golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(14.2): add phase verification

Browse Source
This commit is contained in:
Jakub Zych
2026-10-12 12:42:51 +02:00
parent 0ce57fbe4e
commit 2e6a72b6e9
1 changed files with 255 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

255
.planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-VERIFICATION.md Normal file
View File

@@ -0,0 +1,255 @@
---
phase: 14.2-local-fonoteka-frontend-on-local-summercms-backend
verified: 2026-10-12T10:41:00Z
status: human_needed
score: 49/54 must-haves verified
covered_files:
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-PLAN.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-01-SUMMARY.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-PLAN.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-02-SUMMARY.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-PLAN.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-03-SUMMARY.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-PLAN.md
- .planning/phases/14.2-local-fonoteka-frontend-on-local-summercms-backend/14.2-04-SUMMARY.md
- docs/services/logging.md
- docs/services/storage.md
- docs/setup/configuration.md
- modules/surf/README.md
- modules/surf/accesslog.go
- modules/surf/accesslog_test.go
- modules/surf/router.go
- modules/surf/uploads.go
- modules/surf/uploads_test.go
- scripts/check-phase14.2.sh
covered_digest: "v2:sha256:458b8aba274a449e0c7fec7aa5776f833f9e2dc54b4b2686e64b625d0e59960c"
behavior_unverified: 1
overrides_applied: 1
overrides:
- must_have: "Per D-11, D-16 and D-21, the new and rewritten specs also pass against the PHP backend on :8422 with the app's own PHP-targeted .env"
reason: "The PHP run (UAT item 11) gave expected=4 unexpected=2. Both failures were classified as non-contract: the PNG_1PX fixture cannot be decoded by PHP GD (Resizer.php:139), and the local PHP env has no Centrifugo config. Go passed the same specs. Both follow-ups are in deferred-items.md."
accepted_by: "developer (14.2-UAT.md item 11, 'The developer accepted the classification')"
accepted_at: "2026-10-11T21:04:28Z"
behavior_unverified_items:
- truth: "(14.2-02, edge: concurrency) `up` in the foreground stops both process groups and removes the pid file on Ctrl-C, TERM or any failure (EXIT trap)"
test: "Run `scripts/dev-stack.sh up` in the foreground (stack down first), wait for 'Ctrl-C stops both', press Ctrl-C. Separately, send TERM to the script's pid."
expected: "Both the Go and the Nuxt process groups are gone (ports 8423 and 3119 free), tmp/dev-stack/pids is removed, and the script exits non-zero (130 or 143)."
why_human: "cleanup() and the INT/TERM/EXIT traps are present and wired in up(), but no test or gate stage exercises a foreground interrupt. The gate only uses `up --detach` and `down`."
human_verified:
- test: "UAT items 1-11 (login, browse collections/albums, album detail, search, edit, rate, cover upload, wishlist add/remove, realtime, no 5xx/no PHP header, PHP cross-check)"
uat_row: "1-11"
recorded_at: "2026-10-11T21:04:28Z"
note: "Files changed after the UAT (review fixes WR-01..09: accesslog.go, uploads.go, router.go, dev_seed.go, dev-stack.sh, runTinker.ts, realtime.spec.ts) were re-exercised by the gate's Go e2e run e2e-20261012T101126Z (17/0/0/0, started 10:11:27Z, after the last Go commit 261d9bc and the build stamp 09:28:54Z): login with the seed, cover decode through the Nuxt /storage proxy, search, wishlist, realtime subscribe and push. go.log has 0 5xx records. No re-test requested."
human_verification:
- test: "Accept WR-05: SUMMER_ENV=dev is now refused by fonoteka:dev-seed, the backend marker route and dev-stack.sh"
expected: "The developer confirms that 'local only' replaces the locked 'local or dev' rule (D-02, 14.2-01 truths 3 and 7, 14.2-04 truths 2 and 5), and records an override or updates D-02."
why_human: "Intentional contract change made during code-review fixes (REVIEW-FIX marks it 'requires human verification (behaviour change)'). TestDevSeedRefusesProduction and TestDevMarkerRoute now assert that dev is refused, which contradicts the plan-04 truths as written. Only the developer can accept a change to a locked decision."
- test: "Accept WR-01: the request log never records the URL path, not even for an unmatched request"
expected: "The developer confirms that D-12 ('records each request's path and status') and the 14.2-01 truth 9 / 14.2-04 truth 7 ('path without query only for unmatched requests') are superseded. An unported route then shows in go.log as status=404 with pattern=\"\", and the path is visible only in the browser network tab (README § Logs). The developer records an override or updates D-12."
why_human: "This is a security-motivated narrowing: share and invitation tokens travel in paths. It weakens the D-12 diagnostic ('a 404 on a path the Nuxt app calls is a route the port is missing'), because the Go log no longer names the missing path. Whether that trade-off is acceptable is a product decision."
- test: "Foreground `dev-stack.sh up`: Ctrl-C / TERM stops Go and Nuxt and removes the pid file"
expected: "Ports 8423 and 3119 are free, tmp/dev-stack/pids is gone, and the exit code is 130 (INT) or 143 (TERM)."
why_human: "Cleanup invariant with no automated test (see behavior_unverified_items)."
- test: "Review four test-tier prohibitions that are enforced only by static evidence (unverified-prohibition, human review recommended)"
expected: "Confirm: (1) sm-user-plugin is not modified by any phase commit; `git log df7876b..HEAD -- plugins/golem15/user` in fonoteka.go is empty, and the submodule drift (569768e) is another session's test-only commit from before plan 01. (2) dev-stack.sh writes no file in DEV_STACK_NUXT_DIR: it only checks writability, and `pnpm dev` gets the NUXT_* values as env. vue-fonoteka-app `git status` is clean. (3) dev-stack.sh never reads or edits /etc/centrifugo/config.json and never restarts Centrifugo or calls publish; the path appears only in warning text, and the probes are info/history. (4) Every spec deletes the albums and wishlist entries it created in `finally`, with Date.now() names. Known residue: orphan 'E2E Artist' rows (deferred-items.md)."
why_human: "These prohibitions are declared `verification: test`, but no test or gate stage enforces them. Under the fail-closed rule for test-tier prohibitions they cannot be marked green on code reading alone."
---
# Phase 14.2: Local Fonoteka frontend on local SummerCMS backend: Verification Report
**Phase goal:** A developer runs the existing `vue-fonoteka-app` locally against the local `fonoteka.go` SummerCMS backend (not PHP), logs in, and uses the real Nuxt flows so the port is proven in daily use before production cutover.
**Verified:** 2026-10-12T10:41:00Z
**Status:** human_needed
**Re-verification:** No (initial verification; no previous VERIFICATION.md)
The phase goal is achieved in the codebase. All four roadmap success criteria are verified with fresh or post-fix evidence. Nothing blocks. Four items need a human decision: two deliberate contract narrowings from the review fixes (WR-05, WR-01), one cleanup invariant that no test exercises, and four test-tier prohibitions enforced only statically.
## MVP mode note (warning)
ROADMAP sets `**Mode:** mvp`, but the goal is not in user-story form. `user-story.validate` returned `valid: false` (no "As a …, I want to …, so that …"). The verifier contract says to refuse in that case. I did not refuse, because the orchestrator asked for goal-backward verification of a phase that was already planned, executed and UAT'd. Instead I read the goal as the implicit story "As a developer, I want to run the Nuxt app against local Go and use its flows, so that the port is proven before cutover". If the MVP framing should stay, run `/msd mvp-phase 14.2` to reformat the goal.
## User Flow Coverage
| Step | Expected | Evidence | Status |
|------|----------|----------|--------|
| Start the stack | One command starts Go and Nuxt, wired to each other | `fonoteka.go/scripts/dev-stack.sh` `up()` (lines 587-650): env, services, build, migrate, seed, reindex, serve, guard, pnpm dev, probe | ✓ |
| Log in | The seeded user logs in through the Nuxt proxy to Go | `auth.setup.ts` seeds through `fonoteka:dev-seed` when `E2E_BACKEND=go`; gate e2e 17/0/0/0; UAT item 1 | ✓ |
| Browse collections and albums | The collection lists albums with covers; album detail opens | UAT items 2-3 (human); `public-share`, `smoke` and `album-search` specs in the gate; covers served by the framework `/storage` mount | ✓ |
| Search | A unique album is found | `album-search.spec.ts` (gate); UAT item 4; go.log 0 `album search engine failed` | ✓ |
| Edit, rate, cover | Edit persists, rating persists, cover decodes | `album-edit-rate-cover.spec.ts` (`rating-stars`, `naturalWidth > 0` via `/storage/app/uploads/public/`); UAT items 5-7 | ✓ |
| Wishlist add/remove | An entry is added on /wishlist/new and removed | `wishlist.spec.ts` (`wishlist-item-remove`); UAT item 8 | ✓ |
| Outcome: port proven, not PHP | Every request reaches Go; failures are visible | guard (`--guard` refusals rerun), pinned `NUXT_INTERNAL_API_ORIGIN`, post-start probe through :3119; go.log 3081 `http request` records, 0 5xx | ✓ |
## Goal Achievement
### Roadmap success criteria
| # | Success criterion | Status | Evidence |
|---|-------------------|--------|----------|
| SC1 | Documented local run: Nuxt and Go start together; API base URL, cookies and CORS match how the SPA talks to Winter | ✓ VERIFIED | `fonoteka.go/README.md` § "Running locally with the Nuxt app" (ports, prerequisites, Centrifugo operator step, env table, commands, logs, MCP). The SPA keeps its unchanged `nuxt.config.ts` proxy: `NUXT_DEV_BACKEND_ORIGIN` / `NUXT_INTERNAL_API_ORIGIN` = `http://127.0.0.1:8423`, the same mechanism it uses for Winter, so the browser stays same-origin on :3119 (no CORS). The JWT lives in the app's own `auth_token` cookie and the backend sets none (RESEARCH line 110/200). Info: the README never states "cookies and CORS unchanged" in so many words. |
| SC2 | A signed-in Go session covers browse collections/albums, search, edit, rate, cover upload, wishlist add/remove | ✓ VERIFIED | Gate report `fonoteka.go/tmp/dev-stack/e2e-20261012T101126Z.json`: expected 17, unexpected 0, skipped 0, flaky 0, over all 10 D-15 gate specs, after the review fixes. Plus human UAT items 1-10, all passed (2026-10-11). |
| SC3 | Failures against Go are visible (no silent fall-through to PHP); the local stack does not require the production origin | ✓ VERIFIED | `dev-stack.sh` `guard_origins` / `guard_marker` / `probe`. I reran `check-phase14.2.sh --guard`: php-port, internal-unset, mismatch, production, fake-php and other-marker were all refused, and the control passed. Hosts are loopback only (Go addr, backend origin, Postgres DSN). The marker route is only on Go. The opt-in access log logs method/pattern/status (see the WR-01 human item about the path). |
| SC4 | The new glue has tests or a fail-closed check script, delivered in the last plan | ✓ VERIFIED | `summercms.go/scripts/check-phase14.2.sh` (673 lines, plan 04). I reran self-test, go, docs, parity, contracts and guard, and all passed. `--e2e` was last run by the orchestrator after the fixes (the report above). Named tests: console 5, plugin 5, surf 5, all passing. |
### Plan must-have truths (50) and status
| Plan | Truths | Verified | Notes |
|------|--------|----------|-------|
| 14.2-01 | 13 | 12 | ? #9 (access log adds `path` for unmatched requests) superseded by WR-01: path never logged. #3 and #7 ("only when local or dev") still hold literally after the WR-05 narrowing to local only. Backstop #12 (orphan blob never served) and #13 (integer `duration_ms`) have explicit evidence: `TestUploadsMount` targets `uploadsOrphanDisk` and gets a 404, and `TestAccessLog` parses `duration_ms` as a non-negative integer. |
| 14.2-02 | 14 | 13 | ⚠️ #12 foreground Ctrl-C/TERM cleanup is PRESENT_BEHAVIOR_UNVERIFIED (traps and `cleanup()` wired; no test). The others are verified by code (`up` order, `check_services`, namespace `history` probe, loopback/8422 rules in `load_env` lines 196-197, env stripping in `start_nuxt`) and by the rerun guard stage. |
| 14.2-03 | 10 | 10 (1 by override) | #7 PHP cross-check: PASSED (override); the developer accepted the classification. #8 no `app/` change: `git diff --name-only 984031f..HEAD -- app` is empty, and only `tests/` changed (12 files). #9 operator step: proven by behaviour, since the realtime spec (subscribe on `collection:` without 102, push received) passed with 0 skips. |
| 14.2-04 | 13 | 10 | ? #2 and #5 ("local and dev pass the gate", marker 200 for dev) superseded by WR-05. ? #7 ("raw path without query only for an unmatched request") superseded by WR-01. The rest is verified by the reruns. |
**Score:** 49/54 truths verified (4 roadmap SC plus 50 plan truths; 1 by override). 4 are UNCERTAIN (deliberate contract changes awaiting human acceptance) and 1 is present but behaviour-unverified.
### Prohibitions (must-NOT)
| Prohibition | Tier | Enforcement | Disposition |
|-------------|------|-------------|-------------|
| Seed opens no DB / writes nothing outside local | test | `TestDevSeedRefusesProduction` (passes; now also refuses `dev`) | ✓ |
| No manifest route response change; marker/uploads outside manifest | test | `TestParityCorpus` 175/175/0; `TestDevMarkerRoute` reads `parity/manifest.yaml` | ✓ |
| sm-user-plugin not modified | test | none (git evidence only) | ⚠️ flagged: unverified-prohibition |
| dev-stack.sh writes nothing in the Nuxt checkout | test | none (code plus clean `git status`) | ⚠️ flagged |
| No fall-through to PHP/production; Nuxt only after the guard | test | `--guard` stage (rerun, passed); `up()` runs `guard` before `start_nuxt` | ✓ |
| No read/edit/restart of the shared Centrifugo config | test | none (grep: the path appears only in warning text) | ⚠️ flagged |
| App keeps working on PHP; no `app/` change; specs run on PHP | test | git diff (no app/), UAT item 11 accepted by the developer | ✓ (human-accepted) |
| Specs touch only data they created | test | none (`finally` deletes, Date.now() names) | ⚠️ flagged |
| PHP tinker path unchanged when `E2E_BACKEND` is unset | test | `e2e-backend-switch.test.mjs` 10/10; the diff of runTinker.ts/auth.setup.ts is add-only | ✓ |
| Gate never passes on a skip | test | `--self-test` (planted skip cases), rerun, passed | ✓ |
| Gate never downgrades a missing service or Docker to a pass | test | `--self-test` plus `set -euo pipefail`; services refused in `check_services` | ✓ |
### Required Artifacts
| Artifact | Status | Details |
|----------|--------|---------|
| `summercms.go/modules/surf/uploads.go` | ✓ VERIFIED | 171 lines; `mountUploads` is called in `BuildRouter` after the plugin route loop and before `cabana.Activate` (router.go:554); prefix validation, nosniff, CSP, attachment for non-raster types |
| `summercms.go/modules/surf/accesslog.go` | ✓ VERIFIED | 155 lines; wraps the final handler in `compile` (router.go:382-383); `recordPattern` in `wrap` (router.go:453); `markPanicked` in the recoverers |
| `fonoteka.go/.../console/dev_seed.go` | ✓ VERIFIED | 559 lines; env gate before any DB open; one `lagoon.Transaction` in `lighthouse.WithoutBroadcasting`; `seedSearch` last |
| `fonoteka.go/.../console/database.go` | ✓ VERIFIED | `commandDatabase`/`commandBucket`; used by dev-seed, reindex, oauth-client, prune-notifications |
| `fonoteka.go/.../dev_marker.go` | ✓ VERIFIED | `devMarkerRoutes`, called from routes.go:386; registered only when `DevEnvironment` is local; not in the manifest |
| `fonoteka.go/scripts/dev-stack.sh` | ✓ VERIFIED | 845 lines; subcommands up/down/status/check/guard/exec/e2e/e2e-verdict/fresh/redact-seed |
| `fonoteka.go/.env.dev.example` | ✓ VERIFIED | placeholders only (checked); `.gitignore` has `/.env.dev` and `/storage/app/uploads/public/` |
| `fonoteka.go/README.md` run docs | ✓ VERIFIED | § Running locally with the Nuxt app |
| `vue-fonoteka-app/tests/e2e/helpers/runTinker.ts` | ✓ VERIFIED | `E2E_BACKEND=go` branch; PHP path add-only |
| `vue-fonoteka-app/tests/e2e/{album-edit-rate-cover,album-search,wishlist,realtime}.spec.ts` | ✓ VERIFIED | contain the planned test IDs; conditional `test.skip` guards turn into gate failures through `e2e-verdict` (skipped must be 0) |
| `vue-fonoteka-app/tests/contracts/e2e-backend-switch.test.mjs` | ✓ VERIFIED | 10/10 (rerun) |
| `summercms.go/scripts/check-phase14.2.sh` | ✓ VERIFIED | all stages present; 6 of 7 rerun green here |
| Phase unit tests (dev_seed_test, dev_stack_test, dev_marker_test, uploads_test, accesslog_test) | ✓ VERIFIED | all named tests pass (rerun) |
### Key Link Verification
| From | To | Via | Status |
|------|----|-----|--------|
| surf/router.go | uploads.go | `mountUploads(r, app)` after the routes, before cabana | WIRED |
| surf/router.go | accesslog.go | `accessLog` in `compile`, `recordPattern` in `wrap` | WIRED |
| fonoteka plugin.go | console/dev_seed.go | `console.DevSeedCommand(p.app)` (plugin.go:298) | WIRED |
| dev_seed.go | classes StoreAlbumPhoto / CreateAlbum | inside the seed transaction | WIRED |
| reindex/oauth_client/prune_notifications | console/database.go | `commandDatabase` | WIRED |
| routes.go | dev_marker.go | `p.devMarkerRoutes(r)` | WIRED |
| dev-stack.sh | marker | `MARKER_PATH`, used in guard, `wait_for_marker`, probe | WIRED |
| dev-stack.sh | dev-seed | `bin/fonoteka fonoteka:dev-seed` → `seed.out` (mode 600) → probe cover URL | WIRED |
| dev-stack.sh | nuxt.config.ts | `NUXT_DEV_BACKEND_ORIGIN` / `NUXT_INTERNAL_API_ORIGIN` env on `pnpm dev` | WIRED |
| runTinker.ts | dev-seed | `execFileSync(E2E_GO_BIN, ['fonoteka:dev-seed'])` (contract test) | WIRED |
| check-phase14.2.sh | dev-stack.sh | guard/up/fresh/e2e/e2e-verdict | WIRED |
### Data-Flow Trace (Level 4)
| Artifact | Data | Source | Real data | Status |
|----------|------|--------|-----------|--------|
| Uploads route | cover bytes | published `*blob.Bucket` + `system_files` row via `attach.StaticHandlerPublic` | yes (cover decodes in the e2e run; the probe requires image/png) | ✓ FLOWING |
| Marker | `{backend,app,env}` | marshalled at registration from `DevEnvironment` | static by design (a marker, not data) | ✓ (intended) |
| Access log | method/pattern/status/duration | request plus `statusRecorder` | yes (go.log 3081 records) | ✓ FLOWING |
### Behavioral Spot-Checks (run by the verifier)
| Behavior | Command | Result | Status |
|----------|---------|--------|--------|
| Gate self-test | `bash scripts/check-phase14.2.sh --self-test` | `phase14.2 self-test passed` | ✓ PASS |
| Guard refusals | `bash scripts/check-phase14.2.sh --guard` | 6 refusals with the correct reasons, control passed | ✓ PASS |
| vet + full Go suites + named tests | `bash scripts/check-phase14.2.sh --go` | `phase14.2 go passed`, exit 0, 0 FAIL lines | ✓ PASS |
| Docs | `--docs` | `phase14.2 docs passed` | ✓ PASS |
| Parity | `--parity` | `recorded 175/175 passing 175 failing 0 unrecorded 0 pending 0` | ✓ PASS |
| Contracts | `--contracts` | blocking 10/10; report-only 288/289 (pre-existing `missing-catalog`) | ✓ PASS |
| Surf named tests | `go test ./modules/surf -run 'TestUploadsMount\|TestUploadsResponseHeaders\|TestAccessLog'` | 5 PASS | ✓ PASS |
| Seed/command/marker tests | `go test ./console -run 'TestDevSeed\|TestReindexCommand'`; `go test . -run 'TestDevStackSmoke\|…\|TestDevMarkerRoute'` | 10 PASS | ✓ PASS |
| Go-gate Playwright subset | `--e2e` | not rerun: the auto-mode classifier denied any interaction with the running stack (status/curl). The latest gate report `e2e-20261012T101126Z.json` is 17/0/0/0, newer than the last Go commit and the build stamp; go.log 0 5xx, 0 search failures; `seed.out` mode 600 | ? recorded evidence |
### Probe Execution
No `scripts/*/tests/probe-*.sh` are declared or present for this phase. The phase gate script stands in for a probe and was run as above.
### Requirements Coverage
| Requirement | Source Plan | Description | Status | Evidence |
|-------------|-------------|-------------|--------|----------|
| QA-05 | 14.2-01..04 | Cutover: parity green and vue-fonoteka-app / fonoteka-mcp run unchanged against Go | ✓ SATISFIED (this phase's share) | vue-fonoteka-app runs against Go with no `app/` change; parity 175/175. The fonoteka-mcp leg is documented (token minted, README § MCP) but not exercised here. Full cutover is Phase 20. |
Info: REQUIREMENTS.md traceability maps QA-05 to "Phase 15 / Complete", while ROADMAP maps it to 14.2 and 20. The traceability row is stale.
### Decision Coverage
`check.decision-coverage-verify`: 23/23 CONTEXT decisions honored by the substring heuristic. Two decisions were drifted by the review fixes and are not caught by the heuristic: D-02 ("local/dev") is now local only (WR-05), and D-12 ("records each request's path and status") now records the pattern only, never the path (WR-01). Both are raised as human items.
### Anti-Patterns Found
| File | Line | Pattern | Severity | Impact |
|------|------|---------|----------|--------|
| (phase files) | none | TBD/FIXME/XXX/TODO | none | no debt markers in any phase file |
| `modules/surf/uploads_test.go` | helper | `t.Skip` under `-short` only | ℹ️ Info | CLAUDE.md requires it; the gate never runs `-short` and the detector refuses skips |
| e2e specs | `test.skip(...)` guards | conditional skips | ℹ️ Info | turned into failures by `e2e-verdict` (skipped must be 0) |
| `fonoteka.go/scripts/dev-stack.sh` | 369 | marker check ignores `.app` (IN-06) | ℹ️ Info | any SummerCMS app on the port passes the guard; this is not a PHP fall-through |
| `fonoteka.go/scripts/dev-stack.sh` | 215-241 | Postgres loopback check bypassable via `hostaddr`/query `host` (IN-02) | ℹ️ Info | weakens the "local DB only" refusal; open advisory |
| `summercms.go/scripts/check-phase14.2.sh` | 51 | hard-coded developer path default (IN-09) | ℹ️ Info | open advisory |
The 11 open review Info findings (IN-01..IN-11) are advisory. None is a blocker.
### Human Verification Required
#### 1. Accept the WR-05 narrowing (`dev` refused)
**Test:** Decide whether `SUMMER_ENV=dev` should stay refused by `fonoteka:dev-seed`, the `_dev/backend` marker and `dev-stack.sh`.
**Expected:** Override recorded, or D-02 updated to "local only".
**Why human:** This changes a locked decision. Plan-04 truths 2 and 5 as written are now false; the tests assert the new rule.
#### 2. Accept the WR-01 narrowing (no path in the request log)
**Test:** Decide whether the Go request log may omit the path of unmatched requests.
**Expected:** Override recorded, or D-12 updated. An unported route shows as `status=404 pattern=""`, and the path comes from the browser devtools.
**Why human:** This trades away the D-12 diagnostic for token privacy. Plan-01 truth 9 and plan-04 truth 7 as written are now false.
#### 3. Foreground `up` cleanup
**Test:** `scripts/dev-stack.sh up` (foreground), then Ctrl-C; repeat with TERM.
**Expected:** Both process groups stop, `tmp/dev-stack/pids` is removed, and the exit code is 130/143.
**Why human:** This cleanup invariant is wired but not exercised by any test.
#### 4. Four statically enforced test-tier prohibitions
**Test:** Review the evidence listed in the frontmatter (sm-user-plugin untouched, no writes to the Nuxt checkout, no Centrifugo config access, specs delete only their own data).
**Expected:** The developer confirms each, or asks for a gate check.
**Why human:** Declared `verification: test` but no test enforces them, so they cannot be green on code reading alone.
### Suggested overrides (if items 1 and 2 are accepted)
```yaml
overrides:
- must_have: "TestDevSeedRefusesProduction proves local and dev pass the gate; TestDevMarkerRoute answers 200 for local and dev"
reason: "WR-05: dev is a common name for a shared server; seed, marker and dev-stack.sh accept local only"
accepted_by: "<developer>"
accepted_at: "<ISO timestamp>"
- must_have: "http.access_log adds path without its query string only for unmatched requests"
reason: "WR-01: share and invitation tokens travel in paths; the log records method, pattern, status and duration only"
accepted_by: "<developer>"
accepted_at: "<ISO timestamp>"
```
### Gaps Summary
No blocking gaps. The local stack, the fail-closed guard, the seed, the framework uploads mount and request log, the Nuxt seed switch, the self-seeding specs and the phase gate all exist, are substantive and wired. Each is backed by passing tests that I reran (except `--e2e`, which is backed by the post-fix gate report), plus an approved manual UAT. The status is `human_needed` rather than `passed` because two review fixes changed locked decisions (D-02, D-12) without a recorded acceptance, one cleanup invariant has no test, and four test-tier prohibitions have only static evidence.
Further notes, none of them gaps:
- `covered_files` lists only summercms.go-root files; the fonoteka.go and vue-fonoteka-app files escape the project root and cannot be fingerprinted.
- `14.2-VALIDATION.md` is still `draft` / `nyquist_compliant: false`, left for `/msd-validate-phase 14.2`.
- The PHP repo's `vue-fonoteka-app` submodule pointer is not bumped (`M vue-fonoteka-app` in `/media/nvme/dev/golem15/fonoteka`); that is the user's call.
- Deferred to Phase 20 or follow-ups (deferred-items.md): fileblob cross-device TMPDIR, Vite cold start before the first e2e, the `PNG_1PX` fixture for PHP GD, the local PHP Centrifugo config, and the framework `lagoon.Validate` empty-pointer gap.
---
_Verified: 2026-10-12T10:41:00Z_
_Verifier: Claude (msd-verifier)_