diff --git a/docs/audits/verification-log.md b/docs/audits/verification-log.md index 54600b8..cb68db0 100644 --- a/docs/audits/verification-log.md +++ b/docs/audits/verification-log.md @@ -168,3 +168,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un | V-134 | Focused `EmailSendControllerTests|EmailSendAttemptStoreTests|EmailControllerTests`; full backend; staged diff/secret-name/whitespace review | Repository root | Verify explicit confirmation, bounded input, owner isolation, canonical idempotency, rate-limited provider admission, correspondence/audit transaction and failed/uncertain behavior | PASS — focused 12/12; full backend 619/619; no whitespace errors or secret values. Provider called once across duplicate requests; cross-tenant/unconfirmed/malformed requests never reserve or deliver | SQLite and fake provider only. No real provider/email/network/browser/production execution. Crash-abandoned `sending` reconciliation remains | External provider/runtime limitation | | V-135 | Focused correspondence-inbox Jest; full frontend Jest; `npm.cmd run build`; `git diff --check` | `job-tracker-ui` / repository root | Verify editable provider-bound reply, visible review fields, confirmation/cancel, one UUID, sent/uncertain duplicate safety, responsive TypeScript/build and regression hygiene | PASS — focused 7/7; full 49/49 suites and 190/190 tests; production build; no whitespace errors | JSDOM and mocked API/provider data only; no running browser/provider/email. Full Jest took 75.632s and retained the existing force-exit/open-handle notice | Browser/provider/production limitation | | V-136 | Focused `EmailSendAttemptStoreTests|EmailSendControllerTests`; full backend; provider-dependency search; `git diff --check` | Repository root | Verify restart recovery, stale/fresh boundary, pending-failed versus sending-uncertain classification, two-owner notification isolation, idempotency and absence of provider retries | PASS — focused 10/10; full backend 620/620; repeated recovery 0/0; each owner sees one content-free notification; recovery code has no provider/SMTP dependency; no whitespace errors | Real SQLite and manual clock; no process kill, MariaDB, provider, email or production runtime. Five-minute scan performance is unmeasured on a large ledger | Runtime/performance limitation | +| V-137 | `npm.cmd ls react-router-dom react-router js-yaml nanoid --all --depth=4`; `npm.cmd audit`; six focused router suites; full `npm.cmd test -- --runInBand`; `npm.cmd run build`; staged diff review | `job-tracker-ui` / repository root | Resolve the frontend advisory gate without an unreviewed forced update and verify the React Router v7 compatibility path | PASS — audit reports 0 vulnerabilities; focused 6/6 suites and 24/24 tests; full 49/49 suites and 190/190 tests; production build/TypeScript/static generation pass; `b55a592` pushed | CI/live deployment has not yet consumed the pushed commit; no deployment or production access occurred | Deployment verification pending | diff --git a/docs/verification/dep-001-frontend-advisories.md b/docs/verification/dep-001-frontend-advisories.md new file mode 100644 index 0000000..ecb24a2 --- /dev/null +++ b/docs/verification/dep-001-frontend-advisories.md @@ -0,0 +1,34 @@ +# DEP-001 frontend advisory remediation + +Updated: 2026-08-10 + +Status: `VERIFIED LOCALLY`. The repository fix is pushed; CI and live deployment verification remain. + +## Trigger + +The live deployment pipeline failed its frontend dependency audit on five advisories: React Router/@remix-run/router, js-yaml and nanoid. + +## Resolution + +- Upgraded `react-router-dom` from the vulnerable 6.x line to `7.18.2`, covering the subsequently reported React Router advisories. +- Refreshed transitive `js-yaml` from `3.15.0` to `3.15.1` and `nanoid` from `3.3.16` to `3.3.18` through normal lockfile resolution. +- Removed the obsolete v6 `RouterProvider` future flag. Existing route definitions and URLs were not redesigned. +- Supplied Node's `TextEncoder`/`TextDecoder` to Jest's jsdom environment for React Router v7 module initialization. +- Did not run `npm audit fix --force`; the explicit upgrade and resolved lockfile were reviewed. + +## Verification + +- `npm.cmd audit`: PASS, zero vulnerabilities. +- Focused data-router regression: 6 suites, 24 tests passed. +- Full frontend regression: 49 suites, 190 tests passed. +- `npm.cmd run build`: PASS, production compilation, TypeScript and static generation. +- Resolved versions: `react-router-dom`/`react-router` `7.18.2`, `js-yaml` `3.15.1`, `nanoid` `3.3.18`. +- Commit: `b55a592` (pushed to `release-readiness`). + +## Remaining gate + +Confirm the repository CI dependency-audit job and subsequent live deployment complete from the pushed commit. No production access or deployment was performed in this session. + +## Rollback + +Reverting `b55a592` restores the previous router/test setup but also restores known vulnerable packages and the deployment-blocking audit result. Prefer fixing any v7 compatibility regression forward; do not suppress the audit without a reviewed exception. diff --git a/docs/work-programmes/decisions.md b/docs/work-programmes/decisions.md index 7e679c6..f6c65c9 100644 --- a/docs/work-programmes/decisions.md +++ b/docs/work-programmes/decisions.md @@ -449,3 +449,13 @@ - **Consequences:** interrupted sending requires manual Sent-folder review. Multiple replicas may select the same candidate, but the status predicate allows only one update/notification. The five-minute query intentionally avoids a new migration in this increment; large-ledger performance remains a measured rollout check. - **User approval required:** No; this is local safety recovery with no provider/external call. - **Reversible:** Yes. Revert `ee5ef7e`; existing terminal states and notifications remain truthful and should not be rewritten. + +## DEC-046 — Resolve the audit gate with supported patches, then the smallest router major + +- **Date:** 2026-08-10 +- **Decision:** Update transitive js-yaml/nanoid within their existing major lines and move React Router to 7.18.2 because the later two React Router advisories have no patched 6.x release. Adapt only the obsolete RouterProvider flag and Jest encoding globals; keep the existing route model. +- **Reason/evidence:** 6.30.4 fixed the originally reported protocol-relative redirect but remained affected by two newer advisories, so `npm audit` still failed. React 19 and Node 22 satisfy v7 requirements. Audit, focused data-router tests, all frontend tests and the production build pass on 7.18.2. +- **Alternatives considered:** `npm audit fix --force` without review; suppress moderate findings; stay on 6.30.4; redesign routing. These either hide the resolution, leave the deployment gate red or expand scope unnecessarily. +- **Consequences:** the frontend now requires Node 20 or later through React Router v7. CI/live deployment and navigation smoke remain required before `DONE`. +- **User approval required:** Yes; the user explicitly requested repair of the reported live deployment audit failure and continuation. +- **Reversible:** Technically yes by reverting `b55a592`, but that restores known advisories and the failed gate. Prefer a forward compatibility fix if a deployment-only issue appears. diff --git a/docs/work-programmes/master-progress.md b/docs/work-programmes/master-progress.md index 614bd77..5b12521 100644 --- a/docs/work-programmes/master-progress.md +++ b/docs/work-programmes/master-progress.md @@ -2,18 +2,18 @@ Updated: 2026-08-10 -- **Overall programme status:** Active. Six packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with eight implementation increments. -- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); routing/reads/detail, ledger, Gmail/Graph delivery/re-consent, safe send API/UI and cross-owner-safe interrupted-attempt recovery are committed. Legacy-send retirement and remaining hub actions remain. +- **Overall programme status:** Active. Seven packages are locally verified; nineteen packages through CAREER-002 are implemented with automated/runtime evidence but blocked from applicable browser/provider/production gates; MAIL-001 is in progress with eight committed implementation increments. DEP-001 removed the frontend advisory deployment gate locally and is pushed for CI/live verification. +- **Current work package:** `MAIL-001` — consolidated job-email hub and explicit sending (`IN PROGRESS`); routing/reads/detail, ledger, Gmail/Graph delivery/re-consent, safe send API/UI and cross-owner-safe interrupted-attempt recovery are committed. Legacy-send retirement is implemented and validated in the working tree; tracking/commit remain before the next hub action. - **Completed work packages:** None are `DONE`; all repository security/AI packages still have applicable browser, provider and/or production gates. -- **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001 and PROD-002 (`VERIFIED LOCALLY`). +- **Locally verified work:** SEC-001, SEC-002, SEC-003, SEC-005A, CORE-001, PROD-002 and DEP-001 (`VERIFIED LOCALLY`). - **Implemented, verification incomplete:** SEC-004, SEC-005B, SEC-008, CORE-002, BG-001, OPS-001A/B/C, POL-001/002, AI-001/002/003/004, UX-001/002, QA-001, CAREER-001 and CAREER-002 (`IMPLEMENTED — NOT VERIFIED`). CAREER-002 now protects unsaved edits and provides tested structured custom-entry, profile-override and preview-error interactions; all automated/build gates pass. - **Production-verified work:** None. -- **Blocked work:** SEC-006 requires explicit internet/package-index permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; the in-app browser is available for local UI checks. +- **Blocked work:** SEC-006 parser upgrades remain outside the scoped frontend advisory permission; PROD-001/003/004 and REL-001 require documented production access and unfinished dependencies. Real provider, SMTP/MariaDB and production environments are unavailable; DEP-001 awaits CI/live confirmation. The in-app browser is available for local UI checks. - **Deferred work:** None. Conditional multi-replica coordination, model deletion, realtime operation delivery and unrelated production changes remain outside current packages. - **Next five work packages:** MAIL-001 consolidated email experience; JOBS-001 job-search/application redesign; HOME-001 homepage/Pro promotion; UX-003 authentication/profile polish; PRODUCT-001 homepage/Pro claims. SEC-006/007 resume after package-index permission. -- **Status counts:** 6 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`. -- **Test status:** backend 620/620; frontend 49/49 suites and 190/190 tests; MAIL-001 recovery/send focused 10/10, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5; migration rehearsal and production build pass. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135. -- **Deployment status:** No deployment performed. No production migrations were run. AI operation worker remains disabled by default. +- **Status counts:** 7 `VERIFIED LOCALLY`; 19 `IMPLEMENTED — NOT VERIFIED`; 1 `IN PROGRESS`; 8 `NOT STARTED`; 5 `BLOCKED`; 0 `DONE`; 0 `DEFERRED`. +- **Test status:** backend 621/621; frontend 49/49 suites and 190/190 tests; npm audit 0 vulnerabilities; DEP-001 focused router 24/24 and production build pass; MAIL-001 recovery/send focused 10/10, legacy follow-up/backend worker 10/10, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5 and hub detail 5/5. Jest open-handle/slow-run behavior is recorded in V-127/V-128/V-130/V-131/V-135. +- **Deployment status:** `b55a592` is pushed to remove the frontend audit blocker; remote CI/live result is pending. No deployment was performed directly, no production migrations were run and the AI operation worker remains disabled by default. - **Production status:** Unchanged and unverified. No provider/model call, model pull, external request or paid API occurred. - **Known regressions:** None found by automated suites. Jest still needs `--forceExit` and reports its existing open-handle notice. Email-provider/send tests are fake/local only; real delivery is not claimed. Interrupted attempts are aged after 15 minutes and notified without retry; the five-minute scan is unmeasured on a large ledger. Direct clean EF-only SQLite migration still hits the pre-existing historical blank-chain defect before later migrations; normal startup owns reconciliation. Cross-feature monthly AI usage accounting remains a rollout gap. - **Outstanding security findings:** JT-001 repository ownership remains High deployment risk until migration/inventory/provider checks; production portion of JT-002; JT-006/JT-009 and associated JT-011/JT-012/JT-022 prerequisites. JT-005 foundations are implemented; AI worker activation awaits controlled rollout. JT-007/JT-008/JT-010 lack browser/provider/production verification. diff --git a/docs/work-programmes/master-work-plan.md b/docs/work-programmes/master-work-plan.md index 6083120..b565aeb 100644 --- a/docs/work-programmes/master-work-plan.md +++ b/docs/work-programmes/master-work-plan.md @@ -745,6 +745,24 @@ Ordering differences from the suggested list: - **Commit:** none. - **Remaining work:** create early and update per package; final sweep last. +### DEP-001 — Frontend advisory deployment gate + +- **Source programme:** live deployment blocker reported 2026-08-10; audit supply-chain finding. +- **Original requirement references:** user deployment failure report; JT-017. +- **Related findings:** JT-017. +- **Priority:** P0 release blocker. +- **Dependencies:** none for repository remediation; CI/live access for final verification. +- **Affected components:** `job-tracker-ui/package.json`, lockfile, RouterProvider compatibility and Jest jsdom setup. +- **Acceptance criteria:** npm audit is clean without suppressing advisories; production build and route regressions pass; CI consumes the fixed lockfile; live deployment proceeds. +- **Required tests:** resolved dependency tree, `npm audit`, focused router tests, full frontend tests and production build. +- **Required browser verification:** route/navigation smoke after deployment; existing automated route coverage is required before push. +- **Required production verification:** CI audit and live deployment from the fixed commit. +- **Status:** `VERIFIED LOCALLY`. +- **Blocker:** final deployment verification depends on the remote CI/live environment. +- **Evidence:** `docs/verification/dep-001-frontend-advisories.md`; V-137; audit 0 vulnerabilities, focused 24/24, full 190/190 and production build pass. +- **Commit:** `b55a592` (pushed). +- **Remaining work:** observe CI/live deployment, run route smoke and update to `DONE` only after production verification. + ### REL-001 — Production validation and remaining audit closure - **Source programme:** both final reports and production validation. diff --git a/docs/work-programmes/session-handoff.md b/docs/work-programmes/session-handoff.md index d2b4c37..723ae82 100644 --- a/docs/work-programmes/session-handoff.md +++ b/docs/work-programmes/session-handoff.md @@ -2,17 +2,17 @@ Updated: 2026-08-10 -- **Exact current task:** MAIL-001 — retire or route the legacy follow-up SMTP boundary through the safe provider-send path without breaking draft generation or reminders. -- **Last completed step:** five-minute post-readiness recovery was committed as `ee5ef7e`; attempts older than 15 minutes become failed-before-delivery or uncertain, each owner receives one content-free notification, and no provider retry occurs. -- **Files currently modified:** MAIL-001 verification/log/master tracking documents only. Application code/tests are committed. -- **Commands already run:** complete provider/send trace; read/detail/ledger/delivery/send/composer/recovery focused tests; full backend/frontend; TypeScript build; EF provider migration rehearsal; eight implementation commits. See V-126–V-136. -- **Test results:** MAIL-001 recovery/send 10/10, composer 7/7, delivery/capability 18/18, provider/correspondence 5/5, hub detail 5/5; backend 620/620; frontend 49/49 suites and 190/190 tests; migration/model/build gates pass. +- **Exact current task:** MAIL-001 — commit/push the validated retirement of the legacy follow-up SMTP boundary, then continue the next dependency-correct hub increment. +- **Last completed step:** frontend dependency remediation was committed/pushed as `b55a592`; React Router 7.18.2 plus patched js-yaml/nanoid resolve the deployment audit locally with zero vulnerabilities. +- **Files currently modified:** MAIL-001 legacy-send controller/UI/tests plus DEP-001 and current tracking documents. Dependency application files are committed. +- **Commands already run:** dependency tree/advisory review; `npm audit`; six focused router suites; full frontend; two production builds; legacy follow-up/backend worker focused tests; full backend; focused legacy UI. See V-126–V-137; legacy evidence is pending V-138. +- **Test results:** npm audit 0 vulnerabilities; router focused 24/24; frontend 49/49 suites and 190/190 tests; production build passes. MAIL-001 legacy follow-up/backend worker 10/10, focused UI 2/2 and backend 621/621 passed before the dependency upgrade; full frontend/build also pass with both working-tree changes present. - **Services currently running:** none started intentionally. Exact task-owned hung Jest/build Node processes were stopped; Codex browser runtimes were not touched. Pre-existing Docker services were not changed. - **Temporary files or processes:** none. No provider account, private email, external model, paid service or production service was accessed. - **Production changes currently active:** none. No deployment, migration, provider connection/sync/send or production payload occurred. - **Rollback status:** revert `ee5ef7e` to stop recovery, then `449faeb` to remove the composer; keep admission disabled before reverting `123fc55`/`e9937ac` and downgrade the ledger before reverting `653f011`. No production migration/deploy/provider grant occurred. -- **Uncommitted changes:** MAIL-001 evidence/tracking documents only; commit/push before the next application increment. -- **Known failures:** durable/new-message drafts, export coverage, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Legacy follow-up SMTP bypasses the new boundary. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 needs internet/package-index permission; parser isolation remains SEC-007. -- **Exact next action:** commit/push this evidence, then trace every `SendFollowUp` caller and split draft generation/reminder behavior from delivery; disable or route any user-facing SMTP delivery through the explicit-confirmed provider boundary without changing scheduled notification email. +- **Uncommitted changes:** MAIL-001 legacy-send application/tests and DEP-001/tracking evidence. Stage by work package; do not mix them. +- **Known failures:** durable/new-message drafts, export coverage, full thread/category actions and non-Gmail review remain; existing accounts need re-consent and IMAP stays read-only. Browser/provider/MariaDB/production unavailable or unverified; recovery scan performance is unmeasured at large ledger scale; Jest open handles; SEC-006 parser dependency work is still separately gated; parser isolation remains SEC-007. DEP-001 still needs remote CI/live confirmation. +- **Exact next action:** commit/push DEP-001 evidence, then review/stage/commit/push the validated legacy follow-up retirement and its V-138 evidence without including unrelated changes. - **Work that can continue independently:** remaining MAIL-001 repository work and later UX packages. SEC-006/007 await package-index permission; PROD-001/003/004 await production access. - **Decisions still required from the user:** none for synthetic/code-inspected repository work. Any provider connection or send test, internet/package upgrades, private data, external/paid providers and production actions retain explicit approval/safety gates; SEC-009 retention/legal policy remains unresolved.