DevRunbook-Public/CURRENT_STATE.md

Current state

Current milestone

Milestone 13 — continuous repository freshness: complete

Status: MILESTONE_13_COMPLETE

Next: execute Milestone 14 accessibility and interaction regression under docs/51-post-audit-product-roadmap.md.

Completed scope

• Added fail-closed Node.js 24/pnpm 10.33 runtime preflight, explicit runtime marker files and CI enforcement.

• Made the PostgreSQL integration command fail when the database is missing, zero tests execute or any required test is skipped, with explicit executed, skipped, failed and duration counts.

• Stabilized exhaustive content validation under measured Windows filesystem load and proved the 21-test content suite in three consecutive runs.

• Corrected Windows migration URL conversion and removed host/database clock coupling from immediate PostgreSQL job availability; the repaired three-test lease suite passed three consecutive real PostgreSQL runs.

• Removed the transitive moderate esbuild advisory through a patched override; the production dependency audit now reports zero advisories.

• Implemented the first Phase 10/11 slices: governed usability defaults, human-readable simple-mode errors, five-item project suggestions, 500-item search, recents/favorites presentation, real authenticated identity and removal of nested composer/start main landmarks.

• Made the ordinary-language task statement part of the two-choice Start flow and deterministically normalized bugfix, feature, usability and inspection requests into existing governed inputs; added the missing documentation journey without changing the server composition contract.

• Added a simple review of every resolved task value with human-readable labels and explicit task-detail versus playbook-default provenance.

• Added workspace-authorized, same-origin simple-flow funnel events backed by append-only audit evidence. Metrics retain only an event, playbook slug and coarse duration bucket; task text and project identity are never submitted.

• Added server-owned, per-user and per-workspace project favorites and last-used history with an additive migration, deterministic ordering, optimistic UI rollback and fail-closed cross-workspace repository matching.

• Linked the real account identity menu to authenticated identity and password/session management pages; active sessions can be inspected and non-current owned sessions revoked through the existing protected API.

• Replaced the PostgreSQL readiness probe with a real query against the target database, preventing Compose migration from starting during PostgreSQL's temporary bootstrap server window.

• Started Phase 12 with persistent same-origin Simple/Expert and Dutch/English presentation preferences, browser-language detection, a matching document language and owner-only Management navigation in Simple mode.

• Reduced Simple primary navigation to Start, My tasks, Projects and More while retaining the established technical navigation unchanged in Expert mode.

• Completed Phase 12 with governed Dutch/English copy for Start and the simple composer, translated task search, localized document language and dates, and persistent draft-safe language switching.

• Added working My tasks, More and owner-only Management destinations so every Simple primary-navigation item resolves to a useful, role-appropriate page.

• Added an application icon and eliminated the final browser-console resource error from authenticated desktop and mobile flows.

• Started Phase 13 by exposing same-origin, workspace-authorized per-project and Refresh-all endpoints over the existing idempotent PostgreSQL snapshot jobs; refreshes remain bounded to 500 imported projects and read-only forge access.

• Added actionable project freshness labels, exact snapshot timestamps and optimistic refresh progress without replacing last-known-good profile data.

• Completed Phase 13 with a PostgreSQL-backed periodic repository planner. It selects only due, enabled, imported Gitea repositories, atomically creates the queue job and collecting snapshot, excludes queued/running duplicates and reuses a stable time-bucket idempotency key across worker restarts.

• Added configurable refresh cadence and stale thresholds. Planner failure is contained independently of job polling; snapshot jobs retain leased retry, backoff and stale-lease recovery.

• Added a bounded preflight over the default-branch commit, forge capabilities, tags, releases, governance and workflow availability. Unchanged repositories stop before tree/file reads and never create a profile revision; meaningful changes continue through bounded full analysis.

• Added task-dependent stale-context guidance to Start with an exact collection time and a direct, actionable Projects refresh path.

• Documented the disabled Gitea webhook threat model and its mandatory HMAC, timestamp, replay, flood, body, event and workspace-isolation gates. No webhook endpoint or forge write scope was added.

• Established the pnpm/Turborepo modular-monolith contract, pinned Node.js 24, PostgreSQL 17, application dependencies, strict TypeScript, formatting, lint, Vitest, Playwright, production builds, CI, and typed configuration.

• Validated all 28 P0 packages, six normative examples, 72 roadmap catalog entries, nine schemas, 28 golden prompts, and 68 release-evidence fields.

• Implemented the production TypeScript composer with byte-identical output for all 28 supplied golden fixtures.

• Implemented the 26-table Drizzle schema, two ordered migrations, immutable generated runs, persistent artifacts, setup locking, job idempotency, leases, fencing, retry, and stale-lease recovery.

• Implemented safe built-in package ingestion and PostgreSQL-backed searchable projections with digest conflict protection.

• Completed structured path/code/message/remediation validation, aggregated multi-package failures, seed-catalog schema validation and exact 72-entry to 28-P0 runtime cross-checking.

• Added the application-owned built-in import contract, advisory-locked PostgreSQL importer, immutable published-version trigger, correct Semantic Version ordering and lifecycle-aware current-version selection.

• Added typed search/filter, full detail/history and exact-version catalog queries plus their list, detail and exact-version HTTP boundaries.

• Made worker startup validate and synchronize all built-ins before polling, including both production and development container content layouts.

• Implemented Better Auth behind the application-owned authentication boundary, first-run owner/workspace creation, local sign-in/logout, session limits, versioned password hashing and upgrade, and single-use operator reset tokens.

• Implemented workspace-scoped viewer/editor/owner authorization without an instance-administrator bypass.

• Implemented the first vertical slice through live production boundaries: first-run setup, 28 imports, API listing, package detail UI, deterministic composition, immutable run storage, artifact storage, and restart recovery.

• Implemented hardened Docker/Compose web, worker, migrate, and PostgreSQL roles. Web and worker run non-root with read-only roots and no arbitrary code execution.

• Implemented explicit liveness/readiness, database-degraded readiness, a persistent safe worker loop, and an operator persistence validator.

• Delivered the authenticated Library Explorer with URL-owned search, facets, sorting, card/dense views, persisted favorites and match reasons.

• Delivered responsive detail/version views, governed lifecycle handling, an exact version/digest composer handoff, light/dark/system themes, mobile navigation and a keyboard command palette.

• Aligned playbook and favorite API error/status/query contracts with OpenAPI, including same-origin failures and UUID request IDs.

• Established the Milestone 3 governed RepositoryProfile boundary with strict JSON/YAML parsing, semantic path/command checks, deterministic export and exact digest parity with the published example.

• Added authorized repository use cases, strong profile ETags, atomic manual creation, workspace-scoped immutable revision persistence, semantic no-op handling and generated-run snapshot-independence coverage.

• Added an additive repository-list index plus database-enforced positive revision and lowercase SHA-256 invariants without adding a mutable current revision pointer.

• Delivered the authenticated repository overview, governed profile detail, manual/import creation and immutable revision editor with explicit viewer, degraded, validation and conflict-recovery states.

• Exposed strict workspace-authorized repository HTTP routes with same-origin mutation checks, strong ETags, bounded JSON/YAML imports and deterministic JSON/YAML exports that re-import successfully.

• Carried immutable repository revision, digest and protected-path context into the composer handoff without executing repository commands.

• Added the governed composition resolver with typed input normalization, three-valued condition evaluation, fail-closed policy outcomes, repository compatibility, protected scope resolution, prompt lint, block provenance and deterministic preview digests while retaining all 28 reference-v1 bytes.

• Added server-authoritative preview and immutable generation boundaries that load published playbook versions and exact repository revisions, compute snapshots/lint/prompt bytes server-side and reject substituted store data.

• Added workspace-authorized composition drafts with strong ETags, monotonic revisions, atomic compare-and-swap updates and secure draft HTTP routes.

• Added persisted-run JSON/digest integrity checks, mandatory idempotency keys and an atomic append-only audit event on first immutable generation.

• Delivered the seven-step responsive guided composer with exact-version and historical-profile pinning, live deterministic preview, block outline, provenance, linked lint findings and explicit degraded/viewer states.

• Linked guided immutable generation back to its authorized persisted draft, while preserving the generic direct-composition API path.

• Proved Milestone 4 in the production Unraid stack; exact evidence is recorded in docs/47-milestone-four-guided-composer.md.

• Added exact prompt copy, deterministic Markdown and Run Pack ZIP exports, review-only AGENTS recommendations, authorized artifact history/download and bounded historical Run Pack verification without extraction.

• Added strict archive, manifest, inventory, digest, TASK-envelope, filename, retention, idempotency and workspace-authorization enforcement with hostile traversal, symlink, duplicate, overlap, CRC and size-limit coverage.

• Proved Milestone 5 in the production Unraid stack, including export/import, artifact persistence after container recreation and five responsive widths; exact evidence is recorded in docs/48-milestone-five-export-run-packs.md.

• Implemented workspace-authorized Gitea connection, capability, discovery, encrypted-token, rotation, deletion and repository-import boundaries with no write-capable forge methods.

• Added DNS/IP/redirect SSRF enforcement, response and file limits, safe error projection, capability-level degradation and redacted logging.

• Added bounded deterministic repository evidence collection, immutable evidence digests, findings, create-initial-only profile generation and a durable ID-only worker job handoff.

• Delivered imported-repository status and last-known-good snapshot continuity in the integration UI, including after remote outage and integration deletion.

• Proved Milestone 6 against an isolated live Gitea 1.27.0 fixture and the production Unraid stack; exact evidence is recorded in docs/49-milestone-six-gitea-repository-intelligence.md.

• Delivered bounded private package import/export, complete persisted draft inventories, strong ETags, atomic revision updates and field-specific schema/semantic diagnostics without extraction or execution.

• Delivered the responsive Prompt Lab with deterministic example reproduction, lint/evidence display, exact-digest editorial review, governed publication, immutable published versions and coherent next-version cloning.

• Persisted evaluation cases/results with exact playbook, fixture, environment and rendered-prompt digests while keeping editorial review separate from objective evidence and transactionally rechecking publication policy.

• Proved Milestone 7 in production through import, invalid-edit recovery, review, publication, versioning, composer reproduction, restart persistence and a five-width browser matrix; exact evidence is recorded in docs/50-milestone-seven-prompt-lab.md.

Changed modules

• Root workspace commands, CI, container definitions, environment contract, and validation scripts.
• apps/web: health, catalog, package detail, setup, status, login, logout, and password-reset boundaries and accessible pages.
• apps/worker: standalone ESM-safe worker, safe job dispatch, and operator password reset.
• packages/application, artifacts, composer, config, content, db, domain, integrations, observability, testing, and ui.
• Deployment and host evidence in docs/42-implemented-deployment.md and docs/43-milestone-zero-host-validation.md.
• Milestone 1 package-ingestion and live API evidence in docs/44-milestone-one-package-ingestion.md.
• Milestone 2 library, detail, API and browser evidence in docs/45-milestone-two-library-explorer.md.
• Milestone 3 repository profile, PostgreSQL, API and browser evidence in docs/46-milestone-three-repository-profiles.md.
• Milestone 4 composer and production evidence in docs/47-milestone-four-guided-composer.md.
• Milestone 5 artifact, archive, PostgreSQL, security and browser evidence in docs/48-milestone-five-export-run-packs.md.
• Milestone 6 Gitea adapter, snapshot worker, persistence, outage and browser evidence in docs/49-milestone-six-gitea-repository-intelligence.md.
• Milestone 7 private package, quality evidence, publication, migration and browser evidence in docs/50-milestone-seven-prompt-lab.md.

Validation evidence

Post-audit Phase 9/10/11 additions through commit 3cf2167:

Command/check	Result	Evidence
Wrong-runtime preflight	PASS	Node 23.7.0 rejected; Node 24.14.0 with pnpm 10.33.0 accepted.
Content regression repetition	PASS	Three consecutive runs, 21/21 each; no timeout or skip.
Missing-database integration gate	PASS	No DATABASE_URL exits non-zero before Vitest.
Disposable PostgreSQL 17 integration	PASS	Fresh isolated Unraid container, migrations applied, executed 33, skipped 0, failed 0; container verified removed.
Job lease regression repetition	PASS	Three consecutive real-PostgreSQL runs, 3/3 each.
Focused simple/project/identity tests	PASS	Four files, 14 tests; web typecheck passed.
Security suite	PASS	Two files, 11/11 tests.
Pack and golden contract	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts.
Production dependency audit	PASS	Zero advisories after the esbuild override.
Direct uncached pnpm verify	PASS	Node 24.14.0/pnpm 10.33.0; all 14 package lint/typecheck scripts, unit suites, pack/golden contracts and production builds passed with exit 0 in 855,316 ms.
Clean-room frozen install and verify	PASS	Detached checkout at 164fa49, no copied dependencies/build output; frozen install succeeded and the direct gate passed with exit 0 in 585,617 ms.
Gate cache/process safety	PASS	Release qualification now invokes package scripts directly through topological pnpm -r; stale Turbo cache reuse and a Windows post-build Turbo hang cannot produce release evidence.
Phase 10 focused model/UI tests	PASS	Three focused files, 11/11 tests; web typecheck passed.
Phase 10 live desktop browser	PASS	Isolated PostgreSQL-backed owner/project flow reached a ready usability task with ordinary task text and visible default provenance; no browser warnings/errors.
Phase 10 live 390px browser	PASS	Start and simple composer had one main, no horizontal overflow and 44px primary/detail actions; task text and provenance remained readable.
Phase 10 privacy-safe funnel contract	PASS	Two focused application tests plus application/database/web lint and typecheck; raw task text is rejected as a metric dimension.
Phase 11 preference unit contracts	PASS	Application preference tests 3/3, schema tests 9/9 and Start ordering tests 8/8; 0, 5, 31 and 500 repository boundaries are covered.
Phase 11 API/spec regression	PASS	Pack validation covers 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 reference prompts remain byte-identical.
Phase 11 server PostgreSQL gate	PASS	Isolated PostgreSQL 17.9 on Unraid applied all nine migrations; the preference integration executed 2/2 with cross-workspace, missing and archived mutations denied.
Phase 11 production build/replay	PASS	Node 24.18.0/pnpm 10.33 server build completed 14/14 packages. A fresh Compose volume then migrated with exit 0 after the PostgreSQL initialization health race was repaired.
Phase 11 desktop browser	PASS	Live server flow created a real repository, persisted favorite state across refresh, created a simple draft, showed exact owner name/email/role and loaded the current session without console warnings/errors.
Phase 11 mobile browser	PASS	At 390×844 Start retained one main landmark, 390px viewport with 375px content width, a 44px favorite action, persistent selection/favorite state and no console warnings/errors.
Phase 12 presentation foundation	PASS	Server Node 24 checks: 7/7 preference/navigation tests, web lint, typecheck and production build; default Simple navigation, Dutch labels, Expert parity and viewer Management denial are covered.
Phase 12 complete server gate	PASS	Unraid Node 24.18.0: formatting, all 14 package lint/typecheck scripts and all unit suites passed (web 227/227); the Compose production build completed 14/14 packages. The aggregate pnpm verify then stopped only because its Node image intentionally has no Python, so both Python gates were executed separately.
Phase 12 pack and golden post-check	PASS	Unraid Python 3.13: 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts verified.
Phase 12 bilingual browser flow	PASS	Live PostgreSQL-backed Unraid flow created a real project and draft, matched Dutch search text, preserved draft 59b580b2-5d9c-4f04-a2a7-cb7f041a7263 across Dutch/English changes, and retained technical Expert navigation.
Phase 12 navigation and mobile browser	PASS	My tasks, More and owner-only Management loaded in Dutch; at 390×844 the four mobile shortcuts remained visible and keyboard-addressable. A fresh post-favicon browser session reported zero errors and warnings.
Phase 13 refresh vertical slice	PASS	Unraid Node 24.18.0: production Compose build 14/14 packages; web lint and typecheck passed; 50 files and 230 tests passed, including same-origin, invalid-ID, missing-idempotency-key and refresh-all boundaries.
Phase 13 API post-check	PASS	Unraid Python 3.13 pack validation retained 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 golden prompts remain byte-identical.
Phase 13 continuous-freshness gate	PASS	Unraid Node 24.13.0: formatting, 14/14 lint and typecheck packages, all unit suites and 14/14 production builds passed. Web retained 50 files and 230 tests; worker passed 18 tests.
Phase 13 PostgreSQL scheduler gate	PASS	Fresh PostgreSQL 17.9 on Unraid applied all migrations; 35/35 integration tests executed with zero skips. A new scheduler instance produced one atomic job/snapshot pair and a same-bucket restart produced zero duplicates.
Phase 13 live browser gate	PASS	Fresh production Compose on Unraid reached authenticated Dutch Start with the rebuilt worker active, correct progressive disclosure and zero browser warnings or errors.

Authoritative host: Unraid 7.2, Docker 27.5.1, Compose 2.40.3, Node.js 24.18.0 container, PostgreSQL 17.9 container. The Windows workstation's Node.js 23.7.0 is unsupported and is not release evidence.

Command/check	Result	Evidence
python3 scripts/validate_pack.py	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas, 28 goldens, 68 release fields.
python3 scripts/reference_compose.py --check	PASS	All 28 reference prompts verified.
Frozen pnpm install under Node 24.18.0	PASS	Clean Git checkout without copied dependencies or build output.
pnpm verify under Node 24.18.0	PASS	Formatting, 13-workspace lint/typecheck, unit tests, pack checks, composer checks, and 13 builds.
PostgreSQL integration gates	PASS	Six files and 15 tests; setup, import, composition, artifact, authorization, job, lease, retry, and reconnect coverage.
pnpm test:security	PASS	11 hostile-input, redaction, secret-at-rest, origin, and dependency-boundary tests.
Production Compose build/start	PASS	Fresh migration; web, worker, and PostgreSQL healthy; non-root hardened services.
First-run/authentication	PASS	Setup 201, closure 409, wrong login 401, correct login/session 200, logout revocation, reset/replay/expiry/session-revocation/rehash proof.
Workspace authorization	PASS	Viewer/editor/owner permissions, disabled user, cross-workspace denial, and no admin bypass.
Worker persistence	PASS	Safe health job succeeded; unsupported job failed safely; no duplicate after restart; stale lease covered by PostgreSQL test.
pnpm validate:m0-persistence	PASS	Golden run and 6,806-byte artifact persisted and restored at SHA-256 8389b948158cc35fa1716e170c9893bd3939dc3aaad9311971b6c267f835ae1b.
Full Compose restart	PASS	Readiness recovered; catalog, identity, run, and artifact remained; validation retries were idempotent.
PostgreSQL outage/recovery	PASS	Readiness 503 database-unavailable, liveness 200; readiness returned to 200 after restart.
Migration replay/failure	PASS	Initialized replay exited zero; unreachable test database exited non-zero visibly without a secret.
Backup/restore drill	PASS	Logical dump and artifact archive restored into empty isolated volumes; run bytes and digest matched.
Production log scan	PASS	Configured secret values, authorization headers, and bearer markers absent.

Milestone 1 authoritative additions at commit b7dcb5d:

Command/check	Result	Evidence
Clean Node 24 pnpm verify	PASS	13-workspace format/lint/typecheck/build, unit tests, 28 packages, 72 catalog entries, 9 schemas and 28 golden prompts.
Content validation tests	PASS	Structured errors, invalid UTF-8, hardlinks, multi-package aggregation, catalog mismatch and duplicate identity.
Catalog/import tests	PASS	SemVer ordering, lifecycle recommendation, exact history/version reads, idempotency and digest conflicts.
Fresh PostgreSQL migration and replay	PASS	Empty PostgreSQL 17 volume migrated; post-test replay exited zero.
pnpm test:integration	PASS	3 files, 7 tests with database and artifact targets, including immutable published-version rejection.
pnpm test:security	PASS	2 files, 11 tests.
Fresh production Compose	PASS	Worker inserted 28/28, web/worker/PostgreSQL healthy, exact-version route live.
Worker restart	PASS	Zero inserts, 28 unchanged versions, healthy after restart.
Live API matrix	PASS	28 list items; combined search/filter exact match; detail/history/exact-version; invalid filter 422.
Production log scan	PASS	No configured secret values, authorization headers or bearer markers.

Milestone 2 authoritative additions at commit 3397226:

Command/check	Result	Evidence
Pack and reference composition checks	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas, valid OpenAPI and 28 golden prompts.
Database and web unit gates	PASS	Database 29 passed/3 optional integration skipped; web 80 passed.
pnpm test:security	PASS	2 files and 11 tests, including route/persistence dependency boundaries.
Production Compose build/start	PASS	Final web/worker/migrate images built; web, worker and PostgreSQL healthy.
Live API matrix	PASS	Auth boundary, 28 items, facets, search/filter, detail/version digest, favorites round-trip and origin rejection.
Production Playwright matrix	PASS	23 passed and 3 intentional skips across desktop and 390×844 narrow projects.
Production log/boundary scan	PASS	No sensitive or stack patterns; web/worker non-root and read-only.

Milestone 3 authoritative additions through commit 76b28de:

Command/check	Result	Evidence
Repository intelligence package gates	PASS	Lint, typecheck, build and 23 focused tests; exact example digest remains 041e20f67e299665e85e5f14800a4bbcfa5e6c42ccdd7b22d29206e2c3f6727e.
Application repository gates	PASS	13 files and 67 tests, including actor matrix, server-owned metadata, validation, ETags and export.
Database repository gates	PASS	41 unit tests plus 7 live PostgreSQL integration tests for atomicity, isolation, concurrency, no-op behavior and frozen snapshots.
PostgreSQL 17.9 invariant drill on Unraid	PASS	Fresh 0000→0001→0002 SQL application; valid insert; invalid revision/digest rejection; immutable update rejection; cascade preservation; index-only workspace-list scan. Ephemeral container and test files removed.
Pack and reference composition gates after schema changes	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts remain valid.
Production Compose and migration replay	PASS	Corrected runtime at 184af5c; migrate completed twice, then web, worker and PostgreSQL were healthy.
Live repository API matrix	PASS	Manual create, revision summary, ETag/no-op/append/conflict/precondition, JSON/YAML export and re-import, traversal and origin rejection.
Production browser matrix	PASS	4 passed, 2 duplicate-mutation skips across desktop and narrow projects; zero console/page errors.
Restart, container and log evidence	PASS	Full-stack restart preserved 9 repositories/13 revisions; web/worker non-root and read-only; zero sensitive/error patterns.

Milestone 4 authoritative additions through commit 80b95bc:

Command/check	Result	Evidence
Integrated Node 24 pnpm verify	PASS	14-workspace formatting, lint, typecheck, tests and build with isolated Python pack validation.
Composer/application/web gates	PASS	37 composer tests, 96 application tests and 132 web tests.
Pack and golden contract	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts.
Live PostgreSQL and migration	PASS	Migration count 4; draft/source/history integrations green; existing repositories preserved.
Production browser matrix	PASS	Exact handoff, autosave, lint gate, preview/provenance, immutable task, historical pinning, responsive matrix and zero console issues.
Draft-linked generation	PASS	Run a87ae11c-54b7-41c6-ba70-3a2d2a9aac0e persisted exact source draft, digest and one creation audit event.
Restart and security boundary	PASS	Run survived restart; services non-root/read-only/cap-drop/no-new-privileges; zero sensitive log patterns.

Milestone 5 authoritative additions through commit 5ba0caf:

Command/check	Result	Evidence
Integrated Node 24 verification	PASS	14-workspace formatting, lint, typecheck, tests and production build; focused mobile regression test also passed after the live defect repair.
Artifact/application/web gates	PASS	23 artifact, 100 application and 147 web tests, including 18 hostile/deterministic archive cases.
Pack and golden contract	PASS	28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 production prompts remain byte-identical.
Live PostgreSQL artifact integration	PASS	6 focused files and 17 tests; three production-created artifact rows retained exact sizes, hashes and valid expiry.
Production export/import flow	PASS	Exact copy plus Markdown, ZIP and AGENTS creation; downloaded ZIP verified against the immutable historical run without extraction.
Restart and download persistence	PASS	Web/worker recreation preserved the run, artifact count and all three authorized download rows.
Responsive/browser gate	PASS	390, 768, 1024, 1440 and 2560 widths without overflow after the status-digest regression repair; zero console entries.
Runtime security boundary	PASS	Non-root, read-only, all capabilities dropped, no-new-privileges; zero token, password or error log matches.

Milestone 6 authoritative additions through commit 0af5254:

Command/check	Result	Evidence
Clean Node 24 quality gate	PASS	Formatting, lint and typecheck across 14 workspaces; all unit tests; 14 production builds; 11 security tests.
Pack and golden contract	PASS	Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts.
Live PostgreSQL integration	PASS	Focused Gitea persistence test, including encrypted projection, workspace isolation, snapshot status and retention.
Live Gitea pipeline	PASS	Gitea 1.27.0 capability probe, one-item discovery, 202 import, worker completion, evidence digest, finding and immutable profile revision.
Outage and deletion continuity	PASS	Imported state remained visible with discovery offline; after integration deletion, one repository, one complete snapshot and one profile revision remained and both local APIs returned 200.
Responsive browser gate	PASS	Healthy and unavailable states, safe token suffix, imported repository and retained snapshot rendered; 390 by 844 had no horizontal overflow.
Runtime security boundary	PASS	Web/worker healthy, non-root, read-only and capability-dropped; secret/header log scan passed; temporary fixture resources removed.

Milestone 7 authoritative additions through commit 07cba0f:

Command/check	Result	Evidence
Clean Node 24 quality gate	PASS	Formatting, lint, typecheck, all unit tests, 14 production builds and the configured security suite.
Pack and golden contract	PASS	Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts.
Fresh PostgreSQL integration	PASS	Migrations 0000 through 0006; private draft, package-file and publication/evaluation persistence suites passed.
Production authoring flow	PASS	ZIP import, exact-path invalid edit, reset, exact-digest review, immutable publication, coherent next-version creation and deterministic export.
Example reproduction	PASS	Stored example rendered twice through the production composer with a byte-identical repeat and persisted render digest.
Responsive browser gate	PASS	390, 768, 1024, 1440 and 2560 widths without overflow; fresh-tab console log was empty after the hydration repair.
Migration and restart boundary	PASS	Corrected 0005 trigger ordering applied; 0006 applied; web recreation retained draft/publication/version evidence; services healthy.

Milestone 8 release-candidate additions through commit 3b255f3:

Command/check	Result	Evidence
Node 24 quality gate	PASS	Formatting, lint and typecheck each completed across 14 workspaces; 25/25 test tasks passed, including 212 web, 160 application, 97 database unit and 16 worker tests; security suite 11/11.
Fresh PostgreSQL integration	PASS	Eight migrations applied to a disposable PostgreSQL 17 database; 15 files and 33 integration tests passed for invitations, sessions, personal data, collections, operations, immutable audit and existing persistence contracts.
Pack and golden contract	PASS	Python 3.12 validated 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 byte-identical production prompt fixtures.
Operations and identity	PASS	Authorized queue/audit console, safe retry, sessions, single-use invitations, password-confirmed personal export/deletion, collections and bounded artifact retention are implemented and tested.
Backup and restore	PASS	Backup pre-m8-b2fb5a5 passed strict checksums; isolated restore applied migration 0007, matched users/runs/artifacts/audit/migration counts and reproduced all artifact SHA-256 values before exact temporary-resource removal.
Clean-room installation	PASS	Independent project devrunbook-release-cleanroom-56cbbab built from the documented Compose path, applied all eight migrations, completed protected setup (201, repeat 409), imported 28/28 built-ins, passed preflight/readiness and remained healthy after restart. Temporary project resources were then removed.
Performance	PASS	Deterministic 10,000-version fixture, 30 iterations: search P95 241.913 ms against 500 ms target; detail P95 24.469 ms against 400 ms target. See evidence/performance-report.json.
Security and supply chain	PASS	Production audit has no high/critical dependency findings; final web and worker images have zero high/critical Trivy findings; Gitleaks found no leaks across 153 commits; 161 production package records have classified licenses.
Production browser	PASS	Collections create/membership, operations safe failures/audit, invitation generic failure, desktop and 390 by 844 layouts were exercised. A narrow Operations overflow was found and repaired; the fresh verification tab had zero warnings/errors.
Host-capacity recovery	PASS	Repeated release builds exhausted unused Docker build cache. PostgreSQL completed crash recovery after space was reclaimed; the worker was explicitly restarted, resynchronized 28 unchanged built-ins and returned healthy. No application volume was removed.

Browser verification

• The 2026-07-29 Unraid consolidation replaced 23 accumulated DevRunbook validation and production containers with one healthy DevRunbook DockerMan container. A restored production backup was first verified on port 23004, including 2 users, 43 repository profiles and both health endpoints. The final port-1231 container retained authenticated access and Gitea project selection after a container restart, with zero browser warnings or errors. DockerMan metadata includes the WebUI URL and the installed DevRunbook SVG icon.

• The 2026-07-28 production re-audit verified authenticated library search and URL state, all seven primary application surfaces, a governed composer draft with live deterministic preview and blocking lint, explicit Gitea degraded state, Ctrl+K command palette behavior and theme switching. Desktop Library and Composer plus all primary routes at 390 by 844 had no horizontal page overflow, and the browser console contained zero warnings or errors. See evidence/functional-visual-audit-2026-07-28.md.

• Live Unraid home page loaded 28 persisted built-ins without Gitea.

• Setup remained closed and displayed Instance ready after restart.

• Invalid local login used a generic failure and cleared the password field.

• The root-cause-bugfix detail displayed the persisted package identity and source digest.

• At 390 by 844 there was no horizontal overflow; semantic form and navigation roles remained present.

• Browser console warnings and errors: zero.

• The canonical Playwright suite covers keyboard focus, reduced-motion, responsive, security-header, setup, login, and recovery behavior.

• Milestone 1 rechecked the live Root-Cause Bug Fix detail and its immutable version/digest at 390 by 844 with no horizontal overflow and zero browser warnings or errors.

• Milestone 2 verified URL-preserved search/filter/view state, favorites, complete detail governance, composer handoff, command palette, themes, keyboard behavior and horizontal-overflow absence in desktop and 390×844 production projects. The final matrix passed 23 tests with 3 documented environment/isolation skips.

• Milestone 3 verified manual repository creation, immutable editing, protected-path and inert-command display, export/re-import, composer context, keyboard/theme/reduced-motion behavior and horizontal-overflow absence. The production matrix passed 4 tests with 2 deliberate duplicate-mutation skips.

• Milestone 4 verified the production guided composer at 390, 768, 1024, 1440 and 2560 widths, exact historical profile pinning, live preview, immutable generation and restart persistence with zero browser console issues.

• Milestone 5 verified exact prompt copy, three persisted export formats, historical Run Pack re-import without extraction, download history after container recreation and the same five-width responsive matrix with zero browser console entries.

• Milestone 6 verified safe Gitea connection metadata, repository discovery and import, worker-completed snapshot/profile creation, explicit offline state, retained local profile use and 390-pixel responsive layout.

• Milestone 7 verified package import, path-linked validation recovery, exact-digest review, immutable publication, next-version creation and stored example reproduction. The Prompt Lab passed 390, 768, 1024, 1440 and 2560 widths without horizontal overflow; a fresh tab had zero console messages.

• Milestone 8 verified personal collection creation and membership, operations queue/audit rendering, safe invalid-invitation feedback and the new navigation entries on the live Unraid release candidate. Collections and Operations were checked at desktop and 390 by 844; the final tab had zero console messages.

Migrations and configuration

• Nine forward migrations are authored. Migration 0003 adds governed draft revision/output state and mandatory generated-run idempotency; migration 0004 hardens Gitea persistence, secret envelopes and snapshot integrity; 0005 adds private package drafts/files, 0006 adds immutable quality, review and publication evidence, 0007 adds personal collections and 0008 adds workspace/user-scoped repository preferences. All nine pass fresh PostgreSQL 17.9 application and production replay on Unraid.
• Production Compose keeps baked built-ins separate from persistent operator content, artifacts, and database volumes.
• Unraid DockerMan can alternatively use the all-in-one image target. Its private PostgreSQL database, artifacts and operator content share the single /config persistence boundary; only HTTP port 3000 is published.
• The installed DockerMan template uses a cached PNG icon through DockerMan's file:// convention and exposes managed-container, shell and WebUI metadata.
• The secure validation environment file is mode 0600; no values are recorded in repository evidence.
• Ordinary backups intentionally exclude session and encryption keys. Operators must preserve those separately.

Risks and limitations

• Release qualification was exercised on linux/amd64; other architectures are not claimed by this release evidence.
• The live validation stack and backup evidence remain in the restricted Unraid validation directory. Temporary restore resources were removed.
• Gitea remains deliberately read-only and optional. No GitHub/GitLab adapters, arbitrary command execution, semantic search or scheduled remote health monitoring are included in the MVP.
• Operational log rotation is configured in the Docker logging layer; audit pruning is intentionally manual until append-only governance and backup policy are reconciled.
• The former transitive esbuild advisory was removed through the governed package override; the latest recorded production dependency audit reports zero advisories.
• The shared validation host approached Docker storage capacity during repeated image builds. Only unused build cache was pruned; operators should monitor Docker storage so PostgreSQL always retains write headroom.

Active delegated work

• No delegated work remains active. The lead thread integrated and validated all Milestone 8 slices in the canonical branch.

Next action

Post-audit Phases 14 through 16 are complete. Review the recorded evidence and create a release tag only after explicit operator approval; no tag was created automatically.

Usability recovery — active 2026-07-30

The operator accepted docs/52-usability-recovery-roadmap.md after a live visual audit showed that technical qualification had not produced a sufficiently readable product. Phase A is active. Its first slice standardizes authenticated navigation around tasks and projects, localizes command labels, introduces unique primary-route metadata, and reduces Task library density. Server and browser evidence will be added before this phase is declared complete.

First-slice evidence: on Unraid Node 24, Prettier, web lint and web typecheck passed; the web unit suite executed 51 files and 233 tests with zero failures; the all-in-one production Docker build completed all 14 package builds. The candidate was deployed at a private validation host, reported ready and healthy, and retained its /config data, LAN port and DockerMan labels. The new authenticated browser regression could not log in because the stored validation credential no longer matches the active account (HTTP 403). No account password was changed. Phase A therefore remains active pending authenticated browser evidence and the remaining primary-page localization work.

The next continuous slice localized the Projects overview and task-history recovery, added a bounded case-insensitive project-name query across UI, API, application and PostgreSQL store, and moved dense project evidence behind a technical-details disclosure on project detail. Unraid validation passed all 14-package lint and typecheck tasks, 51 web test files with 233 tests, pack validation and all 28 golden prompt checks. The production all-in-one image was rebuilt and the single DockerMan container returned healthy and ready with its existing persistence and LAN mapping.

The final usability-recovery slice completed the generated-task and task-history surfaces. Generated tasks now use locale-aware ordinary-language headings and actions, keep immutable status explicit, and move provenance, prompt details and technical evidence behind disclosures. Task history now supports bounded search, readiness filtering, localized status summaries, result counts and distinct empty and no-match recovery paths.

Final Unraid evidence on 2026-07-30: repository format, all 14 lint tasks, all 14 typecheck tasks, all unit suites and all 14 production builds passed. The focused web suite passed 51 files and 233 tests; security passed 11 tests; the production dependency audit found no known vulnerabilities. A fresh PostgreSQL 17.9 database applied all migrations and executed 36 integration tests with zero skips or failures. Pack validation covered 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas, and all 28 golden prompts remained byte-identical.

The release image was built and deployed on the Unraid server. Exactly one DevRunbook container is present, reports healthy and ready on a private validation port, retains /mnt/user/appdata/devrunbook:/config, and exposes the DockerMan managed, WebUI and local-icon labels. A live Chrome check found no horizontal overflow at 390 by 844, 50-pixel login fields, a 52-pixel primary action and zero console warnings or errors. Public home/start routing and the login surface were visually checked. Authenticated production browser replay remains unavailable because the stored validation credential no longer matches the operator account; no password, account or production data was changed to manufacture a green browser result.

Post-audit Phases 14–16 — 2026-07-30

• Completed scope: single-main authenticated landmarks, named compact controls, accessible light/dark contrast, keyboard/touch/reflow/reduced-motion checks, human-readable operations status, storage and backup evidence, hardened Compose limits, HTTPS/security headers and final release qualification.
• Changed modules: authenticated pages and shell controls, operations service/UI, PostgreSQL system-status store, Compose/Next configuration, deployment and operator documentation, Playwright accessibility coverage and migration readiness/preflight constants.
• Server gates: Node 24 format, lint, typecheck, unit and production build passed; fresh PostgreSQL 17.9 migration plus integration gate executed 36, skipped 0, failed 0. Security tests and production dependency audit were included in the final verification command.
• Browser evidence: production Compose on Unraid passed 24/24 Phase 14 tests across desktop and 390-pixel projects for Start, composer, Projects, My tasks, account and Management, with no serious/critical Axe findings. The existing repository creation/edit/context handoff flow also passed after regression repair.
• Deployment evidence: web and worker report read-only root filesystems, CapDrop=[ALL], PID limit 256, 1 GiB memory and 64 MiB /tmp tmpfs. HSTS, frame/CSP protection and suppressed framework disclosure were observed.
• Recovery evidence: restart preserved 1 owner and 28 built-ins and returned readiness to ready; an isolated pg_dump restore matched 1 owner, 28 playbooks and 9 migration rows. Restore database and dump were removed.
• Migration/configuration: no new migration was introduced. Readiness and migration preflight now correctly expect the existing nine migrations.
• Remaining limitation: qualification is linux/amd64; HTTPS termination and off-host backup scheduling remain operator infrastructure responsibilities.
• Next milestone: optional Phase 17 Codex-native exports, only after operator release approval. No release tag has been created.

Usability follow-up audit — 2026-08-01

• Completed scope: localized every shared authenticated shell control, the Dutch expert navigation, account preferences, password/session management, new-project entry and workspace-management denial. Account and security routes now receive the common command set by default instead of opening an empty search dialog.
• Role clarity: owner, editor and viewer labels use ordinary language. Viewers no longer receive the write-only advanced composition destination in expert navigation or search. An empty viewer workspace explains who can add a project and links to the readable Projects overview instead of offering an unauthorized Gitea action. Editor and viewer denial states preserve context and recovery.
• Changed modules: authenticated presentation/layout, shared shell, workspace, account, theme and command controls, account/security pages, management and new-project entry, Start copy/empty state, plus localization and browser regression suites. No schema, migration or runtime configuration changed.
• Server gates: the final Linux/Node 24 candidate passed formatting, all repository lint and typecheck tasks, all unit suites (including 52 web files and 235 web tests), pack validation for 28 P0 packages, 6 examples and 72 catalog entries, all 28 byte-identical golden prompts, all 14 production builds, 11 security tests and the production dependency audit with zero known vulnerabilities. A fresh PostgreSQL 17.9 run applied migrations and executed 36 integration tests with zero skips or failures.
• Browser evidence: an isolated all-in-one image on the Unraid server was set up from a clean volume and exercised as a new owner plus invited editor and viewer. Invalid login, empty workspace, account, sessions, management denial, new-project rights, simple/expert, Dutch/English, keyboard mobile navigation, 390-pixel mobile, 640-pixel 200%-equivalent reflow and desktop presentation were inspected. The final browser had no horizontal overflow and zero console warnings or errors. The focused Chromium/Axe matrix passed 17/17 scenarios on eight critical authenticated routes with no serious accessibility findings.
• Remaining boundary: the active-workspace control intentionally exposes only the deterministic current membership; selecting among multiple memberships is not implemented by the current authorization lookup. Advanced repository-profile and integration authoring retain canonical technical/English contract labels. Public first-run setup, login and invitation acceptance also remain English; the authenticated primary navigation, explanations, rights and recovery are localized. These are explicit future product capabilities, not hidden fallbacks in this release.
• Deployment evidence: commit 5b8d207 was pushed to origin/main and its verified all-in-one image replaced production with automatic rollback protection. Exactly one DevRunbook container remains, is healthy and ready on LAN port 1231, retains /mnt/user/appdata/devrunbook:/config, and exposes the DockerMan managed, shell, WebUI and local-icon labels. Temporary candidate, gate and PostgreSQL resources were removed.
• Next action: create a release tag only after explicit operator approval.

Complete usability closure — 2026-08-12

• Completed scope: the public home, setup, login, invitation and password-reset journeys now follow Dutch or English presentation preferences; compact language controls use an authoritative same-origin cookie endpoint. On narrow screens the actionable form precedes explanatory copy. Sign-out and Gitea connection tests remain inside the application and expose accessible failures instead of raw API responses.
• Workspace and role clarity: every active authorized membership is selectable. The server re-authorizes the preference on every request and falls back safely when it is missing, stale or unauthorized. Owner, editor and viewer flows were exercised with two memberships each; write and management destinations remain permission-aware.
• Expert usability: repository-profile and Gitea authoring now localize primary labels, explanations, policy values and status feedback while preserving exact canonical contract values in requests and stored profiles.
• Changed modules: public presentation and authentication pages, locale and workspace preference endpoints, application workspace queries, authenticated layout and shell, repository-profile and integration presentation, plus focused unit and browser regression coverage. No schema or migration changed.
• Verification: format, all 14 lint and typecheck tasks, unit suites including 53 web files and 242 web tests, all 14 production builds and 11 security tests pass. Pack validation still covers 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 golden prompts are byte-identical. The production dependency audit has zero known vulnerabilities after pinning patched fast-uri and nanoid transitives. A fresh PostgreSQL 17.9 gate executes all 36 integration tests with zero skips or failures.
• Browser evidence: an isolated all-in-one server candidate was exercised as a new owner plus invited editor and viewer across both workspaces. Public NL/EN, invalid invitation/reset recovery, sign-out, workspace switching, management denial and expert authoring were checked at desktop and 390 by 844 without horizontal overflow. The focused Chromium/Axe matrix passed 17/17 scenarios on eight critical routes at desktop, mobile and 200%-equivalent reflow.
• Deployment: the verified all-in-one image is deployed as the sole DevRunbook container, healthy and ready on a private validation port with the persistent /config mount and DockerMan managed, shell, WebUI and local-icon labels. Temporary candidate and gate resources were removed after qualification.
• Remaining infrastructure boundary: qualification remains linux/amd64; HTTPS termination and off-host backup scheduling are operator responsibilities. No release tag was created.

Deep presentation follow-up — 2026-08-12

• Completed scope: closed remaining mixed-language presentation on Collections, complete playbook details and favorite actions, technical repository evidence, the advanced composer, Prompt Lab overview/import and Operations. Dutch and English now share the same interaction and safety boundaries; canonical policy, mode, lifecycle and autonomy values remain unchanged in requests and storage.
• Interaction quality: collection creation and optimistic membership rollback announce localized outcomes; composer conflicts, expired sessions, preview readiness and blocking reasons stay actionable; Operations formats dates and sizes for the selected locale and reuses formatters across rows.
• Changed modules: collection, playbook-detail, repository-detail, composer, Prompt Lab and Operations pages/components plus their focused presentation and contract tests. No schema, migration, API contract or stored content changed.
• Verification: Node 24 formatting, all 14 lint and typecheck tasks, all unit suites including 54 web files and 244 web tests, all 14 production builds, 11 security tests and the production dependency audit pass with zero known vulnerabilities. Pack validation and all 28 golden prompt fixtures remain valid and byte-identical. A fresh PostgreSQL 17.9 database applied all nine migrations and executed 36/36 integration tests with zero skips or failures.
• Live evidence: the exact server-built devrunbook:ux-audit-v9 image replaced v8 with automatic rollback protection. Production is healthy and ready on LAN validation port. A 390 by 844 live Chrome check confirmed Dutch login/recovery copy, no horizontal overflow and zero console warnings or errors. Authenticated presentation changes are covered by the exact Linux build, unit contracts and the previously qualified role/accessibility flows; no production credential was changed to manufacture a signed-in replay.
• Deployment shape: exactly one DevRunbook container remains with the persistent /config mount and DockerMan managed, shell, WebUI and local-icon labels.

Public-repository consolidation — 2026-08-31

• Consolidated the later recovery branch into the publication candidate so the Dutch/English onboarding, setup, login, invitation/reset, workspace selection and plain-language presentation work are no longer stranded on a side branch.
• Replaced the implementation-pack landing page with a user-oriented README and documented the difference between historical build-pack version 1.2 and application version 0.1.
• Removed private validation addresses from the current tree. Historical commits still contain those addresses and three work-email author records; the recommended public-history decision is recorded in docs/PUBLICATION_READINESS.md without rewriting shared history.
• Hardened deployment defaults: development and production web ports bind to host loopback, production requires an explicit PUBLIC_BASE_URL, and the development stack no longer contains a shared first-run bootstrap token.
• Added a 16 KiB streaming limit to the unauthenticated setup request before JSON parsing, including declared-length and streamed-overflow regression tests.
• Replaced the ineffective Gitea placeholder validation with Node 24, pinned pnpm, PostgreSQL-backed unit/integration/security gates. Automatic Unraid deployment now depends on the same exact-revision publication gates.
• Corrected security and configuration documentation that incorrectly described the implemented application as an undeployed archive or claimed enforcement for reserved proxy/CIDR settings.
• Local evidence at this point: both Python contract validators pass, the focused setup-body suite passes 3/3, Compose renders successfully with fixture secrets, git diff --check passes and Gitleaks found no secret across 207 commits. Final Node 24, PostgreSQL, security and audit authority remains the managed Gitea run for the final candidate commit.