liderra/portal
1
0
Fork 0
Code Issues Pull Requests Actions 82 Packages Projects Releases Wiki Activity
483 Commits 104 Branches 2 Tags
fb235e9d8db10d169e381dfdb67f686ea9d3cc27
Commit Graph

250 Commits

Author SHA1 Message Date
Дмитрий fb235e9d8d docs(plan): ProjectDetailsDrawer — 10 atomic tasks (TDD-strict) 
Implementation plan для side-panel редактирования single-selected проекта
на /projects (spec: 9d88955 docs/superpowers/specs/2026-05-14-project-details-drawer-design.md).

10 tasks:
 1. Scaffold + null-project no-open test
 2. Render name/limit/days fields
 3. Close emits (X / Cancel / ESC × 2 negative case)
 4. Form reseed on project.id change
 5. Save — PATCH /api/projects/{id} + 422 errors
 6. Pause/Resume + label switch
 7. Delete with confirm
 8. ProjectsView wire (condition >0 → >=2, drawer mount, computed, .has-drawer CSS)
 9. ProjectsView integration tests (5 cases: 0/1/2 selected + close + missing id)
10. Full regression + visual smoke (9 manual checks)

Каждая task: failing test → verify FAIL → impl → verify PASS → commit (TDD-strict).
9 кодовых commits + Task 10 verification only.

Coverage: 16 spec cases (11 unit + 5 integration) реализуются полностью.
Out of plan: confirm dialog при dirty Cancel / optimistic update / mobile / region
autocomplete (region_mask payload-only в Save, UI порт в отдельный sweep).

cspell-words.txt +1 (pdd) — namespacing prefix data-testid'ов компонента.

NB env quirk: Write/Edit tools silently fail on cyrillic repo path —
workaround через ASCII-Temp + PowerShell Copy-Item задокументирован в шапке плана.
 2026-05-14 13:38:04 +03:00
Дмитрий 9d889558d3 docs(spec): ProjectDetailsDrawer push-mode design + mockup 
Design spec + интерактивный HTML mockup для side-panel редактирования
проекта при выборе одного проекта на /projects.

Поведение:
- selectedIds.size === 1 → drawer справа (480px, push-mode, grid сдвигается)
- selectedIds.size >= 2 → BulkActionsBar внизу (условие в ProjectsView.vue:78
  меняется > 0 → >= 2)
- 0 selected → ни drawer, ни bulk-bar

Footer drawer:
- Слева (destructive): Приостановить (toggle-active) + Удалить (soft-archive)
- Справа (form actions): Отмена (close+clearSelection) + Сохранить
  (PATCH /api/projects/{id})

Backend без изменений — используются существующие endpoints PATCH/DELETE/
toggle-active. Pinia store useProjectsStore уже имеет update/toggleActive/
archive методы.

Прецеденты: DealDetailDrawer.vue (overlay-вариант); push-mode здесь — custom
aside + CSS transform/padding-right, без Vuetify teleport.

Mockup: 3 состояния через JS-toggle (0/1/2+ selected), Forest palette
(Teal #0F6E56, ivory #F6F3EC, noir #012019). Phone masked под 152-FZ ПДн.

cspell-words.txt +1 (юнит) — для упоминания юнит-тестов в spec §6.

Open questions: 0 (все 5 UX-решений утверждены заказчиком 2026-05-14).
 2026-05-14 13:33:27 +03:00
Дмитрий 3cd4ac7c59 feat(graph): 3-color conflicts render + sort 🔴→⚫→🟢 + footer cat-legend 
.conflict-item теперь использует динамический bg из CONFLICT_TYPES[type].bg, эмодзи-префикс + цветной name из CONFLICT_TYPES[type].color. Сортировка через CONFLICT_TYPES[type].rank (RED=1, BLACK=2, GREEN=3) — 🔴 не закрыт правилом → ⚫ возник на практике → 🟢 закрыт правилом. Footer cat-legend заменил 1 «— конфликт» бэйдж на 3 цветных. Iter2 spec §4.3 — last code task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 13:16:56 +03:00
Дмитрий 8b0da60114 feat(graph): edge legend render + click handler for 7-field edge profile 
#legend-panel разделён на 2 containers: #legend-node-content (existing) + #legend-edge-content (new, hidden default). На click по ребру открывается edge layout с 7 полями (источник/получатель/тип связи/когда/что передаёт/обязательность/регламент). showLegend переименована в showNodeLegend; новая showEdgeLegend. Click handler dispatches node vs edge. Iter2 spec §5.4, §5.5.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 13:14:20 +03:00
Дмитрий 32396d97de feat(graph): EDGE_DETAILS data structure (5-field profile for all edges) 
Новый объект EDGE_DETAILS — для каждого ребра 5 полей (type/when/transfers/mandatory/rule). Источник и получатель derived from from/to при рендере в T8. Покрытие 100% — все рёбра имеют запись. Тип связи: enum из 9 (содержит/подчиняет/координирует/читает/запускает/документирует/триггерит/альтернатива/конфликт). Iter2 spec §5.1, §5.2, §5.3.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 13:11:12 +03:00
Дмитрий cec1a0c979 fix(graph): T6 — remove orphan hookify_plugin.conflicts[1] (economy-mode item) 
T6 spec review нашёл orphan item: hookify_plugin conflicts array имел 2 items (PreToolUse:CLAUDE.md-warn + economy-mode хук), но в spec §4.2 классифицирован только первый (8 рёбер, hookify↔hk_economy не среди них). Item 2 без canvas edge counterpart. Remove restores invariant: 16 NODE_DETAILS conflicts items = 8 edges × 2 sides.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 13:04:01 +03:00
Дмитрий 93ca58896f feat(graph): 3-color conflicts data (CONFLICT_TYPES + 2 new ⚫ edges + reclassify 6) 
CONFLICT_TYPES enum (RED/BLACK/GREEN с color/bg/emoji/label/rank), CONFLICT() helper расширен опциональным `type` (default RED). 6 существующих рёбер реклассифицированы: 2 🔴 (sk_rls↔ag_rls, hookify↔hk_pre_claude), 4 🟢 (psr_v1↔claude_md, upm↔fd, 21st↔fd, economy↔superpowers). 2 новых ⚫ ребра: mcp_pw↔sk_parallel (browser-in-use, квирк #2), ag_pest↔mcp_redis (Redis race в Pest --parallel, квирк 72). NODE_DETAILS conflicts items получили field `type` для всех 12 existing + 4 new items. Iter2 spec §4.1, §4.2, §4.4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:59:25 +03:00
Дмитрий f6cd79ccb9 chore(graph): rewrite group D (lefthook + memory, 25 nodes) — plain language 
Переписаны nd() блоки для 10 lefthook jobs (lh_gitleaks/lh_mdlint/lh_cspell/lh_stylelint/lh_pint/lh_larastan/lh_squawk/lh_eslint/lh_gitleaks2/lh_lychee) и 15 memory-файлов. Уточнено что «pre-commit stage» = «перед каждым коммитом», «stage_fixed:true» = «авто-сохранить исправленное». Iter2 spec §3 group D. Last text-rewrite task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:53:35 +03:00
Дмитрий db7f798a64 chore(graph): rewrite group C (agents + MCP, 18 nodes) — plain language 
Переписаны nd() блоки для 11 агентов (ag_pest/ag_rls/ag_explore/ag_general/ag_plan/ag_guide/ag_statusline/ag_hookify/ag_pcreator/ag_pvalid/ag_skreview) и 7 MCP (mcp_pw/mcp_gh/mcp_boost/mcp_semgrep/mcp_sentry/mcp_redis/mcp_21st). Иностранные аббревиатуры расшифрованы (SAST/CVE/SQLi/XSS/ПДн). Iter2 spec §3 group C.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:47:10 +03:00
Дмитрий 718a6e6ff3 chore(graph): rewrite group B (skills + hooks, 21 nodes) — plain language 
Переписаны nd() блоки для 14 Superpowers-скилов (sk_brainstorm/sk_tdd/sk_debug/sk_wplans/sk_eplans/sk_verify/sk_parallel/sk_worktree/sk_pr/sk_subagent/sk_wskills/sk_spreview/sk_coderev/sk_elements), 2 проектных (sk_rls/sk_qitem), 5 хуков (hk_pre_claude/hk_post_md/hk_post_schema/hk_session/hk_economy). Жаргон-блэклист убран, параграф-ссылки сохранены. Iter2 spec §3 group B.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:42:32 +03:00
Дмитрий 797a17978d fix(graph): T2 polish — psr_v1.limits terminology + superpowers.when full triggers 
T2 code-quality review: (1) psr_v1.limits — нормализован framing 3 rules (R14.5/R6.0/R6.1) под единый «обязательное правило» pattern. (2) superpowers.when — восстановлены 11 trigger keywords (brainstorm/TDD/debug/verify/writing-plans/parallel-work/work-tree/finishing-PR/subagent/writing-skills + творческие) — Дмитрий должен видеть конкретные skill-имена.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:36:51 +03:00
Дмитрий 2db5bd8709 chore(graph): rewrite group A (rules + plugins, 9 nodes) — plain language 
Переписаны nd() блоки для pravila/claude_md/psr_v1/tooling/superpowers/fd_plugin/upm/claude_md_mgmt/hookify_plugin. Жаргон-блэклист (hard rule, matcher, pipeline, override, peerDep и др. — 11 терминов) убран; параграф-ссылки сохранены как примечания в скобках. Iter2 spec §3 (Style Guide + group A).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:29:21 +03:00
Дмитрий bcdcca01a5 fix(graph): T1 hardening — localStorage try/catch + rAF throttle on redraw 
После T1 code-quality review: 2 Important issues из spec §9 mitigation list. (1) try/catch обернул read/write localStorage — в Edge InPrivate / quota-exceeded не падает, fallback на default 300. (2) network.redraw() rAF-throttled через redrawScheduled flag — устраняет potential jank при fast drag на медленном hardware (mousemove может fire'ить >60Hz).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:22:52 +03:00
Дмитрий 97da018724 feat(graph): resize handle 300-900px + localStorage 
Drag-handle 6px на левой границе #legend-panel (cursor:col-resize, hover-bg #0d4a5a), JS-обработчики mousedown/mousemove/mouseup, clamp [300, 900]px, сохранение ширины в localStorage ключ liderra-map-legend-width, restoration on DOMContentLoaded. После каждого resize вызывается network.redraw() для пересчёта vis.js canvas. Iter2 spec §2.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:17:08 +03:00
Дмитрий abaeebbde6 docs(plan): automation-graph iter2 — 10 atomic tasks (7 parallel-safe + 3 sequential) 
Tasks 1-7 (parallel-safe через dispatching-parallel-agents): T1 resize handle CSS+JS+localStorage, T2-T5 text rewrite groups A/B/C/D (9+21+18+25=73 nodes по Style Guide), T6 CONFLICT_TYPES enum + 2 new ⚫ edges + reclassify 6, T7 EDGE_DETAILS data (74 entries). Tasks 8-10 (sequential): T8 edge legend render + click handler (depends T7), T9 3-color render + sort + footer (depends T6), T10 visual smoke + push.

Test strategy для single-file HTML без unit-tests: 3-уровневая verification (Level 1 — Node.js syntax check per Edit, Level 2 — lefthook pre-commit gauntlet per commit, Level 3 — manual visual smoke в Edge browser). Pre-push: gitleaks full-history + lychee. Self-review pass: spec coverage 100%, no placeholders, no type drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:12:33 +03:00
Дмитрий f936944237 docs(spec): automation-graph iter2 — resize + simple-language + 3-color conflicts + edge legend 
4 improvements after iter1 ride-out: drag-handle resize 300-900px + localStorage; rewrite 73 nodes to plain language with Style Guide; reclassify 8 conflicts as 🔴 not-closed / ⚫ practice-observed / 🟢 closed-by-rule; new 7-field edge legend (source/target/relation-type/trigger/transfers/mandatory/regulation).

Parallel execution strategy: Phase 2 dispatches 6 subagents (P1 resize, P2-P5 text rewrite by category, P6 conflict types + EDGE_DETAILS) returning raw JS blocks; Phase 3 main agent applies 12 atomic Edits in sequence → 11 atomic commits total.

Through superpowers:brainstorming 4-clarifying-question cycle (text scope / conflict classification / resize UX / edge legend fields), all options chosen by Дмитрий explicitly. Self-review pass; no placeholders, no contradictions, 0 open questions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:29:40 +03:00
Дмитрий b73ddaaedd docs(a11y): authenticated rescan baseline + findings (21/21 passing) 
Final state docs after a11y rescan session:

- docs/audit-baseline-pa11y.md: «Authenticated rescan 2026-05-14» section
  added (14 new URLs, all 21 passing). Old «out of scope для первой
  baseline» section marked SUPERSEDED. Per-pattern fix table with file
  references + ignored selector rationale. axe-core cross-validation
  results documented (only DevIndexBadge dev-only remains).

- docs/superpowers/audits/2026-05-14-a11y-rescan-findings.md (new):
  Full audit findings doc — TL;DR, scope expansion table, per-pattern
  root cause + fix sections (A-H), axe-core cross-validation, метрики
  до/после, verdict 🟢 GREEN.

Regression sweep:
- Pa11y: 21/21 URLs passed
- Vitest: 91 files / 736 passed / 3 skipped / 0 failed
- Pest --parallel: 742/739/3sk/0
- Vite build: ~2s
- gitleaks: 0 leaks / 457 commits / 12.72 MB
- lychee: 345 OK / 0 errors / 457 total
- markdownlint: 0 errors (after auto-fix)
- cspell: 0 issues

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:08:08 +03:00
Дмитрий a650484b11 docs(plan): A11y rescan — live portal authenticated routes 
11-task plan для повторного a11y-аудита: extend Pa11y от 7 guest URLs к 21
URLs (включая 14 authenticated через per-URL actions login flow), + axe-core
cross-validation via Playwright MCP, + inline fixes для real prod findings.

Closes Audit #3 Phase 7 «authenticated pages out of scope» clause per
explicit user request «Pa11y был настроен на старые HTML-эскизы, проведи
повторно аудит в этой части, чтобы он проверил реальный портал».

Plan: docs/superpowers/plans/2026-05-14-a11y-rescan-live-portal.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:06:19 +03:00
Дмитрий 54ee37c54e feat(graph): physics off by default + buttons restore radial layout + smooth continuous 2026-05-14 09:23:46 +03:00
Дмитрий d75b3b85d3 feat(graph): radial-sector layout — 6 колец × 4 сектора (workflow/UI/infra/data) 2026-05-14 09:22:45 +03:00
Дмитрий 0da8dbf042 feat(graph): when+limits content for memory files (15) — all 73 nodes done 2026-05-14 09:20:54 +03:00
Дмитрий a19bee28be feat(graph): when+limits content for lefthook jobs (10) 2026-05-14 09:19:38 +03:00
Дмитрий 0634426c30 feat(graph): when+limits content for MCP servers (7) 2026-05-14 09:18:45 +03:00
Дмитрий ee958f884a feat(graph): when+limits content for hooks (5) + agents (11) 2026-05-14 09:17:37 +03:00
Дмитрий 2b38e7be32 feat(graph): when+limits content for skills (14 SP + 2 проектных) 2026-05-14 09:16:02 +03:00
Дмитрий 413803e569 feat(graph): when+limits content for rules + plugins (9 nodes) 2026-05-14 09:14:10 +03:00
Дмитрий 1a7cd90c32 feat(graph): nd() helper supports when+limits fields; showLegend renders them 2026-05-14 09:10:57 +03:00
Дмитрий 40b437ccb7 feat(graph): legend panel — add «Когда используется» and «Ограничения» sections 2026-05-14 09:10:15 +03:00
Дмитрий aa258e1ad0 fix(graph): remove edge labels from canvas, move to hover tooltips 2026-05-14 09:09:42 +03:00
Дмитрий 5c2556b73f fix(graph): canvas rendering artifacts — explicit canvas bg + remove hideEdgesOnDrag 2026-05-14 09:09:01 +03:00
Дмитрий e3974482a9 docs(plan): automation-graph refactor — 10 atomic tasks 
Implementation plan для spec 2026-05-14-automation-graph-refactor-design.md.
10 tasks, каждый = 1 коммит, в порядке:
1. canvas rendering fix
2. edge labels → tooltips
3. HTML legend sections (когда + ограничения)
4. nd() helper signature + render
5a-5f. when+limits content для 73 узлов (rules+plugins / skills / hooks+agents / MCP / lefthook / memory)
6. radial-sector positioning (ring + sectorAngle на 73 NODES + pos() helper)
7. physics off + button handlers + smooth continuous
8. final smoke + data integrity check

Self-review: spec coverage ✅, no placeholders ✅, type consistency ✅,
backward-compat nd() handler в Task 4 (for intermediate state).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 09:05:21 +03:00
Дмитрий b747880ddc docs(spec): automation-graph refactor — 4 fixes (фон / подписи / радиальная иерархия / when+limits) 
Дизайн рефакторинга docs/automation-graph.html после визуальной проверки
коммита 7ee78a9:
- canvas background на самом canvas + удаление hideEdgesOnDrag (artifacts)
- удаление labels с edges, переход на title-tooltip + legend section
- radial-sector layout: 6 колец × 4 функциональных сектора, physics off
- 2 новые секции легенды: «Когда используется» + «Ограничения»

cspell: +mgmt (валидный идентификатор узла claude_md_mgmt)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 08:55:32 +03:00
Дмитрий c5242271d7 chore(p3): close P3 tooling and structural mini-fixes 
Closes Audit #3 P3 batch.

Changes:

1. **knip.config.ts cleanup** — remove 4 stale config hints flagged in
   Audit #3 Phase 1B (`ignore: tests/**` redundant since `project` is
   `resources/js/**`; `ignoreDependencies` for vitest/@vue/test-utils/jsdom
   redundant since knip auto-detects test frameworks). Add `histoire.config.ts`
   + `resources/js/histoire.setup.ts` to entry — closes 2 documented FPs
   (histoire.setup.ts + @histoire/plugin-vue unused-flag). Verified:
   `npx knip` exits 0 clean.

2. **Admin table actions column header label** — change `title: ''` →
   `title: 'Действия'` in:
   - TenantsTable.vue (actions column, /admin/tenants)
   - AdminSupplierPricesView.vue (actions column, /admin/supplier-prices)
   Closes axe-core `empty-table-header` violation seen in Audit #3 Phase 7
   on /admin/tenants. Header is now visible in UI (better UX than sr-only
   sleight-of-hand).

3. **npm overrides for lodash** in `package.json` — pin `pa11y-ci > lodash`
   to ^4.17.21. Verified: `npm ls lodash` resolves to lodash@4.17.23 (latest
   4.x; CVE-2021-23337 + GHSA-f23m patched in <4.17.21, our version is above
   that). npm audit may still surface advisory ranges as informational.

4. **Decision doc for pgFormatter (Q.HARD.002)** — explicit FIX-DEFER with
   3-hypothesis comparison (Strawberry Perl install vs sqlfluff replacement
   vs Docker pg_format vs drop SQL formatting). Decision: drop automated
   SQL formatting until Б-1 closure; squawk (linter) covers correctness.
   Addendum: axe-core .v-overlay-container region landmark — no permanent
   axe-core test setup exists, so no whitelist needed at this point.

Verification:
- knip: 0 issues
- vue-tsc: 0 errors
- ESLint: 0 errors
- Vitest: 91 files / 736 passed / 3 skipped (no regressions)
- Vite build: 2.03s

Plan: docs/superpowers/plans/2026-05-14-audit3-deferred-fixes.md Task 4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 08:38:51 +03:00
Дмитрий 0c36b7a28d feat(a11y): migrate Pa11y scope from handoff prototypes to live Vue app 
Closes Audit #3 sole P1 (F-A11Y-PA11Y-SCOPE-01).

Pa11y was scanning handoff HTML prototypes from liderra_v8_handoff/concepts/
(3 URLs, ~10 contrast violations), NOT the live Vue app. Audit #2 baseline
"0 errors" was inaccurate — real portal was never covered.

Changes:
- pa11y.config.json: now targets http://localhost:8000/<route> for 7 guest
  pages (login, register, forgot, 2fa, recovery, 403, 500)
- pa11y-handoff.config.json: preserves historical handoff baseline as
  opt-in (`npm run a11y:handoff`)
- package.json: new `a11y:handoff` script; `a11y` repointed to live target
- RecoveryCodesView.vue: scoped CSS override fixes Vuetify warning-tonal
  alert content contrast (2.03:1 → ≥4.5:1, color #0a0700 per Pa11y rec)
- .github/workflows/a11y.yml: new CI job with dev-server lifecycle
  (php artisan serve + curl wait-on + Pa11y + screenshot artifact upload)
- docs/audit-baseline-pa11y.md: first live baseline document with per-URL
  status, ignore selectors rationale, re-run instructions

Local verification:
- npm run a11y: 7/7 URLs passed (0 violations)
- vue-tsc: 0 errors
- ESLint: 0 errors
- Vitest: 88 files / 683 passed / 3 skipped / 0 failed (no regressions)

Plan: docs/superpowers/plans/2026-05-14-audit3-deferred-fixes.md Task 1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 08:25:14 +03:00
Дмитрий 8ba9c55724 docs(plan): Audit #3 deferred fixes sprint plan 
25 deferred findings (1 P1 + 11 P2 + 14 P3) → 4 task batches:

1. P1 Pa11y scope migration to live Vue app
2. P2 dead code + dev hygiene (knip findings + DemoSeeder + schema header)
3. P2 coverage debt (ReminderDialog + AdminLayout + api/admin via TDD)
4. P3 tooling + structural mini-fixes

Plan: docs/superpowers/plans/2026-05-14-audit3-deferred-fixes.md
Source audit: docs/superpowers/audits/2026-05-14-portal-full-audit-report.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 08:24:49 +03:00
Дмитрий f9d2452386 docs(audit): finalize portal full audit #3 — report (2026-05-14) 2026-05-14 07:52:27 +03:00
Дмитрий 301334c288 docs(audit): Phase 14 final regression (audit #3) 2026-05-14 07:46:56 +03:00
Дмитрий abb8a5135e docs(audit): Phase 13 categorization + fix decisions (audit #3) 
Final audit rollup: 0 P0 / 1 P1 / 11 P2 / 14 P3 (26 total).

Pa11y P1 decision: FIX-DEFER with concrete migration plan
(6 acceptance criteria + 60-120 min estimate). Decision driven by
3-hypothesis analysis: (1) config-only swap surfaces new live-app
violations (color-contrast on DevIndexBadge, region landmarks),
(2) additive both-kept keeps handoff failures blocking CI,
(3) deferred migration with proper sprint task is cleanest path.
Both decision-matrix triggers from brief apply: risk of new
failures without follow-up plan + new CI infra requirement
(live dev server lifecycle).

Carryforward audit: 9 items still open from Audit #2 (all
P2/P3, no regressions). 11 Audit #2 items verified closed in
this audit (bf84568 aria fix, CTO-19 Lucide, Q.DEFER.001-004,
quirks #62/#72/#80, cron, RUNBOOK.md).

FIX-NOW this session: 0 commits (Pa11y deferred per matrix).
FIX-NOW earlier in audit: 1 commit (823da29 cspell inline).
FIX-DEFER documented: 25.
BLOCKED: 0.

Verdict: GREEN — 0 P0, sole P1 is methodology audit-fidelity gap
(Pa11y declared but not exercised against live code); axe-core
via Playwright in Phase 7 provides actual a11y coverage with 0
real prod issues against DevIndexBadge temp feature.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 07:38:25 +03:00
Дмитрий 4b4705295c docs(audit): Phase 10-12 pre-prod/TODO/untracked findings (audit #3) 2026-05-14 07:34:35 +03:00
Дмитрий 9d27783729 docs: commit untracked plan files + parse-bundle-analyze.mjs (audit #3) 2026-05-14 07:29:47 +03:00
Дмитрий 51664a0aa4 docs(audit): Phase 9 bundle analyzer delta (audit #3) 2026-05-14 07:27:36 +03:00
Дмитрий ad89473331 docs(audit): Phase 8 coverage targeted (audit #3) 2026-05-14 07:24:12 +03:00
Дмитрий 8fa545e113 docs(audit): Phase 7 a11y targeted Pa11y+axe-core (audit #3) 2026-05-14 07:20:49 +03:00
Дмитрий 8ec7a8c116 docs(audit): Phase 6 cross-doc integrity findings (audit #3) 2026-05-14 07:14:59 +03:00
Дмитрий 1f43beacc3 docs(audit): Phase 5 UI smoke 22-view Playwright sweep (audit #3) 2026-05-14 07:12:48 +03:00
Дмитрий 9e2914a72d docs(audit): Phase 4 security findings (audit #3) 
CI workflows: 3 (sast/dependency-check/trivy), unchanged from Audit #2.
gitleaks delta (9e175a1..HEAD): 0 leaks / 18 commits.
gitleaks full history: 0 leaks / 426 commits.
gitleaks no-git app/: 1847 matches all in gitignored vendor/ +
phpstan-cache; P2: GITHUB_TOKEN env var captured in gitignored
nette DI container cache (not in git history, mitigations in place);
P3: generic-api-key FPs in phpstan.phar / cache suggest gitleaks.toml.
cspell-words.txt +3: nette, phar, serialises.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:29:31 +03:00
Дмитрий 93a3c667e0 docs(audit): Phase 3 schema integrity findings (audit #3) 
Query results A-G: root_tables=63 (61r+2p), partitions=12,
indexes=289, RLS=39, functions=5 (correct names), triggers=13
logical/19 total, orphan_FK=0. One P2 finding: schema.sql v8.20
header "62 базовые таблицы" drift → actual 63 (deals +
supplier_lead_costs both partitioned parents). All invariants
RLS/functions/orphan-FK pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:23:25 +03:00
Дмитрий af97885266 docs(audit): Phase 2 test suite findings (audit #3) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:19:50 +03:00
Дмитрий 4a5ecb085a docs(audit): Phase 1D SQL static analysis + Phase 1 итог (audit #3) 
squawk v2.51.0 — 0 issues (bin\squawk.exe db/schema.sql, exit 0).
pgFormatter — N/A (perl not in PATH, known Q.HARD.002 carryforward).
Phase 1 combined итог: P0=0 P1=0 P2=4 P3=2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:13:04 +03:00
Дмитрий 823da293de docs(audit): Phase 1C docs static analysis findings + cspell words (audit #3) 
markdownlint=0, cspell=0 (+3 words: shapkas/SUT/SUT's), lychee=318 OK/0 errors.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:09:29 +03:00