fix(assurance): round-3 production-readiness — build repair, test harness, topology, docs honesty (206 files)

AUDIT-COMPREHENSIVE-2026-06.md

@@ -2,8 +2,7 @@
 
 ## Executive Summary
 
-Audited all 477 tRPC routers, 85 Go services, 54 Rust services, 288+ Python services,
-457 PWA pages, 203 Flutter screens, and 69 React Native screens.
+Audited the platform codebase. **Counts re-verified 2026-08 against commit `505705ac`** (file counts from the git tree; rules stated inline): 418 tRPC router files directly under `server/routers/` (478 in the `services/api-server-ts/server/routers/` mirror), 192 Go modules (`go.mod` files), 93 Rust crates (`Cargo.toml` files), 466 service directories under `services/` (316 of them contain Python), 101 PWA page components (`client/src/pages/*.tsx`), 455 Flutter screen files (`mobile-flutter/lib/screens/*.dart` — but **no `pubspec.yaml` exists anywhere in the repo, so the Flutter app is not currently buildable**), and a 5-file React Native skeleton (`mobile-rn/`, 0 screen files). The original June figures (477 routers / 457 PWA pages / 203 Flutter screens / 69 RN screens) do not match the current tree.
 
 **Overall Production Readiness: 7.4/10** (honest, not inflated)
 
@@ -17,13 +16,13 @@ Audited all 477 tRPC routers, 85 Go services, 54 Rust services, 288+ Python serv
 | No math/rand in production code                              | ✅ PASS | 0 Go files use math/rand                                                            |
 | No TODO/FIXME in Go or TypeScript                            | ✅ PASS | 0 in Go, 0 in Rust, 1 in TS (test file), 1 in Python (gRPC server)                  |
 | No console.log in frontend                                   | ❌ FAIL | **5 files** with 11 console.log calls in hooks/pages                                |
-| No scaffolded/empty handler functions                        | ✅ PASS | All 477 routers have real getDb() + Drizzle queries                                 |
+| No scaffolded/empty handler functions                        | ⚠️ STALE | Original claim covered "477 routers"; 2026-08 re-count finds 418 router files under `server/routers/` (478 in the mirror). Per-file content not re-verified |
 | No cross-project contamination                               | ❌ FAIL | **9 files** in server/\_core/ reference "Manus" platform                            |
-| All PWA pages wired to router                                | ✅ PASS | All 457 pages have real API calls                                                   |
+| All PWA pages wired to router                                | ⚠️ STALE | `client/src/pages/` holds 101 `.tsx` page components at `505705ac` (not 457); wiring not re-verified |
 | All Go routes with auth middleware                           | ❌ FAIL | **59/85** Go services lack auth middleware                                          |
 | All Rust routes with auth middleware                         | ❌ FAIL | **31/54** Rust services lack auth middleware                                        |
 | All middleware have real SDK clients                         | ✅ PASS | SDK clients with embedded fallbacks present                                         |
-| Zero TypeScript errors                                       | ✅ PASS | tsc --noEmit = 0 errors                                                             |
+| Zero TypeScript errors                                       | ❌ FAIL (2026-08 re-check) | `tsc --noEmit` is not error-free across the repo (e.g. `uis/admin-dashboard`); remediation in progress |
 | All top-level services robust (>100 lines, DB, no hardcoded) | ❌ FAIL | See below                                                                           |
 
 ### Services Failing Robustness Check
@@ -64,6 +63,8 @@ Audited all 477 tRPC routers, 85 Go services, 54 Rust services, 288+ Python serv
 | Super App                   | 1            | 8.5/10 | Full implementation                     |
 | TigerBeetle                 | 8            | 8.5/10 | Fixed — native client, persistence      |
 
+_Note (2026-08): the per-domain router counts above reflect the original June audit's domain mapping and predate the 2026-08 re-count (418 router files under `server/routers/` at `505705ac`); they have not been re-derived._
+
 ---
 
 ## 3. KYC/KYB/Liveness Assessment (§2 deep-dive)
@@ -93,19 +94,19 @@ Audited all 477 tRPC routers, 85 Go services, 54 Rust services, 288+ Python serv
 
 ## 4. PWA vs Mobile Parity
 
-| Platform     | Screens/Pages | Coverage |
-| ------------ | ------------- | -------- |
-| PWA          | 457           | 100%     |
-| Flutter      | 203           | 44%      |
-| React Native | 69            | 15%      |
+| Platform     | Screens/Pages (2026-08 re-count @ `505705ac`) | Notes |
+| ------------ | ---------------------------------------------- | ----- |
+| PWA          | 101 (`client/src/pages/*.tsx`)                 | React PWA; original "457 pages / 100%" claim not reproducible |
+| Flutter      | 455 (`mobile-flutter/lib/screens/*.dart`)      | Source only — **no `pubspec.yaml` repo-wide, so not buildable as-is** |
+| React Native | 0                                              | `mobile-rn/` is a 5-file skeleton (no screen files) |
 
-**Gap: 254 PWA pages have no Flutter equivalent, 388 have no RN equivalent.**
+**Gap:** The original "254 PWA pages without Flutter equivalent / 388 without RN equivalent" arithmetic was based on the unreproducible 457-page figure and has been removed. A real parity audit against the 101 current PWA pages has not been performed.
 
 ---
 
 ## 5. Data Layer
 
-- **Schema tables**: 161 in drizzle/schema.ts (5,203 lines)
+- **Schema tables**: 161 `pgTable` definitions in `services/api-server-ts/drizzle/schema.ts` (5,519 lines; re-counted 2026-08). Note: there is **no root-level `drizzle/schema.ts`**; the root `drizzle/` directory holds 41 `pgTable` definitions across its `schema-*.ts` files
 - **Indexes**: 413 index references (good coverage)
 - **Seed scripts**: 15+ scattered scripts, no single unified entry point
 - **Missing**: Unified seed script with realistic Nigerian banking data

DEPLOYMENT.md

@@ -3,6 +3,8 @@
 **Version:** Phase 136  
 **Target:** Ubuntu 22.04 LTS, Docker 24+, 8 vCPU / 32 GB RAM minimum
 
+> ⚠️ **2026-08 correction (@ `505705ac`):** this guide originally referenced `docker-compose.production.yml`, which **does not exist in the repository**. Commands below now use the root `docker-compose.yml` (the only full-stack compose file present). Caveats: (1) the main application service is named `app` in `docker-compose.yml` (previously `pos-shell` below — updated); (2) some services mentioned in this guide (Vault, MinIO, TigerBeetle cluster nodes) are **not defined** in the current `docker-compose.yml`; (3) `Makefile.production` still points at the missing `docker-compose.production.yml` and must be updated (or the file created) before `make -f Makefile.production …` targets will work.
+
 ---
 
 ## Architecture Overview
@@ -57,8 +59,8 @@ sudo apt-get install -y certbot
 ## Step 1: Clone and Configure
 
 ```bash
-git clone https://github.com/54link/pos-shell-demo.git
-cd pos-shell-demo
+git clone https://github.com/munisp/agentbanking.git
+cd agentbanking
 
 # Copy environment template
 cp .env.production.example .env.production
@@ -169,7 +171,7 @@ This starts all services in the correct dependency order:
 
 ```bash
 # Create admin agent (AGT001 / PIN: 1234)
-docker compose -f docker-compose.production.yml exec pos-shell pnpm seed
+docker compose -f docker-compose.yml exec app pnpm seed
 
 # Or run against local DB
 pnpm seed
@@ -237,7 +239,7 @@ The `deploy` target runs `docker compose pull` then `docker compose up -d --buil
 
 ```bash
 # Rollback to previous image tag
-docker compose -f docker-compose.production.yml up -d --no-deps pos-shell \
+docker compose -f docker-compose.yml up -d --no-deps app \
   --image ghcr.io/54link/pos-shell:previous-tag
 ```
 
@@ -247,7 +249,7 @@ docker compose -f docker-compose.production.yml up -d --no-deps pos-shell \
 
 ```bash
 # Scale POS Shell horizontally (requires Redis session sharing — already implemented)
-docker compose -f docker-compose.production.yml up -d --scale pos-shell=3
+docker compose -f docker-compose.yml up -d --scale app=3
 ```
 
 Note: Socket.IO requires sticky sessions at the nginx level. The provided nginx config includes `ip_hash` for this purpose.
@@ -258,14 +260,14 @@ Note: Socket.IO requires sticky sessions at the nginx level. The provided nginx
 
 ```bash
 # PostgreSQL backup
-docker compose -f docker-compose.production.yml exec postgres \
+docker compose -f docker-compose.yml exec postgres \
   pg_dump -U postgres pos_shell > backup-$(date +%Y%m%d).sql
 
 # MinIO backup (sync to S3)
 mc mirror minio/54link-transactions s3/54link-backup/transactions/
 
 # Redis backup (RDB snapshot)
-docker compose -f docker-compose.production.yml exec redis \
+docker compose -f docker-compose.yml exec redis \
   redis-cli BGSAVE
 ```
 

Dockerfile

@@ -1,26 +1,39 @@
 # ─────────────────────────────────────────────────────────────────────────────
-# Stage 1: Build
+# POS-54Link — application image
+#
+# The Node.js application lives in services/api-server-ts (it carries the only
+# package.json + pnpm-lock.yaml in this repo after the 2026-06-29 monorepo
+# restructure). The previous revision of this Dockerfile referenced a root
+# package.json / pnpm-lock.yaml that no longer exist, breaking every build.
+#
+# Multi-stage: install → build → minimal runtime.
 # ─────────────────────────────────────────────────────────────────────────────
 FROM node:22-alpine AS builder
 
-# Install pnpm
-RUN corepack enable && corepack prepare pnpm@9 --activate
+# pnpm is provided by corepack; the exact version (10.4.1) is pinned by
+# services/api-server-ts/package.json#packageManager.
+RUN corepack enable
 
 WORKDIR /app
 
-# Copy manifests and patches for layer caching
-COPY package.json pnpm-lock.yaml ./
-COPY patches/ ./patches/
-RUN pnpm install --frozen-lockfile
+# Copy manifests first for layer caching
+COPY services/api-server-ts/package.json services/api-server-ts/pnpm-lock.yaml ./
+# Lockfile restore pending (staged artifact for maintainers) — no-frozen for now
+RUN pnpm install --no-frozen-lockfile
 
-# Copy source
-COPY . .
+# Copy the application source (.dockerignore strips node_modules/dist/tests)
+COPY services/api-server-ts/ ./
 
-# Build (Vite client + esbuild server bundle)
-ARG VITE_APP_ID=""
-ARG VITE_APP_TITLE="54Link POS Shell"
 ENV NODE_ENV=production
-RUN pnpm build
+# Full build = Vite client + esbuild server bundle. The client tree is not
+# currently part of services/api-server-ts (vite.config.ts expects ./client),
+# so fall back to the server-only bundle until the client is co-located.
+RUN if [ -d client ]; then \
+      pnpm build; \
+    else \
+      echo "client/ not present in services/api-server-ts — building server bundle only (pnpm build:server)"; \
+      pnpm build:server; \
+    fi
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Stage 2: Runtime
@@ -32,16 +45,17 @@ RUN addgroup -S posshell && adduser -S posshell -G posshell
 
 WORKDIR /app
 
-# Copy build output + migrations
+# Copy build output + migrations + manifests
 COPY --from=builder /app/dist ./dist
 COPY --from=builder /app/drizzle ./drizzle
 COPY --from=builder /app/package.json ./
 COPY --from=builder /app/pnpm-lock.yaml ./
-COPY --from=builder /app/patches ./patches
 
-# Install only production runtime dependencies
-RUN corepack enable && corepack prepare pnpm@9 --activate \
-    && pnpm install --prod --frozen-lockfile \
+# NOTE: full install (not --prod). The esbuild bundle keeps runtime-external
+# imports of dev-time packages (e.g. "vite" via server/_core/vite.ts), which
+# must resolve when dist/index.js starts. Lockfile restore pending — no-frozen.
+RUN corepack enable \
+    && pnpm install --no-frozen-lockfile \
     && pnpm store prune
 
 # Switch to non-root user

PRODUCTION_READINESS_v2.md

@@ -2,7 +2,8 @@
 
 **Date:** 2026-04-09  
 **Version:** Phase 136 (Checkpoint `329e940a`)  
-**Test Results:** 244 Node.js · 43 Rust · 8 Go = **295 tests passing, 0 failures**
+**Test Results (Phase 136, self-reported):** 244 Node.js · 43 Rust · 8 Go = 295 tests reported passing
+**2026-08 re-verification (@ `505705ac`):** not reproducible from the current tree — `services/api-server-ts` currently contains 2 test files with 174 test cases (155 in `server/stakeholder-smoke-tests.test.ts`, 19 in `server/caddy-tls-validation.test.ts`). Treat the 295 figure as historical.
 
 ---
 
@@ -20,7 +21,9 @@
 | Mobile Applications            | Scaffolded           | 6/10       |
 | Production Deployment          | Complete             | 9/10       |
 | Testing                        | Complete             | 10/10      |
-| **Overall**                    | **Production-Ready** | **92/100** |
+| **Overall**                    | **Near-Production (self-assessed)** | **92/100** |
+
+> ⚠️ **2026-08 assurance re-verification (@ `505705ac`):** several figures in this scorecard are Phase 136 self-assessments and are not reproducible from the current tree. Known corrections: `docker-compose.production.yml` does not exist in the repo; `tsc --noEmit` is not error-free (remediation in progress); the Flutter/RN apps are not "ready to build" (no `pubspec.yaml` repo-wide; `mobile-rn/` is a 5-file skeleton). See inline edits below.
 
 ---
 
@@ -114,15 +117,15 @@
 
 | Feature             | Status        | Notes                                     |
 | ------------------- | ------------- | ----------------------------------------- |
-| React Native (Expo) | 🔶 Scaffolded | pos-mobile-rn/ — needs Expo build         |
-| Flutter             | 🔶 Scaffolded | pos-mobile-flutter/ — needs flutter build |
+| React Native (Expo) | 🔶 Skeleton   | mobile-rn/ — 5 files, 0 screens; not a buildable app |
+| Flutter             | 🔶 Source only | mobile-flutter/ — 455 screen files but no pubspec.yaml; cannot build without recreating the project manifest |
 | PWA (manifest + SW) | ✅ Complete   | manifest.json, offline.html, SW v3        |
 
 ### 9. Production Deployment ✅
 
 | Feature                       | Status      | Notes                                |
 | ----------------------------- | ----------- | ------------------------------------ |
-| docker-compose.production.yml | ✅ Complete | 20+ services, health checks          |
+| docker-compose.production.yml | ❌ Missing  | File absent from the repo (verified @ `505705ac`); root `docker-compose.yml` (30+ services, profiles) is the only full-stack compose file. `Makefile.production` still references the missing file |
 | nginx TLS reverse proxy       | ✅ Complete | 5 vhosts, WebSocket proxy            |
 | Makefile.production           | ✅ Complete | deploy, test-all, vault-init targets |
 | .env.production.example       | ✅ Complete | 40+ variables documented             |
@@ -135,17 +138,17 @@
 
 | Suite             | Count    | Status         |
 | ----------------- | -------- | -------------- |
-| Node.js (Vitest)  | 244      | ✅ All passing |
-| Rust (cargo test) | 43       | ✅ All passing |
-| Go (go test)      | 8        | ✅ All passing |
+| Node.js (Vitest)  | 244      | ⚠️ Historical claim — not reproducible from current tree (2026-08 re-check: 174 test cases in `services/api-server-ts`) |
+| Rust (cargo test) | 43       | ⚠️ Historical claim — not re-verified |
+| Go (go test)      | 8        | ⚠️ Historical claim — not re-verified |
 | Playwright E2E    | 5        | ✅ Scaffolded  |
-| TypeScript        | 0 errors | ✅ Clean       |
+| TypeScript        | not clean | ❌ `tsc --noEmit` reports errors (e.g. `uis/admin-dashboard`); remediation in progress |
 
 ---
 
 ## Known Gaps (Non-Blocking for Production)
 
-1. **React Native / Flutter builds** — Expo and Flutter CLIs not installed in sandbox; source code is complete and ready to build on a developer machine.
+1. **React Native / Flutter builds** — "ready to build" is **not accurate** (2026-08 re-verification @ `505705ac`): `mobile-flutter/` contains 455 screen source files but the repo has **no `pubspec.yaml` anywhere**, so `flutter build` cannot run without recreating the project manifest; `mobile-rn/` is a 5-file skeleton with no screen files.
 2. **Playwright E2E** — Tests are scaffolded and will run against a live server; browser binaries need `playwright install chromium` on CI.
 3. **Fluvio SmartModule (WASM)** — Velocity and anomaly check logic is defined; WASM compilation requires `cargo build --target wasm32-wasi` on a machine with Fluvio CLI.
 4. **TigerBeetle production cluster** — Demo uses single-node; production requires 3-node cluster with replica configuration.