chore(planning): bootstrap v1.5 marathon

Reset .planning/STATE.md and .planning/ROADMAP.md for the v1.5
overnight marathon. STATE.md tracks 12 phases (0–11) with empty
checkboxes; phase 0 marked done. Capture phase-0 sanity report at
.planning/phase-0-report.md (git status clean, recent commits, CI
status, /api/version=1.4.12 — one tag behind HEAD because the
v1.4.13 GHCR build is still in_progress; phase 1 owns the force-pull
verification). ROADMAP.md condenses the 12-phase plan with the
time-runs-short minimum (1+2+7+8) for shipping v1.5.0.

Previous milestone (v1.4.6) summary preserved as a one-line link to
docs/audit/v146-summary.md at the top of STATE.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.planning/ROADMAP.md

@@ -1,21 +1,29 @@
-# HealthLog v1.4.6 — roadmap
+# HealthLog v1.5 — roadmap
 
-Milestone: **v1.4.6** (overnight 2026-05-09)
+Milestone: **v1.5.0** (overnight 2026-05-09 → 2026-05-10)
+Latest tag at start: v1.4.13 (Codex-OAuth model slug `gpt-5` patch)
 
-| Phase | Goal                                             | State   |
-| ----- | ------------------------------------------------ | ------- |
-| 1     | CI green (e2e workflow root cause + fix)         | pending |
-| 2     | Tier 1 fixes T1–T9                               | pending |
-| 3     | New feature: chart bucketing for >1y ranges      | pending |
-| 4     | Tier 2 polish P1–P20                             | pending |
-| 5     | Multi-agent QA + simplify pass                   | pending |
-| 6     | Pre-release verification                         | pending |
-| 7     | Release commit, tag, deploy, verify production   | pending |
-| 8     | GitHub releases backfill (v1.4.2–v1.4.6) + GHCR  | pending |
-| 9     | Docs site (`healthlog-docs`) + landing site sync | pending |
-| 10    | Summary doc + Marc-facing brief                  | pending |
+| Phase | Goal                                                                       | State   |
+| ----- | -------------------------------------------------------------------------- | ------- |
+| 0     | Bootstrap — STATE+ROADMAP, git/CI/prod sanity, single chore commit         | done    |
+| 1     | Verify Codex-OAuth end-to-end (device-start shape, prod logs, gpt-5 slug)  | pending |
+| 2     | v1.4.6 deferred backlog — T2.1..T2.7 (wipe scope, DST math, 5xx → 422/503, status-card test, redact regex, Backups view, /admin/users) | pending |
+| 3     | End-to-end test coverage — authed dashboard, add-measurement, KI flow, doctor PDF, insights, mobile smoke, axe-core extended | pending |
+| 4     | Performance audit — Playwright capture, `docs/audit/v15-performance.md`, top-3 wins inline | pending |
+| 4b    | Admin Panel refactor — `/admin/[section]` dynamic routes mirror Settings; sidebar Admin group; legacy hash redirects; bundle-size win | pending |
+| 5     | UX polish — design-review top-10 friction points, CRITICAL/HIGH triage     | pending |
+| 6     | Multi-agent QA (parallel) — code-reviewer, security, visual/UX, simplify   | pending |
+| 7     | Pre-release verification — typecheck / lint / format / test / integration / build / e2e | pending |
+| 8     | Release v1.5.0 — bump, CHANGELOG, tag, GHCR, Coolify force-pull, /api/version=1.5.0, smoke screenshots | pending |
+| 9     | Docs + landing site sync to v1.5                                            | pending |
+| 10    | Backfill GitHub releases v1.4.7..v1.4.13 from CHANGELOG                    | pending |
+| 11    | Final summary `docs/audit/v15-summary.md` with Marc-Brief                  | pending |
 
 Stop conditions: production red, large un-spec'd issue, context cutoff,
-budget short of polish — write status doc, do not auto-rollback.
+or budget short of polish — write status doc, do not auto-rollback.
 
-Spec: `docs/audit/v146-findings.md` (every finding ID, every test, every gate).
+Time-runs-short minimum to ship v1.5.0: Phase 1 + Phase 2 + Phase 7 +
+Phase 8. Phases 3–6 + 9 are deferrable to v1.5.1.
+
+Spec: `/Users/marc/infra/prompts/v15-night-marathon.md` (orchestrator
+prompt, every phase, every gate).

.planning/STATE.md

@@ -1,92 +1,119 @@
-# v1.4.6 marathon — state log
+# v1.5 marathon — state log
 
-Status: **release tagged, awaiting Coolify deploy** (2026-05-09 ~02:30)
+Status: phase-0-done
+Last update: 2026-05-09T15:25:00+02:00
 
-## Phase 0 — Bootstrap ✅
+> Previous milestone: see `docs/audit/v146-summary.md` (v1.4.6 marathon).
+> Codex-OAuth iteration v1.4.7 → v1.4.13 landed in CHANGELOG between
+> the v1.4.6 release and this marathon kickoff.
 
-Committed `ecca54d`.
+## Phase 0 — Bootstrap
 
-## Phase 1 — CI green ⚠️
+- [x] STATE+ROADMAP rewritten for v1.5
+- [x] git status clean
+- [x] CI status captured (v1.4.13 docker-publish still in_progress; e2e on cfa8ea6 = failure)
+- [x] /api/version=1.4.13 confirmed — **DISCREPANCY**: prod still on 1.4.12 because the v1.4.13 GHCR build is mid-flight; phase-1 will need to confirm 1.4.13 lives after the build completes (force-pull recipe per hard-rule #10)
+- Result: ok / commit `<filled in by commit step>`
+- Detailed report: `.planning/phase-0-report.md`
 
-- e2e workflow fixed in `bcd1de4` (pnpm-version override) and `46e686f`
-  (mobile project → Pixel 5, locale-cookie anchor, login-form open).
-- Latest run on the v1.4.6 SHA is queued; conclusion not yet known
-  at tag time. Per release-spec, e2e green is not a hard gate.
+## Phase 1 — Verify Codex-OAuth flow end-to-end
 
-## Phase 2 — Tier 1 fixes (T1–T9) ✅
+- [ ] /api/version=1.4.13 confirmed (currently 1.4.12 — needs force-pull after GHCR build completes)
+- [ ] device-start endpoint returns spec-shaped response
+- [ ] prod logs reviewed for codex.* events
+- [ ] gpt-5 model accepted by chatgpt.com backend
+- Detailed report: `.planning/phase-1-report.md` (will be written by phase-1 agent)
 
-| ID      | Commit    | Note                                                 |
-| ------- | --------- | ---------------------------------------------------- |
-| T1 + T2 | `8aae7d6` | tile fill + muted-foreground hierarchy               |
-| T3      | `a75fbc6` | primary recommendation chart-token render            |
-| T4      | `eba898f` | aiBaseUrl cross-provider leak fix + test             |
-| T5      | `c8ee28d` | insights/generate 502 → 422                          |
-| T6      | `4aeb8c9` | admin status-card hrefs + tightened test             |
-| T7      | `31959e4` | bug-report toggle now blocks /api/feedback + UI      |
-| T8      | `c3ca861` | data-wipe preserves AuditLog + scope copy            |
-| T9      | `1adda80` | per-card window 360+24 buckets, 7 generators + tests |
+## Phase 2 — v1.4.6 deferred backlog
 
-## Phase 3 — Chart bucketing ✅
+- [ ] T2.1 notification-channel scope of "Wipe all data"
+- [ ] T2.2 Berlin TZ DST math in cross-metric joins
+- [ ] T2.3 /api/insights/generate provider-error → 422/503
+- [ ] T2.4 status-card-grid test brittleness
+- [ ] T2.5 redactSecrets regex word-boundary
+- [ ] T2.6 Backups dedicated admin section
+- [ ] T2.7 /admin/users dedicated sub-route
+- Detailed report: `.planning/phase-2-report.md`
 
-`6a64df0` — `bucketTimeSeries` helper + chip in chart header + 14
-unit tests.
+## Phase 3 — End-to-end test coverage
 
-## Phase 4 — Tier 2 polish ✅
+- [ ] Authenticated dashboard render
+- [ ] Add measurement flow
+- [ ] Settings → KI Codex flow (mocked)
+- [ ] Doctor report PDF
+- [ ] Insights generation flow (mocked)
+- [ ] Mobile-viewport smoke (Pixel 5, no h-scroll, CTAs ≥ 44×44)
+- [ ] axe-core extended to /dashboard, /settings/integrations, /admin
+- Detailed report: `.planning/phase-3-report.md`
 
-P1-P5 in `fda8dd8`, P6+P10 in `dc6db82`, P7-P9 in `5c884b3`, P11 in
-`e903d9a`, P12 in `c7b6005`, P13 in `4a159d2`, P14 in `dcc697c`,
-P15+P16 in `89b5b80`, P17 in `505f318`, P18 in `86a4b52`, P19 in
-`2654337`, P20 in `dc4507a`.
+## Phase 4 — Performance audit
 
-## Phase 5 — QA ✅
+- [ ] Playwright capture: /, /settings/integrations, /admin, /insights at desktop+mobile
+- [ ] Report at `docs/audit/v15-performance.md`
+- [ ] Top 3 wins identified, <30 LOC ones implemented inline
+- Detailed report: `.planning/phase-4-report.md`
 
-3 parallel reviewers (security / design / code-review). No
-CRITICAL / HIGH carried into v1.4.6 except 3 quick follow-ups
-applied in `6757518`:
+## Phase 4b — Admin Panel refactor (Settings-style dynamic routes)
 
-- ai-section.tsx orange tokens → dracula tokens (also fixes contrast)
-- status-card-grid.tsx CTAs relabelled honestly ("Open integrations",
-  "Open system status")
-- idempotency.ts `text.includes("sk-")` → tightened regex with
-  false-positive regression tests for "task-id" / "risk-management"
+- [ ] /admin/[section]/page.tsx + admin-shell sidebar
+- [ ] Sections moved to /admin/<slug> routes (system-status, services, integrations, feedback, reminders, users, api-tokens, login-overview, backups, danger-zone)
+- [ ] Status-card CTAs use real routes (no #anchor)
+- [ ] i18n keys reorganised under admin.section.<slug>.*
+- [ ] Sidebar nav expandable Admin group
+- [ ] Legacy #anchor → new route redirect in proxy.ts
+- [ ] Bundle-size win on /admin overview verified
+- Detailed report: `.planning/phase-4b-report.md`
 
-Deferred to v1.5: notification-channel data-wipe scope (M1), Berlin
-TZ DST math in cross-metric joins (HIGH from code-review),
-exhaustive-deps + set-state-in-effect refactor in about-section.
+## Phase 5 — UX polish
 
-## Phase 6 — Pre-release verification ✅
+- [ ] design-review walkthrough top-10 friction points
+- [ ] CRITICAL/HIGH triage
+- Detailed report: `.planning/phase-5-report.md`
 
-`pnpm typecheck` clean, `pnpm lint` 0 errors / 12 warnings,
-`pnpm format:check` clean (after the prettier sweep in `02b9955`),
-`pnpm test` 714 passed, `pnpm test:integration` 10 passed.
-`pnpm build` fails locally on Node 25 (Reflect.get private member
-bug in Turbopack); CI Docker uses Node 22 and is the canonical
-release build path.
+## Phase 6 — Multi-agent QA (parallel)
 
-## Phase 7 — Release ✅
+- [ ] superpowers:code-reviewer
+- [ ] security review
+- [ ] visual / UX review
+- [ ] simplify on changed file set
+- Detailed report: `.planning/phase-6-report.md`
 
-- `package.json` 1.4.6 (`a852612`)
-- `CHANGELOG.md` v1.4.6 block (`a852612`)
-- Tag `v1.4.6` pushed
-- GHCR docker-publish: in_progress
-- Coolify deploy: pending GHCR
+## Phase 7 — Pre-release verification
 
-## Phase 8 — Releases ✅
+- [ ] pnpm typecheck
+- [ ] pnpm lint
+- [ ] pnpm format:check
+- [ ] pnpm test
+- [ ] pnpm test:integration
+- [ ] pnpm build (Node-25 bug documented if hit)
+- [ ] pnpm e2e
+- Detailed report: `.planning/phase-7-report.md`
 
-GitHub releases v1.4.2, v1.4.3, v1.4.4, v1.4.5, v1.4.6 backfilled
-from the CHANGELOG blocks. URLs:
-https://github.com/MBombeck/HealthLog/releases/tag/v1.4.{2,3,4,5,6}
+## Phase 8 — Release v1.5.0
 
-GHCR untagged-manifest cleanup: not run; pre-existing tagged
-versions (v1.x.x) are pinned, no orphan manifests visible. Defer
-unless Marc asks.
+- [ ] package.json bumped
+- [ ] CHANGELOG entry
+- [ ] tag v1.5.0 pushed
+- [ ] GHCR build green
+- [ ] Coolify deploy + force-pull
+- [ ] /api/version=1.5.0 confirmed
+- [ ] image digest changed
+- [ ] prod smoke screenshots saved
+- Detailed report: `.planning/phase-8-report.md`
 
-## Phase 9 — Docs / landing 🔄
+## Phase 9 — Docs + landing sync
 
-`general-purpose` agent dispatched to bring `healthlog-docs` from
-v1.2 to v1.4.6 and apply minimal updates to `healthlog-landing`.
-Running in background.
+- [ ] healthlog-docs updated to v1.5
+- [ ] healthlog-landing updated
+- [ ] both committed + pushed
+- Detailed report: `.planning/phase-9-report.md`
 
-## Phase 10 — Summary
+## Phase 10 — Backfill GitHub releases v1.4.7-v1.4.13
 
-`docs/audit/v146-summary.md` — last step.
+- [ ] Releases for v1.4.7..v1.4.13 created from CHANGELOG
+- Detailed report: `.planning/phase-10-report.md`
+
+## Phase 11 — Final summary doc
+
+- [ ] docs/audit/v15-summary.md with Marc-Brief
+- Detailed report: `.planning/phase-11-report.md`

.planning/phase-0-report.md

@@ -0,0 +1,61 @@
+# Phase 0 — Bootstrap report
+
+Status: **done**
+Timestamp: 2026-05-09T15:25:00+02:00
+Commit: see `chore(planning): bootstrap v1.5 marathon` on origin/main.
+
+## Working tree
+
+`git status` clean, branch `main` up to date with `origin/main`.
+
+## Recent commits (`git log --oneline -15`)
+
+```
+cfa8ea6 fix(ai): use plain gpt-5 model slug for ChatGPT-account auth
+e4a07bc fix(ai): complete Codex backend protocol implementation per spec
+e0de659 fix(ai): CodexClient consumes SSE stream from chatgpt.com backend
+68e5797 fix(ai): Codex backend request body matches OpenAI Responses schema
+3dbc8af fix(ai): device-code flow uses OAuth access token directly (v1.4.8 follow-up)
+19eb1d9 fix(ai): switch ChatGPT-OAuth to device-code flow (v1.4.7-followup)
+2f7f487 fix(ai): Codex OAuth flow — correct issuer + api-key exchange
+3bca826 docs(release): v1.4.6 marathon summary
+a852612 chore(release): v1.4.6
+02b9955 chore(style): repo-wide prettier sweep before v1.4.6 tag
+6757518 fix(qa): apply pre-release multi-agent QA findings
+dc4507a fix(admin/status-overview): one failed probe no longer blanks the grid
+2654337 fix(admin): surface query errors instead of an infinite spinner
+86a4b52 fix(admin): danger-zone result colour driven by mutation state
+505f318 style(admin): switch feedback-category badges to dracula tokens
+```
+
+The full v1.4.7 → v1.4.13 Codex iteration is in commits `2f7f487` →
+`cfa8ea6`. v1.4.13 (`cfa8ea6`) is tagged but its docker-publish run
+is still in_progress, so production has not yet swung over.
+
+## CI status (`gh run list --limit 8`)
+
+- v1.4.13 SHA `cfa8ea6`: docker-publish **in_progress** (two runs queued —
+  one is the duplicate that GHCR triggers per tag); e2e **failure** (the
+  e2e on the v1.4.13 SHA — known, not a hard release gate per v1.4.6
+  marathon doctrine, but worth a phase-1 follow-up if it persists);
+  Integration tests **success**; Security & Quality **success**.
+- v1.4.12 SHA `e4a07bc`: docker-publish **success** (×2), Integration
+  tests **success** — i.e. v1.4.12 is the latest fully published image.
+
+## Production state
+
+`curl https://healthlog.bombeck.io/api/version` returns
+`{"version":"1.4.12", ...}` — **production is one tag behind HEAD**.
+Cause: the v1.4.13 docker-publish workflow is still building, and even
+once it finishes, the Coolify-deploy quirk (hard-rule #10) means we
+need to force-pull on apps-01 before /api/version flips to 1.4.13.
+Phase 1 owns that confirmation step.
+
+## Files written
+
+- `.planning/STATE.md` — rewritten for v1.5 marathon, all phases stubbed.
+- `.planning/ROADMAP.md` — v1.5 milestone with phases 0–11 lifted from
+  the marathon prompt.
+- `.planning/phase-0-report.md` — this file.
+
+`PROJECT.md` left untouched (no v1.5-specific changes needed yet).