148 lines
8.4 KiB
JSON
148 lines
8.4 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"checkedOn": "2026-11-05",
|
|
"scope": "Rebuilt frontend and its integration boundaries; not a complete audit of the deployment archive",
|
|
"fixed": [
|
|
{
|
|
"id": "REQUEST_DEADLINE",
|
|
"problem": "Requests could wait indefinitely, including while reading response bodies",
|
|
"resolution": "One request deadline covers preflight, fetch and body; 30s JSON / 120s transfer defaults",
|
|
"evidence": "acceptance.json: the default request deadline aborts an unfinished JSON body and allows retry"
|
|
},
|
|
{
|
|
"id": "LOGOUT_PENDING",
|
|
"problem": "A pending logout response delayed local session revocation",
|
|
"resolution": "Capture old identity, clear local state immediately, revoke with a bounded background request",
|
|
"evidence": "acceptance.json: logout clears local access while its API request remains pending"
|
|
},
|
|
{
|
|
"id": "PAYMENT_DEADLINE",
|
|
"problem": "A stalled status request could consume the payment session deadline",
|
|
"resolution": "One session owns polling, an independent 5 minute deadline and invalidation on close/order/identity changes",
|
|
"evidence": "acceptance.json: stalled status and top-level Paid scenarios"
|
|
},
|
|
{
|
|
"id": "SSH_PAGINATION",
|
|
"problem": "Complete search results and server-paged results were sliced inconsistently",
|
|
"resolution": "Separate applied query from draft input and slice only complete search results",
|
|
"evidence": "acceptance.json: SSH search paginates 25 matches without repeating all rows"
|
|
},
|
|
{
|
|
"id": "SESSION_TREE",
|
|
"problem": "Session changes could unmount a login in progress or keep expired protected components alive",
|
|
"resolution": "Stable public login entry identity; protected component tree belongs to one authenticated session",
|
|
"evidence": "acceptance.json: login, legacy login, payment logout and payment 401 scenarios"
|
|
},
|
|
{
|
|
"id": "LEGACY_URL",
|
|
"problem": "Legacy credentials reappeared when router fullPath restored a query removed only from history",
|
|
"resolution": "Canonicalize both browser history and router location before mounting the legacy entry",
|
|
"evidence": "acceptance.json: a rejected legacy credential stays out of the error URL and can be retried"
|
|
},
|
|
{
|
|
"id": "CROSS_TAB",
|
|
"problem": "Other tabs retained a stale visible authenticated session after logout",
|
|
"resolution": "Reconcile browser storage events into the same reactive identity used by requests and UI",
|
|
"evidence": "acceptance.json: logout in another tab revokes both visible sessions"
|
|
},
|
|
{
|
|
"id": "VENDOR_LICENSE",
|
|
"problem": "The initially restored component-library version displayed an invalid commercial-license warning",
|
|
"resolution": "Use MIT PrimeVue 4 and MIT theme package; do not bypass license checks",
|
|
"evidence": "All browser scenarios reject visible Invalid PrimeUI License warnings"
|
|
},
|
|
{
|
|
"id": "LOCAL_ASSETS_RUNTIME",
|
|
"problem": "Default icon lookup used the external Iconify provider; mismatched framework versions broke server startup",
|
|
"resolution": "Serve bundled Lucide icons locally and align Nuxt/Vue/Router versions",
|
|
"evidence": "Production build and all browser scenarios run without non-local requests"
|
|
},
|
|
{
|
|
"id": "STATIC_GATE_TEMPLATES",
|
|
"problem": "Path checks missed template literals",
|
|
"resolution": "Inspect both literal strings and template elements in the lint-stage AST gate",
|
|
"evidence": "Negative gate smoke rejected string and template machine paths; final check passes"
|
|
}
|
|
],
|
|
"boundedDebt": [
|
|
{
|
|
"id": "AUTH_THEME_CYCLE_LABEL",
|
|
"state": "retained-ux-debt",
|
|
"what": "Blank auth layout labels the light-state button as switch to dark, while the existing theme cycle is auto -> light -> dark -> auto; with an initially light system, the first click stays light",
|
|
"whyDeferred": "Confirmed on both baseline and rewritten layout; this batch preserves existing theme behavior rather than changing the shared three-mode contract",
|
|
"blocks": "Claiming the theme button label accurately describes every next mode",
|
|
"nextStep": "Align the label with the three-mode theme cycle when the shared theme controls are revised"
|
|
},
|
|
{
|
|
"id": "REAL_BACKEND_ACCEPTANCE",
|
|
"state": "unverified",
|
|
"what": "Real ordering, invoices, verification, CAPTCHA/OAuth, financial changes, payment and VNC",
|
|
"whyDeferred": "No production access or real financial operations authorized for this rebuild",
|
|
"blocks": "Production release approval",
|
|
"nextStep": "Run staging acceptance against the real backend and supplier adapters"
|
|
},
|
|
{
|
|
"id": "REMOTE_GATEWAY_QUOTA",
|
|
"state": "known-out-of-scope",
|
|
"what": "Existing services/remote-console/gateway.mjs checks session quota before an await and registers later; two concurrent requests can both create a session at a limit of one",
|
|
"whyDeferred": "Independent server service, not frontend source rebuilding",
|
|
"blocks": "Claiming the remote-console stack has been fixed or production-validated",
|
|
"nextStep": "Separately authorize an atomic quota reservation fix and concurrent HTTP regression test"
|
|
},
|
|
{
|
|
"id": "DEPENDENCY_AUDIT",
|
|
"state": "open",
|
|
"what": "12 propagated npm audit findings: 6 low / 6 moderate",
|
|
"whyDeferred": "Suggested automatic fix force-downgrades Nuxt; reachability and compatibility need review",
|
|
"blocks": "Zero-vulnerability or unrestricted production-readiness claims",
|
|
"nextStep": "Review dependency-audit.json and patched upstream versions before release"
|
|
},
|
|
{
|
|
"id": "AUTH_PROTOCOL",
|
|
"state": "retained-contract",
|
|
"what": "Persistent browser JWT and discontinued CryptoJS AES login protocol remain",
|
|
"whyDeferred": "Changing the wire protocol requires coordinated backend changes",
|
|
"blocks": "Claiming an authentication-protocol security redesign",
|
|
"nextStep": "Plan session storage and login protocol migration with backend ownership"
|
|
},
|
|
{
|
|
"id": "RECOVERED_READABILITY",
|
|
"state": "open",
|
|
"what": "Most business SFCs retain render functions and short local variable names",
|
|
"whyDeferred": "Original source, comments and templates were not present in supplied archives",
|
|
"blocks": "Claiming verbatim original source recovery or a full manual rewrite of every page",
|
|
"nextStep": "Login, legacy entry, SSH keys and the blank auth layout are now handwritten setup/templates; continue incrementally with the remaining business pages"
|
|
},
|
|
{
|
|
"id": "AUDIT_DEPTH",
|
|
"state": "partial",
|
|
"what": "All delivered files are inventoried and all Vue/JS app modules are mechanically checked; only recorded security/lifecycle/payment/pagination boundaries received in-depth human review",
|
|
"whyDeferred": "Rebuilt business surface is large; static coverage is not manual or end-to-end coverage",
|
|
"blocks": "A 100% whole-project line-review or all-feature acceptance claim",
|
|
"nextStep": "Use audit-coverage.json to prioritize unreviewed pages and execute each remaining business entry in staging"
|
|
},
|
|
{
|
|
"id": "REVERSE_PROXY",
|
|
"state": "deployment-required",
|
|
"what": "Same-origin /captcha/ and /remote-console/sessions including WebSockets need separate reverse proxies",
|
|
"whyDeferred": "Local code cannot configure the deployment's proxy or supplier gateway",
|
|
"blocks": "Image CAPTCHA and remote-console integration without proxy configuration",
|
|
"nextStep": "Configure and verify the documented routes in a test deployment"
|
|
},
|
|
{
|
|
"id": "TRUSTED_IMPORTER",
|
|
"state": "documented-boundary",
|
|
"what": "One-time reconstruction script executes trusted build metadata and assumes its source paths are trusted",
|
|
"whyDeferred": "Retained as reconstruction provenance, not a generic or runtime importer; refuses an existing app/pages",
|
|
"blocks": "Using third-party/untrusted metadata as input",
|
|
"nextStep": "Do not run for normal development or builds; use only trusted owned release inputs"
|
|
}
|
|
],
|
|
"latestBatchReview": {
|
|
"scope": "Only the four handwritten SFCs, their changed tests and documented integration seams",
|
|
"confirmedRegressions": 0,
|
|
"acceptance": "21/21 passed after serial integration; browserErrors=0; networkViolations=0",
|
|
"remainingDebt": "All boundedDebt entries remain; no real provider acceptance claimed"
|
|
}
|
|
}
|