Changeset 0.28.3 (#187)

docs/ROADMAP.md

@@ -24,8 +24,8 @@ v0.9.x–v0.27.5  Foundation → Extensions → Surfaces → Auth     ✅
                         │
                 v0.28.0 Platform Polish
                   ├─ v0.28.1  Surfaces ICD audit        ✅
-                  ├─ v0.28.2  ICD audit — all domains
-                  ├─ v0.28.3  FE decomp + SDK prep
+                  ├─ v0.28.2  ICD audit — all domains   ✅
+                  ├─ v0.28.3  ICD close-out + FE decomp prep
                   ├─ v0.28.4  Security tier (red team)
                   ├─ v0.28.5  Infrastructure
                   │   (virtual scroll, KB auto-inject,
@@ -67,7 +67,7 @@ Audit arc, frontend decomposition, security, and infrastructure improvements.
 - [x] 22 handler-level tests + 14 store-level tests (PG + SQLite)
 - [x] CI timeout 8m → 12m for PG integration tests
 
-### v0.28.2 — ICD Audit: All Domains
+### v0.28.2 — ICD Audit: All Domains ✅
 Full audit of every ICD document against code. Goal: ICD becomes the single
 source of truth. After this version, the workflow is ICD-first — update the
 contract before changing code.
@@ -77,6 +77,8 @@ contract before changing code.
 ICD → fix code → fix runner → CI green. Final pass picks up straggling
 failures across all domains.
 
+**Final score: 469/469 (100%)**
+
 **Completed audits:**
 
 *Notifications (cs0):*
@@ -128,32 +130,53 @@ failures across all domains.
       not `files`), archive format query param, auth annotations, all response shapes
 - [x] P0 fix: `GET /workspaces` returns bare array → `{"data": [...]}`
 - [x] P0 fix: `GET /git-credentials` returns bare array → `{"data": [...]}`
-- [x] Fix: `GET .../git/log` returns bare array → `{"data": [...]}` + nil slice guard
+- [x] Fix: `GET .../git/log` returns bare array → `{"data": [...]}`  + nil slice guard
 - [x] New `workspace_test.go`: List empty envelope, list with data + shape, root_path
       not exposed, user isolation, GET by ID shape, not found 404, forbidden 403,
       git-credentials empty envelope, auth required (11 tests)
 
-**Remaining audits:**
+*Projects (cs7):*
+- [x] `projects.md` full rewrite: 6 categories of drift (ghost fields, missing fields,
+      request shapes, association objects, `omitempty` on computed counts)
+- [x] 14 new Go tests: CRUD shapes, 201 status, envelope, admin list, auth, isolation
+- [x] P0 nil guard: `ListByProject` files `null` → `[]`
+- [x] P0: `ListTeamProviderModels` missing `Type` field — Venice 400 fix
+- [x] ICD runner projects rewritten 9 → 19 tests
+- [x] ICD runner tier-providers: SSE parser, model exclusion, ID fallback fixes
 
-| Priority | ICD | Known failures | Notes |
-|----------|-----|----------------|-------|
-| 1 | `projects.md` | 0 | Passed clean, needs full trace |
-| 2 | `websocket.md` | — | Document event shapes only (not testable in runner) |
+### v0.28.3 — ICD Close-out + Frontend Decomposition Prep
+ICD straggler sweep (rolled in from v0.28.2 tail) and frontend
+decomposition groundwork.
 
-- [ ] Notification handler + store tests (PG + SQLite)
-- [ ] WebSocket event contract audit: document `message.created`, `workflow.advanced`,
-      `presence.changed`, `typing`, `workflow.assigned` event shapes in ICD
-- [ ] Final straggler pass: run full ICD runner, fix any remaining failures
+**ICD close-out (cs0):**
+- [x] `websocket.md` full rewrite: event envelope field (`event` not `type`),
+      payload shapes for 11 event types, routing table from code, room model
+      documented as planned-not-implemented
+- [x] `auth.md` corrected: login response shape (added `token_type`/`expires_in`,
+      removed phantom fields), register admin-approval path
+- [x] `enums.md` corrected: added missing `queued` task run status
+- [x] Presence status gap documented (DB allows `away`, runtime emits only
+      `online`/`offline`)
+- [x] VERSION, CHANGELOG, ROADMAP updated
 
-### v0.28.3 — Frontend Decomposition + ICD Audit SDK Prep
-Frontend JS decomposition and ICD runner hardening. Prepares the codebase
-for the SDK layer by untangling the current 15-file global soup.
+**WebSocket delivery fix (cs1):**
+- [x] `workflow.claimed`, `workflow.advanced`, `workflow.completed` use room-scoped
+      `Bus.Publish()` but rooms are never joined — events never reach WebSocket
+      clients. Convert to `SendToUser()` per channel participant (same pattern as
+      `message.created`, `workflow.assigned`).
 
-- [ ] JS dependency audit: map every `window.*` global, cross-file call, init order
-- [ ] Extract shared primitives: toast, confirm, theme, API client into importable modules
+**Frontend decomposition:**
+- [x] JS dependency audit: `docs/JS-DEPENDENCY-AUDIT.md` — full map of 47 files,
+      431 globals, cross-file call graph, script load order per surface
+- [x] IIFE extraction: all 47 JS files wrapped, ~168 functions privatized, zero
+      implicit globals remain. Explicit `window.*` exports on every file.
+- [x] Cross-file coupling fix: `events.js` no longer reads `_storageKey` from
+      `api.js` — uses `API.accessToken` instead
 - [ ] ICD runner gains test tiers: `crud`, `envelope`, `security`, `sdk`
 - [ ] Runner coverage target: 100% of ICD-documented endpoints have at least one test
-- [ ] Document JS module graph and init sequence
+- [ ] Phase 2: onclick → addEventListener migration (143 dynamic + ~50 template handlers)
+- [ ] Phase 3: ES module conversion
+- [ ] Phase 4: Template handler shim
 
 ### v0.28.4 — Security Tier (ICD Runner Red Team)
 New `security` tier in ICD test runner. Multi-user fixtures already exist.