fix(assurance): round-3 production-readiness — build repair, test harness, topology, docs honesty (206 files) - #125
Merged
Merged
Conversation
…6.md (2026-08 re-verification @ 505705a) - Router count: 477 -> 418 (server/routers/*.ts) / 478 (api-server-ts mirror) - PWA pages: 457 -> 101 (client/src/pages/*.tsx) - Flutter: 203 screens "ready" -> 455 screen files but no pubspec.yaml repo-wide (not buildable) - React Native: 69 screens -> 0 (mobile-rn is a 5-file skeleton) - "tsc 0 errors" PASS -> FAIL (not clean; remediation in progress) - Schema tables: fix path to services/api-server-ts/drizzle/schema.ts (161 pgTable, 5519 lines); root drizzle/schema.ts absent - Go/Rust/Python service counts restated with explicit counting rules
…on @ 505705a) - 295 tests -> historical; current verifiable count: 174 test cases in services/api-server-ts (2 test files) - docker-compose.production.yml "Complete" -> Missing (absent from repo; Makefile.production still references it) - TypeScript "0 errors / Clean" -> not clean; remediation in progress - Flutter/RN "ready to build" -> not accurate (no pubspec.yaml repo-wide; mobile-rn is a 5-file skeleton) - Overall status softened to Near-Production (self-assessed)
…tion.yml - docker-compose.production.yml does not exist in the repo (@ 505705a); use root docker-compose.yml - Main app service is 'app' in docker-compose.yml (was 'pos-shell') - Fix clone URL to munisp/agentbanking - Add correction note: Vault/MinIO/TigerBeetle cluster not in current compose; Makefile.production still references the missing file
…n.yml - File absent from repo (@ 505705a); commands now use root docker-compose.yml - Main app service renamed pos-shell -> app per current compose file - Fix clone URL to munisp/agentbanking - Add correction note listing services not defined in current docker-compose.yml
- docker-compose.production.yml described as PRODUCTION but is absent from the repo; note added - docker-compose.override.yml/.final/.unified also absent; legacy list updated to match the tree - Makefile.production still references the missing file (flagged)
…-08 @ 505705a) - "444 tests pass / 0 TS errors" -> historical self-reported; verified today: 174 test cases in services/api-server-ts (2 files); tsc not clean - docker-compose.production.yml references -> file absent; use docker-compose.yml - Microservices line restated with verifiable counts (466 services dirs, 93 Cargo.toml, 192 go.mod)
…t/typecheck claims - 149 tests / zero TS errors were true only as of 2026-03-31; not reproducible @ 505705a - Conclusion softened: re-validate before launch decisions
… tests not reproducible @ 505705a
…tion error in previous commit)
…7 tests not reproducible @ 505705a
…ranscription error in previous commit)
…t.md (now byte-identical to main + correction banner)
…drizzle/schema.ts no longer exist @ 505705a
…kfile with manifest (round3-W2)
…crets (NF-SEC-13)
…ompose.yml
- Add tigerbeetle + tigerbeetle-format services (ghcr.io/tigerbeetle/tigerbeetle:0.16.43,
matching tigerbeetle-go v0.16.x clients; Helm chart 0.15.3 is stale), port 3001
to match existing TIGERBEETLE_URL refs; wire TB_ADDRESSES in middleware hub
- Add fluvio SC + single SPU from repo's own HA overlay (infinyon/fluvio:0.11.11)
so fluvio:9003 refs resolve
- Gate KYC/KYB block and TB middleware block behind "external-integrations"
profile (they reference hosts with no in-file service: permify, opensearch,
lakehouse, openappsec, mojaloop-switch, liveness-detection, kyb-*, deepface)
- Fix apisix config mount: ./infrastructure/apisix/config.yaml (absent) ->
./infra/apisix/config.yaml (real)
- Fail-closed weak secret defaults: PG_PASSWORD/KC_ADMIN_PASSWORD/
GRAFANA_PASSWORD/PGADMIN_PASSWORD ${VAR:-weak} -> ${VAR:?must be set}
…sed on legacy unsalted rows (NF-SEC-8)
…honest empty states (NF-FF-5)
…ranscription fix; content otherwise identical to previous commit)
…o fabricated metrics (NF-FF-27)
….yml content (TB+fluvio services, profile gating, apisix path, fail-closed secrets)
…er transfer (MB-15/16)
…rmify/ILP, visible cache degradation (MB-15/16)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 3: admin-dashboard tsc 541→0 + vite build green (147 files); 89 money-path unit tests (71 vitest + 18 pytest, executed green locally); Dockerfile rebuilt for services/api-server-ts; playwright.config testDir fix; compose/k8s topology repairs (tigerbeetle/fluvio services, apisix mount, mojaloop profile gating, 22 files of fail-closed secrets); NF-SEC-8 PBKDF2 upgrade; NF-SEC-13 seed regeneration (whsec_ literals eliminated via generator + stale 1.5MB JSON deleted); demo-data leftovers replaced with real queries/honest empties (3 routers); MB-15/16 catch-swallow hardening (5 money-path files); 0052 non-negative balance CHECK migration; 10 docs corrected to verified counts. EXTERNAL_BLOCKED (needs workflow-scope token or maintainer push): 7 repaired workflow files staged; pnpm-lock.yaml restore staged. See ledger PUSH_STATE.json round3-* keys.