liderra/portal
1
0
Fork 0
Code Issues Pull Requests Actions 74 Packages Projects Releases Wiki Activity
483 Commits 104 Branches 2 Tags
fb235e9d8db10d169e381dfdb67f686ea9d3cc27
Commit Graph

116 Commits

Author SHA1 Message Date
Дмитрий fb235e9d8d docs(plan): ProjectDetailsDrawer — 10 atomic tasks (TDD-strict) 
Implementation plan для side-panel редактирования single-selected проекта
на /projects (spec: 9d88955 docs/superpowers/specs/2026-05-14-project-details-drawer-design.md).

10 tasks:
 1. Scaffold + null-project no-open test
 2. Render name/limit/days fields
 3. Close emits (X / Cancel / ESC × 2 negative case)
 4. Form reseed on project.id change
 5. Save — PATCH /api/projects/{id} + 422 errors
 6. Pause/Resume + label switch
 7. Delete with confirm
 8. ProjectsView wire (condition >0 → >=2, drawer mount, computed, .has-drawer CSS)
 9. ProjectsView integration tests (5 cases: 0/1/2 selected + close + missing id)
10. Full regression + visual smoke (9 manual checks)

Каждая task: failing test → verify FAIL → impl → verify PASS → commit (TDD-strict).
9 кодовых commits + Task 10 verification only.

Coverage: 16 spec cases (11 unit + 5 integration) реализуются полностью.
Out of plan: confirm dialog при dirty Cancel / optimistic update / mobile / region
autocomplete (region_mask payload-only в Save, UI порт в отдельный sweep).

cspell-words.txt +1 (pdd) — namespacing prefix data-testid'ов компонента.

NB env quirk: Write/Edit tools silently fail on cyrillic repo path —
workaround через ASCII-Temp + PowerShell Copy-Item задокументирован в шапке плана.
 2026-05-14 13:38:04 +03:00
Дмитрий 9d889558d3 docs(spec): ProjectDetailsDrawer push-mode design + mockup 
Design spec + интерактивный HTML mockup для side-panel редактирования
проекта при выборе одного проекта на /projects.

Поведение:
- selectedIds.size === 1 → drawer справа (480px, push-mode, grid сдвигается)
- selectedIds.size >= 2 → BulkActionsBar внизу (условие в ProjectsView.vue:78
  меняется > 0 → >= 2)
- 0 selected → ни drawer, ни bulk-bar

Footer drawer:
- Слева (destructive): Приостановить (toggle-active) + Удалить (soft-archive)
- Справа (form actions): Отмена (close+clearSelection) + Сохранить
  (PATCH /api/projects/{id})

Backend без изменений — используются существующие endpoints PATCH/DELETE/
toggle-active. Pinia store useProjectsStore уже имеет update/toggleActive/
archive методы.

Прецеденты: DealDetailDrawer.vue (overlay-вариант); push-mode здесь — custom
aside + CSS transform/padding-right, без Vuetify teleport.

Mockup: 3 состояния через JS-toggle (0/1/2+ selected), Forest palette
(Teal #0F6E56, ivory #F6F3EC, noir #012019). Phone masked под 152-FZ ПДн.

cspell-words.txt +1 (юнит) — для упоминания юнит-тестов в spec §6.

Open questions: 0 (все 5 UX-решений утверждены заказчиком 2026-05-14).
 2026-05-14 13:33:27 +03:00
Дмитрий abaeebbde6 docs(plan): automation-graph iter2 — 10 atomic tasks (7 parallel-safe + 3 sequential) 
Tasks 1-7 (parallel-safe через dispatching-parallel-agents): T1 resize handle CSS+JS+localStorage, T2-T5 text rewrite groups A/B/C/D (9+21+18+25=73 nodes по Style Guide), T6 CONFLICT_TYPES enum + 2 new ⚫ edges + reclassify 6, T7 EDGE_DETAILS data (74 entries). Tasks 8-10 (sequential): T8 edge legend render + click handler (depends T7), T9 3-color render + sort + footer (depends T6), T10 visual smoke + push.

Test strategy для single-file HTML без unit-tests: 3-уровневая verification (Level 1 — Node.js syntax check per Edit, Level 2 — lefthook pre-commit gauntlet per commit, Level 3 — manual visual smoke в Edge browser). Pre-push: gitleaks full-history + lychee. Self-review pass: spec coverage 100%, no placeholders, no type drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 12:12:33 +03:00
Дмитрий f936944237 docs(spec): automation-graph iter2 — resize + simple-language + 3-color conflicts + edge legend 
4 improvements after iter1 ride-out: drag-handle resize 300-900px + localStorage; rewrite 73 nodes to plain language with Style Guide; reclassify 8 conflicts as 🔴 not-closed / ⚫ practice-observed / 🟢 closed-by-rule; new 7-field edge legend (source/target/relation-type/trigger/transfers/mandatory/regulation).

Parallel execution strategy: Phase 2 dispatches 6 subagents (P1 resize, P2-P5 text rewrite by category, P6 conflict types + EDGE_DETAILS) returning raw JS blocks; Phase 3 main agent applies 12 atomic Edits in sequence → 11 atomic commits total.

Through superpowers:brainstorming 4-clarifying-question cycle (text scope / conflict classification / resize UX / edge legend fields), all options chosen by Дмитрий explicitly. Self-review pass; no placeholders, no contradictions, 0 open questions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:29:40 +03:00
Дмитрий b73ddaaedd docs(a11y): authenticated rescan baseline + findings (21/21 passing) 
Final state docs after a11y rescan session:

- docs/audit-baseline-pa11y.md: «Authenticated rescan 2026-05-14» section
  added (14 new URLs, all 21 passing). Old «out of scope для первой
  baseline» section marked SUPERSEDED. Per-pattern fix table with file
  references + ignored selector rationale. axe-core cross-validation
  results documented (only DevIndexBadge dev-only remains).

- docs/superpowers/audits/2026-05-14-a11y-rescan-findings.md (new):
  Full audit findings doc — TL;DR, scope expansion table, per-pattern
  root cause + fix sections (A-H), axe-core cross-validation, метрики
  до/после, verdict 🟢 GREEN.

Regression sweep:
- Pa11y: 21/21 URLs passed
- Vitest: 91 files / 736 passed / 3 skipped / 0 failed
- Pest --parallel: 742/739/3sk/0
- Vite build: ~2s
- gitleaks: 0 leaks / 457 commits / 12.72 MB
- lychee: 345 OK / 0 errors / 457 total
- markdownlint: 0 errors (after auto-fix)
- cspell: 0 issues

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:08:08 +03:00
Дмитрий a650484b11 docs(plan): A11y rescan — live portal authenticated routes 
11-task plan для повторного a11y-аудита: extend Pa11y от 7 guest URLs к 21
URLs (включая 14 authenticated через per-URL actions login flow), + axe-core
cross-validation via Playwright MCP, + inline fixes для real prod findings.

Closes Audit #3 Phase 7 «authenticated pages out of scope» clause per
explicit user request «Pa11y был настроен на старые HTML-эскизы, проведи
повторно аудит в этой части, чтобы он проверил реальный портал».

Plan: docs/superpowers/plans/2026-05-14-a11y-rescan-live-portal.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 10:06:19 +03:00
Дмитрий e3974482a9 docs(plan): automation-graph refactor — 10 atomic tasks 
Implementation plan для spec 2026-05-14-automation-graph-refactor-design.md.
10 tasks, каждый = 1 коммит, в порядке:
1. canvas rendering fix
2. edge labels → tooltips
3. HTML legend sections (когда + ограничения)
4. nd() helper signature + render
5a-5f. when+limits content для 73 узлов (rules+plugins / skills / hooks+agents / MCP / lefthook / memory)
6. radial-sector positioning (ring + sectorAngle на 73 NODES + pos() helper)
7. physics off + button handlers + smooth continuous
8. final smoke + data integrity check

Self-review: spec coverage ✅, no placeholders ✅, type consistency ✅,
backward-compat nd() handler в Task 4 (for intermediate state).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 09:05:21 +03:00
Дмитрий b747880ddc docs(spec): automation-graph refactor — 4 fixes (фон / подписи / радиальная иерархия / when+limits) 
Дизайн рефакторинга docs/automation-graph.html после визуальной проверки
коммита 7ee78a9:
- canvas background на самом canvas + удаление hideEdgesOnDrag (artifacts)
- удаление labels с edges, переход на title-tooltip + legend section
- radial-sector layout: 6 колец × 4 функциональных сектора, physics off
- 2 новые секции легенды: «Когда используется» + «Ограничения»

cspell: +mgmt (валидный идентификатор узла claude_md_mgmt)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 08:55:32 +03:00
Дмитрий c5242271d7 chore(p3): close P3 tooling and structural mini-fixes 
Closes Audit #3 P3 batch.

Changes:

1. **knip.config.ts cleanup** — remove 4 stale config hints flagged in
   Audit #3 Phase 1B (`ignore: tests/**` redundant since `project` is
   `resources/js/**`; `ignoreDependencies` for vitest/@vue/test-utils/jsdom
   redundant since knip auto-detects test frameworks). Add `histoire.config.ts`
   + `resources/js/histoire.setup.ts` to entry — closes 2 documented FPs
   (histoire.setup.ts + @histoire/plugin-vue unused-flag). Verified:
   `npx knip` exits 0 clean.

2. **Admin table actions column header label** — change `title: ''` →
   `title: 'Действия'` in:
   - TenantsTable.vue (actions column, /admin/tenants)
   - AdminSupplierPricesView.vue (actions column, /admin/supplier-prices)
   Closes axe-core `empty-table-header` violation seen in Audit #3 Phase 7
   on /admin/tenants. Header is now visible in UI (better UX than sr-only
   sleight-of-hand).

3. **npm overrides for lodash** in `package.json` — pin `pa11y-ci > lodash`
   to ^4.17.21. Verified: `npm ls lodash` resolves to lodash@4.17.23 (latest
   4.x; CVE-2021-23337 + GHSA-f23m patched in <4.17.21, our version is above
   that). npm audit may still surface advisory ranges as informational.

4. **Decision doc for pgFormatter (Q.HARD.002)** — explicit FIX-DEFER with
   3-hypothesis comparison (Strawberry Perl install vs sqlfluff replacement
   vs Docker pg_format vs drop SQL formatting). Decision: drop automated
   SQL formatting until Б-1 closure; squawk (linter) covers correctness.
   Addendum: axe-core .v-overlay-container region landmark — no permanent
   axe-core test setup exists, so no whitelist needed at this point.

Verification:
- knip: 0 issues
- vue-tsc: 0 errors
- ESLint: 0 errors
- Vitest: 91 files / 736 passed / 3 skipped (no regressions)
- Vite build: 2.03s

Plan: docs/superpowers/plans/2026-05-14-audit3-deferred-fixes.md Task 4.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 08:38:51 +03:00
Дмитрий 8ba9c55724 docs(plan): Audit #3 deferred fixes sprint plan 
25 deferred findings (1 P1 + 11 P2 + 14 P3) → 4 task batches:

1. P1 Pa11y scope migration to live Vue app
2. P2 dead code + dev hygiene (knip findings + DemoSeeder + schema header)
3. P2 coverage debt (ReminderDialog + AdminLayout + api/admin via TDD)
4. P3 tooling + structural mini-fixes

Plan: docs/superpowers/plans/2026-05-14-audit3-deferred-fixes.md
Source audit: docs/superpowers/audits/2026-05-14-portal-full-audit-report.md

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 08:24:49 +03:00
Дмитрий f9d2452386 docs(audit): finalize portal full audit #3 — report (2026-05-14) 2026-05-14 07:52:27 +03:00
Дмитрий 301334c288 docs(audit): Phase 14 final regression (audit #3) 2026-05-14 07:46:56 +03:00
Дмитрий abb8a5135e docs(audit): Phase 13 categorization + fix decisions (audit #3) 
Final audit rollup: 0 P0 / 1 P1 / 11 P2 / 14 P3 (26 total).

Pa11y P1 decision: FIX-DEFER with concrete migration plan
(6 acceptance criteria + 60-120 min estimate). Decision driven by
3-hypothesis analysis: (1) config-only swap surfaces new live-app
violations (color-contrast on DevIndexBadge, region landmarks),
(2) additive both-kept keeps handoff failures blocking CI,
(3) deferred migration with proper sprint task is cleanest path.
Both decision-matrix triggers from brief apply: risk of new
failures without follow-up plan + new CI infra requirement
(live dev server lifecycle).

Carryforward audit: 9 items still open from Audit #2 (all
P2/P3, no regressions). 11 Audit #2 items verified closed in
this audit (bf84568 aria fix, CTO-19 Lucide, Q.DEFER.001-004,
quirks #62/#72/#80, cron, RUNBOOK.md).

FIX-NOW this session: 0 commits (Pa11y deferred per matrix).
FIX-NOW earlier in audit: 1 commit (823da29 cspell inline).
FIX-DEFER documented: 25.
BLOCKED: 0.

Verdict: GREEN — 0 P0, sole P1 is methodology audit-fidelity gap
(Pa11y declared but not exercised against live code); axe-core
via Playwright in Phase 7 provides actual a11y coverage with 0
real prod issues against DevIndexBadge temp feature.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-14 07:38:25 +03:00
Дмитрий 4b4705295c docs(audit): Phase 10-12 pre-prod/TODO/untracked findings (audit #3) 2026-05-14 07:34:35 +03:00
Дмитрий 9d27783729 docs: commit untracked plan files + parse-bundle-analyze.mjs (audit #3) 2026-05-14 07:29:47 +03:00
Дмитрий 51664a0aa4 docs(audit): Phase 9 bundle analyzer delta (audit #3) 2026-05-14 07:27:36 +03:00
Дмитрий ad89473331 docs(audit): Phase 8 coverage targeted (audit #3) 2026-05-14 07:24:12 +03:00
Дмитрий 8fa545e113 docs(audit): Phase 7 a11y targeted Pa11y+axe-core (audit #3) 2026-05-14 07:20:49 +03:00
Дмитрий 8ec7a8c116 docs(audit): Phase 6 cross-doc integrity findings (audit #3) 2026-05-14 07:14:59 +03:00
Дмитрий 1f43beacc3 docs(audit): Phase 5 UI smoke 22-view Playwright sweep (audit #3) 2026-05-14 07:12:48 +03:00
Дмитрий 9e2914a72d docs(audit): Phase 4 security findings (audit #3) 
CI workflows: 3 (sast/dependency-check/trivy), unchanged from Audit #2.
gitleaks delta (9e175a1..HEAD): 0 leaks / 18 commits.
gitleaks full history: 0 leaks / 426 commits.
gitleaks no-git app/: 1847 matches all in gitignored vendor/ +
phpstan-cache; P2: GITHUB_TOKEN env var captured in gitignored
nette DI container cache (not in git history, mitigations in place);
P3: generic-api-key FPs in phpstan.phar / cache suggest gitleaks.toml.
cspell-words.txt +3: nette, phar, serialises.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:29:31 +03:00
Дмитрий 93a3c667e0 docs(audit): Phase 3 schema integrity findings (audit #3) 
Query results A-G: root_tables=63 (61r+2p), partitions=12,
indexes=289, RLS=39, functions=5 (correct names), triggers=13
logical/19 total, orphan_FK=0. One P2 finding: schema.sql v8.20
header "62 базовые таблицы" drift → actual 63 (deals +
supplier_lead_costs both partitioned parents). All invariants
RLS/functions/orphan-FK pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:23:25 +03:00
Дмитрий af97885266 docs(audit): Phase 2 test suite findings (audit #3) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:19:50 +03:00
Дмитрий 4a5ecb085a docs(audit): Phase 1D SQL static analysis + Phase 1 итог (audit #3) 
squawk v2.51.0 — 0 issues (bin\squawk.exe db/schema.sql, exit 0).
pgFormatter — N/A (perl not in PATH, known Q.HARD.002 carryforward).
Phase 1 combined итог: P0=0 P1=0 P2=4 P3=2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:13:04 +03:00
Дмитрий 823da293de docs(audit): Phase 1C docs static analysis findings + cspell words (audit #3) 
markdownlint=0, cspell=0 (+3 words: shapkas/SUT/SUT's), lychee=318 OK/0 errors.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:09:29 +03:00
Дмитрий 362af8c981 docs(audit): Phase 1B frontend static analysis findings (audit #3) 2026-05-14 06:06:54 +03:00
Дмитрий 85d79499e9 docs(audit): Phase 0 addendum + Phase 1A backend static analysis (audit #3) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-14 06:02:45 +03:00
Дмитрий 07a483333c docs(audit): Phase 0 pre-flight skeletons (audit #3) 2026-05-14 05:59:55 +03:00
Дмитрий 9b21bbc1fd docs(spec): automation graph design spec — vis.js Solarized dark, 72 nodes, 6 conflicts 2026-05-13 16:43:13 +03:00
Дмитрий 7007379b40 docs(plans): add test-quality-preprod sprint plan + fix lychee/cspell 
Sprint plan B.1/B.2/B.3/A.1/A.2/A.3. Fixes: broken ../../../memory/
link → plain text; cspell-words.txt +аутит (Russian IT verb).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-13 13:41:59 +03:00
Дмитрий 9e175a1fd6 docs(audit): Phase 10.2 axe-core + Q.DEFER.001+002 closure — audit #2 follow-up 
axe-core 4.10 на 16 auth views: P2=1 (aria-tooltip-name VTooltip /admin/tenants),
P3=4 кат. (region sitewide, DevIndexBadge temp, empty-table-header 2 views,
page-has-heading-one 1 view). P0/P1=0.

Q.DEFER.001 (Phase 5 24-view smoke) + Q.DEFER.002 (axe-core 16 auth) оба CLOSED.
blocked.md + report.md обновлены. Verdict 🟡 YELLOW, 0 открытых Q-items.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 11:52:59 +03:00
Дмитрий ec0dd00a93 docs(audit): Phase 5 full 24-view smoke — Q.DEFER.001 closure (audit #2 follow-up) 
Playwright MCP iteration по 24 URL (auth + main + admin + 404).
Login/logout flow verified. CTO-19 Lucide icons confirmed holding.
25 screenshots в audit-screens/2026-05-13/. 0 реальных дефектов.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 11:41:11 +03:00
Дмитрий 43f9c257bc docs(audit): finalize portal full audit #2 — Phase 7-9 + report (2026-05-13) 
Phase 7 — Categorize: severity rollup 37 findings (P0=0 / P1=5 / P2=14 / P3=18).
  vs 12.05 baseline (P0=1 / P1=47 / P2=339 / P3=6) — massive improvement.

Phase 8 — Fix loop SKIPPED per hybrid: 0 P0 + 5 P1 все FIX-DEFER known quirks
  (квирки 62/72 + router coverage timeout), не FIX-NOW eligible. 0 atomic
  fix-commits в этой session.

Phase 9 — Final regression: 0 regressions vs Phase 2 baseline (742/738/1/3 Pest,
  88/683/3 Vitest, 35/63 Histoire, 2.15s Vite). Все baseline metrics preserved.

Report.md filled: TL;DR + Phase summaries + метрики до/после + verdict 🟡 YELLOW
+ commits + 3 new quirks (78 branch contention, 79 CWD double-cd, 80 vitest
coverage v8 timeout).

Q-items: Q.DEFER.001 (Phase 5 full smoke) + Q.DEFER.002 (Phase 10 axe auth) deferred.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 11:13:44 +03:00
Дмитрий 845477603a docs(audit): Phase 10+11+12+13+14 findings batch (audit #2) 
Phase 10 — Pa11y 4 guest URLs: ✅ all clean.
Phase 11 — TODO sweep: 19 matches (stable vs 12.05).
Phase 12 — Bundle: critical-path ~189 kB gzip, +25 kB drift vs 12.05.
Phase 13 — Coverage: 78.30/75.78/70.12/80.47. P1 router.spec.ts timeouts под coverage.
Phase 14 — Pre-prod 🟡: P2 Sentry prod SDK missing, partitions cron not registered, runbook отсутствует.

cspell-words.txt: +«редиректится».

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 11:11:40 +03:00
Дмитрий 31f804581d docs(audit): Phase 6 cross-doc integrity findings (audit #2) 
7 normative docs version match (factual vs memory):
- CLAUDE.md v1.92 ✅, Pravila v1.13 ✅, PSR_v1 v2.1 ✅, Tooling v1.17 ✅
- Реестр v1.83 ✅, schema.sql v8.20 ✅, README_АРХИВ v8.5 ✅

routes/web.php: 26 explicit Route::view + Route::fallback — комплектен. 12.05 finding /projects+/reminders+/admin/* missing — fixed `b9038bc`. /admin top-level index new.

Severity Phase 6: P0=0 / P1=0 / P2=0 / P3=0. ✅ vs 12.05 baseline (5 P2 drift) — параллельная сессия PR #4 sync'нула все версии.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:42:07 +03:00
Дмитрий e81b9c45b4 docs(audit): Phase 5 UI smoke (focused) + Q.DEFER blocked entries (audit #2) 
Phase 5 reduced scope (transparent): 17 routes HTTP 200 ✅ + CTO-19 Lucide structural verification (vuetify.ts:19 import + prod bundle inclusion). Indirect coverage via Vitest 88/683 + Histoire 35/63 + Vite build (Phase 2).

Not covered этой session: Playwright MCP interactive flows для 24 views.

Q.DEFER entries → blocked.md:
- Q.DEFER.001: Phase 5 full 24-view Playwright smoke deferred.
- Q.DEFER.002: Phase 10 axe-core 16 auth views deferred.

Severity Phase 5: P0=0 / P1=0 / P2=0 / P3=1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:40:42 +03:00
Дмитрий 17d530f669 docs(audit): Phase 4 security findings (audit #2) 
- 4.1 CI workflows enum (methodology gap closure per Pravila v1.12 §4.6): 3 active (dependency-check.yml + sast.yml + trivy.yml). Semgrep SAST confirmed deployed: p/php + p/javascript + p/typescript + p/secrets, SARIF upload to GitHub Security tab. Q.INFO.001 12.05 closure verified holding.
- 4.2 Gitleaks full history: 401 commits / 12.11 MB / 0 leaks ✅. vs 12.05 (333/11.14) — +68 commits, still clean.
- 4.3 Composer audit cross-link: 0 advisories.
- 4.4 Production secrets grep: 0 AWS prefix, 0 Stripe prefix в app/.

Severity Phase 4: P0=0 / P1=0 / P2=0 / P3=0 — fully clean.

CI security stack полный: SAST + dependency-check + Trivy = pre-prod readiness baseline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:37:30 +03:00
Дмитрий 75dc375da3 docs(audit): Phase 3 schema integrity findings (audit #2) 
Boost MCP queries к dev liderra:
- Root tables: 61 (vs schema.sql v8.20 header 62; vs CLAUDE.md memory dev-actual 75 stale).
- Partition children: 12 (vs header 12 ✅; vs memory 102 stale — после migrate:fresh).
- Indexes: 289 (vs header 117 stale; vs memory 289 ✅).
- RLS policies: 39 ✅ exact match.
- User functions: 5 ✅ exact by name (audit_block_mutation, audit_chain_hash, calc_lead_score, report_jobs_log_export, set_pd_subject_request_deadline).
- Triggers: 19 (vs header 13 stale; vs memory 19 ✅).
- DB roles 0 by design (dev).
- Orphan FK: 0 ✅.

Severity Phase 3: P0=0 / P1=0 / P2=2 (schema.sql header drift + CLAUDE.md/memory partition drift after migrate:fresh) / P3=0.

Structural integrity 100%, drift только в documentation accuracy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:35:57 +03:00
Дмитрий 22d8613578 docs(audit): Phase 2 test suite findings (audit #2) 
- Pest sequential: 742/736/3/3 (квирк 62 cumulative state — 3 expected fails LookupsTest×2 + ProjectExtensionsTest, numbers ↑ vs 12.05: 1465/12176 — больше накопления).
- Pest --parallel --recreate-databases: 742/738/1/3 — 1 sporadic regression vs 12.05 baseline 739/0/3: CsvReconcileJobTest квирк 72 (Redis supplier:session race в parallel subdir-only).
- Vitest: 88f/683/3 ✅ exact match baseline.
- Histoire: 35/63 ✅ match.
- Vite build: 2.15s ✅ faster than baseline. P2 bundle drift app-B-3WRbXK.js +21 kB raw.

Severity Phase 2: P0=0 / P1=4 (all FIX-DEFER known quirks) / P2=1 / P3=1.

cspell-words.txt: +«квирков» (валидная gen-plural форма).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:34:01 +03:00
Дмитрий 51440f4e6d docs(audit): Phase 1 static analysis findings (audit #2) 
Subagent ×4 parallel dispatch результаты:
- Backend (Pint/Larastan/composer audit): ✅ all 0 errors. P3 composer audit network warn (cached DB).
- Frontend (ESLint/vue-tsc/prettier/knip): ESLint 0, vue-tsc 0. P2 prettier 312 files mismatch (87% — generated .histoire/dist + coverage; ~40 real source). P2 knip lucide-vue-next false-positive (dynamic IconSet pattern).
- Docs (markdownlint/cspell/lychee): ✅ all clean (75 md / 88 cspell / 367 links).
- SQL (squawk/pgFormatter): squawk 0. P3 pgFormatter 6284 lines diff — Q.HARD.002 documented «не трогать».

Severity Phase 1: P0=0 / P1=0 / P2=2 / P3=2. vs 12.05 baseline (P1=44, P2=316) — massive improvement.

Также Phase 0 post-pause update: параллельная сессия завершилась PR #4 merge 66ebb22, нормативка bumped до v1.92/v1.13/v2.1/v1.17, +sentry/redis MCP, +SAST workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 10:25:34 +03:00
Дмитрий 2ece232fda Merge branch 'main' of https://github.com/CoralMinister/lidpotok 2026-05-13 09:33:14 +03:00
Дмитрий 0e3f6b2301 docs(plan): quirk #77 candidate plan — Pest --parallel unique-key collision 
Plan: docs/superpowers/plans/2026-05-13-quirk-77-pest-parallel-unique-key-collision-plan.md
279 lines, 3 tasks для documenting Task 8 baseline check finding.

Discovery: ProjectBulkActionsTest::rejects_bulk_when_scope_filter_captures_more_than_500_projects
reproducibly fails 738/742 в --parallel --recreate-databases.
Sequential 14/14 ✅. NOT regression from feat/claude-automation
(verified f454e95 audit-2 commit zero PHP touched).

Evidence captured this session:
- db/schema.sql:836 UNIQUE (tenant_id, name)
- app/database/factories/ProjectFactory.php:23 fake()->words(3, true)
- app/tests/Pest.php:18 // ->use(RefreshDatabase::class) (TX rollback only)
- app/tests/Feature/Api/ProjectBulkActionsTest.php:194-206 (501-project bulk)

Tasks:
1. Memory feedback_environment.md +#77 entry (76→77 quirks)
2. MEMORY.md line 5 summary bump
3. .claude/agents/pest-parallel-debugger.md +Hypothesis 4 + output template
   + description frontmatter

Root cause partial: collision pattern matches birthday paradox (~12.5% per-test
prob with ~100-word Lorem ~1M combos), но deterministic-in-parallel vs sequential
suggests worker state sharing (shared Faker seed via PHP global state? Eloquent
factory caching?). Full RCA pending.

Apply-time recommendation: defer until completion plan Task 9 merged,
apply на separate branch feat/quirk-77-update для atomic-commit hygiene.

Verification: lychee 5/5 OK, markdownlint 0 errors, gitleaks 19.07 KB clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 08:46:07 +03:00
Дмитрий 00eb8ad235 docs(drafts): pre-prep norm-sync edit blocks для Task 9 (5 files, 9 edits) 
Drafts file: docs/superpowers/plans/2026-05-13-claude-automation-norm-sync-drafts.md
364 lines, 5 file targets, 9 distinct Edit blocks с OLD/NEW pairs.

Targets:
- Tooling §0 + §4.8 (sentry) + §4.9 (redis) + §13 changelog v1.16→v1.17
- PSR_v1 R10.1 table + история v2.0→v2.1
- CLAUDE.md §3.3 +#34/#35 + §0 cross-refs + v1.91→v1.92 (через claude-md-management plugin per §5 п.10)
- Pravila §13.2 +Off-phase MCP debug-runtime subsection + v1.12→v1.13
- Memory MEMORY.md + reference_archive.md header refs

Critical correction в drafts: original plan Task 9.3 wording «§3.3 +#34/#35» — error.
Tooling §3.3 = «БД-инструменты», off-phase tools живут в §4.5/§4.6/§4.7.
New sentry+redis → §4.8 + §4.9 (new subsections). Corrected throughout drafts.

Plus bonus finding: new Pest --parallel quirk #77 candidate
(ProjectBulkActionsTest unique key collision on parallel worker shared-DB).
NOT regression from feat/claude-automation (verified). Recommendation:
separate follow-up plan to add quirk #77 to memory + extend
pest-parallel-debugger.

Verification: lychee 3/3 OK 0 errors, markdownlint 0 errors after MD032 fix,
gitleaks 27.35 KB scanned no leaks.

Applied: 0 of 9 edits (drafts only, awaiting Task 1 PR merged).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 08:38:13 +03:00
Дмитрий 7db4075107 docs(plan): completion plan для 9 post-implementation tasks 
Plan: docs/superpowers/plans/2026-05-13-claude-automation-completion-plan.md
1047 lines, 9 tasks разделены на 3 фазы:
- Phase A (Tasks 1-2): PR creation + Claude Code session reload
- Phase B (Tasks 3-7): hook smoke + Redis check + skill/subagent invocations + Sentry creds
- Phase C (Tasks 8-9): Pest/Vitest regression + sync нормативки (4 sub-files) + merge + worktree cleanup

Architecture decision: Option A (merge feat/claude-automation first, sync нормативки
on separate branch feat/claude-automation-norm-sync). Clean PR audit trail.

Pre-execution baseline captured. Verification: lychee 7/7 OK 0 errors,
markdownlint 0 errors, gitleaks no leaks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 08:19:40 +03:00
Дмитрий f454e95a2d docs(audit): Phase 0 pre-flight skeletons + findings (audit #2) 
Skeleton files findings/blocked/report для portal full audit #2 (2026-05-13).

Phase 0 finding P3: обнаружена параллельная сессия на feat/claude-automation
branch (claude-automation-recommender skill активна параллельно с этим audit'ом
на main). Main verified clean, git checkout main вернул state. CWD persistence
quirk зафиксирован для memory (двойной cd app && ... загнал в app/app/).

cspell-words.txt: +«инвалидирует» (валидное слово для Phase 0 finding prose).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 07:37:12 +03:00
Дмитрий d0460f6d20 docs(plan): spec + plan для claude-code automation recommendations 
Spec: docs/superpowers/specs/2026-05-13-claude-automation-recommendations-design.md
Plan: docs/superpowers/plans/2026-05-13-claude-automation-recommendations-plan.md

8 automations scope:
- 2 MCP: sentry, redis
- 2 skills: /q-item-add, /rls-check
- 2 hooks: PreToolUse block CLAUDE.md, PostToolUse db/schema.sql reminder
- 2 subagents: rls-reviewer, pest-parallel-debugger

Execution: Subagent-Driven (user choice A), feature branch feat/claude-automation.

Out of scope per customer:
- Sync нормативки (PSR_v1/Tooling/CLAUDE.md/Pravila формализация)
- Plugin commit-commands install

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 07:35:30 +03:00
Дмитрий 1efd25dc8c docs(audit): implementation plan for portal full audit #2 (2026-05-13) 
Bite-sized task plan для 14 phases описанных в spec fc07529.
Total tasks: ~50+ (Phase 0 setup, Phase 1 ×4 parallel subagents, Phase 2-13
sequential analysis, Phase 14 pre-prod readiness, Finalization).

Каждая task с exact file paths, concrete commands, expected output, commit
strategy. Self-review таблица spec coverage в конце плана (все 14 phases + 5
guardrails + decision-tree + verification gates).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 07:29:55 +03:00
Дмитрий fc07529c4c docs(audit): spec for portal full audit #2 (2026-05-13) 
Design для нового 14-phase audit pass на main 21262ef post-merge plan5→main.

Scope: full 13-phase audit (replica 12.05 структуры — pre-flight, static analysis ×4 subagents, test suites, schema integrity, security, UI smoke 24 views, cross-doc, categorize, fix loop, regression verify, Pa11y live + axe-core, TODO sweep, bundle analyzer, Vitest coverage) + новая Phase 14 pre-production readiness (Sentry, DB roles, mock-data prod-gate revisit, CI workflows audit, env validation, queue/cron, backup/log rotation, deployment runbook).

Fix-strategy: hybrid — P0+P1 → atomic commits на main по ходу; P2/P3 → только запись в findings.md (без commits).

Guardrails applied (lessons из 12.05 audit + Pravila v1.12):
- Phase 4 SAST: ls .github/workflows/ FIRST (audit methodology gap closure)
- Phase 5/10 UI-refactor visual smoke + axe-core с setTimeout 500ms + hard reload (Q.DEFER.004 lesson)
- Pest --parallel --recreate-databases для long sessions (квирки 62/73)
- Plans/specs relative paths ../../../ для app/ refs (Pravila v1.12 §4.7 п.4)
- npm install с --legacy-peer-deps (квирк 74)

Baseline для regression gate Phase 9: Pest 742/739/0/3, Vitest 88f/683/3sk, Vite ~3.5s/0err, Histoire 35/63.

Next step: invoke superpowers:writing-plans для implementation plan в docs/superpowers/plans/2026-05-13-portal-full-audit-2.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 07:24:00 +03:00
Дмитрий 19d12c9f95 docs(meta): session-end hygiene — CLAUDE.md v1.91 + Pravila v1.12 + audit gap 
Capture session-end documentation learnings 13.05.2026 day +1 после
CTO-19 ✅ closure (commit 0832997 + fixup f6e1e64).

CLAUDE.md v1.90 → v1.91 (через `/claude-md-management:revise-claude-md`
per §5 п.10):
— Шапка version line: новый v1.91 narrative bump с session-end summary
— §0 row Pravila: bump v1.11 → v1.12 (cross-ref sync)
— §9 история версий: +v1.91 entry (session learning capture)

Pravila v1.11 → v1.12 (manual Edit per explicit user approval choice
«iii. Pravila v1.11 → v1.12 methodology additions»):
— §4.6 self-review: +subsection «Для UI-refactor (icon migration /
  palette swap / layout overhaul)» — visual smoke verification
  обязательна; unit tests jsdom недостаточны; user-grep
  resources/js insufficient (Vuetify-internal default mdi-* gap learning
  от CTO-19); axe-core scan для palette changes
— §4.7 объединение/переименование файлов: +п.4 «Plans/specs относительные
  пути» — для ссылок на app/db/docs из docs/superpowers/{plans,specs}/
  использовать `../../../<target>` (lychee strict filesystem semantics;
  прецедент CTO-19 fixup `f6e1e64`)

audit findings.md Q.INFO.001 entry: +«Audit methodology gap»
subsection — Phase 4 SAST coverage check must begin с `ls
.github/workflows/` ДО conclusions про tool availability. Audit
12.05.2026 пропустил `.github/workflows/sast.yml` (commit 53fb1ec от
PR #25, 10.05.2026 — 2 дня до audit). Generalize: any «X not
configured» finding должен включать explicit check репо-уровневых
configurations (.github/, .gitlab-ci.yml, lefthook.yml, etc.).

cspell-words.txt +2: «рендерить» / «рендерятся» (dev jargon).
+опечатки fix: «гap» → «gap», «zafiksирован» → «зафиксирован»,
«инсуффициентны» → «недостаточны».

Регрессия зелёная (verified в commit 0832997):
— Pest --parallel 742/739/0/3 / Vitest 88/683+3 / Vite build 3.52s
— axe-core /admin/billing 0 iconography violations
— lychee 252 OK / gitleaks 0 (372+ commits)

0 code changes / 0 schema / 0 migrations / 0 npm install / 0 test impact.

Memory updates (отдельный шаг, git-untracked):
— feedback_environment.md +3 quirks 74-76 (Lucide+Histoire peerDep,
  Vuetify-internal mdi defaults gap, plans-relative-paths)
— MEMORY.md index quirks count bump 73→76

Workflow: `superpowers:brainstorming` (F-option scope) →
`:writing-plans` → `/claude-md-management:revise-claude-md` (CLAUDE.md
bump per §5 п.10) + manual Edit (Pravila + findings.md).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 05:39:22 +03:00
Дмитрий f6e1e64bee fix(plan): correct relative path для vuetify.ts link в CTO-19 plan 
Lychee pre-push hook нашёл broken link: `[app/resources/js/plugins/vuetify.ts](app/resources/js/plugins/vuetify.ts)` resolves к `docs/superpowers/plans/app/...` (несуществующий путь). Fix: `../../../app/resources/js/plugins/vuetify.ts` (3 levels up from plan-file location).

Pravila: prefer new commit over --amend; lychee block requires fix перед push.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-13 05:18:49 +03:00