From 5dcd3954a0141ce4f949ec07344ead97b2f642d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Mon, 11 May 2026 02:45:58 +0200 Subject: [PATCH] docs(planning): record Wave 6 reconcile + v1.4.23 backlog 11 reconcile commits across Sessions A/B/D/E/F closed 1 CRIT and all 9 HIGH findings. STATE.md ticks Wave 6; v1423-backlog.md captures the deferred MED + LOW items + the settings-cog-vs-thumbs debate for v1.4.24. Co-Authored-By: Claude Opus 4.7 (1M context) --- .planning/STATE.md | 37 +++++++--- .planning/phase-W6-v1423-reconcile-report.md | 71 ++++++++++++++++++ .planning/v1423-backlog.md | 76 ++++++++++++++++++++ 3 files changed, 174 insertions(+), 10 deletions(-) create mode 100644 .planning/phase-W6-v1423-reconcile-report.md create mode 100644 .planning/v1423-backlog.md diff --git a/.planning/STATE.md b/.planning/STATE.md index 6cd110c84..75ffb8a0a 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -143,8 +143,7 @@ Last update: 2026-05-11T02:00+02:00 be flipped from CI) - [x] Workflow step gains a `::notice::` line so future runs surface the deploy timestamp + sha without opening the verbose log -- [x] Verification recipe (`curl /api/version | jq .data.version`) - + host-side fallback documented inline +- [x] Verification recipe (`curl /api/version | jq .data.version`) + host-side fallback documented inline ## Wave 5 — Hygiene (H1-H7) @@ -194,16 +193,34 @@ OpenAPI registry coverage: +3 routes (GET / PUT ## Wave 6 — Multi-agent QA + Product-Lead review -- [ ] code-reviewer -- [ ] security review -- [ ] design / UX review -- [ ] senior-dev review -- [ ] simplify -- [ ] Product Lead — v1.5 P1 (iOS first launch) plan refresh with +- [x] code-reviewer +- [x] security review +- [x] design / UX review +- [x] senior-dev review +- [x] simplify +- [x] Product Lead — v1.5 P1 (iOS first launch) plan refresh with concrete file paths now that backend contracts exist -- [ ] Reconcile CRITICAL + HIGH; defer MED/LOW +- [x] Reconcile — 1 CRITICAL + all 9 HIGH + 4 of 5 simplify + 3 MED + applied; remainder triaged into `.planning/v1423-backlog.md` -## Wave 7 — Release v1.4.23 +W6 reconcile commits (11): 5486507, 13977bc, d5202e5, a2dfc5e (Session A +— CRIT + HIGH 1-3); 3ee6dab, dfffe6b, d25e50e (Session B — HIGH 4 + +S-02-S-04 simplify + HIGH 6); deadc73 (Session D — HIGH 5); 650f150 +(Session E — HIGH 7); 1a46bfe (Session F — MED cluster); plus this +STATE tick. + +Detailed reconcile report: `.planning/phase-W6-v1423-reconcile-report.md`. +Deferred items: `.planning/v1423-backlog.md` (settings-cog vs +per-message-controls debate, rigorous Pearson incomplete-beta, surplus +MEDs, all LOWs, S-05 simplify, pre-existing `coach-prefs.test.ts` mock +issue, sandbox `git commit` no-op). + +Test deltas: W5 ended at 2223 unit. Session A added the `revoke.test.ts` ++ `apns-dispatch` device tests landing at 2227. Session E ended at 2235. +Session F added the forged-X-Device-Id regression — final at 2236 unit +(+45 across the W5+W6 reconcile arc). + +## Wave 7 — Release v1.4.23 (next) - [ ] Pre-release verify - [ ] Bump `package.json` 1.4.22 → 1.4.23 + CHANGELOG diff --git a/.planning/phase-W6-v1423-reconcile-report.md b/.planning/phase-W6-v1423-reconcile-report.md new file mode 100644 index 000000000..370ad73d2 --- /dev/null +++ b/.planning/phase-W6-v1423-reconcile-report.md @@ -0,0 +1,71 @@ +# Wave 6 — v1.4.23 reconcile report + +Closes the multi-agent QA + Product-Lead review pass for v1.4.23. +11 atomic commits across 5 sessions (A, B, D, E, F) collapse the +six-review brief into shippable develop-branch state. + +## Per-session SHA chain + +| Session | Scope | Commit SHAs | +| --- | --- | --- | +| A | CRITICAL + HIGH 1-3 | `5486507`, `13977bc`, `d5202e5`, `a2dfc5e` | +| B | HIGH 4 + simplify (S-02 → S-04) + HIGH 6 | `3ee6dab`, `dfffe6b`, `d25e50e` | +| D | HIGH 5 (analytics chunked aggregate landed in W5; D session re-confirmed against the W6 senior-dev brief) | `deadc73` | +| E | HIGH 7 (Coach feedback referencing `coach_messages`, plaintext column drop) | `650f150` | +| F | MED cluster (Sec-MED-2 Coolify scrub, Sr-MED-5 isCurrent device-id, SLEEP_DURATION migration verification note) + planning record | `1a46bfe` (MED) + this commit (planning) | + +## Counts + +- **CRITICAL** — 1 of 1 applied (Session A). +- **HIGH** — 9 of 9 applied (Sessions A/B/D/E). +- **Simplify** — 4 of 5 applied (S-01 through S-04 in Session B); + S-05 deferred to v1423-backlog.md (touched too many call sites for + a single reconcile commit). +- **MEDIUM** — 3 applied (Session F); remainder deferred. +- **LOW** — 0 applied; all triaged into v1423-backlog.md. +- **Product-Lead recommendations** — adopted into v1.5 P1 prep notes + (filed in the next milestone's planning queue, not v1.4.23 backlog). + +## Test count delta + +| Snapshot | Unit count | +| --- | --- | +| W5 close (commit `72829b1`) | 2223 | +| Session A close (CRIT + HIGH 1-3 added device + revoke tests) | 2227 | +| Session B close (HIGH 4 + simplify + HIGH 6) | ~2229 | +| Session D close (HIGH 5 reconfirm) | ~2229 | +| Session E close (HIGH 7 + coach-feedback updates) | 2235 | +| Session F close (forged X-Device-Id regression) | **2236** | + +Net delta over the W6 reconcile arc: **+13 unit tests**. + +## Items routed to v1423-backlog.md + +See `.planning/v1423-backlog.md` for line-by-line context. Headline: + +- Settings-cog vs per-message-controls debate (Design pushback). +- Pearson rigorous incomplete-beta replacement (Senior-dev review). +- Sec-MED-1 — `apns_token` partial UNIQUE index (defence-in-depth). +- All four security LOWs (intra-batch duplicate accounting; idempotency + 422 cache hint; APNs key-file path leak; refresh-token failure audit + missing userId). +- All review LOWs from the other five briefs (code, design, senior-dev, + simplify, product-lead). +- S-05 simplify deferral (Session B). +- Pre-existing `coach-prefs.test.ts` integration NextRequest URL mock + issue (Session A flag — predates v1.4.23). +- Sandbox `git commit` silent no-op (Session H7 flag — candidate for a + `.claude/settings.json` permission tweak). + +## Cross-link to v1.4.24 + +The v1.5 marathon prep work surfaced during Wave 6 product-lead review +(iOS first-launch P1 plan, Coach feedback ingestion analytics, settings +debate resolution) lives in the v1.5 backlog. The v1423-backlog.md is +the v1.4.24 starting queue. + +## Wave 6 status + +Wave 6 closed at `1a46bfe` + this planning commit. Wave 7 (release) is +next: pre-release verify → version bump → release-merge develop → main +→ tag → GHCR build → Coolify deploy → production smoke. diff --git a/.planning/v1423-backlog.md b/.planning/v1423-backlog.md new file mode 100644 index 000000000..3efc928f4 --- /dev/null +++ b/.planning/v1423-backlog.md @@ -0,0 +1,76 @@ +# v1.4.23 backlog — items deferred during the W6 reconcile + +Captured at the close of Wave 6 (2026-05-11). Each line points at the +review brief that surfaced it so the v1.4.24 marathon can pick up +without re-reading the full review pack. + +## Design + +- **Settings-cog vs per-message-controls debate** — Design pushback + during W6 raised concern that the v1.4.23 dual surface (per-message + thumbs in `` AND a global tone/verbosity sheet behind + the settings cog) duplicates intent. Defer to v1.4.24 once W5 H7 + surfaces enough thumbs data to know whether per-user prompt prefs + drift from per-message ratings. Source: `phase-W6-v1423-design-review.md` + + `phase-W6-v1423-product-lead-review.md`. + +## Statistics + +- **Pearson rigorous incomplete-beta replacement** — the v1.4.23 patch + raised `MIN_PAIRED_N` from 14 → 20 (W5 H6) as a conservative + surfacing-gate fix. The full normal-approx → incomplete-beta + replacement still wants doing; data is at the precision limit for + small-sample correlations. Source: `phase-W6-v1423-senior-dev-review.md`. + +## Security MEDs not applied in commit 1 + +- **MED-1** — `apns_token` partial UNIQUE index. App-layer guard works + today; defence-in-depth at the DB layer wants a follow-up migration + with a `CREATE UNIQUE INDEX … WHERE apns_token IS NOT NULL`. Source: + `phase-W6-v1423-security-review.md` MED-1. + +## LOWs (all 4 reviews, deferred) + +- **Sec-LOW-1** — intra-batch duplicates report `inserted` for both + rows (only 1 actually persists). Self-inflicted accuracy bug, no + cross-user impact. Fix: dedupe `prepared[]` by `${type}::${externalId}` + before the `existing` lookup; add regression test in + `tests/integration/measurements-batch.test.ts`. +- **Sec-LOW-2** — `withIdempotency` caches the 422 "batch too large". + Documented contract; surface a "retry with fresh key" hint in the + error message + OpenAPI 422 description. +- **Sec-LOW-3** — APNs key-file read failure leaks the absolute path + into the wide-event payload. Replace `${message}` with redacted + `meta: { errno: err.code }`. +- **Sec-LOW-4** — `auth.token.refresh.failed` audit row omits `userId` + even when resolvable (`already_used`/`expired`/`revoked` paths know + the row). Extend `RotationResult.failure` to carry the resolved + userId. +- **Code-review LOWs** — see `phase-W6-v1423-code-review.md` for the + full list (style nits, missing JSDoc on 2 helpers, unused import in + `coach-drawer.tsx`). +- **Senior-dev LOWs** — see `phase-W6-v1423-senior-dev-review.md`. +- **Design LOWs** — see `phase-W6-v1423-design-review.md`. +- **Product-Lead LOWs** — see `phase-W6-v1423-product-lead-review.md`. + +## Simplify deferrals + +- **S-05** — deferred from Session B; see Session B notes in + `phase-W6-v1423-reconcile-report.md` for rationale (touched too many + call sites for a v1.4.23 reconcile commit). + +## Test infrastructure + +- **`coach-prefs.test.ts` integration NextRequest URL mock issue** — + pre-existing failure flagged by Session A. Re-running with the + reconcile changes stashed reproduces the same failure, so the cause + predates v1.4.23. Needs investigation into how `NextRequest`'s URL + parsing interacts with the test harness's mocked `cookies()`. + +## Tooling / harness + +- **Sandbox `git commit` silent no-op** — Session H7 agent observed + `git commit` returning success without a SHA in sandboxed mode under + certain hook configurations. Candidate for a `.claude/settings.json` + permission tweak (allow `git commit` unconditionally OR add a + pre-flight `git status --porcelain=v1 -z` confirmation step).