feat(housekeeping): model people workflows

.superpowers/sdd/2026-08-26-housekeeping-completion/task-11-report.md

@@ -0,0 +1,133 @@
+# Task 11 — People workflow read models
+
+Status: DONE
+
+## Delivered scope
+
+- Added the exact 24-route People catalog covering the 39 migration-matrix entries across users, multi-account review, online/community, guilds, staff applications/teams, support tickets/help tickets, CFH, moderation overview, bans, IP rules, VPN settings, and word filter workflows.
+- Added canonical, JSON-serializable People DTOs, `/ase/people` link builders, bounded list normalization, and stable sorting with numeric-ID tie breaking.
+- Added injected query factories and narrow server-only production adapters for user/detail, community/guild, staff/applications/teams, support queues/tickets/help/CFH, and moderation/bans/sanctions sources.
+- Reused foundation `HousekeepingResult`, error codes, capability context, authorization, and canonical href contracts. People-local `ListInput` and `Page` were added because no shared foundation equivalents exist in this checkout.
+- Kept the People manifest, global handlers, pages, mutations, providers, widgets, search, and inbox unchanged for Task 12.
+
+## Security and behavior decisions
+
+- User mail and current IP remain independently nullable fields. Each is projected only when the capability context contains the existing `PERMS.USERS_VIEW`; `PERMS.MOD_USERS_VIEW` alone receives the safe base projection with both values set to `null`, and a context with neither permission is forbidden.
+- No new ACL slug or rank threshold was introduced. Staff filtering reuses the existing `getMinStaffRank()` source.
+- The production user selection is explicit and excludes passwords, authentication tickets, secrets, and two-factor material. VPN settings intentionally exclude `vpn_api_key`.
+- Adapters fail closed. Missing detail entities map to `NOT_FOUND`; invalid identifiers to `VALIDATION`; adapter and count failures to `DEPENDENCY_UNAVAILABLE`. No partial-result shape is returned because no People DTO explicitly names failed sources.
+- Pagination clamps page size to 100 and offset to 1,000,000. Production list adapters fetch the full prefix required for in-memory stable sorting/pagination, avoiding double-offset truncation.
+
+## Strict TDD evidence
+
+### Cycle 1 — exact route catalog
+
+RED:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/routes.test.ts
+Test Files 1 failed
+Error: Cannot find module './routes'
+```
+
+GREEN:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/routes.test.ts
+Test Files 1 passed (1)
+Tests 3 passed (3)
+```
+
+### Cycle 2 — canonical models and normalizers
+
+RED:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/models.test.ts
+Test Files 1 failed
+Error: Cannot find module './models'
+```
+
+GREEN:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/models.test.ts
+Test Files 1 passed (1)
+Tests 5 passed (5)
+```
+
+### Cycle 3 — injected-adapter read queries
+
+RED:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/queries/people-queries.test.ts
+Test Files 1 failed
+Error: Cannot find module './community'
+```
+
+GREEN:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/queries/people-queries.test.ts
+Test Files 1 passed (1)
+Tests 10 passed (10)
+```
+
+Production-source contract RED:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/queries/people-adapters-production.test.ts
+Test Files 1 failed (1)
+Tests 2 failed (2)
+Reason: production adapters and buildPeopleUserSelection were not yet exported.
+```
+
+Pagination regression RED after adding the production contract fixture:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/queries/people-adapters-production.test.ts
+Test Files 1 failed (1)
+Tests 1 failed | 2 passed (3)
+Expected ["203.0.113.1", "203.0.113.2"], received ["203.0.113.2"].
+```
+
+GREEN after the minimal prefix-fetch correction:
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/queries/people-adapters-production.test.ts
+Test Files 1 passed (1)
+Tests 3 passed (3)
+```
+
+The query tests cover adversarial page size/offset/search, stable tie sorting, empty/missing entities, adapter and count failures, PII capability combinations, serializable DTOs, explicit source projection, and production pagination.
+
+## Verification
+
+```text
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people/routes.test.ts src/features/housekeeping/domains/people/models.test.ts src/features/housekeeping/domains/people/queries/people-queries.test.ts src/features/housekeeping/domains/people/queries/people-adapters-production.test.ts
+Test Files 4 passed (4)
+Tests 21 passed (21)
+
+pnpm exec vitest run --coverage.enabled=false src/features/housekeeping/domains/people src/features/housekeeping/foundation/foundation-source-contract.test.ts src/features/housekeeping/foundation/authorization.test.ts src/features/housekeeping/foundation/capability-context.test.ts src/features/housekeeping/foundation/contracts/contracts.test.ts
+Test Files 8 passed (8)
+Tests 65 passed (65)
+
+pnpm test:housekeeping
+Test Files 49 passed (49)
+Tests 416 passed (416)
+
+pnpm typecheck
+tsc --noEmit
+Exit 0
+
+pnpm exec biome check --formatter-enabled=false <12 exact Task 11 TypeScript files>
+Checked 12 files. No fixes applied.
+
+git diff --check
+Exit 0
+```
+
+Both `pnpm test:housekeeping` and `pnpm typecheck` emitted the environment warning: the repository requires Node `>=26.8.1 <27`, while this host runs Node `v26.7.0` with pnpm `11.24.0`. Tests and typecheck still exited successfully.
+
+No database operation, deployment, push, or pull-request update was performed.