Skip to content
This repository was archived by the owner on Jun 21, 2026. It is now read-only.

ci(workflows): hygiene pass -- concurrency + SHA pin #79

Open
KooshaPari wants to merge 3 commits into
base: main
Choose a base branch
from
Open

ci(workflows): hygiene pass -- concurrency + SHA pin #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
45d32be
docs(PhenoProject): add user-story traceability map
Jun 5, 2026
77d60b2
ci(workflows): hygiene pass -- concurrency + SHA pin
Jun 6, 2026
001a75e
fix(workflows): address CodeRabbit review on PhenoProject #79
Jun 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions .github/workflows/alert-sync-issues.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,19 @@
name: Alert Sync Issues
permissions:
contents: read
Comment thread
coderabbitai[bot] marked this conversation as resolved.
issues: write
security-events: read
actions: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


on:
schedule:
- cron: "0 6 * * *"
workflow_dispatch:

permissions:
contents: read

jobs:
alert-sync:
uses: KooshaPari/phenoShared/.github/workflows/alert-sync-issues.yml@438e2e71e448c9f1f47f184d3ca4acbb28928677
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ on:
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
rust-ci:
uses: KooshaPari/phenoShared/.github/workflows/ci.yml@438e2e71e448c9f1f47f184d3ca4acbb28928677
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/doc-links.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ on: [push, pull_request]
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
links:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/fr-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ on: [pull_request]
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
coverage:
runs-on: ubuntu-latest
Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/quality-gate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ on: [push, pull_request]
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
gate:
runs-on: ubuntu-latest
Expand Down
11 changes: 10 additions & 1 deletion .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,17 @@ on:
- cron: '17 3 * * 6'
push:
branches: [main]
permissions:
contents: read
security-events: write
id-token: write
actions: read
Comment on lines +10 to +12

@coderabbitai coderabbitai Bot Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/scorecard.yml"

echo "== Top-level permissions =="
awk 'NR>=1&&NR<=20{printf "%4d %s\n", NR, $0}' "$FILE" | sed -n '/^ *8 /,/^ *13 /p'

echo
echo "== Job-level permissions =="
awk 'NR>=20&&NR<=35{printf "%4d %s\n", NR, $0}' "$FILE" | sed -n '/permissions:/,/^ *30 /p'

Repository: KooshaPari/PhenoProject

Length of output: 400

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/scorecard.yml"

echo "== File (with line numbers, first 200 lines) =="
nl -ba "$FILE" | sed -n '1,200p'

echo
echo "== Occurrences of 'permissions:' =="
rg -n "^[[:space:]]*permissions:" "$FILE" || true

echo
echo "== Occurrences of 'jobs:' =="
rg -n "^[[:space:]]*jobs:" "$FILE" || true

echo
echo "== Job keys under jobs: (approx) =="
awk '
  $0 ~ /^[[:space:]]{2}jobs:/ {injobs=1; next}
  injobs && $0 ~ /^[[:space:]]{4}[A-Za-z0-9_-]+:/ {print NR ":" $0}
  $0 !~ /^[[:space:]]/ {if(injobs) injobs=0}
' "$FILE" || true

Repository: KooshaPari/PhenoProject

Length of output: 176

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/scorecard.yml"

echo "== File (with line numbers, first 200 lines) =="
cat -n "$FILE" | sed -n '1,200p'

echo
echo "== Occurrences of 'permissions:' =="
rg -n "^[[:space:]]*permissions:" "$FILE" || true

echo
echo "== Occurrences of 'jobs:' =="
rg -n "^[[:space:]]*jobs:" "$FILE" || true

Repository: KooshaPari/PhenoProject

Length of output: 1637

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/scorecard.yml"
echo "== wc -l =="
wc -l "$FILE"

echo
echo "== tail -n 80 =="
tail -n 80 "$FILE"

Repository: KooshaPari/PhenoProject

Length of output: 1200

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/scorecard.yml"
echo "== wc -l =="
wc -l "$FILE"

echo
echo "== tail -n 80 =="
tail -n 80 "$FILE"

Repository: KooshaPari/PhenoProject

Length of output: 1200

Keep elevated token scopes job-scoped only.
Top-level workflow permissions grants security-events: write, id-token: write, and actions: read, even though jobs.analysis.permissions already defines them—removing the workflow-level scopes keeps defaults least-privileged for any future jobs.

Suggested fix 
 permissions:
   contents: read
-  security-events: write
-  id-token: write
-  actions: read
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 10-10: overly broad permissions (excessive-permissions): security-events: write is overly broad at the workflow level

(excessive-permissions)

[error] 11-11: overly broad permissions (excessive-permissions): id-token: write is overly broad at the workflow level

(excessive-permissions)

[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/scorecard.yml around lines 10 - 12, The workflow-level
permissions block is granting elevated scopes (security-events, id-token,
actions) globally; remove or narrow the top-level permissions block so those
elevated scopes are only defined under jobs.analysis.permissions (leave
jobs.analysis.permissions as-is) to ensure least-privileged defaults for other
jobs—specifically delete the top-level "permissions" entries (security-events:
write, id-token: write, actions: read) and rely on the existing
jobs.analysis.permissions stanza to provide those scopes only to the analysis
job.

Source: Linters/SAST tools


concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


permissions: read-all

jobs:
analysis:
Expand Down
14 changes: 11 additions & 3 deletions .github/workflows/trufflehog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,23 @@ on:
push:
branches: [main]
pull_request:
permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true


jobs:
trufflehog:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
with:
fetch-depth: 0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- uses: trufflehog/actions/setup@main
persist-credentials: false
- uses: trufflehog/actions/setup@3fc0c2a225a9d249aea9b97a1c40c40a5ff7e0c0
- run: trufflehog github --only-verified --no-update
env:
GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ github.token }}
52 changes: 52 additions & 0 deletions docs/reports/user-story-map.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# User Story -> Journey -> FR Traceability Map

@gemini-code-assist gemini-code-assist Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The pull request title and description indicate that this PR performs a sweep of .github/workflows/*.yml files to add concurrency configurations, pin actions to immutable SHAs, and add permissions. However, the only file modified in this pull request is docs/traceability/user-story-map.md. The workflow files themselves are not present in the changes.

@codeant-ai codeant-ai Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Move this new documentation file into one of the allowed documentation subdirectories (for example docs/reference/ or docs/reports/) so it complies with the required docs hierarchy. [custom_rule]

Severity Level: Minor ⚠️

Why it matters? 🤔

The repository guidance in AGENTS.md says docs should be kept under docs/guides/, docs/reports/, docs/research/, docs/reference/, or docs/checklists/. This file was added under docs/traceability/, which is not one of the allowed documentation subdirectories, so the suggestion identifies a real rule violation.

Fix in Cursor | Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** docs/traceability/user-story-map.md
**Line:** 1:1
**Comment:**
	*Custom Rule: Move this new documentation file into one of the allowed documentation subdirectories (for example `docs/reference/` or `docs/reports/`) so it complies with the required docs hierarchy.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


- **Repo:** PhenoProject
- **Authoritative FR doc:** [`FUNCTIONAL_REQUIREMENTS.md`](../../FUNCTIONAL_REQUIREMENTS.md)
- **Journey standard:** [`../../operations/journey-traceability.md`](../../operations/journey-traceability.md)

@coderabbitai coderabbitai Bot Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix broken relative link for journey standard.

The link target is off by one directory. From docs/reports/user-story-map.md, it should point to ../operations/journey-traceability.md, not ../../operations/....

Proposed patch 
-- **Journey standard:** [`../../operations/journey-traceability.md`](../../operations/journey-traceability.md)
+- **Journey standard:** [`../operations/journey-traceability.md`](../operations/journey-traceability.md)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- **Journey standard:** [`../../operations/journey-traceability.md`](../../operations/journey-traceability.md)
- **Journey standard:** [`../operations/journey-traceability.md`](../operations/journey-traceability.md)
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/reports/user-story-map.md` at line 5, Fix the broken "Journey standard"
markdown link in docs/reports/user-story-map.md by changing the link target from
../../operations/journey-traceability.md to
../operations/journey-traceability.md so it correctly points one directory up;
update the markdown link text `[../../operations/journey-traceability.md]`
accordingly.

- **Status date:** 2026-06-05
- **Note:** All seven FRs are stubs (`Status: Stub`, `Test Status: Not yet written`). Source / test / journey columns are populated where the existing code/test layout already maps to the intent, and `[ ]` boxes mark which rows still need a journey manifest, code, test, and gate wired up. The FR-005 / FR-006 / FR-007 rows are the lowest-coverage rows: FR-005 has no test or journey artifact yet; FR-006 has a partial test (auth touches settings only); FR-007 has a partial test (api token only).

Comment thread
coderabbitai[bot] marked this conversation as resolved.
## Legend

- **Code:** Source path(s) that implement the story today.
- **Tests:** Test path(s) that exercise the code (or `none` if only a smoke import exists).
- **Journey:** Path to a journey manifest/evidence bundle, or `none` if not yet produced.
- **Gate:** The CI workflow that should enforce the row (or `none` if missing).
- **Checkboxes** track the four artifacts the row needs: journey manifest, code, test, gate.

## Traceability Table

| # | User story | FR id | Source file(s) | Test file(s) | Journey page (planned/produced) | Gate | Manifest | Code | Test | Gate wired |
|---|------------|-------|----------------|--------------|---------------------------------|------|----------|------|------|------------|
| 1 | As a project lead, I can create and manage a Planify project workspace end-to-end | FR-001 Project workflow management | `rust/Planify/apps/api/plane/app/views/workspace/base.py`, `rust/Planify/apps/api/plane/app/views/project/base.py`, `rust/Planify/apps/web/app/routes/core.ts` | `rust/Planify/apps/api/plane/tests/contract/app/test_workspace_app.py`, `rust/Planify/apps/api/plane/tests/contract/app/test_project_app.py`, `tests/smoke_test.go` (FR-001 trace) | `docs/journeys/manifests/planify-workspace-create.json` (planned) | `.github/workflows/fr-coverage.yml` | [ ] | [x] | [x] | [ ] |
| 2 | As a team member, I can schedule and execute cycles and tasks inside a project | FR-002 Task scheduling and execution | `rust/Planify/apps/api/plane/app/views/cycle/`, `rust/Planify/apps/api/plane/bgtasks/issue_automation_task.py`, `rust/Planify/apps/api/plane/bgtasks/email_notification_task.py` | `rust/Planify/apps/api/plane/tests/contract/api/test_cycles.py` | `docs/journeys/manifests/planify-cycle-run.json` (planned) | `.github/workflows/quality-gate.yml` | [ ] | [x] | [x] | [ ] |
| 3 | As a multi-stack maintainer, I can run Planify (TS/Bun) and KaskMan (Go/Node) side by side | FR-003 Multi-language project support | `rust/Planify/` (TS monorepo, Turbo + pnpm), `go/KaskMan/` (Node CLI + Go-style services) | `rust/Planify/packages/codemods/tests/remove-directives.spec.ts`, `rust/Planify/packages/codemods/tests/function-declaration.spec.ts`, `go/KaskMan/src/rnd-module/RnDModule.test.js` | `docs/journeys/manifests/multistack-bootstrap.json` (planned) | `.github/workflows/ci.yml` | [ ] | [x] | [x] | [x] |
| 4 | As a build engineer, I can resolve and track dependencies across Planify packages | FR-004 Dependency resolution and tracking | `rust/Planify/pnpm-workspace.yaml`, `rust/Planify/turbo.json`, `rust/Planify/package.json` (catalog deps), `rust/Planify/apps/api/plane/requirements.txt` | `rust/Planify/apps/live/tests/services/pdf-export/effect-utils.test.ts`, `rust/Planify/apps/live/tests/lib/pdf/pdf-rendering.test.ts` | `docs/journeys/manifests/planify-dep-graph.json` (planned) | `.github/workflows/ci.yml` | [ ] | [x] | [x] | [x] |
| 5 | As a release engineer, I can generate and publish build artifacts | FR-005 Artifact generation and publishing | `rust/Planify/apps/api/Dockerfile.api`, `rust/Planify/apps/web/Dockerfile.web`, `rust/Planify/apps/space/Dockerfile.space`, `rust/Planify/deployments/` | none | none | none | [ ] | [x] | [ ] | [ ] |
| 6 | As an operator, I can manage configuration across environments (env, secrets, Doppler) | FR-006 Configuration management | `rust/Planify/.env.example`, `rust/Planify/doppler.yaml`, `rust/Planify/apps/api/plane/settings/`, `go/KaskMan/.env.example`, `go/KaskMan/dashboard-memory.json` | `rust/Planify/apps/api/plane/tests/contract/app/test_authentication.py` (instance setup touches settings) | none | none | [ ] | [x] | [x] | [ ] |
| 7 | As an integrator, I can plug into external services via webhooks, exporters, and license checks | FR-007 Integration with external services | `rust/Planify/apps/api/plane/app/views/webhook/`, `rust/Planify/apps/api/plane/bgtasks/export_task.py`, `rust/Planify/apps/api/plane/license/`, `go/KaskMan/src/interfaces/api/server.js` | `rust/Planify/apps/api/plane/tests/contract/app/test_api_token.py` | none | none | [ ] | [x] | [x] | [ ] |
Comment on lines +19 to +27

@coderabbitai coderabbitai Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify file paths referenced in the traceability table exist

echo "=== Checking source files ==="
fd -t f "base.py" rust/Planify/apps/api/plane/app/views/workspace/
fd -t f "base.py" rust/Planify/apps/api/plane/app/views/project/
fd -t f "core.ts" rust/Planify/apps/web/app/routes/
fd -t f "issue_automation_task.py" rust/Planify/apps/api/plane/bgtasks/
fd -t f "email_notification_task.py" rust/Planify/apps/api/plane/bgtasks/
fd -t f "pnpm-workspace.yaml" rust/Planify/
fd -t f "turbo.json" rust/Planify/
fd -t f "Dockerfile.api" rust/Planify/apps/api/
fd -t f ".env.example" rust/Planify/
fd -t f "doppler.yaml" rust/Planify/
fd -t f ".env.example" go/KaskMan/

echo "=== Checking test files ==="
fd -t f "test_workspace_app.py" rust/Planify/apps/api/plane/tests/contract/app/
fd -t f "test_project_app.py" rust/Planify/apps/api/plane/tests/contract/app/
fd -t f "smoke_test.go" tests/
fd -t f "test_cycles.py" rust/Planify/apps/api/plane/tests/contract/api/
fd -t f "remove-directives.spec.ts" rust/Planify/packages/codemods/tests/
fd -t f "test_authentication.py" rust/Planify/apps/api/plane/tests/contract/app/

echo "=== Checking workflow files ==="
fd -t f "fr-coverage.yml" .github/workflows/
fd -t f "quality-gate.yml" .github/workflows/
fd -t f "ci.yml" .github/workflows/

echo "=== Checking referenced docs ==="
fd -t f "FUNCTIONAL_REQUIREMENTS.md"
fd -t f "journey-traceability.md" docs/operations/

echo "=== Checking planned journey manifest directory ==="
ls -la docs/journeys/manifests/ 2>/dev/null || echo "Directory docs/journeys/manifests/ does not exist yet"

Repository: KooshaPari/PhenoProject

Length of output: 1313

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Verify all referenced paths from docs/traceability/user-story-map.md

missing=0

check_file() {
  local p="$1"
  if [ -e "$p" ]; then
    echo "OK: $p"
  else
    echo "MISSING: $p"
    missing=1
  fi
}

check_dir() {
  local p="$1"
  if [ -d "$p" ]; then
    echo "OK(dir): $p"
  else
    echo "MISSING(dir): $p"
    missing=1
  fi
}

echo "=== Verifying exact paths from traceability table ==="

# FR-001
check_file "rust/Planify/apps/api/plane/app/views/workspace/base.py"
check_file "rust/Planify/apps/api/plane/app/views/project/base.py"
check_file "rust/Planify/apps/web/app/routes/core.ts"
check_file "rust/Planify/apps/api/plane/tests/contract/app/test_workspace_app.py"
check_file "rust/Planify/apps/api/plane/tests/contract/app/test_project_app.py"
check_file "tests/smoke_test.go"
check_file "docs/journeys/manifests/planify-workspace-create.json"
check_file ".github/workflows/fr-coverage.yml"

# FR-002
check_dir  "rust/Planify/apps/api/plane/app/views/cycle"
check_file "rust/Planify/apps/api/plane/bgtasks/issue_automation_task.py"
check_file "rust/Planify/apps/api/plane/bgtasks/email_notification_task.py"
check_file "rust/Planify/apps/api/plane/tests/contract/api/test_cycles.py"
check_file "docs/journeys/manifests/planify-cycle-run.json"
check_file ".github/workflows/quality-gate.yml"

# FR-003
check_dir  "rust/Planify"
check_dir  "go/KaskMan"
check_file "rust/Planify/packages/codemods/tests/remove-directives.spec.ts"
check_file "rust/Planify/packages/codemods/tests/function-declaration.spec.ts"
check_file "go/KaskMan/src/rnd-module/RnDModule.test.js"
check_file "docs/journeys/manifests/multistack-bootstrap.json"
check_file ".github/workflows/ci.yml"

# FR-004
check_file "rust/Planify/pnpm-workspace.yaml"
check_file "rust/Planify/turbo.json"
check_file "rust/Planify/package.json"
check_file "rust/Planify/apps/api/plane/requirements.txt"
check_file "rust/Planify/apps/live/tests/services/pdf-export/effect-utils.test.ts"
check_file "rust/Planify/apps/live/tests/lib/pdf/pdf-rendering.test.ts"
check_file "docs/journeys/manifests/planify-dep-graph.json"
check_file ".github/workflows/ci.yml"

# FR-005
check_file "rust/Planify/apps/api/Dockerfile.api"
check_file "rust/Planify/apps/web/Dockerfile.web"
check_file "rust/Planify/apps/space/Dockerfile.space"
check_dir  "rust/Planify/deployments/"
# none for test/journey/workflows other than gate wiring in table (no path)

# FR-006
check_file "rust/Planify/.env.example"
check_file "rust/Planify/doppler.yaml"
check_dir  "rust/Planify/apps/api/plane/settings/"
check_file "go/KaskMan/.env.example"
check_file "go/KaskMan/dashboard-memory.json"
check_file "rust/Planify/apps/api/plane/tests/contract/app/test_authentication.py"

# none for journey manifest / workflows in table (paths are "none")

# FR-007
check_dir  "rust/Planify/apps/api/plane/app/views/webhook"
check_file "rust/Planify/apps/api/plane/bgtasks/export_task.py"
check_dir  "rust/Planify/apps/api/plane/license"
check_file "go/KaskMan/src/interfaces/api/server.js"
check_file "rust/Planify/apps/api/plane/tests/contract/app/test_api_token.py"

echo "=== Verifying docs/journeys/manifests/ contents ==="
ls -la docs/journeys/manifests/ || true

if [ "${missing:-0}" -ne 0 ]; then
  echo "RESULT: Some referenced paths are missing."
  exit 1
fi

echo "RESULT: All referenced paths exist."

Repository: KooshaPari/PhenoProject

Length of output: 2520

Fix missing referenced files in traceability table (docs/traceability/user-story-map.md:19-27)

  • Missing journey manifests:
    • docs/journeys/manifests/planify-workspace-create.json (FR-001)
    • docs/journeys/manifests/planify-cycle-run.json (FR-002)
    • docs/journeys/manifests/multistack-bootstrap.json (FR-003)
    • docs/journeys/manifests/planify-dep-graph.json (FR-004)
  • Missing source dependency file:
    • rust/Planify/apps/api/plane/requirements.txt (FR-004)
🧰 Tools
🪛 LanguageTool

[uncategorized] ~21-~21: The official name of this software platform is spelled with a capital “H”.
Context: ...nify-workspace-create.json(planned) |.github/workflows/fr-coverage.yml` | [ ] | [x] ...

(GITHUB)

[uncategorized] ~22-~22: The official name of this software platform is spelled with a capital “H”.
Context: ...sts/planify-cycle-run.json(planned) |.github/workflows/quality-gate.yml` | [ ] | [x]...

(GITHUB)

[uncategorized] ~23-~23: The official name of this software platform is spelled with a capital “H”.
Context: .../multistack-bootstrap.json(planned) |.github/workflows/ci.yml` | [ ] | [x] | [x] | [...

(GITHUB)

[uncategorized] ~24-~24: The official name of this software platform is spelled with a capital “H”.
Context: ...sts/planify-dep-graph.json(planned) |.github/workflows/ci.yml` | [ ] | [x] | [x] | [...

(GITHUB)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/traceability/user-story-map.md` around lines 19 - 27, The traceability
table references several missing manifest and source files (see FR-001..FR-004
entries); update the repo and the table so the referenced files exist and the
table is accurate: add or commit the missing journey manifest files
docs/journeys/manifests/planify-workspace-create.json, planify-cycle-run.json,
multistack-bootstrap.json, planify-dep-graph.json and ensure the source
dependency file rust/Planify/apps/api/plane/requirements.txt is added or the
FR-004 row updated to point to the correct existing file; then update the
user-story-map.md rows for FR-001..FR-004 to reference the correct filenames (or
remove the manifest/source references) so entries for Planify workspace
(FR-001), cycle run (FR-002), multistack bootstrap (FR-003) and dependency graph
(FR-004) accurately reflect committed files.


## Coverage Summary

| FR id | Code present | Test present | Journey manifest | Gate wired | Coverage |
|-------|--------------|--------------|------------------|------------|----------|
| FR-001 | yes | yes (contract + smoke) | planned | partial | medium |
| FR-002 | yes | yes (cycle contract) | planned | partial | medium |
| FR-003 | yes | yes (codemods + KaskMan) | planned | yes | high |
| FR-004 | yes | yes (live/pdf unit) | planned | yes | high |
| FR-005 | yes | no | no | no | low |
| FR-006 | yes | partial (auth touches settings only) | no | no | low |
| FR-007 | yes | yes (api token only) | no | no | low |

## Lowest-Coverage Stories (Top 3)

1. **FR-005 Artifact generation and publishing** - no test, no journey manifest, no dedicated gate. Only Dockerfiles and a `deployments/` directory exist.
2. **FR-006 Configuration management** - only one contract test (auth/instance setup) tangentially covers settings; no journey and no dedicated gate. Surface spans `.env`, Doppler config, and Django settings.
3. **FR-007 Integration with external services** - only the API token contract test exists; webhook, exporter, and license flows have no dedicated tests, no journey evidence, and no gate.

## Next Actions

- [ ] Flesh out FR-001..FR-007 descriptions in `FUNCTIONAL_REQUIREMENTS.md` (currently empty stubs).
- [ ] Add a journey manifest JSON for each of the seven stories under `docs/journeys/manifests/`.
- [ ] Add Playwright e2e coverage for at least one story per gate (FR-005/006/007 are the biggest gaps).
- [ ] Wire `.github/workflows/fr-coverage.yml` to a real FR/test parser (currently a no-op echo step).
Loading