Phase B cycle 1 was a structural refactor only: F4 (barrel imports +
STC-ARCH-01) and F7 (endpoint builders + STC-ARCH-02). This commit
brings docs in line with source after the cycle, no code changes.
Module docs (12 consumers): swap every /api/<service>/... literal in
code snippets and integration tables for the matching endpoints.*
builder; note the barrel import migration in Dependencies.
New module doc: src__api__endpoints.md (public surface, F4 barrel
re-export note, STC-ARCH-02 enforcement, contract-test reference).
Architecture compliance baseline: mark F4 + F7 CLOSED with commit
hashes (23746ec, 8a461a2).
01_api-transport component description: add endpoints.ts + barrel to
Internal Interfaces, close the F7 caveat, extend Module Inventory.
ripple_log_cycle1.md: Task Step 0.5 reverse-dep analysis records the
import-graph closure (no extra docs needed beyond the direct set).
Carry-over reports landed alongside the docs:
- test_run_report_phase_b_cycle1.md (Step 11 outcome)
- implementation_report_refactor_phase_b_cycle1.md (cycle summary)
State file: trimmed to the autodev <30-line target; Steps 14 + 15
recorded as SKIPPED with rationale (no security or perf surface
changed in this cycle); pointer moved to Step 16 (Deploy).
Co-authored-by: Cursor <cursoragent@cursor.com>
Closes architecture baseline finding F4. Every component now exposes
its Public API through `src/<component>/index.ts`; cross-component
imports go through the barrel. `scripts/check-arch-imports.mjs` plus
`STC-ARCH-01` in the static profile enforce the rule; tests in
`tests/architecture_imports.test.ts` cover AC-4/AC-5 + 2 exemption
cases. One F3-pending exemption (`classColors`) is documented in 5
places (barrel, consumer, script, doc, test) to avoid a circular
import.
Phase B cycle 1 batch 1 of 2 (epic AZ-447). Batch 2 is AZ-486
(endpoint builders) — blocked on this commit landing.
Co-authored-by: Cursor <cursoragent@cursor.com>
The Playwright base image
(mcr.microsoft.com/playwright:v1.49.1-noble) ships without
unzip, which bun's curl|bash installer requires:
error: unzip is required to install bun
process "/bin/sh -c curl -fsSL https://bun.sh/install ..."
did not complete successfully: exit code: 1
Found while user asked the agent to attempt to bring up the
suite-e2e compose stack. Latent bug — the runner image had
never been built successfully in any local workspace before.
Test report (test_run_report.md) updated with the concrete
error trace from the up attempt: the 6 azaion/<S>:test
service images are pull-access-denied (not in any reachable
registry from this host), confirming the legitimate
external-service env block. Local-build half (azaion-ui,
owm-stub, tile-stub, playwright-runner) is healthy.
No e2e tests were executed; Step 7 verdict unchanged
(PASS_WITH_DOCUMENTED_GATE; e2e deferred to CI / merge lane).
Co-authored-by: Cursor <cursoragent@cursor.com>
- static profile: 29/29 PASS (~13s)
- fast profile: 163 PASS / 13 SKIP / 0 FAIL across 26 files (~14.6s)
- e2e profile: user-approved env-block (suite service :test
images not available locally, not buildable from sibling
repos today, registry auth not configured in this workspace).
Deferred to CI / merge lane with registry access.
- 13 skips: all user-approved as Phase B feature quarantines
paired with control PASS tests; tracked in F-CUM-3 / F-CUM-5
drift backlog.
- System-Under-Test Reality Gate: PASS (no internal modules
faked; only external suite services are stubbed).
Step 7 closes; advance to Step 8 (Refactor — optional).
Co-authored-by: Cursor <cursoragent@cursor.com>
Final test-implementation report with handoff to test-run
skill per implement skill Step 16 (next flow step is Run
Tests; let test-run own the full-suite gate to avoid
duplicate runs).
27 test tasks delivered across 8 batches (1 + 4*6 + 4 + 2);
0 production source mutations; 26/26 ACs covered; 23
production drifts pinned to runnable contract tests; 29
commit-time static gates active (up from 13 at baseline).
State: existing-code Step 7 (Run Tests), not_started.
Co-authored-by: Cursor <cursoragent@cursor.com>
K=3 cadence cumulative review for the final 2 batches of
Phase A. Verdict: PASS_WITH_WARNINGS (0 Critical / 0 High;
F-CUM-5 lifts production-drift backlog to 23 entries;
F-CUM-4 long-running soak tagging carries over).
Phase A is now COMPLETE: 25 test tasks delivered across 8
batches; 0 production source mutations; 26/26 ACs covered
in this window; 100% cumulative AC coverage; 29 commit-time
static gates active.
Next autodev action: Step 7 (Run Tests).
Co-authored-by: Cursor <cursoragent@cursor.com>
- AZ-474 tile-split + YOLO parser + auto-zoom + indicator +
malformed (FT-P-51..55, FT-N-10): 13 fast (6 it.fails for
AC-1..6 + 7 controls) + 2 e2e (test.fail for FT-P-51 +
FT-P-53). The split surface is QUARANTINED today (D11) —
no Split-tile button, no parser, no <TileViewer>; all 6
ACs are documented drift, every it.fails paired with a
control PASS pinning current behaviour.
- AZ-480 prod image + nginx routing + RAM (NFT-RES-LIM-02
/03/08/09/10): 4 new static checks promoted into the
per-commit profile (STC-RES02 500M cap, STC-RES03
Dockerfile final-stage nginx:alpine no Node, STC-RES09
exactly 9 /api/* location blocks, STC-RES10 prefix-strip
on every route). 3 e2e (docker-no-Node probe, runtime
prefix-strip, long-running RAM soak — all gated on docker
availability + image build; RAM soak also on
RUN_LONG_RUNNING=1).
Phase A — One-time baseline setup is now COMPLETE. The
todo/ directory is empty after this batch's archival.
Cumulative review for batches 07-08 is the next autodev
action; after that, Step 7 (Run Tests) auto-chains.
Code review: PASS (0 findings). Fast: 26/26 files, 163
passed / 13 skipped. Static: 29/29 PASS (incl. 4 new
STC-RES* gates).
Co-authored-by: Cursor <cursoragent@cursor.com>
Implements 4 blackbox-test tasks for AZ-455 Phase A baseline:
- AZ-458 SSE lifecycle + bearer rotation: 9 fast tests (8 pass, 1
QUARANTINE for annotation-status); 4 e2e scenarios (gated by suite
stack). Uses tests/helpers/sse-mock.ts with globalThis.EventSource
monkey-patch per AC-3 (no stub of src/api/sse.ts). AC-2 bearer
rotation captured as documented drift via it.fails() — FlightsPage
useEffect deps do not include the token today.
- AZ-467 ProtectedRoute spinner + timeout + RBAC: 9 new fast tests
extending the AZ-457 file (6 pass, 3 QUARANTINE), plus 3 e2e
scenarios. FT-P-32 spinner a11y is it.fails() drift; FT-P-33 timeout
and FT-N-03/05 RBAC redirects are it.skip QUARANTINE (no production
behavior today). Positive control: admin_carol reaches /admin.
- AZ-468 Header flight-dropdown a11y: 6 fast tests (5 pass, 1
QUARANTINE). FT-P-30/31 are it.fails() drift (aria-expanded /
role=listbox / aria-activedescendant currently missing); FT-N-09
is it.skip QUARANTINE (no document keydown handler exists).
- AZ-482 Secrets + banned-libs + AC-N1 anti-criterion: 3 new static
checks (STC-SEC13 legacy integrations, STC-SEC14 concurrent-edit,
STC-SEC1B dist/ OWM key) plus refactor of 4 existing checks
(STC-N2/N4/S13/S6) to read from tests/security/banned-deps.json
via scripts/check-banned-deps.mjs per AZ-482 constraint
("deny-list lives in tests/security/banned-deps.json so additions
are visible in code review"). All 22 static checks PASS.
Totals: 57 fast tests pass + 9 skipped; 22/22 static checks pass.
Self-review verdict PASS_WITH_WARNINGS — all five findings are
documented drifts captured by it.fails() / it.skip QUARANTINE +
control tests. See _docs/03_implementation/batch_03_report.md
for the per-task / per-AC matrix and recommended Phase B follow-up
production tasks (Header a11y; ProtectedRoute spinner/timeout/RBAC;
SSE bearer-rotation reconnect; AnnotationsPage SSE).
Co-authored-by: Cursor <cursoragent@cursor.com>
Oleksandr Bezdieniezhnykh