remco/EpicNext-Cms
1
1 Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Revert "Merge pull request 'Complete Housekeeping migration and /ase cutover' (#52) from codex/housekeeping-complete into main"
CI / check (push) Successful in 27s
Details
CI / release (push) Skipped
Details
CI / deploy (push) Successful in 43s
Details

Browse Source 
This reverts commit 488b6e57c4, reversing
changes made to b506b4499a.
This commit is contained in:
Simo committed 2026-08-30 21:31:34 +02:00
1 parent 488b6e57c4
commit b1ddda66ff
802 files changed
+61370 -76659
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/superpowers/evidence/2026-08-26-housekeeping-pre-cutover.md
-74
View File
@@ -1,74 +0,0 @@
# Housekeeping pre-cutover verification
Verified on 2026-08-30 at 19:50 CEST against branch commit `65a62867`.
## Outcome
The pre-cutover gate passed. The replacement Housekeeping workspace has complete route coverage, passes the automated suite and production build, and rendered successfully across the required desktop, tablet, and mobile viewports. The remaining environmental limitations are recorded below and do not hide a failed dependency or a failed state.
## Environment
- Windows and PowerShell, local non-production environment.
- Repository system Node.js was `26.7.0`, which does not match `.nvmrc`. Because the protected NVM installation could not be updated without administrator rights, every recorded gate used the official portable Node.js `26.8.1` distribution with pnpm `11.24.0`.
- The database was used read-only for the browser verification. No mutation command or database write was executed.
- Redis was not configured. RCON was unavailable during the preview and the workspace represented that dependency as a partial provider warning.
- The temporary `AUTH_SECRET` used by the build and local preview was restored or removed after each command.
## Automated gates
| Gate | Result | Evidence |
| --- | --- | --- |
| Toolchain | Pass | `pnpm toolchain:check` reported Node.js `26.8.1` aligned with `.nvmrc`; pnpm was `11.24.0`. |
| Migration matrix and runtime parity | Pass | `137/137` valid; discovered, mapped, and verified routes were all `137`; `2` legacy removals were accounted for; no gaps. |
| Housekeeping suite | Pass | `109` test files, `841` tests. |
| Full suite | Pass | `266` test files passed and `3` skipped; `1,741` tests passed and `5` skipped; statement coverage `24.55%` (`7,737/31,510`). |
| TypeScript | Pass | `pnpm typecheck` exited successfully. |
| Cumulative Biome | Pass | `450` changed JavaScript, TypeScript, JSON, and JSONC files checked in `12` batches; no fixes remained. |
| Patch hygiene | Pass | `git diff --check` exited successfully. |
| Production build | Pass | Next.js `16.3.3` compiled, typechecked, and generated `239/239` static pages. `AUTH_SECRET` restoration was confirmed. |
The production build emitted two non-blocking environmental warnings: `REDIS_URL` is unset, and Turbopack traced a dynamic translation-file path in `mutation-runtime-external.ts`. Both are explicit in the build output and must be considered for the deployment environment.
## Runtime boundary correction
The first real browser run found a React Server Components boundary failure because provider definitions containing a `load` function were passed into a client component. A failing projection test was added first. The workspace now projects definitions to serializable widget options before crossing the client boundary, while preserving the domain import contract by locating the projection in the shared preferences foundation.
The correction is covered by commits `cb77b2d3` and `1ae59bcc`. Cumulative Biome corrections are isolated in `b9c47aa8` and `65a62867`. The corrected browser matrix below rendered without the error boundary.
## Browser and responsive matrix
The canonical route for each domain was tested at `1440x900`, `1024x768`, `390x844`, and `320x568` with an authorized rank-7 fixture.
| Domain | Canonical route | Heading | Viewports | Runtime result |
| --- | --- | --- | --- | --- |
| Operations | `/ase-next` | Operations workspace | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
| People | `/ase-next/people/users` | Users | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
| Content | `/ase-next/content/editorial/articles` | Editorial content | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
| Economy | `/ase-next/economy/catalog` | Catalog | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
| Hotel | `/ase-next/hotel/rooms` | Rooms | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
| System | `/ase-next/system/access/permissions` | Access control | 4/4 | HTTP 200, Housekeeping root present, no error boundary or horizontal overflow. |
All `24/24` canonical route/viewport combinations passed with zero page errors and zero horizontal overflow. The screenshots are retained outside the repository at `C:\Users\simol\.codex\visualizations\2026\08\24\01a03498-f8e9-70d2-9180-2ef86d73ebb6\housekeeping-task24`.
An initial exploratory pass used the non-canonical domain roots `/ase-next/{domain}` and correctly received 404 responses. Those invalid routes were excluded and replaced by the canonical routes shown above.
## Access, states, and command safety
| Scenario | Result |
| --- | --- |
| Anonymous access | Redirected to `/login`; no Housekeeping root rendered. |
| Authenticated rank-1 access | Failed closed with `Page not found`; no Housekeeping root rendered. |
| Authenticated rank-7 access | All 24 browser combinations rendered successfully. |
| Real partial provider state | RCON outage surfaced as `Unable to load Housekeeping`; sibling workspace content remained usable. |
| Real empty state | Operations recent work rendered `Nothing available`. |
| Loading, error, forbidden, partial, empty, and ready UI states | Covered by the targeted smoke suite. |
| Safe and sensitive command dispatch | Covered in tests, including intent, preflight, success, and failure paths; no real mutation was submitted. |
| Provider timeout isolation | Covered at the two-second abort boundary with sibling preservation. |
| Preferences | Schema, upsert, corruption recovery, and reconciliation covered. |
| Studio | All ten kinds, authorization, outage, audit route, lifecycle ordering, and page states covered. |
The targeted state and safety run passed `11` files and `98` tests.
## Cutover readiness
This evidence verifies the preview implementation only. It does not claim a production deployment or live service health. With the recorded limitations accepted, the branch is ready for the route cutover from `/ase-next` to `/ase` and removal of the legacy `/admin` and `/mod` page trees.
docs/superpowers/evidence/2026-08-30-housekeeping-final.md
-66
View File
@@ -1,66 +0,0 @@
# Housekeeping final cutover verification
Verified on 2026-08-30 CEST on branch `codex/housekeeping-complete` after production commit `222535e1`.
## Outcome
The Housekeeping replacement is complete and the administration UI has been cut over atomically to `/ase`. The former `/admin`, `/mod`, and `/ase-next` UI trees are absent and do not redirect. Internal `/api/admin/*` endpoints remain intentionally available behind their existing permission gates.
This report verifies the branch and local production build. It does not claim that the branch is merged, deployed, or healthy in production.
## Delivered cutover
- `2b8f73a9` moved the canonical workspace to `src/app/ase`, removed the three legacy UI roots, removed the preview gate, and deleted the superseded UI and dependency surface.
- `222535e1` closed the final authorization findings: logo writes require `admin.settings.edit`; generic media deletion cannot traverse into nested asset namespaces; hierarchy bypasses use `isSuperAdmin`; bulk ban/unban require `admin.users.ban`; every bulk target is checked before mutation; configured rank identifiers are no longer capped at 7 and must exist in `permission_ranks`.
- The historical migration matrix remains as an auditable 137-row record while the physical legacy-root scanner reports zero retained UI pages.
## Final automated gates
| Gate | Result | Evidence |
| --- | --- | --- |
| Toolchain | Pass | `pnpm toolchain:check`: Node.js `26.8.1` aligned with `.nvmrc`. |
| Migration and runtime parity | Pass | `137/137` historical rows valid; legacy UI pages present `0`; runtime discovered/mapped/verified `137/137/137`; removals `2`. |
| Housekeeping suite | Pass | `109` test files and `843` tests passed. |
| Security regression set | Pass | The focused People production workflow passed `60/60` tests after the review-driven coverage additions. The earlier four-file final-finding set passed `95/95`. |
| Full suite | Pass | `262` files passed and `3` skipped; `1,649` tests passed and `5` skipped. Coverage: statements `31.53%`, branches `26.16%`, functions `36.55%`, lines `32.90%`. |
| TypeScript | Pass | `pnpm typecheck` exited successfully. |
| Dead-code boundary | Pass | `pnpm knip` reported no included file, dependency, dev-dependency, unlisted dependency, or binary findings. |
| Changed-file quality | Pass | Biome checked all `9` final-review files with no remaining fixes; `git diff --check` passed. |
| Production build | Pass | Next.js `16.3.3` compiled, typechecked, generated `129/129` pages, and exposed `/ase` plus `/ase/[domain]/[[...segments]]` as the only administration UI routes. |
The build used an ephemeral local `AUTH_SECRET` because production validation correctly rejects the development environment without one. It was set only in the build process and was not written to `.env`.
## Route and access probes
The post-cutover local server returned:
| Route | Result |
| --- | --- |
| `/admin` | `404`, no redirect |
| `/admin-next` | `404`, no redirect |
| `/ase-next` | `404`, no redirect |
| `/mod` | `404`, no redirect |
| `/ase` | `307` to `/login` for an anonymous request |
| `/api/health` | `200` |
The production route manifest independently confirms that `/ase` is the only administration UI root while the retained `/api/admin/*` backend endpoints remain present.
## Visual evidence boundary
The authenticated pre-cutover workspace passed all `24/24` domain and viewport combinations at `1440x900`, `1024x768`, `390x844`, and `320x568`; details and screenshot locations are recorded in `2026-08-26-housekeeping-pre-cutover.md`.
The final cutover moved that verified workspace to `/ase` without redesigning the rendered workspace. A new authenticated post-cutover browser session was not created because doing so would have required minting or impersonating a privileged session. Final validation therefore combines the existing authenticated visual matrix with the post-cutover source move, route manifest, automated UI tests, and anonymous access probes. No live mutation was submitted.
## Known non-blocking environment debt
- `REDIS_URL` is unset locally, so the build warns that multi-instance rate limits, settings cache, and JWT invalidation would fall back to process memory. Production must provide Redis.
- Turbopack warns that dynamic translation-file access in `mutation-runtime-external.ts` broadens filesystem tracing. The build still completes, but deployment bundle size should be monitored.
- The repository-wide `pnpm lint` remains affected by the existing Windows CRLF baseline. The final changed-file Biome gate and `git diff --check` pass; no unrelated whole-repository formatting churn was introduced.
## Independent review
A second read-only review of `222535e1` found no Critical or Important findings and assessed the change as ready to merge. Its two Minor recommendations were both implemented: hierarchy denial now runs against ban, unban, currency, and badge bulk operations, and the production workflow now proves a successful super-admin assignment to an existing configured rank above 7.
## Release state
The implementation and local release gates are complete. The branch is suitable for continued review in draft PR #52; merge and deployment remain separate operator decisions.