4a builds the stateless interview. Every constraint that matters is
enforced in code rather than requested in the prompt: the seven-question
cap, the answer length, and what fields a brief may contain. parseBrief is
a whitelist, not a parser — a brief asserting priority or accepted loses
those at the boundary and they never reach a caller that could act on them.
4b adds a separate intake route rather than extending Plan 1a's client
card route. That route's tests were written against a two-field body;
widening the shape it accepts would leave them passing while proving less.
Both routes set column, priority, accepted and created_by_role themselves,
and both are separately proven to.
The property both plans are written to: the worst a hostile brief can
achieve is a strangely-worded card in the Inbox.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A guided interview that produces a written brief with sub-tasks, landing
in the Inbox as a draft through Plan 1c's existing accept flow.
Corrects an over-promise made during the Phase 1 discussion: the wizard
was described as grounding date proposals in measured per-card velocity,
and that data does not exist — Plan 2c deferred per-card effort because
session padding does not sum correctly across cards. This phase therefore
produces no time estimate at all, only a size band.
Names the intake as the highest-risk surface in the product: it is the
only place where text written by someone other than the developer enters
a prompt whose output creates records. The security property is that the
worst a hostile brief achieves is a strangely-worded Inbox card.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three tests cover the storage and access boundary:
- A client manager cannot list the settings collection at all (rules are
superuser-only — verified by the rejection, not by silent skip).
- The settings page HTML returned to the owner does not contain the key
value, even when the key is freshly set to a unique sentinel.
- A client manager gets 404 on /admin/settings (admin layout gates on
role, not on session presence).
helpers.ts gained ownerEmail / ownerPassword — needed by the settings test
and reusable for any owner-only integration test going forward.
3a ports the provider structure from MEGAIFRASTRUCTURE's chat/ — SDK-free
types, one adapter per provider — but deliberately not its interface: this
phase needs text in, text out, not a chat transcript and tool protocol. It
carries forward the MiniMax details that module learned the hard way: the
native /v1 route rather than the /anthropic shim, an Open Platform key, and
stripping the inline <think> blocks M2.x emits.
3b is built around one property: batch responses are matched to commits by
an echoed index, never by position. A single skipped line under positional
matching would attach fluent, confident, wrong sentences to every later
commit, with nothing raising an error.
3c is the first plan whose output a client reads, so its verification step
is to read a narrative as the client would and check it claims no
completion, states no date, and invents nothing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The methodology panel already explains that hours are estimated from
commit timing — the pill on the tile was redundant. With the pill gone
the tile row reads as four plain figures, and the methodology is the
single place a client goes to interrogate any of them.
The chart column was flex-1 inside h-40, but had no explicit height of
its own. The bar inside used height: X% which has nothing to compute
against when the parent is auto-sized — Tailwind's percent utilities
collapse to 0 without a definite parent.
Wrap the bar in a flex-1 container that consumes the remaining vertical
space. The percentage now resolves against that container's actual height,
so the 154h August bar fills three-quarters of the way up the column,
the 5h May bar barely peeks above the baseline, and the rest sit between.
One-liners per commit and a progress narrative per card, plus the
swappable provider layer both depend on, ported from the chat/ structure
in MEGAIFRASTRUCTURE.
Model and cost are measured rather than assumed: the full 779-commit
backfill costs about ninety cents on claude-opus-5, so model choice here
is a quality decision and not a cost one. Batch API considered and
rejected — it saves roughly forty cents and adds a job state machine.
Records the rules the non-editable preamble must guarantee, each tied to
a specific way a summary could mislead a paying client.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The neutral (gray) pill read as a status badge rather than an integral
annotation. The brand tone ties the indicator visually to the brand,
making it part of the figure rather than an overlay. The meaning is the
same — 'this number is not measured, it is computed' — and the methodology
panel still explains exactly how.
The 'Hours here are estimated' phrasing was redundant with the 'estimated'
pill on the Hours KPI tile — the pill is the visual signal, the methodology
doesn't need to repeat it. Left is just 'Git records what changed and when,
but not how long it took.' which sets up the next paragraph.
The methodology panel still explains 'what hours are' and 'what they cannot
see'. The session-clustering detail — the constants — was the part a client
might want to interrogate rather than just be told. With this removed, the
constants are still stored inside the payload (so a future question can be
answered) but the visible panel is shorter.
Also dropped the now-unused destructured local in Methodology().
The integration project now aliases server-only to a tiny empty stub
so tests can import modules that carry 'import "server-only"' without
the throwing real implementation firing during prepare. Unit tests do
NOT get the alias — a pure module with a server import is exactly the
kind of leak the unit project's missing condition is meant to surface.
The plan's summariseSessions test expected 2 sessions for four commits
spanning two 3-hour gaps, but with the default 120-minute gap three hours
is too far and produces 3 sessions. The implementation matches the boundary
rule defined in the plan (strictly less than the gap continues a session);
the test was off. Adjusted to a 90-minute follow-up which keeps the same
session and verifies total + longest correctly.
Vitest config: integration project now resolves with the 'react-server'
condition, so server-only modules can be imported directly from tests.
The unit project deliberately does NOT set it: a unit test pulling in a
server-only module must fail loudly, because a pure module with a server
import is exactly the kind of leak that should not reach production.
