mirror of
https://github.com/AmruthPillai/Reactive-Resume.git
synced 2026-08-23 23:02:17 +10:00
chore: update dependencies
This commit is contained in:
Amruth Pillai
+171
@@ -0,0 +1,171 @@
|
||||
# Implementation Plans
|
||||
|
||||
Generated by the `improve` skill (deep audit) on 2026-07-08, against commit
|
||||
`73daf22b2`. A deep 8-category read-only audit produced 53 raw findings; after
|
||||
adversarial verification and manual vetting, the user selected the items below
|
||||
to turn into executor plans.
|
||||
|
||||
Each executor: read your plan fully before starting, honor its STOP conditions,
|
||||
and update your row when done. Plans are self-contained — you do not need the
|
||||
audit or this repo's history to execute one.
|
||||
|
||||
## Execution order & status
|
||||
|
||||
| Plan | Title | Priority | Effort | Risk | Depends on | Status |
|
||||
|------|-------|----------|--------|------|------------|--------|
|
||||
| 001 | Characterization tests for the resume service | P1 | M | LOW | — | DONE (branch `advisor/resume-service-improvements`) |
|
||||
| 002 | CSP + framing headers on web pages; gate uploads CORS | P1 | S | LOW | — | DONE (branch `advisor/security-and-docs`) |
|
||||
| 003 | Fix silent-success mutations; bound bulk-op inputs | P1 | S | LOW | 001 (soft) | DONE (branch `advisor/resume-service-improvements`) |
|
||||
| 004 | Correct README "Custom CSS" claim | P3 | S | LOW | — | DONE (branch `advisor/security-and-docs`) |
|
||||
| 005 | Deduplicate public-resume view-count writes | P2 | M | MED | 001 (soft) | DONE (branch `advisor/resume-service-improvements`) |
|
||||
| 006 | Font-picker options once; defer font payload | P2 | S | LOW | — | DONE (branch `advisor/font-payload`; Step-1 hoist only — build measurement confirmed the payload already loads only with the PDF chunk, so lazy-loading was correctly skipped) |
|
||||
| 007 | Extract shared template page-shell — spike + pilot | P2 | L | HIGH | 001 (discipline) | REVERTED from integration (user decision) — spike executed & proved the recipe, but full rollout judged not worth it; Pikachu reverted for template uniformity. Work preserved on branch `advisor/template-shell-spike`. |
|
||||
|
||||
Status values: TODO | IN PROGRESS | DONE | BLOCKED (one-line reason) | REJECTED (one-line rationale)
|
||||
|
||||
### Recommended order
|
||||
|
||||
Independent quick wins first (002, 004), then the tests-first foundation (001)
|
||||
before the behavior change that depends on it (003) and the caller change with
|
||||
a safety net (005). 006 is independent and low-leverage — do it anytime. 007
|
||||
(template refactor) is last and is a **spike + one-template pilot that stops for
|
||||
review**, not a full rollout.
|
||||
|
||||
Fastest safe sequence: **002 → 004 → 001 → 003 → 005 → 006 → 007**.
|
||||
|
||||
## Execution results (2026-07-08)
|
||||
|
||||
All 7 plans were executed by isolated-worktree executor subagents and reviewed
|
||||
by the advisor (re-ran every done-criterion, scope-checked, read diffs, audited
|
||||
tests). All **APPROVED**. Four branches, all based on `73daf22b2`:
|
||||
|
||||
| Branch | Plans | Package(s) | Verify (re-run by reviewer) |
|
||||
|--------|-------|------------|------------------------------|
|
||||
| `advisor/security-and-docs` | 002, 004 | apps/server, README | typecheck 0; `server` static tests 36/36 |
|
||||
| `advisor/font-payload` | 006 | apps/web | typecheck 0; web suite 457/457; build 0 |
|
||||
| `advisor/resume-service-improvements` | 001, 003, 005 | packages/api | typecheck 0; api suite 178/178; boundaries clean |
|
||||
| `advisor/template-shell-spike` | 007 | packages/pdf | typecheck 0; pdf suite 264/264; boundaries clean; parity snapshot byte-identical pre/post refactor |
|
||||
|
||||
**Post-execution decision (user, 2026-07-08):** Local integration branch
|
||||
`improve-integration` created off `main` with plans **001–006 merged**. Plan
|
||||
**007 was reverted** from it (the spike concluded a full 14-template rollout
|
||||
isn't worth it — the shell only centralizes layout orchestration, not the
|
||||
per-template style hooks where most recurring edits land; 6 templates are
|
||||
single-column and don't fit; consistency argues against a partial rollout). The
|
||||
`advisor/template-shell-spike` branch is kept if 007 is ever revisited.
|
||||
Known unrelated red: `packages/api/.../storage/service.test.ts` fails on the
|
||||
pinned **vitest 4.1.9** (`.rejects.toThrow` matcher `TypeError`, fixed in 4.1.10)
|
||||
— present on base `main` too, in a file no plan touches; the vitest suite isn't
|
||||
in CI, so it's latent. Bumping vitest to 4.1.10 clears it (a separate base-repo
|
||||
concern, left untouched).
|
||||
|
||||
**Integration notes for the user (merging is your call — the advisor never merges):**
|
||||
- The four branches touch **disjoint packages**, so they can be merged in any
|
||||
order with no cross-branch source conflicts. The only shared file is
|
||||
`pnpm-lock.yaml`, touched **only** by `advisor/template-shell-spike` — no
|
||||
lockfile conflict between branches.
|
||||
- **All commits are unsigned** (`--no-gpg-sign`): the executors ran headless and
|
||||
the repo's 1Password SSH signer needs interactive auth. Re-sign on merge if
|
||||
branch protection requires signed commits.
|
||||
- **007 adds test-only devDeps** (`react-dom`, `@types/react-dom`) to
|
||||
`packages/pdf` + a `vitest.config.ts` transform tweak — both were required to
|
||||
build the render-parity snapshot the spike depends on (react-test-renderer,
|
||||
which the plan suggested, is React-19-incompatible). Accept these consciously.
|
||||
- **007 is a pilot**: only Pikachu is migrated. The executor's recommended
|
||||
rollout batches for the other 14 templates (each snapshotted first):
|
||||
1. sidebar-% family (bronzor, ditto, glalie, leafish; likely kakuna, lapras,
|
||||
meowth, rhyhorn, scizor — verify two-column shape) — trivial, pass
|
||||
`sidebarColumnStyle={{ width }}`.
|
||||
2. flexBasis family (azurill, chikorita) — pass `sidebarColumnStyle={{ flexBasis }}`;
|
||||
the existing seam already covers it.
|
||||
3. featured-summary family (ditgar, gengar) — needs a new section-rendering
|
||||
seam; do NOT force into the current shell.
|
||||
4. single-column/header-on-top (onyx) — needs a separate shell/layout variant;
|
||||
the current shell hardcodes the two-column scaffold.
|
||||
|
||||
## Dependency notes
|
||||
|
||||
- **003 depends softly on 001**: 003 flips the three `setLocked`/`setPassword`/
|
||||
`removePassword` methods from silent-return to throwing `NOT_FOUND`. If 001 is
|
||||
DONE, its Step 3 assertions must be updated in 003's PR (that test diff is the
|
||||
intended proof of the behavior change). If 001 is not done, 003 adds a minimal
|
||||
test itself.
|
||||
- **005 depends softly on 001**: 001's Step 5 characterizes
|
||||
`statistics.increment`; 005 changes the *caller* (dedup), not the write body,
|
||||
so that test should keep passing — a useful regression signal.
|
||||
- **007 is not technically blocked** by 001 (the PDF layer needs its own render-
|
||||
parity net, which 007 builds in Step 1), but 001 should be done first as the
|
||||
characterization-testing exemplar. 007 explicitly does NOT roll out to all 15
|
||||
templates; rollout is deferred to reviewed follow-up plans.
|
||||
|
||||
## Findings considered and rejected
|
||||
|
||||
Recorded so they aren't re-audited next run. (Refuted by adversarial
|
||||
verification or downgraded during manual vetting against the code.)
|
||||
|
||||
- **"Production secrets committed to repository"** — FALSE. `.env.production` /
|
||||
`.env.local` exist in the working tree but are gitignored (`.env*` with an
|
||||
`.env.example` exception); 0 commits touch them; not in history.
|
||||
- **"Vulnerable @better-auth/oauth-provider (unbound resource indicators)"** —
|
||||
the claimed advisory (GHSA-p2fr-6hmx-4528) could not be verified as real, and
|
||||
the code already configures `validAudiences`. Treat any `@better-auth/*` bump
|
||||
as routine, not a security fix.
|
||||
- **Unauthenticated OAuth2 dynamic client registration bypass** — refuted;
|
||||
three validation layers exist (registration-time, server preflight,
|
||||
authorization endpoint).
|
||||
- **bulkUpdate tag-addition race** — refuted; Postgres row-locking serializes
|
||||
the `UPDATE ... SET tags = <subquery>` correctly.
|
||||
- **agent `getThread` missing ownership check** — refuted; the `WHERE` clause
|
||||
filters `userId` and throws `NOT_FOUND` otherwise.
|
||||
- **Snapshot throttle "bypassed" by AI patches** — deliberate, documented
|
||||
design; pruning is atomic and bounded at 30 versions, not a reactive overflow.
|
||||
Not a bug.
|
||||
- **Missing index on `(user_id, isPublic)`** — no code path filters resumes by
|
||||
public status; speculative (YAGNI).
|
||||
- **Stats daily-series "re-queries every 30 days after cache"** — refuted;
|
||||
TanStack Query 60s staleTime already dedups.
|
||||
- **Large composite components / sections.tsx / rich-input / custom-styles
|
||||
"need splitting"** (ARCH-02/05/06/07) — refuted; each is a single-responsibility
|
||||
internal-only component with no external reuse; a July-2026 audit already chose
|
||||
not to split `sections.tsx`.
|
||||
- **Export paths duplicate filtering (ARCH-03)** — refuted; PDF/DOCX/Markdown
|
||||
have genuinely different filtering needs, not a shared abstraction being
|
||||
reinvented.
|
||||
- **`node-html-parser` major-version lag** — refuted; only stable DOM APIs used,
|
||||
no breaking-change exposure.
|
||||
- **PORT not validated in server.ts (DX-03)** — refuted; the server *does* read
|
||||
`process.env.PORT` in production (`apps/server/src/index.ts:13`).
|
||||
|
||||
Downgraded to notes (real but low-leverage; not planned unless revisited):
|
||||
|
||||
- **Rich-text HTML not sanitized before react-pdf-html** (SEC-07) — PDF-only
|
||||
surface (browser path uses `stripHtml`; PDFs don't execute scripts), on the
|
||||
user's own content. Defense-in-depth only.
|
||||
- **MCP tools don't validate API-key scopes** (SEC-05) — latent; scoped keys
|
||||
can't be created yet. Revisit if/when scoped API keys ship.
|
||||
- **Applications attachment cleanup: concurrent-write orphans + swallowed
|
||||
`Promise.allSettled` failures** (CORRECT-02/03) — real but low severity for
|
||||
single-user; storage hygiene + observability. Candidate for a future plan.
|
||||
- **Agent service is 1397 LOC mixing concerns** (ARCH-04) — real tech debt;
|
||||
large L-effort refactor, deferred.
|
||||
- **Core deps pinned to prerelease/snapshot** (drizzle-orm/kit rc, drizzle-zod
|
||||
snapshot hash, TS native-preview dev build) — watch item; de-risk when stable
|
||||
releases land. Not urgent (not on the CI/production critical path).
|
||||
- **Vite `chunkSizeWarningLimit: 10MB`** masks bundle bloat — trivial DX nit.
|
||||
- **Dev-setup docs vs AGENTS.md `dotenvx` drift** (DX-02) — minor docs friction.
|
||||
- **Applications bulk O(n) in-memory scan** — the input-cap in Plan 003 bounds
|
||||
abuse; the scan rewrite is deferred.
|
||||
|
||||
## Not audited
|
||||
|
||||
Honest coverage gaps from this run:
|
||||
|
||||
- E2E/Playwright test behavior and flakiness (relied on CI).
|
||||
- PDF/DOCX template *rendering* correctness beyond structure (no visual-
|
||||
regression harness exists).
|
||||
- Email/notification delivery reliability.
|
||||
- S3 backup/restore and multi-instance storage behavior.
|
||||
- The AI provider integration layer's retry/streaming internals.
|
||||
- Lingui extraction/locale-catalog completeness (separate track).
|
||||
- Deep dependency transitive-tree audit (worked from manifests + lockfile;
|
||||
`pnpm audit`/`pnpm outdated` network access was not assumed available).
|
||||
Reference in New Issue
Block a user