golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(19): re-verify Chat and ChatChannels after gap closure

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-10-17 22:41:29 +02:00
parent 70682b4b27
commit d69a3d409e
2 changed files with 128 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.planning/phases/19-chat-and-chatchannels/19-REVIEW-DISPOSITION.md
View File

@@ -1,14 +1,14 @@
---
phase: 19-chat-and-chatchannels
recorded: 2026-10-17T20:15:00Z
recorded: 2026-10-17T20:45:00Z
source: 19-REVIEW.md
findings:
- id: CR-01
severity: critical
disposition: open
disposition: fixed
- id: CR-02
severity: critical
disposition: open
disposition: fixed
- id: WR-01
severity: warning
disposition: open
@@ -33,8 +33,8 @@ findings:
| Finding | Severity | Disposition | Source |
|---------|----------|-------------|--------|
| CR-01 | critical | open | 19-REVIEW.md |
| CR-02 | critical | open | 19-REVIEW.md |
| CR-01 | critical | fixed | 19-06 / 19-07 (`canSend` → `isParticipant`; `TestTeammateDMWriteIDOR`) |
| CR-02 | critical | fixed | 19-06 / 19-07 (`ReassignCreatedBy` on `user.Deleting`; `TestDeletingCascade` creator path) |
| WR-01 | warning | open | 19-REVIEW.md |
| WR-02 | warning | open | 19-REVIEW.md |
| WR-03 | warning | open | 19-REVIEW.md |
@@ -42,4 +42,4 @@ findings:
| IN-01 | info | open | 19-REVIEW.md |
| IN-02 | info | open | 19-REVIEW.md |
_Recorded after execute-phase code_review_gate. Advisory — does not block verification._
_CR-01 and CR-02 closed by gap-closure plans 19-06 (production) and 19-07 (named postgres tests). WR-01..WR-04 and IN-01..IN-02 stay open by plan prohibition._

236
.planning/phases/19-chat-and-chatchannels/19-VERIFICATION.md
View File

@@ -1,8 +1,8 @@
---
phase: 19-chat-and-chatchannels
verified: 2026-10-17T20:17:10Z
status: gaps_found
score: 23/26 must-haves verified
verified: 2026-10-17T20:40:27Z
status: passed
score: 26/26 must-haves verified
covered_files:
- .planning/phases/19-chat-and-chatchannels/19-01-PLAN.md
- .planning/phases/19-chat-and-chatchannels/19-01-SUMMARY.md
@@ -14,42 +14,28 @@ covered_files:
- .planning/phases/19-chat-and-chatchannels/19-04-SUMMARY.md
- .planning/phases/19-chat-and-chatchannels/19-05-PLAN.md
- .planning/phases/19-chat-and-chatchannels/19-05-SUMMARY.md
- .planning/phases/19-chat-and-chatchannels/19-06-PLAN.md
- .planning/phases/19-chat-and-chatchannels/19-06-SUMMARY.md
- .planning/phases/19-chat-and-chatchannels/19-07-PLAN.md
- .planning/phases/19-chat-and-chatchannels/19-07-SUMMARY.md
- scripts/check-phase19.sh
covered_digest: "v2:sha256:1410fefe1f88be6c4049cf116774fdb44c4ecdf205ed983b8580bfba08138c96"
covered_files_note: "verification.fingerprint covers only paths under the summercms.go root. Sibling implementation read this pass: sm-chat-plugin 4d0e764 (plugin, boot, routes, classes/service.go canSend, authorizer, goldens, PHP_METHOD_MAP); sm-chatchannels-plugin 9026cd6 (plugin, boot, ChannelService, search.go, baselines, goldens); sm-user-plugin under fonoteka.go/plugins/golem15/user c077029 (handle migration, HandleGenerator, user authorizer, user.Deleting). Orchestrator recorded bash scripts/check-phase19.sh --all green; this pass did not re-run the postgres suite."
covered_digest: "v2:sha256:573444ee2af546235cd14dbc5133a31859ffe07afd0c9e1aac1600a858f05ddc"
covered_files_note: "verification.fingerprint covers only paths under the summercms.go root. Sibling implementation re-read this pass: sm-chat-plugin f4aeb87 (canSend → isParticipant, ReassignCreatedBy, boot user.Deleting, TestTeammateDMWriteIDOR, TestGapClosureSmoke); sm-chatchannels-plugin 3738f45 (TestDeletingCascade Unscoped + created_by creator path); sm-user-plugin under fonoteka.go/plugins/golem15/user c077029 (FormAfterDelete FireDeletingEvent then Unscoped). This pass did not re-run the postgres suite; named tests TestGapClosureSmoke, TestTeammateDMWriteIDOR, TestDeletingCascade and bash scripts/check-phase19.sh --self-test / --all were recorded green in the gap-closure round."
behavior_unverified: 0
overrides_applied: 0
decision_coverage:
honored: 21
total: 21
not_honored: []
gaps:
- truth: "D-08 / SC-19-1: conversation- and message-level routes check participation on every call; ChatService.sendMessage ports 1:1 (PHP requires hasParticipant)"
status: failed
reason: "CR-01 still open. canSend returns true for a non-participant when the conversation host reports HasMember. GetOrCreateDm stores the host alias on the DM row, so any teammate can POST into another pair's DM. PHP ChatService::sendMessage requires $conversation->hasParticipant($sender) with no HasMember fallback. HTTP tracers only prove a non-member of the context is 404."
artifacts:
- path: "../sm-chat-plugin/classes/service.go"
issue: "canSend (lines 255-273) counts participants then falls back to host.HasMember"
- path: "../sm-chat-plugin/api/messages.go"
issue: "PostMessage calls svc.SendMessage with no extra participant check; a context member who is not a DM participant gets 201"
missing:
- "Require participation only in canSend (return isParticipant); keep GetGroupChat lazy-join via addParticipant"
- "Postgres case: two context members open a DM; a third context member POSTs to that conversation id and must get 404"
- truth: "D-13 GDPR: deleting a user severs that user from channels without CASCADE-wiping conversations remaining members still use"
status: failed
reason: "CR-02 still open. golem15_chat_conversations.created_by is NOT NULL ON DELETE CASCADE. golem15_chatchannels_channels.conversation_id is also ON DELETE CASCADE. FormAfterDelete fires user.Deleting then force-deletes the user. SeverUserFromContext removes that user's members/prefs/participants and does not reassign created_by. Deleting the conversation creator therefore deletes the conversation, then the channel, then remaining members' history. TestDeletingCascade deletes Bob as a member of Alice's channel, so it never observes creator deletion."
artifacts:
- path: "../sm-chat-plugin/updates/202610160001_create_golem15_chat_baseline.go"
issue: "created_by REFERENCES users (id) ON DELETE CASCADE (lines 26-27)"
- path: "../sm-chatchannels-plugin/updates/202610160001_create_golem15_chatchannels_baseline.go"
issue: "conversation_id REFERENCES golem15_chat_conversations (id) ON DELETE CASCADE (lines 48-49)"
- path: "../sm-chatchannels-plugin/classes/channel_service.go"
issue: "SeverUserFromContext (lines 754-787) does not reassign created_by"
- path: "../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go"
issue: "FormAfterDelete fires user.Deleting then unscoped-deletes the user row"
missing:
- "Before the user row is deleted, reassign created_by to another participant on every conversation the user created (keep PHP constraint names; do not ALTER the IF NOT EXISTS baseline CASCADE)"
- "Extend TestDeletingCascade so Alice creates the channel, Alice is deleted, and Bob's member row and the channel row still exist"
re_verification:
previous_status: gaps_found
previous_score: 23/26
gaps_closed:
- "D-08 / SC-19-1: conversation- and message-level routes check participation on every call; ChatService.sendMessage ports 1:1 (PHP requires hasParticipant)"
- "D-13 GDPR: deleting a user severs that user from channels without CASCADE-wiping conversations remaining members still use"
- "SC-19-1: chat schema, models, adapters, jobs, commands and routes port 1:1; ChatChannels plugs in through the same adapter"
gaps_remaining: []
regressions: []
deferred:
- truth: "Route-level parity of /_wave is checked at the Wavepath port"
addressed_in: "Wavepath app port (not a numbered SummerCMS phase; SC-19-3 last sentence)"
@@ -57,20 +43,21 @@ deferred:
- truth: "Vue chat UI, satellites (chatbots, chatvideo, forum, herald, userfriends), and chat:migrate-attachments stay out"
addressed_in: "Phase 19.1 (satellites) and D-19 (migrate-attachments run on PHP before cutover)"
evidence: "Phase 19.1 goal: remaining shared plugins Wavepath requires. D-19: chat:migrate-attachments is not ported."
advisory: []
---
# Phase 19: Chat and ChatChannels Verification Report
**Phase Goal:** `Golem15.Chat` and `Golem15.ChatChannels` run on SummerCMS as shared plugins, with realtime delivery through `lighthouse`, ready for the Wavepath port.
**Verified:** 2026-10-17T20:17:10Z
**Status:** gaps_found
**Re-verification:** No — initial verification
**Verified:** 2026-10-17T20:40:27Z
**Status:** passed
**Re-verification:** Yes — after gap closure 19-06 and 19-07
**MVP note:** ROADMAP marks this phase `mode: mvp` but the ROADMAP goal is not in user-story form (`user-story.validate` → `valid: false`). PLAN.md goals are valid user stories. This report uses the PLAN story for User Flow Coverage and does not refuse verification.
**User story (from plans):** As an application developer, I want to have Chat and ChatChannels run on SummerCMS as shared plugins with realtime through lighthouse, so that they are ready for the Wavepath port.
Code review `19-REVIEW.md` (2026-10-17T20:12:19Z) and `19-REVIEW-DISPOSITION.md` list CR-01 and CR-02 as **open criticals**. This pass re-read the cited files; both defects are still in the tree.
Previous pass (`verified: 2026-10-17T20:17:10Z`) was `gaps_found` 23/26: CR-01 (`canSend` HasMember fallback) and CR-02 (no `created_by` reassignment on `user.Deleting`). This pass re-read production sources. Both criticals are closed. `19-REVIEW-DISPOSITION.md` records CR-01 and CR-02 as **fixed**. WR-01..WR-04 and IN-01..IN-02 stay open and do not flip a must-have.
## User Flow Coverage
@@ -81,9 +68,9 @@ User story: «As an application developer, I want to have Chat and ChatChannels
| Depend on shared plugins | `golem15.chat` and `golem15.chatchannels` compile as sibling modules with Winter layout | `sm-chat-plugin` module `git.golem15.com/golem15/sm-chat-plugin`, `PluginID` `golem15.chat`, `Requires` `golem15.user`; `sm-chatchannels-plugin` `golem15.chatchannels`, `Requires` `golem15.chat` + `golem15.user` | ✓ |
| Mount generic APIs | `/_chat/api/v1` and `/_chatchannels/api/v1` behind `jwt.auth` + named buckets | `sm-chat-plugin/routes.go` `APIPrefix`, `chat-api`/`chat-dm`; `sm-chatchannels-plugin/routes.go` `chatchannels-api` | ✓ |
| Realtime through lighthouse | `created.chat.message` Bind + `chat` / `user` authorizers; no WebSockets plugin | `boot.go` `lighthouse.Bind` + `Register("chat")`; user plugin `Register("user")`; no WebSockets package | ✓ |
| Ready for the Wavepath port | PHP send and GDPR delete behave the same so Wavepath can thin-alias | CR-01: context member can POST into another pair's DM. CR-02: deleting the conversation creator CASCADE-wipes the channel | ✗ |
| Ready for the Wavepath port | PHP send and GDPR delete behave the same so Wavepath can thin-alias | `canSend` returns `s.isParticipant` only; `ReassignCreatedBy` on `user.Deleting`; `TestTeammateDMWriteIDOR` 404; `TestDeletingCascade` creator path keeps Bob's channel | ✓ |
Outcome clause is **not** observably true until CR-01 and CR-02 close.
Outcome clause is observably true. WR-01..WR-04 remain open handler/service bugs; they are not Wavepath-port blockers on this phase's must-haves.
## Goal Achievement
@@ -91,36 +78,36 @@ Outcome clause is **not** observably true until CR-01 and CR-02 close.
| # | Truth | Status | Evidence |
|---|-------|--------|----------|
| 1 | SC-19-1: chat schema, models, adapters, jobs, commands and routes port 1:1; ChatChannels plugs in through the same adapter | ✗ FAILED | Schema/models/jobs/commands/routes exist and ChatChannels uses `chat.Context`. Send authorization is not 1:1: PHP `sendMessage` requires `hasParticipant`; Go `canSend` accepts `HasMember` (CR-01) |
| 2 | SC-19-2: realtime broadcasts and channel authorization go through lighthouse; no WebSockets plugin | ✓ VERIFIED | `bootRealtime` binds `chat.message` and `Registry.Register("chat", AuthorizeChatLookup)`; `AuthorizeChat` splits `chat:conversation:{id}` locally, participants only, capabilities `["prs"]`; does not call `lighthouse.ChannelID`. No WebSockets plugin in either repo |
| 3 | SC-19-3: golden tests match PHP serializers and every realtime event; `/_wave` deferred to the Wavepath port | ✓ VERIFIED | Chat goldens: `message_to_api_array`, `created_chat_message` (ids-only, no `content` key), typing/read/unread/deleted. Channel goldens: channel/category/pref/pin/mention/`mentions.changed`. `TestToAPIArray`, `TestGoldenEvents`, `TestChannelGoldenEvents` are required names in `scripts/check-phase19.sh`. Orchestrator: `--all` green |
| 4 | SC-19-4: unit tests delivered in the last plan | ✓ VERIFIED | Plan 19-05: goldens, `PHP_METHOD_MAP.md` (59+106), `TestPHPMethodMap`, `TestNoQuestStreamTrace`, `scripts/check-phase19.sh` fail-closed |
| 5 | D-01 chat: module `git.golem15.com/golem15/sm-chat-plugin`, package `chat`, plugin ID `golem15.chat`, Requires `golem15.user`; tables `golem15_chat_conversations`, `_participants`, `_messages`, `_thread_summaries` | ✓ VERIFIED | `go.mod`, `plugin.go` `PluginID`, baseline CREATE TABLE names |
| 6 | D-04 / D-05: one gormigrate ID `202610160001_create_golem15_chat_baseline`, `IF NOT EXISTS`, TIMESTAMPTZ/JSONB, never adds or drops the legacy owner column | ✓ VERIFIED | Baseline ID and SQL; `family_id` absent; `updates/baseline_test.go` asserts no `family_id` |
| 7 | D-11: `Registry.Add` stores the alias; `Resolver` returns `ErrUnknownContextType` and is never skipped; chat registers no host aliases | ✓ VERIFIED | `contracts/registry.go`; `bootRegistry` publishes an empty registry; only the test fixture calls `Add` |
| 8 | D-03: `Context.CanActFor`; default adapter true only when `actorID == memberID` | ✓ VERIFIED | `contracts/context.go` interface + `DefaultCanActFor` |
| 9 | D-13 / D-16 chat writes: `SendMessage` / `EditMessage` / `DeleteMessage` persist in `lagoon.Transaction` and Fire `MessageCreated` / `Updated` / `Deleted` inside that tx; Bind alias `chat.message`; ids-only payload | ✓ VERIFIED | `classes/service.go` and `writes.go` Fire inside the tx; `boot.go` Bind `Alias: "chat.message"`; golden `created_chat_message.json` payload has id/conversation_id/sender_id/root_id/type/action/created_at — no `content` |
| 10 | D-06 / D-08: `/_chat/api/v1`; contexts as `/contexts/{type}/{id}/…`; participation checked on every call; unknown type 404 | ✗ FAILED | Prefix and addressing hold (`routes.go`, `api/errors.go` maps `ErrUnknownContextType` to 404). **Read** path uses `CanView` (participant or overseer). **Write** path uses `canSend` HasMember fallback — CONTEXT D-08 says participation on every call. Plan 02's "participation or HasMember" wording reduces D-08 and is rejected |
| 11 | D-09: groups use `jwt.auth` and named buckets; DM start `chat-dm` Max 10 / minute keyed by frontend user id else ClientIP | ✓ VERIFIED | `routes.go` `surf.Use("jwt.auth", "throttle:chat-api")` and `throttle:chat-dm`; `Buckets()` Max 120 / 10, Decay `time.Minute`, key `u:{id}` else `ClientIP` |
| 12 | D-07: operations match Wavepath community chat including `PUT /threads/{rootId}/mute` with body `muted`; persistence is `golem15_chat_thread_mutes` | ✓ VERIFIED | Route mounted; mute table in chat baseline |
| 13 | D-10: `/api/chat/dm` and `/api/chat/attachments/{messageId}/{fileId}` are not registered | ✓ VERIFIED | Only `/_chat/api/v1` groups in `routes.go`; golden test rewrites old prefixes |
| 14 | D-18: uploads through `attach.Store` with ChatAttachmentPolicy (MaxBytes `102400*1024`, max 5, KNOWN_EXTS, SVG/HTML/XML banned); downloads stream from `/_chat/api/v1/attachments/{messageId}/{fileId}` after participation check; missing and unauthorized 404 | ✓ VERIFIED | `attachment_policy.go`, `api/download.go` `NewReader` after `AttachmentForDownload`. WR-04 (filename header) does not undo the participation gate |
| 15 | D-01 / D-04 chatchannels: module `git.golem15.com/golem15/sm-chatchannels-plugin`, package `chatchannels`, `golem15.chatchannels`, Requires chat+user; baseline eight PHP v1.6.0 tables, never adds `users.handle` | ✓ VERIFIED | `go.mod`, `plugin.go`, `202610160001_create_golem15_chatchannels_baseline.go`; handle comments only, no ALTER |
| 16 | D-14: `AccessResolver` CanAccess/CanManage default false; `SetAccessResolver` installs the host; Boot `slog.Warn` while DenyAll remains | ✓ VERIFIED | `classes/deny_all.go`; `boot.go` Warn + Publish |
| 17 | D-13 chatchannels message listeners: Boot listens `MessageCreated` / `Updated` / `Deleted`; accrue/reconcile/remove mentions and indexer; does not import chat models | ✓ VERIFIED | `boot.go` `Listen[*chatevents.MessageCreated]` etc.; `models/message_index.go` duplicates `messageTypeSystem` so models stay a leaf |
| 18 | D-20: `MessageIndex.SearchableAs` returns `messages`; document fields id/content/conversation_id/sender_id/type/created_at Unix; `ShouldBeSearchable` excludes TYPE_SYSTEM and empty content; indexer fail-open | ✓ VERIFIED | `models/message_index.go`; `search_indexer.go` Warn on Sync/Remove error. WR-01 (HTTP search not context-filtered) is a warning on the handler, not this contract |
| 19 | D-12: rewrite of `golem15_chatchannels_channels.context_type` uses the same `LegacyPHPClass` map as chat; command is idempotent | ✓ VERIFIED | `chat:rewrite-context-types` and `chatchannels:rewrite-context-types` both walk `LegacyPHPClass` |
| 20 | D-15: `users.handle VARCHAR(255) NULL` + unique index `users_handle_unique` IF NOT EXISTS; HandleGenerator charset subset of `[A-Za-z0-9._-]`; MentionParser `@([\w.-]{2,255})` resolves among that conversation's participants | ✓ VERIFIED | `202610160002_add_handle_to_users.go`; `handle_generator.go`; `mention_parser.go`; `ResolveMentionedParticipantIDs` joins `users.handle` to `golem15_chat_participants`, excludes sender |
| 21 | D-13 GDPR: `user.Created` / `user.Deleting` fire from create paths and `FormAfterDelete` before unscoped delete; chatchannels listens and `SeverUserFromContext` preserves remaining members' channels | ✗ FAILED | Events and the listener exist (`classes/events.go`, `FormAfterDelete`, `boot.go` `onUserDeleting`). Sever does not reassign `created_by`, so CASCADE still wipes the shared channel (CR-02) |
| 22 | D-17: sm-user-plugin Boot registers lighthouse namespace `user` if free; `user:{id}` allowed only to that user | ✓ VERIFIED | `classes/authorizer.go` `RegisterUserAuthorizer` / `AuthorizeUser` |
| 23 | D-06 / D-08 / D-09 chatchannels API: `/_chatchannels/api/v1`, `jwt.auth`, bucket `chatchannels-api` 120/min, contexts at `/contexts/{type}/{id}/…` | ✓ VERIFIED | `routes.go` full ChannelService resource set. WR-01..WR-03 are handler/service bugs on search/join/pin, not missing prefix/auth |
| 24 | D-21: `testdata/PHP_METHOD_MAP.md` lists 59 chat and 106 chatchannels PHP test methods, each mapped to a Go case; `TestPHPMethodMap` fails if a PHP method is missing | ✓ VERIFIED | 59 and 106 `test_*` rows; `php_method_map_test.go` compares the map to `php_methods.txt` and optionally the frozen PHP tree |
| 1 | SC-19-1: chat schema, models, adapters, jobs, commands and routes port 1:1; ChatChannels plugs in through the same adapter | ✓ VERIFIED | Schema/models/jobs/commands/routes exist and ChatChannels uses `chat.Context`. Send authorization now matches PHP: `canSend` returns `s.isParticipant` after nil/zero-id guards (`classes/service.go:304-308`); `SendMessage` maps false to `ErrNotParticipant` (`service.go:159-164`). No HasMember fallback in `canSend`. `HasMember` remains only on `GetOrCreateDm` / `GetGroupChat` / context helpers. Named case `TestTeammateDMWriteIDOR` (cited PASS) |
| 2 | SC-19-2: realtime broadcasts and channel authorization go through lighthouse; no WebSockets plugin | ✓ VERIFIED | `bootRealtime` binds `chat.message` and `Registry.Register("chat", AuthorizeChatLookup)`; `AuthorizeChat` splits `chat:conversation:{id}` locally, participants only, capabilities `["prs"]`. No WebSockets plugin in either repo. Unchanged this gap round |
| 3 | SC-19-3: golden tests match PHP serializers and every realtime event; `/_wave` deferred to the Wavepath port | ✓ VERIFIED | Chat goldens: `message_to_api_array`, `created_chat_message` (ids-only, no `content` key), typing/read/unread/deleted. Channel goldens: channel/category/pref/pin/mention/`mentions.changed`. Required names in `scripts/check-phase19.sh`. Unchanged this gap round |
| 4 | SC-19-4: unit tests delivered in the last plan | ✓ VERIFIED | Plan 19-07 (tests last of the gap round): `TestTeammateDMWriteIDOR`, `TestDeletingCascade` creator path, `PG_CHAT_TESTS` includes the new name. Plan 19-05 goldens/`PHP_METHOD_MAP.md`/`TestNoQuestStreamTrace` still required |
| 5 | D-01 chat: module `git.golem15.com/golem15/sm-chat-plugin`, package `chat`, plugin ID `golem15.chat`, Requires `golem15.user`; tables `golem15_chat_conversations`, `_participants`, `_messages`, `_thread_summaries` | ✓ VERIFIED | `go.mod`, `plugin.go` `PluginID`, baseline CREATE TABLE names. Unchanged |
| 6 | D-04 / D-05: one gormigrate ID `202610160001_create_golem15_chat_baseline`, `IF NOT EXISTS`, TIMESTAMPTZ/JSONB, never adds or drops the legacy owner column | ✓ VERIFIED | Baseline ID and SQL; `family_id` absent. Gap plans did not ALTER the baseline; `golem15_chat_conversations_created_by_foreign` ON DELETE CASCADE still present (lines 26-27) |
| 7 | D-11: `Registry.Add` stores the alias; `Resolver` returns `ErrUnknownContextType` and is never skipped; chat registers no host aliases | ✓ VERIFIED | `contracts/registry.go`; `bootRegistry` publishes an empty registry. Unchanged |
| 8 | D-03: `Context.CanActFor`; default adapter true only when `actorID == memberID` | ✓ VERIFIED | `contracts/context.go` interface + `DefaultCanActFor`. Unchanged |
| 9 | D-13 / D-16 chat writes: `SendMessage` / `EditMessage` / `DeleteMessage` persist in `lagoon.Transaction` and Fire `MessageCreated` / `Updated` / `Deleted` inside that tx; Bind alias `chat.message`; ids-only payload | ✓ VERIFIED | `classes/service.go` and `writes.go` Fire inside the tx; `boot.go` Bind `Alias: "chat.message"`. Unchanged |
| 10 | D-06 / D-08: `/_chat/api/v1`; contexts as `/contexts/{type}/{id}/…`; participation checked on every call; unknown type 404 | ✓ VERIFIED | Prefix and addressing hold. Write path is now participant-only: `canSend` → `isParticipant`; HTTP `ErrNotParticipant` → 404 (`api/errors.go:56-64`). `TestTeammateDMWriteIDOR`: A opens DM with B (exactly two participants); C (same `acme.teams` host) POST `/conversations/{id}/messages` is 404; A is 200/201. Read path still `CanView` (participant or overseer). CONTEXT D-08 is the contract; Plan 02's older "participation or HasMember" wording is no longer in production `canSend` |
| 11 | D-09: groups use `jwt.auth` and named buckets; DM start `chat-dm` Max 10 / minute keyed by frontend user id else ClientIP | ✓ VERIFIED | `routes.go` `surf.Use("jwt.auth", "throttle:chat-api")` and `throttle:chat-dm`. Unchanged |
| 12 | D-07: operations match Wavepath community chat including `PUT /threads/{rootId}/mute` with body `muted`; persistence is `golem15_chat_thread_mutes` | ✓ VERIFIED | Route mounted; mute table in chat baseline. Unchanged |
| 13 | D-10: `/api/chat/dm` and `/api/chat/attachments/{messageId}/{fileId}` are not registered | ✓ VERIFIED | Only `/_chat/api/v1` groups in `routes.go`. Unchanged |
| 14 | D-18: uploads through `attach.Store` with ChatAttachmentPolicy (MaxBytes `102400*1024`, max 5, KNOWN_EXTS, SVG/HTML/XML banned); downloads stream from `/_chat/api/v1/attachments/{messageId}/{fileId}` after participation check; missing and unauthorized 404 | ✓ VERIFIED | `attachment_policy.go`, `api/download.go`. WR-04 (filename header) does not undo the participation gate |
| 15 | D-01 / D-04 chatchannels: module `git.golem15.com/golem15/sm-chatchannels-plugin`, package `chatchannels`, `golem15.chatchannels`, Requires chat+user; baseline eight PHP v1.6.0 tables, never adds `users.handle` | ✓ VERIFIED | `go.mod`, `plugin.go`, baseline. Unchanged |
| 16 | D-14: `AccessResolver` CanAccess/CanManage default false; `SetAccessResolver` installs the host; Boot `slog.Warn` while DenyAll remains | ✓ VERIFIED | `classes/deny_all.go`; `boot.go` Warn + Publish. Unchanged |
| 17 | D-13 chatchannels message listeners: Boot listens `MessageCreated` / `Updated` / `Deleted`; accrue/reconcile/remove mentions and indexer; does not import chat models | ✓ VERIFIED | `boot.go` `Listen[*chatevents.MessageCreated]` etc. Unchanged |
| 18 | D-20: `MessageIndex.SearchableAs` returns `messages`; document fields id/content/conversation_id/sender_id/type/created_at Unix; `ShouldBeSearchable` excludes TYPE_SYSTEM and empty content; indexer fail-open | ✓ VERIFIED | `models/message_index.go`; `search_indexer.go`. WR-01 remains a warning on the HTTP handler, not this contract |
| 19 | D-12: rewrite of `golem15_chatchannels_channels.context_type` uses the same `LegacyPHPClass` map as chat; command is idempotent | ✓ VERIFIED | Both rewrite commands walk `LegacyPHPClass`. Unchanged |
| 20 | D-15: `users.handle VARCHAR(255) NULL` + unique index `users_handle_unique` IF NOT EXISTS; HandleGenerator charset subset of `[A-Za-z0-9._-]`; MentionParser `@([\w.-]{2,255})` resolves among that conversation's participants | ✓ VERIFIED | Handle migration, generator, mention parser. Unchanged |
| 21 | D-13 GDPR: `user.Created` / `user.Deleting` fire from create paths and `FormAfterDelete` before unscoped delete; chatchannels listens and `SeverUserFromContext` preserves remaining members' channels | ✓ VERIFIED | Chat now owns `user.Deleting` reassignment: `boot.go` `Listen[*userclasses.DeletingEvent]` → `WithDB(ev.Tx).ReassignCreatedBy`. `ReassignCreatedBy` (`service.go:115-139`) updates `created_by` to another remaining participant; empty conversations skip (CASCADE of an empty row is acceptable). Baseline CASCADE and PHP constraint name unchanged. chatchannels `SeverUserFromContext` still only removes that user's members/prefs/participants. `TestDeletingCascade`: Bob-as-member block kept; Alice creates a second private channel with Bob; Fire `DeletingEvent` then `Unscoped` delete of Alice; Bob's member row, channel row, and conversation row remain; `created_by` is Bob. `bootChannels` default plugins include `golem15.chat` so the listener is mounted. Cited PASS |
| 22 | D-17: sm-user-plugin Boot registers lighthouse namespace `user` if free; `user:{id}` allowed only to that user | ✓ VERIFIED | `classes/authorizer.go` `RegisterUserAuthorizer` / `AuthorizeUser`. Unchanged |
| 23 | D-06 / D-08 / D-09 chatchannels API: `/_chatchannels/api/v1`, `jwt.auth`, bucket `chatchannels-api` 120/min, contexts at `/contexts/{type}/{id}/…` | ✓ VERIFIED | `routes.go` full ChannelService resource set. WR-01..WR-03 remain handler/service bugs, not missing prefix/auth |
| 24 | D-21: `testdata/PHP_METHOD_MAP.md` lists 59 chat and 106 chatchannels PHP test methods, each mapped to a Go case; `TestPHPMethodMap` fails if a PHP method is missing | ✓ VERIFIED | 59 and 106 `test_*` rows still present |
| 25 | D-02: `TestNoQuestStreamTrace` greps production sources for the four locked tokens and fails on a hit; fixture id `acme.teams` stays out of production | ✓ VERIFIED | Both plugins' `queststream_trace_test.go`; required by `check-phase19.sh` |
| 26 | `scripts/check-phase19.sh` is fail-closed: named tests must pass; skipped/missing/red required test fails; no admin or layers stage | ✓ VERIFIED | Script lists named short + postgres suites; `--self-test` passed this pass (`phase19 self-test passed`). Orchestrator: `--all` green |
| 26 | `scripts/check-phase19.sh` is fail-closed: named tests must pass; skipped/missing/red required test fails; no admin or layers stage | ✓ VERIFIED | `PG_CHAT_TESTS` now includes `TestTeammateDMWriteIDOR` (slash-free) plus `TestChatHTTPTracer`; `PG_CHATCHANNELS_TESTS` still has `TestDeletingCascade`; self-test token loop greps the new name. This pass: `bash scripts/check-phase19.sh --self-test` → `phase19 self-test passed`. Gap-round `--all` recorded `phase19 postgres passed` |
**Score:** 23/26 truths verified (0 present, behavior-unverified)
**Score:** 26/26 truths verified (0 present, behavior-unverified)
CONTEXT D-08 is the contract for item 10, not the Plan 02 restatement that added "or HasMember".
CONTEXT D-08 is the contract for item 10. Production `canSend` no longer implements the Plan 02 "or HasMember" restatement.
### Deferred Items
@@ -129,78 +116,94 @@ CONTEXT D-08 is the contract for item 10, not the Plan 02 restatement that added
| 1 | `/_wave` route-level parity | Wavepath app port | SC-19-3 last sentence |
| 2 | Vue chat UI, satellites, `chat:migrate-attachments` | Phase 19.1 / D-19 | ROADMAP 19.1; CONTEXT D-19 |
CR-01 and CR-02 are **not** deferred. Phase 19.2 replays Wavepath traffic; it does not name DM write-IDOR or GDPR CASCADE.
WR-01..WR-04 and IN-01..IN-02 are **not** deferred must-haves. They stay open by 19-06/19-07 plan prohibition and do not flip this verdict.
### Advisory (New Scope, Unevidenced)
None. Re-verification Step 7 found no new-scope unevidenced blockers. WR-01..WR-04 and IN-01..IN-02 were already recorded on the prior pass as warnings/info and remain so.
### Required Artifacts
| Artifact | Expected | Status | Details |
|----------|----------|--------|---------|
| `../sm-chat-plugin/plugin.go` | golem15.chat plugin | ✓ VERIFIED | `PluginID`, Requires, config/lang/migrations/models/jobs/commands/routes |
| `../sm-chat-plugin/updates/202610160001_create_golem15_chat_baseline.go` | idempotent v1.3.0 baseline minus D-05 column | ✓ VERIFIED | `IF NOT EXISTS`; CASCADE on `created_by` is the CR-02 schema (PHP-named constraint kept) |
| `../sm-chat-plugin/updates/202610160001_create_golem15_chat_baseline.go` | idempotent v1.3.0 baseline minus D-05 column | ✓ VERIFIED | `IF NOT EXISTS`; PHP-named `created_by` CASCADE kept (19-06 prohibition) |
| `../sm-chat-plugin/contracts/context.go` | Context including CanActFor and BroadcastChannel | ✓ VERIFIED | |
| `../sm-chat-plugin/classes/service.go` | ChatService successor | ✓ VERIFIED | Substantive; `canSend` is the CR-01 defect, not a stub |
| `../sm-chat-plugin/classes/service.go` | ChatService successor | ✓ VERIFIED | `canSend` → `return s.isParticipant`; `WithDB`; `ReassignCreatedBy` |
| `../sm-chat-plugin/boot.go` | Bind + chat authorizer + user.Deleting | ✓ VERIFIED | `bootListeners` → `onUserDeleting` → `ReassignCreatedBy` |
| `../sm-chat-plugin/events/events.go` | MessageCreated/Updated/Deleted | ✓ VERIFIED | `golem15.chat.message.created` etc. |
| `../sm-chat-plugin/routes.go` | APIPrefix, buckets, jwt.auth | ✓ VERIFIED | `/_chat/api/v1` |
| `../sm-chat-plugin/api/download.go` | participation-gated private blob stream | ✓ VERIFIED | `Content-Disposition`; WR-04 unsanitized filename |
| `../sm-chat-plugin/classes/attachment_policy.go` | Limits and banned MIME | ✓ VERIFIED | `102400` |
| `../sm-chat-plugin/gap_closure_test.go` | 19-06 smoke of both post-fix behaviours | ✓ VERIFIED | `TestGapClosureSmoke` (not a required gate name) |
| `../sm-chat-plugin/http_tracer_test.go` | HTTP 404 teammate DM write | ✓ VERIFIED | `TestTeammateDMWriteIDOR` + unchanged `TestChatHTTPTracer` |
| `../sm-chatchannels-plugin/plugin.go` | golem15.chatchannels | ✓ VERIFIED | |
| `../sm-chatchannels-plugin/updates/202610160001_create_golem15_chatchannels_baseline.go` | eight v1.6.0 tables | ✓ VERIFIED | `golem15_chatchannels_channels` |
| `../sm-chatchannels-plugin/classes/channel_service.go` | ChannelService | ✓ VERIFIED | `CreateChannel`; WR-02/WR-03 in Join/Pin |
| `../sm-chatchannels-plugin/classes/channel_service.go` | ChannelService | ✓ VERIFIED | `CreateChannel`; `SeverUserFromContext` still no `created_by` write (chat owns it); WR-02/WR-03 in Join/Pin |
| `../sm-chatchannels-plugin/classes/search_indexer.go` | fail-open beachcomber | ✓ VERIFIED | `SearchableAs` |
| `../sm-chatchannels-plugin/http_tracer_test.go` | creator-delete CASCADE case | ✓ VERIFIED | `TestDeletingCascade` Bob-as-member + Alice-as-creator Unscoped |
| `../fonoteka.go/plugins/golem15/user/updates/202610160002_add_handle_to_users.go` | handle column | ✓ VERIFIED | `ADD COLUMN IF NOT EXISTS handle` |
| `../fonoteka.go/plugins/golem15/user/classes/handle_generator.go` | unique handle generation | ✓ VERIFIED | |
| `../sm-chatchannels-plugin/routes.go` | `/_chatchannels/api/v1` | ✓ VERIFIED | |
| `../sm-chat-plugin/testdata/PHP_METHOD_MAP.md` | 59-row map | ✓ VERIFIED | 59 `test_*` rows |
| `../sm-chatchannels-plugin/testdata/PHP_METHOD_MAP.md` | 106-row map | ✓ VERIFIED | 106 `test_*` rows |
| `scripts/check-phase19.sh` | phase gate | ✓ VERIFIED | Contains `TestGoldenEvents`; `--self-test` green |
| `scripts/check-phase19.sh` | phase gate | ✓ VERIFIED | `TestTeammateDMWriteIDOR` in `PG_CHAT_TESTS` and self-test token loop; `--self-test` green |
**Artifacts:** 18/18 exist and are substantive. None are stubs. Goal failure is behavioral (authorization / CASCADE), not missing files.
**Artifacts:** 22/22 exist and are substantive. None are stubs.
### Key Link Verification
| From | To | Via | Status | Details |
|------|----|-----|--------|---------|
| `../sm-chat-plugin/boot.go` | `../sm-chat-plugin/classes/authorizer.go` | `lighthouse.From` then `Registry.Register("chat", …)` | ✓ WIRED | `boot.go` `Register("chat", classes.AuthorizeChatLookup(…))` |
| `../sm-chat-plugin/classes/service.go` | `../sm-chat-plugin/events/events.go` | Fire MessageCreated/Updated/Deleted inside the write tx | ✓ WIRED | `MessageUpdated` in `writes.go` |
| `../sm-chat-plugin/boot.go` | `../sm-chat-plugin/classes/authorizer.go` | `lighthouse.From` then `Registry.Register("chat", …)` | ✓ WIRED | `Register("chat", classes.AuthorizeChatLookup(…))` |
| `../sm-chat-plugin/classes/service.go` | `../sm-chat-plugin/events/events.go` | Fire MessageCreated/Updated/Deleted inside the write tx | ✓ WIRED | |
| `../sm-chat-plugin/classes/service.go` | `../sm-chat-plugin/classes/service.go` | `canSend` returns `s.isParticipant`; `SendMessage` maps false to `ErrNotParticipant` | ✓ WIRED | `service.go:308` and `:159-164` |
| `../sm-chat-plugin/api/errors.go` | `../sm-chat-plugin/classes/service.go` | `ErrNotParticipant` maps to HTTP 404 | ✓ WIRED | `errors.go:58` |
| `../sm-chat-plugin/boot.go` | `../fonoteka.go/plugins/golem15/user/classes/events.go` | `Listen[*userclasses.DeletingEvent]` then `ReassignCreatedBy` on the event Tx | ✓ WIRED | `boot.go:183-192` |
| `../sm-chat-plugin/console/rewrite_context_types.go` | `../sm-chat-plugin/contracts/registry.go` | D-12 rewrite uses `LegacyPHPClass` | ✓ WIRED | |
| `../sm-chat-plugin/api/messages.go` | `../sm-chat-plugin/classes/service.go` | handlers call `classes.Service`; they do not write rows | ✓ WIRED | `api/auth.go` `Lookup[*classes.Service]`; `PostMessage` → `SendMessage` |
| `../sm-chat-plugin/api/download.go` | `modules/lagoon/attach` | `bucket.NewReader` after participant check | ✓ WIRED | `download.go` and `classes/attachments.go` |
| `../sm-chat-plugin/api/messages.go` | `../sm-chat-plugin/classes/service.go` | handlers call `classes.Service`; they do not write rows | ✓ WIRED | `PostMessage` → `SendMessage` → `canSend` |
| `../sm-chat-plugin/api/download.go` | `modules/lagoon/attach` | `bucket.NewReader` after participant check | ✓ WIRED | |
| `../sm-chat-plugin/http_tracer_test.go` | `../sm-chat-plugin/api/dm.go` | POST DM then teammate POST message is 404 | ✓ WIRED | `TestTeammateDMWriteIDOR` |
| `../sm-chatchannels-plugin/boot.go` | `../sm-chat-plugin/events/events.go` | Listen MessageCreated/Updated/Deleted | ✓ WIRED | |
| `../sm-chatchannels-plugin/classes/channel_service.go` | `../sm-chatchannels-plugin/contracts/access_resolver.go` | every access check through resolver; default deny-all | ✓ WIRED | `CanAccessContext` |
| `../sm-chatchannels-plugin/classes/channel_service.go` | `../sm-chatchannels-plugin/contracts/access_resolver.go` | every access check through resolver; default deny-all | ✓ WIRED | |
| `../sm-chatchannels-plugin/classes/search_indexer.go` | `modules/beachcomber` | `SearchableAs` `"messages"`; fail-open Sync | ✓ WIRED | |
| `../fonoteka.go/plugins/golem15/user/plugin.go` | `modules/lighthouse` | Boot `Register("user")` if free | ✓ WIRED | `classes/authorizer.go` `Register("user", AuthorizeUser())` |
| `../sm-chatchannels-plugin/boot.go` | `../fonoteka.go/plugins/golem15/user/classes/events.go` | Listen `user.Deleting` then `SeverUserFromContext` | ✓ WIRED | Listener is wired; GDPR outcome still fails (CR-02) |
| `../sm-chatchannels-plugin/api/channels.go` | `../sm-chatchannels-plugin/classes/channel_service.go` | handlers call ChannelService only | ✓ WIRED | `api/auth.go` `Lookup[*classes.ChannelService]` |
| `../fonoteka.go/plugins/golem15/user/plugin.go` | `modules/lighthouse` | Boot `Register("user")` if free | ✓ WIRED | |
| `../sm-chatchannels-plugin/boot.go` | `../fonoteka.go/plugins/golem15/user/classes/events.go` | Listen `user.Deleting` then `SeverUserFromContext` | ✓ WIRED | GDPR outcome now holds because chat reassigns first/alongside |
| `../sm-chatchannels-plugin/http_tracer_test.go` | `../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go` | Fire `DeletingEvent` then Unscoped delete of the creator | ✓ WIRED | `TestDeletingCascade` lines 298-323; `bootChannels` mounts `golem15.chat` |
| `../sm-chatchannels-plugin/api/channels.go` | `../sm-chatchannels-plugin/classes/channel_service.go` | handlers call ChannelService only | ✓ WIRED | |
| `../sm-chat-plugin/golden_test.go` | `../sm-chat-plugin/testdata/goldens` | byte-compare event name, channels, payload | ✓ WIRED | `TestGoldenEvents` |
| `../sm-chatchannels-plugin/golden_test.go` | `../sm-chatchannels-plugin/testdata/goldens` | byte-compare arrays and `mentions.changed` | ✓ WIRED | `TestChannelGoldenEvents` |
| `scripts/check-phase19.sh` | `../sm-chat-plugin` | `go -C` named tests; fail-closed detectors | ✓ WIRED | `TestNoQuestStreamTrace` in required lists |
| `scripts/check-phase19.sh` | `../sm-chat-plugin/http_tracer_test.go` | `PG_CHAT_TESTS` requires `TestTeammateDMWriteIDOR` by name | ✓ WIRED | `go_named` slash-free; self-test token loop |
**Wiring:** 14/14 connections present. CR-01/CR-02 are wrong behavior on wired paths, not missing links.
**Wiring:** 19/19 connections present.
### Data-Flow Trace (Level 4)
| Artifact | Data Variable | Source | Produces Real Data | Status |
|----------|---------------|--------|--------------------|--------|
| `api/messages.go` ListMessages | `out []MessageAPI` | `svc.GetMessages` → GORM `golem15_chat_messages` then `MessageAPI` | Yes | ✓ FLOWING |
| `api/messages.go` PostMessage | created message | `svc.SendMessage` → `tx.Create(msg)` | Yes (also the CR-01 write) | ✓ FLOWING |
| `api/messages.go` PostMessage | created message | `svc.SendMessage` → `canSend`/`isParticipant` then `tx.Create(msg)` | Yes; teammate-of-DM is 404 | ✓ FLOWING |
| `api/download.go` | blob bytes | `bucket.NewReader` after participant check | Yes | ✓ FLOWING |
| `api/search.go` | `ids` | `beachcomber.Engine().SearchIDs` on collection `messages` | Yes, but unscoped (WR-01) | ✓ FLOWING |
| lighthouse Bind payload | created.chat.message | `broadcastPayload` ids-only | Yes; golden has no `content` | ✓ FLOWING |
| `ReassignCreatedBy` | `created_by` | GORM update to another `golem15_chat_participants.user_id` on the deleting event Tx | Yes; proven by `TestDeletingCascade` | ✓ FLOWING |
No hollow/static serializer path. Search is real engine data without a context filter.
No hollow/static serializer path. Search is real engine data without a context filter (WR-01, not a must-have).
### Behavioral Spot-Checks
| Behavior | Command | Result | Status |
|----------|---------|--------|--------|
| Fail-closed detectors | `bash scripts/check-phase19.sh --self-test` | `phase19 self-test passed` | ✓ PASS |
| Phase gate (orchestrator evidence) | `bash scripts/check-phase19.sh --all` | recorded green (self-test, plugins, docs, postgres); not re-run here | ✓ PASS (cited) |
| Framework short tests (orchestrator) | `go test -short ./...` in summercms.go | recorded green; not re-run here | ✓ PASS (cited) |
| PHP method map counts | grep `^\| test_` on both `PHP_METHOD_MAP.md` | 59 chat, 106 chatchannels | ✓ PASS |
| CR-01 canSend HasMember fallback | read `classes/service.go:255-273` | participant count then `host.HasMember` | ✗ FAIL (code) |
| CR-02 created_by CASCADE + no reassignment | read chat baseline + `SeverUserFromContext` | CASCADE present; no `created_by` update | ✗ FAIL (code) |
| Fail-closed detectors | `bash scripts/check-phase19.sh --self-test` | `phase19 self-test passed` (this pass) | ✓ PASS |
| Phase gate postgres names | `grep TestTeammateDMWriteIDOR scripts/check-phase19.sh` | in `PG_CHAT_TESTS` and self-test token loop | ✓ PASS |
| CR-01 canSend is participant-only | read `classes/service.go:304-308` | `return s.isParticipant(ctx, conv.ID, senderID)` after nil/zero-id guards; no HasMember | ✓ PASS (code) |
| CR-01 HTTP teammate DM write | `TestTeammateDMWriteIDOR` (gap-round cited) | C POST into A↔B DM is 404; A is 200/201; two participants | ✓ PASS (cited) |
| CR-02 ReassignCreatedBy + listener | read `service.go:115-139` + `boot.go:176-192` | chat-owned `user.Deleting` updates `created_by`; baseline CASCADE not ALTER'd | ✓ PASS (code) |
| CR-02 creator-delete CASCADE | `TestDeletingCascade` (gap-round cited) | Fire + Unscoped Alice; Bob member, channel, conversation remain; `created_by` = Bob | ✓ PASS (cited) |
| CR-01/CR-02 smoke | `TestGapClosureSmoke` (gap-round cited) | Carol `ErrNotParticipant` on Alice/Bob DM; Alice send ok; group lazy-join; after Alice delete DM `created_by` = Bob | ✓ PASS (cited) |
| Phase gate (gap-round) | `bash scripts/check-phase19.sh --all` | recorded `phase19 postgres passed`; not re-run here | ✓ PASS (cited) |
Postgres suite was not re-run (orchestrator evidence + CR-01/CR-02 are proven by source).
Postgres suite was not re-run. Must-haves that previously failed are proven by source plus the named tests the user recorded green this gap round.
### Probe Execution
@@ -210,7 +213,7 @@ Postgres suite was not re-run (orchestrator evidence + CR-01/CR-02 are proven by
### Decision Coverage
All 21 trackable CONTEXT.md decisions (D-01..D-21) are honored by shipped artifacts (`check decision-coverage-verify`: honored 21 / total 21, `not_honored: []`). Honoring a decision in artifacts is not the same as the decision holding at runtime: D-08 and D-13 are present in code and still fail the observable truths above.
All 21 trackable CONTEXT.md decisions (D-01..D-21) are honored by shipped artifacts (`check decision-coverage-verify`: honored 21 / total 21, `not_honored: []`). D-08 and D-13 now hold at runtime as well as in artifacts.
### Requirements Coverage
@@ -218,18 +221,18 @@ REQUIREMENTS.md has **no** `SC-19-*` rows (ROADMAP Phase 19 Requirements line is
| Requirement | Source Plan | Description | Status | Evidence |
|-------------|-------------|-------------|--------|----------|
| SC-19-1 | ROADMAP + 19-01..04 | 1:1 schema/models/adapters/jobs/commands/routes | ✗ BLOCKED | CR-01 sendMessage authorization |
| SC-19-1 | ROADMAP + 19-01..04, 19-06 | 1:1 schema/models/adapters/jobs/commands/routes | ✓ SATISFIED | participant-only `canSend`; `TestTeammateDMWriteIDOR` |
| SC-19-2 | ROADMAP + 19-01 | lighthouse realtime, no WebSockets | ✓ SATISFIED | Bind + authorizers |
| SC-19-3 | ROADMAP + 19-02, 19-05 | goldens; `/_wave` deferred | ✓ SATISFIED | goldens + named tests; `/_wave` deferred |
| SC-19-4 | ROADMAP + 19-05 | unit tests last plan | ✓ SATISFIED | 19-05 + check-phase19.sh |
| SC-19-4 | ROADMAP + 19-05, 19-07 | unit tests last plan | ✓ SATISFIED | 19-07 named postgres + check-phase19.sh |
| D-01 | 19-01, 19-03 | module/package/plugin IDs and table names | ✓ SATISFIED | |
| D-02 | 19-05 | no QuestStream tokens | ✓ SATISFIED | TestNoQuestStreamTrace |
| D-03 | 19-01 | CanActFor | ✓ SATISFIED | |
| D-04 / D-05 | 19-01, 19-03 | squashed IF NOT EXISTS baselines; no family_id | ✓ SATISFIED | |
| D-06 / D-07 / D-09 / D-10 | 19-02, 19-04 | generic APIs, throttle, no legacy /api/chat | ✓ SATISFIED | |
| D-08 | 19-02 | participation on every call | ✗ BLOCKED | CR-01 |
| D-08 | 19-02, 19-06, 19-07 | participation on every call | ✓ SATISFIED | `canSend` → `isParticipant`; HTTP 404 |
| D-11 / D-12 | 19-01, 19-03 | registry + rewrite | ✓ SATISFIED | |
| D-13 | 19-01, 19-03, 19-04 | festival hooks + GDPR sever | ✗ BLOCKED | events/listeners yes; GDPR wipe CR-02 |
| D-13 | 19-01, 19-03, 19-04, 19-06, 19-07 | festival hooks + GDPR sever | ✓ SATISFIED | chat `ReassignCreatedBy`; chatchannels `SeverUserFromContext`; creator-delete test |
| D-14 | 19-03 | deny-all AccessResolver | ✓ SATISFIED | |
| D-15 | 19-04 | users.handle | ✓ SATISFIED | |
| D-16 / D-17 | 19-01, 19-04 | lighthouse chat + user namespaces | ✓ SATISFIED | |
@@ -244,16 +247,16 @@ No `TBD` / `FIXME` / `XXX` in plugin production sources or `scripts/check-phase1
| File | Line | Pattern | Severity | Impact |
|------|------|---------|----------|--------|
| `../sm-chat-plugin/classes/service.go` | 255-273 | `canSend` HasMember fallback (CR-01) | 🛑 Blocker | Write IDOR into another pair's DM; fails D-08 / SC-19-1 |
| `../sm-chat-plugin/updates/202610160001_create_golem15_chat_baseline.go` | 26-27 | `created_by` ON DELETE CASCADE without reassignment (CR-02) | 🛑 Blocker | Deleting the creator wipes the channel; fails D-13 GDPR |
| `../sm-chatchannels-plugin/api/search.go` | 25-38 | `SearchIDs` with only `q` after context access check (WR-01) | ⚠️ Warning | Cross-context existence oracle; not a locked must-have |
| `../sm-chatchannels-plugin/classes/channel_service.go` | 958-968 | `JoinChannel` only clears `has_left` (WR-02) | ⚠️ Warning | Public join does not grant send rights |
| `../sm-chatchannels-plugin/classes/channel_service.go` | 959-968 | `JoinChannel` only clears `has_left` (WR-02) | ⚠️ Warning | Public join does not grant send rights |
| `../sm-chatchannels-plugin/classes/channel_service.go` | 1332-1344 | `PinMessage` does not load the message (WR-03) | ⚠️ Warning | Pin IDOR across conversations |
| `../sm-chat-plugin/api/download.go` | 63-68 | `Content-Disposition` interpolates unsanitized filename (WR-04) | ⚠️ Warning | Header injection via upload name |
| `../sm-chat-plugin/classes/writes.go` | 38-40 | `GetGroupChat` ignores `addParticipant` error (IN-01) | ℹ️ Info | After CR-01, a failed join 200s then 404s on send |
| `../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go` | 516-532 | `user.Deleting` only from admin `FormAfterDelete` (IN-02) | ℹ️ Info | A later API/console hard-delete would skip Sever (and CR-02 reassignment) |
| `../sm-chat-plugin/classes/writes.go` | 38-40 | `GetGroupChat` ignores `addParticipant` error (IN-01) | ℹ️ Info | Failed join 200s then 404s on send (after CR-01 this is consistent) |
| `../fonoteka.go/plugins/golem15/user/controllers/users_admin_controller.go` | 516-532 | `user.Deleting` only from admin `FormAfterDelete` (IN-02) | ℹ️ Info | A later API/console hard-delete would skip Sever and reassignment |
Open review findings WR-01..WR-04 and IN-01..IN-02 are recorded here and in `19-REVIEW-DISPOSITION.md`. They do not independently flip a must-have; they remain open.
Prior blockers CR-01 (`canSend` HasMember) and CR-02 (CASCADE without reassignment) are gone from this table: `canSend` is participant-only; chat `user.Deleting` reassigns `created_by`.
Open review findings WR-01..WR-04 and IN-01..IN-02 stay in `19-REVIEW-DISPOSITION.md` as **open**. They do not independently flip a must-have.
### Test Quality Audit
@@ -261,41 +264,46 @@ Open review findings WR-01..WR-04 and IN-01..IN-02 are recorded here and in `19-
|-----------|-----------|--------|---------|----------|-----------------|---------|
| `sm-chat-plugin/golden_test.go` | SC-19-3 | yes | no | no — goldens `_source` names frozen PHP @943b712 | Value (byte-compare) | OK |
| `sm-chatchannels-plugin/golden_test.go` | SC-19-3 | yes | no | no — frozen PHP @b92fb42 | Value | OK |
| `sm-chat-plugin/php_method_map_test.go` | D-21 | yes | no | no | Value (map completeness) | OK; many PHP methods share one Go case (coarse, still mapped) |
| `sm-chat-plugin/php_method_map_test.go` | D-21 | yes | no | no | Value (map completeness) | OK |
| `sm-chat-plugin/queststream_trace_test.go` | D-02 | yes | no | no | Behavioral (walk sources) | OK |
| `sm-chatchannels-plugin` TestDeletingCascade | D-13 | yes (postgres) | skips under `-short` via TestMain | no | Behavioral | INSUFFICIENT for CR-02 — deletes a member, not the creator |
| HTTP tracers | D-08 | yes (postgres) | `-short` skip | no | Behavioral | INSUFFICIENT for CR-01 — stranger-of-context 404, not teammate-of-DM |
| `sm-chat-plugin/http_tracer_test.go` TestTeammateDMWriteIDOR | D-08 / CR-01 | yes (postgres) | skips under `-short` via TestMain | no | Behavioral (HTTP 404 + participant 200/201 + two-row count) | OK — closes the prior insufficient-assertion gap |
| `sm-chat-plugin/gap_closure_test.go` TestGapClosureSmoke | D-08 / D-13 | yes (postgres) | `-short` skip | no | Behavioral | OK — smoke, not a required gate name |
| `sm-chatchannels-plugin` TestDeletingCascade | D-13 / CR-02 | yes (postgres) | `-short` skip | no | Behavioral (Fire + Unscoped; member/channel/conversation/`created_by`) | OK — creator path added; Bob-as-member kept |
| HTTP tracers TestChatHTTPTracer | D-08 | yes (postgres) | `-short` skip | no | Behavioral | OK for stranger-of-context; teammate-of-DM is the new named case |
**Disabled tests on requirements:** 0 requirement-linked skips (Docker skip in TestMain is the documented `-short` gate).
**Circular patterns detected:** 0.
**Insufficient assertions:** 2 (the two critical gaps: no test for DM write-IDOR; no test for creator-delete CASCADE).
**Insufficient assertions:** 0 (the two prior insufficient cases are now named and asserted).
### Prohibitions
| Statement | Tier | Status | Evidence |
|-----------|------|--------|----------|
| Production sources never contain the four D-02 tokens; plugin.name is Chat / Czat | grep | held | `TestNoQuestStreamTrace`; `lang/en/lang.yaml` `plugin.name: "Chat"` / `"ChatChannels"` |
| Production sources never contain the four D-02 tokens; plugin.name is Chat / Czat | grep | held | `TestNoQuestStreamTrace`; lang names unchanged |
| summercms.go modules are not edited; no new third-party require beyond the analog pin set | grep | held | Framework artifact is `scripts/check-phase19.sh` only |
| `chat:migrate-attachments` is not ported; `/_wave` and friendship DMs stay out | grep / judgment | held | No command; no `/_wave` routes; `GetOrCreateDm` is context-scoped |
| Chat blobs never on `StaticHandler` / `StaticHandlerPublic` | grep | held | zero matches in sm-chat-plugin |
| Chat blobs never on `StaticHandler` / `StaticHandlerPublic` | grep | held | |
| `users.handle` is not a chatchannels migration; Searchable not on `chat.models.Message` | grep | held | |
| `User.MorphName` stays `Golem15\User\Models\User` | judgment | held | `models/user.go` |
| Do not ALTER the IF NOT EXISTS chat or chatchannels baseline; keep PHP constraint names including ON DELETE CASCADE | grep | held | `golem15_chat_conversations_created_by_foreign` still CASCADE; no new gormigrate ID |
| WR-01..WR-04 and IN-01..IN-02 stay open | judgment | held | JoinChannel / PinMessage / search.go / Content-Disposition / ignored addParticipant / FormAfterDelete fire site unread |
| `User.MorphName` stays `Golem15\User\Models\User` | judgment | held | |
| Plugins never patch each other's models | grep | held | festival listeners only |
### Human Verification Required
N/A — status is `gaps_found`. This is an infrastructure/plugin phase with no user-facing SPA. Realtime payloads are proven by goldens. The two blockers are source-visible; they do not need a human to confirm they exist.
N/A — Infrastructure/foundation phase with no user-facing elements.
All acceptance criteria are verifiable programmatically. The two previously failed truths are behavior-dependent and now have named postgres tests (`TestTeammateDMWriteIDOR`, `TestDeletingCascade` creator path). `behavior_unverified: 0`.
### Gaps Summary
The plugins, generic APIs, lighthouse authorizers, goldens, PHP method maps, handle column, and fail-closed gate are in place. The phase goal's outcome — **ready for the Wavepath port** — does not hold:
None. Both prior blockers are closed:
1. **CR-01 / D-08 / SC-19-1** — `canSend` treats host-context membership as send rights. A DM stores that host alias, so any context member can POST into another pair's thread. PHP refuses that. Wavepath clients that assume participant-only send will not match.
2. **CR-02 / D-13 GDPR** — deleting the user who created a conversation CASCADE-deletes the conversation and the channel. `SeverUserFromContext` never reassigns `created_by`. Remaining members lose the channel. `TestDeletingCascade` does not cover this.
1. **CR-01 / D-08 / SC-19-1** — `canSend` returns only `s.isParticipant`. A third context member POSTing into another pair's DM is HTTP 404. `GetGroupChat` still lazy-joins via `addParticipant`. Required gate name: `TestTeammateDMWriteIDOR`.
2. **CR-02 / D-13 GDPR** — chat-owned `user.Deleting` runs `ReassignCreatedBy` on the event Tx before the user row is deleted. Remaining members keep the conversation and channel. Baseline CASCADE is unchanged. Required case: `TestDeletingCascade` creator path (Fire + Unscoped).
Close those two with the review's fixes and named postgres cases, then re-verify. WR-01..WR-04 should be fixed in the same round or explicitly accepted; they are not must-have blockers on this pass.
WR-01..WR-04 remain open warnings. They are not must-have blockers on this pass.
---
_Verified: 2026-10-17T20:17:10Z_
_Verified: 2026-10-17T20:40:27Z_
_Verifier: Claude (msd-verifier)_