this exact CVE class (isEmailTrustedForAccountLinking, nOAuth / CVE-2026-53516 / CVE-2026-64665 / GHSA-6g38-8j4p-j3pr) but it was only wired into the two /api/oidc/callback/* routes' ensureProfile call, not the per-request Zitadel bearer-token path (middleware…

Fix W0.35.c: TOCTOU double-charge race on profile picture reveal · d991cae

recordProfilePictureReveal previously did a plain read (hasProfilePictureRevealGrant) followed by a separate atomic usage increment (recordUsageConsumption) with no join against pictureRevealGrants.profileIds — two concurrent reveal requests for the same profile could both pass the read and both increment usage.dailyPictureReveals, charging one photo reveal as two quota units. Folds the "already granted" and "increment usage" checks into a single atomic findOneAndUpdate (usage.dailyPictureReveals: {$lt: limit} AND…

Fix W0.61.a-d: NoSQL injection, picture-reveal reset, Qwen timeout/injection · 2730a93

- W0.61.a: reject non-string userId on POST /api/internal/recalculate-matches before it reaches Mongo filters (mirrors the AT-20.10 guard). - W0.61.b: EntitlementService.loadNormalizedDocument's stale-reset write-back now also persists pictureRevealGrants, so a cross-day picture reveal actually clears yesterday's revealed-profile list instead of growing it forever. - W0.61.c: add a 30s AbortSignal timeout to all three Node -> matching-service Qwen fetch calls in groundedQwenMlClient.ts. - W0.61.d: frame the Qwen f…

Close W0.33.b (sameIntentOnly half) — wire dead discovery filter flag · 0e6ffec

sameIntentOnly/astrological discovery query flags were parsed and paywall-entitlement-gated by GET /api/discovery/profiles but never passed into DiscoveryQueryService.getDiscoveryProfiles — paying users got charged the entitlement check with zero effect. lib/matching/matchIntentScopeAlignment.ts's passesStrictDiscoveryMatchIntentScopeFilter already existed, fully implemented, just never called anywhere. Wired it in: getDiscoveryProfiles now resolves the viewer's own stored discoveryMatchIntentScopeId when sameInte…

Close W0.33.a — blocked-peer intent-change leaked via discovery SSE/push · dfb5d18

emitDiscoveryPeerIntentUpdated fanned out a peer's intent-scope change to every viewer with a materialized match against them, with zero block check — unlike every other discovery/connections/chat read path in this codebase. A blocked peer's activity still reached the blocking viewer's open SSE tab and could trigger a Web Push notification naming the blocked person. matches.userId (the viewer side of a row) is an authUid, so assertViewerPeerNotBlocked's authUid+authUid signature doesn't fit directly here — only th…

Close W0.41 — device push token cross-account leak on shared devices · 9e2ec9f

POST /api/device/token upserted on (userId, platform) only, with no check that the token wasn't already owned by a different userId — unlike the sibling PushSubscriptionService (Web Push), which does an ownership-scoped upsert for exactly this class of bug. On a shared/family device, APNs/FCM hands the same native token to whichever user is currently logged in; the old owner's stale row stayed live, so their next push notification (chat message, new match, connection request) was delivered to what is now a differe…

Close W0.52 — admin email leaked via createdBy on public bank reads · 96b5a98

GET /api/connection-statements and GET /api/questions (any authenticated regular user) both echoed createdBy — the admin's real Zitadel login email recorded at bulk-upsert/create time — via serializers shared verbatim with admin-only surfaces, and the OpenAPI contract documented it as a real public response field. ConnectionStatementService.serializeConnectionStatementDocument now omits createdBy outright: there's no admin-facing read endpoint for that bank at all (the bulk-upsert route only ever returns counts), …

Close W0.38 — X-Forwarded-For rate-limit bypass · bf1f146

Every unauthenticated per-IP rate limiter re-parsed the raw, client-controlled X-Forwarded-For header and took its leftmost entry, in preference to request.ip (already correctly proxy-aware via Fastify's trustProxy: true + @fastify/proxy-addr). A client sending its own X-Forwarded-For value picked a fresh, empty rate-limit bucket on every request, defeating the email-enumeration guard and every other unauthenticated per-IP limiter (pre-auth passkey routes, registration, diagnostics ingest). New lib/http/resolveCli…

Close W0.30 — paywall purchase/subscription endpoints minted paid entitlements for free · ad6f8db

POST /api/paywall/purchases and /subscriptions granted real tier upgrades and add-on entitlements to any authenticated user with zero payment verification (SRC-BUG-BILLING-DUAL-ENTITLEMENT-STORES). Meanwhile a real completed Stripe payment updated billingSubscriptions but never reached userEntitlements, the store every tier/usage check actually reads — so paying customers' upgrades had no effect either. Maintainer chose "collapse to one store": billingSubscriptions becomes the gate every write into userEntitlement…

Unlock journey answer caps for the dev-bypass mock user only · d0ccb38

EntitlementService's free-tier drip limit on reflection/connection answers was blocking DEV_AUTH_BYPASS local testing from ever reaching Universe, with no way to complete the journey short of standing up real billing. Gate the unlock on the same SSOT the rest of the codebase already uses for dev-bypass (env + self-locking Mongo/filesystem checks, never exposed via any route or admin toggle) and additionally scope it to the literal dev-user-123 mock authUid, so it can never affect a real user's entitlements even if…

Close W0.53 — E2E-seed routes had no second gate beyond the internal secret · 6014e41

`/api/internal/e2e/*` (seed-conversation-request, seed-peer-profile-deleted, ensure-discovery-peers, ensure-simulation-worker) were reachable given only a leaked `INTERNAL_API_SECRET`, with two of them destructive against arbitrary real profile/connection data. Investigated devBypassGate.ts's two-signal pattern as a template, but a blanket NODE_ENV!=production gate would break this repo's real E2E-against-stage workflow (env.ts has no distinct staging value, and internal_api_seed.ts confirms Playwright hits these …

Fix W0.31: unverified-email account takeover in platformRbac.ts · d5e3ff2

resolvePlatformRoleForAuthUid rebound an existing profile's authUid to any caller presenting a matching but IdP-unverified email claim, on essentially every authenticated request (internal bearer, native-shell JWT, and plain ZITADEL JWT alike, via middleware/auth.ts's withPlatformRole). The exact CVE-class fix for this bug (nOAuth / CVE-2026-53516 / CVE-2026-64665) already existed in this codebase as isEmailTrustedForAccountLinking, but was wired only into the two OIDC callback routes, not this independent, always…

Add bug-hunt round 8 findings (5 stories, 11 sub-items) to WAVE-0 · bf0e089

Six more parallel adversarial bug-hunt agents (WebAuthn/passkey ceremony, Node-side backend match calculation, database index/schema correctness, Stripe webhook event normalization, connection state-machine edge transitions, pagination cursor tamper-resistance) surfaced 10 distinct new defects; the WebAuthn agent returned a clean result (no live defect in challenge entropy, replay protection, RP ID/origin checks, credential scoping, or signature-counter anti-clone enforcement) and one Stripe finding turned out to …

Add bug-hunt round 7 findings (5 stories, 15 sub-items) to WAVE-0 · 9240312

Six more parallel adversarial bug-hunt agents (admin question-bank/ psychometric audit, discovery mutation endpoints, analytics/state/ export endpoints, E2E-seed/migration/misc public endpoints, admin match-diagnostics math + synthetic profile generation, i18n backend + platform-settings/feature-flag resolution) surfaced 15 distinct defects. Every finding was independently re-verified against current code before being added; one reported finding (picture-reveal race reachable via a new route) was correctly identif…

Add bug-hunt round 6 findings (6 stories, 11 sub-items) to WAVE-0 · 3041f80

Six more parallel adversarial bug-hunt agents (NextAuth internal CRUD routes, SSE/realtime connection lifecycle, storage/GridFS orphan cleanup, Python matching core scoring algorithm, Zitadel JWT/JWKS internals, secrets/logging/config hygiene) surfaced 11 distinct defects. Every finding was independently re-verified against current code before being added. Notable: two admin delete paths (clearAllProfiles, the generic collection-delete route) bypass the dedicated picture-cleanup service entirely, permanently orpha…

Add bug-hunt round 5 findings (7 stories, 13 sub-items) to WAVE-0 · da3d47e

Six more parallel adversarial bug-hunt agents (profile/journey, media/file handling, push/device, cross-cutting middleware, background jobs/health, Node<->Python integration) surfaced 12 distinct defects (two agents independently converged on the same X-Forwarded-For rate-limit bypass, and two independently found the same unbounded profile-answer field — merged into single items rather than duplicated). Every finding was independently re-verified against current code before being added. Headline: W0.38 is a rate-l…

Replace leftover contract-management generate-all instructions with the in-repo pnpm filter command. · a347947

Add in-repo OpenAPI client generator package · ebdeed5

Enroll @ifeoma-tc/openapi-client-generator in the pnpm workspace so product Axios, types, and Zod regen runs inside this repo instead of contract-management.

Pin web OpenAPI generate scripts to the owner SSOT · c05c010

Stop honoring OPENAPI_SPEC_PATH and WEB_CLIENT_GENERATED_DIR so product client regen always writes from packages/contracts into src/apps/web.

Replace the hand-mirrored matching client schemas with a generator from the owner matching spec, and materialize that file in API pretest. · 7b6150f

Vendor the ML engine into src/apps/ml-service · 0f2c2e2

Copy the stateless compute engine from app-infra-services so True Connection owns the runtime in-repo and compose can start it behind the full profile.

Add bug-hunt round 4 findings (7 stories, 17 sub-items) to WAVE-0 · 0285872

Six parallel adversarial bug-hunt agents (auth/session, discovery/ matching, connections/chat, billing/paywall, admin authorization, Python matching service) surfaced 17 concrete backend defects, each independently verified against the current code (several reproduced directly: JS Date month-overflow, IEEE754 Infinity self-equality defeating a NaN-only finiteness check, pymongo exception class names against the transient-retry classifier) before being added. Headline: W0.31 is a critical, currently-live account-ta…

Don't overwrite a caller-supplied MONGODB_URI just because it lacks credentials · fbc3f2d

docker-entrypoint-mongodb.sh treated "no @ in MONGODB_URI" as "incomplete, reconstruct it with credentials" -- but this repo's own root docker-compose.yml runs Mongo without --auth (see the matching service, which connects the same way with no credentials and works fine), so a caller-supplied credential-less URI is valid and complete, not a signal to invent bogus appuser/apppassword credentials. Verified empirically: a no-auth mongod rejects any client that supplies credentials at all ("Authentication failed"), so…

Write standalone-full-stack runbook, update plan 26 with actual status · 65d9136

Documents the new app/full docker-compose profiles (docs/runbooks/standalone-full-stack.md, linked from docs/runbooks/README.md) and updates plan 26's work list / open questions to reflect what actually shipped this pass (ml-service vendoring + the app profile) versus what's still deferred (mongo/redis vendoring -- reconsidered, not needed; Zitadel -- deferred as its own follow-up; contract codegen -- needs a second generator, not done).

Resync package-lock.json with package.json (eslint ^9.39.5 drift) · 32ab2d9

package-lock.json still pinned eslint@10.5.0 after a prior package.json bump to ^9.39.5, which `npm ci` rejects outright (EUSAGE, lockfile out of range) -- surfaced by actually running `npm ci` in the web Dockerfile's deps stage for the first time via the new containerized `app` compose profile. package.json itself is unchanged; this is a straight `npm install --package-lock-only` resync.

Vendor real ml-service, containerize api+web for self-sufficient docker compose · 7f8dbc9

Adds two opt-in docker-compose profiles so the product runs fully self-sufficiently with nothing outside this git root: - `app`: containerizes api + web themselves (they previously had to run via `npm run dev` on the host). Uses the existing but previously-unwired "dev" build stage in each Dockerfile. Identity stays DEV_AUTH_BYPASS=true -- no real ZITADEL yet. - `full`: real ml-service (NLP/entropy/Qwen compute), vendored wholesale from the sibling app-infra-services repo per docs/plans/26-standalone-runtime-vendo…

Fix stale Stripe API version SSOT, record real full-suite baseline in WAVE-6 · 522b0cd

Running the full src/apps/api Vitest suite for the first time in this session's environment (after pnpm install --frozen-lockfile, no node_modules had been installed) surfaced one real failure: STRIPE_API_VERSION in stripeWireHelpers.ts still pinned "2026-06-24.dahlia" while src/pnpm-lock.yaml now resolves stripe@22.5.0 ("2026-07-29.dahlia") — a plain drift of the documentation/test-SSOT literal behind the lockfile, not the drifted-node_modules mistake the comment's own W0.14.j history warns against (confirmed aga…

Add WAVE-6 backend-only API use-case audit, flag paywall bypass, fix hardcoded paths · f74e09d

WAVE-6 audits every product capability (WAVE-5) against product.openapi.yaml and matching.openapi.yaml to confirm which use-cases are completable through the backend API alone, ignoring the web frontend. Six parallel domain audits (auth/identity, onboarding/profile/journey, discovery/matching+ML, connections/chat/push, admin/platform ops, billing/cross-cutting) verified real route/service implementations and test files, surfacing real gaps: peer legal names ship unconditionally on discovery responses at every disc…

Sync local changes · 3147159

Commit Next.js-generated agent rule files · 8b82120

next dev auto-writes src/apps/web/{AGENTS,CLAUDE}.md on every run; committing them (as Next.js itself recommends) keeps the working tree clean instead of leaving them perpetually untracked.

Clarify former infra services live in sibling app-infra-services repo · 4a4b0e2

Adds a note under Infrastructure dependencies so readers checking out this repo under a shared parent directory alongside its infra siblings know where the former (pre-split) infra services actually live -- app-infra-services, over HTTP, per the repo boundary rule in CLAUDE.md -- rather than assuming they were vendored back into this repo.

Mark branch deprecated (superseded, closed without merge) · dff4277

Mark branch deprecated (merged via PR #23) · 66ec403

Mark branch deprecated — superseded, merged into main · 4b0f40c

Mark branch deprecated — superseded, merged into main · a41a296

Mark branch deprecated — superseded, merged into main · 1c22625

Mark branch deprecated — superseded, merged via PR #17 · 7785d61

Mark branch deprecated — superseded, merged via PR #18 · b0bc5c8

Mark branch deprecated — superseded, merged via PR #15 · 9784f53

Mark branch deprecated — superseded, merged via PR #19 · 8e49795

Mark branch deprecated — superseded, merged via PR #14 · 604b25c

Mark branch deprecated — superseded, merged via PR #20 · f8403d9

Mark branch deprecated — superseded, merged via PR #13 · ea3e1c6

Apply follow-up fixes not carried by the parallel branch consolidation · 36c288c

The claude/merge-workstreams-cujdxo branch this repo used for the multi- branch consolidation was already merged into main (PR #24) by a parallel effort while this branch was independently reconciling the same set of outstanding claude/* branches. Restarted this branch from the latest main per the merged-branch protocol and carried forward only the content still missing from main after that merge, rather than replaying the already-merged history: - claude/i18n-localize-discovery-paywall-copy never landed anywhere:…

Deduplicate bad-merge artifacts, resync stale locale bundle · 45d1291

main was broken: several independent branches merged in quick succession each added the same fix independently, and the merges concatenated instead of deduplicating, leaving: - storageUnavailableLabel declared twice in the same object-type literal (GlassDisclosureSection, GlassStepDisclosure) — tsc duplicate-identifier. - parsePaywallLimitError imported three times in useConnectionManagerWorkflow.ts. - readEnrichedDiscoveryDisplayScore imported twice in DiscoveryUniverseAiRecommendationTeaser.tsx and useDiscoveryP…

Land the duplicate-mock removal from the previous merge commit · 05537b1

The Edit-tool fix removing the duplicated 'const stableAuthUser' / vi.mock('@/features/auth/useAuth') block (surfaced by actually running the suite, not by any conflict marker — see the previous commit's message) was made on disk but never staged before that commit landed. It sat as an uncommitted working-tree change through the clean web-regression-hunt-round-3 merge, which didn't touch this file. Landing it now, verified still needed: the duplicate is exactly what the previous commit's message already described …

Localize discovery/paywall copy, close remaining i18n suite failures · d33874b

`main`'s independent bug-fix work (button presets, discovery score SSOT reads, tsc errors) left every hardcoded string in these components untouched, so the same 4 i18n test files that were failing before that work landed are still failing on main today: designSystemLocalizedUiInvariant, localizedUiTextScanner, messageKeysReferencedInSource, messagesNonEnMustDifferFromEn. Localizes the discovery paywall surfaces (super-like, photo reveal, reshuffle, supermatch card, AI recommendation teaser, refine-profile CTA) an…

Resync api lockfile, fix EntitlementService typecheck, add api typecheck to the closeout gate · 62b2743

Closes W0.12.p. src/apps/api never had a reproducible `npm ci`: package.json allows firebase-admin ^14.2.0 freely, and its transitive google-auth-library / google-gax deps had drifted past what the committed lockfile pinned. Resyncing with `npm install --prefix src/apps/api` touches only gcp-metadata/gaxios under those two parents (26 version lines) - confirmed by inspecting the diff, not a wholesale bump. `rm -rf node_modules && npm ci` now exits 0. That surfaced the 8 EntitlementService.ts errors prior stories h…

Resolve useUserProfilesTabState's 4 findings (246 -> 242) · e9a1c0f

- Identity-swap effect (4 SRC-BUG ids, one reset) documented with a block eslint-disable/eslint-enable, same pattern as the last several files. - Missing-dependency warning on the clearMutation-reset effect: widened [sessionAuthUid, clearMutation.reset] to [sessionAuthUid, clearMutation] per the rule's own suggestion — the body only calls .reset(), so this is a dependency-list correction, not a behavior change. - profiles derived as `!isError && data ? data.profiles : []` created a fresh [] literal on every render…

Drain the MED/LOW residue tier — scan clean at every severity · 88a5925

Sub g only cleared the HIGH tier (the one the gate checks). Two classes of work to take the remaining 458 hits across 81 files to zero: Dead code deleted outright, each confirmed zero-consumer first: - src/interface/ — the Python path facade for pipeline runners, trimmed to backend/web/openapi paths by the prior commit, now removed entirely; its remaining callers are control-plane runners, not this repo. - importlinter.ini + importlinter-fleet.ini — Python import-linter configs whose own targets don't exist in thi…

Resolve useOnboardingPage's 4 findings (250 -> 246) · f71fb55

Same three patterns as the last several files, applied to the onboarding welcome form's view-model hook: - viewerAuthUidRef mirrored during render -> moved into a layout effect, since the TOCTOU guards throughout this hook (photo upload, geolocation detect, submit) all read it from callbacks, never during render. - SRC-BUG-ONBOARDING-FORM-SWAP's identity-change reset and the load-then-sync-from-profile effect are both legitimate multi-setState resets, documented with block eslint-disable/eslint-enable pairs rather…

Clear the web atomic suite's 23 pre-existing failures · fc42659

Root-caused and fixed each of the 23 failures tracked as WAVE-0 W0.14, plus a follow-on i18n gap the fix work surfaced. Categories: Missing/stale test mocks (no product bug): - usePushNotificationsEnable.test.tsx (7): the hook now calls useAuth(), which the test never mocked, so every render threw "useAuthContext must be used within AuthProvider". Added the mock. - appVersionHealthRoute.test.ts (4): GET /api/health gained IP rate limiting and now requires a real NextRequest; the bare GET() call threw in requestIp(…

Fix useChatMode's ref-in-render-argument pattern (258 -> 250) · eb3c188

useChatMode called createLoadChatSession({...}) / createSaveChatSession({...}) directly as useCallback's first argument. Two problems that turned out to be the same root cause: (1) the factory call is evaluated eagerly every render regardless of useCallback's deps, since it's the argument expression, not something useCallback controls; (2) the factory closes over sessionIdentityRef, so evaluating it during render counted as reading the ref during render even though the returned closure only reads .current when act…

Close W0.19 — web build is green · 2c5c056

Claude-Session: https://claude.ai/code/session_01HLWzkTgxvQgb3BfP6m3LN2

Clear all 13 pre-existing tsc errors, web build now exits 0 · d6afb45

Closes W0.19. Worked from the tsc --noEmit list (the build stops at the first error, so fixing one at a time would mean one full build per fix). Three clusters: (a) Two undefined names, simple missing imports — the symbols exist and are exported: - useConnectionManagerWorkflow.ts: parsePaywallLimitError (already imported the same way by useConnectionWorkflowErrorHandler.ts and useDiscoveryPageContent.ts). - DiscoveryPageContent.tsx: DiscoveryPageListChrome, a sibling component in the same directory (its own README…

Finish react-hooks/static-components (259 -> 258) · 604ee6b

MatchIntentScopePickerBody assigned scopeFocusQuadrantIcon(option.id)'s result to a capitalized local (Icon) inside ScopeGridCell and rendered it as a tag. Every branch of that function returned a stable module-scope icon reference (Heart/UsersRound/Briefcase/HandHeart), never created anything, but the shape still reads as "component defined during render" to the rule. Replaced the if-chain with a module-scope lookup table indexed during render instead of called, which the rule accepts. Caught a real gap while fix…

Wave-plan state dashboard + gate wiring + drop sibling-repo script deps (#14) · db1a714

* Add read-only wave-plan state dashboard plan/waves/WAVE-*.html is the task-tracking SSOT, but there was no way to see drain state across the five waves without reading 107KB of HTML by hand. scripts/wave-state-dashboard.py parses the wave files and reports: - per-wave progress (stories, sub-todos, percent complete) - stories ready to pick up, with their next open sub-todo - stories blocked by an unfinished dependency (needs:) - stories parked behind a manual decision gate (verify:manual) Serves an HTML view on 1…

Drain four react-hooks concentrations (282 -> 259) · a2bb0f9

File-by-file pass over the W0.16 backlog. Four files, 23 findings, each judged individually rather than batch-disabled. Real fixes, where the rule was pointing at something worth changing: - UserProfilesTableSection defined SortHeader inside its render body, so React saw a fresh component type every pass and remounted the whole header subtree instead of updating it. Hoisted to module scope with sortKey/sortDirection/onSort threaded as props. This was the genuine defect of the four. - useMatchManagementTabState had…

Align STRIPE_API_VERSION with the lockfile-pinned SDK (W0.14.j) · 88ad878

STRIPE_API_VERSION was "2026-07-29.dahlia" while the lockfile pins stripe@22.3.1, which bakes in "2026-06-24.dahlia". Since stripeWireHelpers.test.ts asserts the constant equals the installed SDK's own API_VERSION, it failed on every faithful install; it passed when introduced only because that node_modules had drifted ahead of the lockfile. Reverts the constant to 2026-06-24.dahlia to match the pinned SDK, and updates the header docstring and @see URL to match. This is behaviour-neutral: runtime pinning is Stripe…

Resolve script deps from this repo only, not a sibling checkout · ba879a0

verify-product-contract-ssot.mjs anchored its createRequire at ../app-infra-operator/contract-management/tools/package.json, so the product OpenAPI SSOT gate could only run on a machine that also had the operator repo checked out beside this one. Without it the gate died with a misleading "YAML parse failed: Cannot find module 'yaml'" — the first step of verify-product-gates.sh, so the whole maintainer bundle was unrunnable. This contradicted the repo boundary in CLAUDE.md ("never cross-repo-import or symlink into…

Record measured W0.16 progress (493 -> 282) · 651baa3

Updates every W0.16 check with counts taken from an actual eslint run rather than estimates, and adds W0.16.e for the two real defects the "cosmetic" rules turned up. Done: W0.16.c (no-unused-vars 82 -> 0, plus the 11 auto-fixable findings and every remaining non-react-hooks rule) and W0.16.e (the two missing imports, the blob-URL <img> tags, the dev-page literal labels). Open: W0.16.a is 183 -> 77 with the 106 WebGL findings resolved; W0.16.b is untouched at 144 and is now the largest category; W0.16.d holds the …

Resolve the 106 WebGL react-hooks/refs findings · 86423d5

Third W0.16 pass. 388 -> 282; react-hooks/refs 183 -> 77. These two files held 106 of the 183, and they needed opposite treatments. useUniverseWebGLCanvasRuntimeRefs mirrored 22 props into refs with render-phase `xRef.current = prop` writes. That is exactly what the rule targets, and the file already demonstrated the correct form — three of its refs were assigned inside useLayoutEffect. The 22 now share one pre-paint effect, making the file internally consistent. Verified safe before moving them: nothing reads the…

Two missing imports, and clear every non-react-hooks lint rule · 675069f

Second W0.16 pass. 400 -> 388, and every rule outside react-hooks/* is now at zero. Two of these were real defects, not style. react/jsx-no-undef and @typescript-eslint's TS2304 were pointing at the same thing from different angles: - DiscoveryPageContent renders <DiscoveryPageListChrome {...vm} /> but never imported it, though the component file sits right next to it. Rendering the discovery list view would have thrown a ReferenceError. - useConnectionManagerWorkflow calls parsePaywallLimitError in its paywallPur…

Clear all 82 no-unused-vars lint findings (W0.16.c) · 6598515

First pass on the W0.16 lint backlog, taking the mechanical category end to end: @typescript-eslint/no-unused-vars 82 -> 0, plus the 11 auto-fixable findings (6 stale eslint-disable directives, 5 prefer-const). Total 493 -> 400. 66 were unused import specifiers, removed with a script that only touches named-import braces and drops the whole statement when nothing is left bound. Three default imports and the remaining bindings were handled by hand: - QuestionPhaseBase, PrivateMode, MatchManagementIndexCard, useBloc…

Record the 19 web fixes under W0.17 and file W0.19 for the red web build · 775ed98

W0.17 moves from 23 failures to 4: W0.17.a closes the 19 non-i18n ones (two genuine product bugs in source, seventeen stale doubles/assertions against correct source — detail in the sub). W0.17.b splits out the remaining i18n cluster and marks it blocked by design: CLAUDE.md's standing policy is to never start i18n work unprompted, so it stays open until someone asks, and nobody has yet triaged whether those four are stale baselines or real untranslated copy. W0.19 is new and was surfaced by running the gate CLAUD…

Clear the 19 non-i18n atomic suite failures · 11c6884

Takes the web atomic suite from 23 failed / 3446 passed to 4 failed / 3465 passed. The remaining 4 are the i18n cluster, untouched under CLAUDE.md's standing i18n policy (they need an explicit in-conversation ask). Tracked as W0.17. Two genuine product bugs, fixed in source: - ConversationMatchCard.tsx: connection-only inbox rows entered the profile-for-sheet resolver. Only `candidateProfiles` was gated on `originalDiscoveryProfile`, but `useDiscoveryProfileForSheet` enables its query on `candidate != null || trim…

Repair inconsistent lockfile so npm ci works (W0.14.a) · dae6382

npm ci could not install src/apps/api at all: node_modules/mongodb declares gcp-metadata@^7.0.1 while the lockfile hoisted gcp-metadata at 8.1.2 with no nested ^7.x copy, so npm exited EUSAGE. Repaired with npm install --package-lock-only rather than deleting and regenerating the lockfile, to avoid re-resolving every range to newest-satisfying and churning the whole dependency set. The result is minimal: 718 -> 700 packages, exactly one version change (hoisted gcp-metadata 8.1.2 -> 7.0.1, now satisfying mongodb), …

Drain the control-plane residue backlog — gate bundle green · ad1bfb2

The residue scan's 23 HIGH hits were all prose, and all of it claimed this repo hosts control-plane tooling it has never had. Each hit got the same treatment the code did: re-point the sentence at the repo that owns the thing, or delete the claim when it describes a layout that no longer exists. - docs/TEST_ISOLATION.md billed itself as SSOT for cross-module pytest boundaries across Fleet, Pipeline, Operator and Tenant — a product repo acting as SSOT for tests it does not host. Rewritten to cover this repo's own s…

Clear all 13 typecheck errors · 2a62ae8

Two were live runtime bugs, not just type noise: - postPaywallAddonPurchase / postPaywallSubscriptionPurchase passed the body as a flat object, but the generated axios client reads it from `paywallAddonPurchaseRequest` / `paywallSubscriptionPurchaseRequest` (the convention every other call site follows). Both calls were therefore POSTing an undefined body — no add-on or subscription purchase could have succeeded. Bodies are now nested. - GetDiscoveryProfilesRequest had lost its `realtimePoll` property while its do…

Gate wave-plan structure in verify-maintainer-gates.sh · c48158b

Adds a --check mode to wave-state-dashboard.py and chains it into the maintainer gate bundle. It verifies only structural coherence of the wave plan, never whether an item is done, so it stays a mechanical gate with no product-decision surface: - every WAVE-*.html has a parseable <section id="wave"> … <pre> block - no non-blank line inside <pre> is silently dropped by the item grammar - story/sub-todo ids are unique, match their wave's prefix, and sub-todos extend their parent story id - every item carries a verif…

Add web typecheck and build to verify-maintainer-gates.sh · 5d164ed

Closes the systemic gap behind W0.12.m: the maintainer closeout bundle ran neither tsc nor next build, which is how 13 src/ type errors and a buttonPreset id that never existed in the preset union reached main with every gate green. - `run_web typecheck` runs first: fastest path to failure, and type errors are the class this bundle actually let through. - `run_web build` runs last: slowest, and only adds bundler/route-collection coverage on top of typecheck. - next build aborts page-data collection without an abso…

Green the 14 failing atomic test files · a73fa2e

Three real product/source defects, the rest stale tests and untranslated UI. Product fixes: - ConversationMatchCard passed peerProfileId/peerAuthUid unconditionally, so connection-only inbox rows (no discovery origin) still entered useDiscoveryProfileForSheet and fired a discovery query for a peer with no discovery row. Both ids are now gated on the candidate, as the SSOT test asked. - Discovery supermatch selection, its reveal card, and the AI teaser sorted and displayed raw `.matchPercentage`, bypassing readEnri…

Boot an in-process mongod so the suite runs standalone · 02921b5

The api suite was failing 122 tests across 37 files. Not 37 bugs: route and middleware tests boot the real Fastify app, platform-role resolution hits Mongo, and middleware/auth.ts:227 turns an unreachable datastore into a 503 — so assertions degraded to "expected 200/404, got 503" with 228 503s and ECONNREFUSED against a closed 127.0.0.1:27017. Two changes, both needed: - tests/globalSetup.mongo.ts boots mongodb-memory-server once per run and provides its URI via Vitest provide/inject. It was already an apps/api d…

Take the value, not the path — drop the remaining outside reads · 832f5ef

The previous pass replaced hardcoded sibling paths with env vars pointing at the same outside trees. That is not a fix: this repo still read another repository's files, the coupling just moved into configuration. CLAUDE.md now says so explicitly — secrets and config arrive as values, never as a directory to rummage through, and the one exception is the tenant merge-env file the caller hands us. Removed accordingly: - E2E_TENANT_PACKAGES_DIR, along with the whole tenant-id branch it served. resolveTenantEnvPathSync…

Unbreak eslint and the documented dev entrypoint · fc39bad

W0.15.a — eslint crashed on every file with "Error while loading rule 'react/display-name': contextOrFilename.getFilename is not a function". ESLint 10 removed context.getFilename() in favour of context.filename, and eslint-plugin-react@7.37.5 still calls the old API, so the lint gate did not run for anyone. Bumping the plugin is not available: 7.37.5 is the latest published release and its peer range tops out at ^9.7. It is also not a direct dependency here — it arrives via eslint-config-next, whose own peer is e…

Track the red web and api test suites as W0.14 and W0.15 · 9d12d36

Both suites were run for the first time after a clean pnpm install. Neither is green, so record the failures as work rather than leaving them undiscovered. W0.14 — web atomic suite: 23 failures across 14 files, grouped by cluster so each sub-todo is independently runnable. Largest is 7 failures in usePushNotificationsEnable, all thrown from the hook's first render. Also records that the suite's exit code is masked when the command pipes through `tail`, which is how the red run was initially misread as passing. W0.…

Remove every remaining cross-repo filesystem reach · 30113dc

Follows eda6a20, which recorded the rule and fixed the two contract-layer reaches. This removes the rest, so nothing in this repo resolves, reads, executes, requires, watches, or resolves node_modules from a sibling checkout. - dev-watch-sync.mjs no longer watches an OpenAPI sources/ tree in a sibling checkout or execSyncs that repo's bundle-openapi.mjs; the bundled spec in src/packages/contracts is the whole contract watch surface. - tests/atomic/helpers/infraSiblingPaths.ts is gone, split into mergedTenantEnv.ts…

Add W0.14 for untracked web suite failures and broken npm ci · 848a4aa

Wave-plan gap audit: the web offline suite has 12 failing test files / 21 failing tests, and none of the 12 filenames appeared anywhere in plan/waves/. This is the same blind spot W0.13 closed for src/apps/api, never done for src/apps/web -- verify-maintainer-gates.sh runs neither app's suite, and each story's targeted verify command only matches its own files, so a green per-item verify never implied a green suite. All 12 confirmed present at 98f0c55 via a clean git worktree run, so they pre-date the 2026-08-17 b…

Fix all 13 web type errors at root cause; npm run build is green again · 2f66573

Closes W0.12.m. tsc goes from 13 src errors to 0 and `npm run build` exits 0. Two of the three diagnoses filed earlier were wrong and were corrected by checking the code rather than assuming: - Button presets were NOT a rename. `git log --all -S "pill-brand-solid"` shows that id never existed in button-brand.ts at any point, so this code never typechecked. Re-pointed each at the registry's documented intent: filter-chip active state to pill-brand-glass-segment (whose idle partner documents that exact pairing), thr…

Drain the 24 HIGH control-plane residue hits · c5f0e6c

verify-product-gates.sh failed at its last step with 24 active HIGH hits from scan_control_plane_residue.py. Audited all 24 individually rather than moving the gate's threshold. Exactly one was real product-source residue: e2e_base_url.ts's resolver error message pointed readers at fleet-management/tests/ run_e2e_registration_*.py, a path inside a sibling repo, which the product-only boundary rule forbids. Rewritten to state the contract — control-plane deploy runners set E2E_BASE_URL once merge-env resolves — wit…

Retire the phantom loop kit (W1.8 decided: retire) · d032c5e

Maintainer decision on the W1.8.a gate: retire rather than build. The .cursor loop kit — loop-project.env, scripts/loop-lock.sh, loop-locks/, LOOP-KIT-PORT.md — was referenced by hub docs from 2026-07-04 but never existed in any commit, branch, or sibling repo. No design was ever recorded and nothing in this repo's automation depended on the lock running, so building it would have meant inventing semantics nobody specified. Deleted the two placeholder docs, which emptied .cursor/ entirely — the last residue of the…

Make verify-maintainer-gates pass without a sibling checkout · 23affc1

The bundle previously died on its first step because verify-product-contract-ssot.mjs resolved `yaml` through app-infra-operator (fixed in the previous commit). With that gone it ran to completion and surfaced three real, repo-local failures: - scan_control_plane_residue.py --fail-on HIGH: 24 hits. One was code — an error string in e2e_base_url.ts naming fleet-management/tests/run_e2e_registration_*.py; reworded to describe the env contract instead. The other 23 were prose in docs/plans/** design narratives, which…

Repair two tests left red by 6e45081 · 035011a

Both were introduced by the previous commit and are unrelated to each other; the offline suite went from 12 failing files to 14. prefsOptimisticRollback: useUserPreferences now calls useTranslations() and fires a sonner toast from the mutation's onError. This test renders the hook with no NextIntlClientProvider above it, so the render threw before reaching any rollback assertion. Mocks next-intl and sonner, the same way the sibling useUserPreferencesOptimisticRollback test already does. orb-brand: 6e45081 delibera…

Unbreak the contract gate and the stale runbook link · 4fa8d17

W0.15.d — verify-product-contract-ssot.mjs anchored createRequire at ../app-infra-operator/contract-management/tools/package.json purely to resolve `yaml`, so verify-product-gates.sh died with "Cannot find module 'yaml'" in any checkout without that sibling repo installed alongside, which is every fresh clone. It also cross-repo-imported a sibling, which this repo's own boundary rule forbids. It now resolves `yaml` from this workspace (src/apps/web/node_modules first, where yaml@^2.9.0 is a declared dependency), u…

Record the auth, lockfile and cross-repo work in WAVE-0/WAVE-4 · d086b75

The last three commits changed code without touching plan/waves/, which is this repo's task-tracking SSOT per CLAUDE.md (KANBAN.md is frozen). Backfills them and, more importantly, records what is still open so it is not carried only in a session transcript. WAVE-0 — closed stories: - W0.14 (a-c): follow-up defects in W0.2.c/W0.2.d's own fixes, found re-reviewing 3ce5bc4 alongside the dev-bypass lock work. dev-bypass-status diverging from the middleware's predicate; optional-auth swallowing PlatformRoleResolutionE…

Forbid cross-repo filesystem reach; drop two sibling-repo calls · eda6a20

Records the rule in CLAUDE.md: nothing in this repo — scripts, maintainer gates, dev tooling, tests, CI helpers — may resolve, read, execute, require, watch, or resolve node_modules from a sibling checkout. The only permitted coupling to the control plane is a decoupled definition: an HTTP API call, the OpenAPI/contract SSOT, or a contract artifact vendored here. The previous wording only bound "product code", which left the gates and tooling exempt. Two live violations removed: - verify-product-contract-ssot.mjs …

Delete the orphaned p124 path rewriter · 6b20560

scripts/p124-path-replace.py was a one-shot migration tool whose replacement table still mapped app-pipeline -> infra-cicd-pipeline, a tree this repo no longer has. Nothing invoked it: no gate script, no CI, no other script — its only references were the scripts/README.md row (removed here) and the WAVE-1 row tracking the decision. scripts/p124-rg-active-gate.py stays. Despite the shared prefix it is a live guard that blocks stale pre-layout app-* path tokens from reappearing in the active tree, and it is wired in…

Repair api lockfile drift and remove all cross-repo code paths · 45ebc8c

Lockfile drift (root cause of `npm ci` EUSAGE, and of the one real API test failure): mongodb@7.5.0 declares an optional peer `gcp-metadata ^7.0.1`. firebase-admin pulls google-auth-library@10.9.1, which pins `gcp-metadata 8.1.2`, and npm hoisted that to the shared `node_modules/gcp-metadata` — violating mongodb's peer range. `npm install` tolerates the conflict; `npm ci` refuses it, so clean installs could not work at all. Regenerating nests gcp-metadata correctly under google-auth-library and google-gax, and dro…

Restore loading-halo colour, expose choice-chip state, de-duplicate brand hex · 496c2ec

Fixes W0.12.f-j. The colour change in W0.12.i turned out not to be the brand decision it was first filed as: `git show 6e45081` shows both loading components previously rendered the literal rgba(139, 92, 246, ...), so #8B5CF6 was the shipped colour and the token migration replaced it with brand violet inside a 93-file commit whose message mentions only "refresh orb tokens". That is a regression, so this restores prior behaviour rather than escalating. - LoadingSpinner / LoadingScreenView now call getLoadingSpinner…

Record the dead-path removal under W1.14 · de082de

Add W1.14.f for the shipped dead in-repo path cleanup, and W1.14.g for the one item left undecided: p124-path-replace.py still maps app-pipeline -> infra-cicd-pipeline, a tree this repo no longer has. Claude-Session: https://claude.ai/code/session_01CXaBryN3TbrWRGLDV2cCxv

A11y(question-card): announce selected choice chips via aria-pressed · 2be2c2f

Reflection choice chips signalled selection with colour, border/shadow and an aria-hidden Check glyph only, so screen-reader users could not tell which options were selected and heard no state change on toggle. Both chip grids (the optionsPrimary grid and the legacy "Show examples" grid) now set aria-pressed, matching the toggle-chip pattern already used by RatingCard and the discovery filter chips. Kept aria-pressed for the single-selection mode rather than promoting the grid to role="radiogroup"/role="radio": a …

Remove dead in-repo paths left behind by the boundary cleanup · aef0ce0

Follow-up to the cross-repo removal. These paths are repo-relative rather than sibling escapes, but none of the directories exist in this product-only repo, so every code path through them was unreachable. - src/interface/__init__.py: delete ml_service_path, ios_path, android_path and schemas_generated_path. They resolved machine-learning/, src/40_ios, src/50_android and contract-management/ respectively — none present, so each could only raise. README table updated to match. - e2e_base_url.ts: delete findProductR…

The capability matrix becomes an implementation wave. · 8617df3

All 184 capability rows across its 21 tables are now sub-todos in plan/waves/WAVE-5.html, carried over verbatim with their status, code anchor, notes and KANBAN id — verified row-for-row, 184 in and 184 out, none dropped. The wave is framed on the premise that these capabilities already exist: the great majority were recorded as Shipped, so the default unit of work is confirming the anchor is really there and really matches the claim, not building anything. A sub-todo only becomes implementation work when the anch…

Track repo-boundary isolation work as W1.14 · 4364264

The cross-repo path removal was not recorded in any wave. Add it as W1.14 with the shipped sub-todos checked and the open follow-ups left explicit: the test suites were never run (no installable node_modules in the authoring container), there is no regression guard for path escapes, and the remaining prose mentions of app-infra-* still need a call. Wire W1.14 into W1.13's needs list so the wave exit demo cannot close without it. Claude-Session: https://claude.ai/code/session_01CXaBryN3TbrWRGLDV2cCxv

Drop remaining cross-repo pointers from e2e helpers and tests · 6a90a47

Second pass over the out-of-repo path escapes, covering the e2e layer and the tests that asserted on sibling-checkout behaviour. - e2e_base_url.ts: remove findInfraOperatorRoot and the sibling tenant-management roots; tenant env now resolves from in-repo paths plus the caller-supplied E2E_MERGED_ENV_PATH / E2E_TENANT_ENV_PATH. Neutralize the error hint that told operators to reach into the sibling checkout. - zitadel_mfa_admin_pat_http.ts: map container-absolute /zitadel-secrets/ paths via ZITADEL_ADMIN_PAT_PATH i…

Remove cross-repo path resolution from product code · ee74243

This git root is product-only, but several scripts, helpers and the Python source facade resolved filesystem paths into the sibling app-infra-operator / app-infra-services checkouts. That made a standalone clone unable to run its own gates (verify-product-contract-ssot died on a sibling node_modules). Remove every out-of-repo path escape: - verify-product-contract-ssot.mjs: resolve `yaml` from in-repo node_modules instead of app-infra-operator/contract-management/tools. - generate-api-zod-schemas.mjs: drop the sib…

Remove all cross-repo filesystem pointers · 1c45f54

This git root is product-only. Nothing in it may resolve a path outside its own root — the sibling app-infra-operator checkout is reachable over HTTP and tenant merge-env only. Removed (pure cross-repo delegators / facades): - run.py — subprocess wrapper into conformance-management/run.py - src/interface/ — SourcePublicInterface path facade for pipeline runners, plus the atomic test that only guarded it - tests reading a sibling checkout: dryVerificationMatrixManifest, traefik-admin-path-rule Stripped sibling-path…

Track landing orb + meteor work and the issues it surfaced · 9ab6c95

Nothing from this session's landing/orb work was in the wave plan. Adds the stories, splitting them by whether they need a decision. WAVE-0 (actionable now): - W0.14 — landing hero orb + shared meteor system. Sub-todos a-e record the fixed defects with their evidence: the inverted-Y trajectory that made half of all meteors leave the viewport, the unit-string trail bug that stacked every particle at the spawn point, the two-thirds-of-width orb sizing, the compositor tile seams traced to the orb layers' translateZ(0…

Track token/SSOT defects missed by the first sweep pass as W0.12.i-k · 94c32ca

A second triage pass over the same tree found that the remaining rgba()/hex literals dismissed as non-findings on the first pass included three real defects, one of which was introduced by the token migration itself: - W0.12.i — `getLoadingSpinnerRadialGlowStyle` (loading-surface-brand.ts) is the purpose-built helper for LoadingScreenView/LoadingSpinner and emits the identical gradient shape from #8B5CF6. Both components were migrated to `getRadialGlowBackdropCss` (#A78BFA) from the orb module instead, silently ch…

Fill the width in landscape, remove orb tile-seam artifacts · b6ffd44

Orb sizing: getLandingHeroBrandOrbSizePx now takes two thirds of the viewport WIDTH in every orientation, not the shorter axis, so landscape fills the same share of the screen as portrait. It is capped to the viewport height so the sphere is never cut off by the top/bottom edge, and floored at LANDING_HERO_BRAND_ORB_MIN_PX. The Hero no longer caps the orb to its layout slot; the orb is absolutely positioned, so a diameter larger than the slot moves the sphere behind the headline and CTA rather than pushing them ou…

Align dev-bypass status with its own gate, fail closed on optional-auth role errors, make forced sign-out survive a failed logout · 5ffc0d7

Three defects found reviewing 3ce5bc4 alongside the dev-bypass lock work. - devBypassGate/middleware/internal routes: GET /api/internal/dev-bypass-status answered bare `!isDevBypassLocked()` while middleware/auth.ts additionally required `isDev && env.DEV_AUTH_BYPASS`. That endpoint exists precisely so the web NextAuth provider never trusts its own NODE_ENV/DEV_AUTH_BYPASS check alone, yet the authority it defers to skipped the API's equivalent checks — an API with bypass switched off in its env still answered `al…

Size the hero orb to two thirds of the screen · ad5e0c0

getLandingHeroBrandOrbSizePx now returns two thirds of the shorter viewport axis instead of the old 140/160/200/240 breakpoint ladder. The orb is a circle, so the shorter axis is the one that constrains it: width on a portrait phone, height on a landscape desktop. Applying that ratio alone pushed the CTA out of the 100dvh fold (measured at 540x960 and 1440x900), so Hero caps the diameter to the slot the orb actually gets between the headline and the CTA, and clamps back up to LANDING_HERO_BRAND_ORB_MIN_PX so a cra…

Close W0.10.b with the combined-measure resolution · 38b4fc1

Records why the filed one-line fix (method='ranked') was not the right call for this gate's binary-label input, and what replaced it.

Measure L8b residual correlation both ways instead of picking one · cb88eaa

W0.10.b was filed as a docstring/implementation mismatch: the gate's docs say "Spearman" and its trace prints rho, but statistics.correlation was called with the default method="linear" (Pearson). The obvious fix is to pass method="ranked". Research into this gate's actual input says that would have been the wrong call. The residual is y - sim_transfer_expected(mirt) where y is a *binary* outcome label, so residuals collapse toward two clusters. Rank correlation degrades badly under exactly that shape: when one cl…

Retire stale references to deleted files, close W0.10.h/i · 87b9bc9

Every reference named in W0.10.h pointed at a file removed in 9a53fdf80. Rewrote each to describe current behaviour in place rather than restoring deleted docs, which is the default the todo called for. Two of the claims were wrong beyond the dead link. README.md's layer table said src/application/ holds the wave runner, recompute jobs and outbox poll -- that package contains only __init__.py; the real homes are src/jobs/, src/mmr/learning/ and src/routes/. And main.py's docstring said "the scaffold ships health +…

Keep connection-rating precision, tighten the sync outbox guard · bcd603c

W0.10.d -- filed as an int()-vs-round() inconsistency at the bank-score conversion in profile_cohort. Tracing it showed the conversion never sees a fraction: parse_stored_connection_rating truncates with int() first, so the reported 7.9-becomes-7 could not happen there. The truncation itself is the defect, and it is worse than the filed symptom. That function documents itself as mirroring the backend's parseStoredConnectionRating, whose parseRating helper keeps the raw number and range-checks that value. Truncatin…

Keep blocking ML-engine calls off the event loop · 1820e09

W0.10.f -- six internal routes are async def with fully synchronous bodies: blocking pymongo queries plus blocking httpx calls to the ML engine, the latter with timeouts up to 300s. Running on the event-loop thread, one slow or hung engine response stalls every other coroutine in the worker, /api/health included, so orchestration reads the pod as dead and cycles it. Two of them were worse than the reported case. The Qwen /generate and /match-narrative handlers called run_grounded_generate/run_match_narrative with …

Restore STRIPE_API_VERSION to the pinned SDK's version · 870421f

Commit 6e45081 bumped the STRIPE_API_VERSION documentation SSOT (and the accompanying docstring/@see link) to 2026-07-29.dahlia, but the pinned stripe SDK is still 22.3.1, whose baked-in Stripe.API_VERSION is 2026-06-24.dahlia. That drift broke the guard test, which deliberately asserts the constant against the installed SDK rather than a literal. Restore the constant and docs to 2026-06-24.dahlia so they match the SDK actually installed. Bumping this string is only correct alongside an SDK upgrade. Claude-Session…

Constant-time internal-secret compare, unwedge the ingress cursor · 363bfee

W0.10.e -- verify_internal_secret compared x-internal-secret to the tenant secret with a plain !=, which short-circuits on the first differing byte. That dependency guards every /api/internal/* learning, match, NLP and Qwen route, so response timing leaked the expected secret prefix by prefix. Now compared with hmac.compare_digest. Both sides are utf-8 encoded before the comparison: compare_digest raises TypeError on a str holding non-ASCII, and the header value is caller controlled. Header bytes above 0x7F arrive…

Make shared shooting stars actually visible · 0b84aba

The landing ShootingStars overlay now renders through the shared meteor system in components/background, which surfaced two defects in that system that had gone unnoticed while it only ran behind the in-app cosmic background. - calculateEndPosition negated sin to "correct" for CSS Y growing downward, but generateShootingStar authors its per-edge angle ranges in screen space already. The double correction sent every top-edge spawn (y = -5, 45deg-135deg) further up and every bottom-edge spawn (y = 105, 225deg-315deg…

Close W0.10.a and file W0.10.j-l from the matching bug-hunt · c45018a

Checks off W0.10.a (standard_errors dropped on the first egress record) and records the two blockers found while trying to run its verify command -- the matching suite could not execute at all from a clean clone, and the CL-001 cross-repo parity gate had never run because the two repos read the fixture from two different paths. Both are fixed in 63b3324 and filed as W0.10.j and W0.10.k for traceability. Files W0.10.l for the follow-up that fix exposed: now that the parity gate actually executes, its 8 golden cases…

Stop dropping standard_errors, restore untracked pytest fixture, repair CL-001 gate · 63b3324

Three related fixes, grouped because the last two are what made the first one verifiable. 1. attach_shared_surfaces() silently dropped standard_errors (W0.10.a) Attaching per-wave item surfaces to the first egress record rebuilt that record by listing its fields by hand, and the list omitted standard_errors. Every prod wave commit therefore discarded the computed standard-errors field for exactly one cohort member -- the first by sorted authUid -- degrading CAT/backend precision data for that user with no error an…

Add read-only wave-plan state dashboard · 7fdcc3e

plan/waves/WAVE-*.html is the task-tracking SSOT, but there was no way to see drain state across the five waves without reading 107KB of HTML by hand. scripts/wave-state-dashboard.py parses the wave files and reports: - per-wave progress (stories, sub-todos, percent complete) - stories ready to pick up, with their next open sub-todo - stories blocked by an unfinished dependency (needs:) - stories parked behind a manual decision gate (verify:manual) Serves an HTML view on 127.0.0.1:8799/dashboard plus /state.json, …

Close W0.5.g and the W0.5 story · 5c0899e

Wire-up of the preference-save error toast was already implemented and covered by a regression test; only the wave-plan checkbox was outstanding. Verified `npx vitest run useUserPreferences` (5 tests / 3 files, PASS) and confirmed the toast copy resolves in all five locales (en/de/fr/es/ar). The item's text called for a new i18n key, but the shipped fix reuses pre-existing, already-translated copy that was simply never wired to this hook — no new keys or locale/parity edits were needed. The 4 failing tests under t…

Drop duplicate matching parity fixture exception · 81ace4f

The blanket *.json rule already had an exception for src/apps/matching/tests/parity/fixtures/*.json further down the whitelist block. Commit 7450dbb added a second identical line, so the same pattern appeared twice. Remove the duplicate and keep the pre-existing one. Claude-Session: https://claude.ai/code/session_01CXaBryN3TbrWRGLDV2cCxv

Track design-system a11y gaps found by the colour-token sweep as W0.12.f-h · 48c13cb

The `getRadialGlowBackdropCss` token migration is already complete: a scoped sweep of `design-system/components/**` confirms `LoadingScreenView`, `LoadingSpinner` and `QuestionCardChoiceOptions` are the only call sites matching the single-stop `radial-gradient(circle, rgba(...), transparent 70%)` glow-backdrop shape, and all three are migrated. The remaining rgba()/hex literals in that tree (celestial renderers with per-object data-driven colours, Tailwind arbitrary box-shadow classes, skeleton shimmer, SearchBar …

Fix remaining WAVE-0 bug-hunt items: admin rate limits, billing webhook idempotency, discovery privacy, and OpenAPI DELETEs. · 6e45081

Also require mutual chat consent for full media disclosure, delete the unused ML client, and refresh orb tokens plus drifted tests.

Allowlist checkout/portal redirect URLs · 98f0c55

successUrl/cancelUrl/returnUrl for Stripe checkout and billing-portal sessions were only checked for presence, never validated against an allowed origin, before flowing unmodified into the provider -- an attacker-controlled URL could ride a real, trusted Stripe redirect to an attacker domain post-payment (open-redirect phishing setup). Now validated against CORS_ORIGINS (the app's existing trusted-origin SSOT) before calling the provider. Closes W0.5.p.

Filter before paginating list queries · 1bb3629

listConnections()/listConversations() applied Mongo-level skip/limit before filtering out blocked/dismissed/duplicate-peer rows, so a page whose raw window contained several such rows could return fewer than `limit` results even though enough legitimate rows existed further down the sorted collection -- infinite-scroll clients would treat that short page as "end of list" and hide real connections/ conversations. Now fetches the full viewer-scoped set, filters, then paginates in-memory, matching the pattern Discove…

Key conversation mute state per viewer, not shared · eaa388b

ConversationDocument.muted was a single boolean on the per-pair conversation row, so one side muting/unmuting a thread silently flipped the other side's state too. Replaced with mutedBy: authUid[]; muteConversation() now $addToSet/$pull only the caller's own id, and listConversations() derives each viewer's muted from membership in that array. Wire shape on GET /api/chat/conversations is unchanged. Closes W0.5.m.

Stop hardcoded ios fallback misclassifying Android shells · 3fca3dd

enableNativePushRegistration now falls back to detectPlatform()'s bridge-global inspection instead of a hardcoded "ios" default when the native bridge omits platform, matching the downstream fallback already used in features/device/api.ts. Closes W0.5.e.

De-duplicate connection-stage messaging gate into a shared SSOT · a560d6f

wave W0.5.d [SRC:chatConnectionTransportState.ts:39,messagingLifecycleGate.ts:29] — web's chatConnectionTransportState.ts used an explicit connection-stage allow-list while the API's messagingLifecycleGate.ts inferred "allowed" implicitly (anything not in its blocking set). They agreed for all 9 current ConnectionStage values, but a new stage added server-side without a matching client entry would silently misclassify as inaccessible on the client even though the API allows it. New src/config/connection-stage-mess…

De-duplicate CORE_VALUE_IDS into a shared JSON SSOT · 7ab9c55

wave W0.5.c [SRC:backfill-domain-ids.ts:57] — the 28-id core-value literal was hand-typed in three places: src/apps/api/scripts/backfill-domain-ids.ts, src/apps/web/src/lib/data/domain/coreValues.ts's CORE_VALUE_IDS, and tests/scripts/backfillDomainIdsLegacyMapping.ssot.test.ts. The backfill script hard-fails on any mismatch rather than silently drifting, but a real divergence would still have broken production data migration. New src/config/core-value-ids.json, following the existing pricing-catalog.json/email-ot…

Fix stale biometric-challenge race comment (already fixed) · 4fe0b04

wave W0.5.b [SRC:biometricChallengeShared.ts:10] — investigated the flagged verify-then-update race (two concurrent challenge submits both minting a session) and found it was already closed on 2026-07-12 by SRC-BUG-BIO-CHALLENGE-ATOMIC, a month before the 2026-08-10 UC-19 sweep that re-flagged the stale TODO comment describing the pre-fix behavior. markBiometricChallengeVerified's atomic findOneAndUpdate({challengeId, verified:false}, {$set:{verified:true}}) is the real mutual-exclusion point and already gates min…

Add same-process overlap guard to the learning-cycle cron · 4451097

wave W0.5.a [SRC:scheduled-tasks.ts:131] — node-cron does not wait for the previous invocation before firing the next tick, so a learning cycle that outlives LEARNING_CYCLE_CRON's interval would overlap with the next one, running concurrently against ml-service regardless of its own idempotency. Added a module-level in-flight flag around the learning-cycle callback: an overlapping tick logs a warn and returns immediately instead of starting a second concurrent run; cleared in a .finally() so it resets even if the …

Whitelist matching parity fixture JSON files · 7450dbb

The blanket *.json ignore had no exception for src/apps/matching/tests/parity/fixtures/, so any new fixture added there (e.g. golden_wave_post_bootstrap_output.json) would silently fail to `git add` unless force-added, risking a clean checkout that can't run the parity suite. The existing three fixtures turned out to already be tracked (committed in 12b64b441), but the gap remains for future fixtures.

Add post-bootstrap golden-cohort parity fixture · 12b64b4

wave W0.4.b (closes W0.4) [REQ:REQ-D-07] — the golden-cohort parity suite only ever exercised the bootstrap wave-0 branch (a fresh cohort's first wave, seeded from structural labels); it never proved correctness for the post-bootstrap branch, where real learningScorecardEvents are ingested and drive theta/matching updates through the actual outcome-fit model-training path. - golden_cohort.py: new run_golden_wave_post_bootstrap() — commits wave 0 (bootstrap) on a fresh mongomock db, seeds a deterministic 45-pair le…

Stop hardcoding the stage host in root score.yaml · 70f0ec1

wave W0.4.a [REQ:REQ-D-01] — score/api.score.yaml and score/web.score.yaml already used the neutral ${PUBLIC_DNS_HOST} placeholder for public-dns.host (control-plane render data), but the older root score.yaml (still the app-catalog score_path default until per-workload paths ship) hardcoded host: stage.trueconnection.app. Repointed it at the same placeholder, matching the per-workload descriptors' established convention, and dropped the now-stale "Catalog enrollment default (stage)" comment.

De-duplicate email-OTP policy constants into a shared JSON SSOT · 2e8c922

wave W0.2.f (closes W0.2 — all 6 auth/session bug-audit findings triaged) — src/apps/web/src/lib/auth/nextauth/email_otp.ts hardcoded the same 5 EMAIL_OTP_* values (max attempts, per-email/per-IP rate limits, TTL) that live authoritatively in src/apps/api/src/lib/auth/emailOtpService.ts, with no shared import — a manual-sync footgun if the two ever drifted. - New src/config/email-otp-policy.json, following the existing pricing-catalog.json SSOT pattern (see src/config/README.md): both apps now import the identical…

Return the minted biometric session token from passkey login · 37f23e4

wave W0.2.e — [redacted].ts discarded the biometricSessionToken/expiresAt that verifyEmailBoundPasskeyAssertionChallenge already mints on every passkey login, so the biometricSessions row was write-only dead data. - AuthPasskeyVerifyResponse (product.openapi.yaml) gained biometricSessionToken/expiresAt (required, same shape as the sibling BiometricSessionResponse used by /api/biometric/verify) — contract regenerated (zod schemas, openapi-typescript, openapi-generator axios client). - registerAuthPasskeyRoutes.ts n…

Close optional-auth recognizer gap and force sign-out on dead refresh · 3ce5bc4

wave W0.2 — auth/session hardening bug-audit batch (4 of 6 triaged). - middleware/auth.ts: optionalAuthenticateRequest only tried the ZITADEL JWKS check, silently treating a valid internal HMAC bearer or native-shell compat JWT as anonymous even though the same token authenticates fine on a required-auth route. Now tries the same token-format recognizer chain as authenticateRequest (internal bearer -> native-shell compat -> ZITADEL), excluding only the dev-only trusted-header path and dev-bypass (neither applies t…

Align paywall visual design with the app design system [REQ-00-R08] · d3de963

wave W0.1 — boost sheets, limit walls, and subscription dialogs used ad-hoc `border-border/60 bg-background/40` boxes and legacy Button variant props instead of the shared design system, plus a raw <select> and a hand-rolled loading scrim. - PaywallDialog, PaywallSubscriptionTermDialog, PaywallSubscriptionManagementCard: ad-hoc card wrapper -> GlassCard; variant="secondary"/"ghost" -> buttonPreset "pill-brand-glass-dialog" / "pill-neutral-ghost-inline". - SubscriptionMenu: raw <select> -> design-system Radix Selec…

Full offline parity for local dev: no reachable Zitadel, Stripe, or ml-engine required for any feature, including paid checkout and NLP-affect scoring. · bce9db2

Full offline parity for local dev: no reachable Zitadel, Stripe, or ml-engine required for any feature, including paid checkout and NLP-affect scoring. - Fix env-schema papercuts: ZITADEL_EXTERNALDOMAIN (unused, was crashing boot) made optional; ZITADEL_AUDIENCE folded into the centralized zod schema. - Real-Zitadel-only routes (registration, Google/Zitadel account linking) now fail fast with a clean 501 ZITADEL_DISABLED_IN_DEV_BYPASS while DEV_AUTH_BYPASS=true, instead of a raw PAT-file/DNS error. - New DevFakeBi…

Close dev-bypass sign-in race that let requests fire with no session yet · de8ba94

AuthProviderInner's `loading` flag dropped to false the instant the dev-bypass auto-sign-in effect fired (synchronously, via signInAttempted.current), while the actual signIn("dev-bypass", ...) network round-trip was still pending — so gated consumers like useProfile()'s `enabled: !authLoading` unblocked and called the API before any session cookie existed, producing intermittent "Authentication required" / "No session token" 401s on routes like /you. Track the sign-in call's own in-flight state (devBypassSigningI…

Repair dev-bypass end-to-end + gate it behind a two-lock bootstrap check · 16b95e3

Dev auth bypass was broken end-to-end: the web BFF proxy requires a real NextAuth session for every /api/* call, but NEXT_PUBLIC_DEV_AUTH_BYPASS only fabricated a fake client-side AuthUser object and never called signIn(), so no session cookie was ever minted and every protected route 401'd before reaching the (already-working) Fastify backend bypass. Fix: AuthProviderInner now auto-triggers a real signIn("dev-bypass", { redirect: false }) against the existing NextAuth CredentialsProvider on mount when unauthentic…

Remove dead packages (fastify auth plugins, radix themes, orphaned node-cron/yaml) · c6902a7

api: @fastify/cookie, @fastify/session, @fastify/static, jwks-rsa, and oauth4webapi have zero remaining call sites — their only consumer, registerUploadsStatic.ts, was deliberately deleted in a prior commit; identity/session auth already lives with NextAuth/Zitadel per the product identity model, so these aren't a gap to fill in. web: @radix-ui/themes has zero references (the design-system package is the real component SSOT); node-cron + @types/node-cron were superseded when scheduled-tasks.ts was refactored to ca…

Actually include the matching hot-reload changes · 300e684

The previous commit's message described bind-mounting src/apps/matching/src and adding --reload, but docker-compose.yml itself never got staged — a multi-path `git add` aborted silently when one of its paths (already git rm'd) didn't match any files on disk, leaving this file behind. Same class of gotcha noted earlier this session; caught it this time by checking `git status` after the commit instead of trusting the add succeeded.

Hot-reload for matching; delete dead-code duplicate health.py · 3d0d546

The matching container had no source volume mount and no --reload flag — editing code would silently do nothing until a manual `docker compose build`. Fixed: bind-mount src/apps/matching/src over the image's baked-in copy, run uvicorn with --reload --reload-dir /app/src. api/web were never affected — they aren't containerized, they run via `npm run dev` on the host with their own native watch/HMR (tsx watch, next dev). Verified this isn't cosmetic — actually edited a live file, watched uvicorn's StatReload detect …

Wire up the matching service; fix its broken test deps · 7a16595

Researched "the AI mathematical part" end to end before touching anything. Finding: it's not missing from the app — src/apps/matching is a complete, already-wired, already-tested ~17k-line Python service (MIRT scoring, Fisher information for adaptive testing, trait estimation, entropy item-weighting, learning-wave orchestration). Verified non-stub by reading the actual math (mmr/cat/fisher_info.py's closed-form Gaussian-kernel derivative) and confirming the HTTP routes call real mmr/ code, not placeholders. The on…

Silence 2 real startup warnings, document expected boot noise · 9391269

Ran a full from-scratch bug hunt (docker compose down -v, up, inspect every container's logs line by line) as a follow-up to the first verification pass. Two genuinely fixable warnings found and fixed: - Mongo: "Soft rlimits for open file descriptors too low (1024, recommends 64000)" — Docker's container default. Fixed with an explicit nofile ulimit on the mongo service; confirmed `ulimit -n` reports 64000 post-fix. - Redis: background-save-under-memory-pressure risk this container was never going to hit anyway (i…

Deliberately narrow scope: just the two data stores product code reads via MONGODB_URI/REDIS_URL (Mongo required, Redis optional/lazy). · f10ce5d

Deliberately narrow scope: just the two data stores product code reads via MONGODB_URI/REDIS_URL (Mongo required, Redis optional/lazy). Not a full-stack compose — Traefik/Zitadel/product-container orchestration stays owned by the sibling app-infra-operator repo, out of this product-only repo's boundary. Mongo runs as a single-node replica set (rs0) — required for transactions (withMongoTransaction.ts) and change streams (change-streams.ts), which the existing `npm run dev:standalone` in-memory-Mongo path doesn't s…

Retire .github/ — no GitHub Actions, git hooks only · 23dcf49

Standing policy is git hooks for enforcement, never GitHub Actions. The remaining 5 workflows were already self-contained and workflow_dispatch-only (confirmed no sibling-repo checkouts, no automatic triggers) — nothing forced removal on scope grounds, but the policy argues against keeping them anyway. - Deleted .github/ entirely (workflows, README, PR template, E2E_MERGED_ENV setup doc). - Migrated the still-useful parts of .github/docs/E2E_MERGED_ENV.md (local E2E_MERGED_ENV_PATH usage, match-scoring stage confi…

This repo was originally built for the Cursor IDE agent (.cursor/ as the agent hub: always-on rules, on-demand skills, a KB). · 125afb8

This repo was originally built for the Cursor IDE agent (.cursor/ as the agent hub: always-on rules, on-demand skills, a KB). It's now driven by Claude Code, which doesn't read .cursor/ at all. Three parallel research agents read every one of the 26 rule files, 15 skill folders, and 55 KB articles in full and categorized each one before anything was deleted. - New root CLAUDE.md: repo bindings, identity model (authUid/profileId), API/contract discipline, backend layering, web conventions, layer-trace discipline, s…

Install wave-plan MCP server, close scan integrity gaps · 514850b

Registered the wave-plan MCP server (wave-plan-lib) locally via a gitignored .mcp.json — same treatment as the existing .cursor/mcp.json, since the registration path is machine-specific. Smoke-tested the MCP server directly over stdio JSON-RPC (initialize/tools-list/wave_next_work) and confirmed it agrees with the CLI scanner. Ran wave-consistency-scan.py end to end and resolved every actionable finding it raised on this plan: - Added a wave-exit-demo story (class J) to each of WAVE-0..4, so every wave now self-cl…

Fix remaining live references to the retired KANBAN.md SSOT · 50f1501

Per user instruction: research the whole repo for anything kanban-related, convert application-feature-related content to wave, delete the rest. Confirmed there is no kanban-branded application feature anywhere in src/apps/{api,web,matching} — every hit was agent/process documentation still pointing at the pre-2026-08-16 "KANBAN.md is the live task SSOT" convention. Wave functionality/skill itself untouched (confirmed via wave-consistency-scan.py: still 96 items, still consistent). Fixed ~23 files' worth of stale …

Remove KANBAN-specific scripts, keep general-purpose ones · 6c1e43b

Per explicit user instruction. Deleted 9 scripts whose entire purpose was keeping KANBAN.md in sync or driving KANBAN-lane claiming — both retired 2026-08-16 when task tracking moved to plan/waves/: - kanban_docs_sync.py, sync-kanban-from-docs.sh, test_kanban_docs_sync.py, verify-docs-plans-kanban.sh, verify-kanban-format.sh — the docs/plans/ <-> KANBAN.md sync engine and its KANBAN.md structural-contract checker. - workflow-register.sh, workflow_register.py, workflow_drain.py, workflow_kanban.py — the swarm lane-…

Rename away from legacy naming for two load-bearing items · 1e9ffa4

Per explicit user instruction: for the two *legacy*-named items that turned out to be live functionality (not dead code), the resolution is "delete [the legacy name], but make sure there's a wave story and requirements first" — i.e. eliminate the legacy branding while preserving the behavior, with the still-open substantive question tracked in the wave plan rather than resolved by guessing. Wave plan updated first (WAVE-1.html), then the renames executed in this same change. journey/legacy-journey-redirect-body.ts…

Remove legacy-visualization discovery component · 44776f5

Per explicit user instruction. Traced the full usage chain before deleting (this is real app code, not just docs): only features/discovery/index.ts's barrel re-exported StarField2D/StarField3D/NetworkVisualization, and nothing else in src/ actually imported them from that barrel — confirmed via repo- wide grep. The 3 remaining hits were non-dependencies: a test using "StarField2D" as an arbitrary fixture label string (unrelated to the component), and JSDoc {@link} references. Removed: - [redacted]-visualization/ (…

Delete archive/ and src/apps/api/docs/legacy-central/ · 77b4297

Per explicit user instruction to remove all legacy-named/archive material. - Deleted archive/ (repo root, 428K, 19 files) — pure cold storage, confirmed nothing outside it depended on the contents existing (only on it being excluded from a few scan scripts). Cleaned up the now-dead references: README.md's tree diagram entry, nextjs-coherence-mongo- allowlist.txt's comment pointer, and the "archive/" skip-dir entries in p124-rg-active-gate.py and scan_control_plane_residue.py (unreachable once the directory doesn't…

Resolve src/docs duplicate, correct 2 stale archive/README.md claims · d96eb5e

Per user decision on the flagged duplicate: src/docs/ARCHITECTURE-AUDIT-CONTINUATION- 2026-05-30.md is byte-identical to archive/legacy-src-docs/'s copy. Confirmed which is canonical by diffing the sibling README.md files: src/docs/README.md has no archive banner and describes itself as active, while archive/legacy-src-docs/README.md explicitly says "Archived 2026-07-04" and points back to itself — src/docs/ is unambiguously the live copy, legacy-src-docs/ is the correctly-labeled historical snapshot. Deleted only…

Third sweep — migrate source-code TODOs, clean dead/duplicate files · 029a3db

Third pass per user request: check all plans/docs/files again for remaining open work and legacy files. Two parallel research sweeps (open work outside docs/plans/, and a legacy/deprecated-file inventory) found: Migrated into the wave plan (11 new items, none previously covered): - W0.5 (6 subs): directly-actionable source-code TODOs found in this sweep — cron overlap guard (scheduled-tasks.ts), biometric challenge race condition (biometricChallengeShared.ts), CORE_VALUE_IDS DRY duplication (backfill-domain-ids.ts…

Resolve the two ambiguous cross-repo plan docs · 42e16d8

Per user decision on the two flagged-ambiguous items from the plan-doc sweep: - fleet_operator_decoupling_fcb6413b.plan.md's 5 pending FOS-07-tail items migrated into WAVE-4 (W4.6, cross-repo coordination watch-list) — same treatment as the other sibling-repo items already there, since one of these once had a KANBAN row purged without completion evidence and the work is still real, just not this repo's to do. - tenant_api_server.plan.md deleted outright with no migration — stale pre-repo-split doc describing sibli…

Migrate 3 open items found in a second plan-doc sweep · b9227b3

Full sweep of docs/plans/*.md, docs/paywall/plans/, and .cursor/plans/*.plan.md for open task items missed by the KANBAN.md-only migration. Most of docs/plans/ turned out to be architecture narrative whose task IDs were already fully accounted for in KANBAN.md/plan/waves — only 3 genuine gaps found: - W0.4: REQ-D-01 + REQ-D-07 from docs/plans/23-matching-app-ownership.requirements.md — two rows explicitly marked "Open" with real verify commands, never mirrored into KANBAN.md's TC-MATCH-APP group despite that group…

Migrate open KANBAN.md work to the wave-plan workflow · 018055a

Installs the wave-plan task-tracking format (plan/waves/WAVE-*.html, drained by the global wave-next/wave-bug-hunt skills) and migrates every open item out of KANBAN.md, which is now a frozen historical record. Migration: - Inventoried KANBAN.md in full: 34 open items (4 Todo, 7 Blocked, 23 Backlog) behind 42 unique KANBAN IDs (some pairs cross-reference each other, e.g. BLOCKED-NEXT-03 <-> WF-TRACE-LIVE-E2E-FULL-WORKFLOW). - All 42 IDs migrated into 5 waves (60 wave items total), ordered so every wave except the …

Remove leaked credential, dedupe FEATURE_MATRIX, drop orphaned parity script · 3221cbf

Production-delivery cleanup following the sibling-repo/SaaS removal in 04f9aa0c9 and the shared/tools/ removal in 2fbedf3b5. Researched and resolved the two items flagged there: Credential exposure: - Delete scripts/suspend-host.sh + suspend-host.sudoers.example. The script has carried a real, decodable sudo password (SUDO_PASSWORD_B64) since its first commit (bd1bcd54e, 2026-05-13); it was removed once (14f001dac, 2026-07-09) but resurrected with the secret intact by yesterday's reconciliation merge (9356c3df5) —…

Remove leaked credential, dedupe FEATURE_MATRIX, drop orphaned sibling script · 2fbedf3

Production-delivery cleanup following the sibling-repo/SaaS removal in 04f9aa0c9. Researched and resolved the two items flagged there: Credential exposure: - Delete scripts/suspend-host.sh + suspend-host.sudoers.example. The script has carried a real, decodable sudo password (SUDO_PASSWORD_B64) since its first commit (bd1bcd54e, 2026-05-13); it was removed once (14f001dac, 2026-07-09) but resurrected with the secret intact by yesterday's reconciliation merge (9356c3df5) — confirmed present on origin/main. It's a p…

Remove sibling-repo and third-party-SaaS reach from CI/scripts · 04f9aa0

Makes this repo self-sufficient: no script or workflow here checks out a sibling git repo (app-infra-services/-operator/-host) or calls a third-party SaaS API (Stripe, cosign/sigstore, container registries) anymore. Removed: - 19 scripts/ scripts: sibling-repo path resolvers (ci-infra-paths.sh, ci_infra_paths.py, ci-checkout-infra-layout.sh), sibling-scoped checks (check_control_plane_web_imports.sh, check_importlinter_control_plane.sh, check_module_web_codegen_drift.sh, verify-ml-stateless-smoke.sh, verify-ci-con…

Restore stashed bug-audit findings from feat/journey-bank-seed-stage-deploy · a8aa385

Uncommitted work-in-progress that was stashed before the branch reconciliation: TODO annotations + KANBAN backlog rows from a 2026-08-09 bug-audit pass (cron replica lock, OAuth callback dedup in-memory state, optional-auth chain divergence, dead session on token-refresh failure, discarded passkey session token, duplicated OTP constants). Dropped the GridFS-cleanup-leak finding — the merged main already fixes that differently (deleteIfPresent now swallows its own failures instead of the caller re-throwing).

Lazy-resolve Mongo collections in module-scoped services (UC-22/AT-22.1) · f474f0b

Full-implementation validation surfaced 2 unhandled `MongoNetworkError: ECONNREFUSED` rejections in the API suite (all tests passed, but the errors exit non-zero). Root cause: `PlatformSettingsService` resolved its collection eagerly in the constructor, and three route modules instantiate it at module scope — so importing the connections route fired a Mongo connection at import time whose rejection nobody awaited. In production the same shape is a latent availability bug: the eager pattern caches a rejected promis…

Fix(admin)+chore(web): confirm-guard the profile full-wipe, delete dead chatQueryKeys (UC-21/AT-21.2,21.6) · 395d0c4

Closes the last two open UC-21 items (user delegated both decisions). AT-21.2 [P2]: an unscoped DELETE /api/admin/profiles (no profileIds) does deleteMany({}) -- even the "keep me" variant deletes every other profile -- gated only by a <=450 cap, unlike the sibling POST /api/admin/questions/clear which requires confirm:true. Closer reading changed the prior "deferred" call: the web UI ALREADY gates clear-all behind a confirmation dialog, so the accidental-UI-wipe path was already mitigated and the residual risk is…

Fix(prefs)+refactor(web): atomic admin prefs write + centralize staleTime (UC-21/AT-21.3,21.7) · d489e74

AT-21.3 [P3]: the admin max-visible-profiles override was a read-modify-write on the whole preferences blob (getPreferences -> spread-merge -> full-blob savePreferences), which clobbered a concurrent user preferences save (also a full-blob replace) — an admin-set value could vanish on the user's next unrelated change and vice versa. Added PreferencesService.setMaxVisibleProfiles, an atomic single-field $set: { "preferences.maxVisibleProfiles": ... } upsert, and pointed the route at it. The two writers now touch di…

Client-cache consistency — prefs rollback + profile-edit invalidation (UC-21/AT-21.4,21.5) · 315701d

AT-21.4 [P2]: useUserPreferences optimistic write had no rollback. persistUserPreferences wrote the cache directly then fired the mutation, whose onError only logged — no snapshot, no rollback, no reconcile. With staleTime 60s, no refetchOnWindowFocus, and no invalidation, a rejected app-shell settings toggle (offline/5xx) left the optimistic value stuck in cache, so the UI showed a setting as applied that the server never accepted, silently reverting only on reload. Rebuilt as the standard optimistic lifecycle: o…

Atomic upsert for setConnectionStage + open UC-21 (AT-21.1) · a9ddce5

Two fresh consistency sweeps ran over the admin API and the web client's React-Query layer — the two largest surfaces no use-case had visited. Both produced clean bills of health worth recording: admin authorization is fully guarded (61/61 route preHandlers, no bypass path) and admin write-path validation is complete; the connection/chat client mutation layer correctly invalidates everywhere. AT-21.1 [P2]: AdminService.setConnectionStage was a read-then-write get-or-create (findOne -> insertOne on miss / updateOne…

Route all inline 11000 checks through isDuplicateKeyError (UC-20 DRY) · 3ad976e

Completes the DRY extraction started with lib/db/duplicateKeyError.ts. Migrated the last inline `err.code === 11000` sites to the shared predicate: the four services/profile/profileProvisioning.ts sites, SimulationAgentService, lib/profile/bindAuthUidToEmailProfile.ts (negated form -> !isDuplicateKeyError), lib/learning/appendLearningScorecardEvent.ts, and routes/admin/adminQuestions.ts. Each dropped its now-unused `import { MongoServerError } from "mongodb"`. Every duplicate-key decision in src/apps/api/src now h…

Unify the mutual-reveal bar to one definition (UC-20 DRY follow-up) · e316a5f

requireProfileMediaAccess (the full-photo gate) hardcoded its own `row.stage === "chat_active"` check for the `full` variant — a second copy of the "full disclosure" business rule that already lives in resolveDiscoveryTier (via isPeerFullDisclosureAllowed) and gates the secure-profile wire in peerSecureProfileAuthorization. Delegated it to isPeerFullDisclosureAllowed so the secure-profile read and the full-photo read share a single source of truth: if the product ever moves the reveal bar, both follow automaticall…

Close final UC-20 cluster — culture logging, Qwen single-flight, WebAuthn counter (AT-20.12..14) · 666373d

The last three UC-20 findings. Two corrected a naive fix the sweep suggested, once the actual call sites were read. AT-20.12 [LOW-MED] culture-identity silent data loss: culturalIdentityForProfileApi dropped a present-but-malformed stored blob to null on every branch with NO log, so a user's culture selections could vanish from their profile and every discovery card with zero operator signal. The sweep proposed "throw like the gender/orbVisuals siblings" — reading the call sites disproved that: this runs inside th…

Waitlist atomicity, passkey injection guard, push E11000 retry (UC-20/AT-20.9..11) · cb8c6bd

The MEDIUM-LOW consistency cluster — three "the pattern already exists elsewhere, apply it here" fixes plus the DRY extraction they all wanted. Shared: new lib/db/duplicateKeyError.ts. The err.code === 11000 check had accreted independent copies (DeviceService, connection/mongoWriteRace, emailOtpService, profileProvisioning...), and AT-20.9/20.11 were about to add two more. Extracted isDuplicateKeyError + isOnlyDuplicateKeyWriteError, migrated the three sites the AT-20.5 TODO named, used them in the new sites. Sco…

Guard batch/HTTP recalc with the per-user lease (UC-20/AT-20.8) · dc50827

[MEDIUM-DATA-INTEGRITY] recalculateMatchesForUser (nightly runFullMatchRecalculation batch + POST /api/internal/recalculate-matches) ran calculateAndStoreMatches + updateMatchForProfileChange with NO lease, while the debounced matchRecalculationScheduler wraps the identical two-op sequence in tryAcquireMatchRecalculationLease. So a scheduler run and a recalculateMatchesForUser run for the same user could execute concurrently; both call removeStaleOutboundMatchesForViewer -- a deleteMany from a getAllProfiles() sna…

Record remaining UC-20 sweep findings (AT-20.8..20.14) for follow-up · b9d4041

The two internal-consistency sweeps surfaced more than the seven fixes shipped this round. Records the rest -- all verified real, none P0/P1 -- with severity, location, and why each is lower priority than what shipped, so they're tracked rather than lost: match-recalc lease gap, waitlist rate-limit atomicity, passkey body validation, push-subscription E11000 retry, culture-identity silent-null, Qwen single-flight, and two low items (native-push try/catch, WebAuthn counter guard). Claude-Session: https://claude.ai/…

Read entropy connection ratings through the canonical parser (UC-20/AT-20.7) · c738093

gatherEntropyItemsFromMongo read questionAnswers through the UC-3-hardened parseStoredProfileQuestionAnswer (logs on rejection) but read connectionRatings, fifteen lines later in the same loop, through a private parseConnectionRatingRecord that: accepted only the object shape (silently dropping bare-number and JSON-string ratings, both supported elsewhere); applied no 1-10 range validation (admitting out-of-range values); and logged nothing on rejection. Entropy/IRT item calibration was computed from a silently tr…

Fail closed on missing/unparseable session+challenge expiry (UC-20/AT-20.6) · aaba103

[P1-SECURITY] Two biometric expiry checks failed OPEN. validateBiometricSession did `if (expiresAt) { ...check... } return true`, so a missing expiresAt skipped the check and returned valid, and an unparseable string produced Invalid Date whose `now > invalid` is false -- also valid. assertBiometricChallengeNotExpired had the mirror `if (!expiresAt) return`. expiresAt is typed required on both docs, so these fire only on corrupt/legacy/partial data -- and turned such a row into a never-expiring credential. Neither…

Make email-OTP rate-limit reset atomic (UC-20/AT-20.5) · 5b7dff5

[P0-SECURITY] assertOtpRateLimitScope did findOne then a separate reset updateOne on the "no window / expired" branch -- a check-then-write race. A concurrent burst (the boundary POST /api/auth/email-otp/request has no other limiter) all read "no window", all set count:1, all pass, bypassing the per-email (3) and per-IP (10) caps for the whole burst. Each admitted request sends a non-idempotent outbound OTP email, so this was both a rate-limit bypass and an email-flooding / cost vector. Surfaced by the internal-co…

Compare-and-set stage transitions + fix missing consent guard (UC-20/AT-20.3+20.4) · 4ecf004

AT-20.3 [P0-DATA-INTEGRITY] Five connection transitions (respondChat accept/ reject, requestChat, respondConversation accept/reject) validated a stage precondition against a read, then wrote filtered on connectionId alone -- a TOCTOU window. Concrete failure: user A ends a connection (endConnection: stage -> rejected, consents cleared) while user B's accept-chat is mid-flight; B already passed its chat_requested check against the pre-end read, so its unguarded write sets chat_active and writes chatConsent rebuilt …

Require mutual reveal for peer secure-profile reads (UC-20/AT-20.2) · aee187e

[P0-SECURITY] GET /api/profile/secure?otherUserId= returned any user's private profile to any authenticated caller. The peer branch authenticated the CALLER (JWT + a biometric session belonging to the caller) and then returned whatever profile the caller named -- no connection lookup, no stage check, nothing about the relationship between the two accounts. secureProfileWire emits real email, birthYear, bio, values, thinkingStyle, emotionalDepth, communicationStyle, questionAnswers and connectionRatings. Reachabili…

One implementation for shared-secret comparison (UC-20/AT-20.1) · 31c9779

First fix from the internal-consistency sweep: take a defensive pattern the codebase already uses somewhere, treat that site as the oracle, and find where else it structurally applies but was not used. lib/auth/verifyInternalBearerToken.ts already compares HMAC signatures with timingSafeEqual and a comment justifying it -- the codebase knows the right answer. But two sibling secret checks used plain ===/!==: routes/system/cron.ts (x-cron-secret) and lib/auth/verifyInternalRouteSecret.ts (x-internal-secret, used by…

Close fail-open OAuth email account-linking + refresh-token race (UC-19) · 8bb6d11

Sweep of the auth/session/proxy/storage surface no prior use-case had visited. Two P0-class defects found, both in previously-unswept code. AT-19.1 [P0-SECURITY] OAuth email trusted as an account-linking key with no verification check. GET /api/oidc/callback/{google,zitadel} passed the IdP's raw email into ensureProfile -> getOrCreateProfile, which looks a profile up by emailNormalized and unconditionally $set-s authUid on a match -- a full handover of an existing profile (chats, matches, photos) to the newly auth…

Correct profile-maturity legacy scoring ceiling, close UC-18 · 4ed84ae

calculateProfileMaturity's fallback branch (used whenever a caller passes a bare Profile without server-computed matchingSignalDimensions, e.g. NetworkVisualization.tsx) summed raw points from 4 categories and treated the sum as an out-of-100 percentage, without accounting for 2 skipped categories (connection intent 20pts, other patterns 15pts, honestly documented via pre-existing TODOs) or a previously-unflagged cap on thinking-patterns (12 reachable, not 15, since real users have no persisted questionStyle field…

Judge and close 4 remaining backlog items (UC-16/UC-17) · 06bb1d8

Per explicit instruction to judge each remaining item and make the best call rather than leave them open indefinitely: 1. AT-2.1 (conv_ thread-id namespacing, UC-16): investigated and retired rather than finished. Traced the live producer and found the scheme's own premise was false -- connections.connectionId was never prefixed either, both already use the identical bare pair-key format, so there was no misalignment to fix. Finishing it for real would have meant switching every chat read/write path plus a live da…

Resolve COMP-DESC-VOCAB with real execution, fix broken validator path (UC-15) · 287c533

Cloned app-infra-operator locally and directly executed its real score_validate.py against test fixtures for all 4 candidate vocabulary types instead of continuing to trust or distrust a KANBAN checkbox. Definitive, per-type result: - secret-materialize, http-service: fully wired (discriminated-union entry + generated Pydantic params model) -- proved by running the actual validator. - tls-cert: passes only the shallow type-string check; no discriminator mapping or generated params model -- would likely fail deeper…

Correct stale repo attribution + flag unverified status on COMP-DESC-VOCAB · 1a763af

The Backlog row pointed at app-infra-services, which predates the 2026-07-04 repo split -- confirmed via direct directory listings that app-infra-services' current KANBAN, GAP-ANALYSIS, and file tree have zero trace of this item or resource-types.openapi.yaml. The actual owner today is app-infra-operator. app-infra-operator's own KANBAN shows COMP-DESC-VOCAB checked off, but only as part of a bulk "archived from Todo hygiene 2026-08-08" sweep with no anchor, verify command, or evidence link -- unlike most other ar…

Close Turbopack-vs-webpack drift audit (UC-14), fix 3 stale docs found along the way · f937a88

Researched Next.js 16 Turbopack defaults and empirically verified `next build` (not just `next dev`) already defaults to Turbopack, and succeeds cleanly despite this repo's custom webpack() config in next.config.ts -- Turbopack silently ignores it rather than erroring. Confirmed local dev, the Docker production build, and (the only place CI would build at all) build-once.yml's image build all already agree on Turbopack; the sole webpack path is the deliberate, already-documented dev:docker fallback. No bundler-dri…

Don't let one corrupted peer profile crash a whole discovery page (UC-13) · cd05752

assembleDiscoveryProfilesForMatchPage called mapProfileToDiscoveryProfile with no try/catch, even though that mapper deliberately throws on any malformed peer field (bad dates, invalid discoveryMatchIntentScopeId, etc.) and the surrounding loop already has a careful skip-and-log pattern for three other row-level failure modes. One legacy/corrupted peer profile could abort the whole .forEach and drop every other already-resolved peer in the page -- same failure shape as the UC-11/UC-12 fan-out bugs, here on a mappi…

The 3-repo-split layout fix (72c5adf) landed after this doc's last edit, so its "token alone won't fix it" warning was already resolved and no longer accurate. · 56b9101

The 3-repo-split layout fix (72c5adf) landed after this doc's last edit, so its "token alone won't fix it" warning was already resolved and no longer accurate. Updated to reflect that the code side is done and the only remaining blocker is an org admin adding three repository secrets. Added a KANBAN Blocked row so this doesn't fall off the tracker (it isn't something an agent/CI run can self-serve).

Fill in final verification numbers for UC-12/AT-12.1 · 1418dd6

Fix confirmed regression in ProfilePictureService GridFS cleanup (UC-12) · 582321a

Applying the specific lesson from UC-11 (unguarded best-effort cleanup inside a fan-out can discard a primary operation's success) as a targeted codebase-wide search found a real, unfixed instance -- with zero prior test coverage -- in ProfilePictureService. Two bugs, same root cause: 1. deleteIfPresent (best-effort GridFS blob cleanup, run AFTER the profile document already stopped referencing the old blobs) re-threw on any delete failure. clearProfilePicture had no try/catch around it at all -- a transient GridF…

Update Ideation Process section to reflect UC-10/UC-11 outcomes · 53c699e

Marked the native-push ideation item DONE (now points at UC-10/UC-11), added AT-6.2b's remaining 3-token decision as an explicit open item, and added the codebase-wide "unguarded cleanup inside fan-out" pattern audit (applying the specific lesson from UC-11's confirmed bug) as a mid-term item -- a background review scoped to this exact question across all of apps/api/src is in progress; its outcome will be recorded once it lands rather than duplicating the search here.

Fix confirmed regression + race condition found by adversarial review (UC-11) · a8cc5e7

An adversarial review of the AT-2.2/AT-2.3 code (written this session, not yet through the same scrutiny as the rest of the codebase) found and reproduced two real bugs: 1. CONFIRMED, reproduced: NativePushNotifier.dispatchOne awaited removeDevice() with no try/catch inside a Promise.all fan-out. A transient Mongo error during that best-effort cleanup step rejects the whole Promise.all, discarding every other device's already-resolved outcome, and propagates all the way up through notifyUserAcrossChannels into Dis…

Resolve AT-6.2b "progress" legacy-label conflict with first-party evidence · 8161be5

User asked for more data before deciding AT-6.2b (the 4-token category classification conflict found while consolidating the legacy core-value label tables). Investigated further rather than guessing: - Git history is a dead end -- both consuming files were introduced in the same squashed commit, no earlier revisions to recover original intent from. - [redacted]-questions.json's active qext_cv_023 seed question has a first-party extractionRules mapping of option id "progress" -> category "growth_learning" (via val…

Record live E2E verification of AT-2.3 native push wiring · 464d0d2

Booted the real API server (npm run dev:standalone -- real Fastify process, real in-memory mongod, no mocks) and exercised the actual HTTP surface: confirmed clean boot with the new ApnsPushProvider/FcmPushProvider fail-soft logging, confirmed a valid platform registers and persists for real in Mongo, and confirmed an invalid platform now gets a real 400 from a live request -- not just from the existing unit/mocked test suite.

Implement native push dispatch via APNs + FCM (AT-2.3) · 6a6d6a7

The `devices` collection was written by POST /api/device/token but never read -- all push delivery went through WebPushNotifier (VAPID) only, so native-shell users who registered a device token had nothing use it. Researched current third-party pitfalls before coding: node-apn (the obvious APNs library) has had no release since 2022, deliberately avoided in favor of @parse/node-apn, the actively-maintained Parse Platform community fork, which owns HTTP/2 session management and provider-token (JWT) caching (APNs to…

Generic, database-configurable schema-migration status auditor (AT-2.2) · a2c449c

No production/stage database is attached to this environment. Rather than leave "has migration X already run against real data" as a permanent blocked TODO, this adds a reusable auditing framework an operator can point at ANY MongoDB endpoint (same MONGO_URL/MONGO_DB convention as backfill-domain-ids.ts) to get a real, evidence-based answer in one command. SchemaMigrationAuditor<TDetails> is a generic abstract base class orchestrating collectDetails -> deriveStatus -> summarize into a uniform report. It doesn't as…

Consolidate duplicated legacy core-value label mapping (AT-6.2) · 2508c6b

apps/web's categoryResolution.ts and apps/api's backfill-domain-ids.ts each hand-maintained an independent copy of the pre-PR-3 English-label -> id mapping for core values/categories. Consolidating them into a shared SSOT (src/config/legacy-core-value-label-mapping.json, following the established src/config/*.json convention) surfaced a real, confirmed drift bug: 4 tokens ("peace", "exploration", "discovery", "progress") resolved to DIFFERENT categories depending on which of the two tables handled them. That 4-tok…

Fix stale AT-6.1e status (deletion already happened, doc still said TODO) · 87b9d0f

bindAuthUidToEmailProfile.ts (web) was deleted in the later "Remove 16 verified-dead code items" batch (4ec9cce), but this doc section still said "awaiting user approval to delete" / AT-6.1e TODO. Verified the file no longer exists on disk and the removal commit is in git log. Updated to DONE with the actual verification trail instead of leaving stale status text.

Close UC-9, record final bare-catch sweep results, fix self-inflicted doc bug · 53b91a6

Marks UC-9 DONE with the complete tally across all 4 triaged scopes: 12 bucket-1 fixes, 108 confirmed safe, 1 flagged for human judgment (Zitadel token format). Also fixes a real bug this session introduced earlier: an Edit call meant to insert the UC-9 section accidentally deleted the "## How this document is meant to be used" header line, leaving its bullet list orphaned under UC-9 instead. Caught while writing this update and restored -- documented here per the session's "note lessons learned" convention rather…

Log 5 more silent-fallback catch blocks (UC-9 continued, lib scope) · d31ef0d

Completes the UC-9 bare-catch sweep's lib/** (non-auth) scope, the largest of the four partitioned audits (36 sites: lib excl. auth, design-system, i18n). 5 confirmed true silent fallbacks fixed with a warn-level log before the existing fallback, no behavior change: - lib/dev/fetchBackendAsPlatformAdmin.ts: same INTERNAL_API_SECRET misconfiguration failure shape already fixed at app/api/auth/token/route.ts in an earlier round, missed on this sibling path. - lib/mail/mail_delivery_trace.ts: a genuine backend failur…

Continuation of the UC-9 bare-catch sweep after the earlier scope-correction found ~100 untriaged web-side sites. · c0f3919

Continuation of the UC-9 bare-catch sweep after the earlier scope-correction found ~100 untriaged web-side sites. Three properly-scoped background audits (lib/auth, features, app routes) classified all sites in these three directories; these 4 were confirmed true silent fallbacks and fixed with a warn-level log before the existing fallback, no behavior change: - lib/auth/getSessionJwtFromRequest.ts: a malformed NEXTAUTH_URL silently defaults the secure-cookie flag, which can make every authenticated request fail w…

Record UC-9 bare-catch sweep, correcting a scope mistake honestly · bcac0c2

Documents the 5 silent-fallback catch fixes just committed, and is explicit about a real mistake: the background agent was dispatched against a grep result that claimed web/src had zero bare-catch hits. A fresh re-run found 120+ in web/src alone -- the same directory-scan-truncation failure mode already documented earlier in this session. Flags the ~115 untriaged web sites as genuinely not done rather than letting the doc imply full coverage.

Log 5 silent-fallback catch blocks found in bare-catch anti-pattern sweep · 90d9f61

Part of this session's ongoing sweep for silent-fallback patterns (R1/R2 in the architecture hardening plan). Each of these caught a real, unexpected failure and silently fell back to a default/empty value with zero operator trail. Added a warn-level log call before the existing fallback in each case, preserving the exact same return value/control flow -- only adds observability, matches the AT-3.1-3.4 precedent: - buildServerChatTranscriptPlainText.ts: malformed icebreaker-transcript JSON in a stored chat message…

The existing unit test for the AT-6.1d PROFILE_UPDATABLE_FIELDS allowlist mocks the Mongo collection. · 6b52c88

The existing unit test for the AT-6.1d PROFILE_UPDATABLE_FIELDS allowlist mocks the Mongo collection. Since this is the highest-risk change in the AT-6.1 series (the single write chokepoint for the profiles collection), add real MongoMemoryServer-backed integration coverage matching the existing *.mongo.integration.test.ts pattern: an allowlisted field actually persists and round-trips, a rejected field leaves the existing row provably unchanged (verified in the database, not just "the call threw"), and email norm…

Update INDEX.md progress line to 40 of ~50 atomic tasks resolved · 2908238

Reflects AT-6.1f closing (duplicate validateSyntheticProfileSeed consolidation) and the profileWireToValidatedSeed dead-code finding.

Marks the short-term items this session actually closed (UC-5/UC-8 dead-code passes, AT-6.1 profiles schema gap, AT-5.11 parity test) as DONE instead of leaving them as stale open… · 8e42350

Marks the short-term items this session actually closed (UC-5/UC-8 dead-code passes, AT-6.1 profiles schema gap, AT-5.11 parity test) as DONE instead of leaving them as stale open items. Adds a new short-term note on the sim-user actor-vs-cohort architectural seam surfaced while investigating AT-6.1f/profileWireToValidatedSeed (cohort = permissive/Mongo-direct, actor = meant to behave like a real HTTP client but has quietly started reading Mongo directly too via loadValidatedSeedFromMongo -- worth an explicit desi…

Flag profileWireToValidatedSeed as non-functional against real data · e9a4465

Investigation into why this function has zero callers (per user's "keep it, add a task to finish/wire it up" decision on the AT-6.1f dead-code finding) found it isn't just unused -- it will always throw against a real GET /api/profile response. That endpoint's wire shape deliberately omits values, thinkingPatterns, connectionIntent, and otherPatterns (confirmed by reading selfProfilePublicWireFromStored), which this function requires as non-empty. simulation-worker/src/loadValidatedSeedFromMongo.ts's own doc comme…

Close out AT-6.1f, flag new dead-code candidate for approval · 0a2c449

Marks AT-6.1f DONE with the full investigation trail and verification counts. Flags a new dead-code finding surfaced during that investigation: profileWireToValidatedSeed's outer function (services/sim-user/actor/) has zero production callers and zero test coverage -- awaiting user approval to delete or turn into a real task, not deleted yet.

Consolidate duplicate validateSyntheticProfileSeed implementations · 84806d4

syntheticProfileLifecycleSeedValidation.ts (cohort) and profileWireToValidatedSeed.ts (actor) each defined their own validateSyntheticProfileSeed with the same field set and validation intent -- a documented, acknowledged duplication (actor's own doc comment said "inlined for actor HTTP path") with no automated check keeping them in sync (AT-6.1c precedent: this is exactly the R5 duplication anti-pattern). Traced every real call site of both functions before consolidating. The two differed in three ways: check ord…

Marks AT-6.1d (profiles field allowlist) and the AT-7.2 divisor follow-up DONE with full write-ups (design rationale, verification counts). · a9d7793

Marks AT-6.1d (profiles field allowlist) and the AT-7.2 divisor follow-up DONE with full write-ups (design rationale, verification counts). Adds the validators.ts dead-code item to the UC-8 section (found while fixing doc references for the registry.ts deletion, user-approved separately). Fixes a stale "see commit for exact counts" placeholder in the AT-7.6 section with the real historical commit's numbers. INDEX.md progress line updated to 39 of ~50 atomic tasks resolved.

Add field allowlist to ProfileService.updateProfile · dc29a7d

updateProfile() previously did a pass-through $set into the profiles collection with zero field-name gating: any caller (including any future one) could write arbitrary top-level fields straight to Mongo. Adds PROFILE_UPDATABLE_FIELDS, a 22-field allowlist sourced by reading all 3 real callers directly, and a new ProfileUpdateFieldNotAllowedError thrown before any Mongo call when an update contains a field outside it. Scoped deliberately to field *names* only, not full value-schema validation -- each of the 3 call…

Correct answerDepthToAxisScore divisor (was capping at ~66.7) · 6cbabe5

answerDepthToAxisScore divided by a hardcoded 3, but the actual maximum achievable depth from singleAnswerDepthScore is ANSWER_DEPTH_MAX_PER_ANSWER (2.0: +1 free-text, +0.5 extra notes, +0.5 selected options). A maximally "deep" answer therefore capped at (2/3)*100 ~= 66.7, never reaching the 0-100 range the function's own doc comment claims. User-confirmed as a genuine off-by-one scaling bug, not intentional headroom. Fix raises solo-profile signal-strength scores for answers already at max depth -- a deliberate …

Remove dead validators.ts, fix README_INDEX to match reality · 8aa8199

validators.ts had zero external callers (verified via grep across src/ and tests/); the middleware/validators subsystem it documented was already superseded by direct-import Zod schema usage generated from OpenAPI. README_INDEX.md rewritten to describe the actual pattern feature modules use today (import generated Zod schemas, call .parse()/.safeParse() directly), listing real consumers found via grep. User-approved deletion (dead-code sweep, architecture hardening plan UC-8).

Document Zitadel registration placeholder lastName instead of a bare TODO · 696234a

UserRegistrationService.ts hardcoded lastName: "User" with a TODO complaining about the hardcoding but no explanation of why. Verified the actual constraint: POST /api/users only ever collects email/password (no name field exists anywhere in the registration form or wire contract), but Zitadel's human-user schema requires a non-empty lastName. Confirmed this placeholder never reaches the app's own data — AuthService.ensureProfile creates the profiles document from authUid/email only, never from Zitadel's firstName…

Record AT-7.2 completion — all UC-7 hardcoded-parameter tasks now done · 1f7c092

docs/plans/23-architecture-hardening-plan.md: AT-7.2 marked DONE with full write-up; new follow-up task tracks the answerDepthToAxisScore /3 divisor decision found mid-fix. docs/plans/INDEX.md: progress line updated (36/~50 atomic tasks resolved), UC-7 (hardcoded-parameter centralization) now fully implemented (AT-7.1 through AT-7.6, all done).

Source dimensionScoring.ts answer-depth constants from the SSOT (AT-7.2) · 5847999

The web-side legacy/testbench dimensionScoring.ts (feeds positionProfilesInPersonalizedUniverse.ts, not the live discovery universe path) independently hardcoded the same four answer-depth magic numbers as the api-side implementations. Now reads them from the new src/config/answer-depth-scoring.json SSOT (synced copy in apps/web/config/) instead, matching the api-side fix. Verified: npx tsc --noEmit clean, full web suite 867/867 files / 2768/2768 tests, zero regressions — same numeric output for the same input. Ne…

Consolidate duplicated answer-depth scoring formula in apps/api (AT-7.2) · c5fea8f

productMatchDimensionScoring.ts's calculateAnswerDepth (production emotional-depth dimension) and profileMatchingSignals.ts's singleAnswerDepth (solo profile-completeness signal) implemented the identical per-answer depth formula independently. Extracted a shared singleAnswerDepthScore into a new lib/matching/answerDepthScoring.ts, sourcing its four magic numbers from the new answer-depth-scoring.json SSOT, and switched both call sites to use it. MatchCalculator.ts's lab-only variant operates on a structurally dif…

Add answer-depth-scoring.json SSOT (AT-7.2) · 5606df9

New src/config/answer-depth-scoring.json holds the four magic numbers behind the "answer depth" match-scoring formula (free-text length threshold, extra-notes length threshold, and their point values), previously hardcoded independently in four places across apps/api and apps/web. Follows the codebase's established src/config/*.json + parity-test convention (connection-ring-thresholds.json, personality-quadrant-parity.json) rather than a new ad hoc approach. Added the file to .gitignore's allowlist and sync-produc…

Record AT-7.4/AT-7.5 completion in architecture hardening plan · 06a2936

Only AT-7.2 (the 4x-duplicated production match-scoring formula) remains open in UC-7 — deliberately deferred, needs more care since it touches live match percentages rather than a mechanical extraction.

Share diagnostics field-length MAX_LENGTHS between route and service (AT-7.4) · 7090fea

registerDiagnosticsRoutes.ts's Zod schema and ClientDiagnosticsService.ts's MAX_LENGTHS object independently typed the same 7 field-length bounds for the same unauthenticated POST /api/diagnostics/client-logs endpoint — byte-for-byte identical, but with no shared constant tying them together. Exported MAX_LENGTHS from ClientDiagnosticsService.ts and derived every Zod .max() call in the route from it, so the two are now structurally the same reference instead of just numerically in sync today. Fixed a real test bre…

Extract duplicated backendBaseUrl() into lib/env.ts (AT-7.5) · 513f55b

internal_backend_fetch.ts and passkey_backend_proxy.ts each defined an identical backendBaseUrl() function, including the same hardcoded "http://localhost:3001" dev fallback. Extracted to a new resolveBackendBaseUrl() export in lib/env.ts. Kept as a plain function reading process.env fresh on every call rather than a property on that file's eager `env` object — env's properties are captured once at module load, which would make a base-URL resolver stale across tests that mutate process.env per case. Verified: npx …

Record AT-7.1 completion in architecture hardening plan · cd38cb8

Centralize residency maxLength and add SSOT parity test (AT-7.1) · 49708b3

ProfileResidencyTextField.tsx independently hardcoded the literal 200 twice (.slice(0, 200) and maxLength={200}) instead of deriving it from product.openapi.yaml's UpdateProfileRequest.residency.maxLength (the real SSOT, already correctly generated into zod-schemas.ts on the API side). Confirmed openapi-typescript erases maxLength from the generated TS types entirely, so importing the bound directly isn't possible. Exported a single named RESIDENCY_MAX_LENGTH constant and used it in both places, then added a parit…

Record AT-6.1c completion and new AT-6.1f follow-up · cec8344

docs/plans/23-architecture-hardening-plan.md: AT-6.1c marked DONE, documenting the second duplicate validateSyntheticProfileSeed function found while fixing it. New AT-6.1f tracks the consolidation decision for the two duplicate functions. docs/plans/INDEX.md: progress line updated (32/~49 atomic tasks resolved, updated test counts).

Route synthetic-profile orbVisuals through the canonical write gate (AT-6.1c) · 0b2d67a

syntheticProfileLifecycleSeedValidation.ts's orbVisuals check independently re-implemented a weaker version of prepareOrbVisualsForProfileUpdate (the AT-4.5 write gate wired into POST /api/profile): non-empty color/texture and finite size, but no hex-format normalization and no exact-key allowlist. While fixing it, found a second, independent duplicate not covered by the original write-site audit: profileWireToValidatedSeed.ts exports its own validateSyntheticProfileSeed — same name, nearly identical body, its own…

Update INDEX.md progress line for AT-6.1b · f9d5063

Record AT-6.1b completion in architecture hardening plan · 846c599

Validate questionAnswers map in admin Q&A bulk import (AT-6.1b) · 9d10f94

QuestionAnswersImportService.importFromBody's parser (questionImportWire.ts) checked only that profiles[i].questionAnswers was non-null before merging it straight into a Mongo $set — any JSON shape for its keys/values (numbers, nested objects, arrays) landed in the profiles collection verbatim. Added QuestionAnswersMapSchema = z.record(z.string(), z.string()), matching the real wire contract SaveProfileAnswerRequest already enforces for the single-answer path (POST /api/profile/answer, answer: z.string()) that thi…

Record UC-8 dead-code sweep round 2 completion · b4ba032

docs/plans/23-architecture-hardening-plan.md: UC-8 marked DONE with the full deletion list, the debugSettingsApiPaths.ts false-positive catch-and-revert, and the new validators.ts dead-code flag recorded for a future approval round. docs/plans/INDEX.md: progress line updated to reflect the 21 deleted items and both apps' full green suite counts (api 264/264, web 864/864).

Remove 16 verified-dead code items from apps/web (UC-8 round 2) · 4ec9cce

User-approved deletion after a fresh grep re-check (src/ and tests/) immediately before each removal, matching the UC-5 verification bar. One false positive was caught by this re-check and restored before commit rather than deleted: debugSettingsApiPaths.ts is read via readFileSync by tests/atomic/security/admin-ui-push-test-api-path.test.ts (a string-content assertion, not an import, invisible to a plain "who imports this" grep) — left untouched. Whole files removed (zero callers anywhere): - lib/profile/bindAuth…

Remove 5 verified-dead code items from apps/api (UC-8 round 2) · 3b529ad

User-approved deletion after a fresh grep re-check (src/ and tests/) immediately before each removal, matching the UC-5 verification bar: - lib/http/connectionStatementsApiCodes.ts (whole file) — zero references anywhere. - lib/chat/chatMediaOrphanPolicy.ts (whole file) — a GC-policy constant for GAP-8.2.6-02 that was apparently never wired in (the sibling constant for the same GAP is used, this one wasn't). - lib/chat/mongoTransactionSupport.ts (whole file) — zero callers. - lib/learning/learningPolicyConstants.t…

Record AT-6.1a/AT-7.3/AT-7.6 completion and UC-8 dead-code sweep round 2 · 3db7476

docs/plans/23-architecture-hardening-plan.md: - AT-6.1a, AT-7.3, AT-7.6 marked DONE with fix + verification detail. - New UC-8 section: fresh dead-code sweep findings (~20 items across both apps, background agent a21a88f8e98e54f7b), recorded but NOT deleted per this session's updated dead-code policy — awaiting explicit user approval to delete or convert to finish-it tasks. docs/plans/INDEX.md: progress line updated (30/~47 atomic tasks resolved).

Fix missing SELF_PEER_FORBIDDEN in web connectionTransitionDetailCodes (AT-7.6) · 2385a4d

Found by a dead-code sweep's "mirror pair" check, then confirmed as a real bug rather than dead code: the web-side CONNECTION_TRANSITION_DETAIL_CODES was missing SELF_PEER_FORBIDDEN, present in the API-side source of truth. resolveConnectionTransitionUserMessage's DETAIL_TO_INTL_KEY map had no entry for it, so a real, tested backend error path (services/connectionService.selfPeerReject.test.ts, e2e connections-self-peer-rejected.spec.ts) silently fell back to a generic error message instead of a localized one. Add…

Fix getMatchPriorityLevel re-hardcoding connection-ring SSOT (AT-7.3) · a8eb56d

MatchCalculator.ts's getMatchPriorityLevel hardcoded 85/70/60 a second time — byte-identical to connection-ring-thresholds.json's RING1/2/3_MIN, which connectionRingBandConfig.ts already imports correctly as SSOT — plus an extra, unsourced 50 cutoff. This function runs on the real production match-persistence path (storeProductMatch.ts, BulkMatchProcessor.ts): every `matches` row written for a real user got a priorityLevel computed from a silently-drifting second copy of the threshold values. Imported the three sh…

Zod-validate admin bulk-profile-upload input (AT-6.1a) · 2baa54b

AdminService.bulkUploadProfiles was the least-constrained write path in the codebase: normalizeBulkProfilePayload spread raw admin-uploaded JSON straight into insertOne() with zero field-shape check, gated only by an array-length cap. The dead AdminBulkUploadProfilesRequest Zod schema was never wired into the route. Verified (via research agent) that POST /api/admin/profiles is a real admin-facing feature (the Super Admin "System Data" tab's bulk-JSON import UI), distinct from the synthetic/lab profile generator p…

Record AT-4.3 completion and split two audits into 10 new atomic tasks · ee128a5

docs/plans/23-architecture-hardening-plan.md: - AT-4.3 entry rewritten to reflect the full 26-handler rewrite (supersedes the earlier date-only slice), with the accounts/link unvalidated-insertOne finding called out explicitly. - AT-6.1 (profiles collection write-site audit, background agent a27ff8ab3c471545b) recorded with its full 13-write-site findings and split into AT-6.1a-e: admin bulk-upload's unvalidated insertOne (highest severity), admin question-answers bulk import, a weaker duplicate orbVisuals validat…

Fully Zod-harden registerInternalNextAuthRoutes.ts (AT-4.3 complete) · e943d7f

All 26 internal NextAuth adapter-persistence handlers now validate request.body against a per-handler Zod schema via validateBody(), replacing hand-rolled `request.body as {...}` casts and manual presence checks. Supersedes the earlier date-only slice. Most severe finding: accounts/link had zero validation of any kind before linkNextAuthAccount() ran a raw accounts.insertOne() — fixed with a LinkAccountBody schema verified field-for-field against both the store-layer AdapterAccountRecord type and the real caller (…

Add max array-length bounds to admin bulk-import routes (AT-4.4) · 159f63c

POST /api/admin/questions/bulk, /api/admin/connection-statements/bulk, and /api/admin/profiles cast their body array to unknown[] with no upper bound. Requires an already-compromised admin session to exploit, hence low priority, but still an unbounded trust-boundary input. Added a 1000-item cap to all three -- 10x simulation_population_size (100) from src/config/learning_policy.stage.json, generous enough for any real bulk-import/seed use case while ruling out a pathological payload. Added an HTTP-level test for a…

Add missing loop-lock closeout docs referenced by CI gate and a test (AT-2.5) · 79695ee

.cursor/LOOP-KIT-PORT.md and .cursor/loop-locks/README.md were referenced by .cursor/README.md/PROMPT.MD and required to exist by both a vitest test and scripts/check_product_isolation.sh's real MAINTAINER_CLOSEOUT_DOCS gate, but neither file existed anywhere in the repo. git log --all -S for both file names found exactly one same-day commit pair (1e059ab added the doc references, 3c9f080 added the test asserting they exist) with no earlier or later commit, branch, or sibling repo ever delivering the actual files …

Validate date fields in registerInternalNextAuthRoutes.ts (AT-4.3 slice) · 03e1cd2

new Date(body.expires) and 4 more identical call sites (emailVerified x2, expiresAt, now) passed unvalidated wire strings straight to the NextAuth adapter-store layer -- new Date() silently returns Invalid Date on garbage input instead of throwing, so a malformed value would have been persisted rather than rejected. Added parseRequiredDate/parseOptionalDate helpers; every new Date(body.X) call site in the file now 400s with a field-specific message before reaching the store layer if the string doesn't parse. The o…

Add max-length/enum bounds to chat, profile, and report input schemas (AT-4.1/4.2) · 2127ba5

SendMessageRequest.text, UpdateProfileRequest.bio/name/firstName/lastName/ interests[], and reportUser_Body.reason/details had no upper bound beyond Fastify's default ~1MB body limit; SendMessageRequest.messageType accepted any string despite being a documented 5-value closed set. Edited the SSOT (src/packages/contracts/product.openapi.yaml) first, then regenerated src/apps/web/src/generated/api-types.ts for real (its generator has no cross-repo dependency) and hand-mirrored the same bounds into the generated Zod …

Remove verified-dead code (AT-5.1-5.10) and fix two pre-existing test/reality gaps · 82492cd

Deleted 9 verified-dead exports/files identified by the architecture sweep: deprecated discovery-wire parser aliases, resolvePeerInboxRouteLabel, match-card's resolveMatchPercent barrel, the unused RuntimeConfigService, url-resolver's dead refreshConfig(), coreValueIcons' iconForCategoryColor, idGeneration's web-side generateConnectionId alias, stubUserBlocksCollectionInMongoMock, and the emailOtpProof.ts re-export shim (repointed its one real consumer and one test mock at emailOtpService.js directly). Updated the…

Fix BOLA/IDOR, broken migration, silent-fallback logging, cross-repo SSOT inversion (#6) · eb2b06d

* Fix BOLA/IDOR, broken migration, silent-fallback logging gaps, cross-repo SSOT inversion Security/data-integrity (P0): - resolveChatPeerOtherUserIdForViewer: fail closed instead of returning an unverified peer identifier when no connection exists (BOLA/IDOR fix); registerConnectionsQwenRoutes now catches the resulting 404 correctly. - Disable the broken conversationThreadId migration: it prefixed conversationId with conv_, but no live read/write path ever adopted that scheme, so running it would have silently fo…

Stop all workflows from running automatically (#5) · 8d3f989

All GitHub Actions workflows now trigger on workflow_dispatch only — no more automatic push/pull_request/schedule runs.

Stop all workflows from running automatically · a7030d5

Every workflow under .github/workflows/ now triggers on workflow_dispatch only. Removed push/pull_request triggers from ci.yml, build-once.yml, operator-ui-e2e.yml, schema-contract.yml, service-worker-bundle.yml, and universe-fragment-shader.yml; removed the weekly schedule trigger from fleet-tenant-automated-health.yml. The three web-client-e2e-*.yml workflows were already workflow_dispatch-only. Every affected workflow has been failing on every push/PR at the cross-repo checkout step since 2026-06-29 (missing IN…

Point Turbopack root at the pnpm workspace, not apps/web itself · d12d873

next.config.ts pinned turbopack.root to __dirname (src/apps/web). That's narrower than the actual pnpm workspace root (src/, per pnpm-workspace.yaml), and apps/web's tsconfig.json extends the sibling workspace package @ifeoma-tc/tsconfig (src/packages/tsconfig) through a node_modules symlink. With root scoped to apps/web, Turbopack refused to follow that symlink and `next dev` failed every request with "tsconfig.json: extends ... doesn't resolve correctly" — found while running the app locally end-to-end (includin…

Migrate CI workflows and infra-sibling path resolution to the 3-repo split · 72c5adf

app-infra-services split into app-infra-operator (operator/fleet/tenant/ conformance/contract-management) and app-infra-host (runtime-host/vm-manager) on 2026-07-04, with cicd-pipeline renamed conformance-management and api-management renamed contract-management along the way. Every checkout step, shell/Python/Node path-resolution helper, npm script, and production code path in this repo that referenced the old single-repo monorepo layout was silently pointing at directories that no longer exist. - Add app-infra-o…

Flag that app-infra-services was split 2026-07-04 — token alone won't go green · 2dc9455

Cloned app-infra-services directly to check the layout the CI checkout expects. scripts/ci-checkout-infra-layout.sh's REQUIRED_MODULES (cicd-pipeline, fleet-management, operator-management, tenant-management, api-management, machine-learning) do not exist at that repo's root anymore: control plane moved to a new sibling repo app-infra-operator, host/runtime moved to app-infra-host, and machine-learning moved under horizontal-services/machine-learning. Both sibling repos are real and actively pushed to (as recently…

Rename cross-repo checkout secret to match sibling repo's convention · c8921a9

app-infra-services already checks out app-trueconnection with the same shape (token: ${{ secrets.TC_APP_CHECKOUT_TOKEN || github.token }}, in build-once.yml). Renamed INFRA_CHECKOUT_TOKEN -> INFRA_APP_CHECKOUT_TOKEN to match that org convention (<repo-being-checked-out>_APP_CHECKOUT_TOKEN) instead of inventing a new naming style. Also documented in docs/ci/infra-checkout-token.md: - TC_APP_CHECKOUT_TOKEN's value couldn't be confirmed (app-infra-services' own build-once.yml fails earlier, at a "Require product CI b…

Backend-driven client-server logging + dependency fixes (#1) · b277720

Backend-driven client-log ingestion (severity-gated, admin toggle) plus fixes for pre-existing undeclared apps/web dependencies and a test-fixture bug. See PR #1 for full details.

Decouple local dev boot from downstream infra services · 49fd488

- DEV_AUTH_BYPASS now actually removes the ZITADEL dependency in dev on both apps/api (env.ts) and apps/web (buildZitadelProvider), instead of still requiring well-formed ZITADEL_* values to boot. - Added apps/api/scripts/dev-standalone.mjs: in-memory MongoDB + dev-safe env in one command (npm run dev:standalone / pnpm dev:api:standalone) — no Docker, no ZITADEL, no sibling app-infra-services checkout. Verified end-to-end. - Fixed dead apps/api/scripts/lin/start.sh (referenced tooling/containers that no longer exi…

SSOT for ifeoma-tc prod ship · 36735a5

Auto-prepared by operator-deploy-source-ship for lifecycle tenant-prod-app-ship.

Point non-product skills at owning-repo SSOTs; keep product skills local. · ae0591f

Replace misplaced operator/fleet/control-api skill trees with alias stubs and retain product-* skills as the product SSOT for the skills migration.

Update ai-workflow-skills paths after kit restructure (installers/harness) · 5a13087

Update references after ai-workflow-installer -> ai-workflow-skills rename · 0badb0e

Add agent context, verify scripts, and kanban evidence. · cd53932

Implement journey-bank seed, matching scaffold, and binding modules. · 78b5be4

Expand product OpenAPI contracts for journey and matching surfaces. · d8a9f91

Extend Score descriptors for secret-materialize and matching workload. · 49da93b

Add agent rules, skills references, and run-canvas tooling. · 6695b5d

Agent overlay bindings for repo boundaries, API contract norms, and maintainer skills.

Restore verify.sh and record journey-bank seed evidence. · c1d8eb1

Restores maintainer verify entrypoint and KANBAN evidence for journey-bank ensure + E2E work.

Extend descriptors for secret-materialize and matching workload. · 295b8c2

Aligns Score YAML fragments, verify scripts, and CI checks with composable registration vocabulary.

Add matching-service scaffold and Score descriptor. · 46b37d5

FastAPI health/internal route stubs for future strangler; live path remains ml-service until API wiring ships.

Add service binding modules for API and web clients. · 3c257a6

Wires composable app descriptor env keys with focused binding tests and import allowlist updates.

Hint users to check spam folder for sign-in codes. · f0a0dc5

Shows localized spam/junk folder copy on OTP verify and magic-link email-sent steps.

Add journey bank seed-and-answer Playwright spec. · 47647ec

Ensures banks via internal ops route, answers reflection and connection in UI, and asserts profile wire persistence without ensure-discovery-peers pre-answers.

Add idempotent journey-bank ensure deploy gate. · 8ee3ef2

POST /api/internal/ops/ensure-journey-banks skips when active banks meet journey minimums; otherwise upserts packaged seeds. Includes operator scripts, Dockerfile seed COPY, and tests.

Add pricing model research, simulator, and phase-0 plan. · 46d7501

Use brand globe for favicon and PWA maskable icons · 3bf9273

Replace sparkle mark with concentric AppBrandHeroOrb-style globe so browser tabs and install icons match the Android launcher.

Note Traefik strips Next Vary on assetlinks route · aa2ac26

Document tc-dal-strip-vary empty Vary removal for Google DAL.

Exclude /.well-known from Next security headers · c233242

Keep Digital Asset Links and AASA on route-only headers so Google DAL is not served page CSP/frame policies that correlated with intermittent ERROR_CODE_MALFORMED_CONTENT.

Clarify assetlinks route skips page security headers · d215a4d

Point at next.config exclusion of /.well-known for Google DAL fetcher.

Compact assetlinks JSON and minimal Content-Type · ca88733

Google DAL echoes our current fingerprints (colon-stripped in errors) yet still returns MALFORMED_CONTENT — align body/headers with Play snippets.

Note pretty-print purpose on buildAndroidAssetLinksJson · 14307c8

Document why assetlinks JSON is indented (Google DAL body-cache bust).

Colon fingerprints are live but statements:list still reports the old colon-free malformed payload — change body bytes so caches miss. · 6e7856e

Track assetlinks.json route; set no-store Cache-Control · e3aea96

*.json gitignore hid the App Router folder named assetlinks.json/. Un-ignore the route and send Cache-Control no-store so Google DAL can refresh after the colon-fingerprint fix.

Google Digital Asset Links rejects colon-free fingerprints as malformed. · c000fab

Normalize env input to AA:BB:… in buildAndroidAssetLinksJson output.

Checkpoint before checking out main · 4768c2f

Sync agent bindings and tc-bindings KB. · c12c78d

KANBAN Phase 0 closeout, plans, and requirement coverage. · 43f671d

Update verify scripts, workflows, and maintainer gates. · 2bec60e

Paywall, connection workflow, and atomic coverage. · 71b861c

Paywall integration, discovery filters, and shell workflow updates. · 88ab84f

Regen OpenAPI axios clients and models. · 6e7e02d

Expand rbac, rate-limit, and route regression coverage. · 8aaf837

Harden chat, connections, mongo transactions, and admin routes. · a93eee3

Phase 0 paywall entitlements, purchases, and enforcement. · 5c5f341

Update composable application manifest and score docs. · 394b15f

Unify learning policy paths and pricing catalog SSOT. · afe09d7

Split matching service ownership and HTTP clients. · fe734dd

Add paywall and matching OpenAPI surfaces. · c858032

Sync top-level SSOT for product-only repository scope. · 8427856

Refresh AGENTS, KANBAN, PROMPT, and feature matrix pointers after moving control-plane ownership to sibling repos and tightening CI requirements.

Align tests and admin UI with sibling infra layout. · 6375300

Update infra path helpers, atomic invariants, e2e helpers, release notes, and admin debug settings for control-plane integration via env and HTTP only.

Move cursor plans and trim infra analysis drafts. · 27410e3

Archive superseded cursor plan files and drop fleet/operator/pipeline analysis drafts that now live in sibling infra repositories.

Consolidate plans for product-only repo boundary. · 51b0e89

Retire control-plane and VMM hosting plan drafts from the product tree; update structural overview, gap checklist, and execution roadmap for HTTP/env sibling integration.

Trim agent overlay to product-only bindings. · bc9aba6

Remove infra-operator KB, skills, and plans from the product overlay; refresh navigation indexes, tc-bindings, and product-stage skills for sibling-repo HTTP/env integration.

Drop control-plane workflows and product CI layout scripts. · fd67c04

Remove build-once, fleet health, and operator UI workflows plus infra-path helpers from the product repo; tighten verify and isolation guards for sibling-repo integration only.

Remove product control-plane Python bridge. · 581f8c6

Delete src/interface and shared import-tier tooling so the product repo no longer hosts Fleet-facing Python; drop UI and tests that assumed in-repo control-plane codegen and fleet debug hints.

Remove obsolete workflow-register scripts and suspend-host helpers. · 14f001d

Drop in-repo agent workflow lock CLIs superseded by ai-workflow-installer; trim package.json scripts and update kanban sync tooling accordingly.

Add paywall planning docs and KANBAN TC-PAY implement group. · 959b98f

Introduce pricing SSOT, requirements, phase-0 plan, interactive model, and board rows wired to ai-workflow-installer req_coverage harness.

Add run-canvas CLI source kept in product repo. · 82717b0

Portable run-canvas skill installs from ai-workflow-installer but requires this repo-local tools/run_canvas.py and tests for canvas generation workflows.

Update plan docs, PROMPT, and scripts/verify.sh to use the sibling installer harness instead of removed in-repo ideation tooling. · abd86d7

Stop tracking portable installer-managed skills and rules in git. · 16c3508

Portable packages reinstall from ai-workflow-installer; add gitignore lockfiles, TC platform anti-patterns overlay, and update agent docs/KB paths accordingly.

Sync package-lock typescript dev flag after install. · f16b00c

Add application.yaml identity manifest for True Connection. · 42b9f61

Normalize dev compose npm install for bind-mounted packages. · 7ba255d

Clear stale node_modules volume seeds and install via scratch dir when package.json uses file:../../packages paths that break arborist in /app.

Migrate clean-arch consumer pointers to app-code-compliance · 102675e

Update KB, bindings, and architecture audit docs to use scanner-clean-arch or POST /api/v1/scans instead of retired dependency_graph_analyser paths.

Document optional code-compliance scan API for clean-arch audits. · c781f61

Point dependency-graph-analyser KB at POST /api/v1/scans and consumer-migration docs.

curl, build-info, and e2e:health-gate PASS on stage (0.1.1009 / 0.1.193). · d40c2eb

RESEARCH-SLOT4-BOARD-STATE-85 — §0b triage PASS · 04bcf09

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked; sync Backlog pulse note to OPS-STAGE-85.

curl, build-info, and e2e:health-gate PASS on stage (0.1.1009 / 0.1.193). · 923c330

Add RESEARCH-SLOT4-BOARD-STATE-84 audit log row · e4dc8e1

RESEARCH-SLOT4-BOARD-STATE-84 — §0b triage PASS · cacfb2c

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked; sync Backlog pulse note to OPS-STAGE-84.

curl, build-info, and e2e:health-gate PASS on stage (0.1.1009 / 0.1.193). · 1077d4a

Add RESEARCH-SLOT4-BOARD-STATE-83 audit log row · 02fa13b

RESEARCH-SLOT4-BOARD-STATE-83 — §0b triage PASS · eb363e8

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked; sync Backlog pulse note to OPS-STAGE-83.

curl, build-info, and e2e:health-gate PASS on stage (0.1.1009 / 0.1.193). · fbcf750

Add RESEARCH-SLOT4-BOARD-STATE-82 audit log row · 166a941

RESEARCH-SLOT4-BOARD-STATE-82 — §0b triage PASS · 2ff391f

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked; sync Backlog pulse note to OPS-STAGE-82.

curl, build-info, and e2e:health-gate PASS on stage (0.1.1009 / 0.1.193). · 1aeaf6e

RESEARCH-SLOT4-BOARD-STATE-81 — §0b triage PASS · 4e686ba

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked in app-infra-operator.

curl, build-info, and e2e:health-gate PASS on stage; Let's Encrypt TLS OK. · 93e40b8

RESEARCH-SLOT4-BOARD-STATE-80 — §0b triage PASS · 26a6fd4

Todo idle; plan drift clean; product gates PASS; infra codegen drift remains Blocked in app-infra-operator.

OPS-STAGE-CONTINUITY-PULSE-80 — stage TLS restored · 396cefd

Document P0 pulse: Traefik default cert regression fixed via infra-refresh-traefik-tls; curl and e2e:health-gate PASS on stage.

WF-TRACE matching-signal parser boundaries at read sites · eb50187

Replace DiscoveryProfile and inline unknown casts with SSOT helpers (readCompleteMatchingSignalDimensionsOrNull, coerceDiscoveryProfileScoreDeriveInput, universePlacementProfileFromPartial) across discovery, chat, profile maturity, and analytics.

Route discovery profilePicture through shared wire mapper. · 74ada31

Map profilePicture in discoveryProfileWireToClient via mapProfilePictureFromWire; drop adapter cast; fix truncated RESEARCH-SLOT4 kanban verify gate.

DRY profile card normalizer through wire field mappers. · 0b8b69e

Route profileDataNormalizer and profileEnrichment extension fields through profileWireFieldMappers; close WF-TRACE group with strict tests under tests/atomic/profile.

Tighten Rating OpenAPI schema and strict wire parsers. · e2284ed

Replace loose additionalProperties Rating with required fields matching GET/POST /api/ratings responses; regenerate types and validate at parseRatingsFromWire boundary.

WF-TRACE gates for analytics, ratings, and journey bank failures · 39f64b8

Stop silent empty states when ratings or journey bank APIs fail; add pure gate SSOTs, wire parsers, and atomic/gray-box test coverage wired into verify-product-gates.

Update KANBAN, README, FEATURE_MATRIX, cursor skills/KB, and archive drafts so platform orchestration references the split operator repo. · 37bd078

Rewrite structural overview and fix cross-repo plan links. · d4dfd1a

Point control-plane references at app-infra-operator, correct module GitHub paths in plan 18, and add repository.yaml descriptor stub.

Saga registration only; no operator HTTP from product · 09a7b92

Remove cross-repo filesystem pointers and run.py delegation. Product SourcePublicInterface and OpenAPI resolution are owner-local only; CI and tests use APP_INFRA_* env fail-closed. Score README documents registration bundle; product runtime uses tenant merge-env (ML, Mongo, Redis) only.

Link mobile backlog rows to sibling KANBAN.md · 5a79211

Device verification work is tracked in app-trueconnection-ios/android repos.

Extract iOS and Android shells to sibling repos · ee1dc2a

Move src/40_ios and src/50_android into app-trueconnection-ios and app-trueconnection-android; scope product PWA gates to web-only and resolve mobile paths via SourcePublicInterface sibling checkout.

Regenerate OpenAPI client types after contract updates · 17433be

Refresh generated TypeScript API bindings from owner product.openapi.yaml.

Sync product feature matrices and README path SSOT · 3c9f080

Update src FEATURE_MATRIX for PWA shell and boundary gates; sweep module README indexes to composable paths and extend path-invariant atomic tests.

Close PWA-SHELL sprint and Plan 17 wave 0 plateau · 1e059ab

Record loop 77 evidence, secret-store consumer plateau, loop-kanban skill, and agent overlay bindings after Todo implement rows reached skip-list only.

Wire product gates, PWA shell checks, and workflow atomic SSOT tests · daca9f0

Chain verify-maintainer-gates and control-plane boundary jobs in GitHub Actions with atomic tests that lock CI workflow wiring against regression.

Add WebView shell with FCM, App Links, and contract tests · d399e0a

Introduce Gradle module, NativeBridge handler, deep-link routing, and JVM tests aligned with plan 22 Android work packages.

Route admin ML refresh through the cohort adapter, verify native-shell compat JWT for handoff, harden simulation worker bootstrap, and fix api Dockerfile for composable tsconfig l… · a3aac51

Route admin ML refresh through the cohort adapter, verify native-shell compat JWT for handoff, harden simulation worker bootstrap, and fix api Dockerfile for composable tsconfig layout.

Ship WebView store shell with OAuth, bridge, and session handoff · bf31580

Replace auth placeholder with native sign-in, universal links, push bridge, NativeBridge contract tests, and verification docs for device checklist work.

PWA shell readiness — maskable icons, well-known, native handoff · c13d73e

Ship store-shell assets (AASA, asset links, maskable icons), native-shell session handoff BFF, push runtime branching, and PWA regression gates for stage deploy.

Add workload descriptors and secret-store consumer SSOT · da97e73

Introduce Score YAML for api/web/ml-service with validation gate and document future secret-materialize vocabulary behind COMP-DESC-VOCAB infra coord.

Ship Plan 17 wave 0 product boundary CI gates · 25d5748

Add dependency-cruiser, import-linter, tenant import tiers, pnpm workspace, Next.js coherence, and maintainer gate bundles so product code cannot drift into control-plane imports without failing verify-architecture-guards.

Migrate composable and PWA plans to numbered 18–22 · fad4b63

Renumber and expand implementation inventories so agents have stable plan IDs for composable infra, descriptors, and PWA/WebView work; refresh INDEX cross-links.

Composable infrastructure deps and plans index · 6c73c36

Document composable app descriptor architecture and infra dependency graph; link new plans from docs hub and root README.

Route OpenAPI parity to owner module verify scripts · 38b6f7f

Replace stale api-management hub paths in schema-contract and VMM drift checks with federation owner codegen entrypoints per ARCH-ALIGN-TC-CI-CHECKOUT.

Add PWA and native webview readiness gap analysis. · d8a5d3d

Document current install/prompt coverage, webview constraints, and follow-up work for mobile shells.

Sweep src README tree to composable paths and owner OpenAPI SSOT. · b6f28e2

Update apps, mobile, PWA, and interface hub docs; point API references at src/packages/contracts and workspace dev commands.

Update root and docs hub READMEs for composable src/apps layout. · e333b0a

Align entry-point navigation and cross-links with the current product tree under src/apps/*.

Fix composable path drift and add SSOT guards after bug-hunt loop. · 594c913

Sweep docs, GitHub templates, and FEATURE_MATRIX to src/apps/* paths; add atomic path guards and FEATURE_MATRIX check in check_product_isolation.sh; record loop triage in KANBAN audit log.

Consolidate .gitignore: dedupe sections and protect tracked JSON. · a05a899

Group deploy-env, vault, cache, and lib/ un-ignore rules; ensure src/packages/tsconfig/base.json stays tracked under the broad *.json ignore.

Record BUGBOT-PATH audit log entries and remove stale src/.cursorignore. · fec0aa8

Document composable-layout fixes in KANBAN; align seed script path comments.

Update web test READMEs and path references for composable layout. · 9f5d7e8

Align atomic readme invariants and E2E helpers with src/apps/web paths.

Sweep web source docstrings, READMEs, and cross-refs to composable paths. · 272e9a7

Update feature docs, auth bridges, matching SSOT comments, and dev docs-graph publicPath.

Update web package READMEs and architecture audit docs for composable paths. · 1626e4e

Align matching system agent rules and next16-baseline with src/apps/web.

Fix API unit test imports and paths for composable repo layout. · 815d15a

Align learning and question-import tests with productRepoPaths conventions.

Replace legacy 10_backend and 30_ml-service references in comments and operator indexes. · 01a8417

Update iOS and Android bridge docs to reference src/apps paths. · 87ea6a9

Keep mobile verification runbooks aligned with the composable web and API packages.

Sweep API operator docs and simulation-worker paths to composable layout. · 73f3910

Cross-link web paths via ../../web; mark legacy-central docs as archived historical references.

Update product plans and root READMEs for composable src/apps layout. · 99aac41

Refresh TEST_ISOLATION and plan verify commands to use src/apps/api and src/apps/web.

Align agent KB, skills, and rules with composable src/apps layout. · f90e658

Point operators at owner OpenAPI SSOT and modern web/api paths instead of legacy module names.

Fix schema-contract workflow concurrency and add owner SSOT verify steps. · c3a121e

Update E2E workflow paths for src/apps/web and add control-plane layout verify script.

Add BUGBOT regression guards for path SSOT and OpenAPI ownership. · 1727065

Cover cursor agent docs, GitHub workflows, KB runbooks, feature READMEs, and codegen script paths.

Consolidate API test paths via productRepoPaths and add architecture guards. · 7668048

Fix wrong repo roots in contract tests; add composable-path invariants for operator docs and READMEs.

Rename admin.debug fleet i18n shard key to admin.debug.fleet. · f28bfc2

Keep fleet debug labels consistent across all five locales and the translations export.

Align config threshold sync and E2E env resolution with composable paths. · 57e3617

e2e_base_url resolves sibling tenant-management; match gate SSOT imports src/config correctly.

Fix ML threshold parity scripts to resolve machine-learning via ci_infra_paths. · b8bcb5b

Wire score-band and connection-ring parity into CI and guard against hardcoded src/30_ml-service paths.

Fix release-notes repoRoot and script hints for composable layout. · e42f07a

Resolve git root with four parent hops so verify:release-notes finds sibling infra; drop legacy loadEnMessagesBundle fallbacks.

Add owner Zod codegen scripts and refresh product OpenAPI artifacts. · ead7e3b

API pretest uses distribute-schemas-for-api; web codegen docs point at src/packages/contracts SSOT.

Fix SourcePublicInterface to resolve composable src/apps paths only. · 8c9ad18

Drop legacy 10_backend and 20_web-client fallbacks so Fleet and tooling hit the modern tree.

Add @ifeoma-tc/tsconfig base.json and wire web and api packages. · 62229bc

Un-ignore base.json so npm ci can resolve the shared extends target apps depend on.

Fix offline CI path drift: owner OpenAPI tests and infra sibling SSOT. · 1893f5b

Contract invariants read src/packages/contracts; test helpers resolve app-infra-services deterministically; dry matrix remaps legacy source/* paths; release-notes semver uses src/apps/*.

OAS-FED-PR02 + Bugbot fixes: owner OpenAPI codegen and profile/worker hardening. · 1fb8cfa

Wire web codegen to src/packages/contracts/product.openapi.yaml, sync product-openapi.json, fix stale 10_backend/cicd-pipeline test paths, guard authUid unique-index collisions, and align simulation-worker Mongo DB default with the API (application).

Owner-local bundled spec and verify gate so product federation no longer depends on api-management hub copy alone; manifest pointer update remains infra OAS-FED-R02. · 2ec3e3d

Record AUDIT-KANBAN-PLAN-SYNC pulse — plan↔kanban verification PASS. · 0c5f56f

verify-docs-plans-kanban.sh: 32 Todo + 0 Backlog match plans; format and sync tests OK.

Record TC-APPS-CODEGEN-DRIFT-PULSE — five module webs zero drift. · ccdbf3f

check_module_web_codegen_drift.sh PASS across tenant, fleet, pipeline, contracts, operator.

Control-plane imports, dockerfile context, product isolation, and web imports verified. · b748317

Record RESEARCH-SLOT4-BOARD-STATE pulse — slot 3 PASS. · 7328cb3

Post Plan 17 boundary deferrals: Todo 2 stub groups, Backlog 16 rows; group count < 4.

shared/tools/check_shared_import_tiers.py not present; remains deferred per Plan 17 A2. · 7878a1b

.dependency-cruiser.cjs not present; remains product-gated per Plan 17 wave 0. · af844e8

importlinter.ini and CLI not present; remains product-gated per Plan 17 wave 0. · da424fd

Re-confirm TC-BOUNDARY-WORKSPACE-PNPM deferral — root workspace absent. · 838bb84

SSOT remains src/pnpm-workspace.yaml (apps/*); product-gated root workspace.

check_kb_rule_links.py --scope all reports zero broken links. · 027785d

On-demand validation after KANBAN audit-log dedupe closeout. · b25ca72

Fix duplicate SIDECAR audit id; AUDIT-KANBAN-PLAN-SYNC PASS. · f91e265

Remove stale deferred TC-BOUNDARY-SIDECAR-PIP-INSTALL row; verify-docs-plans-kanban.sh exit 0.

Re-confirm TC-INFRA-PRODUCER-IMPL deferral — spike doc SSOT present. · 6c6274b

Org repo app-infra-host implementation remains product-gated.

Re-confirm TC-PLAN07-P8-K8S deferral — deploy/k8s still absent. · e54ac5c

On-demand backlog pulse; K8s scaffold remains product-gated.

RESEARCH-SLOT4-BOARD-STATE PASS (a9448424) · 1927a2a

On-demand P2 board slot pulse — Todo groups=3 < 4; Backlog 16 deferred rows.

All four CI boundary guard scripts exit 0 after sidecar pip-install closeout. · c6c0d44

Fix codegen drift check for sibling app-infra-services layout. · 6c8ec9c

Run git diff in APP_INFRA_ROOT for generated web paths; close TC-APPS-CODEGEN-DRIFT-PULSE with verify PASS.

Audit log and backlog purge for Plan 17 A1 sidecar boundary work. · 635b639

Remove wrong-project skills, superseded plan stub, and unwired kanban script wrapper; purge Todo and archive in KANBAN audit logs. · 171ea34

Wire control-plane jobs to app-infra-services monorepo checkout. · afa2e79

Add ci_infra_paths helpers, update workflows and scripts for IFEOMA-CLOUD360/app-infra-services layout, and fix python/ml requirement paths after module moves.

Checkout machine-learning from app-infra-services monorepo. · b5ef6e7

Replace missing IFEOMA-CLOUD360/machine-learning remote with app-infra-services checkout and symlink layout.

Sync ios, android, interface, and tooling paths. · 384177b

Update product README, feature matrix, native-shell docs, and parity tools for renamed module layout.

Sync paths, tests, and release notes for apps/web. · 75bcba7

Retarget scripts, e2e helpers, and docs from 20_web-client to guide-canonical apps/web paths.

Sync paths and docs for monorepo layout. · 774cbef

Update api-management references, ml-service client paths, and test/docs after module renames.

Remove legacy 30_ml-service tree and agent rules. · 9a53fdf

Drop pending-delete ml-service checkout, archived project todos, and source-level cursor rule stubs ahead of services/ migration.

Update root README and feature matrix for new layout. · 1eb369b

Refresh repo entrypoints and capability index after control-plane module renames.

Retarget workflows and scripts to renamed infra layout. · c746c89

Update GitHub Actions paths for apps/web and control-plane modules; add CI infra path helpers.

Rewrite agent overlay paths for module renames. · d7efb5f

Align rules, skills, memory KB, and plans with fleet-management, cicd-pipeline, and apps/web SSOT paths.

Sync architecture plans with renamed module paths. · 5bcf940

Update plan banners, INDEX, and cross-references to cicd-pipeline, fleet-management, and apps/web layout.

Centralize stray todos into Backlog SSOT. · 0c3d8bb

Move ML lab, web §6, native-shell, CI, and repo-cleanup items into KANBAN Backlog and point plan/index docs at the canonical rows.

Add dev profiles and monorepo architecture decisions · 4f71f55

Restructure source/ to guide-canonical apps/web + apps/api pnpm monorepo. · e8ff95e

Move 10_backend and 20_web-client into source/apps/{api,web}, add pnpm-workspace.yaml, turbo.json, and packages/tsconfig; update CI paths, interface facade, and README.

Rename control-plane modules and sync repo references. · 3a14878

Move contracts, pipeline, fleet, operator, and tenant to infra-api-management, infra-cicd-pipeline, service-fleet-management, service-operator-management, and service-tenant-management; update paths across docs, CI, and consumers.

TC-APPS-CODEGEN-DRIFT-PULSE PASS (060a6ed5) · 304dae9

On-demand KB/rule markdown link integrity pulse — check_kb_rule_links.py exit 0. · 4ddd812

On-demand architecture guard pulse — all three guard scripts exit 0. · bdddd2a

On-demand plan↔KANBAN drift pulse — 32 Todo + 0 Backlog match plans; all verify gates PASS. · afdc91d

OPS-STAGE-CONTINUITY-PULSE PASS — stage health + semver gate · 370f182

Drop domain dict-access exclude allowlist for DomainConfig enforcement. · 7942c0a

Remove legacy _EXCLUDE_VARS entry so domain.get/name patterns are flagged; rename vm_target_prep provision JSON loop var; pytest 10 passed; scanner still reports 8 pre-existing fleet result/report findings.

Drop vm_data dict-access exclude allowlist for VmInfo enforcement. · 725dd36

Remove legacy _EXCLUDE_VARS entry so vm_data.get patterns are flagged; update tests and KANBAN pulse rows after P2 epic closeout.

Replace passive monitor /data polling with WS telemetry (slice 9). · 4ee753f

Broker-fed agent_telemetry_canvas drives canvas state; agent_poller retains HTTP sample ingest only; close BACKLOG-MONITOR-WS group.

Retire agent_poller from management action/verify paths (WS slice 9). · 0b8e87c

Broker-fed agent_broker_status replaces HTTP poller in agent_handlers; bootstrap HTTP isolated in agent_http_status for pre-WS installs.

Block setup/config agent delete when lifecycle disallows it (WS slice 8). · 3f679cd

Setup save and config import stay declarative-only; removed agents must be in DELETE_ALLOWED_STATES per broker lifecycle snapshot.

Close MONITOR-WS-UI-START-STOP kanban track index (slice 7). · e93b8f7

Update BACKLOG-MONITOR-WS summary after start/stop WS workflow shipped.

Add monitor WS Start/Stop workflow and UI controls (slice 7). · 656e549

Wire broker START/STOP through workflow dispatch, guard offline sessions, and surface lifecycle-gated buttons in agent management.

Expose broker lifecycle state in monitor agent UI (slice 7). · ccac28e

Merge lifecycle_state and ws_connected into /api/agents/state; render lifecycle chip on agent cards; promote MONITOR-WS-UI-START-STOP as next WS epic task.

Purge Todo group after verify PASS; add WS bootstrap and action-executor rows to pipeline FEATURE_MATRIX. · 8a94a7c

Ship monitor WS bootstrap config in SSH provision slice 5. · f67ba4e

Add manager_ws_url and agent_ws_token to client config so bootstrap install writes websocket endpoint/auth into server-agent.json; legacy SSH helpers log deprecation toward the WS command plane.

Drop stale VmInfo allowlist entry from check_dict_access (slice 1). · 16e928d

VmInfo dataclass exists; remove obsolete TODO and `vm` from _EXCLUDE_VARS, add bootstrap so the verify gate runs standalone, and document vm_data/domain follow-on in Backlog.

On-demand module-web codegen drift pulse — five */web apps zero drift. · e7c9b0f

OPS-STAGE-CONTINUITY-PULSE PASS (23aecb13) · cbc9d7e

Stage /api/health 200 (web 0.1.1008); e2e:health-gate web/backend semver match repo.

Add monitor WS action executor and telemetry publisher (slice 4). · cf57971

Wire AgentActionExecutor into ws_client command handling so runtime agents return structured results for WS lifecycle commands and can emit probe/status telemetry snapshots on the control channel.

Remove duplicate Done group blocks; shipped capability SSOT → feature matrices + Audit Logs. · 9da6542

Close HOSTING-CONTRACTS-VMINFO-DATACLASS research pulse · 25ac22a

Document VmInfo/DomainConfig gap — dataclasses exist but check_dict_access allowlist is stale; follow-on HOSTING-CONTRACTS-DICT-MIGRATE deferred to Backlog.

On-demand plan↔KANBAN drift pulse — 32 Todo + 0 Backlog match plans; all verify gates PASS. · 170126e

Expose CAGG-backed time-bucketed latency, loss, and jitter series for long-window analytics reads; close BACKLOG — Monitor Analytics Phase 2 group. · 469fc6a

OPS-STAGE-CONTINUITY-PULSE PASS (99e6de62) · df0fb50

Stage /api/health 200 (web 0.1.1008); e2e:health-gate web/backend semver match repo.

Close BACKLOG — ML Scoring Phase 2 group · dccb54e

Handoff verify PASS (131+39+4 pytest); archive seven tasks to Audit Logs and update product feature matrices for ml_wave cutover.

On-demand KB/rule markdown link integrity pulse — check_kb_rule_links.py exit 0. · b4016bb

On-demand plan↔KANBAN drift pulse — 32 Todo + 0 Backlog match plans; all verify gates PASS. · bfeb84f

Add Timescale CAGG migrations for 5m and 1h buckets · e38e4b7

Phase 2 continuous aggregates with real-time mode, refresh policies, and migration tests per timescale analytics plan.

Verify PASS — backend skips matches writes under MATCH_SCORING_SOURCE=ml_wave (recalculateMatchesForUser no-op, persist guard, admin ML-wave repair path). · b8134c0

AUDIT-ARCH-GUARDS-PULSE pulse PASS (agent 5777ca1d). · ac879e4

Add batch Timescale ingest DB worker · 98a00ac

Drain the passive-monitor ingest queue in background batches with exponential retry/backoff, retain the analytics pool after startup, and start the worker when MONITOR_ANALYTICS_DSN is set.

Wire MATCH_SCORING_SOURCE through compose and merge-env templates · d04ec20

Stage merge-env already sets ml_wave via mode_overrides; pass the flag into backend containers and document the stage default in deployment templates for Phase 2 ML scoring cutover.

TC-APPS-CODEGEN-DRIFT-PULSE pulse PASS (agent 8fa5c39d). · 6756dc0

Five module-web apps regen with zero api-types.ts drift; contract_models.py reverted.

OPS stage continuity pulse evidence (2026-06-29) · 8e3339b

Record PASS for OPS-STAGE-CONTINUITY-PULSE — stage health 0.1.1008 / backend 0.1.193.

Add bounded ingest queue to passive monitor · de0b3d6

Wire cursor-based agent sample polling into a thread-safe FIFO queue with oldest-eviction overflow so the DB worker can drain normalized SampleRows without blocking the canvas polling loop.

Derive discovery connectionRing from matchPercentage · 9889899

ML wave rows may omit stored connectionRing; discovery assembly now derives the band via calculateConnectionRing SSOT thresholds while preferring an explicit stored ring when present.

On-demand plan↔KANBAN drift pulse — 32 Todo + 0 Backlog match plans; all verify gates PASS. · f370d34

On-demand KB/rule link integrity pulse — check_kb_rule_links.py exit 0; purge Doing claim; refresh P4 critical-path pointer. · 482a3cc

Split Fisher surfaces into matchItemSurfaces collection · 40d2512

Wave egress no longer writes surface_maps into matchItemStats; entropy weights stay in matchItemStats for backend loaders. Closes ML-SCORING-ITEMSTATS-SCHEMA-SPLIT.

Add agent sample cursor API for Timescale ingest · 3608981

Promote MONITOR-ANALYTICS-EPIC ingest slice — ring buffer plus GET /api/agent/samples for server-side polling ahead of passive-monitor queue wiring.

On-demand architecture guard pulse — control-plane imports, product isolation, and sidecar Dockerfile scope checks all exit 0. · 83a56d8

OPS-STAGE-CONTINUITY-PULSE PASS (agent b2e8c3b3) · 73ddc56

Wire monitor workflow handlers to AgentWsBroker dispatch. · d101eee

HTTP workflow steps route through broker.send_command when the agent WS session is connected, with SSH legacy fallback offline; closes MONITOR-WS-HANDLER-ADAPTERS.

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · 935d7be

On-demand module-web codegen drift pulse — five */web apps zero drift; fleet contract_models.py reverted before commit (agent a93a7bc6). · ab85455

Assert wave bulk egress emits all eligible peers by default and drop unused Top-K constant; close Phase 2 egress slice with 14 passing tests. · f6e18d5

WS runtime client scaffold with reconnect backoff · 7b6de90

Land ws_client.py and runtime tests (6 pytest PASS); close MONITOR-WS-RUNTIME-CLIENT in KANBAN.

Phase 2 cohort prod answer parity + promote epic · 521f0eb

Restore ml_scoring plan SSOT, extend extraNotes/freeText scoring parity with backend journey maps, and close ML-SCORING-COHORT-PROD-ANSWER-PARITY under new BACKLOG — ML Scoring Phase 2 Todo group.

Sync OPS pulse pointers to agent d55b5989 · 51a97f7

Add WS broker connection manager (slice 3) · 8bf16ce

Ship AgentWsBroker with token auth, single-session registry, command correlation/timeouts, and UI state cache; close MONITOR-WS-BROKER.

Stage continuity pulse PASS — web 0.1.1008 / API 0.1.193 · a162f9c

On-demand architecture guard pulse — control-plane imports, product isolation, and sidecar Dockerfile scope checks all exit 0. · 3b17f3e

Align WS protocol tests with shared module · 8c655b0

Tests imported the removed agent/ path after slice-2 landed in monitor_server/shared/; verify gate now passes (9 pytest).

Align WS protocol tests with shared module · 9d1af76

Tests imported the removed agent/ path; point at shared/agent_ws_protocol.py and close MONITOR-WS-PROTOCOL-CONTRACTS with FEATURE_MATRIX + KANBAN evidence.

Align WS protocol tests with shared module path · 2772407

Tests import monitor_server.shared.agent_ws_protocol after slice 2 landed in shared/.

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · 4f9ec9f

Ship WS protocol contracts (WS plan slice 2) · 60bcec1

Command/result/event envelopes and error taxonomy for agent WebSocket control plane; closes MONITOR-WS-PROTOCOL-CONTRACTS verify gate.

Wire analytics DB startup in run_server · 2042cbf

Initialize Timescale storage (pool, migrations, health) before passive monitor when MONITOR_ANALYTICS_DSN is set; no-op otherwise.

Stage continuity pulse PASS (4e0dc343) · f85fcce

Verify stage /api/health 200 and e2e:health-gate semver match (web 0.1.1008, backend 0.1.193).

On-demand KB/rule link integrity pulse — check_kb_rule_links.py exit 0; purge Doing claim; refresh P4 critical-path pointer. · b04edf6

On-demand KB/rule link integrity pulse — check_kb_rule_links.py exit 0; purge Doing claim; refresh P4 critical-path pointer. · 646d079

Ship agent lifecycle state machine (WS plan slice 1). · bbdcebc

Commit stalled MONITOR-WS-LIFECYCLE-MODEL implementation and tests after kanban PASS.

Agent lifecycle state machine SSOT (WS plan slice 1) · c3efbdf

Land lifecycle.py transition matrix and structure tests; purge stale OPS Doing claim and align KANBAN evidence (9 pytest).

Purge stale OPS Doing claim after continuity pulse (9ae7a457) · 09c8801

Promote Backlog row to Todo group BACKLOG — Pipeline build; document layout in Audit Logs; fix invalid Backlog verify gate; add FEATURE_MATRIX row. · b8af44f

Close PIPELINE-BUILD inventory turn — purge stale Doing claim, enrich Audit Log. · dee7665

Plan 14 pipeline/build baseline inventoried (4 catalog components, 81 pytest); verify gate passes with no PIPELINE-BUILD rows on board.

All three architecture guard scripts exit 0 (agent 1c30c209). · f348b84

Plan 14 baseline inventory for pipeline/build archived; Backlog row purged; verify gate PASS (no PIPELINE-BUILD refs on board). · b506e8f

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · ebdd084

Five module-web apps zero codegen drift; fleet contract_models.py reverted. · 613d78d

All three architecture guard scripts exit 0: control-plane imports, product isolation, sidecar Dockerfile scope. · 1e006c4

On-demand architecture guard pulse — control-plane imports, product isolation, and sidecar Dockerfile scope checks all exit 0. · 80d61ca

OPS-STAGE-CONTINUITY-PULSE PASS (agent 9ae7a457) · 9def5fd

Stage /api/health 200 (web 0.1.1008); e2e:health-gate web/backend semver match repo.

OPS-STAGE-CONTINUITY-PULSE PASS (3dd5e280) · 71cac74

Stage health 0.1.1008 / backend 0.1.193; e2e:health-gate OK.

Remove orphan web-client mongodb.ts after Plan 17 boundary migration. · be5dd67

getMongoClientPromise had zero importers; delete dead module and close WEB-MONGODB-ORPHAN-EXPORT (BACKLOG — Web hygiene).

Add Timescale initial schema migration (Phase 1 slice 3) · 94d26c9

Bundle monitor_sample_raw hypertable SQL under storage/sql with structure tests per timescale_analytics_rollout plan.

Five module-web apps zero codegen drift; contract_models.py reverted before closeout. · 05b11ab

check_kb_rule_links.py PASS — purge Doing claim; update Track Index and Audit Logs (agent 466c4e63). · eff3f6f

Scaffold Timescale analytics storage package (Phase 1) · aa5b8b4

Add monitor_server/storage with db, migrations, and metrics_repo modules plus structure tests per timescale_analytics_rollout plan slice 2.

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · 918a58a

Architecture guard scripts — control-plane imports, product isolation, sidecar Dockerfile scope — all exit 0. · 73fbbd0

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · a287c4a

OPS-STAGE-CONTINUITY-PULSE PASS (agent b294928b) · 236f077

Stage /api/health 200 (web 0.1.1008); e2e:health-gate web/backend semver match repo.

AUDIT-ARCH guard pulse — all boundary scripts exit 0 · fa78a06

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards.

On-demand KB/rule link integrity pulse — check_kb_rule_links.py exit 0. · d1039c9

Close BACKLOG — ML Scoring prerequisite wave (5cb54f33) · 955f4a5

ML-SCORING-PREREQUISITE-LAB-HANDOFF verify-phase1-handoff.sh PASS (128+38+4 pytest); group purged; Phase 2 cutover unblocked.

OPS stage continuity pulse PASS (981da1d9) · 6b04bf2

P0 on-demand verify — /api/health 200 (0.1.1008); e2e:health-gate web/backend semver match.

Close BACKLOG — Plan Hygiene group (ef2602a0) · 23ce397

Purge Doing/Todo for ARCH-USE-INPROCESS-FLEET-FM-VERIFY; audit log retained.

Reconcile stale in-process fleet rollback prose · 09f053e

Remove never-implemented USE_INPROCESS_FLEET_FM references from Plan 04 rollback section and Plan 14 gap checklist; close BACKLOG — Plan Hygiene group.

On-demand module-web codegen drift — five */web apps zero drift. · 3b6a534

Purge AUDIT-ARCH Doing after guard pulse closeout · 03184c4

All three boundary guard scripts passed; remove stale group claim.

AUDIT-ARCH guard pulse — all boundary scripts exit 0 · c824408

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards.

On-demand KB/rule link integrity pulse — check_kb_rule_links.py exit 0. · cc35abd

Close OPS stage continuity pulse (agent 3b5cb5bb) · feaa416

Stage health 200 + e2e:health-gate PASS — web 0.1.1008 / backend 0.1.193 match repo.

Closeout AUDIT-PLAN on-demand lane — plan sync, banners, and format gates green. · e2d6ba8

Close OPS stage continuity pulse (agent 6dd7851a) · 600b447

Record P0 on-demand verify — stage health 200 and e2e:health-gate semver match.

On-demand module-web codegen drift verify — five */web apps zero drift; fleet contract_models reverted pre-commit. · 5012893

Record check_kb_rule_links.py PASS in Track Index and Audit Logs. · 97f1b9e

AUDIT-ARCH guard pulse after codegen drift · 8f56ed9

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse after plan sync · 087d6df

Re-run module web codegen drift check — five */web apps zero drift PASS.

Re-run plan↔KANBAN sync and plan banner verify gates — all PASS. · d81a607

OPS stage continuity pulse — health 200, semver OK · 51e0e56

Re-run P0 stage health and e2e semver gate after KB-link pulse.

Re-run check_kb_rule_links.py — all relative markdown links resolve. · 554e7c0

AUDIT-ARCH guard pulse after codegen drift · 81c9d60

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse after plan sync · 1f96c5a

Re-run module web codegen drift check — five */web apps zero drift PASS.

Re-run plan↔KANBAN sync and plan banner verify gates — all PASS. · 4e2e04e

OPS stage continuity pulse — health 200, semver OK · d1353f6

Re-run P0 stage health and e2e semver gate after KB-link pulse.

Re-run check_kb_rule_links.py — all relative markdown links resolve. · fe43f6b

AUDIT-ARCH guard pulse after codegen drift · 146e8bc

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse after plan sync · d4daac3

Re-run module web codegen drift check — five */web apps zero drift PASS.

Re-run plan↔KANBAN sync and plan banner verify gates — all PASS. · 5beeee5

OPS stage continuity pulse — health 200, semver OK · 7a098d5

Re-run P0 stage health and e2e semver gate after KB-link pulse.

Re-run check_kb_rule_links.py — all relative markdown links resolve. · a227610

AUDIT-ARCH guard pulse after codegen drift · 269daba

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse after plan sync · f3822e2

Re-run module web codegen drift check — five */web apps zero drift PASS.

Re-run plan↔KANBAN sync and plan banner verify gates — all PASS. · d0a3567

OPS stage continuity pulse — health 200, semver OK · c326103

Re-run P0 stage health and e2e semver gate after KB-link pulse.

Re-run check_kb_rule_links.py — all relative markdown links resolve. · c98bb47

AUDIT-ARCH guard pulse after codegen drift · 61c4cc6

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse after plan sync · 3a415b1

Re-run module web codegen drift check — five */web apps zero drift PASS.

Re-run plan↔KANBAN sync and plan banner verify gates — all PASS. · ceb97ea

OPS stage continuity pulse — health 200, semver OK · 655c773

Re-run P0 stage health and e2e semver gate after KB-link hygiene pulse.

Re-run check_kb_rule_links.py — all relative markdown links resolve. · dd6cdc9

AUDIT-ARCH guard pulse after codegen drift · d302fdc

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

TC-APPS codegen drift pulse — zero drift PASS · 4144629

Re-run module web codegen drift check on five */web apps after OPS/plan pulses.

OPS stage continuity pulse — health 200, semver OK · eaa4965

Re-run P0 stage health and e2e semver gate after plan/KB hygiene pulses.

Re-ran plan↔KANBAN sync verify gates — all PASS; purged AUDIT-PLAN Doing/Todo. · b529bda

AUDIT-ARCH guard pulse after codegen/KB pulses · 21c5c37

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

check_kb_rule_links.py PASS — all relative markdown links resolve. · e9c5904

TC-APPS codegen drift pulse — zero drift PASS · 88b258d

Re-run check_module_web_codegen_drift.sh across five module webs.

Stage /api/health 200; e2e:health-gate confirms web 0.1.1008 and backend 0.1.193 match repo. · bc4d534

Record agent 8ae3d08c on closeout-wave re-run. · 4ad50f0

Re-run kanban_docs_sync, plan banners, and format verify — all PASS. · 5485402

AUDIT-ARCH guard pulse after closeout wave · f3e2811

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

check_kb_rule_links.py PASS — all relative markdown links resolve. · 3276921

TC-INFRA-PRODUCER-IMPL spike SSOT re-confirm pulse · 1314e45

Re-confirm docs/plans/12-infra-host-agent-spike.md exists; org implementation stays Backlog-deferred.

TC-PLAN07-P8-K8S deferral re-confirm pulse · 663d6ff

Re-confirm deploy/k8s absent — Plan 07 P8 remains Backlog-deferred.

Record agent 06db0dfc on hygiene-pulse re-run closeout row. · 3b8803f

Re-run kanban_docs_sync, plan banners, and format verify — all PASS. · db7bd59

AUDIT-ARCH guard pulse after KB link fixes · 82ab070

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

Repair KB/rules links after overlay migration · a7b6cce

Update docstring-wave paths for TC-ARCH-DEBT moves, fix handbook and tenant-api relative links, drop anchor fragments that broke the link checker; REPO-KB-LINK-PULSE verify PASS.

Stage /api/health 200; e2e:health-gate confirms web 0.1.1008 and backend 0.1.193 match repo. · 7b4ca5e

TC-APPS codegen drift pulse — zero drift PASS · 272f648

Re-run check_module_web_codegen_drift.sh across five module webs after overlay migration.

Re-run kanban_docs_sync, plan banners, and format verify — all PASS. · e65c522

AUDIT-ARCH guard pulse after overlay migration · 9cab4d3

Re-run control-plane import, product isolation, and sidecar Dockerfile scope guards — all exit 0.

Migrate agent overlay from project/ to .cursor/ · 3835348

Repo bindings and config now live under .cursor/ (tc-bindings.mdc, agent-overlay.config.json); update plans, rules, skills, and docs so nothing points at the removed project/ tree.

Remove project overlay docs per user directive · d37ec76

Do not restore project/FEATURE_MATRIX.md, README.md, learnings.md, or templates/README.md — bindings live under .cursor/ per AGENTS.md.

AUDIT-ARCH guard hygiene pulse 2026-06-29 · d7fb8d5

Re-run boundary guard scripts (pipeline/tools + scripts paths); all exit 0. Archive pulse in Audit Logs; track set Idle.

TC-APPS codegen drift pulse — verify PASS, kanban audit log · a714e00

Purge stale AUDIT-PLAN Doing claims · 482bc90

Purge stale Doing claims after plan sync closeout · e5151eb

Remove arch guard shims; kanban plan sync · a83a017

Archive REPO-ARCH-GUARD-SHIM-REVERT and AUDIT-KANBAN-PLAN-SYNC in Audit Logs; purge Doing. CI SSOT remains pipeline/tools/ (no repo-root shims).

Plan↔KANBAN verify and banner gates PASS; purge Doing/Todo after AUDIT-PLAN drift pulse (agent 4087bd2a). · 979365a

Remove arch guard script shims; kanban plan sync pulse · 7018ae7

Remove scripts/ shim wrappers for architecture guards; CI SSOT remains pipeline/tools/. · 09288c9

Remove scripts/ shim wrappers for architecture guards; CI SSOT remains pipeline/tools/. Plan↔KANBAN verify and banner audit gates PASS.

AUDIT-ARCH guard hygiene pulse 2026-07-01 · 47c203e

Re-run boundary guard scripts (pipeline/tools + scripts paths); all exit 0. Archive 2026-07-01 pulse in Audit Logs; track set Idle.

Add repo-root architecture guard wrappers · 0c2fcb7

Delegate check_control_plane_imports and check_sidecar_dockerfile_scope to pipeline/tools SSOT so KANBAN verify gates pass. AUDIT-ARCH-GUARDS-PULSE all scripts exit 0.

Archive 2026-07-01 architecture guard pulse — all boundary scripts exit 0. · 6126517

Close AUDIT-ARCH track; archive guard pulse with corrected script paths. · cfc366a

AUDIT-ARCH guard hygiene pulse · b7319f1

Re-run boundary guard scripts; all exit 0. Archive pulse in Audit Logs.

Update REPO-KANBAN purge count to 3 tasks with agent 18836e92 evidence; add AUDIT-ARCH Track Index row and Doing table separator for format gate. · dbfb3ea

Sync INDEX Last updated to 2026-07-01 and archive uncommitted doc closeout in Audit Logs after verify gates pass. · 6eab559

INDEX snapshot and infra spike SSOT pulse · 2041400

Land REPO-UNCOMMITTED-DOC-CLOSEOUT — INDEX footer sync for DOC-INDEX-KANBAN-SNAPSHOT and TC-INFRA-PRODUCER-IMPL pulses; audit log row under REPO-KANBAN.

Sync INDEX snapshot after BACKLOG-INFRA-PRODUCER closeout · d5f6fd1

Record TC-INFRA-PRODUCER-IMPL spike SSOT pulse in INDEX KANBAN snapshot line.

Align INDEX KANBAN snapshot with AUDIT-PLAN group closeout and correct audit log agent attribution after BACKLOG-PLAN07-K8S re-confirm pulse. · b2d44f5

Closeout BACKLOG-INFRA-PRODUCER spike SSOT pulse · a27b313

Re-confirm TC-INFRA-PRODUCER-IMPL backlog row and Track Index entry; verify gate test -f docs/plans/12-infra-host-agent-spike.md PASS.

Audit log + purge row; INDEX snapshot date aligned to 2026-07-01 re-confirm pulse. · 73621a8

Re-confirm Plan 07 P8 K8s deferral · e19e084

Verify gate test ! -d deploy/k8s PASS; INDEX snapshot dated 2026-07-01.

Sync INDEX KANBAN snapshot after BACKLOG-PLAN07-K8S closeout · 69dbb8a

Record TC-PLAN07-P8-K8S deferral re-confirm and BACKLOG-PLAN07-K8S closed in INDEX line ~37; audit_plan_banners PASS.

Re-confirm TC-PLAN07-P8-K8S k8s deferral pulse · 4f1eeaf

Verify gate test ! -d deploy/k8s PASS; sync Backlog evidence and Audit Logs.

DOC-PLAN07-NPMRC-TABLE — shipped row + KANBAN snapshot; audit_plan_banners.sh PASS. · aca7f48

Add TC-APPS-MODULE-WEB-NPMRC-CI to Plan 14 gap checklist · 50bdfa5

DOC-PLAN14-CODEGEN-NPMRC-SYNC — status banner + Plan 07 table row; audit_plan_banners.sh PASS.

Document module-web npm ci and legacy-peer-deps in web-apps.md · 3055822

DOC-WEB-APPS-NPMRC-DOC — aligns consumer matrix with TC-APPS-MODULE-WEB-NPMRC-CI.

Sync OPS Audit Logs row after incomplete pulse closeout · f8347e8

REPO-KANBAN-OPS-AUDIT-STALE — agent fceaa6af on 2026-07-01 pulse; verify-kanban-format.sh PASS.

P0 stage continuity pulse — health 200, semver gate PASS · 851745e

OPS-STAGE-CONTINUITY-PULSE — web 0.1.1008 / backend 0.1.193 match repo (agent fceaa6af).

Close pytest PYTHONPATH note in Plan 14 gap checklist · eac00c6

DOC-PLAN14-PYTEST-NOTE-STALE — TC-ARCH-DEBT-PYTEST-SYSPATH closed 2026-06-30.

Module-web .npmrc + npm ci for codegen drift gate · 474dffe

TC-APPS-MODULE-WEB-NPMRC-CI — legacy-peer-deps on */web; sync tenant lockfile; check_module_web_codegen_drift.sh uses npm ci.

Sync Plan 14 gap checklist with closed KANBAN groups · 4069e96

DOC-PLAN14-GAP-STALE — TC-PLAN07, TC-ARCH-DEBT, compose UI, codegen CI; contracts matrix anchor fix.

Sync Plan 07/INDEX after TC-APPS-CODEGEN-CI ship · 0dc9717

DOC-PLAN07-CODEGEN-DOC-STALE — remove stale “Add codegen CI” prose; refresh INDEX snapshot.

Add module-web generate:api drift gate (TC-APPS-CODEGEN-CI) · 9d15e38

Wire check_module_web_codegen_drift.sh into ci.yml module-web-codegen job; Plan 07 row shipped; removed Backlog row.

Sync Plan 07 status banner after TC-PLAN07-MIGRATE close · 3ec236c

DOC-PLAN07-STATUS-BANNER-STALE — P1-P4 + compose UI closed; P8 Backlog only; add TC-APPS-CODEGEN-CI gap to Backlog (audit finding).

Sync Plan 00 Plan 17 wave banner to waves 0-5 shipped · d922474

DOC-PLAN00-WAVE-BANNER-STALE — catalog + rule text aligned; audit_plan_banners.sh PASS.

Sync Plan 17 hexagonal facades status to Partial · 9081c2e

DOC-PLAN17-HEXAGONAL-STATUS-STALE — Plan 09 + bridge delete shipped; audit_plan_banners.sh PASS.

Sync Plan 17 bridge circularity status to shipped · f32cffe

DOC-PLAN17-BRIDGE-STATUS-STALE — facet waves + bridge delete closed; audit_plan_banners.sh PASS.

Purge stale OPS Doing/Todo after incomplete pulse closeout · 1f69f0d

REPO-KANBAN-OPS-STALE-CLAIM — verify-kanban-format.sh PASS (agent 285c34f6).

P0 stage continuity pulse — health 200, semver gate PASS · e9ee06e

OPS-STAGE-CONTINUITY-PULSE — web 0.1.1008 / backend 0.1.193 match repo (agent fa638ee4).

Re-confirm Plan 07 P8 K8s deferral gate. · 3b21f2d

Standalone verify that deploy/k8s remains absent until product re-opens K8s manifests.

Sync INDEX and plan 14/17 banners after Plan 17 wave 5 close · 19760e5

DOC-PLAN-INDEX-STALE — remove stale platform Mongo and TC-VMM Todo references; audit_plan_banners.sh PASS.

Prune duplicate Done evidence table to Audit Logs pointer · c427b30

REPO-KANBAN-DONE-EVIDENCE-PRUNE — closeout evidence SSOT is Audit Logs; refresh Critical path P2/P4 triage.

Centralize agent and audit tab status copy in messages.js · 409bd2c

MONITOR-UI-AGENT-AUDIT-STATUS-COPY — extend SSOT invariant to guard agent management, api fallbacks, and audit log user-facing status strings.

Purge closed Backlog rows; active-only table (14 rows) · 242b108

REPO-KANBAN-BACKLOG-PURGE-CLOSED — closed row evidence retained in Audit Logs.

Record continuity pulse — health 200 and semver gate PASS · 916c25f

P0 on-demand OPS-STAGE-CONTINUITY-PULSE; stage web 0.1.1008 / backend 0.1.193 match repo package.json via e2e:health-gate.

Sync INDEX KANBAN snapshot date after monitor UI closeout. · 07a49c4

Centralize setup/WoL status copy in messages.js · abb6ca2

Move residual inline setup and WoL status strings into messages.js SSOT and extend the UI messages invariant test so future copy stays centralized.

Centralize monitor setup/WoL status copy in messages.js SSOT. · 6f2514c

Move residual inline user-facing strings from setup and actions modules into messages.js; extend SSOT invariant test to guard against regressions.

HTTP-delegate platform waitlist and e2e mongo-ping to backend · e3b17a1

Plan 17 wave 5 — retire direct Mongo in web-client platform paths; Fastify internal routes own persistence and connectivity probes.

Purge closed Todo stubs and sync INDEX after audit. · b14af51

Todo rail is empty; closed group stubs removed. Add BUG-BOUNDARY-WEB-PLATFORM-MONGO for remaining web-client Mongo outside auth/rbac/mail wave.

Close wave E group in Audit Logs + Track Index, fix duplicate audit-log id, and align Plan 00 catalog with INDEX 04b status. · 25d994a

Defer VMM bridge/uplink inventory to producer TC-M9; close Plan 04b consumer path. · 6cdd9f4

Document HTTP-only libvirt-network scope at the behavior boundary, add DGA install docs gate, and purge TC-VMM-CONTRACT from KANBAN Todo.

Resolve hosting shared.utils in fleet unit bootstrap · 9995a7f

Prepend hosting_runtime/src after pipeline/common on sys.path so VmmClient adapter imports do not shadow shared with common/shared.

Wire golden image capture to VmmClient HTTP · ac7af90

Replace removed PPI run_workflow("golden_image") with create_golden_image and wait_for_job so Fleet UI capture uses app-infra-vmm async jobs.

Restore Done rows dropped during banner audit edit · d1af327

Align plan 00-17 banners with KANBAN state · cd8f016

INDEX catalog and plans 14/15 had stale Partial/Blocked refs after TC-D1, facet waves, and boundary container closures; add audit_plan_banners.sh gate.

Align compose OPERATOR_API_SECRET with dev_env SSOT · 5073e1c

Compose gateway and operator-web defaults now use dev-operator-secret matching bare-metal dev_env.py, closing BUG-GATEWAY-8770-SECRET-DRIFT. Records OPS-STAGE-CONTINUITY-PULSE evidence (stage health 200, semver OK).

Remove obsolete bundled test fixture tenants · 222fae6

Drop committed ephemeral state (service-isolation mirror hint, a/b/x/y registry stubs), the test-unit-delegation package, and empty compose scaffolds for ifeoma-dev/source-tenant. Unit tests use tmp_path or pytest.skip when manifests are absent; ifeoma-tc is unchanged.

Fix plan verify drift for purged KANBAN groups. · db5afc3

Recognize KANBAN-PURGE-*-GROUP audit entries so archived TC-ARCH/TC-INFRA plan tasks no longer report as MISSING after group closeout.

Canonical semver verify gate via e2e:health-gate · a9512ad

Replace loose `grep -q version` on /api/build-info with e2e-health-version-gate that asserts webClientVersion/backendVersion against package.json; close OPS-STAGE-SEMVER-RECONCILE with live stage evidence (web 0.1.1008 / API 0.1.193).

Close DOC-PROFILE-IDENTITY-STALE and TC-BOUNDARY product Mongo group. · 0205aa3

Update profile-identity.mdc to document web-client HTTP delegation for profile/auth/rbac/mail instead of stale Mongo-from-Next guidance.

Route web-client rbac and mail trace through backend HTTP (Plan 17 wave 5). · a573ca2

Retire direct Mongo from rbac/ and mail/ by delegating to Fastify internal routes, matching the PRODUCT-PROFILE-HTTP pattern.

Shrink control-plane allowlist to gate threshold (TC-BOUNDARY-ALLOWLIST-ZERO). · 58ff044

Route harbor/dns/smtp and infrastructure_control.service through lazy importlib bridges; consolidate allowlist to four prefixes; fix operator fleet boundary violations.

Move local browser hosts sync to pipeline deployment.manager; remove runner and TUI trees plus dependent tests; shrink control_plane_import_allowlist. · 0dee342

Remove operator/src/api extend_path bridge (TC-ARCH-OPERATOR-API-BRIDGE). · bd27ba2

Bootstrap now wires src.api.* from fleet/src/api directly; gateway keeps explicit operator/src/client sidecar HTTP clients.

Lazy-load deploy orchestration via pipeline_deployment_loader for bare-metal whitelist remediation; manifest preflight uses InfrastructureControlService directly. · d11d669

Lazy-load deploy orchestration via pipeline_deployment_loader for bare-metal whitelist remediation; manifest preflight uses InfrastructureControlService directly. Container gateway continues delegating gather/gates to pipeline-api with allowPipelineRegather. Closes TC-BOUNDARY-OPERATOR-WORKFLOW-DEPLOYMENT-IMPORTS.

Delegate operator gateway infrastructure routes to fleet-api in container mode. · aad96b2

Container /v1/infrastructure/* now forwards to fleet-api HTTP executor routes; bare-metal keeps in-process handlers. Closes TC-BOUNDARY-OPERATOR-INFRA-HTTP.

Fix fleet unit tests after TC-D1 wave C/D dispatch split (BUG-FLEET-UNIT-TC-D1-STALE-TESTS). · 7c1c1d5

Behavior hosts now bind manager core tenant APIs and cross-delegate without recursion; stale tests target pipeline_fm_legacy and fleet_start_app_flow symbols.

Fix fleet unit conftest paths import shadowing (BUG-FLEET-UNIT-CONTRACTS-IMPORT). · b9a1085

Load shared/paths SSOT via importlib in pipeline/common shims so pipeline/common/paths.py no longer blocks paths.pipeline_paths during pytest collection.

Rename FleetManager survivor to FleetDescriptorService (TC-FACET-WAVE-F). · d3ac2d0

Plan 09 wave F completes the facet delete map: assembled MRO root is now FleetDescriptorService with a transitional FleetManager alias; HTTP facade subclasses the assembled core. Plan 09 marked Done.

Callers now import deployment.dns_* and infrastructure_control.{dns,smtp} directly; shrink control-plane allowlist and add regression invariant for deleted packages. · 6c20a1d

Inline PipelineFleetPart MRO without _pipeline composite (TC-FACET-WAVE-E-PREP-PIPELINE-MRO). · 0b8b947

FleetManager now inherits ProvisioningOpsPart, DevRemoteSyncPart, BuildDeployOpsPart, and QualityOpsPart directly; BuildDeployOpsPart relocated to fleet/_build_deploy/ ahead of _pipeline/ deletion.

Relocate DNS/SMTP Parts from fleet _dns/_smtp · 645043d

DnsProviderPart and SmtpPart now live under operator infrastructure_control; operator_behavior_surface imports operator-owned modules so fleet _dns/_smtp packages can be deleted in facet wave E.

Relocate DNS policy imports from fleet _dns package · 29aad39

Pipeline deployment now imports DNS enforcement and ownership policy from deployment.* SSOT modules so fleet _dns can be deleted in facet wave E.

Document runtime VMM touchpoints vs producer OpenAPI, add backlog rows for golden-image HTTP wiring and network host inventory gaps. · 2b411bb

Add OpenAPI CI mirror and wire spec sync gate · a628022

Mirror producer vmm.openapi.yaml for offline drift checks, resolve codegen paths via sibling checkout or mirror, and add GHA job vmm-spec-sync.

Regen fleet contract models from producer OpenAPI SSOT · 9754e48

Add consumer codegen/drift tooling, KANBAN TC-VMM-SPEC-SYNC-GATE, and enrollment doc notes for list_operations and spec validation.

Close TC-D1-O1-LIVE after provision-vm-bootstrap returns VM IP on br0. · 4590ac6

Fix tenant-api execute coercion for add_target dict payloads; document producer _remote_exists disk convert and br0 topology in enrollment runbook.

Close BUG-TC-D1-O1-CLOUDINIT-SCP; note VM IP blocker. · 2f0bb47

Producer fix verified: cloud-init ISO + virt-install pass; TC-D1-O1-LIVE next on hypervisor bridge DHCP/IP discovery.

Add dev-local VM bootstrap target for TC-D1-O1 · a920460

Configure ifeoma-tc dev workstation target (needs_vm_provision, vm_resources, .local domains, host_id) so gateway provision-vm-bootstrap reaches VMM REST create instead of domain validation 502; document VMM start and OpenAPI chain.

Add TC-BOUNDARY-CONTAINER rows for HTTP-only sidecars · 780f118

Track operator infra HTTP delegation, workflow deployment import debt, and close TC-BOUNDARY-OPERATOR-DOCKER-SCOPE-GUARD; link allowlist-zero to TC-FACET-WAVE-E.

Container-safe infra bootstrap without fleet runner imports · a671c88

Move private domain IP sync into operator infrastructure_control, scrub fleet/pipeline paths when OPERATOR_GATEWAY_CONTAINER=1, and skip fleet bootstrap in load_infra_orchestration_host for the sidecar image.

Update TC-D1-O1-LIVE blocker status after sidecar fixes · 4aa86c4

Sidecars 8765-8767 verified healthy; bootstrap returns 502 problem+json. Resolved BUG-TC-D1-O1-SIDECARS-DOWN; added BUG-TC-D1-O1-DEV-TARGET-VM-CONFIG.

TenantApiSession coerces execute payloads for provisioning credentials, SSH hardening, and per-mode domains. · cce69a4

TenantApiSession coerces execute payloads for provisioning credentials, SSH hardening, and per-mode domains. VM bootstrap drops legacy module- requirements gate and uses operator-owned domain_ip_sync (runner shim delegates). Infrastructure routes map AttributeError to problem+json responses.

Correct sidecar import bootstrap and VMM health URL · 30fcb0f

Fleet-api no longer calls setup_control_plane_import_paths (which bound operator gateway on :8766). Pipeline and tenant sidecars prepend shared/ before pipeline_paths shim. VMM health polling accepts bare :8780 roots.

Restore npm run build in Dockerfile web stage · 9214264

Clarify operator-gateway vs sidecar Dockerfile scope · 6585f7a

Plan 03 and KANBAN BUG-OPERATOR-GATEWAY-PYTHONPATH now distinguish bare-metal import bootstrap from operator-only container image per multi-container model.

Operator-only gateway container image (Plan 03) · 0893e6e

Revert monolith COPY/PYTHONPATH from c8cbc635: image ships shared+operator only. Container bootstrap uses OPERATOR_GATEWAY_CONTAINER; bare-metal O1 still merges fleet common/runner via setup_control_plane_import_paths. Workflows in container delegate gather to pipeline-api (allowPipelineRegather). Job store uses Redis env without pipeline/common on disk. Scope guard covers operator/Dockerfile.

Close BUG-OPERATOR-GATEWAY-PYTHONPATH, update TC-D1-O1-LIVE · 3941a46

Record gateway bootstrap import fix evidence and narrow TC-D1-O1-LIVE blocker to tenant-api sidecar and module requirements (no import 500).

Bootstrap gateway imports without manual PYTHONPATH · c8cbc63

run_operator_server and cli use setup_control_plane_import_paths with shared on sys.path so fleet common/runner resolve at startup. Stop job_store_backend from prepending pipeline/common (it shadowed fleet/src/runner). Add regression tests for runner import after create_app.

TC-D1-O1 gateway evidence and Plan 17 wave 4 banner. · e0fcda9

Record gateway 8770 health pass with dev-operator-secret; backlog BUG-GATEWAY-8770-SECRET-DRIFT and BUG-TC-D1-O1-SIDECARS-DOWN for bootstrap blockers.

Wave E delete gate still fails — pipeline DNS coupling and FM MRO blockers documented with verify gates; TC-D1-O1 blocker clarified (8770 alive, 401). · d0bdb63

Close TC-BOUNDARY-PRODUCT-PROFILE-HTTP after auth HTTP wave. · 053aff0

Sync Plan 00/17 after TC-BOUNDARY-PRODUCT-PROFILE-HTTP close. · 31dd893

Close TC-BOUNDARY-PRODUCT-PROFILE-HTTP group. · 2632d73

Verify gate PASS — no Mongo in web-client src/lib/auth; purge TC-BOUNDARY Todo.

Delegate web-client auth to backend HTTP (Plan 17). · 9c49be1

HttpNextAuthAdapter plus internal fetch for OTP, magic-link, and e2e paths; removes getMongoClientPromise from src/lib/auth/ (verify gate PASS).

Backend internal NextAuth persistence routes. · b640d66

Move adapter, email OTP, magic-link, and e2e lab stores to Fastify /api/internal/nextauth/* so web-client auth no longer touches Mongo.

Update MRO doc after wave D tenant facet removal. · 0cb93e8

Remove tenant facets from FM MRO (TC-FACET-WAVE-D). · 505ffe1

Drain TenantStatePart through PlatformAdminPart from FleetManager MRO; delegate wave-D methods via tenant_behavior_surface dispatch mixin chained to operator_behavior_surface.

Wave D — tenant facets off FleetManager MRO · 928d701

Dispatch tenant/admin Part methods via TenantBehaviorDispatchMixin and cli/tenant_behavior_surface instead of composing bridge Parts on FleetManager; closes TC-FACET-WAVE-D verify gate.

Sync Plan 00/04b after TC-D1-V1-LIVE close. · 1d4d303

Producer ssh_port on port 2222 unblocks dev workstation VMM readiness; dedupe Done rows. · 3dd004b

Close TC-D1-VMM-SSH-PORT and TC-D1-V1-LIVE after producer verify. · 7f631c9

Producer app-infra-vmm 78c0dc6 ships hypervisor ssh_port=2222; ready and scoped VM list return 200 on the dev workstation.

Sync Plan 04b banners after TC-D1-V1-LIVE close · 8dc943a

VMM ssh_port producer fix unblocks workstation ready gate; O1 remains blocked on operator gateway 8770.

Producer ssh_port on port 2222 unblocks /api/v1/ready; update enrollment runbook, learnings, and purge Doing claim after verify PASS. · dfb8e82

Document TC-D1 VMM ssh_port closure and ready verify pass. · c395c37

Producer app-infra-vmm 78c0dc6 ships hypervisor ssh_port; workstation ready probe returns 200.

TC-D1 VMM ssh_port blocker and dedupe wave C Done row. · a2118d5

Bind producer-repo TC-D1-VMM-SSH-PORT unblock path; sync plan 04b/14 and enrollment runbook.

Sync Plan 09/INDEX after TC-FACET-WAVE-C close. · f0599e5

Remove operator mutation facets from FM MRO (TC-FACET-WAVE-C). · d474dd9

Drain InfraManagementPart through HarborManagementPart from FleetManager MRO; delegate wave-C methods via operator_behavior_surface dispatch mixin.

JWT profile provisioning via backend HTTP (TC-BOUNDARY-PRODUCT-PROFILE-HTTP partial). · b570ffc

Route NextAuth getOrCreateProfileForAuthUid through POST /api/internal/get-or-create-profile; six auth Mongo paths remain for adapter/OTP/e2e.

Bind VMM dev hypervisor scope and enrollment runbook · 6d8d91d

Document user decisions: dev workstation Model B enrollment, stage on 178.104.131.219 orthogonal to TC-D1 live gates, K8s re-ship on request.

Colocate tenant API tests under tenant/tests (TC-BOUNDARY-TENANT-TESTS-COLOCATE). · 2c69791

Move 12 pipeline/tests/test_tenant_* modules; add tenant/tests/conftest.py; update CI schema-contract paths and KANBAN backlog (TC-BOUNDARY-ALLOWLIST-ZERO).

Remove pipeline bridge facets from FM MRO (TC-FACET-WAVE-B). · 40c8aba

Drop InterfaceInfraOpsPart and InterfaceCliDelegatesPart from FleetManager MRO; route infra CLI to InfraManagementPart methods and delegate-only CLI ops through orchestration_surface.

Dedupe bridge-delete audit log entry. · be54638

Promote OPS pulse rows and TC-D1 loader PPI. · af91d8f

Scan plans 00–17 for open items missing from Backlog; align TC-FACET-WAVE-B note after TC-BOUNDARY-FLEET-BRIDGE-DELETE shipped.

Delete pipeline_orchestration_bridge (TC-BOUNDARY wave 3). · ad2053c

Replace lazy bridge with direct deployment.orchestration imports; shrink control_plane import allowlist; steered deploy path unchanged (operator HTTP).

Correct VMM Model B hypervisor live gate. · 4b64a71

VMM producer is SSH-only (no libvirt socket in API container); TC-D1-V1-LIVE requires enrolled hypervisor with virsh/libvirt on the SSH target host.

Defer K8s manifests and restore P8 to Backlog. · 9cde291

User decision (2026): remove deploy/k8s/control-plane/ (422148f8 lineage); TC-PLAN07-P8-K8S back in Backlog with ship verify gate. Plan 07 Partial; Plan 10 Done without P8. TC-FACET-WAVE-B bound to MRO-only removal.

Drop compose UI from Plan 14 open banner. · bde07ed

TC-COMPOSE-UI-REAL shipped; gap checklist banner mirrors KANBAN Backlog only.

Sync KANBAN Done/Backlog, plan INDEX/07 banners, and TC-D1 re-scope notes after compose module-web profile ships. · 51b5b65

Wire control-plane-ui module web services (TC-COMPOSE-UI-REAL). · 0d85fe1

Add shared module-web Dockerfile and compose services for operator/tenant/fleet/pipeline/contracts webs; extend control-plane-ui profile to pull sidecars and gateway deps so compose config validates standalone.

Close TC-PLAN07-P8-K8S and sync plan banners. · 91331d3

Dedupe audit log rows; align Plan 00/07/10/INDEX with P8 shipped and TC-COMPOSE-UI-REAL as sole Plan 07 backlog item.

Add Plan 07 K8s control-plane Kustomize scaffold (TC-PLAN07-P8-K8S). · 563fbd0

Ship deploy/k8s/control-plane manifests mirroring compose service names and Plan 16 ports; gitignore local secrets.yaml copies.

Add K8s control-plane Kustomize scaffold (TC-PLAN07-P8-K8S). · 422148f

Mirror compose service names (sidecars, gateway, module webs, redis, vmm gate) under deploy/k8s/control-plane/; close backlog row and sync plan/matrix status.

Sync Plan 07 INDEX row with module homes shipped. · bd030d1

Align catalog step 07 with KANBAN closeout — P1–P4 and TC-PLAN07-P2-MODULE-HOMES done; P8 K8s and compose UI remain Backlog.

Close TC-PLAN07-P2-MODULE-HOMES and re-scope TC-D1 live gates. · 241d5f0

Module web home pages already pass the placeholder verify gate; document ifeoma-tc remote SSH stage path vs VMM producer libvirt blockers.

Close TC-APPS-CODEGEN-MODULE-WEBS group. · ed31ea4

Verify gate passed for all four module web api-types.ts outputs.

Regenerate tenant and fleet OpenAPI TypeScript types. · 00dd485

Unblocks TC-APPS-CODEGEN-MODULE-WEBS after job-schemas bundle merge.

Merge job-schemas into tenant and fleet bundles. · 2438f79

Tenant and fleet OpenAPI bundles omitted shared ProblemDetail and JobLogEvent schemas, breaking openapi-typescript codegen for module webs.

Dedupe TC-PLAN07 audit log and align closeout dates. · 3d828bc

Remove retired vite-pages archive directory. · f7fc898

Plan 10 P1–P4 migration is complete; drop the empty vite-pages folder and update Plan 07 open-item list.

Dedupe Done rows and close TC-PLAN07 P3/P4 group. · 8ac716d

Archive P3/P4 operator page migration, DOC-OPS-CLI-STALE, and compose URL docs with verify evidence; purge duplicate Done entries.

Dedupe Done rows and close doc/compose backlog items. · 8b44ab0

Record DOC-OPS-CLI-STALE, TC-ARCH-COMPOSE-MODULE-WEB-URLS, DOC-TEST-ISOLATION-SSOT in Done; promote TC-PLAN07-P2-MODULE-HOMES to Backlog.

Sync Plan 07 P3/P4 closeout and dedupe KANBAN Done rows. · 1ff02eb

Align INDEX/roadmap with shipped operator Next pages and E2E split; refresh operator CLI/README port SSOT.

Refresh operator docs for Next.js 5180 shell (DOC-OPS-CLI-STALE). · 7979a1b

Remove stale Vite :5173 and deleted src/cli references from CLI.md and README_INDEX.

Audit plans 00–17 status banners and INDEX sync. · afba2a9

Mark foundation plans 01–05, 11–13, 16 Done; partial state for 04/06/07/09/10/14/15/17; align KANBAN TC-PLAN07 P1–P4 evidence with plan checklists.

Split Plan 07 E2E tests to module webs (TC-PLAN07-P4). · 86dfabe

Move steered-deploy invariant under operator Next workflows; scaffold tenant/web Playwright e2e; retire vite-pages test stub.

Replace react-router vite stubs with App Router pages, OperatorClientRoot shell, Next Link navigation, and SSR-safe session hydration; operator-web build passes. · 8d87b8d

Fix operator-web port SSOT to 5180 (BUG-OPS-WEB-PORT-5173). · 3a11db2

Probe, CORS dev defaults, control-plane start messages, and web-dev CLI help now target Next.js on 5180 instead of retired Vite 5173.

Close verified TC-BOUNDARY backlog rows in KANBAN and Plan 17. · e1839ad

Mark CI gates, shared paths, tenant HTTP-only, and pipeline-no-FM as shipped after verify gates passed without reimplementation.

Migrate ContractsPage to contracts-web runs route (TC-PLAN07-P2-CONTRACTS-PAGE). · 7529771

Move schema/compliance/boundary governance runs into contracts/web with operator-gateway BFF routes; retire operator vite stub and deep-link command center to /runs.

Track build route excluded by root build/ gitignore · cc8ba56

Allow pipeline/web/src/app/build/ through .gitignore so Plan 07 verify gate path is versioned.

Migrate pipeline build page from operator vite (TC-PLAN07-P2-PIPELINE-PAGE) · e3f7d74

Add pipeline/web build console with BFF proxy routes; steered deploy remains on operator workflows; remove legacy PipelinePage.tsx.

Migrate fleet targets page from operator vite (TC-PLAN07-P2-FLEET-PAGE) · 9cc8124

Move fleet infra/status UI into fleet/web with gateway BFF routes and deep-link operator command center to module URLs.

Dedupe wave B IDs and close boundary glossary backlog row · 8ca8051

Remove duplicate TC-BOUNDARY-FM-WAVE-B and TC-ARCH-DEBT-TENANT-TESTS-COLOCATE; archive TC-BOUNDARY-AGENT-GLOSSARY with verify PASS; TC-FACET-WAVE-B canonical for wave B.

Sync Plan 10/14/17 with KANBAN TC-PLAN07 and boundary shipped state · 5f23558

Add TC-PLAN07 task table, mark P1/P2 fleet shipped, retire TC-APPS page-migration IDs, refresh Plan 14 gap sections, and mark TC-BOUNDARY-CONTRACTS-HTTP and agent glossary shipped in Plan 17.

Migrate tenant create and detail pages from operator vite · 92083c3

Move TenantsPage and TenantDetailPage to tenant/web with BFF routes to tenant-api, remove operator vite stubs, and wire operator deep-links to tenant-web URLs.

BACKLOG-DOCS group closeout audit log · a0d313f

Record DOC-TENANT-API-MDC purge after tenant-api.mdc shipped.

Add tenant-api.mdc agent rule (DOC-TENANT-API-MDC) · f2495ab

Close tenant module documentation debt referenced by module.mdc with contract-first HTTP API guidance for tenant/src/server/ work.

Require CONTRACTS_API_BASE_URL for reconcile contract checks (Plan 17). · 1f94fb2

Remove in-process contracts/interface.py fallback from provisioning_contracts_checks; reconcile preflight now always uses contracts-api HTTP jobs.

Agent hub link and rule index updates · f683318

Refresh .cursor hub READMEs, rules index, and VMM integration KB links after plan renumbering and feature-matrix SSOT.

Refresh release notes artifact and plan path test · 122797b

Regenerate release-notes JSON and update dry verification manifest paths; fix deployment unit test sys.path for compose TLS helpers.

Add README merge tool and index · a592122

Add merge_readmes_to_all.py to build README_ALL.md and document it in the scripts hub for agent navigation.

Hub and module README refresh · 8c8b948

Align root and module README hubs with Plan 16 ports, boundary layout, and Next 16 baseline notes for product and control-plane navigation.

Feature matrices, KANBAN purge, and group closeout prompt · 9da74e9

Add platform and module feature matrices, trim KANBAN Done noise, refresh PROMPT closeout flow, and ignore matrix scratch artifacts.

Pytest sys_path SSOT and import allowlist · bc56639

Centralize test sys.path bootstrapping, tighten control-plane import gates, and align fleet purge tests and operator CLI docs with loaders.

Extract tc-shared paths package (Plan 17 wave 1) · 5001b5c

Publish shared path SSOT, shim pipeline constants, scope sidecar Dockerfiles, and wire CI boundary gates with editable shared install.

Add module web scaffolds · 3265d38

Add contracts-web and pipeline-web Next scaffolds and document web-app codegen destinations for Plan 07 multi-app control plane.

Replace Vite shell with App Router, archive legacy pages under vite-pages, and update e2e and toolchain config for the Next baseline. · 7a90db2

Remove deprecated manager/cli stubs · b2bbceb

Drop unused manager and src/cli packages and refresh clean-arch audit so control-plane entrypoints reflect the gateway-only layout.

Restore DIP and split FM legacy orchestration · 67ccbb9

Reintroduce merge-env reporting at the ports boundary, delegate FM-era steps to pipeline_fm_legacy, and lock sidecar DIP invariants in tests.

Rename deployment/src to cli_legacy · cf0fb69

Move legacy CLI orchestrators under cli_legacy and update entrypoints, pytest layout, and test fixtures so imports keep working without src/.

Renumber adjunct plans and add 12-17 · 5456711

Renumber and relocate plan docs (08–17), add drafts and kanban sync tooling so plans hub and KANBAN extraction stay aligned.

Purge AUDIT Done rows and dedupe audit log header. · fd09e79

Mark plan↔kanban verify drift done in architecture-gap-checklist.

Close AUDIT group and purge swarm hygiene Todo section. · e5f1920

Archive evidence in Audit Logs; refresh critical path P0 to OPS continuity only.

Add monitor __main__ shim for run.py entry. · 2b6aeaa

Restores `python3 pipeline/run.py monitoring --help` after monitor package layout change.

Add workflow lane registry and Done-table kanban sync. · cbcef14

Register npm workflow locks for multi-agent pre-flight; teach plan↔kanban verify to accept purged tasks in Done.

Refresh architecture plans and implementation inventories. · d46c30a

Cross-link structural overview, gap checklists, and Plan 04–07 inventories after planning sessions.

Add TC-ARCH-DEBT group from Plan 04 gap analysis. · 6aa777d

Track eight post-foundation runtime-shape tasks and refresh P2 critical path after deep-architecture-analysis doc landed.

Point agent and docs hub at structural overview entry. · d0c5ae9

Surface structural-overview.md as the primary architecture map from AGENTS.md and docs/README.md.

Add deep architecture analysis and link from plans hub. · 13f94ce

Catalog operator/src inventory, Plan 04/07 shape gaps, and Wave 1–4 sequence; cross-link from roadmap, INDEX, and plans 04/07.

Add structural overview and architecture inventory checklists. · 5eaf2e4

Introduce repo map, gap checklist, FleetManager facet delete map, and operator/web Plan 07 migration checklist for strangler onboarding.

Close TC-D1 offline group: sync live gates to Blocked and purge Todo. · 94fd1d7

TC-D1-V1-LIVE and TC-D1-O1-LIVE now tracked only in Blocked; all offline hosting-deletion tasks evidenced in Done table.

Purge completed TC-ARCH Todo group (REPO lifecycle) · 58e5199

Remove 32 closed TC-ARCH rows from Todo; evidence retained in Done table.

Scaffold Next.js 16 fleet-web admin app (Plan 07) · 904352e

Add fleet/web on port 5182 with OpenAPI codegen hook and BFF health route proxying fleet-api, matching tenant-web conventions.

Fleet unit suite green (1717 passed); purge completed P0 BUG-FIX Todo group. · e209130

Align unit tests with TC-ARCH bridge and TC-D1 fail-closed · 512e172

Update shim invariants for operator_behavior_bridge, reject hosting_api PPI delegation, and stub PTR DNS when dnspython is absent in CI.

Load job store and tenant contracts via SSOT paths · 6549bec

Avoid application/contracts and operator control_plane shadowing when fleet and pipeline sidecars import shared Redis job metadata or when migrate_mail_domain_contracts runs under FleetManager import chains.

Tighten gitignore patterns and source module cursor rule · 86a26b5

Exclude transient env/workflow paths and align source module rule with product isolation boundaries.

Add control-plane boundary guards for imports and Dockerfiles · 480636f

Wire check_control_plane_imports, sidecar scope, product isolation, web import bans, and tightened VMM consumer allowlist into CI workflows.

Document Plan 06 host producer routes (provision, ship-ready, desired-state, agent report) and Plan 07 OpenAPI codegen mapping for control-plane web apps. · 2beac3d

Extend VMM client for live producer contract and descriptor routes · 9cfb386

Improve VmmClient config/models for tenant-target HTTP consumer chain and align fleet-api tenant descriptor route tests with HTTP-only tenant access.

Fail-closed hosting PPI and route VM ops through VMM HTTP · c1bc7f1

Remove in-process provisioning loader and HOSTING_API provider path now that operator/src/infrastructure/hosting is deleted from the tree.

Steered tenant deployment accepts runtimeContext dict · b8b4f6c

Add run_tenant_deployment spine that requires immutable runtimeContext from operator gather instead of FleetManager for gateway-steered deploy runs.

Thin sidecar via import bridges and gateway HTTP provisioning · bba1131

Lazy-load operator behavior and pipeline orchestration, steer fleet provision through OperatorGatewayClient, and fetch tenant descriptors over HTTP only.

SQLite bootstrap, tenant-api image, and Plan 07 tenant-web scaffold · c2d8af8

Seed tenant.db from bundled packages on empty volume, document admin surface and DNS/mail policy SSOT, and add Next.js tenant-web with BFF health route.

Add sidecar Dockerfiles and unified compose stack · bb3647f

Multi-stage images for fleet/pipeline/contracts/tenant with scoped COPY, unified docker-compose profiles, tenant_data volume SSOT, and sidecar health verify script plus Dockerfile scope CI guard.

Persist job metadata in Redis when JOB_STORE_URL is set · 1e9137f

Add shared job_store_config/redis helpers and wire operator, fleet, and pipeline job modules to sync external store while keeping in-process cache.

Move job logging SSOT to pipeline/common · ecf42ed

Centralize job_logging http/paths/sink/store under pipeline/common and re-export from operator via importlib so sidecars share one implementation.

Expand API-steered plans, kanban progress, and infra inventory · 5a6f337

Add Plan 07 multi-app control plane, infra mutation inventory, execution roadmap updates, and kanban evidence for TC-ARCH/TC-D1/TC-APPS/TC-INFRA lanes.

Consolidate agent rules, skills, and navigation index · ec8c9f3

Merge duplicate numbered rules into canonical hubs, add product-feature-matrix and docstring-wave index, and align skills with kanban-only agent ops.

Remove legacy .agent tree and pipeline tenant symlink · 811dfdd

Drop obsolete .agent docs/rules and the erroneous pipeline/tenant/tenants path alias so tenant state stays owned by tenant-api only.

Add module README indexes and drop workflow references · 1f7cd34

Refresh hub READMEs across contracts, fleet, operator, pipeline, tenant, and source trees. Add directory-level README stubs for navigation and align module docs with kanban-only agent operations.

Retarget plans and tooling away from workflow engine · 51c77bd

Update root and docs READMEs, architecture plans, and control-plane scripts for kanban-only agent ops. Point clean-arch audits at the external analyser and drop bundled workflow lock-compile from uv-compile-ci-python-deps.

Retire orchestrator rules and retarget agent hub · a1a390a

Remove workflow-engine rules, workflow-rules KB mirrors, and skills tied to npm workflow:*. Update remaining skills, memory KB, and core rules for kanban-only turns via PROMPT.MD and KANBAN.md.

Kanban-only agent ops and board purge · 66cda35

Add PROMPT.MD turn lifecycle, project overlay (config + learnings), and trim KANBAN.md to active Todo/Backlog. Update AGENTS.md to point at kanban-only paths instead of the workflow orchestrator.

Remove bundled engine and provenance tooling · da2ebb1

Drop root package.json, workflow deletion gate, and pipeline scripts that enforced engine adoption. Remove workflow.md and .gitignore entries for the installed .cursor/workflow bundle.

Link plans INDEX from docs hub and AGENTS.md · bad9478

TC-ARCH-VISION-DOC: point architecture navigation at docs/plans/INDEX.md.

Tighten env, workflow runtime, and tenant path patterns · 63cab29

Extend ignore rules for deploy env snapshots, workflow data, local DB scratch, and fix tenant/tenants nested definition env glob paths.

Add kanban sync and verify gates for docs/plans tasks · fd621f8

Port MATR4U-style plan↔KANBAN pipeline with TC-ARCH/TC-INFRA prefix support, structure audits, and template compliance checks.

Introduce the three-layer architecture plan set with executable task tables, dependency chain, and Plan 06 for host/OS infra producer work. · ee27d95

Align adopter .cursor context to .cursor/workflow layout · 236f9b7

Update rules, skills, gitignore, docs, and audit paths after hub install at .cursor/workflow/; add domain skills from bundle deploy.

Deletion-gate and preflight use .cursor/workflow layout · dc6e080

Point pipeline tools at apps/hub engine path; gate checks orchestrator, validate, and project overlay under .cursor/workflow. Add restamp-provenance and optional postinstall for workflow bundle deps.

Provenance uses apps/hub subtree HEAD not repo HEAD · 65e20e5

Align deletion-gate with platform b3666c7 — kanban-only platform commits no longer false-fail when INSTALLED.md matches hub subtree.

WF-ENGINE-1b runtime docs and npm aliases verified · b63240f

Re-point docs/workflow.md to .cursor/workflow layout and env.agent drain deps.

WF-ENGINE-1c bundle layout verified at .cursor/workflow · 6fd0fc1

Re-point provenance paths to .cursor/workflow; monorepo git HEAD resolution. · e0a253a

WF-ENGINE-1-INSTALL hub bundle to .cursor/workflow · 5a19620

Replace vendored workflow/ fork with platform apps/hub install.sh overlay; preserve project overlay; merge workflow:* npm aliases from contract.

Complete engine adoption preflight for ifeoma-tc · 3e47589

WF-ENGINE-0b: run check-adoption + learn-from-project, pin social-discovery-app preset, add verify script and preflight reports.

Default fork compare to engine provenance gate · 4d576a3

WF-ENGINE-0-GATE: compare_workflow_engine_fork.py delegates to provenance by default; keep --byte-parity for optional drift diagnostics.

Pin ai-workflow-engine provenance for adopter closure · 6657842

Replace byte-parity drift with a provenance check and record engine path + commit in workflow/INSTALLED.md (WF-ENGINE-0).

Multi-agent continue prompt and root PROMPT.MD · 361cb22

Extend kanban-multi-agent-continue with atomic register flow; add root PROMPT.MD mirror; drop archived vm/README; minor gitignore and uv-ci KB.

Add multi-agent kanban continue prompt · 34463c7

Publish kanban-multi-agent-continue.md with pre-flight lane rules, Done vs Evidence lifecycle; link from kanban-turn-methodology.

SSOT control panel toggle copy in messages.js · 5a29985

Centralize Show/Hide Panel disclosure and aria labels so actions.js imports from messages.js; extend SSOT and a11y invariant tests.

Centralize setup secret toggle copy in messages.js · f3ef346

Extract Show/Hide Secrets disclosure labels, mask notes, and save-while-hidden error to messages SSOT; wire json_editor and setup requests; extend invariants.

Extend messages SSOT with WoL preflight and template payload constants; wire actions and setup requests; tighten invariant test for Invalid WoL literals. · 82052f2

Align UI invariants with messages SSOT and setup split · f2a7703

Update audit-log and setup-subtab accessibility structure tests after messages.js centralization and setup/tabs+bindings extraction; wire WoL templates import in setup requests.

Deduplicate Invalid JSON response copy across setup, agent, audit, and request_client modules. · 3340ef2

Deduplicate Invalid JSON response copy across setup, agent, audit, and request_client modules. Add invariant test so literals stay in the SSOT module.

Extract HTTP route composers from http_server · aa7a5e9

Move handler bindings, API route maps, core GET dispatch, and POST body policy into route_composers/. Keep module-level handler aliases on http_server for test patch compatibility. Add structure tests; server_api suite remains green (68 tests).

Break start_app orchestration import cycle · 2e54304

Lift multi-target gates into deployment.orchestration.multi_target_gates so fleet_start_app_flow no longer imports manager.orchestration.pipeline. Centralize test gate patches via patch_run_multi_target_gates; document blast-radius lane rule in todo-lifecycle KB.

Split setup tabs and bindings from index · de577e2

Extract setup/tabs.js for sub-tab ARIA + persistence and setup/bindings.js for page-level listeners; setup/index.js is composition-only like monitor.js. Extend test_ui_setup_module_structure with split contracts.

Extract monitor controller from composition entry · 1b9391a

Move draw/fetch and user-driven refresh handlers into monitor/controller.js so monitor.js only wires DOM, bindings, and polling. Extend structure tests to assert composition-only entry and controller-owned orchestration.

Drop dead fleet_zitadel_provision shim · 7697e55

Remove unused orchestration module and pipeline.py F401 re-export; Zitadel OAuth provisioning SSOT is deployment.start_app.run_zitadel_provision_for_app. Align README and tenant-env-merge KB to the live entrypoint.

Remove hardcoded vpn lab paths from desktop launchers · e2e0b74

Add self-locating launch_vpn_cli.sh and install_desktop_entries.sh so desktop shortcuts resolve pipeline/monitor from the script tree instead of a fixed lab checkout path; lock behavior with invariant tests.

Isolate pipeline API health test from fleet cwd sys.path · 9100a69

scrub_control_plane_paths resolves empty/`.` sys.path entries against cwd so pytest running from fleet/ does not alias import src to fleet/src during Pipeline create_app smoke tests; align tenant_create audit doc to canonical provisioning_ssh_key_sync path.

Retarget plan paths to pipeline/monitor tree · 39a49a4

Replace legacy standalone vpn lab absolute paths in monitor plans with repo-relative pipeline/monitor paths and document completed domain mapping via monitor_server/file_ownership.md.

Lock reconnect UI contracts in connection_state · a460499

Add source-level contract tests for monitor reconnect messaging, hint threshold, waiting card copy, and clearReconnecting reset semantics.

Retarget baseline keys to orchestration modules · ebb20bd

Rename ratchet baseline entries from deleted manager/orchestration shim paths to deployment.orchestration canonical modules (same counts).

Align orchestration references to canonical module paths · 18c23b3

Replace stale manager/orchestration/_* shim paths in fleet docs, pipeline KB/rules, workflow plans, and orchestration README with deployment.orchestration, common.control_plane, and deploy_orchestration SSOT locations.

Lift CI compliance module to orchestration · d7a1b64

Move code compliance ratchet helpers from manager _ci_compliance shim to deployment.orchestration.ci_compliance; ci facade re-exports unchanged API. Completes manager orchestration underscore shim migration.

Lift credentials PAT module to orchestration · 536feb6

Move Zitadel PAT sync from manager _credentials_pat shim to deployment.orchestration.credentials_pat; credentials facade re-exports unchanged public API; update compliance boundary allowlist and fleet KB.

Lift pipeline diagnostics and zitadel to orchestration · e8738be

Move manager _pipeline_diagnostics and _pipeline_zitadel into deployment.orchestration fleet_* modules; pipeline.py and fleet status tests import canonical paths only.

Delete zero-importer orchestration re-export shims · dbc8803

Remove 11 thin manager.orchestration._* re-exports now that importers use deployment.orchestration and common.control_plane canonical paths; fix fleet invariant tests for canonical orchestration module paths.

Prune pipeline-flow orchestration re-export shims · d4cea02

Wire pipeline.py and credentials to fleet_reconcile, host_infra_overlay, and provisioning_ssh_deploy canonical modules. Fix host-foundation gate test monkeypatch to setattr on the imported infra_start_ops module.

Prune control-plane orchestration re-export shims · ff1c10f

Point credentials, deploy, and ACME helpers at common.control_plane and deployment.orchestration canonical modules; delete eight unused _* shims.

Prune five manager orchestration re-export shims · 4baed03

Point deploy/build/pipeline/diagnostics at canonical modules and delete orphan _* compatibility files (invocation_correlation, mail_runtime_alerts, pipeline_gates, pipeline_api_bridge, ha_deploy_plan).

Patch remote_start_app_target in start_app contract stubs · 84469ce

After canonical target resolution moved to deployment.orchestration.remote_start_app_target, unit tests must patch resolve_deployment_targets at the use site, not manager.deploy. Adds patch_resolve_deployment_targets_for_start_app SSOT helper shared by spawn/contract and infra-gate start_app tests.

Lift provisioning_ssh_key_sync to orchestration · 768d2ab

Canonical module under deployment.orchestration; manager path is a thin re-export. provisioning_ssh_deploy and credentials import the new path so the orchestration package has zero manager._* imports.

Patch remote_start_app_target in start_app contract stubs · cb8fea4

Monkeypatch resolve_deployment_targets on the canonical orchestration module so spawn-contract tests stay isolated after remote_start_app_target rehome.

Migrate interface mixin imports to orchestration · 8e191c3

Rehome interface_cli_delegates, interface_infra_ops, and interface_mixin_base under deployment.orchestration with manager re-export shims; update FleetManager assembly and fleet unit tests to canonical import paths.

Migrate fleet_unit tests off manager shims · 6063c70

Point reconcile and provisioning SSH deploy tests at deployment.orchestration canonical modules; lift provisioning_ssh_deploy under orchestration with thin manager re-export shim.

Lift orchestration helpers to canonical package · 6b76be0

Move remote_start_app_target, dev_tls_policy, stage_stack_consistency, deployment_runtime, tls_runtime, and zitadel_helpers under deployment.orchestration; keep manager._* paths as thin re-export shims. Update fleet_start_app_flow, fleet_reconcile, fleet consumers, and tests.

Migrate unit tests off deployment manager shims · c5a1a89

Point fleet tests at canonical deployment.context, deploy_orchestration, pipeline_api_bridge, and control_plane modules where thin shims only re-exported symbols. Patch fleet_reconcile and fleet_start_app_flow for monkeypatch targets; extend layout_roots for canonical resolve_tenant_path.

Track pipeline/build requirements.lock in git · 0fbac1e

Un-ignore the compiled lock under the generic build/ gitignore rule so CI module lock verification can find pipeline/build/requirements.lock.

Lock agent payload allowlist and pip SSOT invariants · 37916c1

Regression tests for PAYLOAD_ALLOWLIST leading with requirements.txt and agent requirements delegating to the root monitor manifest via -r.

DRY agent requirements via root manifest · 48a85b0

Remote agent pip installs delegate to pipeline/monitor/requirements.txt through -r ../../requirements.txt; sync the root manifest in PAYLOAD_ALLOWLIST so provision stays reproducible without duplicating playwright floors.

Remove deprecated archaeology migration scripts · 540b25a

Delete superseded rewrite_manager_to_operator and _rewrite_manager_orchestration_imports one-shots; migrate_manager_pkg_imports.py is the supported path. Zero CI/cron callers verified.

Add app_infra module lock and manifest SSOT comments · 821bd3f

Extend uv-compile-ci-python-deps.sh for operator app_infra pytest manifest. Document lockfile paths on monitor, agent deploy, and hosting_runtime manifests.

Add monitor and hosting_runtime Python module locks · 247a456

Complete the per-tree uv lock wave for remaining pipeline manifests so monitor Playwright scripts and hosting_runtime provisioning share the same reproducible install path as operator/fleet/deployment.

Close REPO-DEPS-PYTHON-LOCK-PIPELINE-DEPLOYMENT wave · 93235b1

Add pipeline/deployment uv module lockfile · 30a61be

Complete per-module lock coverage for control-plane Python manifests; update python-uv-ci KB with four module lock table.

Evidence for contracts deployment.manager SSOT group · fad8348

Close REPO-CONTRACTS-DOC-DEPLOYMENT-MANAGER-SSOT group · 1a2f953

Align plan status with deployment.manager SSOT · fef215a

Refresh import-boundary and target-map rows after FOS-07 migration; drop stale manager.orchestration references from MODULE-API-PLAN-STATUS.

Evidence for fleet/pipeline common lock group · f7a1a6d

Close REPO-DEPS-PYTHON-LOCK-FLEET-PIPELINE group · a7caa37

Add fleet and pipeline/common uv module lockfiles · 79d1902

DRY compile_module helper in uv-compile-ci-python-deps.sh; extend python-uv-ci KB with per-module lock table.

Close REPO-DEPS-PYTHON-LOCK-PIN group · eea5dd2

Add operator uv lockfile pilot and compile hook · b206371

Extend uv-compile-ci-python-deps.sh for operator/requirements.lock; document lock layers and refresh flow in python-uv-ci KB.

Close OPS-AGENT-TMPDIR-HINT group · 9f7ead3

Add agent TMPDIR runbook for sandbox ENOSPC · 5cd6ea8

Document cursor-sandbox-cache vs root / headroom, TMPDIR redirect, and cache prune steps in LOCAL-DISK-CLEANUP; cross-link from hosting README.

Close REPO-DEPS-AUDIT-2026-06 group · ced6744

Bump node-cron and swagger-ui-react patch levels · 2e369bc

npm update within semver ranges for web-client and backend lockfiles; operator/web and workflow already current.

Close REPO-BOUNDARY-SCRIPT-DOC-SSOT group · 7d1f440

Align boundary gate with deployment.manager SSOT · 17306a6

Build orchestration import scan patterns from variables; ban legacy bare-prefix regressions via bracket-dot ripgrep. Refresh verification README for FOS-07 paths.

Backlog for boundary doc SSOT and deps audit · 2c27604

Close REPO-MIGRATION-TOOLS-REWRITE-TARGETS group · 8eda809

Archaeology rewriters target deployment.manager · 3feec8f

Use DEPLOYMENT_MANAGER / ORCHESTRATION constants so --allow-archaeology runs cannot reintroduce bare manager.* imports after FOS-07 migration.

Evidence for source audit and migration tool hygiene · e153d91

Guard deprecated manager migration scripts · 9a9612f

Deprecate one-shot archaeology rewriters with exit 2 unless --allow-archaeology; point SSOT to migrate_manager_pkg_imports (deployment.manager.*).

Add local disk cleanup policy for workstation headroom · 33b6772

Document gitignored images/ cache reclaim, ≥10% root FS gate, and cross-links for lab hosts. Restore +x on check_operator_fleet_import_boundary.sh so verify gates run without bash prefix.

Add workflow engine parity gate and sync workspace · f2b5b93

Add compare_workflow_engine_fork.py (portable/full scopes, --json) as the gate for WF-APP-PRUNE-FORK-ENGINE. Update KANBAN evidence and minor doc path fixes; refresh ifeoma-tc tenant index/env/state from local ops.

Align paths after monitor_server rename · 066221e

Update README, file ownership map, logging contract, server_api test docs, and monitor plan links to use monitor_server instead of manager.

Rename manager package to monitor_server · b70e83a

Avoid namespace collision with deleted orchestration manager shim after FOS-07 deployment.manager migration; update agent payload paths, CLI entrypoints, and all monitor tests (200 unittest OK).

Remove redundant workflow/.cursor deploy fork · dc261cb

Bundle SSOT is workflow/cursor/ deployed to .cursor/ only; drop the duplicate workflow/.cursor mirror and narrow audit-kanban parity checks.

Drop get_public_interface CLI aliases (FOS-07) · 0906f85

Migrate fleet CLI handlers and unit tests to get_fleet_manager and get_fleet_manager_and_tenant; remove backward-compat public-interface aliases from _utils.py.

Sync bundle cursor artifacts with deployed overlay · 4f371cf

Align workflow/.cursor rules and skills with the application .cursor install so audit-kanban-migration bundleDriftCount is zero.

Clear remaining package and test docstring drift · 239553f

Align deployment package docstrings, MODULE-API-PLAN-STATUS, and infra CLI test comments with FleetManager / descriptor-only fleet-api SSOT.

Clear remaining FOS-07 stale references in misc docs · 147ede2

Mark rewrite_manager_to_operator.py as historical archaeology, refresh operator infra test README and workflow operator-control-plane KB mirror.

Refresh plan paths to FOS-07 manager SSOT · 37224e8

Point tenant-api and control-plane gather plans at pipeline/deployment/manager and fleet descriptor service.

Refresh manager paths to pipeline/deployment/manager · c3daa5a

Update vmm-consumer allowlist, control-api-kit, and platform-admin KB to FOS-07 SSOT; mirror workflow adopters topic KB copies.

Align route catalogs to FOS-07 fleet-api SSOT · 806fabd

Replace stale FleetPublicInterface and operator manager paths with descriptor_service / pipeline deployment bridge references.

Remove FleetPublicInterface from pipeline/.cursor guides · b8cd98c

Align agent KB, boundaries, and runner docs with FOS-07 FleetManager SSOT; fix fleet_manager module docstrings to cite deployment/manager paths.

Scan deployment/manager in import gate scripts · cc5e812

Post FOS-07 the operator/src/manager tree is only a pkgutil shim; VMM consumer and Operator↔Fleet boundary checks must scan the canonical pipeline/deployment/manager package.

Retarget manager paths to deployment/manager · 6cf905b

Post FOS-07 KB, rules, and PIPELINE_API_SERVER now cite deployment/manager/*, build/build_context, and pipeline_api_bridge SSOT.

Retarget phase7 typecheck at deployment manager SSOT · 2287e7c

After FOS-07 manager rehome, mypy targets live under deployment/ instead of deleted fleet/src/manager paths; drop fleet symlink workaround.

Drop stale FleetPublicInterface references · 71dadb0

Align README, fleet-api route table, and tenant runner docs with FOS-07 (FleetManager + CLI handlers; steered workflows on Operator gateway).

Point clean-arch audit SSOT at bundled mcp tool · 92ede29

Document workflow/mcp/clean-arch as the default auditor path and resolve relative audit.toolDir in hooks so agents work without an external checkout.

Add requirements-dev.txt for httpx2 pytest bootstrap · 4a0873f

Document CI-parity and minimal local install paths so tenant-api ASGI fixtures run without silent missing httpx2 failures.

Add httpx2 to optional dev dependencies for pytest · 5cf988e

Tenant fixture tests use common.asgi_test_client which requires httpx2 for Starlette TestClient; document pip install -e '.[dev]' in README.

Resolve application root in golden image syntax check · 35a4b3a

TestSyntaxCheck used _FLEET.parent.parent which pointed at the repo parent instead of application/. Use ROOT.parent so provisioning_config.py compiles.

Rewrite MAINTENANCE and fix manager path links · ebaf98c

Align fleet maintenance guide and cross-doc links with FOS-07 rehome to pipeline/deployment/manager and removal of FleetPublicInterface.

Drop app_hosting_root alias from VM contract tests · 9ac877f

Import orchestrator/provisioning modules after hosting_runtime bootstrap; use common.provisioning_contracts for serialization fixtures. Removes the legacy app_hosting_root sys.modules shim from load_app_provisioning_runtime.

Align src READMEs with deployment manager rehome · 8bbbd61

Point orchestration spine at pipeline/deployment/manager and fix fleet_manager layout links after FOS-07 manager path removal.

Align README tree with hosting_runtime ownership · 6b35b49

Update repository structure and workflow order so Fleet is not described as owning hosting source; hosting_runtime lives under pipeline/.

Point module docs at hosting_runtime SSOT · 24b6362

Align pipeline README and module.mdc with pipeline/provisioning/hosting_runtime as the hosting runtime owner; note operator hosting as TC-D1 legacy only.

Resolve pipeline root for check_architecture imports · 3d8571a

parents[4] pointed at pipeline/provisioning; common.runner_output lives under pipeline/. Use parents[5] so the arch CLI runs without PYTHONPATH hacks.

Point hosting globs and indexes at hosting_runtime · 1181998

Replace stale fleet_manager/hosting paths in fleet-swimlane, silent-fallback inventory, and agent todo-notes with pipeline/provisioning/hosting_runtime.

Shared layer no longer imports provisioning · 162e39f

Move ISSHOperations to shared/protocols and point shared DTO imports at common.provisioning_contracts so check_architecture rule #1 passes.

Fix stale hosting paths in network and module audit docs · 53ed92d

Point fleet network README at hosting_runtime + operator app_infra (TC-D1). Update MODULE_PURPOSE_AUDIT header to hosting_runtime/src SSOT.

Point hosting docs at pipeline/provisioning/hosting_runtime · 1c2e5da

TC-D1 moved VM/hosting prep from fleet_manager/hosting to hosting_runtime. Verify: rg fleet_manager/hosting README.md → 0.

SSOT config_loader and vm_states under pipeline/common · dc60233

Move config_loader, vm_states, linux_hostname, and network_bridge_utils from fleet/src/common to pipeline/common; add hosting_cli_pythonpath_entries so hosting_runtime/src precedes pipeline/provisioning stub; fix path_utils and hosting CLI entrypoints. Hosting batch 178 passed.

Path_schema hosting_runtime root + arch check host_public gate · 3eaa3b2

PathSchema auto-detect returns hosting_runtime (not src/) for TC-D1 layout. Architecture checker bans provisioning.host barrel imports in outer layers. Unit tests: test_path_schema_hosting_runtime (2 passed).

Evidence for pipeline tools hosting_runtime path SSOT (257fae7a). · 4834eb6

Outer-layer host_public imports and golden-image VMCreator paths · 5e8be18

Migrate connection_module to host_public facade; use relative VMCreator imports in golden-image capture/cleanup; align ssh hardening test with importlib gate pattern. Hosting batch 174 passed.

SSOT hosting_runtime scan paths in pipeline tools · 257fae7

Add hosting_runtime_src_dir helpers; replace stale pipeline/hosting paths in compliance scanners; fleet_layout.hosting_dir delegates to pipeline_paths.

Use host_public and hosting_runtime paths in test runners · c9da2be

Lifecycle and e2e cleanup imported provisioning.host.* via stale fleet/hosting paths; switch to hosting_dir_from_pipeline_root and provisioning.host_public. Backlog hygiene: drop closed reference rows from KANBAN.

Finish host_public facade and relative host imports · 136fb15

Route outer layers through provisioning.host_public; replace remaining provisioning.host barrel imports inside host/vm with relative paths so pytest hosting batch (174) and VM contract tests (17) stay green.

Align todo-lifecycle with KANBAN AgentId row contract · a17c892

Document AgentId and Updated (UTC) columns for parallel agent claims.

Add host_public facade for outer-layer host imports · fe5c899

Orchestrator, pipeline, and tests import provisioning.host_public instead of provisioning.host.* absolute paths to avoid the heavy host package barrel; hosting batch 174 passed, VM contract tests 17 passed.

Sync module indexes and rules to KANBAN SSOT · 9084fdb

Retired OPEN_TODOS paths in module shards and operator iteration-loop refs; workflow validate.mjs ok.

Replace absolute provisioning.host imports with relative paths · 4f35529

Avoid circular barrel loads when hosting_runtime submodules import siblings; hosting batch 174 passed, VM contract tests 17 passed.

Provisioning test bootstrap and post-FOS-07 docs · 7a46093

Purge pipeline/provisioning namespace shadow, bind fleet common.* for hosting_runtime imports, and lazy-load orchestrator barrels so VM contract pytest stays green; refresh FPI audit and deployment manager README for load_fleet_orchestration SSOT.

Close REPO-WIP-HYGIENE group and log hosting import backlog · c7aded1

Record bootstrap/orchestrator test evidence; add REPO-HOSTING-ABSOLUTE-IMPORTS backlog row for remaining provisioning.host absolute import cleanup.

Hosting test bootstrap and orchestrator import hygiene · 31c5dc0

Provisioning-runtime test bootstrap binds fleet common modules; lazy orchestrator/workflow inits and relative host imports fix VM contract tests; FPI audit doc archived post-FOS-07; browser-hosts doc → FleetManager.

TC-D1 test bootstrap uses hosting_runtime alias · 31ea3b9

load_app_provisioning_runtime registers hosting_runtime + legacy app_hosting_root shim for VM contract tests. Fix operator_browser_hosts docstring to reference FleetManager after manager rehome.

Close ARCH VMM audit and generated-index triage groups · 4152998

Record invariant-based VMM regression proof and revert timestamp-only generated index churn; board Todo/Doing cleared for backlog promotion.

Stage gate curl-only mode and sidecar preflight · d2715b2

Document operator runtime-verify and fail fast when TENANT_API_BASE_URL is unset; --curl-only supports semver probes without tenant-api sidecar.

Add FleetPublicInterface audit and VMM operator index · 60c7e3b

Phase E1 inventory cross-links INFRA_CONTROL_FACET_AUDIT (B0 HTTP facets). Operator README_INDEX documents VMM HTTP integration paths. Fleet clean-arch config scopes audit to src/api/vmm only after vm_management moved to IC.

Add FleetPublicInterface audit and cross-link B0 facets · 4ce0538

Phase E1 FPI inventory doc complements INFRA_CONTROL_FACET_AUDIT; remove untracked hosting lab conftest and record hosting batch verify (174 passed).

Close REPO-DOCS and discovery triage evidence rows · eab48e7

Document 60647d52; add Todo for untracked operator audit doc and hosting debug conftest hygiene.

Remove deprecated discoveryProfileFromWire shim · 60647d5

Parser tests live in discoveryFromApiWire.test.ts; api.ts imports the canonical module per discoveryWireApiMisuseInvariant. Drops the legacy re-export barrel and its duplicate atomic test file.

Close REPO-SOURCE release-notes verify row · 73b1c1b

verify: release-notes matches web 0.1.1008; no bundle churn to commit.

Refresh release-notes bundle for 0.1.1008 · 1da0ae8

Regenerate release-notes.generated.json from git log so web/api/cloud/AI semvers match package.json and build-info HEAD before the next stage deploy.

Dedupe REPO-OPERATOR evidence log rows · a76b2bd

Consolidate closed operator/pipeline WIP evidence after verify passes.

Add infrastructure_control.behavior module presence tests; document .venv-ci pytest entrypoint for httpx2-backed fleet_unit suite. · 47dba06

Adds delete_extraneous to RemoteRunContext/build_rsync_cmd so compose/config sync can be additive without --delete. · 4e06a4a

Adds delete_extraneous to RemoteRunContext/build_rsync_cmd so compose/config sync can be additive without --delete. Documents VMM_API_TOKEN in tenant misc secrets template and tightens gateway bootstrap test to assert src.api bridge without widening the whole fleet src namespace.

Align z_infrastructure fleet_unit with pipeline common SSOT · 2b352f1

Updates infra tests after TC-D1 contracts extract: wizard filters assert provisioning.contracts import path, Traefik TLS tests re-export common.tests, and conftest re-binds fleet paths after gateway bootstrap.

Track VMM client, fleet descriptor, and pipeline common SSOT · 4ff5112

origin/main referenced these modules from tracked call sites but the files were never committed — fresh clones and CI would fail on import. Adds the fleet VMM HTTP consumer, descriptor service, provisioning_contracts SSOT, and related common helpers with re-export shims and the VMM consumer gate.

Evidence log for REPO-KANBAN-ROOT and fleet runner slice · 2c7be56

Close REPO-FLEET-WIP runner + contract_models rows; fix duplicate evidence headers.

Refresh task board columns after root track commit · e3f17d5

Evidence log for closed REPO-KANBAN-ROOT group; restore Todo/Doing layout.

VMM-safe DHCP SSH probe and disposable VM cleanup order · 1c4dec4

detect_dhcp_interface uses pipeline/common build_ssh_cmd and conn_info instead of HostManagementInterface; run disposable VM cleanup after tenant_path is materialized with tenant_path and target_id.

Add root task board markdown as SSOT · 609f570

Consolidates open work after module todo file retirement. Workflow validate ok.

Ignore contracts/tools package-lock after global un-ignore · 51b3e3f

Place the contracts-orchestrator lock ignore after !**/package-lock.json so the empty meta-package lockfile stays out of git status.

Meta package has no npm install step; ignore stray lockfile noise. · 1636b65

Gitignore OpenAPI generator markdown under generated/api/docs · 14f78f2

SSOT for web API types remains api-types.ts; ignore openapi-generator markdown noise so hygiene commits stay clean.

Retire module 00_PROJECT-TODOS files; add docs/workflow · 2905066

Consolidate open work into root KANBAN (orchestrator-owned); remove 17 scattered OPEN_TODOS / 00_PROJECT-TODOS / source/TODOS files; add docs/workflow.md and workflow template/learnings updates. Archive pointer remains in source/00_PROJECT-TODOS-DONE.md.

Propagate correlation and idempotency on sidecar clients · f4c1860

SidecarClient reads correlationId/idempotencyKey from JSON bodies into X-Request-Id and Idempotency-Key headers (operator + pipeline clients).

Tenant summary/mode/services facades and workflow phases · 5761e81

Contract-first gateway routes proxy to tenant-api; TenantClient methods; JobRecord.workflowPhases on 202 responses; pipeline-only import bootstrap in tenant_deployment_gather (no fleet sys.path in gateway process).

Add VMM Ring A consumer adapter checklist · 3499616

Documents HTTP-only integration pattern, boot order, and governance gates alongside vmm-integration.mdc.

Add VmmClient consumer adapter and common SSOT modules · 4731190

Track fleet/src/api/vmm client stack (required by vm_management on main), pipeline/common provisioning/DNS/TLS/SSH helpers, hosting_runtime shims, compose control-plane contract, and check_vmm_consumer_imports guard.

Replace standalone Any in common harbor/purge protocols · 03a24b8

Category-14 compliance ratchet flagged Protocol -> Any on harbor startup and infra plane purge helpers. Use typed Protocol readers and ResultBase.

Move Harbor tenant CRUD materialization to IC host · 6f5226c

Python CI module-boundaries Check 3 flagged tenant.get_infra/update_infra in pipeline/common/harbor_startup_contracts.py. Materialization now lives on HarborManagementPart; common ensure_harbor_startup_contracts delegates via the HarborStartupHost protocol only.

Track vm_network_labels adapter module · afaf114

8694ef6e wired _vm_network_ui to this bridge but the file was never added. Refresh post-MRO doc paths to infrastructure_control SSOT.

Repair KB relative links after workflow sync · ad4c912

implementation-loop skill paths must use ../../../workflow from .cursor/skills; org kanban template links to GitHub instead of sibling repo.

Sync cursor bundle for kanban parity · 6c8b3d6

Deploy workflow/cursor to .cursor/ so bundleParity validate passes; fix stale verification.checks path in agent todo-notes.

Delete manager reachability/checks shims · 0fa548c

Reachability and stage checks SSOT is verification.*; remove legacy operator/src/manager/{reachability,checks} re-export packages, refresh docs to verification.reachability paths, add shim invariant tests.

Move steered redeploy to cli_lib for clean-arch DIP · 86b088e

Relocate HTTP app-redeploy workflow from src/workflows (interface_adapters) to cli_lib/redeploy_workflow (frameworks_drivers) so gateway delegation no longer crosses layers; fleet shim imports cli_lib.redeploy_workflow.

Post-MRO hygiene — contract paths, test FILEPATHs, KB/plan sync · d7c18d0

Point mesh-network OpenAPI and structural tests at infrastructure_control and hosting_runtime SSOT; refresh vmm-integration and tenant API plans.

Refresh fleet shim paths to infrastructure_control SSOT · 55499eb

Point operator/fleet/pipeline docs and rules at canonical behavior modules after MRO shim deletion; verify rg finds no stale fleet/_* runtime paths.

Complete MRO shim deletion (provisioning, edge-tls, mesh) · b3ff027

Remove fleet/_provisioning, _edge_tls, and _mesh re-export shims; import infrastructure_control.behavior.* at composition and test boundaries. Add shim invariant tests and tighten operator/fleet import boundary gate.

Remove VM behavior shims; canonical ic imports · 8694ef6

Delete fleet/_vm package and _vm_management_part facade; FleetManager assembly and tests import infrastructure_control.behavior.vm_* directly. Extends harbor/infra/tenant shim invariants and operator boundary checks. Verify: test_fleet_vm_shim_invariant + vm network tests — 18 passed.

Delete fleet/_tenant shims (ARCH-FLEET-MRO-TENANT) · 832f32d

Remove the last fleet/_tenant re-export; tenant unit tests import infrastructure_control.behavior.tenant_* directly. Boundary gate drops _tenant/* exception; invariant tests guard against shim regression.

Remove _infra shims; tests use operator behavior · 19548eb

Delete fleet/_infra re-export modules; fleet and operator tests import infrastructure_control.behavior.infra_* directly. Boundary gate no longer whitelists _infra/*; composition root remains _assembled_manager.py only.

Remove _harbor shims; compose harbor from operator · 385cbd8

Delete fleet/_harbor re-export package; FleetManager assembly and pipeline CLI delegates import infrastructure_control.harbor directly. Boundary gate allows infrastructure_control imports only on _assembled_manager.py.

Remove dead infra_ops common re-export shims · 05327ea

Delete unused _infra_plane_purge_sequence and _harbor_startup_contracts shims now that fleet runner, reconcile, and infra_lifecycle import pipeline/common SSOT directly; add regression invariant test.

Infra plane purge SSOT; zero runner infra_ops imports · e014608

Move stop_then_purge_host_and_app_infra_planes to pipeline/common with InfraPlanePurgeHost Protocol so fleet reset ops and operator infra_lifecycle avoid infrastructure.infra_ops; E2E reset script uses common InfraServicePlane.

Move infra plane purge sequence to pipeline/common · 2bae467

Fleet runner reset ops and operator infra lifecycle import the shared stop/purge ordering from common instead of infrastructure.infra_ops.

Runner DNS reassert via InfraManagementPart host · b73dfb0

Extract outbound DNS reassert into infra_ops/_outbound_dns_reassert.py and expose FleetManager.reassert_outbound_dns_after_infra_foundation so fleet runners no longer import infrastructure.infra_ops directly.

Decouple harbor startup and vm bootstrap DIP · b6fb149

Move Harbor startup contracts to pipeline/common so fleet runners and reconcile import the host Protocol SSOT instead of infrastructure.infra_ops. Split VM bootstrap durable job wiring into src/server/vm_bootstrap_worker with lazy imports so infrastructure_control no longer reaches jobs_store.

Verify harbor startup SSOT decoupling from infra_ops · 591ea26

Add common and fleet invariants that _orchestration_runtime imports common.harbor_startup_contracts only; document closure in decoupling KB.

Compose ps status SSOT; fleet CLI infra_ops gate · 269acdd

Move compose_ps_status_bucket to pipeline/common for shared Fleet CLI and Operator health parsing. Add check_fleet_cli_infra_ops_imports.sh with empty inventory so new fleet/src/cli infra_ops imports fail CI.

Remote deploy dir SSOT via common.constants_paths · 766a36e

Fleet CLI stack-log and elasticsearch commands no longer import infra_ops.REMOTE_DEPLOY_DIR; operator keeps a backward-compat alias to DEFAULT_VM_DEPLOY_DIR. Adds decoupling KB article and navigation links.

Bundle semver refs to fleet-cli-commands log · 92552e6

Kanban semver evidence via fleet-cli-commands · a3724c9

Slim AGENTS.md index; migrate runbooks to .cursor KB · 9aca48c

Move durable agent orientation out of AGENTS.md into KB articles and update rules/skills cross-refs; live semver evidence stays in fleet-cli-commands.

Harbor compose deploy SSOT paths and test helpers · 0f6ed17

Centralize operator app-infra compose resolution in harbor_compose_paths, migrate policy tests to harbor_compose_deploy_path(), and gate the hosting_runtime reference copy with explicit SSOT documentation.

Harbor compose SSOT paths and pipeline audit hygiene · 1e9f79e

Add harbor_compose_deploy_path helper, document operator vs hosting_runtime compose ownership, wire harbor healthcheck test to SSOT, exclude .venv from pipeline clean-arch scans.

Batch import paths, nested coercion, hosting bootstrap · 74afb06

Fleet conftest path order, tenant/security _FIELD_COERCIONS, hosting ensure_hosting_src_on_path for PlatformDetector, serialization wire round-trip, and infra-ops test patches for canonical FPI modules.

Green full batch — common namespace restore and fleet test paths · 4670239

Restore pre-test common.* modules after provisioning-contracts isolation so SmtpRelayConfig isinstance stays stable across the tenant suite; update VM syntax-check paths for manager/hosting rehome; fix fleet unit conftest sys.path so import cli resolves to fleet/src/cli not fleet/cli.py.

Green unit pytest batch via bootstrap SSOT and importlib mode · 6b2d8fe

Centralize hosting_runtime unit path setup on pipeline/tests/common/bootstrap, anchor pytest rootdir to hosting_runtime, and fix stale compose/DNS test paths so run_batch_main_module_tests.py hosting exits 0 (174 passed).

Compliance ratchet baseline and hosting pytest bootstrap · 2a0e4b2

Update pipeline/tools/.compliance-baseline.json for the VMM/control-plane slice so Python CI step 1b passes. Fix trace_usage test path after hosting_runtime migration; rename provisioning.py CLI to hosting_provision_cli.py to stop shadowing src/provisioning; lazy-load hosting conftest imports and omit pipeline/ from hosting unit-test PYTHONPATH until conftest appends it.

Track control-plane target map SSOT test · 6243128

Commit pipeline/tests/test_control_plane_target_map.py so CI dry verification matrix manifest resolves ARCH-CONTROL-PLANE-TARGET-MAP-SSOT.

Remove legacy lab copy and add import guard (TC-D1) · ad437f1

Delete in-repo vm_api/libvirt lab; keep vm/README.md stub pointing at app-infra-vmm. Add pipeline/tools/check_vm_lab_imports.sh alongside the VMM consumer import gate.

Fix relative markdown links for CI KB gate · 977ed4a

Point pipeline hosting docs at provisioning/hosting_runtime; correct workflow paths from implementation-loop skill; use HTTPS for external VMM contract; replace sibling-repo links with plain-text org refs.

Commit missing OpenAPI model shards for CI tsc · bc1afac

index.ts exported 22 admin/chat model modules that existed locally but were never tracked (gitignore parent-dir negation gap). Un-ignore api/ and openapi/ directories; add generated model files from product OpenAPI.

Align module boundary checker with control_plane SSOT · 422bf08

Document transitional tenant CRUD paths under common/control_plane and deployment orchestration; allow typed tenant/infra contract seams; route compose/rsync helpers through common.provisioning_contracts.

Fix vmm-integration relative links · cb84039

Correct deletion-plan path depth; reference KANBAN as plain text (untracked SSOT).

Use uv pip sync --system on GHA Python jobs · e8010f3

setup-python installs into the runner system interpreter without a venv; uv pip sync requires --system in that environment.

Uv lockfiles for Python CI jobs · da96567

Add ci-python-requirements.in + compiled locks for python-ci and ml-service-tests; wire CI to uv pip sync. Include refresh script and align hosting_runtime dnspython floor with fleet.

Httpx2 TestClient for API pytest · e14fda9

Self-contained tests/helpers/asgi_test_client.py mirrors control-plane and ml-service patterns; add httpx2 to dev extras and bump FastAPI floor.

SSOT VM network selector CLI copy and table · f7e2638

Centralize VMM-backed selector table rendering and static bridge/VMM prompt strings in _vm_network_ui.py; dedupe network_manager and create-vm wizard paths. NAT guidance references dynamic Notes labels from inventory.

Httpx2 TestClient SSOT for pytest · be2a2a7

Starlette/FastAPI TestClient emits UserWarning without httpx2; add pipeline/common/asgi_test_client.py and route operator/fleet/pipeline tests through it. httpx2 added to fleet/operator requirements and tenant pyproject for sidecar smoke coverage.

Use httpx2 for Starlette TestClient in route tests · 41453df

Add httpx2 dev dependency and asgi_test_client helper so FastAPI 0.138 / Starlette 1.3 route tests avoid StarletteDeprecationWarning on TestClient import.

Add uv bootstrap script and CI setup-uv gate · ed62346

Install Astral uv via scripts/ensure-uv.sh for dev and pin setup-uv v8.2.0 in python-ci. Document orchestration shim re-export rules and export reconcile explicitly from _pipeline_reconcile.

Restore start-app shim exports and orchestration imports · 3a8fd08

Star-import shims dropped private symbols needed by pipeline.py; re-export explicitly and fix fleet_start_app_flow lazy imports after orchestration rehome. Align operator reconcile unit tests to patch fleet_reconcile module globals.

Import domain_resolution from control_plane SSOT · 8dd8b38

Point fleet and deployment orchestration at common.control_plane.domain_resolution instead of manager.orchestration._domain_resolver shims. Fix fleet_reconcile lazy imports to manager.orchestration.build and manager.deploy.

SSOT deployment gates for operator workflows · 5bed670

Move multi-target APP-INFRA gates, domain resolution, and host-infra overlay to pipeline/common/control_plane. Operator workflows import infrastructure_control.deployment_gates instead of manager.orchestration.

SSOT public edge probe plan for operator and fleet · 561f60a

Move merged-env probe URL resolution to pipeline/common so Operator verification no longer imports fleet CLI modules (CL-AUDIT-25).

Trim AGENTS.md semver table; SSOT stage proof in skill + fleet KB · c4b7dbc

Promoted stage proof checklist to product-stage-deploy-verify skill; cross-refs point to fleet-cli-commands evidence log instead of AGENTS table. Verify: wc -l AGENTS.md ~200; rg 'Current canonical stage stack' → 0.

Route Harbor MRO through _harbor shim for boundary gate · 51470d9

Decouple verification from fleet_manager imports · 0ef2b19

VerificationOrchestrationHost Protocol + fleet_lab_bridge for lab-only FleetManager fallback; checks/reachability use SSOT probes and SSH helpers. Verify: rg fleet_manager in operator/src/verification → 0; pytest 21 passed.

Rehome HarborManagementPart to infrastructure_control.harbor · 1944ea4

Canonical harbor package under operator/src/infrastructure_control/harbor; fleet _harbor/* are compatibility shims. host.py and FleetManager import from operator-owned path. Harbor unit tests updated. Verify: rg fleet_manager in infrastructure_control → 0; test_harbor_health_gate 19 passed.

Move MeshManagementPart to operator behavior; fleet shim re-exports. · 8e3858e

Compose HarborManagementPart on host/FleetManager MRO separately from mesh. Update fleet_unit tests to import canonical modules.

ARCH-AUDIT-FINDINGS: pipeline CL-AUDIT-22/23 and operator clean-arch config. · 85962ed

Exclude common/tests bootstrap probes from pipeline entity audit; document accepted deployment_bindings/runtime_workers cycle; add operator layer map with CL-AUDIT-24/25 for namespace bridge and verification fleet debt.

Replace src.* lazy imports with fleet_manager.*, api.*, and cli.* so deployment orchestration does not bind to the ambiguous src package namespace (sidecar DIP). · 048a4f7

FOS-07-FPI-DELETE: route CLI and job workers through FleetManager directly. · 9a9a779

Compose interface mixins onto FleetManager, replace FleetPublicInterface with load_fleet_orchestration(), and use descriptor_service() on fleet-api routes.

Replace FleetPublicInterface in fleet/src with orchestration facade · 2856c42

Rename the pipeline CLI facade to FleetOrchestrationFacade, route fleet CLI and job workers through src.cli.orchestration, and drop FleetPublicInterface exports from fleet/src and operator/src so the import triangle closes for Group FOS-07-D.

FOS-07-IC-LOADER-COMMON: rehome loader/contracts/requirements to common control_plane. · a9b4584

Operator infrastructure_control imports common.control_plane SSOT for module loading, contract aggregation, pip requirements, and tenant PAT helpers; manager orchestration modules become thin re-exports.

TLS certs SSOT without manager loader · 02d88e7

Add common.control_plane.app_infra_loader for AppInfraPublicInterface resolution and drop manager.orchestration.loader from tls_certs (FOS-07-D).

FOS-07-IC-TLS-COMMON: rehome tls_certs to common control_plane. · 7800a58

Move TLS generate/inspect orchestration to pipeline/common/control_plane/tls_certs.py; manager.orchestration.tls_certs becomes a shim; infrastructure_control infra_tls_certs imports common only (no manager.orchestration).

FOS-07-IC-COMMON-IMPORTS: finish IC control_plane SSOT wiring. · cfc3b6d

Route infrastructure_control host and behavior through common.control_plane (tenant paths, vm lifecycle, tenant config validation); add vm bootstrap job and VMM target resolve helper; zero manager.orchestration._ imports in IC.

Tenant config validation SSOT in common · 79b1bae

Move tenant package gap checks to common.control_plane.tenant_config_validation, point infrastructure_control behavior and fleet tests at the SSOT, and align vm lifecycle policy tests with common imports (FOS-07-D).

FOS-07-ALLOWLIST-EMPTY: empty Operator↔Fleet import allowlist. · 91821f5

Rehome mail alerts, VM lifecycle policy, orchestration result, and tenant path helpers to pipeline/common/control_plane with manager shims; tighten boundary script to Operator→src.fleet_manager import lines only; add pytest for empty allowlist and boundary gate.

Route infra_ops/IC through common control_plane SSOT · 2a285b9

Point infra_ops and infrastructure_control behavior modules at common.control_plane tenant_paths, orchestration_result, and mail_runtime_alerts; add resolve_app_infra_paths to tenant_paths and drop infra_ops from the import allowlist (FOS-07-D).

Infra_ops uses common effective target map SSOT · 80eb1ba

Route infra_ops effective-target-map imports through common.control_plane.effective_target_map instead of the manager.orchestration shim (FOS-07-D slice).

Close FOS-07-C manager import namespace decouple · eabe311

Migrate pipeline/deployment/manager off src.fleet_manager/runner aliases, narrow src bootstrap to api/cli bridges, and shrink the import allowlist.

DRY manager imports off fleet_layout and dns shims · 206bfc2

Point deploy preflight at deployment.dns_orchestration_enforcement, provisioning SSH validation at infrastructure_control, and Zitadel/PAT compose dirs at infra_dir_from_pipeline_root SSOT.

Decouple infrastructure_control from fleet_manager imports · 37c3fa5

Rehome rsync, SSH conn, and DNS preflight enforcement to pipeline/common and pipeline/deployment with fleet compatibility shims; introduce InfrastructureControlHost protocol for provisioning behavior modules.

Introduce structural typing for compose orchestration hosts, replace broken ..fleet imports, and resolve app-infra paths via pipeline_paths SSOT. · 7ba4324

Resolve src.api imports after operator src bootstrap (FOS-07-C) · 1311b1e

Extend the src namespace with fleet/src for sidecar HTTP clients, lazy-load FleetManager assembly to break the infra_management import cycle, and re-bootstrap pytest fixtures after src cache purge.

SSOT bootstrap_operator_gateway_imports (FOS-07-B) · 8a00868

Centralize operator gateway sys.path ordering in pipeline_paths so import src.server binds to operator/src after fleet common merge; wire control_plane, sidecar smoke, and pytest conftest to the shared helper.

SSOT bootstrap for operator src namespace (Group FOS-07-B) · 608e92c

Add operator/src/__init__.py and bootstrap_operator_gateway_imports in pipeline_paths; wire control_plane paths and sidecar smoke imports; add regression tests proving import src binds to operator after fleet merge.

Remove deprecated host deploy-runs gateway proxy (FOS-05) · 5420bef

Steered deploy must use tenant-deployment-runs with Operator gather; the host Pipeline deploy-runs bypass is no longer exposed on :8770.

Add chat media multipart route verification bundle (Group DRY) · 2315a73

Register DRY-BACKEND-CHAT-MEDIA-MULTIPART-ROUTE in the matrix; add voice 200 route contract test and mockReset isolation between happy-path cases.

Consume multipart file during parts() iteration (Group TEST) · 4be1df2

Deferred toBuffer() after the busboy parts loop stalled chat media inject tests and could hang when type/file field order varies. Buffer the file part inside the loop; document the rule on registerMultipart; add form-auto-content route contract tests (400/413/200).

DRY mail enforcement stages for migrate script · 6efb4b4

Import rollout stage literals from dns_mail_preflight_policy SSOT so migrate_mail_domain_contracts cannot drift from deploy preflight policy.

Refresh Node lockfiles and Python floors (Group DEPS) · 11165f1

Bump web-client, backend, operator-web, contracts/workflow npm trees via ncu; align Python requirements for tenant, fleet, operator gateway, and ml-service. Fix react-day-picker v10 calendar classNames, backend chat gate RBAC mocks + vitest teardown, operator generate-all cwd, and ml route tests for FastAPI 0.138 OpenAPI path inventory.

Align chat media 413 copy with photo vs voice intent · 278b664

Introduce chatMediaPayloadTooLargeDetail SSOT for validation and multipart limit responses; route passes resolved media type to the multipart handler; extend policy tests for photo and voice 413 JSON mapping.

Unify DNS/mail preflight static rules across fleet and pipeline · 238a77c

Fleet mail preflight now delegates static contract checks to the shared dns_mail_preflight_policy module while keeping live DNS probes fleet-local; adds BIMI rules to SSOT, wire adapters, DRY matrix bundle, and tests.

Refresh stage semver table for 2026-06-21 · d762d7b

OPS-STAGE-SEMVER-RECONCILE: live curl matches repo HEAD at web 0.1.1008, API 0.1.193, and AI 0.1.26.

Lock VMM package-root DIP with CL-AUDIT-21 · 5452597

Document docstring-only src/api/vmm/__init__.py and add an AST invariant test; clean-arch audit reports zero violations on the VMM consumer slice.

Inject sidecar ports for tenant deployment DIP · 9099b9f

Move Pipeline API client/worker imports to composition root so deployment orchestration no longer crosses into src.* drivers; closes ARCH-PIPELINE- DEPLOYMENT-SERVER-DIP with clean-arch audit at zero violations.

Drop deprecated chat peer-name shim re-exports · a05a451

Chat hooks and tests import peerNameDisclosurePolicy SSOT directly; removed chatMutualRevealDisplayName and chat peerNameDisclosurePolicy barrels.

Ban Stage reconciliation in KANBAN; add board hygiene rules · 822ff57

Stage semver belongs in AGENTS.md and OPS-STAGE-SEMVER-RECONCILE backlog task, not a standing kanban section. Update engine template, continue-loop skill, and kanban-turn-methodology with explicit hygiene guidance.

Add verification matrix and runner for Group DRY close-out · 96a84b5

Document SSOT slices with machine-readable manifest, verify_dry_matrix.sh, and manifest invariant tests (12/12 focused bundles green).

Lock contract SSOT with wire Zod + invariants · e394800

Verify wireChatMessageFromDocument output against generated ChatMessageWire, GetMessagesResponse envelope, and source invariants for connections query, media semantics, and profile public wire builders.

Verify workflow gate ordering and job federation parity · 3de63af

Add steered-deploy phase-order tests and extend downstream id/jobId + failed-status federation coverage for control-plane gate policy closure.

Add discovery-from-api-wire strict Zod parser layer · c1b0706

Mirror connections wire boundary: generated OpenAPI Zod, strip tier-internal profile blobs, and parse in api.ts before hooks cache discovery rows.

Split discovery score read vs derive APIs · bbd787c

Add resolvePreMaterializedDiscoveryDisplayScore and deriveDiscoveryDisplayScore; chat inbox reads enriched scores after buildDiscoveryProfileForSheet; adapter rejects un-enriched pairwise rows. Misuse invariants lock the read path in chat.

SSOT peer name disclosure in profile policy · 9c9d27a

Centralize stage gate, legal name parts, primary labels, and chat thread display in features/profile/peerNameDisclosurePolicy. Discovery card helpers and chat barrels delegate; discoveryDisplayNameOrNull now uses name-parts SSOT.

SSOT match ring and percent display in matching · 47439e1

Move connectionRingForPeerLayout and resolveMatchPercentForDisplay into features/matching so universe layout and chat inbox share one policy. transformToMatch derives rings from the same resolved display % as the row.

Delegate radar renderable check to pairwise SSOT · d585dfb

hasRenderableDimensions now calls hasRenderablePairwiseDimensions so chart empty-state logic matches connection-first pairwise precedence elsewhere.

Single scan root for clean-arch audit config · 15765ac

Multi scan_roots collapsed package __init__ modules to id "root", producing false entities→interface_adapters violations. Use scan_roots: ["."] and exclude provisioning/** so make audit-app-cli exits 0.

SSOT read for admin whitelist env CIDRs · a3d56e8

Centralize TRAEFIK_ADMIN_ALLOWED_CIDRS parsing in admin_whitelist_cidr_policy so deploy preflights and whitelist sync plan share one env-file reader.

Deprecate useFeatureFlag; document fail-closed policy · 2071d18

useFeatureFlagQuery remains the SSOT for gates with explicit error surface; the boolean wrapper is deprecated with invariant tests proving no production call sites.

Stage smoke for connections pairwise wire field · ecb100b

Adds a Node script that signs in on stage, seeds a connection when the inbox is empty, and verifies peerPairwiseMatchDimensions on every list row — closing match-peer P0 item 6 with live SMOKE_OK evidence.

Add stubbed ui-authenticated viewport spec for inbox View profile → pairwise radar, shared pairwise section helper, inventory invariant, and npm script. · d43984b

PeerProfileSheet pairwise empty state when dimensions null · 1dd7ae3

Always render the fit-by-axis section after chart deferral; delegate null and all-zero skips to CompatibilityDimensionsRadar empty copy with test ids.

Universe architecture §2.1 pairwise vs connections · 416e35b

Document discovery pairwiseMatchDimensions vs connections peerPairwiseMatchDimensions with surface table, mermaid flow, and links to matching SSOT; lock with doc invariant test.

Align offline invariants with admin load-error SSOT · 667b0c2

Unblocks match-peer regression bundle verify: platform settings uses AdminLoadErrorPanel; admin reports mock uses valid limit; DE openers stub allows qwen vs template source.

Tighten id-label admin API client types · 13ea9a5

Use generated OpenAPI wire types in questions.ts; add QuestionWriteInput and fail-closed create validation; type connection statement bulk mapper to ConnectionStatementSeedRow only.

Remove generation config load_settings DIP violation · 05fcb70

Re-export qwen_settings from generation/config barrel; mmr adapters never import src.config. Closes Group ARCH ml audit row.

Resolve clean-arch cross-layer import violations · 2b994c9

Move DevFunctionsStatus SSOT to lib/dev, drop JSDoc import() links the audit tool treated as real edges; web layer violations now 0.

Triage web/ml clean-arch layer violations · 8c2d2fe

Web: include generated/api and messages in audit graph (72→3 real edges); document fingerprints in ARCHITECTURE-AUDIT-WEB-CLIENT. ML: classify output_locale adapter; document accepted routes→dependencies pattern.

Match storage DIP guard leaf for persist layer · 03c5104

Extract assertMatchStorageWriteAllowed so matchStoragePersist does not import the policy module; document in ARCHITECTURE-AUDIT-BACKEND. Add admin user-profiles list-rows invariant test (no ?? [] on query failure).

Apply VMM client DIP — docstring-only package root · 8fd5ce7

Stop re-exporting VmmClient from src.api.vmm __init__ (entities layer); call sites import client/adapters directly. Clean-arch fleet VMM scan: 0 layer violations; VMM unit tests 8 passed.

Consolidate SSH tunnel SSOT under src/network/ssh_tunnels · 09d0b71

Single README for registry push forwards and dev ENDPOINT_SPECS matrix; cross-link CONNECTIVITY_LAYERS, mesh, runner/tunnel, and fleet index.

Document tenant mesh_network in OpenAPI (P134-L03) · c86bfe7

Add shared mesh-network.yaml aligned with MeshNetworkConfig and MeshType, type tenant GET/PUT /infra with TenantInfraState, and enum mesh_type on target conn_info. Regenerate tenant/fleet bundles; parity OK; alignment pytest 4 passed.

Psychometric QA mobile sidebar + Playwright system Chrome · 32baff9

Keep admin section nav off-canvas on narrow viewports, wait for questions GET, and add PLAYWRIGHT_USE_SYSTEM_CHROME for Ubuntu hosts without Playwright Chromium/ffmpeg bundles. Stage E2E 2 passed @ 540×960 / 1080×2340 on web 0.1.1008.

Extract dev env defaults so run_operator_server no longer imports control_plane.start (fleet src.server was binding on 8770). · 8a694d9

Extract dev env defaults so run_operator_server no longer imports control_plane.start (fleet src.server was binding on 8770). Prefer local openapi-typescript for contract preflight; fix admin sidebar e2e helper for next build typecheck. Stage rebuild-web-client succeeded; curl health 0.1.1008.

Align turn plan with org kanban lifecycle · f0e0dfa

Merge IFEOMA-CLOUD360 turn-plan structure with TC kanban: group closeout, continuous drain/register, no circumvention rule, and adopter todo-lifecycle KB. Bundle sync + validate/audit gates green.

DRY control-plane target schemas across fleet and pipeline APIs. · 5ffc6ed

Shared control-plane-targets.yaml is now the SSOT for tenant targets and FleetTargetDescriptor; bundle tooling merges product shared schemas so nested refs resolve in generated Python models.

Sync local changes · eaa1a34

Mark admin OpenAPI wire-parse and arch rebaseline done · fffcc85

Close API-OPENAPI-ADMIN-SYNTHETIC-MATCH-IRT, PSYCHOMETRIC-JOURNEY, and SIMULATION-MATCH-READS rows; log 2026-05-30 clean-arch rebaseline job ids.

Strict admin API wire parsers for all JSON responses · cddd8de

Extend parseAdminResponsesFromWire for recalc, synthetic, psychometric, journey-length, pair-explain, match diagnostics, simulation agents, and max-visible-profiles. Remove response casts from features/admin/api.ts; add AdminTargetUserIdRequiredError, vitest fixtures, and README boundary docs.

Typed admin recalculate-matches and tighten IRT/synthetic schemas · 5c26c7c

Add oneOf single/batch recalculate responses, AdminRecalculateMatchesRequest, strict AdminMatchIrtStatusResponse, and AdminBulkRecalcSummary maps on synthetic generate. Regenerate product OpenAPI bundle and zod/web-client artifacts.

Typed admin profiles and connection-stage responses · 3d20220

Add OpenAPI schemas for admin profiles CRUD, connection-stage, and biometric reset; DRY adminWireParse; fix connection-stage wire (no phantom success field).

Typed AdminStats for GET /api/admin/stats · 6c9c32f

Replace loose additionalProperties response with AdminStats schema; parse at web boundary with generated Zod (no silent field mapping).

Mark chat-session push done; add admin OpenAPI backlog · 8dd5201

Typed PersistedChatSession for chat session CRUD · c130d85

Replace loose session blobs with OpenAPI components and Zod validation at web and backend boundaries; add route test and contract-first invariants.

CI billing blocker note and OpenAPI chat-session schema follow-ups · 0917c93

GHA skipped all jobs on 587de743 due to org billing; local backend vitest green.

Backend route mongo mocks, vitest serial pool, strict chat session messages · 587de74

Route tests mock platform RBAC so internal auth does not open localhost Mongo; Vitest runs single-file to clear EnvironmentTeardownError; chat session wire requires a messages array instead of defaulting to [].

Defer UserBlockService Mongo until use; assert self-peer before block checks. · 459b0b8

Discovery tests mock dismissals/profiles collection modules; align match bulk, pair-explain, and WebAuthn tests with ml_wave default and storage sanitize contract.

Track tenant manifest JSON and align backend chat test mocks · a4ce0ea

GHA tenant list smoke failed because manifest.json and state/infra.json were gitignored. Backend vitest failed after messaging gates began calling getExistingConnectionStage: tests now use shared ConnectionService and Mongo stubs (blocks, dismissals, profiles). Config runtime test expects localhost domain from test env; admin bulk authUid prefix sim-gen.

Mark passkey OTP mock and verify-stack pipeline-root fixes done · 4a1b897

Resolve pipeline root in fleet verify-stack and UI tests · 5c5d9d7

Tests used parents[3] as pipeline root; on GHA that is the application root and breaks application_root_from_pipeline_root. Use resolve_app_pipeline_root and hosting_dir_from_pipeline_root; add a fleet unit invariant. Mock InputOTP in passkeyLoginOption tests to avoid input-otp timers after jsdom teardown.

Remove wrong pipeline_root fixtures overriding conftest SSOT · f4b2824

Module-level parents[3] fixtures pointed at the application root, breaking tenant_packages_dir_from_pipeline_root on GHA where source/ is not a sibling of the checkout parent. All fleet unit tests use conftest _PIPELINE_ROOT.

SSOT pipeline_root fixture for unit tests on CI · a97c309

fleet/tests/unit conftest exposes canonical pipeline/ path; remove wrong parents[3] fixtures that break tenant_packages_dir resolution when the repo has no source/ sibling above the application root (GHA layout).

Compile discovery.scope.restoreLoadFailed into messages bundles · 3e1632e

Shard keys must be built before CI messageKeysReferencedInSource runs.

Hygiene batch — wire parser, match-intent UX, fleet/pipeline tests · 4cf8684

Fail-closed optional string fields on chat wire rows; surface match-intent restore failures via i18n toast. Fix merge_env(mode=) in tenant-live-health, stabilize ml-internal unit tests with monkeypatch, bind verify-live tests to pipeline/src, and add MATCH_SCORING_SOURCE to env schema for seeder parity.

Install operator requirements for Python CI pytest batch · b05ce4b

Operator infra CLI tests import FastAPI TestClient; hosting-only deps were insufficient.

Anonymous topic modal distinguishes bank load failure · b3e5973

Reuse useIcebreakerQuestionBank SSOT; show loadFailed + retry instead of empty-bank copy when GET /api/questions fails.

Fail-closed chat connection transport for unknown stages · a69ed19

Explicit live-stage allowlist; wire typos and schema drift map to inaccessible instead of live messaging (messagingLifecycleGate parity).

ML pytest lab fixtures and KB p124 todo token · fa3fd61

Materialize lab_ui_table_bands and minimal pipeline_artifacts on GHA from tracked config/pytest_lab; ignore testbench-only and rich TUI tests.

Arch audit rebaseline 30/18/17 and chat fallback backlog · a5bba5c

Record clean-arch P0=0 audits and scoped anti-pattern findings for follow-up.

ML pytest policy SSOT, chat peer invariant, test corruption · 8506b04

Root-cause CI failures: stage learning policy on GHA (prod_mongo), missing gitignored JSON fixtures, REPRO-PATHS app-pipeline typo, chat route normalizing before pair invariant, and a corrupted vitest import line.

ML pytest policy path and live-test ignores on GHA · a0d6186

Set ML_SERVICE_LEARNING_POLICY to tracked stage JSON in conftest and CI env so scorecard parity loads at import. Add pytest.ini live-module ignores so jsdom runners skip rich/TUI suites reliably.

ML pytest green + universe DPR atomic CI fix · e640615

Stub device hints in universe DPR atomics for CI jsdom · acfbd13

Vitest reports low hardwareConcurrency and triggered low-power DPR caps; mock desktop-tier hints so cap assertions match UNIVERSE_WEBGL_MAX_DPR SSOT.

Pytest green — mmr.nlp import SSOT and cohort feature version · 02271fe

Route mmr.nlp package root through lab (NlpConfig/runner) while production submodules (errors, backends) alias src.mmr.nlp for identical exception types. Align offline learning loop NLP v2 with fit_for_wave cohort affect resolution; fallback outcome models use feature_names_for_version. Tests catch domain_errors and fix live scorecard agent email typo.

Web atomic green, BFF /uploads reject, admin route invariants · 7a88f91

Align offline tests with backend admin route split, contract-first feature flags, i18n key SSOT, and post-0.1.909 BFF proxy rules. Refresh compliance ratchet baseline for fleet ML ops additions.

SBOM prune exported images only; ML CI offline pytest scope · c25aee5

- Do not docker-rmi manifest images before their SBOM (simulation-worker fix) - Ignore test_live_* in ML pytest; track contracts scorecard fixture in git - Align adminApiDocsTabInvariant with PRODUCT_ADMIN_OPENAPI_SPEC_PATH SSOT - Arch audit rebaseline jobs 4cc4eb0d / 21ee1b25 / 42181ca5 (P0=0)

Prune peer images before each syft SBOM on Build once · 5ec193d

GHA runners keep all built images until the SBOM step; syft still hit no space left on device for application-ml-service. Drop other manifest images before each scan, sort ml-service last, and clear stereoscope /tmp.

Free GHA disk after each syft SBOM export · 5c05b06

Syft failed on application-ml-service with no space left on device when writing docker image tar. Prune each local image after a successful scan and surface syft stderr in BuildSbomError messages.

Restore web tsc inventory tests and ML pytest dev deps · 06c993a

- Remove markdown corruption from universePrototypeDockI18nE2eInventory.test.ts - Add getOrbStateByPercentage SSOT; fix connection stage test fixtures - CI installs ml-service requirements-dev.txt (mongomock + httpx) - Syft SBOM export: drop --quiet so CI logs stderr on failure

Un-ignore web-client features/**/lib next to src/lib gitignore rule · 7fa270e

Parent-directory exclusion from blanket lib/ blocked feature-owned helpers even with late negation rules; colocate exceptions with src/lib.

Track web-client feature lib helpers ignored by blanket lib/ rule · df313d0

Move features/**/lib un-ignore next to src/lib exceptions and add eight error/journey/i18n/ui resolver modules so Docker Build once can resolve imports that passed locally but were never committed.

Track missing OpenAPI generated api model files · d6d4e2f

Root cause: src/generated/** gitignore blocked new OpenAPI Generator model modules while models/index.ts re-exported them — local builds worked (files on disk) but GHA Docker build:direct failed with 55 module not found errors. Un-ignore generated api client paths and commit the missing model artifacts from contracts generate-all.

Mark CI web-lib gitignore fix todos done · 005aa1f

Track web-client src/lib sources omitted by gitignore · e68bd56

Root cause: blanket lib/ ignore had app-source un-ignore rules only; source/20_web-client/src/lib/** (strictJsonObject, errors/core, navigation SSOT, etc.) existed locally but never reached GHA, breaking npm run build:direct in Docker. Mirror app-source exceptions and commit lib + tests/atomic/lib invariants.

Track prod learning policy and psychometric config JSON · 689df3e

Root cause: blanket *.json gitignore hid files required by backend/ml-service Docker COPY steps, breaking GHA Build once. Add SSOT exceptions matching learning_policy.stage.json and commit both artifacts.

Mark audit evidence commit todo done · 357178a

Sync audit rebaseline 25 and stage semver evidence · 1e1e606

Record P0=0 jobs ef7f4cab/c26655c8/bc909fea, refresh AGENTS.md stage table to web 0.1.1001 and API 0.1.188, and align project todos.

Mark architecture commit and stage deploy todos done · 2abc19b

Sync architecture audit evidence and project todos · e00ca37

Record latest clean-arch rebaseline jobs and close commit-gate hygiene rows.

Arch hygiene, i18n shards, and production build fixes · 5b1208c

Stop exporting server-only UnprefixedRouteShell from the app-shell barrel, localize discovery scope and profile culture copy, consolidate dev operator errors under devShell i18n, remove dead adminAuth, and fix TS/build blockers.

Auth request SSOT and fail-closed profile route guards · 41185a0

Extract AuthenticatedRequest to lib/auth, route profile handlers through getAuthenticatedRequest, and add architecture invariants for clean-arch audit.

Mirror @config alias in vitest for SSOT threshold tests · 55e6fd2

Vitest only resolved @/ while threshold loaders use @config/* from tsconfig; add the alias to both vitest configs, an invariant test, and the prod audit sweep.

Unblock clean-arch rebaseline at P0 zero · 86bbc0a

Document dependency_graph_analyser at /home/doc1024/Documents/tools/… in core-agent rules; remove JSDoc import() links that caused phantom P0 edges. Re-audit job f4b90c1e confirms error_violations 0 (was 116 pre-epic).

Enable prod learning and ML wave env keys for ifeoma-tc · 3ba7ef6

Add learning scorecard ingress, outbox polling, and local NLP backend settings to prod tenant env so ML wave scoring aligns with stage policy.

Record clean-arch audit runbook and close WEB-ARCH todos · 5c8d55c

Document dependency_graph_analyser path, navigation index entry, rebaseline metrics (P0 116→2), and mark WEB-ARCH epic items done in project todos.

Clean architecture layer boundary sweep · e28c454

Split design-system presentation from features wiring: AppNav, match-card, journey chrome, i18n shell, errors, auth guards, and UI chrome resolvers. Remove nextjs-api shim, move Match type to features/discovery, add layer invariant tests, waitlist landing client, and contract-first HTTP gates.

Add diagnostics CLI commands for fleet invoke · 63bfd2f

Register workstation diagnostics helpers and fleet subprocess wrapper with CLI docs and tests so operators can run targeted health checks without chaining legacy fleet CLIs ad hoc.

Add mobile app waitlist public API · 27a96cc

OpenAPI POST /api/public/mobile-app-waitlist with generated web client, Zod schemas, and BFF public-route proxy exclusion so the Next.js handler receives traffic instead of Fastify upstream.

Centralize product threshold JSON SSOT · 0e93a15

Move match, connection-ring, admin, and journey maturity thresholds to source/config with web-client mirrors and a Docker sync script so runtime and vitest SSOT tests read the same files.

Remove deprecated matchScoreBandLocaleKey · 2270851

Unused after formatMatchScoreBandRangeLabel SSOT labels; closes CL-HYGIENE-003.

Close continuous-learning prod audit v3.5 · 8995927

Centralize threshold and scorecard-label SSOT in config JSON with parity CLIs and vitest/pytest guards; migrate ML routes to mmr adapters with a single routes/dependencies seam and thin jobs shims; remove IRT paths and silent fallbacks; rebuild i18n for dynamic maturity/learning band placeholders.

Sync project todos, AGENTS stage table, E2E merged-env notes · 30e96d7

Record Qwen/match-fit/openers/admin QA completion rows, stage deploy verify todos, and E2E helper documentation for locale shards and health gates.

Prototype dock operator locale i18n build scripts · d5c1635

Add scripts to build and apply final prototype-dock operator locale strings for universe scene debug chrome.

E2E and vitest for match-fit, openers, admin QA · 409dcc8

Add Playwright specs and route stubs for match-fit peer sheet, connection openers DE language note, admin journey-length narrative, and outcome-by-band viewports. Locale shard helpers, health version gates, and invariant tests.

Match-fit, openers, admin QA, server-prose language chips · 8eaa035

Ship discovery match-fit narrative, connection openers, profile NLP affect, admin psychometric/journey-length/outcome panels, and shared ServerGeneratedProseLanguageNote. Contract-first generated clients, typed connections API validation, admin confirm-modal SSOT, universe empty-pool i18n, and web 0.1.999.

Match ML ops CLI, tenant gather NLP, contract models · d960ad7

Add fleet commands for match-item-stats and admin outcome-by-band probes; refresh generated contract models; extend operator tenant-deployment gather and CLI HTTP helpers for steered deploy workflows.

NLP secrets, ml-service health probe, stage env · 0480160

Extend merge-env and tenant API for NLP backend settings, bake ml-service NLP deps in compose, and refresh ifeoma-tc stage/deploy env templates for Qwen.

Match-fit, openers, admin QA, E2E ml_wave materialization · c37a182

Wire discovery match-fit narrative, connection openers, icebreaker recommendations, profile NLP affect, and admin psychometric/journey-length routes. Add grounded fact bundle SSOT, Qwen client integration, ml_wave E2E discovery peer seeding, and match recalculation scheduler guards (API 0.1.187).

Qwen grounded generation, NLP jobs, learning audits · 7782ce1

Add on-prem Qwen routes and jobs for match-fit narrative, question-bank QA, reflection enrich, and connection openers. Ship learning scorecard ingress, label audits, cohort weight tests, and NLP env contract updates (0.1.6).

Regenerate web-client and fleet API clients · e091c23

Refresh generated TypeScript and Python models after OpenAPI additions for match-fit, openers, admin QA, profile NLP affect, and ml-service Qwen routes.

Qwen surfaces, match-fit, openers, admin QA routes · a59b6a6

Add product OpenAPI paths and schemas for match-fit narrative, connection openers, icebreaker recommendations, profile NLP affect, admin psychometric audit, journey-length recommendation, and match outcome by band. Extend ml-service and tenant API contracts for grounded generation and NLP settings.

Restore structural label fix row · 12df5c7

Bank audit DONE, rename outcome label diversity todo · c229bde

NLP backend blank settings defer to env (0.1.17) · 9f43918

Empty Settings.nlp_backend no longer blocks NLP_BACKEND merge-env. Profile NLP route maps NlpError to HTTP 503 with explicit detail.

Tenant-audit-profile-bank-alignment + gate plane C trace (0.1.16) · a5470bc

Ship audit script in ML image; Fleet SSH docker exec for legacy bank drift. Learning gate logs plane C skew/kurtosis for operator grep.

Sync cohort deploy and plane C partial status · 612331c

Mark ML wave stage gate pass and cohort deploy DONE · eb7adfe

Stage wave 0 commitApplied true on AI 0.1.15; plane C y=0 diversity remains partial.

PsychometricRegistry.questions is a list; build_item_surfaces_for_wave incorrectly called .values() causing wave 500 after gate pass on mongo bank. · 84c6784

Bootstrap 03_weights for wave commit (0.1.14) · ce6ac27

Stage wave run-once returned HTTP 500 when gate passed but calibration-artifacts lacked 03_weights.json. Bootstrap uniform baseline under bootstrap_mode and map LearningExportError to HTTP 200.

Add grep-friendly cohort overlap traces and a Mongo bank-alignment audit CLI for legacy profile journey key drift. · e7f058f

Add grep-friendly cohort overlap traces and a Mongo bank-alignment audit CLI for legacy profile journey key drift. Fix label_all_pairs to resolve agents by subject_id (authUid) instead of email-only lookup. Untrack lab learning.db.

Phase 1 prod wave, mongo psychometric bank, NLP boundary · d67abfb

Port continuous-learning core to src/mmr (wave runner, cohort, egress, NLP affect), load psychometric registry from Mongo on stage, fix prod NLP to use src/mmr/nlp/models (not lab/), pass ML/NLP env through compose, and align tenant stage mode_overrides. ML service 0.1.11; tests include import boundary and OpenAPI route SSOT.

Align ifeoma-tc stage env ML service version to 0.1.6 · ce1b3e9

Refresh PACKAGE_INDEX and stage/deploy env pins after ML service semver bump.

Update master-plan and module todos for peer lifecycle, admin Q&A, and mailbox gate workstreams. · cef5ee6

Update master-plan and module todos for peer lifecycle, admin Q&A, and mailbox gate workstreams. Extend CI workflow coverage and document admin answers import versioning.

Contract-first APIs, chat peer lifecycle, admin question bank, mailbox gate · 575ad4b

Migrate remaining product HTTP to generated clients; add inactive-chat inbox filtering, acknowledge-unavailable-peer UX, admin Q&A export/import UI, and strict preferences parsing. Fail closed when session and profile lack a mailbox (app shell gate, onboarding read-only email, settings without no-email fallback). Bump web client to 0.1.969 with i18n and tests.

Peer lifecycle dismissals, admin Q&A export/import, preferences strict blob · a3ff718

Implement acknowledge-unavailable-peer with viewer_peer_dismissals, filter dismissed peers from connections and discovery lists, admin answers export/import routes, and UserPreferencesBlob validation on preferences. Add mongo integration tests and chat session peer profile policy. Bump API package to 0.1.175.

Extend product API for peer lifecycle, preferences, and admin Q&A · 791d70f

Add OpenAPI paths and schemas for acknowledge-unavailable-peer, user preferences blob, admin question answers export/import, and stricter question/connection-statement models. Regenerate web, zod, and fleet contract models from the updated product spec.

Record ProfileDeleteResponse and landing trust todo evidence · 5da98e4

Mark contract and landing-trust slices done; clarify full-deletion scope backlog.

Regenerate release-notes after ProfileDeleteResponse and landing trust commits. · 2beef78

Guard landing trust strip against data-export copy · f2f1c10

Assert dataSelfService uses delete iconography and docs omit export claims.

Align profile settings README with delete-only data UX · a61b8e8

Remove export-account references; document DELETE /api/profile and sign-out after self-service deletion.

Validate ProfileDeleteResponse at parser boundary · be7b36d

Require profilePictureCleared and journeyReflectionCleared on DELETE /api/profile and expose the typed result from deleteProfileAccount.

Regenerate clients for ProfileDeleteResponse fields · 9673583

Refresh OpenAPI types, profile API stubs, and Zod bundles after extending the profile delete response with picture and journey reflection flags.

Extend ProfileDeleteResponse with deletion scope fields · 0a70ffa

Document profilePictureCleared and journeyReflectionCleared on self-service DELETE /api/profile, including what is and is not hard-deleted today.

Landing trust badges reflect delete-only data controls. · 068a1a3

Removes export copy from the trust strip, uses a delete-account icon, and refreshes landing locale shards plus compiled message bundles.

Document ProfileDeleteResponse on DELETE /api/profile. · 8273417

Adds the OpenAPI schema and route response for self-service account deletion so codegen and client parsers share one contract-first delete envelope.

Records completed chat lifecycle, contract-first HTTP, i18n CSV hardening, account-deletion orchestration, and stage E2E verification rows. · de32b99

Regenerates messages/*.json and release-notes evidence after profile-delete, chat contract-first, and i18n shard updates in this batch. · b170687

E2E journey welcome gate and chat viewport shell specs. · abaaeb8

Dismisses journey-intro before polling hub progress URLs and adds Playwright viewport coverage for lifecycle-ack and unknown-peer chat routes.

Harden i18n CSV tooling with shared SSOT helpers. · 40021a5

Centralizes shard listing, leaf flattening, and cell codec across export/import scripts; rejects CSV path conflicts and missing locale cells; removes dead chat.system.profileNotAvailable keys from locale shards.

Contract-first chat messages, media upload, and transcript export. · bbd0b10

Routes chat HTTP through generated api.chat clients with strict response parsers and shared error mapping so features/chat no longer uses ad-hoc fetch or raw JSON casts.

Chat peer lifecycle ack dialog and strict chats-route transport. · b05ea41

Ports lifecycle-ack test ids onto BaseModal, decouples thread render phases from connection-stage gates, and resolves embedded chat routes through strict peer transport validation with general peer-unavailable copy.

Contract-first profile delete and honest settings UX. · 0490bb6

Uses generated deleteProfileAccount with parseProfileDeleteResponse, signs the user out after a successful delete, and localizes updated delete-modal copy across all base locale profile shards.

Orchestrate self-service account deletion side effects. · fd491c1

Adds AccountDeletionService to purge profile media, journey reflection, and connection rows; wires DELETE /api/profile to structured success logging and extends contract tests for the delete response envelope.

Regenerate product API clients across modules. · e68ecc1

Keeps fleet, tenant, pipeline, and ML service generated models aligned with the current OpenAPI contract surface; refreshes tracked web Zod schema index.

Mark chat lifecycle hardening todos done at web 0.1.929 · 9427ea0

Fail-closed connection validation and profile delete contract · 0e83bbe

Remove English getConnectionActionLabel shim, add canBlock SSOT, align DELETE /api/profile OpenAPI with connectionsEnded, and wire resolvePeerTransportId in ChatView.

Record chat peer lifecycle completion and repo semver 0.1.928 · 7f1e022

Update master plan, AGENTS semver table, and project todo rollups for the lifecycle slice.

Regenerate product API clients and profile delete route · e97ae93

Refresh OpenAPI-derived web/backend artifacts for self-service profile delete and admin API docs surfaces.

Chat peer lifecycle UX with general unavailable copy · 950e876

Decouple viewer vs peer thread gates, add lifecycle acknowledgement, inbox stub labels, and i18n for quiet peer-unavailable messaging across five locales.

Chat peer lifecycle gates and profile-delete cascade · 1e97251

Centralize peer profile checks and read-only transcript policy on chat paths, terminate connections when a profile is deleted, and document viewer-only block semantics.

Extract admin maturity bands · 2ba5aea

Move platform maturity thresholds into a named helper so analytics buckets and averages do not depend on inline coercion.

Capture product readiness gate layers · e5138de

Document the separate onboarding, journey, signal, discovery, and chat gates so future cleanup does not collapse unlike completeness metrics.

Record admin cleanup follow-up evidence · 22f81ee

Update product todos and stage notes with completed verification rows plus remaining deploy/report work.

Bump product versions · 21e1710

Refresh deployable semvers and release notes after the admin cleanup and UI consistency work.

Cover admin journey and locale invariants · d0ccfe8

Lock admin analytics to capped Match targets and add regression coverage for locale-aware links, timestamps, percent display, and quadrant labels.

Localize dynamic admin and profile UI · 7d44a9d

Move hardcoded profile/admin presentation through locale-aware helpers so operators and profile surfaces do not render English-only fallbacks or browser-default dates.

Drop legacy discovery English fallbacks · 8996439

Let missing legacy list bio and location remain absent so display components, not transformers, own user-facing fallback copy.

Share discovery intent score reader · 5b1f792

Consolidate viewer and peer intent score branching so both readers derive from the same enriched-or-scoped path.

Centralize journey readiness targets · b6f8907

Route journey completion checks through the target SSOT so hub, You, analytics, and route phase logic cannot drift from Match readiness.

Delete selected profiles from table · 9445aeb

Replace the one-off no-email cleanup with table filters, sorting, and explicit selected-profile deletion so admin cleanup is inspectable before destructive action.

Add WEB-I18N-BASELINE-ZERO todos and refresh score SSOT evidence · d68483c

Roll up the remaining i18n scanner baseline cleanup across master-plan and module todo indexes, and document the stricter discovery score SSOT audit (8 tests).

Audit discovery match score math stays in score model · 7bd0f9c

Extend SSOT audit to forbid computeDiscoverySessionMatchScores and sessionMatchScore calls outside the canonical discovery score modules.

Mark P133-MERGE-PR done after p124-repo-layout merge to main · 05d6c58

Sync generated schemas and P133 merge-pr todo note · 17b59e0

Regenerated contract models and web zod schemas; update pipeline todo for PR #4 CI status after hosting/python-ci fixes on p124-repo-layout.

Defer VMCreator until after network preflight · a129c09

Unit tests for create_vm policy and network discovery must not require virt-install on CI runners; only disk/image provisioning needs it.

Hosting VM guard before virt-install; align chat media wire test · ac68e17

Check existing VM policy before VMCreator init so unit tests pass without virt-install on GHA. Install hosting requirements in python-ci job. Expect API media URLs from mediaId in wire parity test.

Install operator hosting requirements in GHA python-ci (paramiko for edge TLS unit tests). · d93d783

Install operator hosting requirements in GHA python-ci (paramiko for edge TLS unit tests). Align chat media wire test with API URL derivation; mock UserBlockService in POST messages gate test so offline route tests avoid Mongo.

Add dnspython to fleet requirements for DNS unit tests · f74abce

GHA python-ci fleet batch imports fleet_manager._dns; dnspython was only listed under operator hosting, not fleet/requirements.txt.

Add pytest-order for hosting pytest.ini addopts · c1d2cac

Fleet batch runs operator hosting tests with --order-scope=module; install pytest-order alongside httpx in fleet/requirements.txt.

Add pytest-order for hosting pytest.ini addopts · 7a110ab

Fleet batch runs operator hosting tests with --order-scope=module; install pytest-order alongside httpx in fleet/requirements.txt.

Install httpx for pipeline sidecar client tests · c796139

Fleet CI batch imports deployment orchestration tests that use httpx-backed sidecar clients; declare httpx in fleet/requirements.txt with operator parity.

Install httpx for pipeline sidecar client tests · 9ef4422

Fleet CI batch imports deployment orchestration tests that use httpx-backed sidecar clients; declare httpx in fleet/requirements.txt with operator parity.

Defer PatReadResult annotations in deployment contracts · 1a5641a

Add future annotations so classmethod return types resolve during module load (fixes Python CI collection on deployment whitelist tests).

Defer PatReadResult annotations in deployment contracts · 4a66f5b

Add future annotations so classmethod return types resolve during module load (fixes Python CI collection on deployment whitelist tests).

Restore P133 PR gates (KB link, PyYAML, match-gate parity) · af03efe

Track pipeline/build/README-BUILD-DIGEST-PROMOTION.md for KB link checks; install PyYAML in manifest post-build CI job; add source/tools parity script after app-source → source layout.

Restore P133 PR gates (KB link, PyYAML, match-gate parity) · 9c30325

Track pipeline/build/README-BUILD-DIGEST-PROMOTION.md for KB link checks; install PyYAML in manifest post-build CI job; add source/tools parity script after app-source → source layout.

Skip PR build-once when diff has no catalog components · 398c482

Doc-only or layout-only PRs no longer fail the affected-components step; downstream SBOM/cosign/upload and deploy-consume skip when compose is skipped.

Skip PR build-once when diff has no catalog components · 67052fc

Doc-only or layout-only PRs no longer fail the affected-components step; downstream SBOM/cosign/upload and deploy-consume skip when compose is skipped.

Exclude root .gitignore from P124 path gate · a61df76

Track manifest fixtures and install pytest in post-build job · 9260cf2

Un-ignore pipeline/common/tests/fixtures/*.json so GHA offline manifest gates can read promotion fixtures. Add pytest + fleet PYTHONPATH to the build-manifest-post-verify workflow job.

Mark B52-CI-GHA-COMPOSE done · c9da0f1

Mark B52-CI-GHA-COMPOSE done after green build-once · b143c9a

Default build CLI invocation_id for build-once GHA · 30d4631

Build manifests require invocation_id; ci_build_once invokes build/cli.py without fleet. Generate a UUID v4 per CLI run when --invocation-id is omitted.

Default build CLI invocation_id for build-once GHA · 3d6e146

Build manifests require invocation_id; ci_build_once invokes build/cli.py without fleet. Generate a UUID v4 per CLI run when --invocation-id is omitted.

Narrow P124 path gate and refresh tenant path strings · e7dcf64

Gate only flags app-pipeline/ layout paths and pipeline/tenant/ (not every "tenant" token). Update KB, tests, and tracked env paths for post-layout tree.

Narrow P124 path gate and refresh tenant path strings · 88ab4f8

Gate only flags app-pipeline/ layout paths and pipeline/tenant/ (not every "tenant" token). Update KB, tests, and tracked env paths for post-layout tree.

Track src/lib/api/version.json for Docker builds · 23970f8

The API semantic version module imports version.json; the global *.json ignore rule kept it out of git so CI build:direct type-check failed.

Track src/lib/api/version.json for Docker builds · 5e23f0a

The API semantic version module imports version.json; the global *.json ignore rule kept it out of git so CI build:direct type-check failed.

Restore consumer map links and fleet bootstrap in manifest scripts · 6837d43

Add contracts/consumers/README.md, point KB links at operator-control-plane.mdc and Operator hosting paths, and call ensure_fleet_sys_path from repo-root manifest verify scripts so GHA post-build gates load common.vm_states.

Restore consumer map links and fleet bootstrap in manifest scripts · 75d0387

Add contracts/consumers/README.md, point KB links at operator-control-plane.mdc and Operator hosting paths, and call ensure_fleet_sys_path from repo-root manifest verify scripts so GHA post-build gates load common.vm_states.

Whitelist web-client scripts/lib and features/*/lib · 2f9bf31

Add releaseNotesCliExit for prebuild scripts in CI · 9957b59

Docker build:direct type-checks scripts/; releaseNotesCliExit was missing from the repo (ignored lib/ path). Provide fatal stderr helpers used by generate-release-notes and verify-release-notes-bundle-semvers.

Add releaseNotesCliExit for prebuild scripts in CI · b9b8f8e

Docker build:direct type-checks scripts/; releaseNotesCliExit was missing from the repo (ignored lib/ path). Provide fatal stderr helpers used by generate-release-notes and verify-release-notes-bundle-semvers.

Commit landing scroll hooks and journey seed JSON for CI · 79270c4

Restore missing landingScrollPerformance module referenced by landing UI, whitelist lib/data/seeds JSON from the global *.json ignore, and track default question/statement banks required by build:direct in Docker.

Commit landing scroll hooks and journey seed JSON for CI · 80406c6

Restore missing landingScrollPerformance module referenced by landing UI, whitelist lib/data/seeds JSON from the global *.json ignore, and track default question/statement banks required by build:direct in Docker.

Compliance ratchet bootstrap and operator fleet status path · 444463e

Bootstrap fleet/src before check_compliance imports common; refresh compliance baseline after layout-era drift. Restore GET /fleet/tenants/{tenantId}/status in operator-gateway fleet paths source. Harden compose-build test subprocess mocks with stderr fields.

Track ISO geography JSON for Docker/CI builds · cb92902

The backend imports iso3166Alpha2Codes.v1.json at compile time; it was ignored by the global *.json rule so GHA build-once backend images failed with TS2307. Whitelist the file like cultureTaxonomyV1.json.

Surface compose build errors and inject CI compile-time env · f0697e4

Log redacted docker compose stderr on failure, pass --ci-public-site-url from ci_build_once for allowlisted NEXT_PUBLIC_* / Server Actions keys, and add ci_build_time_env helper for GHA build-once web-client builds.

Bootstrap fleet common merge for build-once GHA job · 897f547

Load pipeline_paths via importlib before common package init, set job PYTHONPATH to fleet/src, and pass fleet_operator_pythonpath_entries to build subprocesses so ci_build_once resolves common.vm_states on runners.

Repair build-once workflow YAML and cosign step guards · b186c3e

Indent embedded Python in the PR affected-components step so GitHub accepts the workflow file; map cosign secrets to job env for valid step-level if conditions. Add contract test that the workflow parses.

Record full-product-workflow GHA E2E pass · 775c0d7

Inject infra into build_pipeline_build_context callers · 4bca282

Pass tenant infra snapshot from Operator bridge and fleet tests instead of reading tenant.get_infra() inside pipeline build (module-boundaries).

Restore valid OpenAPI fragment after control-plane commit corruption. · 7afa48b

Align compliance script bootstrap with fleet_operator_pythonpath_entries.

Close ADMIN-MATCH-PAIR-EXPLAIN with Playwright CI evidence · 1743205

Preflight skip for authenticated E2E workflows when E2E_MERGED_ENV unset · 3fdde88

Align chat icebreaker and full-product-workflow GHA with admin match diagnostics (notice + skip). Add ubuntu24.04 Playwright override. Close admin match E2E todo row and refresh master-plan reconciliation.

Admin match E2E green on stage and CI; fix pipeline pytest imports · 04ecd1b

Record Playwright admin-match-diagnostics 2 passed (stage + GHA run 26378285439). Pipeline tests import infrastructure.infra_ops via ensure_fleet_sys_path; add pipeline_control_src fixture for src namespace isolation.

Green admin match diagnostics on stage via email-token login · 4bd629c

When E2E_ZITADEL_SKIP_MANAGEMENT_PROVISION=1, sign in with NextAuth email-token only (no flaky Zitadel signedin loop). Navigate admin shell then user-profiles section. Verified: explain panel and compare matrix passed against stage (ifeoma-tc).

Harden admin Zitadel login and document E2E_MERGED_ENV secret · 0a72a51

Fix pipeline traefik tests to import infrastructure.infra_ops via ensure_fleet_sys_path. Admin session helper handles Zitadel signedin interstitial and email-token fallback; add GitHub secret setup doc. Extend admin route diagnostics vitest coverage.

Align build context and tests with tenant.get_infra() registry · 8b2683b

Use resolve_infra_registry_url on tenant infra snapshot; mark control-plane smoke tests integration; tighten deployment architecture pytest. Refresh operator-control-plane KB for HTTP-only steered deploy CLI.

Note build:direct i18n compose and GHA admin E2E skip · 350b398

Docker image build uses build:direct (shard messages + SW + next build). Document that admin match diagnostics workflow_dispatch skips Playwright when E2E_MERGED_ENV is not configured.

InfraOrchestrationHost SSOT for deploy and reachability · fcf11e3

Introduce pipeline deployment.infra_orchestration_host and operator infrastructure_control host/composed_behaviors so deploy gates, whitelist policy, and verification resolve infra through one protocol instead of FleetManager type hints. Extend operator gateway contracts, steered-deploy UI invariants, and fleet/operator pytest coverage for host resolution.

Skip admin match diagnostics E2E when E2E_MERGED_ENV is unset · 5c0e866

Add a preflight job so workflow_dispatch no longer fails on repos without the merged tenant secret; emit a notice with setup instructions instead.

Extract e2eSeedConversationRequest helper; repeat seed when pair is already conversation_active returns 200 without 500. · 3cda08e

Extract e2eSeedConversationRequest helper; repeat seed when pair is already conversation_active returns 200 without 500. Admin profile search utils aligned.

Record product push and post-push stage rebuild · bbd1be7

Eleven commits on main deployed via rebuild-app; stage semver unchanged at web 0.1.913 / API 0.1.165 / AI 0.1.6; chat media 401/404 smoke OK.

Refresh stage reconciliation to web 0.1.913 · 94d0de6

Align reconciliation table with AGENTS.md live semver after admin match and weight-pipeline deploy loop.

Stop proxying public /uploads; map wire mediaUrl to participant read path. · b2ed317

BFF and proxy matcher tests lock routing behaviour.

Participant-only GET /api/chat/media/:mediaId · 96e929b

Authorize thread participants before streaming GridFS bytes; mediaUrl points at /api/chat/media/{id}. Remove public registerUploadsStatic plugin.

Chat media read route and mediaUrl contract · 3af70e4

GET /api/chat/media/{mediaId} plus UploadMediaResponse.mediaUrl as participant-authenticated path (not public /uploads).

Localize profile last-active labels via profileEnrichment · ccd26cf

Replace hard-coded activity strings with profileLastActiveLabel + i18n shards; ProfileCard surfaces pass translate into enrichProfile.

Single SSOT for discovery match percent display · c7d3d13

Centralize display scores in getDiscoveryMatchScore / deriveDiscoveryProfileScoreModel; resolveMatchPercent returns null without silent zero; list, universe, chat, and connection surfaces share enrichment. Vitest SSOT audit and parity tests.

Admin match diagnostics Playwright and stage evidence · dc61521

workflow_dispatch CI, npm test:e2e:ui:admin-match-* scripts, runbook links, and AGENTS.md stage 0.1.913 / API 0.1.165 / AI 0.1.6 verification rows.

Admin pair-explain panel and compare matrix UI · 8e498fd

User Profiles: explain pair, 2–3 profile compare matrix, journey 15/5 targets, materialized-score SSOT for operator diagnostics. i18n admin.matchExplain/* and admin.matchCompare/*; build:direct runs i18n:messages:build (0.1.913).

Admin pair-explain API and match weight floor · b06f168

MatchPairExplainService exposes bidirectional operator diagnostics; discovery list shares discoveryPeerInclusionEvaluator. loadMatchItemWeights applies floor when stats exist but weight is null (0.1.165).

Materialize match item weights for degenerate histograms · 37e28fa

Resolve matchingDimension from the questions bank when answers omit it, use a present-answer bucket for item-stats, and apply entropy floor 0.15 for single-bucket items so backend recalc can load weights (0.1.6).

Add admin match pair-explain OpenAPI and codegen · 05a2016

Operator diagnostics for bidirectional match rows, journey gates, discovery exclusion reasons, and ML weight context. Regenerates product zod and web-client types.

Refresh stage order consistency doc references · 1073f06

Stage web 0.1.908 and API 0.1.160 voice upload evidence · 740693e

Deployment DTO boundaries, chat uploads proxy, semver bump · 00e6d77

Align module boundary checks and deployment contracts with P133 schema batch; centralize infra registry URL resolution; extend tenant-deployment runner tests. Serve chat media via backend static /uploads plugin and BFF proxy routes. Bump web 0.1.907 and API 0.1.158; refresh generated contract models and todo evidence.

P133-CI-SCHEMA partial progress on schema batch · a3e7c12

Record schema workflow steps 1–6 green; module-boundaries step 8 blocked by three pre-existing deployment/fleet import violations.

List only tenants with initialized infra mode · 028ab9c

Exclude manifest-only lab directories from GET /v1/tenants so partial packages do not 500 the control API. Schema batch module-boundaries step now includes fleet PYTHONPATH for common.vm_states.

Record duplication refactor plan closure · 1cfd437

Mirror DUPLICATION-REFACTOR-B7F5 as done on master plan and pipeline todo rollup.

Align inbox and adapter tests with duplication SSOT · c58a37e

Update transformToMatch and chats inbox tests for chat_active name policy and enriched display scores; preserve authUid in discoveryProfileAdapter; fix useDiscoveryProfilesForMatch sort invariant source check.

Unify chat wire, media semantics, and contract parity · 31c5807

Emit full ChatMessageWire including icebreaker fields; centralize media kind resolution for send, push, and export; align matchScope on discovery vs connections; use ListConnectionsQuery Zod at runtime and ProfilePublic builder for picture routes; add generated schema and route parity tests.

Dedupe profile, score, ring, and name policies · a0bbe95

Add shared pairwise dimensions, connection ring, peer name disclosure, discovery wire parser, match percent helper, and chat profile stub factory. Wire inbox and connection detail through connection-first discovery resolvers; fence legacy ListView mapper; align score APIs with enriched reads; update SSOT invariants.

Single-source deploy gates and preflight policies · 7c99112

Extract deployment gate, whitelist CIDR, DNS/mail, and infra health policies so steered Operator workflows run the same multi-target gates as in-process deploy. Fence Pipeline re-gather behind explicit debug options, block direct Pipeline production bypass without runtimeContext, and add parity tests for gather fencing, job federation, legacy delegates, and sidecar clients.

Refresh project todo rollups · dab026d

Update the workspace plan and pipeline todo rollups so committed work reflects the latest control-plane and product status.

Version matching intelligence materials · e89e00a

Replace draft matching intelligence docs with versioned overview, peer, press, and whitepaper materials for clearer ML-service publishing.

Add deploy preflight remediation · ced8658

Wire manifest deploy preflight and admin whitelist remediation through Operator workflows so deployment gathers fail clearly before Pipeline execution.

Remove execute workflow route · f67d747

Drop the legacy Fleet execute route and refresh Fleet contract/client surfaces so status and proxy behavior move through explicit supported routes.

Expose infrastructure control facets · 07b6c09

Add contract-backed gateway routes and UI types for infrastructure control so the operator surface owns these workflows through explicit API facets.

Relocate infrastructure test suite · aa084d3

Move infrastructure-heavy operator tests under the z_infrastructure package so the default test layout can separate focused gateway checks from long-running infra coverage.

Add media wire message contract · cb944ca

Promote chat media payloads into the product contract so backend and web clients share the same generated message wire shape.

Unify profile sheet score source · c96dd9b

Move chat and match profile-sheet data onto a discovery-owned resolver and score model so the same peer uses one enriched DiscoveryProfile across surfaces.

Unify chat peer profile resolution with discovery sources · 53a8730

Resolve inbox and thread peer labels from discovery profile data, remove the unused consent hook, and add atomic/E2E coverage for profile-source parity.

Explicit-context deploy preflights and snapshot rollback (P1) · 90edcbd

Gather tenant infra/targets/domains from Tenant API into deployContext, extract preflight and snapshot logic into deploy_preflights, and skip manager-bound snapshots on the Pipeline-exclusive deploy path.

Drop Fleet live-health proxy and refresh migration docs · 4c8f5e4

Remove the gateway proxy for Fleet live-health-runs, regenerate Operator web types/mocks, and update migration runbooks to point at Operator-native workflows.

Remove remaining transitional workflow routes (P6) · 74a9311

Drop live-health-runs and transitional route helpers from Fleet so workflow orchestration stays on Operator/Pipeline. Update Fleet OpenAPI, route catalog, and async-route tests to assert the removed surface returns 404.

Add matching intelligence overview materials · bc28e6c

Add audience-facing ML and matching overview docs to explain the matching intelligence service and related launch narratives.

Run post deploy health in full deploy worker · afe3196

Run explicit-target post-deploy health checks from Pipeline fullDeploy so deploy verification starts moving out of the legacy manager deploy spine.

Own app infra dispatch helper · 25a7063

Move the generic app-infra lifecycle dispatch body into Operator infrastructure control so Fleet's facet delegates through the owning layer.

Remove direct infra sidecar route · 1270dcf

Shrink Fleet's HTTP contract by dropping the app-infra action endpoint and keeping Operator's infrastructure route as the compatibility entrypoint.

Move reachability checks to verification · 638197c

Make Operator verification the implementation home for reachability and stage checks while leaving manager compatibility wrappers for transitional callers.

Add Operator infrastructure OpenAPI surface · 2084e5e

Bundle POST /v1/infrastructure/tenants/{tenantId}/infra/{action}, mark legacy fleet infra proxy deprecated, and regenerate operator web API types.

Add infrastructure control package and native infra routes · c169dd7

Introduce operator/src/infrastructure_control for app-infra lifecycle dispatch, POST /v1/infrastructure/tenants/{tenantId}/infra/{action}, and manifest-deploy infra preflight in tenant-deployment workflows. Deprecate fleet infra proxy path.

Reconcile todos, KB, and rules for manager and infra extraction · 60ff058

Update master plan, module boundaries, fleet-cli KB, and operator todos after splitting fleet manager control into operator-owned packages.

Embed discovery profile filters in match intent scope picker · a8835aa

Bridge list/universe filter chips into the scope picker modal, normalize viewer residence country codes, and add atomic plus Playwright viewport coverage.

Refresh generated clients and route catalogs · 4dc847b

Regenerate sidecar contract models and update fleet/pipeline route catalogs after control-plane API surface changes.

Fix imports after manager relocation and infra extraction · db5842d

Update integration and VM/traefik tests to use operator infrastructure paths and manager.* orchestration modules.

Update unit and batch tests for manager and import paths · a3ec557

Refresh fleet test imports for operator/src/manager and fleet_manager, keep reconcile multi-target coverage in fleet, and add workflow CLI redirect guards.

Update CLI, server, and runners for manager split · 74e1f1a

Redirect workflow commands to Operator/Pipeline successors, fix import paths to manager.* and fleet_manager, and refresh fleet docs for the new layout.

Wire deploy orchestration and tenant deployment runner · 857c6e0

Port deploy helpers to deploy_orchestration, extend tenant deployment context and runner intents, and align preflight/import paths with the manager split.

Migrate fleet infra unit tests and add infrastructure harness · e2217eb

Add operator/tests/infrastructure conftest and fleet fixtures, move VM/provision/infra unit coverage from fleet, and drop operator/tests/__init__ that shadowed fleet helpers.

Align infra_ops paths and execution with operator layout · a62866d

Use pipeline_paths for app_infra resolution and tighten infra execution, firewall, reachability, and remote ops against the operator infrastructure trees.

Split manager into fleet_manager facets and operator control · 41848dd

Move orchestration, deploy, reachability, and checks under operator/src/manager while FleetManager facets live in fleet/src/fleet_manager. Update sys.path bootstrap and import rewrite tooling so callers use manager.* without fleet owning workflow source.

Move contracts_generate and paths out of fleet · dad9e98

Centralize schema-generation helpers under the contracts module and route pipeline preflight imports through contracts_import so fleet no longer owns contracts tooling source.

Fix ifeoma-tc deploy env paths for application repo layout · 0e7a675

Point APP_PIPELINE_ROOT and APP_INFRA_ENV_FILE at pipeline/ and tenant/ paths after repo layout normalization.

Document operator gather → runtimeContext → pipeline flow, refresh master plan/todo rows for build-runs mock closure, and extend agent anti-patterns. · c6421ad

Align infra/hosting tests with operator app_infra paths · 58a1da1

Update traefik and harbor compose test paths after infra module extraction from fleet into operator-owned infrastructure control.

Cover operator workflow gather/runtimeContext wiring, direct-pipeline CLI guard, fleet proxy routes, and regenerate operator-web API types/mocks. · 69eabe6

Tenant deployment, gather wire, and import path coverage · 051d7d9

Add unit tests for wire/validation/runner/context, migrate deployment tests off load_package path hacks, and sync build/deploy run API tests with inline background job execution.

Centralize sidecar import path bootstrap for pytest · 1acc436

Add ensure_pipeline_sidecar_import_path SSOT, root pipeline conftest, and infra registry URL helper so src.client resolves consistently across tests.

Package-relative start_app imports and inventory contracts · 86cd1d3

Use deployment package imports in start_app/zitadel_provision, resolve inventory contracts via deployment package init, and drop legacy deployment conftest path hack.

Remove duplicated build/deploy context loaders and fleet rebuild/reconcile HTTP routes; thin orchestration to pipeline sidecar calls and pipeline-owned dev_sync/deploy modules. · 4784b80

Expose domains, manifest, and PAT value for deployment gather · 3146669

Add control-plane routes consumed by operator tenant-steered deployment workflows when materializing env and building runtimeContext.

Tenant deployment gather workflow and CLI steering · 7223722