Feat/phase10 public page coverage - #261
Merged
Merged
Conversation
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
…in dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state
…wPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case
…age-coverage # Conflicts: # docs/10_Execution_Tracking.md # docs/12_Phase10_PreLaunch_Gates.md
…age-coverage # Conflicts: # backend/tests/k6/README.md # backend/tests/k6/admin-dashboard.js # backend/tests/k6/availability-query.js # backend/tests/k6/concurrent-booking.js # backend/tests/k6/concurrent-search.js # backend/tests/k6/mixed-traffic.js # backend/tests/k6/payment-intent.js # docs/02_ADR_ENTERPRISE_FULL.md # docs/04_IDD_ENTERPRISE_FULL.md # docs/09_Implementation_Plan.md # docs/10_Execution_Tracking.md # docs/12_Phase10_PreLaunch_Gates.md # docs/handoffs/2026-05-17-220746-phase10-local-docker-load-validation-handoff.md
…merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions).
- Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected.
…ession - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main.
PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38
…l tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit.
…aunch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c01f76697c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | 9 | **Load Tests** | Concurrent booking simulation | 100 users, 0 double-booking | ✅ **LOCAL DOCKER BASELINE VERIFIED 18 May 2026** — booking flow passed locally in Docker after local startup inventory seed expansion, load-test session partitioning, and overlap-retry stabilization. Final k6 baseline completed with `http_req_failed 0.00%`, `http_req_duration p95 16.87ms`, and `9686` iterations. **PR #259 MERGED 2026-06-02** — closure commit landed on `main` via `merge: resolve origin/main conflicts for PR #259` (SHA `544613c`). | ✅ GO | | ||
| | 10 | **Security** | OWASP Top 10 scan | 0 critical/high | ✅ **HARDENED 10 May 2026** — No critical/high vulnerabilities found. Previously documented medium findings were closed: named CORS policy added, non-development security headers enabled, Swagger/OpenAPI gated to Development, `AllowedHosts` restricted, and default `AutoMigrateOnStartup=false`. Manual production-style boot with `Database__AutoMigrateOnStartup=true` returned `/health` 200 and `/openapi/v1.json` 404. | ✅ GO | | ||
| | 11 | **Security** | Dependency vulnerabilities | 0 critical/high | ✅ **FIXED 4 May 2026** — Backend: `dotnet list package --vulnerable` = 0. Frontend: `pnpm audit` = 0 (was 4 high + 6 moderate, resolved via `pnpm update` + `pnpm.overrides` for lodash, uuid, postcss, minimatch). | ✅ GO | | ||
| | 11 | **Security** | Dependency vulnerabilities | 0 critical/high | ✅ **FIXED 4 May 2026 + 2 June 2026** — Backend: `dotnet list package --vulnerable` = 0. Frontend: `pnpm audit` = 0 critical / 0 high (1 transitive moderate `brace-expansion` via `eslint-config-next > eslint-plugin-import > ... > minimatch` remains, deliberate follow-up — override or wait-for-parent, separate PR). **2 Dependabot critical vitest alerts closed 2 June 2026** via **PR #260** (merged SHA `220d602`, fix/security-vitest-2026-06-02 → main, vitest `^3.2.4 → ^4.1.0` for CVE-2026-47429 / GHSA-5xrq-8626-4rwp). Verification: `pnpm test` 190/190 PASS, `pnpm build` 0 error, `pnpm lint` 0 error. PR body archived at `docs/handoffs/2026-06-02-PR-260-fix-security-vitest-body.md`. | ✅ GO | |
There was a problem hiding this comment.
In this commit's tree, frontend/package.json still declares both vitest and @vitest/coverage-v8 as ^3.2.4, and the lockfile still resolves them to 3.2.4, so the CVE-2026-47429 fix described here is not present in the reviewed revision. Marking the dependency-vulnerability launch gate as ✅ GO and saying the critical Dependabot alerts are closed can let release readiness proceed while the vulnerable dependency is still shipped from this branch; either include the frontend package/lockfile bump in this change or keep this gate/status as pending.
Useful? React with 👍 / 👎.
Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177
chelebyy
pushed a commit
that referenced
this pull request
Jun 2, 2026
Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria.
chelebyy
added a commit
that referenced
this pull request
Jun 3, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 5, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 6, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path * fix(auth): prevent local admin dashboard login loop * fix(frontend): align admin fleet and pricing workflows * fix(fleet): show physical vehicles publicly with photos * fix(admin): make vehicle photo picker clickable * fix(public): prevent vehicle card price overlap --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 6, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path * fix(auth): prevent local admin dashboard login loop * fix(frontend): align admin fleet and pricing workflows * fix(fleet): show physical vehicles publicly with photos * fix(admin): make vehicle photo picker clickable * fix(public): prevent vehicle card price overlap * fix(fleet): price available vehicle groups Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(i18n): add booking flow messages Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * test(frontend): centralize next-intl mock Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize shared booking chrome Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize date selection step Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): resolve vehicle selection pricing Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize driver details step Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): preserve payment summary pricing Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 10 docs + working-tree cleanup follow-through. No code, no test, no contract surface changed.
Context
This branch (
feat/phase10-public-page-coverage→main, all 8/8 CI checks SUCCESS) is a docs + working-tree cleanup PR, not a feature/security PR. The dependency-vulnerability launch gate (gate #11) tracksmainHEAD state, not this PR's branch state — see the inline note added to gate #11 in this PR.What's in this PR
chore(phase10): finalize preserved working-tree state and ignore local tooling/resultsgit rm5 historical handoff files (May 2026, content superseded by surviving successor handoffs).gitignore: add.sisyphus/(local Sisyphus agent runtime) andbackend/tests/k6/results/(local k6 result JSONs, regenerable)docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11docs/12_Phase10_PreLaunch_Gates.mdgate deps(backend): Bump dotnet-ef from 10.0.0-rc.2.25502.107 to 10.0.3 #11: record PR fix(security): bump vitest to 4.1.x to address CVE-2026-47429 #260 MERGED + 1 transitivebrace-expansionmoderate remainingdocs/10_Execution_Tracking.md: new02.06.2026 | Follow-uprow for PR fix(security): bump vitest to 4.1.x to address CVE-2026-47429 #260 merge confirmationdocs/handoffs/2026-06-02-235900-...: new session handoff chained to predecessor2026-06-02-232800-...mainHEAD state, not the PR-branch state. The vitest bump lives in PR fix(security): bump vitest to 4.1.x to address CVE-2026-47429 #260's branch (already merged tomain); this PR is documentation sync only."Why gate #11 is ✅ GO even though this branch doesn't bump vitest
The 2 Dependabot critical vitest alerts (CVE-2026-47429 / GHSA-5xrq-8626-4rwp) were closed by PR #260 (
fix/security-vitest-2026-06-02, merged tomain2026-06-02T20:36Z, SHA220d602), independent of this PR. This PR's branch is intentionally docs-only — adding a vitest bump here would conflict with the lockfile state PR #260 already landed onmain.Deferred (out of scope, per user direction)
brace-expansionmoderate — separate follow-up PR withpnpm.overridesrationale🤖 Generated with Claude Code