# Task Dependencies

## Epic AZ-447 — 01-testability-refactoring (Autodev Step 4)

| Task | Name | Epic | Complexity | Depends on |
|------|------|------|-----------|------------|
| AZ-448 | C01 — Externalize OWM API key | AZ-447 | 2 | None |
| AZ-449 | C02 — Externalize OWM base URL | AZ-447 | 2 | AZ-448 (same file) |
| AZ-450 | C03 — Externalize map tile URLs | AZ-447 | 2 | None |
| AZ-451 | C04 — Bundle Leaflet marker icon locally | AZ-447 | 2 | None |
| AZ-452 | C05 — `getApiBase()` accessor | AZ-447 | 3 | None |
| AZ-453 | C06 — `navigateToLoginImpl()` accessor | AZ-447 | 2 | None |
| AZ-454 | C07 — Document `setToken/getToken` | AZ-447 | 1 | None |
| AZ-485 | C08 (Phase B) — Public API barrels + STC-ARCH-01 | AZ-447 | 5 | None |
| AZ-486 | C09 (Phase B) — Endpoint builders (endpoints.ts) + STC-ARCH-02 | AZ-447 | 5 | AZ-485 |

### Notes (AZ-447)

- Epic AZ-447 is the umbrella for the autodev existing-code Step 4 testability run (`01-testability-refactoring`).
- AZ-448 and AZ-449 share `src/features/flights/flightPlanUtils.ts` and should land in one commit to avoid a mid-state where the URL still hardcodes a base while the key is externalized.
- C01–C07 (AZ-448 … AZ-454) totalled 14 complexity points; closed in Phase A (see `_docs/04_refactoring/01-testability-refactoring/FINAL_report.md`).
- C08 (AZ-485) and C09 (AZ-486) are Phase B additions covering architecture baseline findings **F4** and **F7** — the two High/Medium baseline findings the Step 4 batch deferred. They share AZ-447 because they are mechanical testability refactors of the same shape; total 10 additional complexity points across the two tasks.
- AZ-486 depends on AZ-485 — `endpoints` ships through the `src/api` barrel introduced by AZ-485, and a "Blocks" link is set in Jira.
- **F1** (mission-planner duplication, Critical) is deliberately NOT in this epic. Per baseline routing it requires 7+ port-group Phase B feature cycles; it will be decomposed in a separate `/decompose` session and own its own Epic.
- Deferred Step 4 items remain in `_docs/04_refactoring/01-testability-refactoring/deferred_to_refactor.md` for traceability.

---

## Epic AZ-455 — Blackbox Tests (Autodev Step 5, tests-only decomposition)

| Task | Name | Epic | Complexity | Depends on |
|------|------|------|-----------|------------|
| AZ-456 | Test Infrastructure (Vitest + MSW + Playwright + static) | AZ-455 | 5 | None |
| AZ-457 | Auth & token handling (11 scenarios) | AZ-455 | 5 | AZ-456 |
| AZ-458 | SSE lifecycle + bearer rotation (9 scenarios) | AZ-455 | 5 | AZ-456 |
| AZ-459 | Wire-contract enum compliance (4 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-460 | Annotation save URL + payload contract (2 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-461 | Detection endpoints sync/async/long-video (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-462 | Overlay window membership edges (4 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-463 | Flight selection persistence + memory soaks (4 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-464 | Bulk-validate URL + body + UI sync (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-465 | i18n parity + t() coverage + detector + persistence (4 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-466 | Destructive UX + ConfirmDialog + no-alert (8 scenarios) | AZ-455 | 4 | AZ-456 |
| AZ-467 | ProtectedRoute spinner + timeout + RBAC (7 scenarios) | AZ-455 | 4 | AZ-456 |
| AZ-468 | Header flight dropdown a11y + Escape (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-469 | Browser support + responsive variants (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-470 | Panel-width debounced PUT + rehydration (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-471 | CanvasEditor draw/resize/multi-select/zoom/pan (5 scenarios) | AZ-455 | 5 | AZ-456 |
| AZ-472 | DetectionClasses load + hotkeys + click + fallback (4 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-473 | PhotoMode switch + auto-select + yoloId wire (3 scenarios) | AZ-455 | 2 | AZ-456, AZ-472 |
| AZ-474 | Tile-split + YOLO parser + auto-zoom + indicator (6 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-475 | Numeric form hygiene (2 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-476 | Upload 501 MB → 413 → user-visible error (2 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-477 | Settings save 500/network resilience (5 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-478 | Network offline + SSE disconnect + tainted-canvas (3 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-479 | Bundle ≤2 MB + mission-planner excluded + FCP + soak (4 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-480 | Prod image nginx:alpine + 500M + 9 routes + edge RAM (5 scenarios) | AZ-455 | 3 | AZ-456 |
| AZ-481 | CI image tag scheme + OCI labels + revision binding (3 scenarios) | AZ-455 | 2 | AZ-456 |
| AZ-482 | Secrets/banned-libs/AC-N1 anti-criterion (6 scenarios) | AZ-455 | 3 | AZ-456 |

### Notes (AZ-455)

- **Epic AZ-455** is the umbrella for the autodev existing-code Step 5 tests-only decomposition.
- **Scenario count**: 117 distinct scenarios across 26 implementation tasks (T02..T27).
- **Total complexity**: 79 points across 27 tasks (including infrastructure AZ-456).
- **Critical-path dependency**: every test task depends on AZ-456 (Test Infrastructure). AZ-456 MUST be implemented first; tests cannot be implemented in parallel until the harness is in place.
- **Internal cross-deps** (non-blocking for ordering, but worth noting for review):
  - AZ-473 (PhotoMode) reuses the DetectionClasses fixtures landed by AZ-472; flagged as a soft dep to avoid duplicating fixture wiring.
  - AZ-457 (Auth) lands `setToken / getToken / setNavigateToLogin` test helpers that AZ-458 (SSE bearer rotation), AZ-467 (ProtectedRoute), and AZ-468 (Header dropdown — uses authed page) all rely on. Recommended landing order after AZ-456: AZ-457 → everything else in parallel.
  - AZ-466 (Destructive UX) lands the `data-destructive` marker + `<DestructiveButton>` wrapper used by the static enforcement check; per-feature surfaces (admin user delete, class delete, flight delete) need the marker before AZ-466 can pass — handled in-task by AZ-466 itself (lands the wrapper AND the markers across existing destructive surfaces in scope).
  - AZ-479 (bundle/FCP) is the only test task that requires `bun run build` to succeed against the SPA; if a Phase-B feature breaks build, AZ-479 starts failing first.
  - AZ-480 / AZ-481 require the production image build pipeline; they can be implemented in parallel with the rest but their CI lane is conditional on the `dev` branch (out-of-band from feature merge gates).
- **Profile distribution**:
  - `static` only: AZ-481, AZ-482, parts of AZ-459, AZ-465, AZ-466, AZ-474, AZ-479, AZ-480
  - `fast` only (no e2e companion): AZ-462, AZ-468, AZ-470 (e2e companion present but not gating), AZ-471 (mostly fast, e2e smoke), AZ-475, AZ-477
  - `fast + e2e`: most of the rest
  - `e2e (long-running)`: AZ-463 NFT-RES-LIM-06/07, AZ-479 NFT-RES-LIM-05 — tagged `@long-running`, run on `dev`/`stage` merges only
  - `e2e (requires-docker)`: AZ-480 — requires the suite docker-compose stack
  - `e2e (requires-ci)`: AZ-481 NFT-RES-LIM-12/13 — local skip allowed
- **Quarantine scenarios**: FT-P-12 (async video detect, AZ-461) starts QUARANTINEd until AC-25 / Phase B; verification_pending enums in AZ-459 quarantine until Step 4 .NET-service snapshot lifts.

---

## Epic AZ-497 — Self-Hosted Satellite Tiles — SPA Integration (cycle 2)

| Task | Name | Epic | Complexity | Depends on |
|------|------|------|-----------|------------|
| AZ-498 | Self-hosted satellite tiles + drop map-type toggle | AZ-497 | 5 | AZ-450; cross-workspace: satellite-provider cookie-auth (user-filed) |
| AZ-499 | mission-planner OWM env-var hardening + AZ-482 source-scan gap | AZ-497 | 2 | AZ-448, AZ-449, AZ-482 |

### Notes (AZ-497)

- **Epic AZ-497** is the cycle-2 umbrella selected by the user during the autodev new-task session. It covers BOTH the SPA-side tile swap to `satellite-provider` (AZ-498) and the `mission-planner` OWM hardening (AZ-499). The OWM work is not literally about satellite tiles; the user explicitly accepted the wider umbrella to avoid creating a second cycle-2 epic.
- **AZ-498 — cross-workspace dependency**: requires `satellite-provider` to expose a cookie-auth variant of `GET /tiles/{z}/{x}/{y}` before merge. The user files that ticket on the satellite-provider workspace separately. UI work can be authored ahead but cannot ship without the upstream change.
- **AZ-498 — contract**: produces/consumes `_docs/02_document/contracts/satellite-provider/tiles.md` (v1.0.0, draft).
- **AZ-499 — out-of-band**: the compromised key `335799082893fad97fa36118b131f919` must be revoked at the OpenWeatherMap dashboard before AZ-499 closes. AC-7 captures that as a deliverable.
- **AZ-499 — gap fix**: adds a new `owm_key_in_source` banned-deps kind that covers `src/` AND `mission-planner/`, closing the source-scan gap left by AZ-482's `dist/`-only scan.