deps(backend): Bump MockQueryable.EntityFrameworkCore from 7.0.0 to 10.0.2 - #38
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
…0.0.2 --- updated-dependencies: - dependency-name: MockQueryable.EntityFrameworkCore dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
Superseded by #40. |
dependabot
Bot
deleted the
dependabot/nuget/backend/tests/RentACar.Tests/MockQueryable.EntityFrameworkCore-10.0.2
branch
March 9, 2026 21:12
chelebyy
pushed a commit
that referenced
this pull request
Jun 2, 2026
PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38
chelebyy
added a commit
that referenced
this pull request
Jun 2, 2026
Two Dependabot critical alerts on main: - #37 (frontend/package.json): vitest < 4.1.0 - #38 (frontend/pnpm-lock.yaml): vitest < 4.1.0 Both point to GHSA-5xrq-8626-4rwp / CVE-2026-47429: 'When Vitest UI server is listening, arbitrary file can be read and executed.' Resolved by bumping: - vitest: ^3.2.4 -> ^4.1.0 (resolved 4.1.8) - @vitest/coverage-v8: ^3.2.4 -> ^4.1.0 (resolved 4.1.8) Vitest 4.1.x prerequisites (already met): - Vite >= 6.4.0 (we have 7.3.2) - Node >= 22.12.0 (we have v24.13.0) Verification: - pnpm audit: 0 critical, 0 high (1 transitive moderate brace-expansion in eslint chain, out of scope for this PR) - pnpm test: 190/190 PASS (46 files, 21.38s) - pnpm build: 0 error - pnpm lint: 0 error (1 pre-existing warning in SearchForm.test.tsx) Vitest 4.0 migration: poolMatchGlobs and environmentMatchGlobs removed (use projects config instead). Our vitest.config.ts uses neither, no config change required. Refs: GHSA-5xrq-8626-4rwp, CVE-2026-47429, Dependabot #37, #38 Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com>
chelebyy
added a commit
that referenced
this pull request
Jun 2, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 3, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 5, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 6, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path * fix(auth): prevent local admin dashboard login loop * fix(frontend): align admin fleet and pricing workflows * fix(fleet): show physical vehicles publicly with photos * fix(admin): make vehicle photo picker clickable * fix(public): prevent vehicle card price overlap --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
chelebyy
added a commit
that referenced
this pull request
Jun 6, 2026
* test(frontend): restore SearchForm showPicker teardown Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * feat(phase10): close payment/reservation module thresholds, start admin dashboard coverage - Add 8 tests to PaymentServiceTests (Hold→PendingPayment, invalid state, missing 3DS, deposit capture failure, GetPaymentStatus) - Add 9 tests to ReservationServiceTests (distributed lock, no-vehicle, overlap, blank/missing/non-succeeded intent, extend-hold negative paths) - Create DashboardPage.test.tsx for admin dashboard (3 tests: loading, loaded, empty state) - Update docs/12_Phase10_PreLaunch_Gates.md: payment row 4 → GO (91.71%), reservation row 5 → GO (82.47%), summary 10/22 GO - Update docs/10_Execution_Tracking.md: backend section, KPI row, footer - Add session handoff for 17 May state * fix(tests): codex review fixes - reservation overlap mock param + showPicker teardown - ReservationServiceTests: pass reservationId as exclude param in overlap mock (matches actual CreateHoldAsync call) - SearchForm.test.tsx: use Reflect.deleteProperty instead of undefined assignment for absent showPicker case * test(phase10): expand admin reservations coverage * docs(phase10): add admin reservations PR handoff * test(phase10): lift frontend coverage past 25 percent * test(phase10): expand admin coverage toward launch gate * docs(phase10): add pr230 coverage handoff * test(phase10): close frontend coverage gate * docs(phase10): align frontend coverage completion notes * fix(phase10): stabilize local docker load validation * fix(phase10): restore reservation service unit tests * fix(phase10): scope reservations and stabilize smoke checks * docs(phase10): verify local docker load validation * fix(phase10): address codex review comments * fix(phase10): preserve reservation tracking on by-id lookup * docs(phase10): close local load baseline * fix(test): align rate limiting reflection test * fix(phase10): move concurrent booking seed to startup * fix(phase10): address load-baseline review follow-up * docs(phase10): archive PR #259 load-baseline closure body and record merge - docs/handoffs/2026-05-18-PR-235-load-baseline-closure-body.md: tracked archival of the PR body used to open PR #235 / merge PR #259. - docs/12_Phase10_PreLaunch_Gates.md: gate #9 (Concurrent booking simulation) now records PR #259 MERGED 2026-06-02 with merge SHA 544613c, on top of the 18 May 2026 local Docker baseline verification. - docs/10_Execution_Tracking.md: 02.06.2026 follow-up delivery entry added, recording the merge confirmation, branch sync state (0 ahead / 0 behind), and the gh pr view evidence. - docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md: new 'Follow-up — PR #259 MERGED 2026-06-02' section preserves the authoritative post-merge state and the working-tree preservation rules (no .sisyphus/, no k6/results/, no restore of the 5 historical handoff deletions). * docs: restructure CLAUDE.md to delegate to AGENTS.md - Project overview and design-context sections removed from CLAUDE.md; the canonical architecture/conventions/design/security rules already live in AGENTS.md. - CLAUDE.md kept lean and focused on session-tooling rules + day-to-day commands (backend/frontend/single-test invocations), per the existing 'This file covers session-tooling rules' intent. - Header pointer added at the top directing readers to AGENTS.md for full guidelines. - This is a tooling-only change; no code, no contracts, no test surface affected. * docs(handoff): archive 2026-06-02 paperwork + CLAUDE.md restructure session - docs/handoffs/2026-06-02-225758-phase10-pr259-merge-paperwork-and-claudemd-restructure.md: new handoff record for this session's work. - Captures the post-merge state after PR #259 landed: 2-commit split (46735ea phase10 docs + 5f4c406 CLAUDE.md restructure), branch sync verified 0 ahead / 0 behind, working-tree preservation rules, and the surfaced-but-deferred Dependabot 2-critical follow-up. - Chained to docs/handoffs/2026-05-18-022152-phase10-load-baseline-complete-and-docs-sync.md (predecessor), does not supersede it. Predecessor gained a '## Follow-up' section in commit 46735ea. - Manual validation: 0 TODO placeholders, all required sections present, no secrets, all referenced files exist. Skill scripts/validate_handoff.py was unavailable at validation time (sandbox/ephemeral); manual checks replicate the script's criteria. - First-action item for the next session: triage the 2 critical Dependabot alerts on main. * docs(phase10): archive PR #260 body and record Dependabot vitest CVE fix PR #260 (fix/security-vitest-2026-06-02, OPEN) bumps vitest and @vitest/coverage-v8 from ^3.2.4 to ^4.1.0 to address two Dependabot critical alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp): - #37: frontend/package.json vitest < 4.1.0 - #38: frontend/pnpm-lock.yaml vitest < 4.1.0 Resolves the 'Pending Work' item #1 surfaced in the predecessor handoff (2026-06-02-225758-...). Verification recorded in PR #260 body (also archived): - pnpm audit: 0 critical, 0 high - pnpm test: 190/190 PASS - pnpm build: 0 error - pnpm lint: 0 error Out of scope (deliberately deferred): - 1 transitive moderate brace-expansion (eslint chain) — separate fix path; future PR with override rationale - 9 DEFERRED Phase 10 launch gates (Dokploy-dependent, user-deferred) The PR #260 branch is fix/security-vitest-2026-06-02; CI is in progress. It will land on main independently of feat/phase10-public-page-coverage when merged; Dependabot auto-closes alerts #37 and #38 on merge. Working-tree state preserved per predecessor handoff rules: - 5 deleted historical handoffs (D) remain uncommitted - .sisyphus/ and backend/tests/k6/results/ remain untracked Refs: PR #260, CVE-2026-47429, GHSA-5xrq-8626-4rwp, Dependabot #37 + #38 * chore(phase10): finalize preserved working-tree state and ignore local tooling/results Working-tree preservation rule (set by docs/handoffs/2026-05-18-022152-... and preserved through 2026-06-02-225758-... + 2026-06-02-232800-...) held 5 historical handoff deletions in D status pending explicit user direction. The user's 'dokploy,canlıya alma hariç kalan işlemleri bitir' instruction this session is that direction. - git rm 5 historical handoffs (May 2026) — content fully superseded by the surviving 2026-05-17-... and 2026-06-02-... handoff chains (verified by cross-reference) - .gitignore: add .sisyphus/ (Sisyphus agent runtime dir, local only) - .gitignore: add backend/tests/k6/results/ (6 local k6 result JSONs from 17-18 May 2026 smoke runs, regenerable) No code, no test, no contract surface changed. Per project 'no mixed concerns' rule, this commit is logically separate from the docs paperwork sync that follows in the next commit. * docs(phase10): sync PR #260 paperwork, add session handoff, refresh launch gate #11 PR #260 (fix/security-vitest-2026-06-02, MERGED 2026-06-02T20:36Z, SHA 220d602) closed the 2 Dependabot critical vitest alerts on main (CVE-2026-47429 / GHSA-5xrq-8626-4rwp). All CI checks SUCCESS on PR #260 (Backend Unit/Integration, Frontend Lint/Test/Build, Docker Build, CodeQL csharp+js). The 1 transitive moderate 'brace-expansion' (eslint chain) remains; deliberate follow-up — separate PR with override rationale. - docs/12_Phase10_PreLaunch_Gates.md gate #11: appended PR #260 closure evidence (vitest ^3.2.4 → ^4.1.0, 190/190 tests PASS, 0 build/lint error) and the 1 transitive moderate note. Gate remains GO. - docs/10_Execution_Tracking.md: new 02.06.2026 | Follow-up row for PR #260 merge confirmation, mirroring the existing PR #259 row pattern (date, label, MERGED + SHA, handoff link, PR body archive link). - docs/handoffs/2026-06-02-235900-...: new comprehensive session handoff for this branch cleanup + PR #260 paperwork sync. Chained to the immediate predecessor (2026-06-02-232800-...). Phase 10 launch-gate source of truth and milestone ledger are now in sync with the current main HEAD (cef9964...). 9 DEFERRED Phase 10 gates (Dokploy-dependent) remain untouched per user direction. Working tree is now 'structurally clean' after the chore commit in this session. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(phase10): clarify gate #11 references main HEAD not PR branch state Address Codex P1 review feedback (chatgpt-codex-connector, review 4413547177, commit c01f766): the dependency-vuln gate #11 row text updated in the previous commit mentioned PR #260's vitest bump, but a reviewer reading PR #261's diff in isolation might think the bump is in this PR. It is not — PR #260 was a separate branch already merged to main. This commit adds one inline note to gate #11 making it unambiguous that the row tracks main HEAD state, not PR branch state, and that the vitest bump lives in PR #260 (already on main). PR #261 body also added via 'gh pr edit' for full context (docs-only PR, no code/test/contract surface changed). Refs: PR #261, PR #260, Codex review 4413547177 * feat(phase10): ship Wave 4 admin Reports backend (Wave 4.1) Closes the backend Reports gap that has been blocking the admin /admin/v1/reports endpoints since the Phase 10 frontend coverage expansion (PR #261). The frontend hook layer (useRevenueReport / useOccupancyReport / usePopularVehicles) was already wired to USE_MOCK=false and was 404ing against the backend. Scope - backend Reports surface: IReportsService + ReportsService (period-aware aggregation from Reservations / PaymentIntents / Vehicles via IApplicationDbContext). - New controller: AdminReportsController (api/admin/v1/reports, AdminOnly policy, standard rate limit) exposing revenue / occupancy / popular-vehicles endpoints. - DTOs: RevenueReportResponse, OccupancyReportResponse, PopularVehicleReportItemResponse matching the frontend types in lib/api/admin/types.ts. - DI registration in ServiceCollectionExtensions. - Tests: 7 controller tests (mocked service) + 14 service tests (InMemory DB) = 21 new tests. dotnet build clean (0 warning / 0 error). Full unit suite 615/615 PASS. Out of scope (deferred to post-launch) - settings/system persistence (no backend SystemSettings entity; config migration). - fleet/maintenance complete action (no Maintenance entity; fleet workflow needs state-machine + migration). Both are documented in the session handoff as launch-non-critical and remain in the post-launch technical-debt registry per Wave 4 completion criteria. * docs(phase10): record Wave 4 closure evidence + session handoff Updates Wave 4 status in the launch-gate source of truth and the execution tracker, and archives the session handoff for the next agent. - docs/12_Phase10_PreLaunch_Gates.md: header 'Wave 4 DEFERRED' replaced with 'Wave 4 PARTIALLY COMPLETED — Reports backend shipped; settings/system + maintenance stub formally DEFERRED'. Wave 4 row in 10.0.1.3 scoped-review table marked closed. New 10.0.8 Wave 4 Completion Evidence section added, mirroring the Wave 1/2/3 closure blocks (kapanış tarihi, kapsam, verify results, file list, formal deferral note). - docs/10_Execution_Tracking.md: Wave 4 bullet moved from 'Bekliyor' to 'PARTIALLY COMPLETED'. New 03.06.2026 | Delivery row in the milestone ledger recording the Reports backend delivery + the formal defer. - docs/handoffs/2026-06-03-phase10-wave4-closure-handoff.md: comprehensive session handoff with session metadata, handoff chain, current state summary, codebase understanding, files modified, decisions made, pending work, risk register, verification evidence, reproducible commands, related artifacts. * fix(phase10): address Wave 4 reports review feedback * test(phase10): capture local docker release evidence * fix(admin): normalize admin proxy version path * fix(auth): prevent local admin dashboard login loop * fix(frontend): align admin fleet and pricing workflows * fix(fleet): show physical vehicles publicly with photos * fix(admin): make vehicle photo picker clickable * fix(public): prevent vehicle card price overlap * fix(fleet): price available vehicle groups Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(i18n): add booking flow messages Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * test(frontend): centralize next-intl mock Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize shared booking chrome Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize date selection step Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): resolve vehicle selection pricing Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): localize driver details step Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> * fix(booking): preserve payment summary pricing Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> --------- Co-authored-by: Sisyphus <sisyphus@ohmyopencode.com> Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated MockQueryable.EntityFrameworkCore from 7.0.0 to 10.0.2.
Release notes
Sourced from MockQueryable.EntityFrameworkCore's releases.
10.0.2
What's Changed
New Contributors
Full Changelog: ramantsitou/MockQueryable@v10.0.1...v10.0.2
10.0.1
#93 ExecuteUpdateAsync not suported with SetProperty with Value Expression - fixed
Full Changelog: ramantsitou/MockQueryable@v10.0.0...v10.0.1
10.0.0
v10.0.0 Upgrade to .Net 10 and EntityFrameworkCore 10
9.0.0
Upgrade to .Net 9 and EntityFrameworkCore 9
Full Changelog: ramantsitou/MockQueryable@v8.0.1...v9.0.0
8.0.1
What's Changed
.AsQueryablecalls to the test data set by @Catlandor in #88 Fix.AsQueryablecalls to the test data set ramantsitou/MockQueryable#90New Contributors
Full Changelog: ramantsitou/MockQueryable@v8.0.0...v8.0.1
8.0.0
What's Changed
#81 Add support to ExecuteDelete and ExecuteUpdate - Thanks @lazaro-ansaldi and @Catlandor
#82 Update versions of Moq, NSubstitute and FakeItEasy to newer versions without known vulnerabilities - Thanks @Catlandor
#73 Supporting EF.Functions.Like and/or prossibility to provide cusotm ExpressionVisitor - Thanks @Catlandor
#66 Not suported with EF7: ExecuteDeleteAsync and ExecuteUpdateAsync - Thanks @Catlandor
New Contributors
Full Changelog: ramantsitou/MockQueryable@v7.0.3...v8.0.0
7.0.4-beta
What's Changed
New Contributors
Full Changelog: ramantsitou/MockQueryable@v7.0.2...7.0.4-beta
7.0.3
What's Changed
New Contributors
Full Changelog: ramantsitou/MockQueryable@v7.0.2...v7.0.3
7.0.2
#77 BuildMock moved to MockQueryable.EntityFrameworkCore - Thanks @skarllot
Full Changelog: ramantsitou/MockQueryable@v7.0.1...v7.0.2
7.0.1
#74 Fix ToListAsync() for mocked DbSet by using lazy-creation of AsyncEnumerator - Thanks @fischero19
#75 Added method for build DbSet from IEnumerable. - Thanks @sq735
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)