Externalize audit pipeline services

This commit is contained in:
2026-06-07 23:06:31 +02:00
parent 470fb0f348
commit a45b92ea0a
42 changed files with 3141 additions and 247 deletions

View File

@@ -0,0 +1,43 @@
---
id: TASK-31
title: Require auth for usage event reads
status: In Progress
assignee: []
created_date: '2026-06-06 20:27'
updated_date: '2026-06-06 20:31'
labels: []
dependencies: []
priority: high
ordinal: 33000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Protect public Convex usageEvents read queries from unauthenticated access while preserving validators, bounded reads, and index usage.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Source contracts assert every public usageEvents read query requires requireOperator auth
- [x] #2 usageEvents read queries call requireOperator before reading sensitive telemetry
- [x] #3 Focused usage-events source tests pass after the implementation
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect usageEvents source tests and local auth patterns
2. Add RED source contracts for authenticated read queries
3. Run focused test and capture RED
4. Add minimal requireOperator guard to usageEvents reads
5. Run focused GREEN verification and self-review
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: pnpm test -- tests/usage-events-source.test.ts is blocked by pre-existing tests/ai-schemas.test.ts missing exports. Focused node --test tests/usage-events-source.test.ts fails as expected on missing usageEvents requireOperator auth guard.
GREEN: node --test tests/usage-events-source.test.ts passes 6/6. pnpm test -- tests/usage-events-source.test.ts compiles and usageEvents tests pass, but the overall runner fails on existing external-audit-pipeline-source.test.js: audit generation action sanitizes raw errors before run events and run failure summaries, outside Worker F scope.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-32
title: Wire v3 skill registry into audit generation
status: In Progress
assignee: []
created_date: '2026-06-06 20:27'
updated_date: '2026-06-06 20:36'
labels: []
dependencies: []
priority: high
ordinal: 34000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix the final review finding by using the v3 skills registry and v3 finding validation in the live audit generation path while preserving best-effort fallback behavior.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 auditGenerationAction loads and passes a non-empty v3 skill registry from v2_elemente/skills.md/loadSkillsRegistry when available
- [x] #2 Classification uses a v3 findings schema live instead of legacy-only internalFindingsSchema
- [x] #3 Audit persistence validators accept v3 usedSkills with id and optional category without forcing undefined category fields
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Read current audit generation, schemas, validators, and focused tests
2. Add RED source-contract/schema tests for v3 registry, v3 classification, and optional usedSkill category
3. Run focused tests and record failures
4. Implement minimal wiring and validator/schema changes
5. Run focused tests green plus relevant verification
6. Self-review scope and update task notes without closing
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: pnpm test tests/audit-generation-action-source.test.ts tests/ai-schemas.test.ts tests/audit-skills-schema.test.ts tests/audit-skill-registry-v3.test.ts failed in tsc because auditClassificationSchema and AuditClassification are not exported yet. This confirms the v3 classification schema is not wired.
GREEN: pnpm exec tsc -p tsconfig.test.json exited 0. Focused compiled tests passed: node --test .test-output/tests/audit-generation-action-source.test.js .test-output/tests/ai-schemas.test.js .test-output/tests/audit-skills-schema.test.js .test-output/tests/audit-skill-registry-v3.test.js => 32/32 pass. Full pnpm test passed: 345/345. Self-review: no changes to convex/usageEvents.ts, no commit/staging; usedSkills optional fields are conditionally spread before persistence.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-33
title: Fix v3 live wiring quality issues
status: In Progress
assignee: []
created_date: '2026-06-06 20:41'
updated_date: '2026-06-06 20:47'
labels: []
dependencies: []
priority: high
ordinal: 35000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Address the two v3 live wiring review quality issues: select category-less v3 skills from the real registry and keep registry-load warning logging best-effort.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Real v3 skills from v2_elemente/skills.md are selected from realistic audit evidence without fabricated categories
- [x] #2 Legacy category-based skill registry selection continues to work
- [x] #3 Registry load fallback returns an empty registry even when warning event logging fails
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect current skill selection and action warning fallback
2. Add RED tests for real v3 registry selection and isolated warning logging
3. Run focused tests and record RED failures
4. Implement minimal selection and warning isolation fixes
5. Run focused tests green plus typecheck/relevant suite
6. Self-review scope and leave task In Progress
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: tsc passed. node --test .test-output/tests/audit-evidence.test.js .test-output/tests/audit-generation-action-source.test.js failed with 2 expected failures: real v3 registry selectedSkills was empty/missing ids, and loadAuditSkillRegistry warning logging lacked isolated try/catch fallback.
GREEN: pnpm exec tsc -p tsconfig.test.json exited 0. Focused tests passed: node --test .test-output/tests/audit-evidence.test.js .test-output/tests/audit-generation-action-source.test.js => 23/23 pass. Full pnpm test passed: 347/347. Self-review: only touched audit-evidence skill selection, auditGenerationAction registry warning fallback, and focused tests; no staging/commit; no convex/usageEvents.ts changes.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,42 @@
---
id: TASK-34
title: Harden v3 selection and Convex payloads
status: In Progress
assignee: []
created_date: '2026-06-06 20:54'
updated_date: '2026-06-06 21:03'
labels: []
dependencies: []
priority: high
ordinal: 36000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix v3 quality review issues by removing explicit undefined values from Convex mutation payloads and making v3 skill selection registry-driven with negative applicability tests.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Convex mutation payloads in auditGenerationAction omit undefined top-level and nested fields
- [x] #2 v3 skill selection is registry-driven by applies_when and declared inputs with deterministic capped output
- [x] #3 Negative v3 input/applicability tests and legacy category tests pass
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect current Convex mutation payload construction and v3 selection
2. Add RED tests for no undefined payload patterns, negative v3 gating, and deterministic cap
3. Run focused tests and record RED failures
4. Implement minimal payload omission and registry-driven v3 selection
5. Run focused tests green plus pnpm test if fast
6. Self-review scope and leave task In Progress
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: tsc passed, focused node --test .test-output/tests/audit-evidence.test.js .test-output/tests/audit-generation-action-source.test.js failed as expected on registry-order v3 cap and explicit undefined stage payload contract. GREEN: tsc passed; focused tests passed 26/26; full pnpm test passed 350/350. Self-review: no commits/staging, no changes to convex/usageEvents.ts, no ScreenshotOne missing-key behavior changes.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-35
title: Remove remaining undefined audit generation payloads
status: In Progress
assignee: []
created_date: '2026-06-06 21:06'
updated_date: '2026-06-06 21:13'
labels: []
dependencies: []
priority: high
ordinal: 37000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix TASK-34 spec-review issues by preventing appendRunEvent, success finish, and quality stage calls from sending explicit undefined optional fields.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 appendRunEvent only sends details when defined
- [x] #2 success finishAuditGenerationRun omits errorSummary instead of sending undefined
- [x] #3 quality-stage persistAuditStage callsite does not pass explicit undefined optional fields
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect appendRunEvent, quality persist stage, and success finish call
2. Add RED source contracts for remaining explicit undefined patterns
3. Run focused tests and record RED
4. Implement minimal conditional spreads
5. Run focused tests green and full pnpm test if fast
6. Self-review scope and leave task In Progress
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: tsc passed. Focused node --test .test-output/tests/audit-generation-action-source.test.js failed as expected on three contracts: appendRunEvent details sent as args.details, success finishAuditGenerationRun ternary errorSummary undefined, and qualityReview persistAuditStage callsite ternary errorSummary undefined.
RED: tsc passed. Focused node --test .test-output/tests/audit-generation-action-source.test.js failed as expected on appendRunEvent details, success finishAuditGenerationRun errorSummary ternary, and qualityReview persistAuditStage errorSummary ternary. GREEN: focused source test passed 21/21; full pnpm test passed 353/353. Self-review: changed only convex/auditGenerationAction.ts and tests/audit-generation-action-source.test.ts in this turn; no commits/staging; no UsageEvents or ScreenshotOne behavior changes.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-36
title: Remove optional helper undefined args
status: In Progress
assignee: []
created_date: '2026-06-06 21:15'
updated_date: '2026-06-06 21:23'
labels: []
dependencies: []
priority: high
ordinal: 38000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix remaining spec-review issues in auditGenerationAction by avoiding explicit undefined auditId and nested usage fields in helper call arguments.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 persistAuditStage callsites include auditId only by conditional spread
- [x] #2 recordOpenRouterUsage/recordAuditUsageEvent/capture helper callsites include optional auditId only by conditional spread
- [x] #3 stage usage helper args are built without explicit undefined token fields
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect auditId and usage helper callsites
2. Add RED source contracts for optional auditId and nested usage args
3. Run focused test and record RED
4. Implement minimal conditional spreads and usage arg helper
5. Run focused tests green and full pnpm test if fast
6. Self-review scope and leave task In Progress
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: tsc passed. Focused node --test .test-output/tests/audit-generation-action-source.test.js failed as expected on persistAuditStage auditId callsites, helper auditId callsites, and inline nested usage objects.
GREEN: pnpm exec tsc -p tsconfig.test.json passed. Focused node --test .test-output/tests/audit-generation-action-source.test.js passed 24/24. Full pnpm test passed 356/356. Implemented conditional auditId spreads at persist/helper callsites and stage usage builder for callsite usage objects.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-37
title: Prioritize v3 local audit skills
status: In Progress
assignee: []
created_date: '2026-06-06 21:30'
updated_date: '2026-06-06 21:38'
labels: []
dependencies: []
priority: high
ordinal: 39000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Add a deterministic local-audit relevance rule before the v3 skill selection cap so core applicable skills are not displaced by registry order.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Full-evidence v3 selection includes local-seo-basics and performance-experience within the cap
- [x] #2 v3 input/applicability gating remains enforced
- [x] #3 Legacy category-based skill selection remains supported
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect current v3 selection and existing audit-evidence tests
2. Add RED tests against real v2_elemente/skills.md for full-evidence core skill inclusion and missing-input gating
3. Run focused test and record RED
4. Implement minimal deterministic local-audit relevance sort before cap
5. Run focused tests green and full pnpm test if fast
6. Self-review scope and leave task In Progress
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED: pnpm exec tsc -p tsconfig.test.json passed. Focused node --test .test-output/tests/audit-evidence.test.js failed as expected: full-evidence v3 selection returned registry-order ids visual-design, first-impression-clarity, contact-conversion, mobile-usability, trust-signals, conversion-copy instead of including local-seo-basics and performance-experience before the cap.
GREEN: pnpm exec tsc -p tsconfig.test.json passed. Focused node --test .test-output/tests/audit-evidence.test.js passed 8/8. Full pnpm test passed 356/356. Added deterministic v3 local-audit priority before cap while preserving applicability/input gating and legacy category selection.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,44 @@
---
id: TASK-38
title: Add ScreenshotOne missing-key run warning
status: In Progress
assignee: []
created_date: '2026-06-06 21:41'
updated_date: '2026-06-06 21:46'
labels: []
dependencies: []
priority: high
ordinal: 40000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Emit a best-effort warning run event when an external audit needs screenshots but SCREENSHOTONE_API_KEY is not configured, while keeping audit classification and AI stages running.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 needsScreenshots with missing SCREENSHOTONE_API_KEY writes a warning run event through appendRunEvent
- [x] #2 warning logging is best-effort and cannot fail the audit run
- [x] #3 needsScreenshots false does not emit the missing-key warning
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Inspect current ScreenshotOne skip path and source-contract style
2. Add RED source-contract for warning event and best-effort guard
3. Run focused test to capture RED
4. Implement minimal runtime warning inside needsScreenshots missing-key branch
5. Run focused tests green and broader tests if practical
6. Self-review and report without staging or commits
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
RED verified: pnpm exec tsc -p tsconfig.test.json passed, then node --test .test-output/tests/external-audit-pipeline-source.test.js failed only on missing ScreenshotOne config warning message (actual index -1).
GREEN verified: focused node --test .test-output/tests/external-audit-pipeline-source.test.js passed 11/11 after implementation. Full pnpm test passed 357/357 with exit 0.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,34 @@
---
id: TASK-39
title: Secure Convex operator APIs
status: In Progress
assignee: []
created_date: '2026-06-06 21:52'
updated_date: '2026-06-06 22:00'
labels: []
dependencies: []
priority: high
ordinal: 41000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Guard non-public Convex audit, lead, and run APIs so sensitive operational data is not exposed or mutated without authentication while preserving internal pipeline calls.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 Audit admin reads and writes require operator auth while getPublicBySlug remains public
- [x] #2 Lead admin reads and review mutations require operator auth while internal audit-generation calls use internal functions
- [x] #3 Run admin reads/writes require operator auth while internal actions can append run events safely
- [x] #4 Source contracts and full tests pass
<!-- AC:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
Worker I audit slice: Added source-contract coverage for audit admin auth guards and preserved public getPublicBySlug. RED: node --test .test-output/tests/audits-auth-source.test.js failed on create missing requireOperator before ctx.db. GREEN: pnpm exec tsc -p tsconfig.test.json passed; node --test .test-output/tests/audits-auth-source.test.js passed (2/2).
Worker J RED/GREEN: Added leads/runs source contracts; initial pnpm test failed on missing lead/run requireOperator guards and missing internal lead/run action refs. Implemented operator auth for public leads/runs APIs, added internal lead get/review update and run append event mutations, and switched auditGenerationAction/pageSpeedAction/websiteEnrichmentAction to internal refs. GREEN: pnpm test passed (363/363). Did not touch convex/audits.ts and did not stage/commit.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,40 @@
---
id: TASK-40
title: Behebe abschliessende Lint-Blocker
status: In Progress
assignee: []
created_date: '2026-06-06 22:10'
updated_date: '2026-06-06 22:15'
labels: []
dependencies: []
priority: high
ordinal: 42000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix the final lint blockers after the v2 pipeline implementation without changing runtime behavior. Keep v2_elemente as planning/reference material unless production imports require otherwise.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 pnpm lint exits 0 or only documents unrelated pre-existing generated warnings with a scoped suppression decision
- [x] #2 pnpm test remains green
- [x] #3 git diff --check remains green
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Reproduce pnpm lint failures
2. Apply scoped minimal lint policy or test-file cleanup
3. Re-run pnpm lint, pnpm test, git diff --check
4. Leave task In Progress until Matthias confirms Done
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
TASK-40 worker update: fixed final lint blockers by ignoring v2_elemente reference snippets in ESLint and removing an unused helper from tests/external-audit-pipeline-source.test.ts. Verification: pnpm lint exits 0 with only generated convex/betterAuth/_generated unused-disable warnings; pnpm test passes 363/363; git diff --check exits 0. Task intentionally left In Progress pending user confirmation.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,47 @@
---
id: TASK-41
title: Repariere Convex-Typecheck fuer Usage Events
status: In Progress
assignee: []
created_date: '2026-06-06 22:13'
updated_date: '2026-06-06 22:16'
labels: []
dependencies: []
priority: high
ordinal: 43000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Fix final Convex typecheck blockers after adding usageEvents and external screenshot persistence. This includes updating generated Convex API references if required and making screenshot blob storage type-valid without changing runtime behavior.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 pnpm exec convex codegen --dry-run --typecheck enable exits 0
- [x] #2 pnpm exec tsc --noEmit exits 0 or reports only documented unrelated pre-existing issues
- [x] #3 pnpm test remains green
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Reproduce Convex typecheck/codegen failures
2. Regenerate Convex API if required
3. Fix screenshot Blob typing with minimal runtime-neutral change
4. Re-run Convex typecheck, tsc, pnpm test
5. Leave task In Progress until Matthias confirms Done
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
Verification/results:
- Reproduced with `pnpm exec convex codegen --dry-run --typecheck enable` outside sandbox after pnpm sandbox DB failure; initial result failed with TS2339 `internal.usageEvents` missing and TS2322 `Uint8Array<ArrayBufferLike>` not assignable to `BlobPart` in convex/auditGenerationAction.ts.
- Ran `pnpm exec convex codegen` outside sandbox; generated convex/_generated/api.d.ts now includes usageEvents.
- Applied minimal ownership-scoped Blob typing fix in convex/auditGenerationAction.ts by wrapping screenshotBytes with `new Uint8Array(screenshotBytes)` before Blob storage.
- `pnpm exec convex codegen --dry-run --typecheck enable` exits 0.
- `pnpm exec tsc --noEmit` exits 2 only because of unrelated pre-existing v2_elemente/* errors (missing local generated modules/imports and implicit any issues); no TASK-41/convex/auditGenerationAction.ts errors remain. Per user instruction, v2_elemente fixes were not touched.
- `pnpm test` exits 0: 363 tests passed, 0 failed.
<!-- SECTION:NOTES:END -->

View File

@@ -0,0 +1,43 @@
---
id: TASK-42
title: Scope v2 Referenzdateien aus dem Typecheck
status: In Progress
assignee: []
created_date: '2026-06-06 22:16'
updated_date: '2026-06-06 22:18'
labels: []
dependencies: []
priority: high
ordinal: 44000
---
## Description
<!-- SECTION:DESCRIPTION:BEGIN -->
Keep v2_elemente as PRD/reference snippets while ensuring the production TypeScript check is not broken by those exploratory files.
<!-- SECTION:DESCRIPTION:END -->
## Acceptance Criteria
<!-- AC:BEGIN -->
- [x] #1 pnpm exec tsc --noEmit exits 0
- [x] #2 pnpm lint remains green
- [x] #3 pnpm test remains green
- [x] #4 v2_elemente content remains available as planning/reference material
<!-- AC:END -->
## Implementation Plan
<!-- SECTION:PLAN:BEGIN -->
1. Reproduce tsc failures from v2_elemente snippets
2. Apply minimal production TypeScript scope fix
3. Re-run tsc, lint, tests, diff check
4. Leave task In Progress until Matthias confirms Done
<!-- SECTION:PLAN:END -->
## Implementation Notes
<!-- SECTION:NOTES:BEGIN -->
Reproduced pnpm exec tsc --noEmit failure: production tsconfig includes v2_elemente reference snippets via **/*.ts, while eslint already scopes them out as non-runtime material.
Applied minimal scope fix: tsconfig.json now excludes v2_elemente/** from the production TypeScript program, matching the existing ESLint ignore for reference snippets. Verification passed: pnpm exec tsc --noEmit (exit 0), pnpm lint (exit 0 with two existing generated-file warnings), pnpm test (exit 0, 363 tests passed), git diff --check (exit 0). v2_elemente contents were not edited.
<!-- SECTION:NOTES:END -->