From cabafa529903dc10ff63275d6c4e664878cebfd2 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Tue, 10 Nov 2026 12:49:02 +0100 Subject: [PATCH] docs(roadmap): record admin security and launch checkpoints --- docs/direct-roadmap/LATEST_CHECKPOINT.md | 19 +++++++++++++++++++ docs/direct-roadmap/NEXT_ACTIONS.md | 6 +++--- docs/direct-roadmap/ROADMAP_STATUS.md | 4 ++-- 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/docs/direct-roadmap/LATEST_CHECKPOINT.md b/docs/direct-roadmap/LATEST_CHECKPOINT.md index 01887d8a..d575743e 100644 --- a/docs/direct-roadmap/LATEST_CHECKPOINT.md +++ b/docs/direct-roadmap/LATEST_CHECKPOINT.md @@ -1,5 +1,24 @@ # Direct execution continuation +## 10 November continuation and owner addendum + +Owner authorised `E:/Storage/Projects/Active/temp docs/final/additional`. Read the full A3 refinement and EUROPE-READY-01 prompt, SHA-256 `5aaefea0e2fde342fd78917d0b9d9eb38c873d902095bdaa4389c9bb6d83397d`, and inspected the three supplied screenshots. The authoritative addition is mapped in `docs/ui-modernisation/REFINEMENT_AND_EUROPE.md` on the integration branch. The `0bb722672520f2fea79d42fe3412bb58de104945` coverage companion uses the same 59 I18N candidate codes and records separate geography, map, provider, locale and release dispositions. No country or extra locale qualified for release. + +- **Phase 10** published full local receipt `6f57a37abbd1748484473ff9178ba9991e82eaef` on `feature/phase10-cleanup`, independently read back. Passed 1,448 backend and 1,031 frontend cases (112 suites), separately. Both raw hashes and compressed reports are in P10-05. Independent audit, full preservation closure and source-defined environment/human gates remain open. No additional removal approved. +- **Security** published `ecadc29bbee69d097ef425715b2007bac825fe11` on `codex/security-offline-preflight`, independently read back. Source/test commit `d4c486681ad51424bfd33545d518e87193ffbc56` omits imported reply subjects from Admin Audit while preserving the owner's stored event and operational metadata. Red HTTP fixture reproduced disclosure. Final 62 cases passed, including A/B notification reads/counts/foreign writes and role enforcement. The exact controller and test delta is also published on A3 at `2033aea31b4ffc90db8c9d28471355fff7b26b65` with 57 selected backend tests. These runs overlap. No permission expansion, live access or formal scan. `MFA_RECOVERY_PROPOSAL.md` contains the source findings and approval-gated design. +- **A3** published through `bd34a3504f7e849c41b48db444f0e1f16324a16f` on `codex/a3-ui-10`, independently read back. Earlier same-branch receipts: `e585561a` follow-up/agenda, `71c927b1` Admin heading hierarchy, `f79024df` mail review/409, `2af15025` audit timestamp/density, `91e5a6bf` EN/NB Gmail count wording, `511945b4` Settings privacy recovery. Source-bound scope, individual counts and exclusions are in the IM10 visual-correction reports. No owner acceptance promoted. +- **Launch** current public root rendered baseline is in `bd34a350` on the integration branch. 12 navigation fixtures at phone/tablet/desktop in EN/NB and themes passed. All 12 show landmark best-practice findings, no raw hero/canonical/hreflang, and 24 anonymous language writes were rejected. The dashboard mockup address was anonymised in the captured fixture only. The final visual/claims design remains separate. +- **Discover search-first** published at `99a2b6f4f641b5828e6309112eeb39489c0c015f` and independently read back. Runtime `0540e84ff6d5106946b481a2e24484d0b0898583`. 26 native cases, type-check, lint, build and 108 rendered states across 36 configurations passed. The exact query/municipality request and keyboard disclosure were checked. Existing provider matches title/company and a location string. No canonical country, map, skill search or new provider capability added. + +- **Applications** published `252759f420d35a97696873432751bc3884565cd7`. Title-first layout, explicit selection and EN/NB preparation label passed 57 tests, types, lint, build and 72 captures/scans. Secondary actions remain open. +- **Admin Users alignment** published `d6e5a45ba2243141b4aec79c76d33c4adc524ba5`. 12 selected tests and 36 responsive states passed. The maximum desktop offset dropped from 14 to 0.5 px. +- **System Status** published `13c9c65352b0fabc56efdbb4cec7c4ad7e34c3a3`. 20 selected tests and 108 captures/scans passed. The last successful browser read remains visible on a failed refresh. The isolated diagnostic suite design is recorded separately. Existing production benchmark dispatch was never invoked. +- **Admin Users account status** published `2717c6afaf6375e2e1abd7d63cbfa613a802ce83`. 7 backend and 14 frontend tests, lint, build and 36 responsive states passed. Admin-only status is read-only and an older response shows unavailable. Recovery actions remain protected. A Git local maintenance warning reported long Codex ref paths. Commit verification and independent remote readback succeeded. +- **Launch audit** published `98483b804a2d327ca6ca6d1e5cd17669bb968b05` on `feature/launch-site-redesign`. It reconciles the 12 previously executed rendered states with the design-neutral launch record. The four high-fidelity concept pairs and final visual approval remain open. +- **Support access** proposal `4328edbdae53106ba20ac07e0aa7fa6e366cd451` was published and read back on `codex/security-offline-preflight`. Consent-based access is still a design proposal, with no expanded access. + +All branch receipts above were independently read back. Next, continue the remaining compact user/application actions, audit usability and launch concept inputs. Preserve the separate decisions for MFA recovery, private support access, new provider activation, diagnostics execution, bookmarklet retirement, final A3, integrated security and release acceptance. The orchestrator remains paused. No main merge or deployment. + **P10-05 full local backend and frontend lanes passed at source `39aac4f404cc19bead83b719fbf372de87f965ff`.** Backend passed 1,448 of 1,448 in Release with pinned SDK 9.0.317. Frontend passed 1,031 of 1,031 across 112 suites. Both native runs exited 0. Exact native receipts and scope in [P10-05](../redesign/phase-10/P10-05.md). Live AI/corpus, device/human, hosted and recovery qualification remain separate. Phase 10 acceptance and independent audit remain open. **Published A3-IM10 checkpoint `71c927b15bdea7c41d76dee084baf05af6f703cd`**, independently matched on `codex/a3-ui-10`. Runtime `c7e8627ca782b37ed553299a1db93af192e420e4` removes duplicate headings across four Admin routes. 66 targeted Jest tests, type-checking, lint, build, 36 controlled configurations and 324 browser captures/axe scans passed. No writes, export requests, page errors or axe violations. The 144 intentional System 503s and 216 unavailable company reads are recorded separately. 1,472 committed/source/export checks passed. See `ADMIN_HEADINGS_REVIEW.md`. The 768 px Bokmål audit screenshot exposed separate timestamp wrapping, tracked as V25. Remaining Admin action/error/permission states are open. diff --git a/docs/direct-roadmap/NEXT_ACTIONS.md b/docs/direct-roadmap/NEXT_ACTIONS.md index 47cf28d2..0f1c852d 100644 --- a/docs/direct-roadmap/NEXT_ACTIONS.md +++ b/docs/direct-roadmap/NEXT_ACTIONS.md @@ -1,11 +1,11 @@ # Next eligible actions -9 November 2026. +10 November 2026. 1. Continue P10-05 qualification on the frozen cleanup branch. CLEAN-20 is published. Reconcile full local regression, source-bound evidence and the 57 preservation groups. Further removal requires its own proven candidate and approval. -2. Continue approved A3-IM10 on `codex/a3-ui-10`. Use the route and discrepancy registers for correspondence, Settings, import and admin states. Prepare final Gate F once visual, workflow and regression evidence is reviewable. +2. Continue approved A3-IM10 from published `2033aea3` on `codex/a3-ui-10`. Next eligible slices include compact admin/application actions and audit filtering and expansion. Use the route and discrepancy registers for remaining correspondence, Settings and import states. Prepare final Gate F once the visual, workflow and regression evidence is reviewable. 3. Continue independently eligible localisation on its isolated branch. The 188 historical dynamic calls are accounted for. Prioritise contextual display coverage and automated locale checks. Native and additional locale publication gates remain open. -4. Continue design-neutral launch preparation and eligible offline security/recovery work on their existing branches. RR-11 is fixed and tested offline. Preserve launch design/claims decisions, integrated security scope, and approved recovery environment requirements. +4. Continue launch audit inputs and prepare four desktop/mobile concept pairs from `98483b80`. Continue eligible offline security/recovery work on the existing branches. RR-11 is fixed and tested offline. Preserve launch design/claims decisions, integrated security scope, and approved recovery environment requirements. 5. Keep Product Review findings provisional until Phase 10 acceptance. Reuse the published GJ-00 pack. GJ-01 awaits the accepted predecessors, implementation scope and provider rights. Use [the latest checkpoint](LATEST_CHECKPOINT.md) and branch-specific handoffs to resume. The orchestrator remains paused. Keep pre-p10-ux and unrelated work intact. Publication belongs on the relevant development branch. diff --git a/docs/direct-roadmap/ROADMAP_STATUS.md b/docs/direct-roadmap/ROADMAP_STATUS.md index 0a7c6704..01ea3370 100644 --- a/docs/direct-roadmap/ROADMAP_STATUS.md +++ b/docs/direct-roadmap/ROADMAP_STATUS.md @@ -1,6 +1,6 @@ # Direct roadmap status -Updated 9 November 2026. This register records direct-chat work. See [the continuation checkpoint](LATEST_CHECKPOINT.md) for exact integration refs and evidence. +Updated 10 November 2026. This register records direct-chat work. See [the continuation checkpoint](LATEST_CHECKPOINT.md) for exact integration refs and evidence. | Workstream/checkpoint | Status | Dependency and evidence | | --- | --- | --- | @@ -16,7 +16,7 @@ Updated 9 November 2026. This register records direct-chat work. See [the contin | INT-GLOBAL-JOBS-01 implementation | BLOCKED | Accepted Phase 10/Product Review, initiative approval and provider rights | | I18N-01 / I18N-00 audit | PARTIAL | All 188 historical dynamic call reviews accounted for in published `4172c23d`. Full visible-text, native, market and European coverage remain open | | I18N-01–08 implementation/acceptance | PARTIAL | Bounded EN/NB improvements tested and published. Later stage prerequisites, native review and additional locale publication remain separate | -| LAUNCH-SITE-01 / LAUNCH-00 audit | PARTIAL | Design-neutral content, locale and crawlable HTML/SEO contracts published at `af8c48ce`. Rendered design and public claims decisions remain open | +| LAUNCH-SITE-01 / LAUNCH-00 audit | PARTIAL | Design-neutral contracts at `af8c48ce` and rendered baseline reconciliation at `98483b80`. Design research, asset rights and public claims remain open | | LAUNCH-01 four desktop/mobile concepts | PENDING | No viewable concepts produced; eligible independent task after completing audit inputs | | LAUNCH-SITE final design/implementation | AWAITING_APPROVAL | Four concrete concepts must be delivered before owner selection; no final design auto-selection | | SECURITY-AUDIT-01 | OFFLINE PREFLIGHT PARTIAL | Approved root policy published at `de3d5031`. Formal integrated scan requires a completed application baseline and applicable environment/cost approval |