{ "schemaVersion": 1, "checkedOn": "2026-11-05", "scope": "Rebuilt frontend and its integration boundaries; not a complete audit of the deployment archive", "fixed": [ { "id": "REQUEST_DEADLINE", "problem": "Requests could wait indefinitely, including while reading response bodies", "resolution": "One request deadline covers preflight, fetch and body; 30s JSON / 120s transfer defaults", "evidence": "acceptance.json: the default request deadline aborts an unfinished JSON body and allows retry" }, { "id": "LOGOUT_PENDING", "problem": "A pending logout response delayed local session revocation", "resolution": "Capture old identity, clear local state immediately, revoke with a bounded background request", "evidence": "acceptance.json: logout clears local access while its API request remains pending" }, { "id": "PAYMENT_DEADLINE", "problem": "A stalled status request could consume the payment session deadline", "resolution": "One session owns polling, an independent 5 minute deadline and invalidation on close/order/identity changes", "evidence": "acceptance.json: stalled status and top-level Paid scenarios" }, { "id": "SSH_PAGINATION", "problem": "Complete search results and server-paged results were sliced inconsistently", "resolution": "Separate applied query from draft input and slice only complete search results", "evidence": "acceptance.json: SSH search paginates 25 matches without repeating all rows" }, { "id": "SESSION_TREE", "problem": "Session changes could unmount a login in progress or keep expired protected components alive", "resolution": "Stable public login entry identity; protected component tree belongs to one authenticated session", "evidence": "acceptance.json: login, legacy login, payment logout and payment 401 scenarios" }, { "id": "LEGACY_URL", "problem": "Legacy credentials reappeared when router fullPath restored a query removed only from history", "resolution": "Canonicalize both browser history and router location before mounting the legacy entry", "evidence": "acceptance.json: a rejected legacy credential stays out of the error URL and can be retried" }, { "id": "CROSS_TAB", "problem": "Other tabs retained a stale visible authenticated session after logout", "resolution": "Reconcile browser storage events into the same reactive identity used by requests and UI", "evidence": "acceptance.json: logout in another tab revokes both visible sessions" }, { "id": "VENDOR_LICENSE", "problem": "The initially restored component-library version displayed an invalid commercial-license warning", "resolution": "Use MIT PrimeVue 4 and MIT theme package; do not bypass license checks", "evidence": "All browser scenarios reject visible Invalid PrimeUI License warnings" }, { "id": "LOCAL_ASSETS_RUNTIME", "problem": "Default icon lookup used the external Iconify provider; mismatched framework versions broke server startup", "resolution": "Serve bundled Lucide icons locally and align Nuxt/Vue/Router versions", "evidence": "Production build and all browser scenarios run without non-local requests" }, { "id": "STATIC_GATE_TEMPLATES", "problem": "Path checks missed template literals", "resolution": "Inspect both literal strings and template elements in the lint-stage AST gate", "evidence": "Negative gate smoke rejected string and template machine paths; final check passes" } ], "boundedDebt": [ { "id": "AUTH_THEME_CYCLE_LABEL", "state": "retained-ux-debt", "what": "Blank auth layout labels the light-state button as switch to dark, while the existing theme cycle is auto -> light -> dark -> auto; with an initially light system, the first click stays light", "whyDeferred": "Confirmed on both baseline and rewritten layout; this batch preserves existing theme behavior rather than changing the shared three-mode contract", "blocks": "Claiming the theme button label accurately describes every next mode", "nextStep": "Align the label with the three-mode theme cycle when the shared theme controls are revised" }, { "id": "REAL_BACKEND_ACCEPTANCE", "state": "unverified", "what": "Real ordering, invoices, verification, CAPTCHA/OAuth, financial changes, payment and VNC", "whyDeferred": "No production access or real financial operations authorized for this rebuild", "blocks": "Production release approval", "nextStep": "Run staging acceptance against the real backend and supplier adapters" }, { "id": "REMOTE_GATEWAY_QUOTA", "state": "known-out-of-scope", "what": "Existing services/remote-console/gateway.mjs checks session quota before an await and registers later; two concurrent requests can both create a session at a limit of one", "whyDeferred": "Independent server service, not frontend source rebuilding", "blocks": "Claiming the remote-console stack has been fixed or production-validated", "nextStep": "Separately authorize an atomic quota reservation fix and concurrent HTTP regression test" }, { "id": "DEPENDENCY_AUDIT", "state": "open", "what": "12 propagated npm audit findings: 6 low / 6 moderate", "whyDeferred": "Suggested automatic fix force-downgrades Nuxt; reachability and compatibility need review", "blocks": "Zero-vulnerability or unrestricted production-readiness claims", "nextStep": "Review dependency-audit.json and patched upstream versions before release" }, { "id": "AUTH_PROTOCOL", "state": "retained-contract", "what": "Persistent browser JWT and discontinued CryptoJS AES login protocol remain", "whyDeferred": "Changing the wire protocol requires coordinated backend changes", "blocks": "Claiming an authentication-protocol security redesign", "nextStep": "Plan session storage and login protocol migration with backend ownership" }, { "id": "RECOVERED_READABILITY", "state": "open", "what": "Most business SFCs retain render functions and short local variable names", "whyDeferred": "Original source, comments and templates were not present in supplied archives", "blocks": "Claiming verbatim original source recovery or a full manual rewrite of every page", "nextStep": "Login, legacy entry, SSH keys and the blank auth layout are now handwritten setup/templates; continue incrementally with the remaining business pages" }, { "id": "AUDIT_DEPTH", "state": "partial", "what": "All delivered files are inventoried and all Vue/JS app modules are mechanically checked; only recorded security/lifecycle/payment/pagination boundaries received in-depth human review", "whyDeferred": "Rebuilt business surface is large; static coverage is not manual or end-to-end coverage", "blocks": "A 100% whole-project line-review or all-feature acceptance claim", "nextStep": "Use audit-coverage.json to prioritize unreviewed pages and execute each remaining business entry in staging" }, { "id": "REVERSE_PROXY", "state": "deployment-required", "what": "Same-origin /captcha/ and /remote-console/sessions including WebSockets need separate reverse proxies", "whyDeferred": "Local code cannot configure the deployment's proxy or supplier gateway", "blocks": "Image CAPTCHA and remote-console integration without proxy configuration", "nextStep": "Configure and verify the documented routes in a test deployment" }, { "id": "TRUSTED_IMPORTER", "state": "documented-boundary", "what": "One-time reconstruction script executes trusted build metadata and assumes its source paths are trusted", "whyDeferred": "Retained as reconstruction provenance, not a generic or runtime importer; refuses an existing app/pages", "blocks": "Using third-party/untrusted metadata as input", "nextStep": "Do not run for normal development or builds; use only trusted owned release inputs" } ], "latestBatchReview": { "scope": "Only the four handwritten SFCs, their changed tests and documented integration seams", "confirmedRegressions": 0, "acceptance": "21/21 passed after serial integration; browserErrors=0; networkViolations=0", "remainingDebt": "All boundedDebt entries remain; no real provider acceptance claimed" } }