Hartmut/Nexus
1
0
Fork 0
Code Issues 11 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI
CI / Unit Tests (pull_request) Successful in 5m46s
Details
CI / Lint (pull_request) Failing after 3m49s
Details
CI / E2E Tests (pull_request) Has been skipped
Details
CI / Fresh-Linux Docker Deploy (pull_request) Has been skipped
Details
CI / Assistant Split Regression (pull_request) Failing after 35s
Details
CI / Architecture Guardrails (pull_request) Failing after 2m14s
Details
CI / Typecheck (pull_request) Successful in 4m22s
Details
CI / Build (pull_request) Has been skipped
Details
CI / Release Images (pull_request) Has been skipped
Details

Browse Source 
- @capakraken/* → @nexus/* across 12 packages (root + 11 workspaces),
  1551 import lines migrated via codemod
- User-visible brand strings renamed (emails, page titles, PWA
  manifest, mobile header, MFA backup-codes header, tooltips, signin
  page, invite page, weekly digest, install prompt)
- TOTP issuer "CapaKraken" → "Nexus" (existing secrets still valid;
  re-enrollment relabels them in users' authenticator apps)
- Function rename: assertCapaKrakenDbTarget → assertNexusDbTarget
- LocalStorage migration shim in apps/web/src/app/layout.tsx copies
  capakraken_* → nexus_* on first load (guarded by nexus_migrated_v1
  sentinel; runs once per browser, then never again)
- Service-worker cache name capakraken-v2 → nexus-v2 with one-time
  caches.delete('capakraken-v2') from the same shim
- Email-domain fixtures @capakraken.{dev,app} → @nexus.{dev,app} in
  seed data, e2e specs, SMTP default fallback
- Dockerfile.dev / Dockerfile.prod / all .github/workflows/*.yml
  pnpm --filter @capakraken/* → @nexus/*
- README, CLAUDE.md, LEARNINGS.md, all docs/*.md, .env.example,
  tooling/deploy/.env.production.example brand sweep

Phase 1 deliberately leaves untouched (handled in Phase 3 cutover):
- PostgreSQL DB name "capakraken" and POSTGRES_USER "capakraken"
- Volume names capakraken_pgdata etc.
- Compose project name "capakraken" / "capakraken-prod"
- db-target-guard default expectedDatabase
- env-var CAPAKRAKEN_EXPECTED_DB_NAME
- Container DNS names in docker-compose.ci.yml

Quality gates green: pnpm typecheck (7/7), pnpm test:unit (7/7),
pnpm lint (0 errors), check:exports/imports/architecture all pass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Hartmut Nörenberg
2026-05-21 15:10:44 +02:00
parent d9a7ec0338
commit 4a5edeef3e
941 changed files with 24475 additions and 16760 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/README.md
+24 -24
View File
@@ -1,24 +1,24 @@
# Documentation Index
**Date:** 2026-03-12
**Purpose:** Single entry point for active CapaKraken product and technical documentation.
**Purpose:** Single entry point for active Nexus product and technical documentation.
## Canonical Documents
| Topic | File | Use |
|---|---|---|
| AI excellence due diligence | [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md) | Frank quality assessment and cleanup roadmap toward a showcase AI-built project |
| Showcase quality backlog | [showcase-quality-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/showcase-quality-backlog.md) | Consolidated working backlog for the current quality and maintainability north star |
| Parallel worktree hygiene | [parallel-worktree-hygiene.md](/home/hartmut/Documents/Copilot/capakraken/docs/parallel-worktree-hygiene.md) | Keep parallel worker slices isolated and the worktree reviewable |
| Target CI/CD architecture | [cicd-target-architecture.md](/home/hartmut/Documents/Copilot/capakraken/docs/cicd-target-architecture.md) | Canonical image-based build, deploy, and rollback flow |
| Active roadmap and open gaps | [product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md) | Primary backlog and current delivery order |
| Estimating system design | [estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md) | Workbook analysis, field mapping, and implementation plan |
| Dispo import implementation | [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation.md) | Clean-slate Dispo v2 import design, mapping rules, staging flow, and commit policy |
| Dispo import ticket pack | [dispo-import-implementation-tickets.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation-tickets.md) | Worker-ready delivery slices, dependencies, and acceptance criteria for the Dispo import |
| Demand/assignment cutover guide | [demand-assignment-migration-cutover.md](/home/hartmut/Documents/Copilot/capakraken/docs/demand-assignment-migration-cutover.md) | Go/no-go criteria, staged cutover, and readiness artifact policy |
| Strategic architecture direction | [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/capakraken/research/v2-architecture-proposal-2026-03-11.md) | Longer-horizon architecture target |
| Implementation history | [LEARNINGS.md](/home/hartmut/Documents/Copilot/capakraken/LEARNINGS.md) | Append-only decisions and lessons |
| Agent/project guidance | [CLAUDE.md](/home/hartmut/Documents/Copilot/capakraken/CLAUDE.md) | Working conventions and quality gates |
| Topic | File | Use |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| AI excellence due diligence | [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md) | Frank quality assessment and cleanup roadmap toward a showcase AI-built project |
| Showcase quality backlog | [showcase-quality-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/showcase-quality-backlog.md) | Consolidated working backlog for the current quality and maintainability north star |
| Parallel worktree hygiene | [parallel-worktree-hygiene.md](/home/hartmut/Documents/Copilot/nexus/docs/parallel-worktree-hygiene.md) | Keep parallel worker slices isolated and the worktree reviewable |
| Target CI/CD architecture | [cicd-target-architecture.md](/home/hartmut/Documents/Copilot/nexus/docs/cicd-target-architecture.md) | Canonical image-based build, deploy, and rollback flow |
| Active roadmap and open gaps | [product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md) | Primary backlog and current delivery order |
| Estimating system design | [estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md) | Workbook analysis, field mapping, and implementation plan |
| Dispo import implementation | [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation.md) | Clean-slate Dispo v2 import design, mapping rules, staging flow, and commit policy |
| Dispo import ticket pack | [dispo-import-implementation-tickets.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation-tickets.md) | Worker-ready delivery slices, dependencies, and acceptance criteria for the Dispo import |
| Demand/assignment cutover guide | [demand-assignment-migration-cutover.md](/home/hartmut/Documents/Copilot/nexus/docs/demand-assignment-migration-cutover.md) | Go/no-go criteria, staged cutover, and readiness artifact policy |
| Strategic architecture direction | [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/nexus/research/v2-architecture-proposal-2026-03-11.md) | Longer-horizon architecture target |
| Implementation history | [LEARNINGS.md](/home/hartmut/Documents/Copilot/nexus/LEARNINGS.md) | Append-only decisions and lessons |
| Agent/project guidance | [CLAUDE.md](/home/hartmut/Documents/Copilot/nexus/CLAUDE.md) | Working conventions and quality gates |
## Archive Policy
@@ -34,12 +34,12 @@ Archive-note files should point back to the relevant canonical document instead
All archived markdown plan and proposal files now live under `docs/old-markdowns/`.
- [plan.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/plan.md)
- [rename-capakraken-to-capakraken-plan.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/rename-capakraken-to-capakraken-plan.md)
- [PLAN_SKILLMATRIX.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/PLAN_SKILLMATRIX.md)
- [refactor-sprint-plan.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/refactor-sprint-plan.md)
- [estimating-field-mapping.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/estimating-field-mapping.md)
- [cgi-breakdown-implementation-proposal.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/cgi-breakdown-implementation-proposal.md)
- [architecture-evaluation-2026-03-06.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/architecture-evaluation-2026-03-06.md)
- [perf-audit-2026-03-09.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/perf-audit-2026-03-09.md)
- [review-report-2026-03-15-computation-graph.md](/home/hartmut/Documents/Copilot/capakraken/docs/old-markdowns/review-report-2026-03-15-computation-graph.md)
- [plan.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/plan.md)
- [rename-nexus-to-nexus-plan.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/rename-nexus-to-nexus-plan.md)
- [PLAN_SKILLMATRIX.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/PLAN_SKILLMATRIX.md)
- [refactor-sprint-plan.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/refactor-sprint-plan.md)
- [estimating-field-mapping.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/estimating-field-mapping.md)
- [cgi-breakdown-implementation-proposal.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/cgi-breakdown-implementation-proposal.md)
- [architecture-evaluation-2026-03-06.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/architecture-evaluation-2026-03-06.md)
- [perf-audit-2026-03-09.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/perf-audit-2026-03-09.md)
- [review-report-2026-03-15-computation-graph.md](/home/hartmut/Documents/Copilot/nexus/docs/old-markdowns/review-report-2026-03-15-computation-graph.md)
docs/acn-full-standards-compliance.md
+119 -115
View File
@@ -1,4 +1,4 @@
# CapaKraken — Vollstaendiger Accenture Security Standards Abgleich
# Nexus — Vollstaendiger Accenture Security Standards Abgleich
**Stand:** 2026-03-27 | **Analysierte Standards:** 6 von 19 relevanten (die kritischsten)
@@ -6,14 +6,14 @@
## Uebersicht: Alle analysierten Standards
| # | Standard | Version | Controls | OK | PARTIAL | TODO | Compliance |
|---|----------|---------|----------|-----|---------|------|-----------|
| 1 | Application Security Standard | V 7.30 | 63 | 46 | 5 | 8 | **73%** |
| 2 | Generative AI Security Standard | V 1.1 | ~45 | ~15 | ~12 | ~18 | **~33%** |
| 3 | Agentic AI Security Standard | V 1.2 | ~50 | ~10 | ~15 | ~25 | **~20%** |
| 4 | PostgreSQL Security Standard | V 1.6 | ~25 | ~8 | ~7 | ~10 | **~32%** |
| 5 | Logging and Auditing Standard | (ref) | ~15 | ~12 | ~2 | ~1 | **~80%** |
| 6 | Access Control Standard | (ref) | ~10 | ~8 | ~1 | ~1 | **~80%** |
| # | Standard | Version | Controls | OK | PARTIAL | TODO | Compliance |
| --- | ------------------------------- | ------- | -------- | --- | ------- | ---- | ---------- |
| 1 | Application Security Standard | V 7.30 | 63 | 46 | 5 | 8 | **73%** |
| 2 | Generative AI Security Standard | V 1.1 | ~45 | ~15 | ~12 | ~18 | **~33%** |
| 3 | Agentic AI Security Standard | V 1.2 | ~50 | ~10 | ~15 | ~25 | **~20%** |
| 4 | PostgreSQL Security Standard | V 1.6 | ~25 | ~8 | ~7 | ~10 | **~32%** |
| 5 | Logging and Auditing Standard | (ref) | ~15 | ~12 | ~2 | ~1 | **~80%** |
| 6 | Access Control Standard | (ref) | ~10 | ~8 | ~1 | ~1 | **~80%** |
---
@@ -26,47 +26,47 @@ Bereits detailliert analysiert — siehe `acn-security-compliance-status.md`.
## Standard 2: Generative AI Security Standard V1.1 (~33%)
**CapaKraken Kategorie:** "Complex Agentic Systems" (HartBOT mit 87+ Tools)
**Nexus Kategorie:** "Complex Agentic Systems" (HartBOT mit 87+ Tools)
### 4.1 Extension Management Security
| EGAI # | Control | Status | CapaKraken | Handlungsbedarf |
|--------|---------|--------|-----------|----------------|
| 4.1.1.1 | Extensions im Kontext des Auth-Users ausfuehren | OK | Tools nutzen `ctx.permissions` + `assertPermission()` | — |
| 4.1.1.2 | Extension-Permissions auf Minimum beschraenken | PARTIAL | Tools haben breiten DB-Zugriff via `ctx.db` | Tool-Permissions granularer machen (read-only Tools sollen nicht schreiben koennen) |
| 4.1.1.3 | Nur essential Plugins beschraenken | OK | 87 Tools, alle zweckgebunden definiert | — |
| 4.1.1.4 | Nur noetige Endpoints/Methods exponieren | OK | Jedes Tool hat spezifische Zod-Input-Schema | — |
| 4.1.1.5 | Extensions auf minimum permissions | PARTIAL | Alle Tools laufen mit vollem `ctx.db` Zugriff | Separate Read-Only DB-Connection fuer Query-Tools |
| 4.1.1.6 | Auth in Downstream-Systemen, nicht im LLM | OK | RBAC via `assertPermission()` in jedem Tool | — |
| 4.1.2.1 | AI Agent kontinuierlich monitoren | TODO | Kein Runtime-Monitoring des AI-Verhaltens | AI-Action-Logging implementieren (welche Tools wie oft aufgerufen) |
| 4.1.2.2 | Adversarial Testing (Fuzzing, Input Manipulation) | TODO | Kein adversarial Testing | Prompt Injection Tests + Fuzzing Suite erstellen |
| 4.1.2.3 | Keine open-ended Extensions | OK | Alle Tools sind zweckgebunden, kein `eval()` oder arbitrary code | — |
| 4.1.2.4 | Complete Mediation — jeder Request validiert | OK | tRPC Middleware prueft Auth auf jedem Request | — |
| 4.1.2.5 | AI gibt accurate, relevante Antworten | PARTIAL | System Prompt definiert Verhalten, aber kein Output-Validation | Output-Validierung fuer kritische Aktionen |
| 4.1.3.1 | **HITL fuer High-Impact Actions** | **TODO** | **Kein Human-in-the-Loop — AI kann direkt erstellen/loeschen** | **KRITISCH: Confirmation fuer create/delete/update Aktionen** |
| 4.1.3.2 | Rate Limiting auf Extensions | OK | Rate Limiting auf tRPC-Procedures (100/15min) | — |
| EGAI # | Control | Status | Nexus | Handlungsbedarf |
| ------- | ------------------------------------------------- | -------- | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| 4.1.1.1 | Extensions im Kontext des Auth-Users ausfuehren | OK | Tools nutzen `ctx.permissions` + `assertPermission()` | — |
| 4.1.1.2 | Extension-Permissions auf Minimum beschraenken | PARTIAL | Tools haben breiten DB-Zugriff via `ctx.db` | Tool-Permissions granularer machen (read-only Tools sollen nicht schreiben koennen) |
| 4.1.1.3 | Nur essential Plugins beschraenken | OK | 87 Tools, alle zweckgebunden definiert | — |
| 4.1.1.4 | Nur noetige Endpoints/Methods exponieren | OK | Jedes Tool hat spezifische Zod-Input-Schema | — |
| 4.1.1.5 | Extensions auf minimum permissions | PARTIAL | Alle Tools laufen mit vollem `ctx.db` Zugriff | Separate Read-Only DB-Connection fuer Query-Tools |
| 4.1.1.6 | Auth in Downstream-Systemen, nicht im LLM | OK | RBAC via `assertPermission()` in jedem Tool | — |
| 4.1.2.1 | AI Agent kontinuierlich monitoren | TODO | Kein Runtime-Monitoring des AI-Verhaltens | AI-Action-Logging implementieren (welche Tools wie oft aufgerufen) |
| 4.1.2.2 | Adversarial Testing (Fuzzing, Input Manipulation) | TODO | Kein adversarial Testing | Prompt Injection Tests + Fuzzing Suite erstellen |
| 4.1.2.3 | Keine open-ended Extensions | OK | Alle Tools sind zweckgebunden, kein `eval()` oder arbitrary code | — |
| 4.1.2.4 | Complete Mediation — jeder Request validiert | OK | tRPC Middleware prueft Auth auf jedem Request | — |
| 4.1.2.5 | AI gibt accurate, relevante Antworten | PARTIAL | System Prompt definiert Verhalten, aber kein Output-Validation | Output-Validierung fuer kritische Aktionen |
| 4.1.3.1 | **HITL fuer High-Impact Actions** | **TODO** | **Kein Human-in-the-Loop — AI kann direkt erstellen/loeschen** | **KRITISCH: Confirmation fuer create/delete/update Aktionen** |
| 4.1.3.2 | Rate Limiting auf Extensions | OK | Rate Limiting auf tRPC-Procedures (100/15min) | — |
### 4.3 AI Response Handling Security
| EGAI # | Control | Status | CapaKraken | Handlungsbedarf |
|--------|---------|--------|-----------|----------------|
| 4.3.1.2 | Model-Responses validieren | PARTIAL | Tool-Results werden JSON-serialized, kein Schema-Check | Output-Schema Validierung fuer Tool-Results |
| 4.3.1.3 | AI-Content klar kennzeichnen | TODO | Kein "AI Generated" Label auf AI-Summaries/Narratives | Label "AI Generated" auf allen AI-Outputs |
| 4.3.1.4 | User ueber LLM-Risiken informieren | TODO | Kein Disclaimer | Disclaimer im Chat-Panel: "AI-Antworten koennen ungenau sein" |
| 4.3.2.1 | Semantic Filtering fuer toxische Inhalte | TODO | Kein Content-Filter auf AI-Outputs | Content-Filter auf AI-Responses evaluieren |
| EGAI # | Control | Status | Nexus | Handlungsbedarf |
| ------- | ---------------------------------------- | ------- | ------------------------------------------------------ | ------------------------------------------------------------- |
| 4.3.1.2 | Model-Responses validieren | PARTIAL | Tool-Results werden JSON-serialized, kein Schema-Check | Output-Schema Validierung fuer Tool-Results |
| 4.3.1.3 | AI-Content klar kennzeichnen | TODO | Kein "AI Generated" Label auf AI-Summaries/Narratives | Label "AI Generated" auf allen AI-Outputs |
| 4.3.1.4 | User ueber LLM-Risiken informieren | TODO | Kein Disclaimer | Disclaimer im Chat-Panel: "AI-Antworten koennen ungenau sein" |
| 4.3.2.1 | Semantic Filtering fuer toxische Inhalte | TODO | Kein Content-Filter auf AI-Outputs | Content-Filter auf AI-Responses evaluieren |
### 4.6 External API Integration Security
| EGAI # | Control | Status | CapaKraken | Handlungsbedarf |
|--------|---------|--------|-----------|----------------|
| 4.6.1.1 | API-Aktivitaet monitoren + Alerts | OK | External API Logging mit Pino (Timing + Provider) | — |
| 4.6.2.1 | Sichere Protokolle fuer externe APIs | OK | HTTPS fuer OpenAI + Gemini | — |
| 4.6.2.4 | Starke Auth fuer LLM-Endpoints | OK | Auth.js + tRPC protectedProcedure | — |
| 4.6.3.2 | Preprocessing-Modul fuer Input/Output Scanning | TODO | Kein Input/Output-Scanner | Prompt-Injection Detection Middleware |
| 4.6.4.1 | Action-Queuing + Limits | OK | Rate Limiting + max 8 Tool-Iterations | — |
| 4.6.5.1 | CSP gegen XSS | OK | Content-Security-Policy implementiert | — |
| 4.6.5.4 | Error Messages ohne sensitive Details | OK | tRPC Error-Codes, keine Stack Traces | — |
| 4.6.5.7 | API Keys sicher gespeichert | OK | In SystemSettings DB, nicht in Code/Env | — |
| EGAI # | Control | Status | Nexus | Handlungsbedarf |
| ------- | ---------------------------------------------- | ------ | ------------------------------------------------- | ------------------------------------- |
| 4.6.1.1 | API-Aktivitaet monitoren + Alerts | OK | External API Logging mit Pino (Timing + Provider) | — |
| 4.6.2.1 | Sichere Protokolle fuer externe APIs | OK | HTTPS fuer OpenAI + Gemini | — |
| 4.6.2.4 | Starke Auth fuer LLM-Endpoints | OK | Auth.js + tRPC protectedProcedure | — |
| 4.6.3.2 | Preprocessing-Modul fuer Input/Output Scanning | TODO | Kein Input/Output-Scanner | Prompt-Injection Detection Middleware |
| 4.6.4.1 | Action-Queuing + Limits | OK | Rate Limiting + max 8 Tool-Iterations | — |
| 4.6.5.1 | CSP gegen XSS | OK | Content-Security-Policy implementiert | — |
| 4.6.5.4 | Error Messages ohne sensitive Details | OK | tRPC Error-Codes, keine Stack Traces | — |
| 4.6.5.7 | API Keys sicher gespeichert | OK | In SystemSettings DB, nicht in Code/Env | — |
---
@@ -76,44 +76,44 @@ Bereits detailliert analysiert — siehe `acn-security-compliance-status.md`.
### 3.1 Memory Poisoning Prevention
| IAAI # | Control | Status | Handlungsbedarf |
|--------|---------|--------|----------------|
| 3.1.1 | Memory Content Validation | PARTIAL | Chat-Messages in localStorage, kein Schema-Validation | Conversation-History validieren |
| IAAI # | Control | Status | Handlungsbedarf |
| ------ | ------------------------- | ------- | ----------------------------------------------------- | ------------------------------- |
| 3.1.1 | Memory Content Validation | PARTIAL | Chat-Messages in localStorage, kein Schema-Validation | Conversation-History validieren |
### 3.2 HITL & Decision Fatigue
| IAAI # | Control | Status | Handlungsbedarf |
|--------|---------|--------|----------------|
| 3.2.1 | Goal Consistency Validation | TODO | Kein Check ob AI-Aktionen mit User-Intent uebereinstimmen | Intent-Validation Layer |
| IAAI # | Control | Status | Handlungsbedarf |
| ------ | --------------------------- | ------ | --------------------------------------------------------- | ----------------------- |
| 3.2.1 | Goal Consistency Validation | TODO | Kein Check ob AI-Aktionen mit User-Intent uebereinstimmen | Intent-Validation Layer |
### 3.3 Tool Execution Security
| IAAI # | Control | Status | Handlungsbedarf |
|--------|---------|--------|----------------|
| 3.3.1 | **Execution Sandboxes** | **TODO** | **Tools laufen im selben Prozess wie die App** | **KRITISCH: Tool-Execution isolieren** |
| IAAI # | Control | Status | Handlungsbedarf |
| ------ | ----------------------- | -------- | ---------------------------------------------- | -------------------------------------- |
| 3.3.1 | **Execution Sandboxes** | **TODO** | **Tools laufen im selben Prozess wie die App** | **KRITISCH: Tool-Execution isolieren** |
### 3.5 Authentication & Privilege
| IAAI # | Control | Status | Handlungsbedarf |
|--------|---------|--------|----------------|
| 3.5.1 | Granulare RBAC/ABAC | OK | 5-stufiges RBAC + PermissionKey pro Tool | — |
| IAAI # | Control | Status | Handlungsbedarf |
| ------ | ------------------- | ------ | ---------------------------------------- | --- |
| 3.5.1 | Granulare RBAC/ABAC | OK | 5-stufiges RBAC + PermissionKey pro Tool | — |
### 3.6 Application Development & Deployment (36 MCP-Controls)
| IAAI # | Control | Status | Handlungsbedarf |
|--------|---------|--------|----------------|
| 3.6.1 | Version Control fuer AI Knowledge | OK | Git-basiert, alle Aenderungen tracked | — |
| 3.6.2 | Dependencies scannen | OK | Dependabot + npm audit Cron | — |
| 3.6.3 | Version Pinning | OK | pnpm lockfile | — |
| 3.6.4 | Alle Interaktionen verschluesselt | PARTIAL | HTTPS extern, aber intern unverschluesselt (localhost tRPC) | Intern TLS evaluieren |
| 3.6.10-21 | MCP OAuth/Token Validation | **N/A** | **CapaKraken nutzt kein MCP-Protokoll** — AI ist eingebettet | Standard-MCP Controls nicht anwendbar |
| 3.6.22 | Tool Permissions auf Minimum | PARTIAL | Tools haben vollen DB-Zugriff | Read-Only separation |
| 3.6.26 | **Human Approval fuer High-Risk Ops** | **TODO** | **AI kann ohne Bestaetigung Daten aendern** | **KRITISCH** |
| 3.6.30 | Input Sanitization in Tools | OK | Zod-Schemas auf allen Tool-Inputs | — |
| 3.6.33 | Parameterized DB Queries | OK | Prisma ORM | — |
| 3.6.34 | Quotas, Timeouts, Rate Limits | OK | Rate Limiting + max 8 Iterations + Tool Result Size Cap | — |
| 3.6.35 | Actions/Permissions an User anzeigen | PARTIAL | Tool-Results werden angezeigt, aber nicht vorab | Vorab-Anzeige was der AI-Agent tun wird |
| 3.6.36 | Automated Security Scanning | PARTIAL | CI/CD Tests, kein spezifisches AI-Security-Scanning | AI-spezifische Scans |
| IAAI # | Control | Status | Handlungsbedarf |
| --------- | ------------------------------------- | -------- | ----------------------------------------------------------- | --------------------------------------- |
| 3.6.1 | Version Control fuer AI Knowledge | OK | Git-basiert, alle Aenderungen tracked | — |
| 3.6.2 | Dependencies scannen | OK | Dependabot + npm audit Cron | — |
| 3.6.3 | Version Pinning | OK | pnpm lockfile | — |
| 3.6.4 | Alle Interaktionen verschluesselt | PARTIAL | HTTPS extern, aber intern unverschluesselt (localhost tRPC) | Intern TLS evaluieren |
| 3.6.10-21 | MCP OAuth/Token Validation | **N/A** | **Nexus nutzt kein MCP-Protokoll** — AI ist eingebettet | Standard-MCP Controls nicht anwendbar |
| 3.6.22 | Tool Permissions auf Minimum | PARTIAL | Tools haben vollen DB-Zugriff | Read-Only separation |
| 3.6.26 | **Human Approval fuer High-Risk Ops** | **TODO** | **AI kann ohne Bestaetigung Daten aendern** | **KRITISCH** |
| 3.6.30 | Input Sanitization in Tools | OK | Zod-Schemas auf allen Tool-Inputs | — |
| 3.6.33 | Parameterized DB Queries | OK | Prisma ORM | — |
| 3.6.34 | Quotas, Timeouts, Rate Limits | OK | Rate Limiting + max 8 Iterations + Tool Result Size Cap | — |
| 3.6.35 | Actions/Permissions an User anzeigen | PARTIAL | Tool-Results werden angezeigt, aber nicht vorab | Vorab-Anzeige was der AI-Agent tun wird |
| 3.6.36 | Automated Security Scanning | PARTIAL | CI/CD Tests, kein spezifisches AI-Security-Scanning | AI-spezifische Scans |
---
@@ -121,86 +121,87 @@ Bereits detailliert analysiert — siehe `acn-security-compliance-status.md`.
### 3.1 Network Security & Hardening
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| Listen nur auf noetige Interfaces | OK | Docker-Netzwerk, Port 5433 nur lokal | — |
| Firewall-Regeln | OK | Docker isolation | — |
| TLS/SSL fuer Verbindungen | **TODO** | **Kein TLS zwischen App und DB** | PostgreSQL SSL aktivieren |
| pg_hba.conf Restrictions | TODO | Docker-Default (trust im Container) | `pg_hba.conf` auf md5/scram-sha-256 |
| Control | Status | Handlungsbedarf |
| --------------------------------- | -------- | ------------------------------------ | ----------------------------------- |
| Listen nur auf noetige Interfaces | OK | Docker-Netzwerk, Port 5433 nur lokal | — |
| Firewall-Regeln | OK | Docker isolation | — |
| TLS/SSL fuer Verbindungen | **TODO** | **Kein TLS zwischen App und DB** | PostgreSQL SSL aktivieren |
| pg_hba.conf Restrictions | TODO | Docker-Default (trust im Container) | `pg_hba.conf` auf md5/scram-sha-256 |
### 3.2 Identification & Authentication
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| Starke Passwoerter | OK | `capakraken_dev` (Dev), starkes PW fuer Prod noetig | Prod-PW Policy |
| Separate DB-User fuer Apps | OK | Dedizierter `capakraken` User | — |
| Kein Default-User (postgres) | PARTIAL | App nutzt `capakraken`, aber `postgres` Superuser existiert | postgres-User einschraenken |
| Control | Status | Handlungsbedarf |
| ---------------------------- | ------- | ------------------------------------------------------ | --------------------------- |
| Starke Passwoerter | OK | `nexus_dev` (Dev), starkes PW fuer Prod noetig | Prod-PW Policy |
| Separate DB-User fuer Apps | OK | Dedizierter `nexus` User | — |
| Kein Default-User (postgres) | PARTIAL | App nutzt `nexus`, aber `postgres` Superuser existiert | postgres-User einschraenken |
### 3.3 Access Control
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| Minimal Privileges | PARTIAL | `capakraken` hat SUPERUSER | **SUPERUSER entfernen, nur noetige Grants** |
| Schema-basierte Isolation | TODO | Alles in `public` Schema | Separate Schemas fuer App-Daten vs Audit |
| Control | Status | Handlungsbedarf |
| ------------------------- | ------- | ------------------------ | ------------------------------------------- |
| Minimal Privileges | PARTIAL | `nexus` hat SUPERUSER | **SUPERUSER entfernen, nur noetige Grants** |
| Schema-basierte Isolation | TODO | Alles in `public` Schema | Separate Schemas fuer App-Daten vs Audit |
### 3.4 Encryption
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| Encryption at Rest | TODO | Docker Volume ohne Encryption | Encrypted Volume oder pgcrypto |
| Encryption in Transit | TODO | Kein TLS | PostgreSQL SSL Zertifikat |
| Control | Status | Handlungsbedarf |
| --------------------- | ------ | ----------------------------- | ------------------------------ |
| Encryption at Rest | TODO | Docker Volume ohne Encryption | Encrypted Volume oder pgcrypto |
| Encryption in Transit | TODO | Kein TLS | PostgreSQL SSL Zertifikat |
### 3.5 Login Audit
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| log_connections | TODO | Nicht konfiguriert | `log_connections = on` in postgresql.conf |
| log_disconnections | TODO | Nicht konfiguriert | `log_disconnections = on` |
| log_statement | TODO | Nicht konfiguriert | `log_statement = 'ddl'` (mindestens) |
| Control | Status | Handlungsbedarf |
| ------------------ | ------ | ------------------ | ----------------------------------------- |
| log_connections | TODO | Nicht konfiguriert | `log_connections = on` in postgresql.conf |
| log_disconnections | TODO | Nicht konfiguriert | `log_disconnections = on` |
| log_statement | TODO | Nicht konfiguriert | `log_statement = 'ddl'` (mindestens) |
### 3.6 Patch Management
| Control | Status | Handlungsbedarf |
|---------|--------|----------------|
| Aktuelle Version | OK | PostgreSQL 16 Alpine (aktuell) | — |
| Control | Status | Handlungsbedarf |
| --------------------- | ------- | ------------------------------------- | -------------------------- |
| Aktuelle Version | OK | PostgreSQL 16 Alpine (aktuell) | — |
| Regelmaessige Updates | PARTIAL | Docker Image wird selten aktualisiert | Update-Schedule definieren |
---
## Gesamtbewertung ueber alle Standards
| Standard | Controls | Compliant | Compliance % |
|----------|----------|-----------|-------------|
| Application Security V7.30 | 63 | 46 | **73%** |
| Gen AI Security V1.1 | ~45 | ~15 | **~33%** |
| Agentic AI Security V1.2 | ~50 | ~10 | **~20%** |
| PostgreSQL Security V1.6 | ~25 | ~8 | **~32%** |
| Logging & Auditing | ~15 | ~12 | **~80%** |
| Access Control | ~10 | ~8 | **~80%** |
| **GESAMT** | **~208** | **~99** | **~48%** |
| Standard | Controls | Compliant | Compliance % |
| -------------------------- | -------- | --------- | ------------ |
| Application Security V7.30 | 63 | 46 | **73%** |
| Gen AI Security V1.1 | ~45 | ~15 | **~33%** |
| Agentic AI Security V1.2 | ~50 | ~10 | **~20%** |
| PostgreSQL Security V1.6 | ~25 | ~8 | **~32%** |
| Logging & Auditing | ~15 | ~12 | **~80%** |
| Access Control | ~10 | ~8 | **~80%** |
| **GESAMT** | **~208** | **~99** | **~48%** |
---
## TOP 10 Kritische Action Items
| # | Was | Standard | Aufwand | Machbar? |
|---|-----|----------|---------|----------|
| **1** | **HITL: Human Approval fuer AI-Aktionen** (create/delete/update muessen bestaetigt werden) | EGAI 4.1.3.1, IAAI 3.6.26 | 2-3 Tage | **JA** — Confirmation-Dialog vor mutierenden Tool-Calls |
| **2** | **AI Content Labeling** ("AI Generated" Badge auf Summaries, Narratives, Cover Art) | EGAI 4.3.1.3 | 1 Tag | **JA** — UI Label auf allen AI-Outputs |
| **3** | **AI Disclaimer** im Chat-Panel | EGAI 4.3.1.4 | 2h | **JA** — Text-Banner im ChatPanel |
| **4** | **PostgreSQL TLS** aktivieren | PG 3.4 | 1 Tag | **JA** — Docker SSL-Zertifikat + `sslmode=require` |
| **5** | **PostgreSQL Audit-Logging** (log_connections, log_statement) | PG 3.5 | 2h | **JA** — postgresql.conf in Docker |
| **6** | **PostgreSQL SUPERUSER entfernen** (nur noetige Grants) | PG 3.3 | 1h | **JA** — REVOKE SUPERUSER + GRANT spezifisch |
| **7** | **Prompt Injection Detection** Middleware | EGAI 4.6.3.2 | 2-3 Tage | **JA** — Input/Output-Scanner fuer AI-Calls |
| **8** | **AI Tool Read/Write Separation** (Query-Tools ohne Schreibzugriff) | EGAI 4.1.1.2, IAAI 3.6.22 | 2 Tage | **JA** — Separate DB-Connections |
| **9** | **Adversarial Testing** Suite fuer AI | EGAI 4.1.2.2 | 3-5 Tage | **JA** — Test-Suite mit Prompt Injection Vektoren |
| **10** | **Content Filtering** auf AI-Outputs | EGAI 4.3.2.1 | 2 Tage | **JA** — Toxicity-Check Middleware |
| # | Was | Standard | Aufwand | Machbar? |
| ------ | ------------------------------------------------------------------------------------------ | ------------------------- | -------- | ------------------------------------------------------- |
| **1** | **HITL: Human Approval fuer AI-Aktionen** (create/delete/update muessen bestaetigt werden) | EGAI 4.1.3.1, IAAI 3.6.26 | 2-3 Tage | **JA** — Confirmation-Dialog vor mutierenden Tool-Calls |
| **2** | **AI Content Labeling** ("AI Generated" Badge auf Summaries, Narratives, Cover Art) | EGAI 4.3.1.3 | 1 Tag | **JA** — UI Label auf allen AI-Outputs |
| **3** | **AI Disclaimer** im Chat-Panel | EGAI 4.3.1.4 | 2h | **JA** — Text-Banner im ChatPanel |
| **4** | **PostgreSQL TLS** aktivieren | PG 3.4 | 1 Tag | **JA** — Docker SSL-Zertifikat + `sslmode=require` |
| **5** | **PostgreSQL Audit-Logging** (log_connections, log_statement) | PG 3.5 | 2h | **JA** — postgresql.conf in Docker |
| **6** | **PostgreSQL SUPERUSER entfernen** (nur noetige Grants) | PG 3.3 | 1h | **JA** — REVOKE SUPERUSER + GRANT spezifisch |
| **7** | **Prompt Injection Detection** Middleware | EGAI 4.6.3.2 | 2-3 Tage | **JA** — Input/Output-Scanner fuer AI-Calls |
| **8** | **AI Tool Read/Write Separation** (Query-Tools ohne Schreibzugriff) | EGAI 4.1.1.2, IAAI 3.6.22 | 2 Tage | **JA** — Separate DB-Connections |
| **9** | **Adversarial Testing** Suite fuer AI | EGAI 4.1.2.2 | 3-5 Tage | **JA** — Test-Suite mit Prompt Injection Vektoren |
| **10** | **Content Filtering** auf AI-Outputs | EGAI 4.3.2.1 | 2 Tage | **JA** — Toxicity-Check Middleware |
---
## Empfehlung: Naechste Schritte
### Woche 1: Quick Wins (5 Items, ~2 Tage)
- AI Disclaimer im Chat (#3)
- AI Content Labeling (#2)
- PostgreSQL Audit-Logging (#5)
@@ -208,15 +209,18 @@ Bereits detailliert analysiert — siehe `acn-security-compliance-status.md`.
- Datenklassifizierung durchfuehren
### Woche 2-3: Kern-Sicherheit (3 Items, ~5 Tage)
- HITL fuer AI-Aktionen (#1)
- PostgreSQL TLS (#4)
- AI Tool Read/Write Separation (#8)
### Woche 4-6: Erweiterte AI-Sicherheit (2 Items, ~5 Tage)
- Prompt Injection Detection (#7)
- Adversarial Testing Suite (#9)
### Monat 2+: Vertiefung
- Content Filtering (#10)
- Verbleibende Gen AI + Agentic AI Controls
- Formale Security Assessments
docs/acn-security-compliance-status.md
+136 -135
View File
@@ -1,4 +1,5 @@
# CapaKraken — Accenture Application Security Standard V7.30
# Nexus — Accenture Application Security Standard V7.30
## Vollstaendiger Compliance Status Report
**Stand:** 2026-03-27 | **Standard:** V 7.30 (13.02.2026)
@@ -7,229 +8,229 @@
## Zusammenfassung
| Status | Anzahl | Prozent |
|--------|--------|---------|
| **OK** (Compliant) | 46 | 73% |
| **PARTIAL** (Teilweise) | 5 | 8% |
| **TODO** (Offen) | 8 | 13% |
| **N/A** (Nicht anwendbar) | 4 | 6% |
| **Gesamt** | **63** | |
| Status | Anzahl | Prozent |
| ------------------------- | ------ | ------- |
| **OK** (Compliant) | 46 | 73% |
| **PARTIAL** (Teilweise) | 5 | 8% |
| **TODO** (Offen) | 8 | 13% |
| **N/A** (Nicht anwendbar) | 4 | 6% |
| **Gesamt** | **63** | |
---
## 3.1 Governance (2 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.1.1.01 | App in AIR registriert | TODO | Noch nicht registriert — braucht Accenture AIR Portal |
| 3.1.1.02 | Komponenten trackbar | OK | Git-basiertes Monorepo, alle Packages versioniert |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ---------------------- | ------ | ----------------------------------------------------- |
| 3.1.1.01 | App in AIR registriert | TODO | Noch nicht registriert — braucht Accenture AIR Portal |
| 3.1.1.02 | Komponenten trackbar | OK | Git-basiertes Monorepo, alle Packages versioniert |
## 3.2.1 Application Architecture (4 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.1.01 | Security Architecture Document | OK | `docs/security-architecture.md` (11 Sektionen) |
| 3.2.1.02 | Firewall/Segregation | OK | PostgreSQL nur intern, nginx Reverse Proxy |
| 3.2.1.03 | Kein direkter DB-Internet-Zugang | OK | PostgreSQL nur ueber Docker-Netzwerk (Port 5433 lokal) |
| 3.2.1.04 | Proaktives Monitoring | OK | Health-Endpoints + `/api/cron/health-check` (DB+Redis Check mit ADMIN-Alert bei Failure) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | -------------------------------- | ------ | ---------------------------------------------------------------------------------------- |
| 3.2.1.01 | Security Architecture Document | OK | `docs/security-architecture.md` (11 Sektionen) |
| 3.2.1.02 | Firewall/Segregation | OK | PostgreSQL nur intern, nginx Reverse Proxy |
| 3.2.1.03 | Kein direkter DB-Internet-Zugang | OK | PostgreSQL nur ueber Docker-Netzwerk (Port 5433 lokal) |
| 3.2.1.04 | Proaktives Monitoring | OK | Health-Endpoints + `/api/cron/health-check` (DB+Redis Check mit ADMIN-Alert bei Failure) |
## 3.2.2.1 Identity and Access Management (5 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.1.01 | Identification & Authentication Standard | OK | Auth.js v5 + Argon2 Hashing + TOTP MFA |
| 3.2.2.1.02 | OAuth v2.0 fuer APIs | N/A | Interne App, kein oeffentliches API — tRPC mit Server-Sessions |
| 3.2.2.1.03 | Token Validity Periods | OK | Session maxAge=8h, updateAge=30min (idle) |
| 3.2.2.1.04 | Immutable Claims | OK | Server-side Sessions, keine Client-JWT |
| 3.2.2.1.05 | ADAL zu MSAL Migration | N/A | Keine Microsoft-Auth-Library im Einsatz |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ---------------------------------------- | ------ | -------------------------------------------------------------- |
| 3.2.2.1.01 | Identification & Authentication Standard | OK | Auth.js v5 + Argon2 Hashing + TOTP MFA |
| 3.2.2.1.02 | OAuth v2.0 fuer APIs | N/A | Interne App, kein oeffentliches API — tRPC mit Server-Sessions |
| 3.2.2.1.03 | Token Validity Periods | OK | Session maxAge=8h, updateAge=30min (idle) |
| 3.2.2.1.04 | Immutable Claims | OK | Server-side Sessions, keine Client-JWT |
| 3.2.2.1.05 | ADAL zu MSAL Migration | N/A | Keine Microsoft-Auth-Library im Einsatz |
## 3.2.2.2 Multi-Factor Authentication (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.2.01 | MFA implementiert | OK | TOTP via `otpauth`, QR-Setup, Sign-in Integration |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ----------------- | ------ | ------------------------------------------------- |
| 3.2.2.2.01 | MFA implementiert | OK | TOTP via `otpauth`, QR-Setup, Sign-in Integration |
## 3.2.2.3 Input & Output Validation (14 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.3.01 | Input Validation Controls | OK | Zod-Schemas auf allen tRPC-Procedures |
| 3.2.2.3.02 | Passwort-Felder maskiert | OK | `type="password"` durchgehend |
| 3.2.2.3.03 | Laengen-Validierung | OK | Zod `.min()` / `.max()` auf relevanten Feldern |
| 3.2.2.3.04 | Numerische Bereichs-Validierung | OK | Zod `.min()` / `.max()` auf Number-Feldern |
| 3.2.2.3.05 | Malicious Characters ablehnen | OK | DOMPurify auf User-Text, Zod-Typ-Validierung |
| 3.2.2.3.06 | Parameterized SQL | OK | Prisma ORM — alle Queries parameterized |
| 3.2.2.3.07 | Admin-Dashboard Input ausnahme | OK | Admin-Procedures hinter `adminProcedure` RBAC |
| 3.2.2.3.08 | App hinter Company Firewall | PARTIAL | nginx Reverse Proxy, kein VPN-only Zugang |
| 3.2.2.3.09 | ESO/MFA integriert | OK | TOTP MFA implementiert (kein ESO, aber eigene MFA) |
| 3.2.2.3.10 | Internal Company Use only | OK | Nur interne Nutzer mit Accounts |
| 3.2.2.3.11 | Admin-Zugang beschraenkt | OK | RBAC: adminProcedure, separate Admin-Seiten |
| 3.2.2.3.12 | Logging fuer unauthorisierten Zugang | OK | Failed Auth Logging via Pino + Audit-Entries |
| 3.2.2.3.13 | HTTP Security Headers | OK | HSTS, CSP, X-Frame-Options, X-Content-Type-Options |
| 3.2.2.3.14 | Predefined Assessments | TODO | Kein formaler Security Assessment durchgefuehrt |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------------------------ | ------- | -------------------------------------------------- |
| 3.2.2.3.01 | Input Validation Controls | OK | Zod-Schemas auf allen tRPC-Procedures |
| 3.2.2.3.02 | Passwort-Felder maskiert | OK | `type="password"` durchgehend |
| 3.2.2.3.03 | Laengen-Validierung | OK | Zod `.min()` / `.max()` auf relevanten Feldern |
| 3.2.2.3.04 | Numerische Bereichs-Validierung | OK | Zod `.min()` / `.max()` auf Number-Feldern |
| 3.2.2.3.05 | Malicious Characters ablehnen | OK | DOMPurify auf User-Text, Zod-Typ-Validierung |
| 3.2.2.3.06 | Parameterized SQL | OK | Prisma ORM — alle Queries parameterized |
| 3.2.2.3.07 | Admin-Dashboard Input ausnahme | OK | Admin-Procedures hinter `adminProcedure` RBAC |
| 3.2.2.3.08 | App hinter Company Firewall | PARTIAL | nginx Reverse Proxy, kein VPN-only Zugang |
| 3.2.2.3.09 | ESO/MFA integriert | OK | TOTP MFA implementiert (kein ESO, aber eigene MFA) |
| 3.2.2.3.10 | Internal Company Use only | OK | Nur interne Nutzer mit Accounts |
| 3.2.2.3.11 | Admin-Zugang beschraenkt | OK | RBAC: adminProcedure, separate Admin-Seiten |
| 3.2.2.3.12 | Logging fuer unauthorisierten Zugang | OK | Failed Auth Logging via Pino + Audit-Entries |
| 3.2.2.3.13 | HTTP Security Headers | OK | HSTS, CSP, X-Frame-Options, X-Content-Type-Options |
| 3.2.2.3.14 | Predefined Assessments | TODO | Kein formaler Security Assessment durchgefuehrt |
## 3.2.2.4 Session Management (5 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.4.01 | Unpredictable Session IDs + Timeout | OK | Auth.js crypto Sessions, 8h/30min Timeouts |
| 3.2.2.4.02 | Concurrent Sessions limitiert | OK | Max 3 per User, aelteste wird gekickt |
| 3.2.2.4.03 | Session Management Best Practices | OK | HttpOnly, Secure, SameSite=Strict Cookies |
| 3.2.2.4.04 | Nur server-issued Session IDs | OK | Auth.js server-side Sessions |
| 3.2.2.4.05 | Idle Timeout konfigurierbar (SaaS) | OK | SystemSettings: sessionIdleTimeout (Default 30min) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ----------------------------------- | ------ | -------------------------------------------------- |
| 3.2.2.4.01 | Unpredictable Session IDs + Timeout | OK | Auth.js crypto Sessions, 8h/30min Timeouts |
| 3.2.2.4.02 | Concurrent Sessions limitiert | OK | Max 3 per User, aelteste wird gekickt |
| 3.2.2.4.03 | Session Management Best Practices | OK | HttpOnly, Secure, SameSite=Strict Cookies |
| 3.2.2.4.04 | Nur server-issued Session IDs | OK | Auth.js server-side Sessions |
| 3.2.2.4.05 | Idle Timeout konfigurierbar (SaaS) | OK | SystemSettings: sessionIdleTimeout (Default 30min) |
## 3.2.2.5 Insecure File Upload (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.5.01 | Sichere File-Upload Validierung | OK | Magic Bytes Check (PNG/JPEG/WebP/GIF/BMP/TIFF), Groessen-Limit |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------------------- | ------ | -------------------------------------------------------------- |
| 3.2.2.5.01 | Sichere File-Upload Validierung | OK | Magic Bytes Check (PNG/JPEG/WebP/GIF/BMP/TIFF), Groessen-Limit |
## 3.2.2.6 Error Handling (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.6.01 | Keine tech. Fehlerdetails an User | OK | tRPC Error-Codes, Stack nur in Dev, Sentry fuer Prod |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | --------------------------------- | ------ | ---------------------------------------------------- |
| 3.2.2.6.01 | Keine tech. Fehlerdetails an User | OK | tRPC Error-Codes, Stack nur in Dev, Sentry fuer Prod |
## 3.2.2.7 Security Assessments (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ---------------------------- | ------- | --------------------------------------------------------------------------------------- |
| 3.2.2.7.01 | Regelmaessige Security Scans | PARTIAL | Dependabot + npm audit in CI + `/api/cron/security-audit` (in-app), kein SAST/DAST Tool |
## 3.2.2.8 Other Controls (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.2.8.01 | Secure Development Lifecycle | OK | `docs/sdlc.md`, CI/CD Pipeline, PR Security Checklist |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ---------------------------- | ------ | ----------------------------------------------------- |
| 3.2.2.8.01 | Secure Development Lifecycle | OK | `docs/sdlc.md`, CI/CD Pipeline, PR Security Checklist |
## 3.2.3 Data Protection (3 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.3.01 | Autocomplete off fuer Passwoerter | OK | `autocomplete="new-password"` auf allen Passwort-Feldern |
| 3.2.3.02 | Source-Code nur Dev-Team | OK | Gitea mit Authentifizierung |
| 3.2.3.03 | Keine Prod-Daten in Non-Prod | OK | Fiktive Seed-Daten (Marvel Characters) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | --------------------------------- | ------ | -------------------------------------------------------- |
| 3.2.3.01 | Autocomplete off fuer Passwoerter | OK | `autocomplete="new-password"` auf allen Passwort-Feldern |
| 3.2.3.02 | Source-Code nur Dev-Team | OK | Gitea mit Authentifizierung |
| 3.2.3.03 | Keine Prod-Daten in Non-Prod | OK | Fiktive Seed-Daten (Marvel Characters) |
## 3.2.4 Change Management (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.4.01 | Change Management Prozess | OK | Git PRs + CI + Activity History Audit Trail |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ------------------------- | ------ | ------------------------------------------- |
| 3.2.4.01 | Change Management Prozess | OK | Git PRs + CI + Activity History Audit Trail |
## 3.2.5 Legal (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.5.01 | License Compliance | OK | Open-Source Lizenzen (MIT, Apache) via pnpm |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ------------------ | ------ | ------------------------------------------- |
| 3.2.5.01 | License Compliance | OK | Open-Source Lizenzen (MIT, Apache) via pnpm |
## 3.2.6 Code Signing (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.6.01 | Executable Code Signing | N/A | Web-App, keine distributable Executables |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ----------------------- | ------ | ---------------------------------------- |
| 3.2.6.01 | Executable Code Signing | N/A | Web-App, keine distributable Executables |
## 3.2.7 Logging and Auditing (3 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.2.7.01 | Application Event Logging | OK | Auth failures, config changes, API errors, high-risk ops, ext. API calls |
| 3.2.7.02 | Job Scheduler Monitoring | N/A | Kein Job Scheduler (Cron-Endpoints manuell aufrufbar) |
| 3.2.7.03 | Access Logs + Review | OK | Pino structured logging + Activity History Admin-UI |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ------------------------- | ------ | ------------------------------------------------------------------------ |
| 3.2.7.01 | Application Event Logging | OK | Auth failures, config changes, API errors, high-risk ops, ext. API calls |
| 3.2.7.02 | Job Scheduler Monitoring | N/A | Kein Job Scheduler (Cron-Endpoints manuell aufrufbar) |
| 3.2.7.03 | Access Logs + Review | OK | Pino structured logging + Activity History Admin-UI |
## 3.3.1.1 Web Authentication (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.1.01 | Web Auth Standard | OK | Auth.js + Argon2 + TOTP MFA |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ----------------- | ------ | --------------------------- |
| 3.3.1.1.01 | Web Auth Standard | OK | Auth.js + Argon2 + TOTP MFA |
## 3.3.1.2 Web Input Validation (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.2.01 | XSS/Injection-frei | OK | DOMPurify + Zod + Prisma (kein Raw-SQL/HTML) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------ | ------ | -------------------------------------------- |
| 3.3.1.2.01 | XSS/Injection-frei | OK | DOMPurify + Zod + Prisma (kein Raw-SQL/HTML) |
## 3.3.1.3 HTTP Response Headers (5 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.3.01 | Security Headers definiert | OK | HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| 3.3.1.3.02 | CORS Headers | OK | Next.js default CORS (same-origin) |
| 3.3.1.3.03 | Error-Page Headers | OK | Cache-Control no-store auf allen Routen (auth, API, catch-all) via next.config.ts |
| 3.3.1.3.04 | Server Header entfernen | TODO | nginx zeigt noch Server-Version (braucht Server-Zugang) |
| 3.3.1.3.05 | X-Powered-By entfernen | OK | Next.js entfernt automatisch |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | -------------------------- | ------ | --------------------------------------------------------------------------------------- |
| 3.3.1.3.01 | Security Headers definiert | OK | HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| 3.3.1.3.02 | CORS Headers | OK | Next.js default CORS (same-origin) |
| 3.3.1.3.03 | Error-Page Headers | OK | Cache-Control no-store auf allen Routen (auth, API, catch-all) via next.config.ts |
| 3.3.1.3.04 | Server Header entfernen | TODO | nginx zeigt noch Server-Version (braucht Server-Zugang) |
| 3.3.1.3.05 | X-Powered-By entfernen | OK | Next.js entfernt automatisch |
## 3.3.1.4 Web Server Hardening (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.4.01 | Server Hardening | OK | Next.js Standalone + nginx Hardening Template (`docs/nginx-hardening.conf`: rate limits, SSL, header stripping) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ---------------- | ------ | --------------------------------------------------------------------------------------------------------------- |
| 3.3.1.4.01 | Server Hardening | OK | Next.js Standalone + nginx Hardening Template (`docs/nginx-hardening.conf`: rate limits, SSL, header stripping) |
## 3.3.1.5 HTTP Methods (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.5.01 | Nur erlaubte HTTP Methods | OK | tRPC nutzt nur GET/POST, andere Methods nicht exponiert |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------------- | ------ | ------------------------------------------------------- |
| 3.3.1.5.01 | Nur erlaubte HTTP Methods | OK | tRPC nutzt nur GET/POST, andere Methods nicht exponiert |
## 3.3.1.6 Cookies (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.6.01 | Sichere Cookie-Attribute | OK | HttpOnly, Secure (Prod), SameSite=Strict |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------------ | ------ | ---------------------------------------- |
| 3.3.1.6.01 | Sichere Cookie-Attribute | OK | HttpOnly, Secure (Prod), SameSite=Strict |
## 3.3.1.7 Browser Cache Protection (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.7.01 | Sensitive Seiten nicht cachen | OK | Auth-Seiten: `Cache-Control: no-store` |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ----------------------------- | ------ | -------------------------------------- |
| 3.3.1.7.01 | Sensitive Seiten nicht cachen | OK | Auth-Seiten: `Cache-Control: no-store` |
## 3.3.1.8 Sensitive Information Protection (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.8.01 | Sensitive Daten schuetzen | OK | API Keys/Passwoerter nie an Client, Audit-Log sanitized |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ------------------------- | ------ | ------------------------------------------------------- |
| 3.3.1.8.01 | Sensitive Daten schuetzen | OK | API Keys/Passwoerter nie an Client, Audit-Log sanitized |
## 3.3.1.9 Common Exploits Protection (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.9.01 | CSRF/Clickjacking/etc. Schutz | OK | SameSite=Strict, X-Frame-Options: DENY, CSRF Token (Auth.js) |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ---------- | ----------------------------- | ------ | ------------------------------------------------------------ |
| 3.3.1.9.01 | CSRF/Clickjacking/etc. Schutz | OK | SameSite=Strict, X-Frame-Options: DENY, CSRF Token (Auth.js) |
## 3.3.1.10 Web Error Handling (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.10.01 | Custom Error Pages | OK | Next.js global-error.tsx + tRPC Error-Codes |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ----------- | ------------------ | ------ | ------------------------------------------- |
| 3.3.1.10.01 | Custom Error Pages | OK | Next.js global-error.tsx + tRPC Error-Codes |
## 3.3.1.11 SOAP Security (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.11.01 | SOAP Security | N/A | Kein SOAP — nur tRPC/REST |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ----------- | ------------- | ------ | ------------------------- |
| 3.3.1.11.01 | SOAP Security | N/A | Kein SOAP — nur tRPC/REST |
## 3.3.1.12 API Management (2 Controls)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.1.12.01 | API Security Controls | OK | Auth auf allen Endpoints, Zod Validation, Rate Limiting |
| 3.3.1.12.02 | API Rate Limiting | OK | 100/15min allgemein, 5/15min Auth |
| EAPPS # | Control | Status | Nachweis/Luecke |
| ----------- | --------------------- | ------ | ------------------------------------------------------- |
| 3.3.1.12.01 | API Security Controls | OK | Auth auf allen Endpoints, Zod Validation, Rate Limiting |
| 3.3.1.12.02 | API Rate Limiting | OK | 100/15min allgemein, 5/15min Auth |
## 3.3.3 Databases (1 Control)
| EAPPS # | Control | Status | Nachweis/Luecke |
|---------|---------|--------|----------------|
| 3.3.3.01 | DB Security Guidelines | OK | Dokumentiert in `docs/security-architecture.md` Sek. 12: Auth, Network Isolation, SSL/Audit/pg_hba Empfehlungen |
| EAPPS # | Control | Status | Nachweis/Luecke |
| -------- | ---------------------- | ------ | --------------------------------------------------------------------------------------------------------------- |
| 3.3.3.01 | DB Security Guidelines | OK | Dokumentiert in `docs/security-architecture.md` Sek. 12: Auth, Network Isolation, SSL/Audit/pg_hba Empfehlungen |
---
## Offene Items — Wer/Was/Wann
| # | Control | Status | Verantwortlich | Aufwand | Prioritaet |
|---|---------|--------|---------------|---------|-----------|
| 1 | AIR Registration | TODO | Projektleiter | 2h | HOCH |
| 2 | Security Assessment/Pentest | TODO | Security Team | 3-5 Tage | HOCH |
| 3 | SAST/DAST Tool (SonarQube/Snyk) | TODO | DevOps | 2-3 Tage | HOCH |
| 4 | nginx Server-Header entfernen | TODO | Ops/Infra | 15min | MITTEL |
| 5 | ~~Externes Uptime-Monitoring~~ | ~~OK~~ | ~~DevOps~~ | — | ERLEDIGT — `/api/cron/health-check` |
| 6 | ~~nginx Hardening vervollstaendigen~~ | ~~OK~~ | ~~Ops/Infra~~ | — | ERLEDIGT — `docs/nginx-hardening.conf` Template |
| 7 | ~~DB-Level Audit Logging~~ | ~~OK~~ | ~~DBA/DevOps~~ | — | ERLEDIGT — Dokumentiert in `security-architecture.md` Sek. 12 |
| 8 | ~~Error-Page Headers (3xx/4xx/5xx)~~ | ~~OK~~ | ~~Entwickler~~ | — | ERLEDIGT — `next.config.ts` Cache-Control auf allen Routen |
| # | Control | Status | Verantwortlich | Aufwand | Prioritaet |
| --- | ------------------------------------- | ------ | -------------- | -------- | ------------------------------------------------------------- |
| 1 | AIR Registration | TODO | Projektleiter | 2h | HOCH |
| 2 | Security Assessment/Pentest | TODO | Security Team | 3-5 Tage | HOCH |
| 3 | SAST/DAST Tool (SonarQube/Snyk) | TODO | DevOps | 2-3 Tage | HOCH |
| 4 | nginx Server-Header entfernen | TODO | Ops/Infra | 15min | MITTEL |
| 5 | ~~Externes Uptime-Monitoring~~ | ~~OK~~ | ~~DevOps~~ | — | ERLEDIGT — `/api/cron/health-check` |
| 6 | ~~nginx Hardening vervollstaendigen~~ | ~~OK~~ | ~~Ops/Infra~~ | — | ERLEDIGT — `docs/nginx-hardening.conf` Template |
| 7 | ~~DB-Level Audit Logging~~ | ~~OK~~ | ~~DBA/DevOps~~ | — | ERLEDIGT — Dokumentiert in `security-architecture.md` Sek. 12 |
| 8 | ~~Error-Page Headers (3xx/4xx/5xx)~~ | ~~OK~~ | ~~Entwickler~~ | — | ERLEDIGT — `next.config.ts` Cache-Control auf allen Routen |
docs/acn-security-compliance-todo.md
+94 -94
View File
@@ -1,7 +1,7 @@
# Accenture Application Security Standard V7.30 — Compliance ToDo
> Basierend auf: Application Security Standard V 7.30, Effective Date: February 13, 2026
> Analysiert gegen: CapaKraken (Stand: 2026-03-27)
> Analysiert gegen: Nexus (Stand: 2026-03-27)
---
@@ -16,166 +16,166 @@
## 3.1 Governance
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| EAPPS.3.1.1 | App muss im AIR (Application Information Repository) registriert sein | TODO | Nicht registriert | AIR-ID beantragen |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ----------- | --------------------------------------------------------------------- | ------ | ----------------- | ----------------- |
| EAPPS.3.1.1 | App muss im AIR (Application Information Repository) registriert sein | TODO | Nicht registriert | AIR-ID beantragen |
---
## 3.2.1 Application Architecture
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.1.01 | Architectural document muss vorhanden sein | PARTIAL | CLAUDE.md + docs/ vorhanden, kein formelles Security Architecture Doc | Formelles Security Architecture Document erstellen |
| 3.2.1.03 | Kein direkter Internet-Zugang zu Datenbanken | OK | PostgreSQL nur ueber Docker-Netzwerk, nicht extern exponiert | — |
| 3.2.1.04 | Proaktives Monitoring bei business-kritischen Systemen | PARTIAL | Health-Endpoints vorhanden, kein externes Monitoring | Uptime-Monitoring einrichten (UptimeRobot o.ae.) |
| # | Anforderung | Status | Nexus Stand | ToDo |
| -------- | ------------------------------------------------------ | ------- | --------------------------------------------------------------------- | -------------------------------------------------- |
| 3.2.1.01 | Architectural document muss vorhanden sein | PARTIAL | CLAUDE.md + docs/ vorhanden, kein formelles Security Architecture Doc | Formelles Security Architecture Document erstellen |
| 3.2.1.03 | Kein direkter Internet-Zugang zu Datenbanken | OK | PostgreSQL nur ueber Docker-Netzwerk, nicht extern exponiert | — |
| 3.2.1.04 | Proaktives Monitoring bei business-kritischen Systemen | PARTIAL | Health-Endpoints vorhanden, kein externes Monitoring | Uptime-Monitoring einrichten (UptimeRobot o.ae.) |
---
## 3.2.2.1 Identity and Access Management
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.2.1.01 | Compliant mit Identification and Authentication Standard | PARTIAL | Auth.js v5 mit Argon2 Passwort-Hashing, RBAC vorhanden | ESO/ADFS Integration pruefen (aktuell eigene Auth) |
| 3.2.2.1.02 | OAuth v2.0 fuer APIs/Services | TODO | Kein OAuth — tRPC mit Session-basierter Auth | OAuth 2.0 oder JWT-basierte API Auth evaluieren |
| 3.2.2.1.03 | Token Validity: Access Token max 1h, Refresh Token max 24h | PARTIAL | Auth.js Session-basiert, kein Token-Expiry konfiguriert | Session-Timeout konfigurieren (idle + absolute) |
| 3.2.2.1.04 | Nur immutable Claims in Tokens | OK | Auth.js nutzt server-side Sessions, keine JWT-Claims | — |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ---------- | ---------------------------------------------------------- | ------- | ------------------------------------------------------- | -------------------------------------------------- |
| 3.2.2.1.01 | Compliant mit Identification and Authentication Standard | PARTIAL | Auth.js v5 mit Argon2 Passwort-Hashing, RBAC vorhanden | ESO/ADFS Integration pruefen (aktuell eigene Auth) |
| 3.2.2.1.02 | OAuth v2.0 fuer APIs/Services | TODO | Kein OAuth — tRPC mit Session-basierter Auth | OAuth 2.0 oder JWT-basierte API Auth evaluieren |
| 3.2.2.1.03 | Token Validity: Access Token max 1h, Refresh Token max 24h | PARTIAL | Auth.js Session-basiert, kein Token-Expiry konfiguriert | Session-Timeout konfigurieren (idle + absolute) |
| 3.2.2.1.04 | Nur immutable Claims in Tokens | OK | Auth.js nutzt server-side Sessions, keine JWT-Claims | — |
---
## 3.2.2.2 Multi-Factor Authentication (MFA)
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.2.2 | MFA muss implementiert sein | TODO | Keine MFA — nur Email+Passwort | MFA via TOTP oder WebAuthn implementieren, oder ESO-Integration |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------- | --------------------------- | ------ | ------------------------------ | --------------------------------------------------------------- |
| 3.2.2.2 | MFA muss implementiert sein | TODO | Keine MFA — nur Email+Passwort | MFA via TOTP oder WebAuthn implementieren, oder ESO-Integration |
---
## 3.2.2.3 Input & Output Validation
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.2.3.01 | Input Validation Controls | OK | Zod-Schemas auf allen tRPC-Inputs, TypeScript strict mode | — |
| 3.2.2.3.02 | Passwort-Felder muessen maskiert sein | OK | `type="password"` auf allen Passwort-Inputs | — |
| 3.2.2.3.03 | Laengen-Validierung auf Input-Parametern | OK | Zod `.min()` / `.max()` auf relevanten Feldern | — |
| 3.2.2.3.04 | Numerische Werte Bereichs-Validierung | OK | Zod `.min()` / `.max()` auf Number-Feldern | — |
| 3.2.2.3.05 | Malicious Characters ablehnen/sanitizen | PARTIAL | Zod validiert Typen, kein explizites XSS-Sanitizing | DOMPurify oder aehnliches fuer User-generierte Texte (Kommentare, Descriptions) |
| 3.2.2.3.06 | Parameterized SQL (kein SQL Injection) | OK | Prisma ORM — alle Queries sind parameterized | — |
| 3.2.2.3.13 | HTTP Security Headers auf gesamter Seite | PARTIAL | Einige Headers via next.config.ts, nicht vollstaendig | Siehe HTTP Headers Sektion unten |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ---------- | ---------------------------------------- | ------- | --------------------------------------------------------- | ------------------------------------------------------------------------------- |
| 3.2.2.3.01 | Input Validation Controls | OK | Zod-Schemas auf allen tRPC-Inputs, TypeScript strict mode | — |
| 3.2.2.3.02 | Passwort-Felder muessen maskiert sein | OK | `type="password"` auf allen Passwort-Inputs | — |
| 3.2.2.3.03 | Laengen-Validierung auf Input-Parametern | OK | Zod `.min()` / `.max()` auf relevanten Feldern | — |
| 3.2.2.3.04 | Numerische Werte Bereichs-Validierung | OK | Zod `.min()` / `.max()` auf Number-Feldern | — |
| 3.2.2.3.05 | Malicious Characters ablehnen/sanitizen | PARTIAL | Zod validiert Typen, kein explizites XSS-Sanitizing | DOMPurify oder aehnliches fuer User-generierte Texte (Kommentare, Descriptions) |
| 3.2.2.3.06 | Parameterized SQL (kein SQL Injection) | OK | Prisma ORM — alle Queries sind parameterized | — |
| 3.2.2.3.13 | HTTP Security Headers auf gesamter Seite | PARTIAL | Einige Headers via next.config.ts, nicht vollstaendig | Siehe HTTP Headers Sektion unten |
---
## 3.2.2.4 Session Management
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| # | Anforderung | Status | Nexus Stand | ToDo |
| ---------- | --------------------------------------------------------------- | ------- | -------------------------------------------------------------- | -------------------------------------------------------------------- |
| 3.2.2.4.01 | Session IDs muessen unpredictable sein, terminiert nach Timeout | PARTIAL | Auth.js generiert sichere Session-IDs, kein expliziter Timeout | Session Idle Timeout (30min) und Absolute Timeout (8h) konfigurieren |
| 3.2.2.4.02 | Concurrent Sessions limitieren fuer High-Impact Systeme | TODO | Keine Session-Limitierung | Max 3 concurrent Sessions pro User implementieren |
| 3.2.2.4.04 | Nur server-issued Session-IDs verwenden | OK | Auth.js server-side Sessions | — |
| 3.2.2.4.05 | Idle Timeout konfigurierbar (SaaS) | TODO | Kein konfigurierbarer Timeout | Idle Timeout in SystemSettings aufnehmen |
| 3.2.2.4.02 | Concurrent Sessions limitieren fuer High-Impact Systeme | TODO | Keine Session-Limitierung | Max 3 concurrent Sessions pro User implementieren |
| 3.2.2.4.04 | Nur server-issued Session-IDs verwenden | OK | Auth.js server-side Sessions | — |
| 3.2.2.4.05 | Idle Timeout konfigurierbar (SaaS) | TODO | Kein konfigurierbarer Timeout | Idle Timeout in SystemSettings aufnehmen |
---
## 3.2.2.5 Insecure File Upload
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------- | ------------------------------- | ------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| 3.2.2.5 | Sichere File-Upload Validierung | PARTIAL | Cover-Art Upload validiert Dateityp + Groesse, XLSX Import parst sicher | File-Type Validation verstaerken (Magic Bytes pruefen, nicht nur Extension) |
---
## 3.2.2.6 Error Handling
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------- | --------------------------------------- | ------- | ------------------------------------------------------ | --------------------------------------------------------------- |
| 3.2.2.6 | Keine technischen Fehlerdetails an User | PARTIAL | tRPC gibt Error-Codes zurueck, Stack Traces nur in Dev | Sentry fuer Production error capturing (installiert, DSN fehlt) |
---
## 3.2.2.7 Application Security Assessments
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.2.7 | Regelmaessige Security Scans | TODO | Kein SAST/DAST, kein Pen-Test | npm audit in CI (Dependabot vorhanden), SAST-Tool evaluieren (SonarQube, Snyk) |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------- | ---------------------------- | ------ | ----------------------------- | ------------------------------------------------------------------------------ |
| 3.2.2.7 | Regelmaessige Security Scans | TODO | Kein SAST/DAST, kein Pen-Test | npm audit in CI (Dependabot vorhanden), SAST-Tool evaluieren (SonarQube, Snyk) |
---
## 3.2.2.8 Other Additional Controls
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------- | ---------------------------- | ------- | ------------------------------------------------------ | ------------------------------------------------------------------- |
| 3.2.2.8 | Secure Development Lifecycle | PARTIAL | CI/CD vorhanden, Code Review via PR, TypeScript strict | Formales SDLC-Dokument erstellen, Security Checklist in PR-Template |
---
## 3.2.3 Data Protection
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.3.01 | Autocomplete=off fuer Passwort-Felder | TODO | Nicht explizit gesetzt | `autocomplete="off"` oder `autocomplete="new-password"` auf Passwort-Feldern |
| 3.2.3.02 | Source-Code Zugang nur fuer Dev-Team | OK | Gitea mit User-Authentifizierung | — |
| 3.2.3.03 | Keine Produktionsdaten in Non-Prod | OK | Seed-Daten sind fiktiv (Marvel-Characters) | — |
| # | Anforderung | Status | Nexus Stand | ToDo |
| -------- | ------------------------------------- | ------ | ------------------------------------------ | ---------------------------------------------------------------------------- |
| 3.2.3.01 | Autocomplete=off fuer Passwort-Felder | TODO | Nicht explizit gesetzt | `autocomplete="off"` oder `autocomplete="new-password"` auf Passwort-Feldern |
| 3.2.3.02 | Source-Code Zugang nur fuer Dev-Team | OK | Gitea mit User-Authentifizierung | — |
| 3.2.3.03 | Keine Produktionsdaten in Non-Prod | OK | Seed-Daten sind fiktiv (Marvel-Characters) | — |
---
## 3.2.4 Change Management
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| # | Anforderung | Status | Nexus Stand | ToDo |
| ----- | ------------------------- | ------- | ------------------------------------------------------ | ---------------------------------------------- |
| 3.2.4 | Change Management Prozess | PARTIAL | Git-basiert mit PRs und CI, Activity History vorhanden | Formalen Change-Approval-Prozess dokumentieren |
---
## 3.2.7 Logging and Auditing
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| 3.2.7.01 | Authorization/Access Failures loggen | PARTIAL | RBAC Fehler werden als tRPC FORBIDDEN zurueckgegeben, nicht explizit geloggt | Failed Auth Attempts in Audit-Log aufnehmen |
| 3.2.7.01 | Input Validation Failures loggen | TODO | Zod-Errors werden an Client zurueckgegeben, nicht geloggt | Validation Failures an Pino Logger weiterleiten |
| 3.2.7.01 | Application Errors loggen | OK | Pino Structured Logging auf allen tRPC-Procedures | — |
| 3.2.7.01 | Config Changes loggen | OK | Activity History System audited 29/36 Router | — |
| 3.2.7.01 | High-Risk Functionality (User-Mgmt) loggen | OK | User Create/Delete/SetPassword/SetPermissions audited | — |
| 3.2.7.01 | API/Third-Party Access loggen | PARTIAL | AI-Aufrufe (OpenAI, Gemini) nicht explizit geloggt | API-Calls an externe Services loggen |
| 3.2.7.03 | Access Logs fuer alle User inkl. Vendor | PARTIAL | Audit-Log vorhanden, kein Login-Log | Login/Logout Events loggen |
| # | Anforderung | Status | Nexus Stand | ToDo |
| -------- | ------------------------------------------ | ------- | ---------------------------------------------------------------------------- | ----------------------------------------------- |
| 3.2.7.01 | Authorization/Access Failures loggen | PARTIAL | RBAC Fehler werden als tRPC FORBIDDEN zurueckgegeben, nicht explizit geloggt | Failed Auth Attempts in Audit-Log aufnehmen |
| 3.2.7.01 | Input Validation Failures loggen | TODO | Zod-Errors werden an Client zurueckgegeben, nicht geloggt | Validation Failures an Pino Logger weiterleiten |
| 3.2.7.01 | Application Errors loggen | OK | Pino Structured Logging auf allen tRPC-Procedures | — |
| 3.2.7.01 | Config Changes loggen | OK | Activity History System audited 29/36 Router | — |
| 3.2.7.01 | High-Risk Functionality (User-Mgmt) loggen | OK | User Create/Delete/SetPassword/SetPermissions audited | — |
| 3.2.7.01 | API/Third-Party Access loggen | PARTIAL | AI-Aufrufe (OpenAI, Gemini) nicht explizit geloggt | API-Calls an externe Services loggen |
| 3.2.7.03 | Access Logs fuer alle User inkl. Vendor | PARTIAL | Audit-Log vorhanden, kein Login-Log | Login/Logout Events loggen |
---
## 3.3.1.3 HTTP Response Headers
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| X-Frame-Options: DENY | OK | In next.config.ts gesetzt | — |
| X-Content-Type-Options: nosniff | OK | In next.config.ts gesetzt | — |
| Referrer-Policy: strict-origin-when-cross-origin | OK | In next.config.ts gesetzt | — |
| Permissions-Policy | OK | In next.config.ts gesetzt (camera, mic, geo disabled) | — |
| Strict-Transport-Security (HSTS) | TODO | Nicht gesetzt | `Strict-Transport-Security: max-age=31536000; includeSubDomains` hinzufuegen |
| Content-Security-Policy (CSP) | TODO | Nicht gesetzt | CSP Header definieren (script-src, style-src, img-src etc.) |
| X-XSS-Protection | TODO | Nicht gesetzt | `X-XSS-Protection: 0` (Browser-eigener XSS-Filter, CSP preferred) |
| Cache-Control fuer sensitive Seiten | TODO | Nicht gesetzt | `Cache-Control: no-store` fuer Auth-Seiten |
| Server Header entfernen | TODO | nginx/openresty zeigt Server-Version | `server_tokens off` in nginx Config |
| X-Powered-By entfernen | OK | Next.js entfernt X-Powered-By automatisch | — |
| # | Anforderung | Status | Nexus Stand | ToDo |
| ------------------------------------------------ | ----------- | ----------------------------------------------------- | ---------------------------------------------------------------------------- | ---- |
| X-Frame-Options: DENY | OK | In next.config.ts gesetzt | — |
| X-Content-Type-Options: nosniff | OK | In next.config.ts gesetzt | — |
| Referrer-Policy: strict-origin-when-cross-origin | OK | In next.config.ts gesetzt | — |
| Permissions-Policy | OK | In next.config.ts gesetzt (camera, mic, geo disabled) | — |
| Strict-Transport-Security (HSTS) | TODO | Nicht gesetzt | `Strict-Transport-Security: max-age=31536000; includeSubDomains` hinzufuegen |
| Content-Security-Policy (CSP) | TODO | Nicht gesetzt | CSP Header definieren (script-src, style-src, img-src etc.) |
| X-XSS-Protection | TODO | Nicht gesetzt | `X-XSS-Protection: 0` (Browser-eigener XSS-Filter, CSP preferred) |
| Cache-Control fuer sensitive Seiten | TODO | Nicht gesetzt | `Cache-Control: no-store` fuer Auth-Seiten |
| Server Header entfernen | TODO | nginx/openresty zeigt Server-Version | `server_tokens off` in nginx Config |
| X-Powered-By entfernen | OK | Next.js entfernt X-Powered-By automatisch | — |
---
## 3.3.1.6 Cookies & Attributes
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| HttpOnly Flag | OK | Auth.js Session-Cookie ist HttpOnly | — |
| Secure Flag | PARTIAL | In Production ja (HTTPS), in Dev nein (HTTP) | Sicherstellen dass Secure Flag in Prod immer gesetzt |
| SameSite Attribute | PARTIAL | Auth.js setzt SameSite=Lax | Pruefen ob Strict moeglich |
| Cookie-Prefix (__Host- oder __Secure-) | TODO | Keine Cookie-Prefixe | `__Host-` Prefix fuer Session-Cookie evaluieren |
| # | Anforderung | Status | Nexus Stand | ToDo |
| -------------------------------------- | ----------- | -------------------------------------------- | ---------------------------------------------------- | ---- |
| HttpOnly Flag | OK | Auth.js Session-Cookie ist HttpOnly | — |
| Secure Flag | PARTIAL | In Production ja (HTTPS), in Dev nein (HTTP) | Sicherstellen dass Secure Flag in Prod immer gesetzt |
| SameSite Attribute | PARTIAL | Auth.js setzt SameSite=Lax | Pruefen ob Strict moeglich |
| Cookie-Prefix (**Host- oder **Secure-) | TODO | Keine Cookie-Prefixe | `__Host-` Prefix fuer Session-Cookie evaluieren |
---
## 3.3.1.12 API Management
| # | Anforderung | Status | CapaKraken Stand | ToDo |
|---|------------|--------|-----------------|------|
| Rate Limiting | TODO | Kein Rate Limiting | Rate Limiting auf tRPC-Endpoints implementieren (z.B. `express-rate-limit` oder nginx level) |
| API Versioning | N/A | Internes Tool, kein oeffentliches API | — |
| API Authentication | OK | Alle tRPC-Procedures hinter protectedProcedure | — |
| API Input Validation | OK | Zod-Schemas auf allen Inputs | — |
| # | Anforderung | Status | Nexus Stand | ToDo |
| -------------------- | ----------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------- | ---- |
| Rate Limiting | TODO | Kein Rate Limiting | Rate Limiting auf tRPC-Endpoints implementieren (z.B. `express-rate-limit` oder nginx level) |
| API Versioning | N/A | Internes Tool, kein oeffentliches API | — |
| API Authentication | OK | Alle tRPC-Procedures hinter protectedProcedure | — |
| API Input Validation | OK | Zod-Schemas auf allen Inputs | — |
---
@@ -220,16 +220,16 @@
## Bereits Compliant (kein Handlungsbedarf)
| Bereich | Standard-Anforderung | CapaKraken Feature |
|---------|---------------------|-------------------|
| SQL Injection Prevention | Parameterized Queries | Prisma ORM |
| Password Hashing | Sichere Hash-Funktion | Argon2 via @node-rs/argon2 |
| RBAC | Rollenbasierte Zugriffskontrolle | 5-stufiges RBAC (USER→ADMIN) + Per-User Overrides |
| Input Validation | Alle Inputs validiert | Zod-Schemas auf allen tRPC-Procedures |
| Audit Logging | Aenderungen nachvollziehbar | Activity History System (29/36 Router) |
| Data Masking | Passwort-Felder maskiert | `type="password"` durchgehend |
| Source Code Access | Nur Dev-Team | Gitea mit Auth |
| No Prod Data in Dev | Fiktive Testdaten | Marvel-Character Seed |
| X-Frame-Options | Clickjacking-Schutz | DENY in next.config.ts |
| X-Content-Type-Options | MIME-Sniffing Schutz | nosniff in next.config.ts |
| API Auth | Alle Endpoints geschuetzt | protectedProcedure Middleware |
| Bereich | Standard-Anforderung | Nexus Feature |
| ------------------------ | -------------------------------- | ------------------------------------------------- |
| SQL Injection Prevention | Parameterized Queries | Prisma ORM |
| Password Hashing | Sichere Hash-Funktion | Argon2 via @node-rs/argon2 |
| RBAC | Rollenbasierte Zugriffskontrolle | 5-stufiges RBAC (USER→ADMIN) + Per-User Overrides |
| Input Validation | Alle Inputs validiert | Zod-Schemas auf allen tRPC-Procedures |
| Audit Logging | Aenderungen nachvollziehbar | Activity History System (29/36 Router) |
| Data Masking | Passwort-Felder maskiert | `type="password"` durchgehend |
| Source Code Access | Nur Dev-Team | Gitea mit Auth |
| No Prod Data in Dev | Fiktive Testdaten | Marvel-Character Seed |
| X-Frame-Options | Clickjacking-Schutz | DENY in next.config.ts |
| X-Content-Type-Options | MIME-Sniffing Schutz | nosniff in next.config.ts |
| API Auth | Alle Endpoints geschuetzt | protectedProcedure Middleware |
docs/acn-standards-applicability.md
+72 -70
View File
@@ -1,4 +1,4 @@
# CapaKraken — Accenture Security Standards Applicability Matrix
# Nexus — Accenture Security Standards Applicability Matrix
**Stand:** 2026-03-27 | **Quelle:** in.accenture.com/protectingaccenture/is-to-operations/architecture-standards/
@@ -6,44 +6,44 @@
## Zusammenfassung
| Kategorie | Relevant | Nicht relevant | Gesamt |
|-----------|----------|---------------|--------|
| Enterprise Security Standards | **12** | 7 | 19 |
| AI Security Standards | **2** | 1 | 3 |
| Infrastructure Standards | **5** | ~60 | ~65 |
| **Gesamt relevant** | **19** | ~68 | ~87 |
| Kategorie | Relevant | Nicht relevant | Gesamt |
| ----------------------------- | -------- | -------------- | ------ |
| Enterprise Security Standards | **12** | 7 | 19 |
| AI Security Standards | **2** | 1 | 3 |
| Infrastructure Standards | **5** | ~60 | ~65 |
| **Gesamt relevant** | **19** | ~68 | ~87 |
---
## Teil 1: Enterprise Security Standards
### RELEVANT fuer CapaKraken (12 Standards)
### RELEVANT fuer Nexus (12 Standards)
| # | Standard | Relevanz | CapaKraken Status | Handlungsbedarf |
|---|----------|----------|------------------|----------------|
| 1 | **Application Security Standard** | KERN-Standard | 73% compliant (46/63 Controls) | Bereits detailliert analysiert — siehe `acn-security-compliance-status.md` |
| 2 | **API Management Security Standard** | tRPC-API | TEILWEISE — Rate Limiting, Auth, Validation vorhanden | Standard lesen und gegen tRPC-Implementierung abgleichen |
| 3 | **Data Classification and Protection** | Personaldaten (Names, Emails, Rates) | TEILWEISE — RBAC + Audit vorhanden, keine formale Datenklassifizierung | Datenklassifizierung durchfuehren (welche Felder sind HC/C/IR?) |
| 4 | **Encryption Standard** | Passwoerter, API Keys, DB-Verbindung | TEILWEISE — Argon2 Hashing, HTTPS via nginx, DB ohne TLS | PostgreSQL TLS aktivieren, Key-Rotation Prozess definieren |
| 5 | **Identification and Authentication Standard** | Login, MFA, Session Mgmt | HOCH — Auth.js + TOTP MFA + Session Timeouts implementiert | ESO-Integration evaluieren (aktuell eigene Auth) |
| 6 | **Logging and Auditing Standard** | Activity History | HOCH — Pino Logger + Audit Entries auf 29/36 Router | Log-Retention Policy definieren, zentrales Log-Shipping |
| 7 | **Access Control Standard** | RBAC, Permissions | HOCH — 5-stufiges RBAC + per-User Overrides | Formale Access-Review Prozedur dokumentieren |
| 8 | **Security Remediation and Patch Management** | Dependencies | TEILWEISE — Dependabot + npm audit Cron | Patch-SLA definieren (Critical: 48h, High: 7d, Medium: 30d) |
| 9 | **User Authorization Standard** | Wer darf was | HOCH — RBAC mit PermissionKey-System | Bereits implementiert, Review-Prozess dokumentieren |
| 10 | **Data Integrity Standard** | Daten-Konsistenz | TEILWEISE — Prisma Transactions, Audit Trail | Backup-Strategie + Integrity-Checks definieren |
| 11 | **SaaS and PaaS Cloud Computing Security** | Falls Cloud-Deployment | NIEDRIG aktuell (On-Prem Docker) | Relevant bei Cloud-Migration |
| 12 | **Mobile Application Security Standard** | PWA auf Mobile | NIEDRIG — PWA ist kein native App | Service Worker Security pruefen |
| # | Standard | Relevanz | Nexus Status | Handlungsbedarf |
| --- | ---------------------------------------------- | ------------------------------------ | ---------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| 1 | **Application Security Standard** | KERN-Standard | 73% compliant (46/63 Controls) | Bereits detailliert analysiert — siehe `acn-security-compliance-status.md` |
| 2 | **API Management Security Standard** | tRPC-API | TEILWEISE — Rate Limiting, Auth, Validation vorhanden | Standard lesen und gegen tRPC-Implementierung abgleichen |
| 3 | **Data Classification and Protection** | Personaldaten (Names, Emails, Rates) | TEILWEISE — RBAC + Audit vorhanden, keine formale Datenklassifizierung | Datenklassifizierung durchfuehren (welche Felder sind HC/C/IR?) |
| 4 | **Encryption Standard** | Passwoerter, API Keys, DB-Verbindung | TEILWEISE — Argon2 Hashing, HTTPS via nginx, DB ohne TLS | PostgreSQL TLS aktivieren, Key-Rotation Prozess definieren |
| 5 | **Identification and Authentication Standard** | Login, MFA, Session Mgmt | HOCH — Auth.js + TOTP MFA + Session Timeouts implementiert | ESO-Integration evaluieren (aktuell eigene Auth) |
| 6 | **Logging and Auditing Standard** | Activity History | HOCH — Pino Logger + Audit Entries auf 29/36 Router | Log-Retention Policy definieren, zentrales Log-Shipping |
| 7 | **Access Control Standard** | RBAC, Permissions | HOCH — 5-stufiges RBAC + per-User Overrides | Formale Access-Review Prozedur dokumentieren |
| 8 | **Security Remediation and Patch Management** | Dependencies | TEILWEISE — Dependabot + npm audit Cron | Patch-SLA definieren (Critical: 48h, High: 7d, Medium: 30d) |
| 9 | **User Authorization Standard** | Wer darf was | HOCH — RBAC mit PermissionKey-System | Bereits implementiert, Review-Prozess dokumentieren |
| 10 | **Data Integrity Standard** | Daten-Konsistenz | TEILWEISE — Prisma Transactions, Audit Trail | Backup-Strategie + Integrity-Checks definieren |
| 11 | **SaaS and PaaS Cloud Computing Security** | Falls Cloud-Deployment | NIEDRIG aktuell (On-Prem Docker) | Relevant bei Cloud-Migration |
| 12 | **Mobile Application Security Standard** | PWA auf Mobile | NIEDRIG — PWA ist kein native App | Service Worker Security pruefen |
### NICHT RELEVANT fuer CapaKraken (7 Standards)
### NICHT RELEVANT fuer Nexus (7 Standards)
| Standard | Grund |
|----------|-------|
| IaaS Cloud Computing Security | Kein IaaS-Deployment (Docker on-prem) |
| Domain Registration Security | Keine eigene Domain-Registrierung |
| External Personnel Access | Keine externen Nutzer |
| Public Key Infrastructure (PKI) | Keine PKI-Infrastruktur |
| Remote Access Standard | Kein VPN/Remote-Access-Thema |
| Asset Protection Standard (AFS) | Nur fuer Accenture LLP Software |
| Standard | Grund |
| ------------------------------------------ | ------------------------------------------ |
| IaaS Cloud Computing Security | Kein IaaS-Deployment (Docker on-prem) |
| Domain Registration Security | Keine eigene Domain-Registrierung |
| External Personnel Access | Keine externen Nutzer |
| Public Key Infrastructure (PKI) | Keine PKI-Infrastruktur |
| Remote Access Standard | Kein VPN/Remote-Access-Thema |
| Asset Protection Standard (AFS) | Nur fuer Accenture LLP Software |
| Asset Classification & Protection (Tier 0) | Fuer Infrastruktur-Assets, nicht App-Level |
---
@@ -52,15 +52,15 @@
### RELEVANT (2 Standards)
| # | Standard | Relevanz | CapaKraken Status | Handlungsbedarf |
|---|----------|----------|------------------|----------------|
| 13 | **Generative AI Security Standard** | Azure OpenAI + Gemini Integration | TODO | Standard lesen — betrifft AI Summary, Narrative Generation, Image Generation |
| 14 | **Agentic AI Security Standard** | HartBOT AI Assistant mit 87+ Tools | TODO | Standard lesen — betrifft Function Calling, Tool Execution, Data Access |
| # | Standard | Relevanz | Nexus Status | Handlungsbedarf |
| --- | ----------------------------------- | ---------------------------------- | ------------ | ---------------------------------------------------------------------------- |
| 13 | **Generative AI Security Standard** | Azure OpenAI + Gemini Integration | TODO | Standard lesen — betrifft AI Summary, Narrative Generation, Image Generation |
| 14 | **Agentic AI Security Standard** | HartBOT AI Assistant mit 87+ Tools | TODO | Standard lesen — betrifft Function Calling, Tool Execution, Data Access |
### NICHT RELEVANT (1)
| Standard | Grund |
|----------|-------|
| Standard | Grund |
| ---------------------------- | ------------------------------------------------------ |
| Secure Vibe Coding Guideline | Fuer AI-gestuetzte Code-Generierung, nicht App-Feature |
---
@@ -69,17 +69,18 @@
### RELEVANT (5 Standards)
| # | Standard | Relevanz | CapaKraken Status | Handlungsbedarf |
|---|----------|----------|------------------|----------------|
| 15 | **PostgreSQL Security Standard** | Haupt-Datenbank | TODO | Standard lesen und gegen aktuelle Config abgleichen |
| 16 | **Nginx Security Standard** | Reverse Proxy | TEILWEISE — Hardening-Template vorhanden (`docs/nginx-hardening.conf`) | Template anwenden + gegen Standard pruefen |
| 17 | **Container Security Standard** | Docker Deployment | TODO | Docker-Compose Hardening (non-root, read-only FS, resource limits) |
| 18 | **DevSecOps Standard** | CI/CD Pipeline | TEILWEISE — GitHub Actions CI, Dependabot | Standard lesen, Compliance-Gaps identifizieren |
| 19 | **Secure Code Repositories Standard** | Gitea | TEILWEISE — Auth vorhanden, Branch Protection unklar | Branch Protection Rules + Signed Commits evaluieren |
| # | Standard | Relevanz | Nexus Status | Handlungsbedarf |
| --- | ------------------------------------- | ----------------- | ---------------------------------------------------------------------- | ------------------------------------------------------------------ |
| 15 | **PostgreSQL Security Standard** | Haupt-Datenbank | TODO | Standard lesen und gegen aktuelle Config abgleichen |
| 16 | **Nginx Security Standard** | Reverse Proxy | TEILWEISE — Hardening-Template vorhanden (`docs/nginx-hardening.conf`) | Template anwenden + gegen Standard pruefen |
| 17 | **Container Security Standard** | Docker Deployment | TODO | Docker-Compose Hardening (non-root, read-only FS, resource limits) |
| 18 | **DevSecOps Standard** | CI/CD Pipeline | TEILWEISE — GitHub Actions CI, Dependabot | Standard lesen, Compliance-Gaps identifizieren |
| 19 | **Secure Code Repositories Standard** | Gitea | TEILWEISE — Auth vorhanden, Branch Protection unklar | Branch Protection Rules + Signed Commits evaluieren |
### NICHT RELEVANT (~60 Standards)
Betrifft Technologien die CapaKraken nicht nutzt:
Betrifft Technologien die Nexus nicht nutzt:
- Windows/MacOS/Linux Workstation Standards (kein Desktop-Client)
- Microsoft 365/Teams/SharePoint/Defender Standards
- Network/Firewall/VPN/Switch Standards
@@ -94,45 +95,46 @@ Betrifft Technologien die CapaKraken nicht nutzt:
### Sofort (diese Woche)
| # | Aktion | Aufwand | Wer |
|---|--------|---------|-----|
| A1 | **Gen AI Security Standard lesen** und Gap-Analyse erstellen | 2h | Entwickler |
| A2 | **Agentic AI Security Standard lesen** — HartBOT betrifft | 2h | Entwickler |
| A3 | **Datenklassifizierung** durchfuehren: welche Felder sind HC/Confidential/Internal/Unrestricted | 4h | PO + Entwickler |
| # | Aktion | Aufwand | Wer |
| --- | ----------------------------------------------------------------------------------------------- | ------- | --------------- |
| A1 | **Gen AI Security Standard lesen** und Gap-Analyse erstellen | 2h | Entwickler |
| A2 | **Agentic AI Security Standard lesen** — HartBOT betrifft | 2h | Entwickler |
| A3 | **Datenklassifizierung** durchfuehren: welche Felder sind HC/Confidential/Internal/Unrestricted | 4h | PO + Entwickler |
### Kurzfristig (2 Wochen)
| # | Aktion | Aufwand | Wer |
|---|--------|---------|-----|
| B1 | **PostgreSQL Security Standard** lesen und abgleichen | 3h | DBA/DevOps |
| B2 | **Container Security** — Docker non-root, read-only, resource limits | 1 Tag | DevOps |
| B3 | **API Management Security Standard** gegen tRPC pruefen | 3h | Entwickler |
| B4 | **Encryption Standard** — PostgreSQL TLS, Key-Rotation | 1 Tag | DevOps |
| B5 | **nginx Hardening-Template anwenden** (bereits erstellt) | 30min | Ops |
| # | Aktion | Aufwand | Wer |
| --- | -------------------------------------------------------------------- | ------- | ---------- |
| B1 | **PostgreSQL Security Standard** lesen und abgleichen | 3h | DBA/DevOps |
| B2 | **Container Security** — Docker non-root, read-only, resource limits | 1 Tag | DevOps |
| B3 | **API Management Security Standard** gegen tRPC pruefen | 3h | Entwickler |
| B4 | **Encryption Standard** — PostgreSQL TLS, Key-Rotation | 1 Tag | DevOps |
| B5 | **nginx Hardening-Template anwenden** (bereits erstellt) | 30min | Ops |
### Mittelfristig (1 Monat)
| # | Aktion | Aufwand | Wer |
|---|--------|---------|-----|
| C1 | **Logging Standard** abgleichen — Log-Retention, zentrales Shipping | 1 Tag | DevOps |
| C2 | **DevSecOps Standard** — Pipeline-Compliance pruefen | 4h | DevOps |
| C3 | **Secure Code Repositories** — Branch Protection, Signed Commits | 2h | DevOps |
| C4 | **Patch Management SLA** definieren und dokumentieren | 2h | PO |
| C5 | **Access Review Prozedur** dokumentieren | 2h | PO |
| # | Aktion | Aufwand | Wer |
| --- | ------------------------------------------------------------------- | ------- | ------ |
| C1 | **Logging Standard** abgleichen — Log-Retention, zentrales Shipping | 1 Tag | DevOps |
| C2 | **DevSecOps Standard** — Pipeline-Compliance pruefen | 4h | DevOps |
| C3 | **Secure Code Repositories** — Branch Protection, Signed Commits | 2h | DevOps |
| C4 | **Patch Management SLA** definieren und dokumentieren | 2h | PO |
| C5 | **Access Review Prozedur** dokumentieren | 2h | PO |
### Spaeter / Bei Bedarf
| # | Aktion | Trigger |
|---|--------|---------|
| D1 | SaaS/PaaS Cloud Security | Bei Cloud-Migration |
| D2 | Mobile Application Security | Bei nativer Mobile-App |
| D3 | Data Integrity — Backup-Strategie | Vor Production Go-Live |
| # | Aktion | Trigger |
| --- | --------------------------------- | ---------------------- |
| D1 | SaaS/PaaS Cloud Security | Bei Cloud-Migration |
| D2 | Mobile Application Security | Bei nativer Mobile-App |
| D3 | Data Integrity — Backup-Strategie | Vor Production Go-Live |
---
## Wichtigste Erkenntnis
Die **zwei AI Security Standards** (Generative AI + Agentic AI) sind **neu und kritisch** — CapaKraken nutzt:
Die **zwei AI Security Standards** (Generative AI + Agentic AI) sind **neu und kritisch** — Nexus nutzt:
- Azure OpenAI / Gemini fuer Text-Summaries und Bild-Generierung
- Einen AI Assistant (HartBOT) mit 87+ Tools und Zugriff auf alle Geschaeftsdaten
- Function Calling fuer automatisierte Aktionen (Allocations erstellen, Projekte aendern)
docs/ai-excellence-due-diligence-roadmap.md
+9 -9
View File
@@ -1,11 +1,11 @@
# AI Excellence Due Diligence And Roadmap
**Date:** 2026-03-30
**Purpose:** Frank assessment of the current codebase plus a pragmatic roadmap to turn CapaKraken into a reference project for disciplined AI-assisted software engineering.
**Purpose:** Frank assessment of the current codebase plus a pragmatic roadmap to turn Nexus into a reference project for disciplined AI-assisted software engineering.
## Executive Summary
CapaKraken is already well beyond a prototype. The repository shows a real domain model, a non-trivial bounded-context split, a meaningful automated test baseline, and active delivery discipline.
Nexus is already well beyond a prototype. The repository shows a real domain model, a non-trivial bounded-context split, a meaningful automated test baseline, and active delivery discipline.
At the same time, the codebase still carries several risks that are typical of fast-moving AI-assisted development:
@@ -44,30 +44,30 @@ The previously critical SSE and browser parser coverage issues were addressed du
### High
1. Router and UI module size is now an operational risk.
Evidence: [assistant-tools.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/assistant-tools.ts), [resource.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/resource.ts), [allocation.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/allocation.ts), [timeline.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/timeline.ts), [vacation.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/vacation.ts), and large frontend files such as [SystemSettingsClient.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/admin/SystemSettingsClient.tsx) and [TimelineProjectPanel.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineProjectPanel.tsx) are each well past the size where safe ownership stays easy.
Evidence: [assistant-tools.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/assistant-tools.ts), [resource.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/resource.ts), [allocation.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/allocation.ts), [timeline.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/timeline.ts), [vacation.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/vacation.ts), and large frontend files such as [SystemSettingsClient.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/admin/SystemSettingsClient.tsx) and [TimelineProjectPanel.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineProjectPanel.tsx) are each well past the size where safe ownership stays easy.
Risk: AI-generated changes become harder to review, humans lose local reasoning context, and regressions become more likely.
2. Runtime secret policy is mostly corrected, but deploy standardization still has to catch up.
Evidence: runtime resolution and admin flows now treat environment-backed secrets as the preferred source in [settings.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/settings.ts), [system-settings-runtime.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/lib/system-settings-runtime.ts), and [SystemSettingsClient.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/admin/SystemSettingsClient.tsx).
Evidence: runtime resolution and admin flows now treat environment-backed secrets as the preferred source in [settings.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/settings.ts), [system-settings-runtime.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/lib/system-settings-runtime.ts), and [SystemSettingsClient.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/admin/SystemSettingsClient.tsx).
Risk: a strong secret policy is only fully effective once staging and production provisioning use one canonical deployment path and operators clear remaining legacy database copies.
Update: the application no longer persists new operational secret values through admin settings; the remaining work is rollout discipline and cleanup completion.
3. Least-privilege is materially better documented now, but it still needs long-lived enforcement rather than relying mainly on one hardening batch.
Evidence: the route audience model is now explicit in [route-access-matrix.md](/home/hartmut/Documents/Copilot/capakraken/docs/route-access-matrix.md) and backed by multiple focused auth tests, but the remaining guarantee still depends on continuing test coverage and architecture guardrails as new routes evolve.
Evidence: the route audience model is now explicit in [route-access-matrix.md](/home/hartmut/Documents/Copilot/nexus/docs/route-access-matrix.md) and backed by multiple focused auth tests, but the remaining guarantee still depends on continuing test coverage and architecture guardrails as new routes evolve.
Risk: future feature work can slowly widen access again if the matrix and tests are not treated as an enforced contract.
### Medium
1. Rate limiting now supports deployment-grade shared counters, but rollout discipline still matters.
Evidence: [rate-limit.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/middleware/rate-limit.ts) now prefers Redis-backed counters when `REDIS_URL` is configured, while preserving an in-memory fallback for local development and degraded operation.
Evidence: [rate-limit.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/middleware/rate-limit.ts) now prefers Redis-backed counters when `REDIS_URL` is configured, while preserving an in-memory fallback for local development and degraded operation.
Risk: protections still depend on production actually wiring Redis for all instances instead of silently running on the fallback path.
2. Performance hotspots are well understood but not yet structurally solved.
Evidence: the current performance review identifies repeated in-memory filtering, broad invalidation, and heavyweight timeline/report derivations in [performance-optimization-review-2026-03-18.md](/home/hartmut/Documents/Copilot/capakraken/docs/performance-optimization-review-2026-03-18.md).
Evidence: the current performance review identifies repeated in-memory filtering, broad invalidation, and heavyweight timeline/report derivations in [performance-optimization-review-2026-03-18.md](/home/hartmut/Documents/Copilot/nexus/docs/performance-optimization-review-2026-03-18.md).
Risk: user experience and infrastructure cost will degrade as data volume grows.
3. Rollback and incident drills still need to be exercised, even though the deployment path is now standardized.
Evidence: the canonical production path now runs through [release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml), [deploy-staging.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-staging.yml), [deploy-prod.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-prod.yml), and the single host compose file [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/capakraken/docker-compose.prod.yml).
Evidence: the canonical production path now runs through [release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml), [deploy-staging.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-staging.yml), [deploy-prod.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-prod.yml), and the single host compose file [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/nexus/docker-compose.prod.yml).
Risk: a clean architecture path still needs operator rehearsal before it becomes operationally boring under pressure.
## Overall Rating
@@ -237,6 +237,6 @@ Artifacts to add:
## Bottom Line
CapaKraken is already good enough to justify further investment. It is not a cleanup disaster.
Nexus is already good enough to justify further investment. It is not a cleanup disaster.
The opportunity is not to rebuild it. The opportunity is to harden the weak edges, reduce oversized ownership surfaces, and make the engineering standards visible enough that the repository becomes evidence that AI can accelerate serious software without normalizing architectural debt.
docs/architecture-decision-records/0001-runtime-secret-provisioning.md
+1 -1
View File
@@ -5,7 +5,7 @@
## Context
CapaKraken historically allowed some operational runtime secrets to be persisted through `SystemSettings`.
Nexus historically allowed some operational runtime secrets to be persisted through `SystemSettings`.
That included values such as:
docs/assistant-tool-test-split-migration.md
+1 -1
View File
@@ -12,7 +12,7 @@ Diese Notiz hält fest, wie die alten Assistant-Tool-Monolith-Tests in kleinere,
## Regression ausführen
Im Paket `@capakraken/api`:
Im Paket `@nexus/api`:
```bash
pnpm test:assistant-split
docs/audience-scoping-backlog.md
+1 -1
View File
@@ -62,7 +62,7 @@ Each “ready now” slice should follow the same template:
1. change the router audience only if the current procedure is too broad
2. add focused auth tests for unauthenticated, plain authenticated, and elevated callers as applicable
3. update [route-access-matrix.md](/home/hartmut/Documents/Copilot/capakraken/docs/route-access-matrix.md)
3. update [route-access-matrix.md](/home/hartmut/Documents/Copilot/nexus/docs/route-access-matrix.md)
4. verify with targeted `vitest`
5. run `git diff --check`
6. commit in isolation
docs/calculation-reference.md
+86 -79
View File
@@ -1,6 +1,6 @@
# Calculation Reference
How every number in CapaKraken is derived. All monetary values are integer cents. All percentages are 0-100 integers unless noted.
How every number in Nexus is derived. All monetary values are integer cents. All percentages are 0-100 integers unless noted.
---
@@ -8,18 +8,20 @@ How every number in CapaKraken is derived. All monetary values are integer cents
**Source:** `packages/engine/src/allocation/calculator.ts`
| Metric | Formula | Notes |
|--------|---------|-------|
| Daily Cost | `round(hoursPerDay x lcrCents)` | LCR = Labor Cost Rate (cents/hour) |
| Total Cost | `round(lcrCents x hoursPerDay x workingDays)` | Mon-Fri only, minus vacation days |
| Working Days | Calendar days minus weekends minus vacations | Sat included only if `includeSaturday=true` |
| Metric | Formula | Notes |
| ------------ | --------------------------------------------- | ------------------------------------------- |
| Daily Cost | `round(hoursPerDay x lcrCents)` | LCR = Labor Cost Rate (cents/hour) |
| Total Cost | `round(lcrCents x hoursPerDay x workingDays)` | Mon-Fri only, minus vacation days |
| Working Days | Calendar days minus weekends minus vacations | Sat included only if `includeSaturday=true` |
**Inputs:**
- `lcrCents` — from Resource record (integer cents per hour)
- `hoursPerDay` — from Allocation record
- `startDate` / `endDate` — allocation period
**Edge cases:**
- Null LCR -> cost = 0
- Recurring allocations use `getRecurringHoursForDay()` per-day override
- Availability-aware: capped at resource's available hours for that weekday
@@ -92,22 +94,23 @@ SAH = round(totalHours x 100) / 100
```
**Schedule rules** (e.g. Spain):
- Friday: reduced hours (`fridayHours`)
- Summer period: reduced hours (`summerHours`)
- Default: `regularHours`
**Components returned:**
| Field | Meaning |
|-------|---------|
| calendarDays | Total days (inclusive) |
| weekendDays | Sat + Sun |
| grossWorkingDays | calendarDays - weekendDays |
| publicHolidayDays | Holidays falling on working days |
| absenceDays | Vacations/absences on working days |
| netWorkingDays | Gross - holidays - absences |
| effectiveHoursPerDay | Weighted average including FTE |
| standardAvailableHours | **SAH** (total for period) |
| Field | Meaning |
| ---------------------- | ---------------------------------- |
| calendarDays | Total days (inclusive) |
| weekendDays | Sat + Sun |
| grossWorkingDays | calendarDays - weekendDays |
| publicHolidayDays | Holidays falling on working days |
| absenceDays | Vacations/absences on working days |
| netWorkingDays | Gross - holidays - absences |
| effectiveHoursPerDay | Weighted average including FTE |
| standardAvailableHours | **SAH** (total for period) |
---
@@ -130,10 +133,10 @@ winWeightedCents = round(allocatedCents x winProbability / 100)
**Warning thresholds** (`packages/shared/src/constants/index.ts`):
| Level | Threshold |
|-------|-----------|
| INFO | >= 70% |
| WARNING | >= 85% |
| Level | Threshold |
| -------- | ------------------ |
| INFO | >= 70% |
| WARNING | >= 85% |
| CRITICAL | >= 95% or exceeded |
---
@@ -219,16 +222,16 @@ Lines are aggregated by `discipline + "::" + chapter`.
### Rule matching (hierarchical specificity)
| Specificity | Filters present | Score |
|-------------|-----------------|-------|
| Most specific | chapter + location + level | 7 |
| | chapter + location | 6 |
| | chapter + level | 5 |
| | chapter only | 4 |
| | location + level | 3 |
| | location only | 2 |
| | level only | 1 |
| Least specific | none (global fallback) | 0 |
| Specificity | Filters present | Score |
| -------------- | -------------------------- | ----- |
| Most specific | chapter + location + level | 7 |
| | chapter + location | 6 |
| | chapter + level | 5 |
| | chapter only | 4 |
| | location + level | 3 |
| | location only | 2 |
| | level only | 1 |
| Least specific | none (global fallback) | 0 |
Highest score wins. Ties broken by order.
@@ -257,6 +260,7 @@ if shoringRatio > 0:
### Component scores (each 0-100)
**Skill Score:**
```
if no required skills: 100
else:
@@ -269,12 +273,14 @@ else:
```
**Availability Score:**
```
no conflicts: 100
else: max(0, 100 - conflictDays x 10)
```
**Cost Score:**
```
no budget: 50 (neutral)
within budget: 100
@@ -283,6 +289,7 @@ over budget: max(0, round(100 - (ratio - 1) x 100))
```
**Utilization Score:**
```
gap = target - current
gap >= 20: 100
@@ -293,12 +300,12 @@ gap < -20: 0
### Combined score (weights)
| Dimension | Weight |
|-----------|--------|
| Skill | 40% |
| Availability | 30% |
| Cost | 20% |
| Utilization | 10% |
| Dimension | Weight |
| ------------ | ------ |
| Skill | 40% |
| Availability | 30% |
| Cost | 20% |
| Utilization | 10% |
```
total = round(skill x 0.4 + availability x 0.3 + cost x 0.2 + utilization x 0.1)
@@ -314,13 +321,13 @@ Results sorted descending by total score.
Five dimensions, each normalized to 0-100:
| Dimension | Formula | Weight |
|-----------|---------|--------|
| Skill Depth | `round(avgProficiency / 5 x 100)` | 30% |
| Skill Breadth | `min(100, skillCount x 10)` | 15% |
| Cost Efficiency | `round((1 - lcrCents/maxLcrCents) x 100)` | 25% |
| Chargeability | `max(0, 100 - abs(target - current) x 2)` | 15% |
| Experience | `min(100, round(avgYears x 10))` | 15% |
| Dimension | Formula | Weight |
| --------------- | ----------------------------------------- | ------ |
| Skill Depth | `round(avgProficiency / 5 x 100)` | 30% |
| Skill Breadth | `min(100, skillCount x 10)` | 15% |
| Cost Efficiency | `round((1 - lcrCents/maxLcrCents) x 100)` | 25% |
| Chargeability | `max(0, 100 - abs(target - current) x 2)` | 15% |
| Experience | `min(100, round(avgYears x 10))` | 15% |
```
total = clamp(0, 100, round(
@@ -370,53 +377,53 @@ requiredFTEs = SUM(headcount x demandFteFactor)
### Allocation Columns
| Key | Label | Default | Hideable | Derivation |
|-----|-------|---------|----------|------------|
| resource | Resource | visible | no | `assignment.resource.displayName` |
| project | Project | visible | no | `project.shortCode + project.name` |
| role | Role | visible | yes | `allocation.role` (text label) |
| dates | Dates | visible | yes | `startDate -> endDate` formatted |
| hoursPerDay | h/day | visible | yes | `allocation.hoursPerDay` |
| cost | Daily Cost | hidden | yes | `round(hoursPerDay x lcrCents) / 100` in EUR |
| status | Status | visible | yes | PROPOSED / CONFIRMED / ACTIVE / COMPLETED / CANCELLED |
| Key | Label | Default | Hideable | Derivation |
| ----------- | ---------- | ------- | -------- | ----------------------------------------------------- |
| resource | Resource | visible | no | `assignment.resource.displayName` |
| project | Project | visible | no | `project.shortCode + project.name` |
| role | Role | visible | yes | `allocation.role` (text label) |
| dates | Dates | visible | yes | `startDate -> endDate` formatted |
| hoursPerDay | h/day | visible | yes | `allocation.hoursPerDay` |
| cost | Daily Cost | hidden | yes | `round(hoursPerDay x lcrCents) / 100` in EUR |
| status | Status | visible | yes | PROPOSED / CONFIRMED / ACTIVE / COMPLETED / CANCELLED |
### Resource Columns
| Key | Label | Default | Derivation |
|-----|-------|---------|------------|
| displayName | Name | visible | Direct from DB |
| eid | EID | visible | Employee ID (anonymized when enabled) |
| chapter | Chapter | visible | Organizational unit |
| roles | Roles | visible | From ResourceRole join table |
| chargeability | Chargeability | visible | See Section 2a |
| lcr | LCR | hidden | Labor Cost Rate (cents/hour), requires VIEW_COSTS |
| valueScore | Score | hidden | See Section 10 |
| isActive | Status | visible | Boolean flag |
| Key | Label | Default | Derivation |
| ------------- | ------------- | ------- | ------------------------------------------------- |
| displayName | Name | visible | Direct from DB |
| eid | EID | visible | Employee ID (anonymized when enabled) |
| chapter | Chapter | visible | Organizational unit |
| roles | Roles | visible | From ResourceRole join table |
| chargeability | Chargeability | visible | See Section 2a |
| lcr | LCR | hidden | Labor Cost Rate (cents/hour), requires VIEW_COSTS |
| valueScore | Score | hidden | See Section 10 |
| isActive | Status | visible | Boolean flag |
### Project Columns
| Key | Label | Default | Derivation |
|-----|-------|---------|------------|
| shortCode | Code | visible | Direct from DB |
| name | Name | visible | Direct from DB |
| status | Status | visible | DRAFT / ACTIVE / COMPLETED / CANCELLED |
| orderType | Type | visible | CHARGEABLE / INTERNAL / INVESTMENT |
| dates | Dates | visible | `startDate -> endDate` |
| budget | Budget | hidden | `project.budgetCents / 100` in EUR |
| allocations | Allocations | visible | Count of linked assignments + demands |
| Key | Label | Default | Derivation |
| ----------- | ----------- | ------- | -------------------------------------- |
| shortCode | Code | visible | Direct from DB |
| name | Name | visible | Direct from DB |
| status | Status | visible | DRAFT / ACTIVE / COMPLETED / CANCELLED |
| orderType | Type | visible | CHARGEABLE / INTERNAL / INVESTMENT |
| dates | Dates | visible | `startDate -> endDate` |
| budget | Budget | hidden | `project.budgetCents / 100` in EUR |
| allocations | Allocations | visible | Count of linked assignments + demands |
---
## 13. Rounding & Precision Rules
| Domain | Rule |
|--------|------|
| Money | Integer cents everywhere. `round(value)` at calculation boundary |
| Hours | 2 decimal places: `round(x * 100) / 100` |
| Percentages | Integer 0-100: `round(ratio * 100)` |
| Scores | Integer 0-100: `round(weighted_sum)`, clamped |
| Days | Integer (or 0.5 for half-day vacations) |
| FTE | Decimal (e.g. 0.8), used as multiplier on SAH |
| Domain | Rule |
| ----------- | ---------------------------------------------------------------- |
| Money | Integer cents everywhere. `round(value)` at calculation boundary |
| Hours | 2 decimal places: `round(x * 100) / 100` |
| Percentages | Integer 0-100: `round(ratio * 100)` |
| Scores | Integer 0-100: `round(weighted_sum)`, clamped |
| Days | Integer (or 0.5 for half-day vacations) |
| FTE | Decimal (e.g. 0.8), used as multiplier on SAH |
---
docs/ci-cd-manual.md
+17 -17
View File
@@ -1,8 +1,8 @@
# CapaKraken CI/CD Manual
# Nexus CI/CD Manual
## Overview
This is the operational runbook for the canonical CapaKraken delivery path:
This is the operational runbook for the canonical Nexus delivery path:
1. CI validates every PR.
2. Every push to `main` publishes immutable release images.
@@ -12,7 +12,7 @@ This is the operational runbook for the canonical CapaKraken delivery path:
## 1. CI Gate
The merge gate is [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml).
The merge gate is [ci.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/ci.yml).
It covers:
@@ -28,15 +28,15 @@ Before merging, all required checks must pass.
Useful local commands:
```bash
pnpm --filter @capakraken/web exec tsc --project tsconfig.typecheck.json --noEmit
pnpm --filter @nexus/web exec tsc --project tsconfig.typecheck.json --noEmit
pnpm lint
pnpm test:unit
pnpm --filter @capakraken/web exec next build
pnpm --filter @nexus/web exec next build
```
## 2. Image Release
[release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) runs automatically on every push to `main`.
[release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) runs automatically on every push to `main`.
It publishes:
@@ -47,7 +47,7 @@ The workflow is also callable manually if a rebuild or tag override is needed.
## 3. Host Bootstrap
Each deploy target should have a dedicated directory such as `/opt/capakraken` containing:
Each deploy target should have a dedicated directory such as `/opt/nexus` containing:
```text
docker-compose.prod.yml
@@ -58,8 +58,8 @@ tooling/deploy/deploy-compose.sh
Use these examples from the repo:
- [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/.env.production.example)
- [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy.env.example)
- [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/.env.production.example)
- [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy.env.example)
Important host-side rules:
@@ -79,16 +79,16 @@ openssl rand -base64 32
Standard path:
1. merge to `main`
2. wait for [release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) to publish `sha-<commit>`
3. run [deploy-staging.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-staging.yml) with that tag
2. wait for [release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) to publish `sha-<commit>`
3. run [deploy-staging.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-staging.yml) with that tag
The workflow uploads:
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/capakraken/docker-compose.prod.yml)
- [tooling/deploy](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/README.md)
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/nexus/docker-compose.prod.yml)
- [tooling/deploy](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/README.md)
- a short-lived `deploy.env`
On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy-compose.sh):
On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy-compose.sh):
1. validates the rendered compose file
2. pulls `APP_IMAGE` and `MIGRATOR_IMAGE`
@@ -101,7 +101,7 @@ On the host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tool
After staging is accepted:
1. run [deploy-prod.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-prod.yml)
1. run [deploy-prod.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-prod.yml)
2. use the exact same `sha-<commit>` tag
3. verify `GET /api/ready`
@@ -151,10 +151,10 @@ Schema changes still need expand-and-contract discipline for rollback safety.
Run the failing command locally:
```bash
pnpm --filter @capakraken/web exec tsc --project tsconfig.typecheck.json --noEmit
pnpm --filter @nexus/web exec tsc --project tsconfig.typecheck.json --noEmit
pnpm lint
pnpm test:unit
pnpm --filter @capakraken/web exec next build
pnpm --filter @nexus/web exec next build
```
### Deploy fails before container start
docs/cicd-target-architecture.md
+17 -17
View File
@@ -2,7 +2,7 @@
## Goal
This document describes the canonical release path for CapaKraken.
This document describes the canonical release path for Nexus.
The release model is now:
@@ -16,7 +16,7 @@ The release model is now:
### 1. Pull Request Validation
The main [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml) workflow remains the merge gate for:
The main [ci.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/ci.yml) workflow remains the merge gate for:
- architecture guardrails
- typecheck
@@ -27,26 +27,26 @@ The main [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/c
### 2. Automatic Image Release
[release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) now runs automatically on every push to `main` and can still be started manually for rebuilds or tag overrides.
[release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) now runs automatically on every push to `main` and can still be started manually for rebuilds or tag overrides.
It publishes two images from [Dockerfile.prod](/home/hartmut/Documents/Copilot/capakraken/Dockerfile.prod):
It publishes two images from [Dockerfile.prod](/home/hartmut/Documents/Copilot/nexus/Dockerfile.prod):
- `ghcr.io/<owner>/<repo>-app:sha-<commit>`
- `ghcr.io/<owner>/<repo>-migrator:sha-<commit>`
### 3. Staging Promotion
[deploy-staging.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-staging.yml) copies the canonical deploy bundle to the staging host:
[deploy-staging.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-staging.yml) copies the canonical deploy bundle to the staging host:
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/capakraken/docker-compose.prod.yml)
- [tooling/deploy/deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy-compose.sh)
- the rest of [tooling/deploy](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/README.md)
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/nexus/docker-compose.prod.yml)
- [tooling/deploy/deploy-compose.sh](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy-compose.sh)
- the rest of [tooling/deploy](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/README.md)
GitHub Actions also writes a short-lived `deploy.env` containing `APP_IMAGE`, `MIGRATOR_IMAGE`, and the host port.
### 4. Host-Side Deployment
On the target host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy-compose.sh):
On the target host, [deploy-compose.sh](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy-compose.sh):
1. loads `.env.production` and `deploy.env`
2. validates the rendered compose file
@@ -60,7 +60,7 @@ The host does not build application code from Git anymore.
### 5. Production Promotion
[deploy-prod.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-prod.yml) repeats the exact staging flow with the same image tag after staging acceptance.
[deploy-prod.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-prod.yml) repeats the exact staging flow with the same image tag after staging acceptance.
That keeps staging and production on the same artifact instead of rebuilding.
@@ -88,13 +88,13 @@ That keeps staging and production on the same artifact instead of rebuilding.
The canonical host-side inputs are:
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/capakraken/docker-compose.prod.yml)
- [docker-compose.prod.yml](/home/hartmut/Documents/Copilot/nexus/docker-compose.prod.yml)
- `.env.production`
- `deploy.env`
`.env.production` holds long-lived runtime configuration and secrets. The example file is [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/.env.production.example).
`.env.production` holds long-lived runtime configuration and secrets. The example file is [tooling/deploy/.env.production.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/.env.production.example).
`deploy.env` is short-lived deployment metadata. The example file is [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/capakraken/tooling/deploy/deploy.env.example).
`deploy.env` is short-lived deployment metadata. The example file is [tooling/deploy/deploy.env.example](/home/hartmut/Documents/Copilot/nexus/tooling/deploy/deploy.env.example).
Important invariants:
@@ -107,7 +107,7 @@ Important invariants:
Release environments must run migrations through the `migrator` image, which executes:
```bash
pnpm --filter @capakraken/db db:migrate:deploy
pnpm --filter @nexus/db db:migrate:deploy
```
`db:push` remains a local-development tool, not a production rollout mechanism.
@@ -127,9 +127,9 @@ This assumes schema changes follow backwards-compatible expand-and-contract roll
The standard production update is:
1. merge to `main` after CI is green
2. let [release-image.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/release-image.yml) publish `sha-<commit>` images
3. deploy that tag to staging through [deploy-staging.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-staging.yml)
2. let [release-image.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/release-image.yml) publish `sha-<commit>` images
3. deploy that tag to staging through [deploy-staging.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-staging.yml)
4. validate staging
5. promote the same tag through [deploy-prod.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/deploy-prod.yml)
5. promote the same tag through [deploy-prod.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/deploy-prod.yml)
The important property is artifact identity: staging and production run the same image, not two separate builds.
docs/demand-assignment-migration-cutover.md
+7 -6
View File
@@ -24,9 +24,9 @@ pnpm db:readiness:demand-assignment --write-artifacts
Supporting commands:
```bash
pnpm --filter @capakraken/db db:audit:demand-assignment --json --fail-on-blockers
pnpm --filter @capakraken/db db:backfill:demand-assignment --json --fail-on-blockers
pnpm --filter @capakraken/db db:backfill:demand-assignment --apply
pnpm --filter @nexus/db db:audit:demand-assignment --json --fail-on-blockers
pnpm --filter @nexus/db db:backfill:demand-assignment --json --fail-on-blockers
pnpm --filter @nexus/db db:backfill:demand-assignment --apply
```
`pnpm db:readiness:demand-assignment` fails with a non-zero exit code when the workspace is not ready for `--apply`. Use `--allow-blockers` only when collecting review artifacts before remediation.
@@ -86,7 +86,7 @@ No production backfill should run from an ad hoc shell session without the saved
### Stage 3: Apply Backfill
- run `pnpm --filter @capakraken/db db:backfill:demand-assignment --apply`
- run `pnpm --filter @nexus/db db:backfill:demand-assignment --apply`
- immediately rerun `pnpm db:readiness:demand-assignment --write-artifacts`
- require the post-apply readiness report to remain `go`
@@ -129,7 +129,7 @@ The latest workspace readiness run on `2026-03-13T20:10:43.050Z` reported:
- dry-run creates: `0` demand, `0` assignment
- `goNoGo: "go"`
The first real `pnpm --filter @capakraken/db db:backfill:demand-assignment --apply --json` was executed on `2026-03-13` and completed as a no-op:
The first real `pnpm --filter @nexus/db db:backfill:demand-assignment --apply --json` was executed on `2026-03-13` and completed as a no-op:
- `demandCreates: 0`
- `assignmentCreates: 0`
@@ -177,6 +177,7 @@ As of `2026-03-14`, the split persistence migration is fully complete through St
### Facade Retirement (Complete)
The former compatibility facades have been renamed to clean domain names:
- `update-allocation-with-compatibility` → `update-allocation-entry`
- `delete-allocation-facade-entry` → `delete-allocation-entry`
- `fill-open-demand-with-compatibility` → `fill-open-demand`
@@ -184,7 +185,7 @@ The former compatibility facades have been renamed to clean domain names:
All `AllocationFacade*` type prefixes have been replaced with `AllocationEntry*`. All `compatibilityId` and `source` fields have been removed from booking interfaces. Variable names like `demandRequirementByCompatibilityId` and `existingFacade` have been renamed to `demandRequirementById` and `resolved`. Test descriptions referencing "compatibility" have been updated.
No legacy *compatibility* naming (e.g. `compatibilityId`, `AllocationFacade*`, `WithCompatibility`, `FillPlaceholder`) remains in the codebase. The `isPlaceholder` property and `"placeholder"` strategy values are intentionally retained as derived read-model contracts — they describe the demand-vs-assignment distinction at the frontend consumption layer, not legacy migration artifacts.
No legacy _compatibility_ naming (e.g. `compatibilityId`, `AllocationFacade*`, `WithCompatibility`, `FillPlaceholder`) remains in the codebase. The `isPlaceholder` property and `"placeholder"` strategy values are intentionally retained as derived read-model contracts — they describe the demand-vs-assignment distinction at the frontend consumption layer, not legacy migration artifacts.
## Parallel Workstream Note
docs/developer-runbook.md
+22 -22
View File
@@ -9,7 +9,7 @@
```bash
# 1. Repo klonen
git clone <url> capakraken && cd capakraken
git clone <url> nexus && cd nexus
# 2. Root-Env anlegen (NEXTAUTH_SECRET ist Pflicht, kein Default)
cp .env.example .env
@@ -20,7 +20,7 @@ cp .env.example .env
docker compose --profile full up -d
# 4. Warten bis gesund, dann Seed ausführen
docker compose exec app pnpm --filter @capakraken/db exec prisma db seed
docker compose exec app pnpm --filter @nexus/db exec prisma db seed
```
Der App-Container führt beim Start automatisch `prisma migrate deploy` + `prisma generate` aus (via `tooling/docker/app-dev-start.sh`).
@@ -58,10 +58,10 @@ Explizite Literal-Werte im `environment:`-Block haben höchste Priorität und k
Das Flag muss an **zwei Stellen** stehen:
| Ort | Wann aktiv |
|---|---|
| `docker-compose.yml` → `environment:` | Wenn die App im Docker-Container läuft |
| `apps/web/.env.local` | Wenn die App lokal per `pnpm run dev` läuft |
| Ort | Wann aktiv |
| ------------------------------------- | ------------------------------------------- |
| `docker-compose.yml` → `environment:` | Wenn die App im Docker-Container läuft |
| `apps/web/.env.local` | Wenn die App lokal per `pnpm run dev` läuft |
Next.js lädt `.env.local` via Volume-Mount. Docker Compose liest nur seinen eigenen `environment:`-Block. Beide Quellen sind nötig — es gibt keine gemeinsame "eine Stelle".
@@ -133,13 +133,13 @@ node scripts/prisma-with-env.mjs migrate deploy
## Container-Neustart nach Code-Änderungen
| Änderung | Aktion |
|---|---|
| TypeScript-Quellcode | Kein Restart nötig (Hot Reload via Turborepo) |
| `schema.prisma` geändert | `docker compose restart app` (führt `prisma generate` aus) |
| Neue Migration erstellt | `docker compose restart app` (führt `migrate deploy` aus) |
| `docker-compose.yml` geändert | `docker compose --profile full up -d` (recreate) |
| Node-Module aktualisiert | `docker compose build app && docker compose --profile full up -d` |
| Änderung | Aktion |
| ----------------------------- | ----------------------------------------------------------------- |
| TypeScript-Quellcode | Kein Restart nötig (Hot Reload via Turborepo) |
| `schema.prisma` geändert | `docker compose restart app` (führt `prisma generate` aus) |
| Neue Migration erstellt | `docker compose restart app` (führt `migrate deploy` aus) |
| `docker-compose.yml` geändert | `docker compose --profile full up -d` (recreate) |
| Node-Module aktualisiert | `docker compose build app && docker compose --profile full up -d` |
### Nach `--force-recreate` oder Image-Rebuild
@@ -160,13 +160,13 @@ Warten bis: `✓ Ready on http://0.0.0.0:3100`
docker compose --profile full down
# Named Volume löschen (verliert alle Daten!)
docker volume rm capakraken_pgdata
docker volume rm nexus_pgdata
# Neu starten — Container führt beim Start Migrationen aus
docker compose --profile full up -d
# Seed ausführen
docker compose exec app pnpm --filter @capakraken/db exec prisma db seed
docker compose exec app pnpm --filter @nexus/db exec prisma db seed
```
---
@@ -191,10 +191,10 @@ Voraussetzung: Dev-Server läuft auf `localhost:3100` (Docker oder `pnpm run dev
## Häufige Probleme
| Problem | Ursache | Fix |
|---|---|---|
| P3005 bei `migrate deploy` | DB per `db push` initialisiert | `migrate resolve --applied` für jede bestehende Migration |
| P1001 "Can't reach database" | `DATABASE_URL` zeigt auf falschen Host | Im Container ist `localhost` der Container selbst; Docker-interne URL (`postgres:5432`) verwenden |
| tRPC 401 nach E2E-Tests | E2E-Sessions haben echte Sessions aus `active_sessions` verdrängt | `E2E_TEST_MODE=true` setzen (registriert keine `active_sessions`) |
| Auth-Rate-Limit erschöpft | Zu viele Logins in Tests | `globalSetup` nutzt StorageState; direkte `signIn()`-Calls in Tests minimieren |
| Timeline leer nach Tests | E2E-Session hat Admin-Session aus `active_sessions` gekickt | Einloggen + E2E_TEST_MODE prüfen |
| Problem | Ursache | Fix |
| ---------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| P3005 bei `migrate deploy` | DB per `db push` initialisiert | `migrate resolve --applied` für jede bestehende Migration |
| P1001 "Can't reach database" | `DATABASE_URL` zeigt auf falschen Host | Im Container ist `localhost` der Container selbst; Docker-interne URL (`postgres:5432`) verwenden |
| tRPC 401 nach E2E-Tests | E2E-Sessions haben echte Sessions aus `active_sessions` verdrängt | `E2E_TEST_MODE=true` setzen (registriert keine `active_sessions`) |
| Auth-Rate-Limit erschöpft | Zu viele Logins in Tests | `globalSetup` nutzt StorageState; direkte `signIn()`-Calls in Tests minimieren |
| Timeline leer nach Tests | E2E-Session hat Admin-Session aus `active_sessions` gekickt | Einloggen + E2E_TEST_MODE prüfen |
docs/dispo-import-implementation-tickets.md
+3 -3
View File
@@ -1,7 +1,7 @@
# Dispo Import Implementation Tickets
**Date:** 2026-03-14
**Purpose:** Worker-ready implementation tickets for the clean-slate Dispo v2 import defined in [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation.md).
**Purpose:** Worker-ready implementation tickets for the clean-slate Dispo v2 import defined in [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation.md).
## How To Use This Ticket Pack
@@ -68,7 +68,7 @@ Freeze the implementation assumptions so multiple workers do not diverge.
**Deliverables**
- decision log appended to [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation.md)
- decision log appended to [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation.md)
- explicit list of values to seed for roles and internal project buckets
**Acceptance Criteria**
@@ -436,7 +436,7 @@ Apply part-time logic to resource availability without creating fake bookings.
**Goal**
Commit approved staged data into final CapaKraken entities.
Commit approved staged data into final Nexus entities.
**Scope**
docs/dispo-import-implementation.md
+18 -18
View File
@@ -1,11 +1,11 @@
# Dispo Import Implementation
**Date:** 2026-03-14
**Purpose:** Canonical implementation document for replacing the current CapaKraken planning dataset with a clean-slate import from the Dispo v2 Excel workbooks.
**Purpose:** Canonical implementation document for replacing the current Nexus planning dataset with a clean-slate import from the Dispo v2 Excel workbooks.
## Scope
This document defines how CapaKraken should ingest and normalize the following source workbooks:
This document defines how Nexus should ingest and normalize the following source workbooks:
- `/samples/Dispov2/MandatoryDispoCategories_V3.xlsx`
- `/samples/Dispov2/DISPO_2026.xlsx`
@@ -13,7 +13,7 @@ This document defines how CapaKraken should ingest and normalize the following s
- `/samples/Dispov2/MV_DispoRoster.xlsx`
- `/samples/Dispov2/Resource Roster_MASTER_FY26_CJ_20251201.xlsx`
The goal is not a raw workbook archive. The goal is a normalized CapaKraken dataset that:
The goal is not a raw workbook archive. The goal is a normalized Nexus dataset that:
- wipes existing database data and starts from a clean baseline
- imports canonical reference data first
@@ -79,7 +79,7 @@ Use as the source of:
- resource enrichment when missing elsewhere
- aggregate validation after commit
Do not treat PTD/MTD/YTD outputs as canonical source-of-truth records when CapaKraken can derive them from normalized data.
Do not treat PTD/MTD/YTD outputs as canonical source-of-truth records when Nexus can derive them from normalized data.
### 4. `MV_DispoRoster.xlsx`
@@ -151,20 +151,20 @@ The import commits into the existing planning model:
Relevant current schema anchors:
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L178)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L235)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L334)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L372)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L460)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L754)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L780)
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma#L815)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L178)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L235)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L334)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L372)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L460)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L754)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L780)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma#L815)
## Required Implementation Changes
### 1. Canonical Person Identity
CapaKraken currently stores both `eid` and `enterpriseId` on `Resource`. The import should operate on a single canonical identity.
Nexus currently stores both `eid` and `enterpriseId` on `Resource`. The import should operate on a single canonical identity.
Recommendation:
@@ -392,7 +392,7 @@ Assignments should be written only when a project or internal bucket is resolved
| `[_NA] Public Holiday ... {NA}` | `Vacation(type=PUBLIC_HOLIDAY)` | preferred source of truth is geography-driven generation |
| `[_NA] Weekend {NA}` | no vacation row | derive from calendar |
Public holiday implementation should integrate with the existing vacation planner and batch holiday support in [vacation.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/vacation.ts#L425).
Public holiday implementation should integrate with the existing vacation planner and batch holiday support in [vacation.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/vacation.ts#L425).
### Availability and Part-Time Mapping
@@ -506,7 +506,7 @@ Recommended approach:
Known implementation gap:
- the chargeability forecast currently passes an empty `publicHolidays` list into SAH calculation in [chargeability-report.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/chargeability-report.ts#L167)
- the chargeability forecast currently passes an empty `publicHolidays` list into SAH calculation in [chargeability-report.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/chargeability-report.ts#L167)
Required follow-up:
@@ -546,11 +546,11 @@ Required checks:
For the clean-slate import workflow, use dedicated DB scripts instead of ad-hoc SQL:
- reset and bootstrap a disposable environment:
- `pnpm --filter @capakraken/db db:reset:dispo -- --force`
- `pnpm --filter @nexus/db db:reset:dispo -- --force`
- reset without `pg_dump` backup only in an intentionally disposable environment:
- `pnpm --filter @capakraken/db db:reset:dispo -- --force --skip-backup`
- `pnpm --filter @nexus/db db:reset:dispo -- --force --skip-backup`
- seed Dispo v2 reference vocabulary after reset:
- `pnpm --filter @capakraken/db db:seed:dispo-v2`
- `pnpm --filter @nexus/db db:seed:dispo-v2`
The reset command:
docs/domain-slices-backlog.md
+161 -161
View File
@@ -17,15 +17,15 @@ Grobe Gesamtdauer über alle noch offenen Slices: `25-41h`
## Offene Slices
| # | Slice | Status | Restaufwand | Kernziel |
|---|---|---|---:|---|
| 1 | Timeline Interaction, Overlays, Hover, SSE-State | in_progress | 6-10h | Stabile Timeline ohne Render-/Overlay-/Drag-Artefakte, auch bei View-Wechseln und Live-Updates |
| 2 | Holiday/Vacation Correctness and Explainability | in_progress | 1-3h | Feiertage und Urlaube konsistent in Timeline, Chargeability, Forecasts, Assistant und UI-Erklärungen |
| 3 | Assistant Parity, Policy Auto-Exposure, Advanced Queries | in_progress | 5-8h | Assistant kennt und nutzt denselben Berechtigungs- und Datenraum wie der Nutzer, inkl. komplexer Queries |
| 4 | Reports, Templates/Blueprints, Export Completeness | in_progress | 4-6h | Report Builder mit speicherbaren Vorlagen und vollständigen Exportgrößen wie SAH und Bezugsfaktoren |
| 5 | Notifications, Tasks, Broadcasts, Reminder Reliability | in_progress | 3-5h | Robuste Inbox-/Broadcast-/Reminder-Flows ohne leere Fanout- oder Persistenzkanten |
| 6 | Dashboard, Widgets, Explainability, First-Load Stability | in_progress | 4-6h | Dashboard zuverlässig ladbar, Widgets kompakt, nachvollziehbar und per Detail-Toggle kontrollierbar |
| 7 | DB Safety, Env Loading, Migration/Seed Discipline, Naming Cleanup | in_progress | 2-4h | Keine Raw-Prisma/Env-Fallen, kein versehentliches Seeding, keine operativen `planarchy`-Reste |
| # | Slice | Status | Restaufwand | Kernziel |
| --- | ----------------------------------------------------------------- | ----------- | ----------: | -------------------------------------------------------------------------------------------------------- |
| 1 | Timeline Interaction, Overlays, Hover, SSE-State | in_progress | 6-10h | Stabile Timeline ohne Render-/Overlay-/Drag-Artefakte, auch bei View-Wechseln und Live-Updates |
| 2 | Holiday/Vacation Correctness and Explainability | in_progress | 1-3h | Feiertage und Urlaube konsistent in Timeline, Chargeability, Forecasts, Assistant und UI-Erklärungen |
| 3 | Assistant Parity, Policy Auto-Exposure, Advanced Queries | in_progress | 5-8h | Assistant kennt und nutzt denselben Berechtigungs- und Datenraum wie der Nutzer, inkl. komplexer Queries |
| 4 | Reports, Templates/Blueprints, Export Completeness | in_progress | 4-6h | Report Builder mit speicherbaren Vorlagen und vollständigen Exportgrößen wie SAH und Bezugsfaktoren |
| 5 | Notifications, Tasks, Broadcasts, Reminder Reliability | in_progress | 3-5h | Robuste Inbox-/Broadcast-/Reminder-Flows ohne leere Fanout- oder Persistenzkanten |
| 6 | Dashboard, Widgets, Explainability, First-Load Stability | in_progress | 4-6h | Dashboard zuverlässig ladbar, Widgets kompakt, nachvollziehbar und per Detail-Toggle kontrollierbar |
| 7 | DB Safety, Env Loading, Migration/Seed Discipline, Naming Cleanup | in_progress | 2-4h | Keine Raw-Prisma/Env-Fallen, kein versehentliches Seeding, keine operativen `planarchy`-Reste |
## Umsetzungshinweise
@@ -50,122 +50,122 @@ Grobe Gesamtdauer über alle noch offenen Slices: `25-41h`
- [x] Staffing Read Pipeline Split: gemeinsame holiday-/absence-aware Capacity-Zusammenfassung aus `staffing-suggestions-read.ts` und `staffing-best-project-resource.ts` in `staffing-capacity-summary.ts` extrahiert und gegen fokussierte Staffing-/Assistant-Regressionen validiert
- [x] Vacation Read Separation: Holiday-/Deduction-Preview-Shaping aus `vacation-read.ts` in `vacation-read-support.ts` extrahiert und gegen Vacation-Auth-/Router-Regressionen validiert
- [ ] Slice 1: Timeline Interaction, Overlays, Hover, SSE-State
Fortschritt:
Live `cellWidthRef` statt stale Snapshot im Drag-Pfad verdrahtet.
Projekt-Drag zentralisiert finalisiert, sodass MouseUp/Canvas-Up nicht mehr parallel mutieren.
`document`-Listener für Projekt-Drag, Allocation-Drag und Multi-Select werden beim Unmount sauber entfernt.
Timeline-Popovers schließen bei Scroll/Resize nicht mehr sofort, sondern bleiben stabil sichtbar.
Query-Refresh wird pro aktivem Timeline-Kontext statt nur einmal pro Mount erzwungen.
Session-Loading und SSE-Reconnect werden gehärtet, damit erste Route-Loads nicht in einem leeren Zwischenzustand hängen bleiben.
Vacation-SSE und lokale Planning-Invalidierung laden jetzt auch `vacation.list` nach, damit Urlaubsbalken ohne Reload konsistent bleiben.
Allocation-Handles und Move-Flächen stoppen jetzt `mousedown` sauber, damit Resource-/Project-Row-Canvases nicht parallel Range-Selektion starten.
Fortschritt:
Live `cellWidthRef` statt stale Snapshot im Drag-Pfad verdrahtet.
Projekt-Drag zentralisiert finalisiert, sodass MouseUp/Canvas-Up nicht mehr parallel mutieren.
`document`-Listener für Projekt-Drag, Allocation-Drag und Multi-Select werden beim Unmount sauber entfernt.
Timeline-Popovers schließen bei Scroll/Resize nicht mehr sofort, sondern bleiben stabil sichtbar.
Query-Refresh wird pro aktivem Timeline-Kontext statt nur einmal pro Mount erzwungen.
Session-Loading und SSE-Reconnect werden gehärtet, damit erste Route-Loads nicht in einem leeren Zwischenzustand hängen bleiben.
Vacation-SSE und lokale Planning-Invalidierung laden jetzt auch `vacation.list` nach, damit Urlaubsbalken ohne Reload konsistent bleiben.
Allocation-Handles und Move-Flächen stoppen jetzt `mousedown` sauber, damit Resource-/Project-Row-Canvases nicht parallel Range-Selektion starten.
- [ ] Slice 2: Holiday/Vacation Correctness and Explainability
Fortschritt:
Vacation-Deduction-Snapshots werden im UI bereits in `MyVacationsClient` erklärt.
Dieselbe Ableitung wird jetzt auch im Vacation-Kalender per Hover-Tooltip genutzt.
Holiday-Editor-Vorschau zeigt jetzt Scope-/Source-Zusammenfassung plus aufgeloeste Feiertage mit Scope.
`entitlement.getBalanceDetail`, Assistant-Tool `get_vacation_balance` und `BalanceCard` nutzen jetzt denselben holiday-/deduction-aware Explainability-Pfad inkl. Vacation-Breakdown, Holiday-Basis und ausgeschlossenen Feiertagen.
Fokussierte Validierung für Entitlement-/Assistant-Balance und Web-Typecheck ist grün; Alt-Snapshots respektieren weiter persistierte `deductedDays`, während fehlende Snapshots wieder korrekt auf kanonische Feiertagsauflösung zurückfallen.
Entitlement-Jahresübersicht, Assistant-`get_entitlement_summary` und die Manager-Übersicht tragen jetzt auch `countryCode`, `countryName`, `federalState` und `metroCityName`, damit regionale Feiertagsunterschiede als Bezugsgröße sichtbar bleiben.
Assistant-`run_report` liefert für `resource_month` jetzt zusätzlich einen Explainability-Block mit Holiday-/Absence-/Location-Basis, fehlenden empfohlenen Bezugsgrößen und Interpretationshinweisen zur SAH-Ableitung.
Chargeability-Detailpfad und Assistant-`get_chargeability_report` tragen jetzt ebenfalls einen Explainability-Block mit Ortsbezug, Herleitungsfeldern, Formeln und aktiven Filtern, damit dieselbe SAH-/Holiday-/Absence-Logik auch im Forecast-Readmodel transparent ist.
Chargeability-Frontend zeigt dieselbe Berechnungsbasis jetzt kompakt an; der Excel-Export enthält zusätzlich ein Explainability-Sheet mit Formeln, Filtern und Bezugsgrößen.
Budget-Forecast-Readmodel, Dashboard-Detail und Assistant-`get_budget_forecast` tragen jetzt ebenfalls eine kompakte Burn-Herleitung mit Base-vs-Adjusted-Burn, Holiday-/Absence-Abzügen, Holiday-aware-vs-Fallback-Assignments und Anzahl der Kalenderkontexte; das Widget zeigt diese Herleitung nur im Detailmodus an.
Project-Health-Readmodel, Dashboard-Detail und Assistant-`get_project_health` tragen jetzt ebenfalls eine explizite Budget-Herleitung mit Base-vs-Adjusted-Spend, Holiday-/Absence-Abzügen, Holiday-aware-vs-Fallback-Assignments und Kalenderkontexten; das Widget zeigt diese Basis nur im Detailmodus an.
Nächster Fokus: verbleibende Forecast-/Widget-Parität derselben Ableitungen schließen.
Fortschritt:
Vacation-Deduction-Snapshots werden im UI bereits in `MyVacationsClient` erklärt.
Dieselbe Ableitung wird jetzt auch im Vacation-Kalender per Hover-Tooltip genutzt.
Holiday-Editor-Vorschau zeigt jetzt Scope-/Source-Zusammenfassung plus aufgeloeste Feiertage mit Scope.
`entitlement.getBalanceDetail`, Assistant-Tool `get_vacation_balance` und `BalanceCard` nutzen jetzt denselben holiday-/deduction-aware Explainability-Pfad inkl. Vacation-Breakdown, Holiday-Basis und ausgeschlossenen Feiertagen.
Fokussierte Validierung für Entitlement-/Assistant-Balance und Web-Typecheck ist grün; Alt-Snapshots respektieren weiter persistierte `deductedDays`, während fehlende Snapshots wieder korrekt auf kanonische Feiertagsauflösung zurückfallen.
Entitlement-Jahresübersicht, Assistant-`get_entitlement_summary` und die Manager-Übersicht tragen jetzt auch `countryCode`, `countryName`, `federalState` und `metroCityName`, damit regionale Feiertagsunterschiede als Bezugsgröße sichtbar bleiben.
Assistant-`run_report` liefert für `resource_month` jetzt zusätzlich einen Explainability-Block mit Holiday-/Absence-/Location-Basis, fehlenden empfohlenen Bezugsgrößen und Interpretationshinweisen zur SAH-Ableitung.
Chargeability-Detailpfad und Assistant-`get_chargeability_report` tragen jetzt ebenfalls einen Explainability-Block mit Ortsbezug, Herleitungsfeldern, Formeln und aktiven Filtern, damit dieselbe SAH-/Holiday-/Absence-Logik auch im Forecast-Readmodel transparent ist.
Chargeability-Frontend zeigt dieselbe Berechnungsbasis jetzt kompakt an; der Excel-Export enthält zusätzlich ein Explainability-Sheet mit Formeln, Filtern und Bezugsgrößen.
Budget-Forecast-Readmodel, Dashboard-Detail und Assistant-`get_budget_forecast` tragen jetzt ebenfalls eine kompakte Burn-Herleitung mit Base-vs-Adjusted-Burn, Holiday-/Absence-Abzügen, Holiday-aware-vs-Fallback-Assignments und Anzahl der Kalenderkontexte; das Widget zeigt diese Herleitung nur im Detailmodus an.
Project-Health-Readmodel, Dashboard-Detail und Assistant-`get_project_health` tragen jetzt ebenfalls eine explizite Budget-Herleitung mit Base-vs-Adjusted-Spend, Holiday-/Absence-Abzügen, Holiday-aware-vs-Fallback-Assignments und Kalenderkontexten; das Widget zeigt diese Basis nur im Detailmodus an.
Nächster Fokus: verbleibende Forecast-/Widget-Parität derselben Ableitungen schließen.
- [ ] Slice 3: Assistant Parity, Policy Auto-Exposure, Advanced Queries
Fortschritt:
Tool-Sichtbarkeit und Laufzeit-Guarding auf gemeinsame Registry-/Access-Metadaten gezogen.
Estimate-Tools tragen jetzt explizite Rollen-/Permission-/Cost-Metadaten statt impliziter Alt-Policy.
Fokussierte Assistant-Policy-Regressionstests laufen gegen dieselbe zentrale Quelle.
Tool-Selektion priorisiert Holiday-/Vacation-/Entitlement- sowie Dashboard-/Report-Anfragen jetzt gezielter, damit diese Tools unter dem OpenAI-128-Limit erhalten bleiben.
Top-Level-Chat-/Approval-/Prompt-Orchestrierung ist jetzt in `assistant-procedure-support.ts` und `assistant-system-prompt.ts` extrahiert; API-Typecheck plus fokussierte Assistant-Suite laufen wieder grün.
Produktive AI-Fallbacks, Admin-UI-Platzhalter und Settings-Default im Frontend zeigen jetzt konsistent `gpt-5.4` statt alter `gpt-4o-mini`-Defaults; die fokussierte Assistant-/Settings-/Insights-Suite dafür ist grün validiert.
Fortschritt:
Tool-Sichtbarkeit und Laufzeit-Guarding auf gemeinsame Registry-/Access-Metadaten gezogen.
Estimate-Tools tragen jetzt explizite Rollen-/Permission-/Cost-Metadaten statt impliziter Alt-Policy.
Fokussierte Assistant-Policy-Regressionstests laufen gegen dieselbe zentrale Quelle.
Tool-Selektion priorisiert Holiday-/Vacation-/Entitlement- sowie Dashboard-/Report-Anfragen jetzt gezielter, damit diese Tools unter dem OpenAI-128-Limit erhalten bleiben.
Top-Level-Chat-/Approval-/Prompt-Orchestrierung ist jetzt in `assistant-procedure-support.ts` und `assistant-system-prompt.ts` extrahiert; API-Typecheck plus fokussierte Assistant-Suite laufen wieder grün.
Produktive AI-Fallbacks, Admin-UI-Platzhalter und Settings-Default im Frontend zeigen jetzt konsistent `gpt-5.4` statt alter `gpt-4o-mini`-Defaults; die fokussierte Assistant-/Settings-/Insights-Suite dafür ist grün validiert.
- [ ] Slice 4: Reports, Templates/Blueprints, Export Completeness
Fokus:
Report-Templates/Blueprints, SAH-/Bezugsgrößen-Vollständigkeit und Export-Parität zur UI weiterziehen.
Fortschritt:
Report Builder exponiert Template-Beschreibung und Shared-Status jetzt auch im Frontend statt nur im Backend-Vertrag.
Gespeicherter Template-Status vs. lokal geänderte Builder-Konfiguration wird jetzt explizit angezeigt, damit lokale Draft-Änderungen nicht mehr wie persistierte Vorlagen wirken.
Duplicate-Template-Saves werden jetzt fachlich als `CONFLICT` mit verständlicher Meldung statt als roher DB-Fehler zurückgegeben.
`resource_month`-Explainability ist jetzt im gemeinsamen Report-Pfad statt nur im Assistant-Sonderfall verdrahtet; der Builder zeigt dieselbe Holiday-/Absence-/SAH-Basis kompakt im Result-Header an.
`resource_month`-Exporte laufen jetzt als XLSX mit separatem Explainability-Sheet, damit SAH-/Kalender-/Feiertagslogik im Export nachvollziehbar bleibt ohne Logik in Excel neu aufzubauen.
Der `resource_month`-Blueprint-/Preset-Katalog kommt jetzt aus einem gemeinsamen Backend-Vertrag inklusive Runtime-Output-Schema statt aus lokalem Frontend-Hardcode; fokussierte Router-/Typecheck-Validierung dafür ist grün.
`resource`, `project` und `assignment` tragen jetzt zusätzliche Bezugsgrößen wie Blueprint, Client Unit, Enterprise ID, Value Score, Shoring-/Onshore-Felder sowie Resource-/Project-Kontext an Assignments in den Report-Spaltenkatalog.
Nächster Fokus: verbleibende Report-/Export-Vollständigkeit an echten Nutzerflows prüfen, insbesondere Frontend-/Export-Verhalten außerhalb von `resource_month`.
Fokus:
Report-Templates/Blueprints, SAH-/Bezugsgrößen-Vollständigkeit und Export-Parität zur UI weiterziehen.
Fortschritt:
Report Builder exponiert Template-Beschreibung und Shared-Status jetzt auch im Frontend statt nur im Backend-Vertrag.
Gespeicherter Template-Status vs. lokal geänderte Builder-Konfiguration wird jetzt explizit angezeigt, damit lokale Draft-Änderungen nicht mehr wie persistierte Vorlagen wirken.
Duplicate-Template-Saves werden jetzt fachlich als `CONFLICT` mit verständlicher Meldung statt als roher DB-Fehler zurückgegeben.
`resource_month`-Explainability ist jetzt im gemeinsamen Report-Pfad statt nur im Assistant-Sonderfall verdrahtet; der Builder zeigt dieselbe Holiday-/Absence-/SAH-Basis kompakt im Result-Header an.
`resource_month`-Exporte laufen jetzt als XLSX mit separatem Explainability-Sheet, damit SAH-/Kalender-/Feiertagslogik im Export nachvollziehbar bleibt ohne Logik in Excel neu aufzubauen.
Der `resource_month`-Blueprint-/Preset-Katalog kommt jetzt aus einem gemeinsamen Backend-Vertrag inklusive Runtime-Output-Schema statt aus lokalem Frontend-Hardcode; fokussierte Router-/Typecheck-Validierung dafür ist grün.
`resource`, `project` und `assignment` tragen jetzt zusätzliche Bezugsgrößen wie Blueprint, Client Unit, Enterprise ID, Value Score, Shoring-/Onshore-Felder sowie Resource-/Project-Kontext an Assignments in den Report-Spaltenkatalog.
Nächster Fokus: verbleibende Report-/Export-Vollständigkeit an echten Nutzerflows prüfen, insbesondere Frontend-/Export-Verhalten außerhalb von `resource_month`.
- [ ] Slice 5: Notifications, Tasks, Broadcasts, Reminder Reliability
Fortschritt:
Notification-/Reminder-/Webhook-Testtrio ist grün validiert.
Zukünftige Scheduled Broadcasts mit Task-/Approval-Metadaten werden jetzt hart abgewiesen, damit `taskAction`/`dueDate` nicht still verloren gehen.
Broadcast-Fanout mappt jetzt auch verlorene `sourceId`-/Sender-Referenzen stabil auf fachliche `NOT_FOUND`-Fehler statt rohe FK-Fehler.
Nicht-terminale Task-Statuswechsel bereinigen jetzt `completedAt`/`completedBy` deterministisch, damit wiedergeöffnete Tasks fachlich und technisch konsistent bleiben.
Wiederkehrende Reminder ziehen `nextRemindAt` nach Downtime jetzt direkt auf den ersten Termin nach `now` vor, damit überfällige Serien-Erinnerungen nicht auf jedem Scheduler-Tick erneut feuern.
Task-Reassignment mappt fehlende `assigneeId`-Referenzen jetzt über den gemeinsamen Notification-Fehlerpfad stabil auf `NOT_FOUND`, statt rohe FK-Fehler aus dem Core-Router nach oben zu reichen.
Immediate Broadcasts werden jetzt ohne `$transaction` hart abgewiesen, damit es keinen nicht-atomaren Fan-out-Fallback mit Teilpersistenz mehr gibt.
Broadcast-Fanout gegen fehlende Empfänger ist jetzt ebenfalls fokussiert abgesichert: `userId`-FK-Verlust im Recipient-Create mappt stabil auf fachliches `NOT_FOUND`, ohne Broadcast-Finalisierung, SSE oder E-Mail-Nebenwirkungen.
Direkte Router-Writes für `notification.create` und `notification.createTask` nutzen jetzt denselben kontextsensitiven Notification-Fehlerpfad wie Assistant/Broadcast, sodass fehlende Recipient-/Sender-Referenzen als fachliche `NOT_FOUND`-Fehler statt rohe Prisma-FKs herauskommen.
`executeTaskAction` blockt jetzt auch `DISMISSED` als terminalen Zustand und läuft nur noch transaktional, damit Domain-Aktion und Task-Abschluss nicht mehr auseinanderlaufen; die Assistant-Test-Helpers spiegeln denselben Transaction-Contract jetzt ebenfalls.
Reminder-Updates und -Deletes sind jetzt auch gegen Missing-/Wrong-Owner-Fälle fokussiert regressionsgesichert, damit die fachliche `NOT_FOUND`-Oberfläche stabil bleibt.
`assignTask` fängt jetzt auch den Read-then-Update-Race auf gelöschte Tasks sauber als fachliches `NOT_FOUND` ab; Missing-Task- und Wrong-Category-Pfade sind auf Router-Ebene zusätzlich abgesichert.
Nächster Fokus: verbleibende Persistenz-/Broadcast-Kanten schließen.
Fortschritt:
Notification-/Reminder-/Webhook-Testtrio ist grün validiert.
Zukünftige Scheduled Broadcasts mit Task-/Approval-Metadaten werden jetzt hart abgewiesen, damit `taskAction`/`dueDate` nicht still verloren gehen.
Broadcast-Fanout mappt jetzt auch verlorene `sourceId`-/Sender-Referenzen stabil auf fachliche `NOT_FOUND`-Fehler statt rohe FK-Fehler.
Nicht-terminale Task-Statuswechsel bereinigen jetzt `completedAt`/`completedBy` deterministisch, damit wiedergeöffnete Tasks fachlich und technisch konsistent bleiben.
Wiederkehrende Reminder ziehen `nextRemindAt` nach Downtime jetzt direkt auf den ersten Termin nach `now` vor, damit überfällige Serien-Erinnerungen nicht auf jedem Scheduler-Tick erneut feuern.
Task-Reassignment mappt fehlende `assigneeId`-Referenzen jetzt über den gemeinsamen Notification-Fehlerpfad stabil auf `NOT_FOUND`, statt rohe FK-Fehler aus dem Core-Router nach oben zu reichen.
Immediate Broadcasts werden jetzt ohne `$transaction` hart abgewiesen, damit es keinen nicht-atomaren Fan-out-Fallback mit Teilpersistenz mehr gibt.
Broadcast-Fanout gegen fehlende Empfänger ist jetzt ebenfalls fokussiert abgesichert: `userId`-FK-Verlust im Recipient-Create mappt stabil auf fachliches `NOT_FOUND`, ohne Broadcast-Finalisierung, SSE oder E-Mail-Nebenwirkungen.
Direkte Router-Writes für `notification.create` und `notification.createTask` nutzen jetzt denselben kontextsensitiven Notification-Fehlerpfad wie Assistant/Broadcast, sodass fehlende Recipient-/Sender-Referenzen als fachliche `NOT_FOUND`-Fehler statt rohe Prisma-FKs herauskommen.
`executeTaskAction` blockt jetzt auch `DISMISSED` als terminalen Zustand und läuft nur noch transaktional, damit Domain-Aktion und Task-Abschluss nicht mehr auseinanderlaufen; die Assistant-Test-Helpers spiegeln denselben Transaction-Contract jetzt ebenfalls.
Reminder-Updates und -Deletes sind jetzt auch gegen Missing-/Wrong-Owner-Fälle fokussiert regressionsgesichert, damit die fachliche `NOT_FOUND`-Oberfläche stabil bleibt.
`assignTask` fängt jetzt auch den Read-then-Update-Race auf gelöschte Tasks sauber als fachliches `NOT_FOUND` ab; Missing-Task- und Wrong-Category-Pfade sind auf Router-Ebene zusätzlich abgesichert.
Nächster Fokus: verbleibende Persistenz-/Broadcast-Kanten schließen.
- [ ] Slice 6: Dashboard, Widgets, Explainability, First-Load Stability
Fortschritt:
Peak Times komprimiert die Summary-Leiste jetzt in drei kompakte Pills statt großer redundanter Karten.
Zusatztexte und Erklärinfos bleiben dort jetzt konsequent hinter dem Details-Toggle.
Budget Forecast reduziert Summary-Helfertexte und sekundäre Zeilendetails jetzt ebenfalls sauber bei `Details off`.
Dashboard-Layout-Hydration überschreibt beim First Load lokale Nutzeraktionen nicht mehr, wenn DB-Layout und erste Interaktion race-condition-artig aufeinandertreffen; fokussierte Hook-/Widget-Tests dafür sind grün.
Top-Value-Ressourcen tragen jetzt auch `countryName` durch Readmodel, API-Detailpfad und Widget-Lokationsanzeige, damit Kalender-/Feiertagsbezug nicht nur als Kürzel sichtbar ist.
Top-Value trägt jetzt zusätzlich `valueScoreBreakdown` und `valueScoreUpdatedAt` bis in API-/Assistant-Detailpfade und Widget-Hover durch, damit die Score-Herleitung nachvollziehbar bleibt ohne den Default-View mit Text zu überladen.
Peak Times trägt jetzt pro Periode `calendarContextCount` plus kompakte `calendarLocations` aus dem Application-Layer bis in Widget-Hover, Detailpanel und `get_dashboard_detail`, damit regionale Feiertags-/Standortbasis auch für Auslastungsspitzen sichtbar bleibt.
Fortschritt:
Peak Times komprimiert die Summary-Leiste jetzt in drei kompakte Pills statt großer redundanter Karten.
Zusatztexte und Erklärinfos bleiben dort jetzt konsequent hinter dem Details-Toggle.
Budget Forecast reduziert Summary-Helfertexte und sekundäre Zeilendetails jetzt ebenfalls sauber bei `Details off`.
Dashboard-Layout-Hydration überschreibt beim First Load lokale Nutzeraktionen nicht mehr, wenn DB-Layout und erste Interaktion race-condition-artig aufeinandertreffen; fokussierte Hook-/Widget-Tests dafür sind grün.
Top-Value-Ressourcen tragen jetzt auch `countryName` durch Readmodel, API-Detailpfad und Widget-Lokationsanzeige, damit Kalender-/Feiertagsbezug nicht nur als Kürzel sichtbar ist.
Top-Value trägt jetzt zusätzlich `valueScoreBreakdown` und `valueScoreUpdatedAt` bis in API-/Assistant-Detailpfade und Widget-Hover durch, damit die Score-Herleitung nachvollziehbar bleibt ohne den Default-View mit Text zu überladen.
Peak Times trägt jetzt pro Periode `calendarContextCount` plus kompakte `calendarLocations` aus dem Application-Layer bis in Widget-Hover, Detailpanel und `get_dashboard_detail`, damit regionale Feiertags-/Standortbasis auch für Auslastungsspitzen sichtbar bleibt.
- [ ] Slice 7: DB Safety, Env Loading, Migration/Seed Discipline, Naming Cleanup
Fortschritt:
Repo-Wrapper für Env-Laden sind gesetzt; aktuelle Assistant-, Import/Export- und Insights-Tests sowie der Web-Typecheck laufen grün.
Operative Altspuren `planarchy` kommen derzeit noch über einen Symlink-Pfad und einzelne Logs/Artefakte hinein und werden weiter bereinigt.
`pnpm db:prisma -- ...` prüft jetzt für destruktive oder schemawirksame Prisma-Kommandos hart, dass `DATABASE_URL` wirklich auf `capakraken` zeigt; falsche Ziele wie `planarchy` werden vor jedem Prisma-Zugriff blockiert.
Aktive Worker:
Worker A: Slice 5 Notification-/Broadcast-Persistenzkanten.
Worker B: Slice 2 Holiday-/Vacation-Explainability in Forecast-/Widget-Parität.
Lokal: Slice 1 Timeline-Stabilität, Slice 3 Assistant-Parity, Slice 7 DB-/Env-Guardrails und Naming-Cleanup.
Fortschritt:
Repo-Wrapper für Env-Laden sind gesetzt; aktuelle Assistant-, Import/Export- und Insights-Tests sowie der Web-Typecheck laufen grün.
Operative Altspuren `planarchy` kommen derzeit noch über einen Symlink-Pfad und einzelne Logs/Artefakte hinein und werden weiter bereinigt.
`pnpm db:prisma -- ...` prüft jetzt für destruktive oder schemawirksame Prisma-Kommandos hart, dass `DATABASE_URL` wirklich auf `nexus` zeigt; falsche Ziele wie `planarchy` werden vor jedem Prisma-Zugriff blockiert.
Aktive Worker:
Worker A: Slice 5 Notification-/Broadcast-Persistenzkanten.
Worker B: Slice 2 Holiday-/Vacation-Explainability in Forecast-/Widget-Parität.
Lokal: Slice 1 Timeline-Stabilität, Slice 3 Assistant-Parity, Slice 7 DB-/Env-Guardrails und Naming-Cleanup.
## Validierter Stand
- Assistant-Regressionen: `8` fokussierte Testdateien, `36` Tests grün.
- Assistant-/Settings-/Insights-/AI-Defaults: `8` fokussierte Testdateien, `30` Tests grün.
- Web-Typecheck: `pnpm --filter @capakraken/web exec tsc -p tsconfig.typecheck.json --noEmit` grün.
- Timeline/SSE-Regressionen: `pnpm --filter @capakraken/api exec vitest run src/__tests__/timeline-router.test.ts src/__tests__/sse-subscription-policy.test.ts` grün (`15` Tests).
- Dashboard WidgetContainer: `pnpm --filter @capakraken/web exec vitest run src/components/dashboard/WidgetContainer.test.tsx` grün (`2` Tests).
- Insights Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/insights-router.test.ts src/__tests__/insights-procedure-support.test.ts` grün (`9` Tests).
- Country Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/country-router.test.ts src/__tests__/country-procedure-support.test.ts src/__tests__/country-support.test.ts` grün (`12` Tests).
- Holiday Calendar Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/holiday-calendar-router.test.ts src/__tests__/holiday-calendar-router-auth.test.ts src/__tests__/holiday-calendar-procedure-support.test.ts src/__tests__/holiday-calendar-support.test.ts src/__tests__/holiday-calendar-write-support.test.ts` grün (`26` Tests).
- Dispo Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/dispo-router.test.ts src/__tests__/dispo-procedure-support.test.ts src/__tests__/dispo-management-support.test.ts` grün (`10` Tests).
- Org Unit + Import/Export Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/org-unit-router.test.ts src/__tests__/org-unit-procedure-support.test.ts src/__tests__/org-unit-support.test.ts src/__tests__/import-export-router.test.ts src/__tests__/import-export-procedure-support.test.ts` grün (`19` Tests).
- Estimate Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/estimate-router.test.ts` grün (`45` Tests).
- Import/Export Procedure Support: `pnpm --filter @capakraken/api exec vitest run src/__tests__/import-export-procedure-support.test.ts` grün (`5` Tests).
- Assistant Tool Selection: `pnpm --filter @capakraken/api exec vitest run src/__tests__/assistant-tool-selection.test.ts` grün (`3` Tests).
- Assistant Split Regression Runner: `pnpm --filter @capakraken/api test:assistant-split` als explizite Fünf-Batch-Regression plus API-Typecheck etabliert; deckt jetzt auch `export_projects_csv`, Holiday-Resolution-Fehlerpfade und `get_timeline_holiday_overlays` ab.
- Assistant Report Read: `pnpm --filter @capakraken/api exec vitest run src/__tests__/assistant-tools-report-read.test.ts` grün (`3` Tests).
- Report Router: `pnpm --filter @capakraken/api exec vitest run src/__tests__/report-router.test.ts` grün (`8` Tests).
- Report Explainability/Export Parity: `pnpm --filter @capakraken/api exec vitest run src/__tests__/report-router.test.ts src/__tests__/assistant-tools-report-read.test.ts` grün (`11` Tests), `pnpm --filter @capakraken/web exec vitest run src/components/reports/reportBuilderExplainability.test.ts` grün (`2` Tests).
- Report Blueprint Catalog Contract: `pnpm --filter @capakraken/api exec vitest run src/__tests__/report-router.test.ts` grün (`9` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün, `pnpm --filter @capakraken/web exec vitest run src/components/reports/reportBuilderExplainability.test.ts` grün (`2` Tests).
- Report Column Coverage Expansion: `pnpm --filter @capakraken/api exec vitest run src/__tests__/report-router.test.ts` grün (`11` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Chargeability Report Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/chargeability-report-router.test.ts src/__tests__/assistant-tools-chargeability-report.test.ts` grün (`7` Tests).
- Notification Router + Reminder Scheduler: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-router.test.ts src/__tests__/reminder-scheduler.test.ts` grün (`41` Tests).
- Project Health Explainability: `pnpm --filter @capakraken/application exec vitest run src/__tests__/dashboard.test.ts -t "excludes regional public holidays from project health budget usage"` grün (`1` Test), `pnpm --filter @capakraken/api exec vitest run src/__tests__/dashboard-router.test.ts -t "getProjectHealthDetail"` grün (`1` Test), `pnpm --filter @capakraken/api exec vitest run src/__tests__/assistant-tools-dashboard-project-health.test.ts` grün (`1` Test).
- Dashboard Top Value Country Context: `pnpm --filter @capakraken/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/dashboard-router.test.ts` grün (`19` Tests).
- Dashboard Top Value Explainability: `pnpm --filter @capakraken/application exec vitest run src/__tests__/dashboard.test.ts -t "enforces visible-role filtering for top value resources"` grün (`1` Test), `pnpm --filter @capakraken/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/dashboard-router.test.ts src/__tests__/assistant-tools-dashboard-detail.test.ts` grün (`20` Tests), `pnpm --filter @capakraken/web exec vitest run src/components/dashboard/widgets/TopValueWidget.test.tsx` grün (`1` Test).
- Peak Times Calendar Explainability: `pnpm --filter @capakraken/application exec vitest run src/__tests__/dashboard.test.ts -t "peak times"` grün (`4` Tests aktiv, `17` geskippt), `pnpm --filter @capakraken/web exec vitest run src/components/dashboard/widgets/PeakTimesWidget.test.tsx` grün (`1` Test), `pnpm --filter @capakraken/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/assistant-tools-dashboard-detail.test.ts` grün (`4` Tests).
- Notification Task Reopen Reliability: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-router.test.ts` grün (`37` Tests).
- Notification Task Assignment Reference Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts` grün (`46` Tests).
- Notification Immediate Broadcast Transaction Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-router.test.ts` grün (`40` Tests).
- Notification Broadcast Recipient Reference Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts` grün (`49` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Direct Create/CreateTask Reference Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts src/__tests__/assistant-tools-notification-create-errors.test.ts src/__tests__/assistant-tools-task-create-errors.test.ts` grün (`60` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Task Action Transaction Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-router.test.ts src/__tests__/assistant-tools-task-action-guards.test.ts src/__tests__/assistant-tools-task-action-execution.test.ts src/__tests__/assistant-tools-task-action-assignment-errors.test.ts src/__tests__/assistant-tools-task-action-vacation-errors.test.ts` grün (`56` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Reminder Ownership + AssignTask Race Guard: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-router.test.ts` grün (`51` Tests), `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Support + Assistant Router: `pnpm --filter @capakraken/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts src/__tests__/notification-router-auth.test.ts src/__tests__/assistant-router.test.ts src/__tests__/assistant-router-auth.test.ts src/__tests__/assistant-chat-loop.test.ts src/__tests__/assistant-chat-response.test.ts src/__tests__/assistant-tool-selection.test.ts src/__tests__/assistant-approvals.test.ts src/__tests__/assistant-procedure-support.test.ts` grün (`74` Tests).
- Assistant Broadcast Validation: `pnpm --filter @capakraken/api exec vitest run src/__tests__/assistant-tools-broadcast-send-validation-errors.test.ts` grün (`3` Tests).
- Staffing Read Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/staffing-router.test.ts src/__tests__/assistant-tools-holiday-staffing-suggestions.test.ts src/__tests__/assistant-tools-advanced-resource-ranking.test.ts` grün (`32` Tests).
- Vacation Read Slice: `pnpm --filter @capakraken/api exec vitest run src/__tests__/vacation-router.test.ts src/__tests__/vacation-router-auth.test.ts` grün (`58` Tests).
- API-Typecheck: `pnpm --filter @capakraken/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Web-Typecheck: `pnpm --filter @nexus/web exec tsc -p tsconfig.typecheck.json --noEmit` grün.
- Timeline/SSE-Regressionen: `pnpm --filter @nexus/api exec vitest run src/__tests__/timeline-router.test.ts src/__tests__/sse-subscription-policy.test.ts` grün (`15` Tests).
- Dashboard WidgetContainer: `pnpm --filter @nexus/web exec vitest run src/components/dashboard/WidgetContainer.test.tsx` grün (`2` Tests).
- Insights Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/insights-router.test.ts src/__tests__/insights-procedure-support.test.ts` grün (`9` Tests).
- Country Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/country-router.test.ts src/__tests__/country-procedure-support.test.ts src/__tests__/country-support.test.ts` grün (`12` Tests).
- Holiday Calendar Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/holiday-calendar-router.test.ts src/__tests__/holiday-calendar-router-auth.test.ts src/__tests__/holiday-calendar-procedure-support.test.ts src/__tests__/holiday-calendar-support.test.ts src/__tests__/holiday-calendar-write-support.test.ts` grün (`26` Tests).
- Dispo Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/dispo-router.test.ts src/__tests__/dispo-procedure-support.test.ts src/__tests__/dispo-management-support.test.ts` grün (`10` Tests).
- Org Unit + Import/Export Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/org-unit-router.test.ts src/__tests__/org-unit-procedure-support.test.ts src/__tests__/org-unit-support.test.ts src/__tests__/import-export-router.test.ts src/__tests__/import-export-procedure-support.test.ts` grün (`19` Tests).
- Estimate Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/estimate-router.test.ts` grün (`45` Tests).
- Import/Export Procedure Support: `pnpm --filter @nexus/api exec vitest run src/__tests__/import-export-procedure-support.test.ts` grün (`5` Tests).
- Assistant Tool Selection: `pnpm --filter @nexus/api exec vitest run src/__tests__/assistant-tool-selection.test.ts` grün (`3` Tests).
- Assistant Split Regression Runner: `pnpm --filter @nexus/api test:assistant-split` als explizite Fünf-Batch-Regression plus API-Typecheck etabliert; deckt jetzt auch `export_projects_csv`, Holiday-Resolution-Fehlerpfade und `get_timeline_holiday_overlays` ab.
- Assistant Report Read: `pnpm --filter @nexus/api exec vitest run src/__tests__/assistant-tools-report-read.test.ts` grün (`3` Tests).
- Report Router: `pnpm --filter @nexus/api exec vitest run src/__tests__/report-router.test.ts` grün (`8` Tests).
- Report Explainability/Export Parity: `pnpm --filter @nexus/api exec vitest run src/__tests__/report-router.test.ts src/__tests__/assistant-tools-report-read.test.ts` grün (`11` Tests), `pnpm --filter @nexus/web exec vitest run src/components/reports/reportBuilderExplainability.test.ts` grün (`2` Tests).
- Report Blueprint Catalog Contract: `pnpm --filter @nexus/api exec vitest run src/__tests__/report-router.test.ts` grün (`9` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün, `pnpm --filter @nexus/web exec vitest run src/components/reports/reportBuilderExplainability.test.ts` grün (`2` Tests).
- Report Column Coverage Expansion: `pnpm --filter @nexus/api exec vitest run src/__tests__/report-router.test.ts` grün (`11` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Chargeability Report Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/chargeability-report-router.test.ts src/__tests__/assistant-tools-chargeability-report.test.ts` grün (`7` Tests).
- Notification Router + Reminder Scheduler: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-router.test.ts src/__tests__/reminder-scheduler.test.ts` grün (`41` Tests).
- Project Health Explainability: `pnpm --filter @nexus/application exec vitest run src/__tests__/dashboard.test.ts -t "excludes regional public holidays from project health budget usage"` grün (`1` Test), `pnpm --filter @nexus/api exec vitest run src/__tests__/dashboard-router.test.ts -t "getProjectHealthDetail"` grün (`1` Test), `pnpm --filter @nexus/api exec vitest run src/__tests__/assistant-tools-dashboard-project-health.test.ts` grün (`1` Test).
- Dashboard Top Value Country Context: `pnpm --filter @nexus/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/dashboard-router.test.ts` grün (`19` Tests).
- Dashboard Top Value Explainability: `pnpm --filter @nexus/application exec vitest run src/__tests__/dashboard.test.ts -t "enforces visible-role filtering for top value resources"` grün (`1` Test), `pnpm --filter @nexus/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/dashboard-router.test.ts src/__tests__/assistant-tools-dashboard-detail.test.ts` grün (`20` Tests), `pnpm --filter @nexus/web exec vitest run src/components/dashboard/widgets/TopValueWidget.test.tsx` grün (`1` Test).
- Peak Times Calendar Explainability: `pnpm --filter @nexus/application exec vitest run src/__tests__/dashboard.test.ts -t "peak times"` grün (`4` Tests aktiv, `17` geskippt), `pnpm --filter @nexus/web exec vitest run src/components/dashboard/widgets/PeakTimesWidget.test.tsx` grün (`1` Test), `pnpm --filter @nexus/api exec vitest run src/__tests__/dashboard-procedure-support.test.ts src/__tests__/assistant-tools-dashboard-detail.test.ts` grün (`4` Tests).
- Notification Task Reopen Reliability: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-router.test.ts` grün (`37` Tests).
- Notification Task Assignment Reference Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts` grün (`46` Tests).
- Notification Immediate Broadcast Transaction Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-router.test.ts` grün (`40` Tests).
- Notification Broadcast Recipient Reference Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts` grün (`49` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Direct Create/CreateTask Reference Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts src/__tests__/assistant-tools-notification-create-errors.test.ts src/__tests__/assistant-tools-task-create-errors.test.ts` grün (`60` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Task Action Transaction Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-router.test.ts src/__tests__/assistant-tools-task-action-guards.test.ts src/__tests__/assistant-tools-task-action-execution.test.ts src/__tests__/assistant-tools-task-action-assignment-errors.test.ts src/__tests__/assistant-tools-task-action-vacation-errors.test.ts` grün (`56` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Reminder Ownership + AssignTask Race Guard: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-router.test.ts` grün (`51` Tests), `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
- Notification Support + Assistant Router: `pnpm --filter @nexus/api exec vitest run src/__tests__/notification-procedure-support.test.ts src/__tests__/notification-router.test.ts src/__tests__/notification-router-auth.test.ts src/__tests__/assistant-router.test.ts src/__tests__/assistant-router-auth.test.ts src/__tests__/assistant-chat-loop.test.ts src/__tests__/assistant-chat-response.test.ts src/__tests__/assistant-tool-selection.test.ts src/__tests__/assistant-approvals.test.ts src/__tests__/assistant-procedure-support.test.ts` grün (`74` Tests).
- Assistant Broadcast Validation: `pnpm --filter @nexus/api exec vitest run src/__tests__/assistant-tools-broadcast-send-validation-errors.test.ts` grün (`3` Tests).
- Staffing Read Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/staffing-router.test.ts src/__tests__/assistant-tools-holiday-staffing-suggestions.test.ts src/__tests__/assistant-tools-advanced-resource-ranking.test.ts` grün (`32` Tests).
- Vacation Read Slice: `pnpm --filter @nexus/api exec vitest run src/__tests__/vacation-router.test.ts src/__tests__/vacation-router-auth.test.ts` grün (`58` Tests).
- API-Typecheck: `pnpm --filter @nexus/api exec tsc -p tsconfig.json --noEmit --pretty false` grün.
## API Router Slice Inventory
@@ -185,44 +185,44 @@ oder benachbarte Support-Module, Verhalten und öffentliche Contracts bleiben st
### Vollständige Router-Liste
| Router | Status | Priorität | Sinnvolle Slices |
|---|---|---:|---|
| `allocation.ts` | done | - | Aggregator bereits dünn; nur Support-Module weiter pflegen |
| `assistant.ts` | done | - | top-level chat, approval payloads und system prompt in Support-Module extrahiert |
| `audit-log.ts` | monitor | 4 | Optional: list/detail reads und filter-building trennen, falls Auth/Wiring wächst |
| `blueprint.ts` | done | - | summary/list reads, identifier reads, CRUD, role-preset mutation und global-field procedures in `blueprint-procedure-support.ts` extrahiert |
| `calculation-rules.ts` | monitor | 4 | Aktuell klein; nur bei zusätzlicher Write-/Audit-Logik extrahieren |
| `chargeability-report.ts` | excluded_for_now | - | Bewusst zurückgestellt; erst nach Freigabe des geblockten Bereichs |
| `client.ts` | done | - | list/tree reads, identifier reads, CRUD/deactivate und sort-order batch mutation in `client-procedure-support.ts` extrahiert |
| `comment.ts` | done | - | Bereits in `comment-procedure-support.ts` ausgelagert |
| `computation-graph.ts` | monitor | 4 | Bereits Kompositionsrouter; nur bei zusätzlicher Orchestrierung weiter schneiden |
| `country.ts` | done | - | list/identifier reads, country CRUD, metro-city CRUD |
| `dashboard.ts` | excluded_for_now | - | Bewusst zurückgestellt; hoher Querschnitt und paralleler Scope |
| `dispo.ts` | done | - | workbook input schemas, staging/validation, staged-read procedures, resolve/commit/cancel mutations |
| `effort-rule.ts` | done | - | list/detail reads, CRUD/default toggle, preview und apply-rules mutation in `effort-rule-procedure-support.ts` extrahiert |
| `entitlement.ts` | excluded_for_now | - | Bewusst zurückgestellt; größerer Fachblock |
| `estimate.ts` | done | - | commercial reads, demand line writes, phasing, version workflow, aggregate read models |
| `experience-multiplier.ts` | done | - | list/detail reads, CRUD/default toggle, preview und apply-rules mutation in `experience-multiplier-procedure-support.ts` extrahiert |
| `holiday-calendar.ts` | done | - | calendar CRUD, entry CRUD; catalog/resolution reads sind schon separat |
| `import-export.ts` | done | - | export reads, import preview/validation, file-bound orchestration |
| `insights.ts` | done | - | anomaly/summary reads, cached narrative read, AI narrative mutation |
| `management-level.ts` | done | - | group reads/writes, level writes/delete und Audit-Orchestrierung in `management-level-procedure-support.ts` extrahiert |
| `notification.ts` | later | 3 | Top-Level ist tragbar; nächster sinnvoller Schritt ist die weitere Zerlegung von `notification-procedure-support.ts` |
| `org-unit.ts` | done | - | list/tree reads, identifier reads, CRUD/deactivate |
| `project.ts` | monitor | 4 | Bereits stark komponiert; optional nur `list` und `getById` separat ziehen |
| `rate-card.ts` | done | - | list/detail/match reads, card CRUD, line CRUD und replace-lines in `rate-card-procedure-support.ts` extrahiert |
| `report.ts` | done | - | Bereits in `report-template-procedure-support.ts` ausgelagert |
| `resource.ts` | monitor | 4 | Top-Level dünn; tieferliegende Shared-Read-Module sind separat zu betrachten |
| `role.ts` | done | - | Bereits in `role-procedure-support.ts` ausgelagert |
| `scenario.ts` | done | - | Bereits in `scenario-procedure-support.ts` ausgelagert |
| `settings.ts` | done | - | Bereits in `settings-procedure-support.ts` ausgelagert |
| `staffing.ts` | done | - | Aggregator bereits dünn |
| `system-role-config.ts` | monitor | 4 | Klein genug; nur bei wachsender Audit-/Validation-Logik schneiden |
| `timeline.ts` | done | - | Bereits auf dünnen Aggregator umgestellt |
| `user.ts` | excluded_for_now | - | Bewusst zurückgestellt; hoher Querschnitt und paralleler Scope |
| `utilization-category.ts` | monitor | 4 | Klein genug; nur bei zusätzlicher Komplexität schneiden |
| `vacation.ts` | done | - | Bereits auf dünnen Aggregator umgestellt |
| `webhook.ts` | monitor | 4 | Noch tragbar; optional später read/write separation |
| Router | Status | Priorität | Sinnvolle Slices |
| -------------------------- | ---------------- | --------: | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `allocation.ts` | done | - | Aggregator bereits dünn; nur Support-Module weiter pflegen |
| `assistant.ts` | done | - | top-level chat, approval payloads und system prompt in Support-Module extrahiert |
| `audit-log.ts` | monitor | 4 | Optional: list/detail reads und filter-building trennen, falls Auth/Wiring wächst |
| `blueprint.ts` | done | - | summary/list reads, identifier reads, CRUD, role-preset mutation und global-field procedures in `blueprint-procedure-support.ts` extrahiert |
| `calculation-rules.ts` | monitor | 4 | Aktuell klein; nur bei zusätzlicher Write-/Audit-Logik extrahieren |
| `chargeability-report.ts` | excluded_for_now | - | Bewusst zurückgestellt; erst nach Freigabe des geblockten Bereichs |
| `client.ts` | done | - | list/tree reads, identifier reads, CRUD/deactivate und sort-order batch mutation in `client-procedure-support.ts` extrahiert |
| `comment.ts` | done | - | Bereits in `comment-procedure-support.ts` ausgelagert |
| `computation-graph.ts` | monitor | 4 | Bereits Kompositionsrouter; nur bei zusätzlicher Orchestrierung weiter schneiden |
| `country.ts` | done | - | list/identifier reads, country CRUD, metro-city CRUD |
| `dashboard.ts` | excluded_for_now | - | Bewusst zurückgestellt; hoher Querschnitt und paralleler Scope |
| `dispo.ts` | done | - | workbook input schemas, staging/validation, staged-read procedures, resolve/commit/cancel mutations |
| `effort-rule.ts` | done | - | list/detail reads, CRUD/default toggle, preview und apply-rules mutation in `effort-rule-procedure-support.ts` extrahiert |
| `entitlement.ts` | excluded_for_now | - | Bewusst zurückgestellt; größerer Fachblock |
| `estimate.ts` | done | - | commercial reads, demand line writes, phasing, version workflow, aggregate read models |
| `experience-multiplier.ts` | done | - | list/detail reads, CRUD/default toggle, preview und apply-rules mutation in `experience-multiplier-procedure-support.ts` extrahiert |
| `holiday-calendar.ts` | done | - | calendar CRUD, entry CRUD; catalog/resolution reads sind schon separat |
| `import-export.ts` | done | - | export reads, import preview/validation, file-bound orchestration |
| `insights.ts` | done | - | anomaly/summary reads, cached narrative read, AI narrative mutation |
| `management-level.ts` | done | - | group reads/writes, level writes/delete und Audit-Orchestrierung in `management-level-procedure-support.ts` extrahiert |
| `notification.ts` | later | 3 | Top-Level ist tragbar; nächster sinnvoller Schritt ist die weitere Zerlegung von `notification-procedure-support.ts` |
| `org-unit.ts` | done | - | list/tree reads, identifier reads, CRUD/deactivate |
| `project.ts` | monitor | 4 | Bereits stark komponiert; optional nur `list` und `getById` separat ziehen |
| `rate-card.ts` | done | - | list/detail/match reads, card CRUD, line CRUD und replace-lines in `rate-card-procedure-support.ts` extrahiert |
| `report.ts` | done | - | Bereits in `report-template-procedure-support.ts` ausgelagert |
| `resource.ts` | monitor | 4 | Top-Level dünn; tieferliegende Shared-Read-Module sind separat zu betrachten |
| `role.ts` | done | - | Bereits in `role-procedure-support.ts` ausgelagert |
| `scenario.ts` | done | - | Bereits in `scenario-procedure-support.ts` ausgelagert |
| `settings.ts` | done | - | Bereits in `settings-procedure-support.ts` ausgelagert |
| `staffing.ts` | done | - | Aggregator bereits dünn |
| `system-role-config.ts` | monitor | 4 | Klein genug; nur bei wachsender Audit-/Validation-Logik schneiden |
| `timeline.ts` | done | - | Bereits auf dünnen Aggregator umgestellt |
| `user.ts` | excluded_for_now | - | Bewusst zurückgestellt; hoher Querschnitt und paralleler Scope |
| `utilization-category.ts` | monitor | 4 | Klein genug; nur bei zusätzlicher Komplexität schneiden |
| `vacation.ts` | done | - | Bereits auf dünnen Aggregator umgestellt |
| `webhook.ts` | monitor | 4 | Noch tragbar; optional später read/write separation |
### Empfohlene Reihenfolge
@@ -238,15 +238,15 @@ oder benachbarte Support-Module, Verhalten und öffentliche Contracts bleiben st
Diese Slices betreffen nicht mehr primär den Top-Level-Router, sondern große Read-/Procedure-Module
im selben Architektur-Track. Sie sind sinnvoll, sobald der aktuelle Router-Arbeitsvorrat abgearbeitet ist.
| Slice | Priorität | Betroffene Module | Ziel |
|---|---:|---|---|
| Allocation Mutation Decomposition | 1 | `allocation-assignment-procedures.ts` | Assignment-Transaktionen, Audit, Events, Webhooks und Budget-Folgelogik weiter trennen |
| Vacation Read Separation | 1 | `vacation-read.ts`, `vacation-management-procedures.ts` | Ownership, Anonymisierung, Holiday-Preview und Query-Varianten sauberer schneiden |
| Resource Shared Read Decomposition | 1 | `resource-read-shared.ts`, `resource-summary-read-procedure-support.ts`, `resource-identifier-read.ts` | Summary-/Detail-Selects, Identifier-Selects und Mapper aus `resource-read-shared.ts` in fokussierte Helper extrahieren; oeffentliche Read-Vertraege stabil halten |
| Estimate Write Router Slimming | 1 | `estimate.ts` plus benachbarte Estimate-Module | Write-Orchestrierung, version workflow und error translation aus dem Router ziehen |
| Staffing Read Pipeline Split | 1 | `staffing-suggestions-read.ts`, `staffing-capacity-read.ts`, `staffing-best-project-resource.ts` | gemeinsame Load-/Ranking-/Response-Pipeline extrahieren |
| Report Engine by Execution Mode | 2 | `report-query-engine.ts`, `report-query-config.ts` | generische Reports, `resource_month`-Sonderfall und Exportpfade klar trennen |
| Computation Graph Read Model Split | 2 | `computation-graph-resource.ts`, `computation-graph-project.ts` | Snapshot-Building, Forecasting und Graph-Assembly entkoppeln |
| Slice | Priorität | Betroffene Module | Ziel |
| ---------------------------------- | --------: | ------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Allocation Mutation Decomposition | 1 | `allocation-assignment-procedures.ts` | Assignment-Transaktionen, Audit, Events, Webhooks und Budget-Folgelogik weiter trennen |
| Vacation Read Separation | 1 | `vacation-read.ts`, `vacation-management-procedures.ts` | Ownership, Anonymisierung, Holiday-Preview und Query-Varianten sauberer schneiden |
| Resource Shared Read Decomposition | 1 | `resource-read-shared.ts`, `resource-summary-read-procedure-support.ts`, `resource-identifier-read.ts` | Summary-/Detail-Selects, Identifier-Selects und Mapper aus `resource-read-shared.ts` in fokussierte Helper extrahieren; oeffentliche Read-Vertraege stabil halten |
| Estimate Write Router Slimming | 1 | `estimate.ts` plus benachbarte Estimate-Module | Write-Orchestrierung, version workflow und error translation aus dem Router ziehen |
| Staffing Read Pipeline Split | 1 | `staffing-suggestions-read.ts`, `staffing-capacity-read.ts`, `staffing-best-project-resource.ts` | gemeinsame Load-/Ranking-/Response-Pipeline extrahieren |
| Report Engine by Execution Mode | 2 | `report-query-engine.ts`, `report-query-config.ts` | generische Reports, `resource_month`-Sonderfall und Exportpfade klar trennen |
| Computation Graph Read Model Split | 2 | `computation-graph-resource.ts`, `computation-graph-project.ts` | Snapshot-Building, Forecasting und Graph-Assembly entkoppeln |
### Explizit Ausgeschlossen Im Aktuellen Batch
docs/estimating-extension-design.md
+77 -77
View File
@@ -2,7 +2,7 @@
**Date:** 2026-03-13
**Related workbook:** `samples/CGIBreakdown_Template/Template_CGI-Breakdown+Calc_25Dez_V0.976_251212_beta_LCR-Update.xlsx`
**Purpose:** Canonical design, field mapping, and implementation plan for a browser-based estimating system in CapaKraken.
**Purpose:** Canonical design, field mapping, and implementation plan for a browser-based estimating system in Nexus.
## Executive Summary
@@ -15,12 +15,12 @@ The workbook is not a simple calculator. It is a full estimating and pricing sys
- management summaries
- downstream export sheets
CapaKraken can support this, but not by copying Excel cell logic into the browser. The right implementation is a dedicated estimating bounded context with:
Nexus can support this, but not by copying Excel cell logic into the browser. The right implementation is a dedicated estimating bounded context with:
- a wizard for first-pass estimate creation
- a workspace for iterative revisions
- a typed calculation pipeline
- live linkage to CapaKraken resources and roles
- live linkage to Nexus resources and roles
- immutable snapshots for auditability
## Design Principles
@@ -39,7 +39,7 @@ The replacement should be:
### 2. Reuse the current platform where it already fits
Useful existing CapaKraken primitives:
Useful existing Nexus primitives:
- `Resource` for roster, rates, skills, availability, and dynamic metadata
- `Project` for schedule, budget, and project linkage
@@ -106,89 +106,89 @@ That mix is exactly why the app needs separated models for assumptions, scope, d
### New bounded context: `Estimating`
| Model | Purpose |
|---|---|
| `Estimate` | Top-level estimate container tied to a project or opportunity |
| `EstimateVersion` | Versioning, options, baselines, approvals, and locked commercial states |
| `EstimateAssumption` | Structured commercial, tax, pricing, and scenario inputs |
| `ScopeItem` | Scope rows imported or authored from the breakdown sheet |
| `ScopeEffortRule` | Rules that turn scope into discipline effort |
| `EstimateDemandLine` | Normalized effort lines with phasing and pricing attributes |
| `RateCard` | Versioned pricing and cost catalog |
| `RateCardLine` | Attribute-based rate resolution entries |
| `ResourceCostSnapshot` | Immutable copy of roster/rate facts used by one estimate version |
| `EstimateMetric` | Persisted derived totals for fast reads and auditability |
| `EstimateExport` | Stored export artifacts and serializer metadata |
| Model | Purpose |
| ---------------------- | ----------------------------------------------------------------------- |
| `Estimate` | Top-level estimate container tied to a project or opportunity |
| `EstimateVersion` | Versioning, options, baselines, approvals, and locked commercial states |
| `EstimateAssumption` | Structured commercial, tax, pricing, and scenario inputs |
| `ScopeItem` | Scope rows imported or authored from the breakdown sheet |
| `ScopeEffortRule` | Rules that turn scope into discipline effort |
| `EstimateDemandLine` | Normalized effort lines with phasing and pricing attributes |
| `RateCard` | Versioned pricing and cost catalog |
| `RateCardLine` | Attribute-based rate resolution entries |
| `ResourceCostSnapshot` | Immutable copy of roster/rate facts used by one estimate version |
| `EstimateMetric` | Persisted derived totals for fast reads and auditability |
| `EstimateExport` | Stored export artifacts and serializer metadata |
### Reuse strategy
| Existing model | Reuse level | How it fits |
|---|---|---|
| `Project` | `Direct` | Parent linkage, timeline context, budget bridge |
| `Resource` | `Direct` | Roster, chapter, role, LCR/UCR, skill and availability context |
| `Role` | `Direct` | Demand-line role alignment and staffing suggestions |
| `DemandRequirement` / `Assignment` | `Downstream` | Planning handoff target after estimate approval |
| `dynamicFields` / blueprints | `Bridge only` | Short-term bridge for unmigrated metadata, not core estimate storage |
| Existing model | Reuse level | How it fits |
| ---------------------------------- | ------------- | -------------------------------------------------------------------- |
| `Project` | `Direct` | Parent linkage, timeline context, budget bridge |
| `Resource` | `Direct` | Roster, chapter, role, LCR/UCR, skill and availability context |
| `Role` | `Direct` | Demand-line role alignment and staffing suggestions |
| `DemandRequirement` / `Assignment` | `Downstream` | Planning handoff target after estimate approval |
| `dynamicFields` / blueprints | `Bridge only` | Short-term bridge for unmigrated metadata, not core estimate storage |
## Mapping Strategy
### Mapping legend
- `Direct`: already maps to an existing first-class CapaKraken field
- `Direct`: already maps to an existing first-class Nexus field
- `Bridge`: can be bridged short-term, but should move to estimating models
- `Derived`: calculate it, do not persist it as manual source data
- `New Model`: requires estimating schema
### Project and commercial inputs
| Workbook field | Current target | Status | Recommended target |
|---|---|---|---|
| Project Name | `Project.name` | `Direct` | keep on `Project`, mirror into `Estimate.name` |
| Opportunity ID | project dynamic field | `Bridge` | `Estimate.opportunityId` |
| Timeframe From / To | `Project.startDate` / `Project.endDate` | `Direct` | default estimate context from project |
| Currency | project/resource bridge only | `Bridge` | `Estimate.baseCurrency` |
| Contract Owner / Business Unit / Service Group | none | `New Model` | `EstimateAssumption.*` |
| Pricing Structure | partly `Project.orderType` | `Bridge` | `EstimateAssumption.pricingStructure` |
| Revenue Timing / Recognition | none | `New Model` | `EstimateAssumption.*` |
| Sales Tax / Billing Arrears / Payment Terms | none | `New Model` | `EstimateAssumption.*` |
| Contingency / Capital Charge / Mgmt Fee policies | none | `New Model` | `EstimateAssumption.*` |
| Workbook field | Current target | Status | Recommended target |
| ------------------------------------------------ | --------------------------------------- | ----------- | ---------------------------------------------- |
| Project Name | `Project.name` | `Direct` | keep on `Project`, mirror into `Estimate.name` |
| Opportunity ID | project dynamic field | `Bridge` | `Estimate.opportunityId` |
| Timeframe From / To | `Project.startDate` / `Project.endDate` | `Direct` | default estimate context from project |
| Currency | project/resource bridge only | `Bridge` | `Estimate.baseCurrency` |
| Contract Owner / Business Unit / Service Group | none | `New Model` | `EstimateAssumption.*` |
| Pricing Structure | partly `Project.orderType` | `Bridge` | `EstimateAssumption.pricingStructure` |
| Revenue Timing / Recognition | none | `New Model` | `EstimateAssumption.*` |
| Sales Tax / Billing Arrears / Payment Terms | none | `New Model` | `EstimateAssumption.*` |
| Contingency / Capital Charge / Mgmt Fee policies | none | `New Model` | `EstimateAssumption.*` |
### Scope breakdown inputs
| Workbook field | Current target | Status | Recommended target |
|---|---|---|---|
| Row sequence, type, package | none | `New Model` | `ScopeItem.sequenceNo`, `scopeType`, `packageCode` |
| Description, scene, page, location | coarse project notes only | `New Model` | `ScopeItem.*` |
| Assumptions / comments | none | `New Model` | `ScopeItem.assumptionCategory`, `internalComments` |
| Resolution / FPS / aspect / shot length | project dynamic fields only | `Bridge` | `ScopeItem.technicalSpec` JSON |
| Frame count / count / unit mode | limited bridge only | `Bridge` | `ScopeItem.frameCount`, `count`, `unitMode` |
| Discipline effort columns | none | `New Model` | generated `EstimateDemandLine` rows |
| Total costs on the breakdown sheet | none | `Derived` | `EstimateMetric` |
| Workbook field | Current target | Status | Recommended target |
| --------------------------------------- | --------------------------- | ----------- | -------------------------------------------------- |
| Row sequence, type, package | none | `New Model` | `ScopeItem.sequenceNo`, `scopeType`, `packageCode` |
| Description, scene, page, location | coarse project notes only | `New Model` | `ScopeItem.*` |
| Assumptions / comments | none | `New Model` | `ScopeItem.assumptionCategory`, `internalComments` |
| Resolution / FPS / aspect / shot length | project dynamic fields only | `Bridge` | `ScopeItem.technicalSpec` JSON |
| Frame count / count / unit mode | limited bridge only | `Bridge` | `ScopeItem.frameCount`, `count`, `unitMode` |
| Discipline effort columns | none | `New Model` | generated `EstimateDemandLine` rows |
| Total costs on the breakdown sheet | none | `Derived` | `EstimateMetric` |
### Resource, rate, and lookup data
| Workbook field | Current target | Status | Recommended target |
|---|---|---|---|
| Roster employee/name | `Resource.displayName` / `eid` | `Bridge` | link to `Resource` plus snapshot source text |
| UCR / LCR | `Resource.ucrCents` / `lcrCents` | `Direct` | direct reuse plus snapshot |
| FTE | indirect only | `Bridge` | `ResourceCostSnapshot.fte` |
| Level / work type / area | dynamic fields only | `Bridge` | normalize later, snapshot now |
| Location / country | dynamic bridge only | `Bridge` | snapshot + demand-line attributes |
| Rates ACN / rate breakdown / machine / FX | none | `New Model` | `RateCard`, `RateCardLine`, FX/rule tables |
| Experience adjustments | none | `New Model` | rate adjustment rules |
| Workbook field | Current target | Status | Recommended target |
| ----------------------------------------- | -------------------------------- | ----------- | -------------------------------------------- |
| Roster employee/name | `Resource.displayName` / `eid` | `Bridge` | link to `Resource` plus snapshot source text |
| UCR / LCR | `Resource.ucrCents` / `lcrCents` | `Direct` | direct reuse plus snapshot |
| FTE | indirect only | `Bridge` | `ResourceCostSnapshot.fte` |
| Level / work type / area | dynamic fields only | `Bridge` | normalize later, snapshot now |
| Location / country | dynamic bridge only | `Bridge` | snapshot + demand-line attributes |
| Rates ACN / rate breakdown / machine / FX | none | `New Model` | `RateCard`, `RateCardLine`, FX/rule tables |
| Experience adjustments | none | `New Model` | rate adjustment rules |
### Calculation, phasing, and exports
| Workbook field group | Current target | Status | Recommended target |
|---|---|---|---|
| Calculation line items | none | `New Model` | `EstimateDemandLine` |
| Named resource references | `Assignment.resourceId` via planning handoff | `Direct` | linked demand line + resource snapshot |
| Dates, hours, bill code, org unit, economic profile | none | `New Model` | `EstimateDemandLine.*` |
| Monthly spread | none | `New Model` | `EstimateDemandLine.monthlySpread` |
| Weekly phasing (`4Dispo`) | none | `Derived` | generated projection view |
| `CALC_AUX` transformed outputs | none | `Derived` | derived from demand lines and snapshots |
| `MMP Import` / external export sheets | none | `New Model` | serializer output + `EstimateExport` |
| Cockpit / analytics totals | none | `Derived` | persisted `EstimateMetric` rows |
| Workbook field group | Current target | Status | Recommended target |
| --------------------------------------------------- | -------------------------------------------- | ----------- | --------------------------------------- |
| Calculation line items | none | `New Model` | `EstimateDemandLine` |
| Named resource references | `Assignment.resourceId` via planning handoff | `Direct` | linked demand line + resource snapshot |
| Dates, hours, bill code, org unit, economic profile | none | `New Model` | `EstimateDemandLine.*` |
| Monthly spread | none | `New Model` | `EstimateDemandLine.monthlySpread` |
| Weekly phasing (`4Dispo`) | none | `Derived` | generated projection view |
| `CALC_AUX` transformed outputs | none | `Derived` | derived from demand lines and snapshots |
| `MMP Import` / external export sheets | none | `New Model` | serializer output + `EstimateExport` |
| Cockpit / analytics totals | none | `Derived` | persisted `EstimateMetric` rows |
## Browser Architecture
@@ -236,7 +236,7 @@ That prevents old approved estimates from changing when roster rates or metadata
### Phase 4. Resource linkage and planning handoff
- connect demand lines to resources, roles, and availability
- add staffing suggestions from current CapaKraken data
- add staffing suggestions from current Nexus data
- support conversion from approved estimate demand into downstream planning entities
### Phase 5. Exports and approvals
@@ -261,7 +261,7 @@ Implemented baseline in the current codebase:
- version submit, approve, and locked revision-cloning actions
- export artifact scaffolding with stored serializer metadata records
- format-specific export generation with stored payloads for JSON, CSV, XLSX, SAP, and MMP
- live resource-linked staffing rows that can sync current CapaKraken rates and persist estimate-version snapshots
- live resource-linked staffing rows that can sync current Nexus rates and persist estimate-version snapshots
- explicit live-vs-manual rate mode metadata on demand lines, with server-side recalculation before metrics are persisted
- read-only and draft workspace visibility for manual overrides versus live resource snapshots
- project snapshot persistence on estimate versions
@@ -293,16 +293,16 @@ Approved estimate versions hand off like this:
### Estimate-to-planning mapping
| Estimate source | DemandRequirement target | Assignment target | Notes |
|---|---|---|---|
| `Estimate.projectId` + approved version | `projectId` | `projectId` | direct |
| `EstimateDemandLine.id` | `metadata.estimateHandoff.estimateDemandLineId` | same | provenance |
| `EstimateDemandLine.name` | `role` or demand title | copied display metadata | readable context |
| `EstimateDemandLine.roleId` | `roleId` | optional copied roleId | direct when present |
| `EstimateDemandLine.resourceId` | `metadata.suggestedResourceId` when open | `resourceId` when assigned | demand vs assignment split eliminates nullable-resource ambiguity |
| `EstimateDemandLine.hours` + project window | `hoursPerDay`, `percentage`, `headcount` | `hoursPerDay`, `percentage` | reused derivation logic |
| `EstimateDemandLine.fte` | `headcount` | not needed | demand owns quantity |
| rate and price totals | metadata snapshot | metadata snapshot | preserve auditability |
| staffing attributes / monthly spread | metadata | metadata | direct carry-over |
| Estimate source | DemandRequirement target | Assignment target | Notes |
| ------------------------------------------- | ----------------------------------------------- | --------------------------- | ----------------------------------------------------------------- |
| `Estimate.projectId` + approved version | `projectId` | `projectId` | direct |
| `EstimateDemandLine.id` | `metadata.estimateHandoff.estimateDemandLineId` | same | provenance |
| `EstimateDemandLine.name` | `role` or demand title | copied display metadata | readable context |
| `EstimateDemandLine.roleId` | `roleId` | optional copied roleId | direct when present |
| `EstimateDemandLine.resourceId` | `metadata.suggestedResourceId` when open | `resourceId` when assigned | demand vs assignment split eliminates nullable-resource ambiguity |
| `EstimateDemandLine.hours` + project window | `hoursPerDay`, `percentage`, `headcount` | `hoursPerDay`, `percentage` | reused derivation logic |
| `EstimateDemandLine.fte` | `headcount` | not needed | demand owns quantity |
| rate and price totals | metadata snapshot | metadata snapshot | preserve auditability |
| staffing attributes / monthly spread | metadata | metadata | direct carry-over |
The workbook mapping is feasible. The estimating product covers wizard creation, workspace editing, version management, export generation, and planning handoff. Remaining work focuses on templates, richer comparison, and the scope-to-effort rule engine.
docs/gitlooper-strategy.md
+25 -18
View File
@@ -5,7 +5,7 @@
## Overview
GitLooper is a Claude Code slash command (`/gitlooper:gitlooper`) that connects to CapaKraken's Gitea instance, reads open issues, triages them, and autonomously implements fixes/features using spawned sub-agents.
GitLooper is a Claude Code slash command (`/gitlooper:gitlooper`) that connects to Nexus's Gitea instance, reads open issues, triages them, and autonomously implements fixes/features using spawned sub-agents.
## Architecture
@@ -52,48 +52,55 @@ User runs /gitlooper:gitlooper
## Current Open Issues (2026-03-17)
| # | Title | Type | Effort | Reporter | Priority |
|---|-------|------|--------|----------|----------|
| 3 | No Blueprints available in New Project Wizard | bug | S | Larissa | P1 |
| 5 | Account not linked to a resource | bug | S | Larissa | P1 |
| 7 | Dropdown menu broken in vacation management | bug | S | Larissa | P1 |
| 6 | My Vacations and Vacation Mgmt selected simultaneously | bug | S | Larissa | P2 |
| 10 | Sick leave not automatically added to timeline | bug | M | Larissa | P2 |
| 8 | Assign different color to Public Holidays vs Annual Vacation | ux | S | Larissa | P3 |
| 4 | Display Hours/Costs total per resource in Project Overview | feature | M | Larissa | P3 |
| 2 | Keep search bar locations consistent on all pages | feature | M | Larissa | P3 |
| 9 | Preferences: toggle "include demand projects" on page load | feature | M | Larissa | P4 |
| 1 | Assign a color to a project | feature | L | Larissa | P4 |
| # | Title | Type | Effort | Reporter | Priority |
| --- | ------------------------------------------------------------ | ------- | ------ | -------- | -------- |
| 3 | No Blueprints available in New Project Wizard | bug | S | Larissa | P1 |
| 5 | Account not linked to a resource | bug | S | Larissa | P1 |
| 7 | Dropdown menu broken in vacation management | bug | S | Larissa | P1 |
| 6 | My Vacations and Vacation Mgmt selected simultaneously | bug | S | Larissa | P2 |
| 10 | Sick leave not automatically added to timeline | bug | M | Larissa | P2 |
| 8 | Assign different color to Public Holidays vs Annual Vacation | ux | S | Larissa | P3 |
| 4 | Display Hours/Costs total per resource in Project Overview | feature | M | Larissa | P3 |
| 2 | Keep search bar locations consistent on all pages | feature | M | Larissa | P3 |
| 9 | Preferences: toggle "include demand projects" on page load | feature | M | Larissa | P4 |
| 1 | Assign a color to a project | feature | L | Larissa | P4 |
### Triage Notes
**P1 — Bugs (blocking):**
- **#3** — Blueprints likely not seeded in the new Gitea DB, or the query returns empty. Quick check of `blueprint.list` query.
- **#5** — User account created but `Resource.userId` not linked. Need to link Larissa's account to her resource record.
- **#7** — Chapter dropdown filter in VacationClient resets options after selecting one. Likely a state management bug in the filter component.
**P2 — Bugs (non-blocking):**
- **#6** — AppShell sidebar highlights both "My Vacations" and "Vacation Mgmt" simultaneously. URL path matching issue.
- **#10** — Sick leave entries (vacation type SICK) not showing on timeline. The timeline `getEntries` query likely filters vacation types.
**P3 — UX/Feature (quick wins):**
- **#8** — VacationClient uses same color for all vacation types. Add type-specific colors.
- **#4** — Add "Total Hours" and "Total Costs" columns to ProjectAssignmentsTable.
- **#2** — Add search bars to Timeline page matching Allocations page layout.
**P4 — Feature (larger scope):**
- **#9** — User preferences system (new DB field or localStorage) for default filter state.
- **#1** — Project color field + color picker in UI + timeline rendering by project color.
## Agent Spawning Strategy
### For bugs (S effort):
Direct fix in main context — no worktree needed. Read, fix, test, commit.
### For features (M effort):
Spawn a **coder** agent with `isolation: "worktree"` to keep main clean. Review output before merging.
### For features (L effort):
Spawn a **planner** agent first to create implementation plan. Then spawn **coder** agent per task in the plan. Requires user approval at each stage.
## Usage
@@ -114,8 +121,8 @@ Spawn a **planner** agent first to create implementation plan. Then spawn **code
## Files Created
| File | Purpose |
|------|---------|
| `.claude/commands/gitlooper/gitlooper.md` | Slash command definition |
| `~/.gitea-token` | API token (chmod 600, not in repo) |
| `docs/gitlooper-strategy.md` | This strategy document |
| File | Purpose |
| ----------------------------------------- | ---------------------------------- |
| `.claude/commands/gitlooper/gitlooper.md` | Slash command definition |
| `~/.gitea-token` | API token (chmod 600, not in repo) |
| `docs/gitlooper-strategy.md` | This strategy document |
docs/holiday-calendar-implementation-plan.md
+1 -1
View File
@@ -2,7 +2,7 @@
## Ziel
CapaKraken soll standortabhaengige Feiertage fachlich korrekt berechnen koennen, sodass zwei Personen im selben Land, aber in unterschiedlichen Regionen oder Staedten, unterschiedliche `SAH` und damit unterschiedliche Chargeability erhalten koennen.
Nexus soll standortabhaengige Feiertage fachlich korrekt berechnen koennen, sodass zwei Personen im selben Land, aber in unterschiedlichen Regionen oder Staedten, unterschiedliche `SAH` und damit unterschiedliche Chargeability erhalten koennen.
Die Feiertagsaufloesung soll kuenftig diese Prioritaet haben:
docs/import-hardening.md
+3 -3
View File
@@ -12,7 +12,7 @@
## Server Boundary
The dispo-import reader in [read-workbook.ts](/home/hartmut/Documents/Copilot/capakraken/packages/application/src/use-cases/dispo-import/read-workbook.ts) now enforces:
The dispo-import reader in [read-workbook.ts](/home/hartmut/Documents/Copilot/nexus/packages/application/src/use-cases/dispo-import/read-workbook.ts) now enforces:
- normalized filesystem paths before reading
- regular-file checks
@@ -22,11 +22,11 @@ The dispo-import reader in [read-workbook.ts](/home/hartmut/Documents/Copilot/ca
- a worksheet column limit of `256`
- `.xlsx`-only parsing through `exceljs` behind a hardened server-side parser boundary
The API entry points in [dispo.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/dispo.ts) reject non-`.xlsx` workbook paths before staging or validation begins.
The API entry points in [dispo.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/dispo.ts) reject non-`.xlsx` workbook paths before staging or validation begins.
## Browser Boundary
The browser import helpers in [excel.ts](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/lib/excel.ts) and [skillMatrixParser.ts](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/lib/skillMatrixParser.ts) now enforce:
The browser import helpers in [excel.ts](/home/hartmut/Documents/Copilot/nexus/apps/web/src/lib/excel.ts) and [skillMatrixParser.ts](/home/hartmut/Documents/Copilot/nexus/apps/web/src/lib/skillMatrixParser.ts) now enforce:
- a hard client-side file size limit of `10 MiB`
- explicit rejection of legacy `.xls`
docs/imports/departed-sync-2026-03-14.md
+9 -4
View File
@@ -3,20 +3,24 @@
Date: 2026-03-14
Source workbook:
- `/home/hartmut/Documents/Copilot/capakraken/samples/Dispov2/MV_DispoRoster.xlsx`
- `/home/hartmut/Documents/Copilot/nexus/samples/Dispov2/MV_DispoRoster.xlsx`
- Sheet: `DispoRoster`
- Column K: `MV Ressource Type`
Applied rule:
- If column K equals `Departed`, set `resource.departed = true` for the matching CapaKraken resource identified by `EID`.
- If column K equals `Departed`, set `resource.departed = true` for the matching Nexus resource identified by `EID`.
Result:
- Workbook rows marked `Departed`: `166`
- Matching resources found in CapaKraken: `141`
- Matching resources found in Nexus: `141`
- Resources updated to `departed = true`: `141`
- Workbook EIDs not found in CapaKraken: `25`
- Workbook EIDs not found in Nexus: `25`
Missing EIDs:
- `antonia.melzer`
- `ashutosh.pandit`
- `augusto.a.wagner`
@@ -44,6 +48,7 @@ Missing EIDs:
- `yvonne.karle`
Note on `rolledOff`:
- No explicit rolled-off source column was found in this workbook.
- `Last day in dispo`, `Resource Hours/Week = 0`, `Long-term absence`, and `Demand` are not safe equivalents for `rolledOff`.
- Do not bulk-update `rolledOff` from this file without an explicit business rule.
docs/installation.md
+12 -12
View File
@@ -1,6 +1,6 @@
# Installation Guide
This guide covers everything needed to get CapaKraken running from a fresh clone.
This guide covers everything needed to get Nexus running from a fresh clone.
---
@@ -20,18 +20,18 @@ You do **not** need Node.js or pnpm installed locally; the application runs enti
## 2. Clone & Configure
```bash
git clone https://github.com/your-org/capakraken.git
cd capakraken
git clone https://github.com/your-org/nexus.git
cd nexus
cp .env.example .env
```
Open `.env` and fill in the required values:
| Variable | Description | Example |
|---|---|---|
| `NEXTAUTH_SECRET` | Random secret for session signing | see command below |
| `NEXTAUTH_URL` | Full URL the app is served from | `http://localhost:3100` |
| `DATABASE_URL` | PostgreSQL connection string | already set in `.env.example` |
| Variable | Description | Example |
| ----------------- | --------------------------------- | ----------------------------- |
| `NEXTAUTH_SECRET` | Random secret for session signing | see command below |
| `NEXTAUTH_URL` | Full URL the app is served from | `http://localhost:3100` |
| `DATABASE_URL` | PostgreSQL connection string | already set in `.env.example` |
Generate a secure `NEXTAUTH_SECRET`:
@@ -88,14 +88,14 @@ The wizard automatically redirects to the sign-in page once the account is creat
If you prefer the command line, run the setup script inside the running container:
```bash
docker exec capakraken-app-1 \
docker exec nexus-app-1 \
node scripts/setup-admin.mjs \
--email admin@example.com \
--name "Admin" \
--password changeme123
```
Replace `capakraken-app-1` with your actual container name if different (check with `docker ps`).
Replace `nexus-app-1` with your actual container name if different (check with `docker ps`).
Expected output on success:
@@ -114,7 +114,7 @@ The script exits with code 0 in both cases.
**Running on the host** (advanced): If you have Node.js and pnpm installed locally and `DATABASE_URL` is reachable from your host, you can also run:
```bash
pnpm --filter @capakraken/db exec prisma generate # ensure Prisma client is built
pnpm --filter @nexus/db exec prisma generate # ensure Prisma client is built
node scripts/setup-admin.mjs --email admin@example.com --name "Admin" --password changeme123
```
@@ -149,7 +149,7 @@ For production deployments:
```
- Set `NEXTAUTH_URL` to your real HTTPS domain:
```dotenv
NEXTAUTH_URL=https://capakraken.yourdomain.com
NEXTAUTH_URL=https://nexus.yourdomain.com
```
- See `tooling/deploy/README.md` for reverse-proxy configuration and TLS setup.
- Never commit `.env` to version control — it contains secrets.
docs/old-markdowns/PLAN_SKILLMATRIX.md
+1 -1
View File
@@ -8,4 +8,4 @@ Most of this plan has already been implemented:
- admin system settings for AI configuration
- AI summary generation and resource detail UI
Do not use this file as an active backlog. Remaining product work belongs in [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md), and completed implementation detail is reflected in the codebase and [LEARNINGS.md](/home/hartmut/Documents/Copilot/capakraken/LEARNINGS.md).
Do not use this file as an active backlog. Remaining product work belongs in [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md), and completed implementation detail is reflected in the codebase and [LEARNINGS.md](/home/hartmut/Documents/Copilot/nexus/LEARNINGS.md).
docs/old-markdowns/architecture-evaluation-2026-03-06.md
+1 -1
View File
@@ -12,4 +12,4 @@ Examples that are no longer current:
- Redis-backed SSE work has already landed
- Playwright E2E coverage is no longer empty
Use [product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md) for the active backlog and [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/capakraken/research/v2-architecture-proposal-2026-03-11.md) for the still-relevant strategic direction.
Use [product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md) for the active backlog and [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/nexus/research/v2-architecture-proposal-2026-03-11.md) for the still-relevant strategic direction.
docs/old-markdowns/cgi-breakdown-implementation-proposal.md
+1 -1
View File
@@ -1,3 +1,3 @@
# Archived Proposal Note
The CGI workbook analysis and implementation proposal were merged into [estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md) so the estimating work now has one canonical document.
The CGI workbook analysis and implementation proposal were merged into [estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md) so the estimating work now has one canonical document.
docs/old-markdowns/estimating-field-mapping.md
+1 -1
View File
@@ -1,3 +1,3 @@
# Archived Mapping Note
The field mapping table was merged into [estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md) so the estimating design, workbook analysis, and implementation plan live in one canonical file.
The field mapping table was merged into [estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md) so the estimating design, workbook analysis, and implementation plan live in one canonical file.
docs/old-markdowns/perf-audit-2026-03-09.md
+1 -1
View File
@@ -16,4 +16,4 @@ Still conceptually relevant, but no longer the canonical backlog:
- staffing suggestion scalability
- index strategy for larger datasets
Use [product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md) for active prioritization and keep this file only as archive context.
Use [product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md) for active prioritization and keep this file only as archive context.
docs/old-markdowns/plan.md
+1 -1
View File
@@ -8,4 +8,4 @@ That work is now only partially relevant as an archive:
- several sorting/view-state pieces were implemented
- Blueprints parity still appears open
The active backlog now lives in [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md).
The active backlog now lives in [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md).
docs/old-markdowns/refactor-sprint-plan.md
+1 -1
View File
@@ -2,7 +2,7 @@
This sprint plan mixed active refactor work with implementation mechanics that are now stale.
The still-relevant backlog from this document is tracked centrally in [product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md):
The still-relevant backlog from this document is tracked centrally in [product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md):
- widget config typing and layout versioning
- registry-driven dashboard rendering
docs/old-markdowns/review-report-2026-03-15-computation-graph.md
+15 -9
View File
@@ -6,24 +6,26 @@ Alle Quality Gates bestanden. Keine kritischen Probleme. Zwei Minor-Empfehlungen
## Quality Gates
| Gate | Status | Details |
|------|--------|---------|
| Engine Tests | ✅ | 283/283 (19 files) |
| Staffing Tests | ✅ | 37/37 (3 files) |
| API Tests | ✅ | 209/209 (21 files) |
| Application Tests | ✅ | 67/67 (15 files) |
| TypeScript (web) | ✅ | 0 errors (excl. BlueprintFieldEditor TS2589) |
| TypeScript (api) | ✅ | 0 errors |
| Gate | Status | Details |
| ----------------- | ------ | -------------------------------------------- |
| Engine Tests | ✅ | 283/283 (19 files) |
| Staffing Tests | ✅ | 37/37 (3 files) |
| API Tests | ✅ | 209/209 (21 files) |
| Application Tests | ✅ | 67/67 (15 files) |
| TypeScript (web) | ✅ | 0 errors (excl. BlueprintFieldEditor TS2589) |
| TypeScript (api) | ✅ | 0 errors |
## Code-Review-Checkliste
### Architektur
- [x] Keine zirkulaeren Abhaengigkeiten — `api → engine/shared/db` (erlaubt)
- [x] `engine` und `staffing` unveraendert, keine DB-Imports
- [x] Neuer Router `computationGraph` in `index.ts` registriert
- [x] Keine SSE-Events noetig (read-only Feature, keine Mutations)
### TypeScript & Typsicherheit
- [x] `any`-Types nur an `react-force-graph-3d`-Grenzen mit `eslint-disable` Kommentar (6 Stellen)
- [x] Prisma-Enums gecastet: `pa.status as unknown as string` + `as Parameters<typeof computeBudgetStatus>[2]`
- [x] JSONB-Feld gecastet: `commercialTerms as { contingencyPercent?: number; ... } | null`
@@ -31,17 +33,20 @@ Alle Quality Gates bestanden. Keine kritischen Probleme. Zwei Minor-Empfehlungen
- [x] `exactOptionalPropertyTypes` beachtet: `...(formula ? { formula } : {})` Pattern
### Datenbank & Prisma
- [x] Keine Schema-Aenderungen — rein lesende Queries
- [x] Geldbetraege in Integer-Cents: `lcrCents`, `dailyCostCents`, `budgetCents` etc.
- [x] Kein Seed noetig (kein neues Modell)
### UI & Komponenten
- [x] `"use client"` Direktive gesetzt
- [x] Three.js via `dynamic(() => import(...), { ssr: false })` — kein SSR-Problem
- [x] Neue Seite in AppShell-Navigation ergaenzt ("Computation Graph" unter Analytics)
- [x] Opake Hintergruende: `bg-zinc-50`, `bg-zinc-900/95` (95% ist akzeptabel fuer Tooltip)
### Sicherheit
- [x] Beide Procedures nutzen `controllerProcedure` (ADMIN + MANAGER + CONTROLLER)
- [x] Keine Raw-Queries — nur Prisma `findMany`/`findUniqueOrThrow`
- [x] Keine sensiblen Daten im Response — nur berechnete Werte und Formeln
@@ -49,11 +54,12 @@ Alle Quality Gates bestanden. Keine kritischen Probleme. Zwei Minor-Empfehlungen
## Gefundene Probleme
### Kritisch
Keine.
### Minor
1. **Duplizierte Types** — `GraphNode`, `GraphLink`, `Domain` sind sowohl in `packages/api/.../computation-graph.ts` als auch `apps/web/.../domain-colors.ts` definiert. Funktioniert (tRPC inferiert die Typen), aber bei Aenderungen muss man beide Stellen anpassen. Empfehlung: Types nach `@capakraken/shared` verschieben wenn sie stabil sind.
1. **Duplizierte Types** — `GraphNode`, `GraphLink`, `Domain` sind sowohl in `packages/api/.../computation-graph.ts` als auch `apps/web/.../domain-colors.ts` definiert. Funktioniert (tRPC inferiert die Typen), aber bei Aenderungen muss man beide Stellen anpassen. Empfehlung: Types nach `@nexus/shared` verschieben wenn sie stabil sind.
2. **`project.list` Query** — Der Client castet das Ergebnis via `(projectData as any)?.projects ?? (projectData as any)`. Das deutet auf Unsicherheit ueber das Return-Format hin. Sollte nach dem Merge geprueft werden, ob `.projects` oder direkt das Array zurueckkommt.
docs/performance-optimization-review-2026-03-18.md
+15 -15
View File
@@ -6,7 +6,7 @@ Scope: analysis only. No runtime behavior was changed in this pass.
## Executive Summary
The biggest performance costs in CapaKraken currently come from three patterns:
The biggest performance costs in Nexus currently come from three patterns:
1. Broad data fetches followed by repeated in-memory filtering/grouping.
2. Expensive client-side derivations on screens with large datasets, especially Timeline.
@@ -20,11 +20,11 @@ The highest-value optimization target is the Timeline stack. After that, the bes
Relevant files:
- [TimelineContext.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineContext.tsx)
- [TimelineView.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineView.tsx)
- [TimelineResourcePanel.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineResourcePanel.tsx)
- [TimelineProjectPanel.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineProjectPanel.tsx)
- [timeline.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/timeline.ts)
- [TimelineContext.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineContext.tsx)
- [TimelineView.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineView.tsx)
- [TimelineResourcePanel.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineResourcePanel.tsx)
- [TimelineProjectPanel.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineProjectPanel.tsx)
- [timeline.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/timeline.ts)
Observed issues:
@@ -43,8 +43,8 @@ Impact:
Relevant files:
- [ChargeabilityReportClient.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/reports/ChargeabilityReportClient.tsx)
- [chargeability-report.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/chargeability-report.ts)
- [ChargeabilityReportClient.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/reports/ChargeabilityReportClient.tsx)
- [chargeability-report.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/chargeability-report.ts)
Observed issues:
@@ -62,9 +62,9 @@ Impact:
Relevant files:
- [dashboard.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/dashboard.ts)
- [get-chargeability-overview.ts](/home/hartmut/Documents/Copilot/capakraken/packages/application/src/use-cases/dashboard/get-chargeability-overview.ts)
- [get-overview.ts](/home/hartmut/Documents/Copilot/capakraken/packages/application/src/use-cases/dashboard/get-overview.ts)
- [dashboard.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/dashboard.ts)
- [get-chargeability-overview.ts](/home/hartmut/Documents/Copilot/nexus/packages/application/src/use-cases/dashboard/get-chargeability-overview.ts)
- [get-overview.ts](/home/hartmut/Documents/Copilot/nexus/packages/application/src/use-cases/dashboard/get-overview.ts)
Observed issues:
@@ -80,8 +80,8 @@ Impact:
Relevant files:
- [ResourcesClient.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/app/(app)/resources/ResourcesClient.tsx)
- [resource.ts](/home/hartmut/Documents/Copilot/capakraken/packages/api/src/router/resource.ts)
- [ResourcesClient.tsx](</home/hartmut/Documents/Copilot/nexus/apps/web/src/app/(app)/resources/ResourcesClient.tsx>)
- [resource.ts](/home/hartmut/Documents/Copilot/nexus/packages/api/src/router/resource.ts)
Observed issues:
@@ -97,7 +97,7 @@ Impact:
Relevant files:
- [list-assignment-bookings.ts](/home/hartmut/Documents/Copilot/capakraken/packages/application/src/use-cases/allocation/list-assignment-bookings.ts)
- [list-assignment-bookings.ts](/home/hartmut/Documents/Copilot/nexus/packages/application/src/use-cases/allocation/list-assignment-bookings.ts)
Observed issues:
@@ -112,7 +112,7 @@ Impact:
Relevant schema:
- [schema.prisma](/home/hartmut/Documents/Copilot/capakraken/packages/db/prisma/schema.prisma)
- [schema.prisma](/home/hartmut/Documents/Copilot/nexus/packages/db/prisma/schema.prisma)
Good coverage already exists for:
docs/product-roadmap.md
+75 -74
View File
@@ -6,12 +6,12 @@
## Canonical Documents
- Active product and refactor backlog: this file
- Estimating system design and workbook mapping: [estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md)
- Dispo clean-slate import design and field mapping: [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation.md)
- Dispo worker ticket pack and dependency breakdown: [dispo-import-implementation-tickets.md](/home/hartmut/Documents/Copilot/capakraken/docs/dispo-import-implementation-tickets.md)
- Demand/assignment migration cutover and readiness policy: [demand-assignment-migration-cutover.md](/home/hartmut/Documents/Copilot/capakraken/docs/demand-assignment-migration-cutover.md)
- Strategic longer-horizon architecture direction: [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/capakraken/research/v2-architecture-proposal-2026-03-11.md)
- Implementation history and decisions: [LEARNINGS.md](/home/hartmut/Documents/Copilot/capakraken/LEARNINGS.md)
- Estimating system design and workbook mapping: [estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md)
- Dispo clean-slate import design and field mapping: [dispo-import-implementation.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation.md)
- Dispo worker ticket pack and dependency breakdown: [dispo-import-implementation-tickets.md](/home/hartmut/Documents/Copilot/nexus/docs/dispo-import-implementation-tickets.md)
- Demand/assignment migration cutover and readiness policy: [demand-assignment-migration-cutover.md](/home/hartmut/Documents/Copilot/nexus/docs/demand-assignment-migration-cutover.md)
- Strategic longer-horizon architecture direction: [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/nexus/research/v2-architecture-proposal-2026-03-11.md)
- Implementation history and decisions: [LEARNINGS.md](/home/hartmut/Documents/Copilot/nexus/LEARNINGS.md)
Older plans and reviews were left in place only as archive notes so active guidance is no longer split across stale task lists.
@@ -35,13 +35,13 @@ The following items were proposed in older markdown files and are already implem
## Active Workstreams
| Workstream | Status | Why It Is Still Open | Recommended Next Step |
|---|---|---|---|
| Estimating system | `Complete` | Full CRUD, versioning, export, planning handoff, clone/template, rate cards per client, richer version comparison, scope-to-effort rule engine, experience multipliers & shoring ratios, weekly phasing (4Dispo grid), and structured commercial terms. | — |
| Demand vs assignment split | `Complete` | Legacy `Allocation` table dropped. `legacyAllocationId` columns removed. Migration tooling deleted. Compatibility facades renamed to clean domain names (`updateAllocationEntry`, `deleteAllocationEntry`, `fillOpenDemand`, `loadAllocationEntry`). `isPlaceholder` is a derived read-model property. No legacy compatibility naming remains. | — |
| Widget platform refactor | `Implemented` | Widget config typing, layout normalization, registry-driven rendering, and dashboard query extraction now live behind shared/application contracts instead of ad hoc router logic. | Keep future widgets on the same registry + application-use-case pattern. |
| Package-level regression tests | `Expanded` | Shared schema validation (rate-card, allocation, estimate — 32 tests), engine vacation/recurrence (29 tests), staffing capacity-analyzer (12 tests), plus existing application and dashboard tests. Scenario module regression: 31 new unit tests across all four scenario modules (`scenario-shared`, `scenario-apply`, `scenario-baseline`, `scenario-simulation`). Timeline interaction: drag+selection conflict fix (FloatingActionBar cleared on project-bar and allocation drag start) + `FloatingActionBar` render regression suite. SSE stability: 2 additional edge-case tests for hide-during-reconnect and first-ever-connection-failure paths (10 tests total). | Continue adding API-level integration tests for remaining router procedures. |
| Chargeability and resource planning (Dispo v2) | `Complete` | Plans 1-5 (schema, types, SAH engine, 5 API routers, 5 admin UIs, resource/project modal extensions), Phase A (live forecast report), Phase B (target comparison + drill-down grouping), Phase D (Excel/CSV export). Phase C (SAP actuals) removed from scope. | — |
| Workstream | Status | Why It Is Still Open | Recommended Next Step |
| ---------------------------------------------- | ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Estimating system | `Complete` | Full CRUD, versioning, export, planning handoff, clone/template, rate cards per client, richer version comparison, scope-to-effort rule engine, experience multipliers & shoring ratios, weekly phasing (4Dispo grid), and structured commercial terms. | — |
| Demand vs assignment split | `Complete` | Legacy `Allocation` table dropped. `legacyAllocationId` columns removed. Migration tooling deleted. Compatibility facades renamed to clean domain names (`updateAllocationEntry`, `deleteAllocationEntry`, `fillOpenDemand`, `loadAllocationEntry`). `isPlaceholder` is a derived read-model property. No legacy compatibility naming remains. | — |
| Widget platform refactor | `Implemented` | Widget config typing, layout normalization, registry-driven rendering, and dashboard query extraction now live behind shared/application contracts instead of ad hoc router logic. | Keep future widgets on the same registry + application-use-case pattern. |
| Package-level regression tests | `Expanded` | Shared schema validation (rate-card, allocation, estimate — 32 tests), engine vacation/recurrence (29 tests), staffing capacity-analyzer (12 tests), plus existing application and dashboard tests. Scenario module regression: 31 new unit tests across all four scenario modules (`scenario-shared`, `scenario-apply`, `scenario-baseline`, `scenario-simulation`). Timeline interaction: drag+selection conflict fix (FloatingActionBar cleared on project-bar and allocation drag start) + `FloatingActionBar` render regression suite. SSE stability: 2 additional edge-case tests for hide-during-reconnect and first-ever-connection-failure paths (10 tests total). | Continue adding API-level integration tests for remaining router procedures. |
| Chargeability and resource planning (Dispo v2) | `Complete` | Plans 1-5 (schema, types, SAH engine, 5 API routers, 5 admin UIs, resource/project modal extensions), Phase A (live forecast report), Phase B (target comparison + drill-down grouping), Phase D (Excel/CSV export). Phase C (SAP actuals) removed from scope. | — |
## Prioritized Backlog
@@ -312,14 +312,14 @@ Current incremental slice:
Runs independently of the demand/assignment workstream. Source analysis and detailed plans in `samples/Dispov2/plan-*.md`.
| Plan | Scope | Depends On | Primary Files |
|---|---|---|---|
| Country/SAH/FTE | Country + MetroCity models, SAH calculator, Spain schedule, FTE scaling | - | `schema.prisma`, `packages/engine/src/sah/`, `packages/shared/src/types/country.ts` |
| OrgUnit Hierarchy | 3-level self-ref OrgUnit tree (L5→L6→L7) | - | `schema.prisma`, `packages/api/src/router/org-unit.ts`, `apps/web/src/components/org-units/` |
| Utilization Categories | UtilizationCategory model on Projects (Chg, BD, MD&I, M&O, PD&R, Absence) | - | `schema.prisma`, `packages/api/src/router/utilization-category.ts` |
| Client/WBS | Self-ref Client tree (Master→Entity), project linking | - | `schema.prisma`, `packages/api/src/router/client.ts`, `apps/web/src/components/clients/` |
| Resource Extensions | EID attributes, ManagementLevel, ResourceType, derivation rules | Plans 1-4 | `schema.prisma`, `Resource` model, `ResourceModal.tsx` |
| Chargeability Report | Live reporting page, forecast from assignments + SAH, export | All above | `packages/engine/src/chargeability/`, `apps/web/src/app/(app)/reports/` |
| Plan | Scope | Depends On | Primary Files |
| ---------------------- | ------------------------------------------------------------------------- | ---------- | -------------------------------------------------------------------------------------------- |
| Country/SAH/FTE | Country + MetroCity models, SAH calculator, Spain schedule, FTE scaling | - | `schema.prisma`, `packages/engine/src/sah/`, `packages/shared/src/types/country.ts` |
| OrgUnit Hierarchy | 3-level self-ref OrgUnit tree (L5→L6→L7) | - | `schema.prisma`, `packages/api/src/router/org-unit.ts`, `apps/web/src/components/org-units/` |
| Utilization Categories | UtilizationCategory model on Projects (Chg, BD, MD&I, M&O, PD&R, Absence) | - | `schema.prisma`, `packages/api/src/router/utilization-category.ts` |
| Client/WBS | Self-ref Client tree (Master→Entity), project linking | - | `schema.prisma`, `packages/api/src/router/client.ts`, `apps/web/src/components/clients/` |
| Resource Extensions | EID attributes, ManagementLevel, ResourceType, derivation rules | Plans 1-4 | `schema.prisma`, `Resource` model, `ResourceModal.tsx` |
| Chargeability Report | Live reporting page, forecast from assignments + SAH, export | All above | `packages/engine/src/chargeability/`, `apps/web/src/app/(app)/reports/` |
Serialization constraint: all plans add to `schema.prisma` — edits serialized, not parallel.
@@ -337,28 +337,28 @@ This has been fully resolved: the `Allocation` table has been dropped, and all r
Additive target for the next schema slice:
| New model | Core fields | Purpose |
|---|---|---|
| `DemandRequirement` | `id`, `projectId`, `roleId`, `role`, `startDate`, `endDate`, `hoursPerDay`, `percentage`, `headcount`, `status`, `metadata` | first-class planning demand |
| `Assignment` | `id`, `projectId`, `resourceId`, `demandRequirementId?`, `startDate`, `endDate`, `hoursPerDay`, `percentage`, `dailyCostCents`, `status`, `metadata` | actual staffing assignment |
| `AssignmentRevision` later | `assignmentId`, `changedAt`, `before`, `after`, `reason` | audit-friendly history after the base split lands |
| New model | Core fields | Purpose |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| `DemandRequirement` | `id`, `projectId`, `roleId`, `role`, `startDate`, `endDate`, `hoursPerDay`, `percentage`, `headcount`, `status`, `metadata` | first-class planning demand |
| `Assignment` | `id`, `projectId`, `resourceId`, `demandRequirementId?`, `startDate`, `endDate`, `hoursPerDay`, `percentage`, `dailyCostCents`, `status`, `metadata` | actual staffing assignment |
| `AssignmentRevision` later | `assignmentId`, `changedAt`, `before`, `after`, `reason` | audit-friendly history after the base split lands |
### Field mapping from current `Allocation`
| Current `Allocation` field | DemandRequirement target | Assignment target | Notes |
|---|---|---|---|
| `id` | new id on backfill | new id on backfill | keep old allocation id in compatibility metadata during migration |
| `projectId` | `projectId` | `projectId` | direct |
| `resourceId` | not stored except optional `suggestedResourceId` metadata | `resourceId` | nullable meaning is removed from the main model |
| `startDate` / `endDate` | direct | direct | direct |
| `hoursPerDay` | direct | direct | direct |
| `percentage` | direct | direct | direct |
| `role` / `roleId` | direct | copied from linked demand when useful | preserve text fallback until role normalization is done |
| `isPlaceholder` | removed | removed | business state moves to model choice, not a flag |
| `headcount` | direct | removed from assignment | one assignment row always means one staffing record |
| `dailyCostCents` | derived or zero | direct | demand does not carry execution cost as a required source field |
| `status` | direct | direct | keep enum initially for compatibility |
| `metadata` | direct | direct | preserve `estimateHandoff`, recurrence, and migration provenance |
| Current `Allocation` field | DemandRequirement target | Assignment target | Notes |
| -------------------------- | --------------------------------------------------------- | ------------------------------------- | ----------------------------------------------------------------- |
| `id` | new id on backfill | new id on backfill | keep old allocation id in compatibility metadata during migration |
| `projectId` | `projectId` | `projectId` | direct |
| `resourceId` | not stored except optional `suggestedResourceId` metadata | `resourceId` | nullable meaning is removed from the main model |
| `startDate` / `endDate` | direct | direct | direct |
| `hoursPerDay` | direct | direct | direct |
| `percentage` | direct | direct | direct |
| `role` / `roleId` | direct | copied from linked demand when useful | preserve text fallback until role normalization is done |
| `isPlaceholder` | removed | removed | business state moves to model choice, not a flag |
| `headcount` | direct | removed from assignment | one assignment row always means one staffing record |
| `dailyCostCents` | derived or zero | direct | demand does not carry execution cost as a required source field |
| `status` | direct | direct | keep enum initially for compatibility |
| `metadata` | direct | direct | preserve `estimateHandoff`, recurrence, and migration provenance |
### Delivery phases
@@ -372,13 +372,13 @@ Additive target for the next schema slice:
### Use cases to migrate first
| Priority | Scope | Why |
|---|---|---|
| `P0` | estimate planning handoff | this is where planning demand now enters the operational domain |
| `P0` | manual demand creation and fill flow | direct replacement for placeholder allocation creation/fill |
| `P1` | timeline command paths | move/resize/edit semantics should stop branching on placeholder state |
| `P1` | timeline command paths and remaining persistence-facing reads | remove the remaining placeholder-specific assumptions after the dashboard/report cleanup |
| `P2` | legacy allocation CRUD compatibility | keep only as a migration facade |
| Priority | Scope | Why |
| -------- | ------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| `P0` | estimate planning handoff | this is where planning demand now enters the operational domain |
| `P0` | manual demand creation and fill flow | direct replacement for placeholder allocation creation/fill |
| `P1` | timeline command paths | move/resize/edit semantics should stop branching on placeholder state |
| `P1` | timeline command paths and remaining persistence-facing reads | remove the remaining placeholder-specific assumptions after the dashboard/report cleanup |
| `P2` | legacy allocation CRUD compatibility | keep only as a migration facade |
### Acceptance criteria for the split
@@ -391,17 +391,18 @@ Additive target for the next schema slice:
### Parallel tickets
| Ticket | Owner | Scope |
|---|---|---|
| `DAS-01` | `A1-architect` | finalize Prisma target schema, compatibility period, and cutover rules |
| `DAS-02` | `C1-estimate-backend` | switch estimate planning handoff from placeholder allocations to demand-first writes |
| `DAS-03` | `C1-estimate-backend` | add demand/assignment application services and additive API procedures |
| `DAS-04` | `C2-estimate-frontend` | adapt wizard/workspace follow-up UIs and any demand-fill flows to new commands |
| `DAS-05` | `T1-regression` | backfill tests, compatibility tests, and Docker smoke checks |
| Ticket | Owner | Scope |
| -------- | ---------------------- | ------------------------------------------------------------------------------------ |
| `DAS-01` | `A1-architect` | finalize Prisma target schema, compatibility period, and cutover rules |
| `DAS-02` | `C1-estimate-backend` | switch estimate planning handoff from placeholder allocations to demand-first writes |
| `DAS-03` | `C1-estimate-backend` | add demand/assignment application services and additive API procedures |
| `DAS-04` | `C2-estimate-frontend` | adapt wizard/workspace follow-up UIs and any demand-fill flows to new commands |
| `DAS-05` | `T1-regression` | backfill tests, compatibility tests, and Docker smoke checks |
### Known residual semantic mismatches
All previously listed mismatches have been resolved:
- The legacy `Allocation` table has been dropped; persistence uses `DemandRequirement` and `Assignment` exclusively.
- Compatibility facades have been renamed to clean domain names (`updateAllocationEntry`, `deleteAllocationEntry`, `fillOpenDemand`).
- `isPlaceholder` is retained as a derived read-model property (not a stored column) for frontend consumption.
@@ -410,25 +411,25 @@ All previously listed mismatches have been resolved:
Use a single orchestrator and split roadmap execution into package-owned workstreams. Shared files should be merged only at integration checkpoints.
| Agent | Scope | Primary Files / Packages | Deliverables | Notes |
|---|---|---|---|---|
| `A1-architect` | keep roadmap, contracts, and merge boundaries coherent | [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md), [docs/estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md), shared contract entry points | acceptance criteria, sequencing, shared-file coordination | should not implement feature code unless integration is blocked |
| `C1-estimate-backend` | estimate domain, router, persistence, exports | `packages/api`, `packages/application`, `packages/engine`, `packages/db`, `packages/shared` | workspace read/write procedures, export serializers, version actions, metrics persistence | owns server-side behavior and cross-package type safety |
| `C2-estimate-frontend` | estimates pages, wizard follow-up, workspace tabs | `apps/web/src/app/(app)/estimates`, `apps/web/src/components/estimates`, shared UI components | detail workspace, overview/assumptions/scope/rates tabs, iteration UX | should avoid editing backend contracts without handoff |
| `T1-regression` | tests and runtime verification | `packages/*/test*`, `apps/web` verification paths, Docker runtime checks | regression tests, package typechecks, app smoke validation | runs after each integration checkpoint |
| `R1-reviewer` | final integration and regression review | diff review across touched packages | findings, missing permissions, backward-compatibility risks | review after C1 and C2 merge |
| Agent | Scope | Primary Files / Packages | Deliverables | Notes |
| ---------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `A1-architect` | keep roadmap, contracts, and merge boundaries coherent | [docs/product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md), [docs/estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md), shared contract entry points | acceptance criteria, sequencing, shared-file coordination | should not implement feature code unless integration is blocked |
| `C1-estimate-backend` | estimate domain, router, persistence, exports | `packages/api`, `packages/application`, `packages/engine`, `packages/db`, `packages/shared` | workspace read/write procedures, export serializers, version actions, metrics persistence | owns server-side behavior and cross-package type safety |
| `C2-estimate-frontend` | estimates pages, wizard follow-up, workspace tabs | `apps/web/src/app/(app)/estimates`, `apps/web/src/components/estimates`, shared UI components | detail workspace, overview/assumptions/scope/rates tabs, iteration UX | should avoid editing backend contracts without handoff |
| `T1-regression` | tests and runtime verification | `packages/*/test*`, `apps/web` verification paths, Docker runtime checks | regression tests, package typechecks, app smoke validation | runs after each integration checkpoint |
| `R1-reviewer` | final integration and regression review | diff review across touched packages | findings, missing permissions, backward-compatibility risks | review after C1 and C2 merge |
### Active Parallel Slice
Current target: execute the demand/assignment persistence split without blocking estimate usage that already works.
| Ticket | Owner | Depends On | Scope |
|---|---|---|---|
| `DAS-01` Additive Prisma schema and compatibility rules | `A1-architect` + `C1-estimate-backend` | current read-model split | define `DemandRequirement` / `Assignment` tables, migration comments, and cutover constraints |
| `DAS-02` Demand-first planning handoff | `C1-estimate-backend` | `DAS-01` | change approved estimate handoff to create demand first, assignment second |
| `DAS-03` Demand/assignment command surface | `C1-estimate-backend` | `DAS-01` | add demand create/fill procedures and compatibility wrappers for legacy allocation flows |
| `DAS-04` Frontend follow-up flows | `C2-estimate-frontend` | `DAS-02`, `DAS-03` | completed for the main allocation, timeline, and estimate handoff surfaces; continue only for residual legacy copy |
| `DAS-05` Regression and migration net | `T1-regression` | `DAS-01` to `DAS-04` checkpoints | backfill tests, contract tests, Docker smoke validation, and migration rehearsal |
| Ticket | Owner | Depends On | Scope |
| ------------------------------------------------------- | -------------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| `DAS-01` Additive Prisma schema and compatibility rules | `A1-architect` + `C1-estimate-backend` | current read-model split | define `DemandRequirement` / `Assignment` tables, migration comments, and cutover constraints |
| `DAS-02` Demand-first planning handoff | `C1-estimate-backend` | `DAS-01` | change approved estimate handoff to create demand first, assignment second |
| `DAS-03` Demand/assignment command surface | `C1-estimate-backend` | `DAS-01` | add demand create/fill procedures and compatibility wrappers for legacy allocation flows |
| `DAS-04` Frontend follow-up flows | `C2-estimate-frontend` | `DAS-02`, `DAS-03` | completed for the main allocation, timeline, and estimate handoff surfaces; continue only for residual legacy copy |
| `DAS-05` Regression and migration net | `T1-regression` | `DAS-01` to `DAS-04` checkpoints | backfill tests, contract tests, Docker smoke validation, and migration rehearsal |
### Merge Boundaries
@@ -446,9 +447,9 @@ Current target: execute the demand/assignment persistence split without blocking
## Document Ownership
| Topic | Canonical File | Notes |
|---|---|---|
| Active backlog | [product-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/product-roadmap.md) | Update this instead of reopening old plan files. |
| Estimating design and field mapping | [estimating-extension-design.md](/home/hartmut/Documents/Copilot/capakraken/docs/estimating-extension-design.md) | Holds workbook analysis, mapping, and implementation plan. |
| Strategic architecture direction | [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/capakraken/research/v2-architecture-proposal-2026-03-11.md) | Keep as strategy, not sprint backlog. |
| Historical decisions | [LEARNINGS.md](/home/hartmut/Documents/Copilot/capakraken/LEARNINGS.md) | Append-only log. |
| Topic | Canonical File | Notes |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| Active backlog | [product-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/product-roadmap.md) | Update this instead of reopening old plan files. |
| Estimating design and field mapping | [estimating-extension-design.md](/home/hartmut/Documents/Copilot/nexus/docs/estimating-extension-design.md) | Holds workbook analysis, mapping, and implementation plan. |
| Strategic architecture direction | [v2-architecture-proposal-2026-03-11.md](/home/hartmut/Documents/Copilot/nexus/research/v2-architecture-proposal-2026-03-11.md) | Keep as strategy, not sprint backlog. |
| Historical decisions | [LEARNINGS.md](/home/hartmut/Documents/Copilot/nexus/LEARNINGS.md) | Append-only log. |
docs/refactor-v2-plan.md
+75 -39
View File
@@ -1,4 +1,4 @@
# CapaKraken v2 Refactoring Plan
# Nexus v2 Refactoring Plan
**Date:** 2026-03-14
**Status:** Proposed
@@ -22,6 +22,7 @@
**Problem:** 7 near-identical `formatMoney(cents, currency?)` implementations scattered across estimate and dashboard components.
**Files affected:**
- `apps/web/src/components/estimates/EstimateWorkspaceClient.tsx`
- `apps/web/src/components/estimates/EstimateWorkspaceDraftEditor.tsx`
- `apps/web/src/components/estimates/VersionCompare.tsx`
@@ -33,9 +34,10 @@
**Target:** `apps/web/src/lib/format.ts` — add `formatMoney(cents: number, currency?: string): string`
**Acceptance criteria:**
- [x] `formatMoney` exported from `~/lib/format.ts`
- [x] All 7 local copies removed, replaced by import from `~/lib/format.ts`
- [x] `pnpm --filter @capakraken/web exec tsc --noEmit` passes
- [x] `pnpm --filter @nexus/web exec tsc --noEmit` passes
- [x] Visual output unchanged (same `de-DE` locale, same `maximumFractionDigits: 0`)
---
@@ -62,10 +64,11 @@ export async function findUniqueOrThrow<T>(
**Files affected:** All router files in `packages/api/src/router/` that use the pattern.
**Acceptance criteria:**
- [x] Helper exported from `packages/api/src/db/helpers.ts`
- [x] At least 15 router files migrated to use the helper (19 files migrated)
- [x] `pnpm --filter @capakraken/api exec vitest run` passes (191 tests)
- [x] `pnpm --filter @capakraken/api exec tsc --noEmit` passes
- [x] `pnpm --filter @nexus/api exec vitest run` passes (191 tests)
- [x] `pnpm --filter @nexus/api exec tsc --noEmit` passes
---
@@ -77,11 +80,22 @@ export async function findUniqueOrThrow<T>(
```typescript
export const ROLE_SELECT = { id: true, name: true, color: true } as const;
export const PROJECT_BRIEF_SELECT = { id: true, name: true, shortCode: true, status: true } as const;
export const RESOURCE_BRIEF_SELECT = { id: true, displayName: true, eid: true, chapter: true } as const;
export const PROJECT_BRIEF_SELECT = {
id: true,
name: true,
shortCode: true,
status: true,
} as const;
export const RESOURCE_BRIEF_SELECT = {
id: true,
displayName: true,
eid: true,
chapter: true,
} as const;
```
**Acceptance criteria:**
- [x] Select constants exported from `packages/api/src/db/selects.ts`
- [x] All routers using inline `{ id: true, name: true, color: true }` for roles migrated
- [x] TypeScript compiles, tests pass
@@ -93,6 +107,7 @@ export const RESOURCE_BRIEF_SELECT = { id: true, displayName: true, eid: true, c
**Problem:** 3 modal components copy the same 8-line `invalidatePlanningViews()` block.
**Files affected:**
- `apps/web/src/components/allocations/AllocationModal.tsx`
- `apps/web/src/components/resources/ResourceModal.tsx`
- `apps/web/src/components/projects/ProjectModal.tsx`
@@ -100,6 +115,7 @@ export const RESOURCE_BRIEF_SELECT = { id: true, displayName: true, eid: true, c
**Target:** `apps/web/src/hooks/useInvalidatePlanningViews.ts`
**Acceptance criteria:**
- [x] Hook exported from `~/hooks/useInvalidatePlanningViews.ts`
- [x] AllocationModal uses the hook (ResourceModal/ProjectModal only have single-line invalidations — not candidates)
- [x] TypeScript compiles, invalidation behavior unchanged
@@ -111,6 +127,7 @@ export const RESOURCE_BRIEF_SELECT = { id: true, displayName: true, eid: true, c
**Problem:** 4+ components define their own `STATUS_BADGE: Record<string, string>` color maps.
**Files affected:**
- `apps/web/src/components/allocations/AllocationsClient.tsx`
- `apps/web/src/components/vacations/VacationClient.tsx`
- `apps/web/src/components/vacations/MyVacationsClient.tsx`
@@ -119,6 +136,7 @@ export const RESOURCE_BRIEF_SELECT = { id: true, displayName: true, eid: true, c
**Target:** `apps/web/src/lib/status-styles.ts` (or `packages/ui/src/statusStyles.ts` if cross-package)
**Acceptance criteria:**
- [x] Typed status style maps exported from a single source (`~/lib/status-styles.ts`)
- [x] All 4 consumers import from the shared module
- [x] Dark mode classes preserved exactly
@@ -151,6 +169,7 @@ model Vacation {
```
**Acceptance criteria:**
- [x] Indexes added to schema
- [x] `pnpm db:push` succeeds
- [x] No existing queries broken (191 API tests pass, 254 engine tests pass)
@@ -184,6 +203,7 @@ interface TimelineContextValue {
```
**Acceptance criteria:**
- [x] `TimelineContext` created with `useTimelineContext()` hook
- [x] All data-fetching and filter state lives in the context provider
- [x] Child components access data via `useTimelineContext()` instead of props
@@ -201,6 +221,7 @@ interface TimelineContextValue {
**Target:** `apps/web/src/components/timeline/TimelineResourcePanel.tsx`
**Acceptance criteria:**
- [x] Resource row rendering extracted into `TimelineResourcePanel`
- [x] Uses `useTimelineContext()` for data access
- [x] `TimelineView.tsx` reduced from 1,903 to 538 lines (72% reduction)
@@ -217,6 +238,7 @@ interface TimelineContextValue {
**Target:** `apps/web/src/components/timeline/TimelineProjectPanel.tsx`
**Acceptance criteria:**
- [x] Project group rows and open-demand blocks extracted into `TimelineProjectPanel`
- [x] Uses `useTimelineContext()` for data access
- [x] `TimelineView.tsx` reduced to 538 lines (orchestrator + drag/tooltip/popover)
@@ -230,13 +252,14 @@ interface TimelineContextValue {
**Target:** Replace with 3 smaller memos inside `TimelineResourcePanel`:
| Memo | Dependencies | Responsibility |
|---|---|---|
| `resourceRows` | resources, filter, allocsByResource | Which rows to render |
| `vacationBlocks` | vacationsByResource, viewStart, viewEnd, dayWidth | Vacation bar positions |
| `assignmentBlocks` | allocsByResource, viewStart, viewEnd, dayWidth | Assignment bar positions |
| Memo | Dependencies | Responsibility |
| ------------------ | ------------------------------------------------- | ------------------------ |
| `resourceRows` | resources, filter, allocsByResource | Which rows to render |
| `vacationBlocks` | vacationsByResource, viewStart, viewEnd, dayWidth | Vacation bar positions |
| `assignmentBlocks` | allocsByResource, viewStart, viewEnd, dayWidth | Assignment bar positions |
**Acceptance criteria:**
- [x] No single `useMemo` has more than 10 dependencies (max 6)
- [ ] React DevTools Profiler shows reduced re-render count on filter toggle (manual verification)
- [x] Identical visual output
@@ -254,16 +277,19 @@ interface TimelineContextValue {
**Target:** `packages/api/src/router/timeline.ts` — extend `getEntriesView` input:
```typescript
getEntriesView.input(z.object({
startDate: z.coerce.date(),
endDate: z.coerce.date(),
resourceIds: z.array(z.string()).optional(), // NEW
projectIds: z.array(z.string()).optional(), // NEW
chapters: z.array(z.string()).optional(), // NEW
}))
getEntriesView.input(
z.object({
startDate: z.coerce.date(),
endDate: z.coerce.date(),
resourceIds: z.array(z.string()).optional(), // NEW
projectIds: z.array(z.string()).optional(), // NEW
chapters: z.array(z.string()).optional(), // NEW
}),
);
```
**Acceptance criteria:**
- [x] `getEntriesView` accepts optional filter arrays (resourceIds, projectIds, chapters, eids)
- [x] Prisma `where` clause includes filters when provided
- [x] Client passes active filters from `TimelineFilter` state
@@ -282,6 +308,7 @@ getEntriesView.input(z.object({
Remove `availability` from `PROJECT_PLANNING_ASSIGNMENT_INCLUDE.resource.select`. Load it separately only in capacity-analysis queries.
**Acceptance criteria:**
- [x] `availability` removed from timeline resource select (new `TIMELINE_ASSIGNMENT_INCLUDE`)
- [x] Staffing/capacity queries still load `availability` where needed (`PROJECT_PLANNING_ASSIGNMENT_INCLUDE`)
- [x] Timeline rendering unchanged (availability was never used in rendering)
@@ -298,6 +325,7 @@ Remove `availability` from `PROJECT_PLANNING_ASSIGNMENT_INCLUDE.resource.select`
Add a 50ms debounce buffer: batch events within the window, then emit a single aggregated event.
**Acceptance criteria:**
- [x] Batch operations emit 1 SSE event instead of N (50ms debounce buffer)
- [x] Single-record operations still emit immediately (50ms imperceptible)
- [x] Timeline re-fetches only once for batch operations
@@ -314,6 +342,7 @@ Add a 50ms debounce buffer: batch events within the window, then emit a single a
**Problem:** 6 inline tab components (`OverviewTab`, `AssumptionsTab`, `ScopeTab`, `StaffingTab`, `FinancialsTab`, `VersionsTab`) are defined inside a single file.
**Target:** Create individual files:
- `apps/web/src/components/estimates/tabs/OverviewTab.tsx`
- `apps/web/src/components/estimates/tabs/AssumptionsTab.tsx`
- `apps/web/src/components/estimates/tabs/ScopeTab.tsx`
@@ -323,6 +352,7 @@ Add a 50ms debounce buffer: batch events within the window, then emit a single a
- `apps/web/src/components/estimates/tabs/ExportsTab.tsx`
**Acceptance criteria:**
- [x] Each tab is a separate file with its own imports (7 tab files created)
- [x] `EstimateWorkspaceClient.tsx` reduced to 306 lines (tab orchestrator + header + status bar)
- [x] No behavioral change
@@ -335,11 +365,13 @@ Add a 50ms debounce buffer: batch events within the window, then emit a single a
**Problem:** `EstimateWorkspaceDraftEditor.tsx` (1,205 lines) contains inline editors for assumptions, scope items, and demand lines.
**Target:** Create individual editor components:
- `apps/web/src/components/estimates/editors/AssumptionEditor.tsx`
- `apps/web/src/components/estimates/editors/ScopeItemEditor.tsx`
- `apps/web/src/components/estimates/editors/DemandLineEditor.tsx`
**Acceptance criteria:**
- [x] Each editor is a separate file (3 editor files created)
- [x] `EstimateWorkspaceDraftEditor.tsx` reduced to 581 lines (orchestrator + save logic)
- [x] Edit/save flow unchanged
@@ -356,6 +388,7 @@ Add a 50ms debounce buffer: batch events within the window, then emit a single a
**Problem:** `update-blueprints.ts` (1,272 lines) and `seed.ts` (1,228 lines) live in `packages/application` but are database-specific operations.
**Acceptance criteria:**
- [x] Both files already in `packages/db/src/` (no move needed)
- [x] Import paths correct
- [x] `pnpm db:seed` works
@@ -368,12 +401,14 @@ Add a 50ms debounce buffer: batch events within the window, then emit a single a
**Problem:** Single 1,112-line file doing validation, map building, placement, and persistence.
**Target:** Split into:
- `validate-dispo-batch.ts` — input validation and denormalization checks
- `build-dispo-maps.ts` — chargeability and reference data map construction
- `determine-placement.ts` — placement context and assignment logic
- `commit-dispo-import-batch.ts` — orchestrator (300 lines max)
**Acceptance criteria:**
- [x] Each extracted module has a clear single responsibility (3 modules: validate, build-maps, determine-placement)
- [x] `commit-dispo-import-batch.ts` orchestrates via function calls (1,112 → 573 lines)
- [x] All 67 application tests pass
@@ -409,6 +444,7 @@ export async function paginate<T extends { id: string }>(
```
**Acceptance criteria:**
- [x] Pagination helper exported (`paginate` + `paginateCursor` in `packages/api/src/db/pagination.ts`)
- [x] 2 router procedures migrated (project.list, project.listWithCosts — others use custom patterns)
- [x] All 209 API tests pass (11 new pagination tests)
@@ -418,32 +454,32 @@ export async function paginate<T extends { id: string }>(
## Execution Constraints
| Rule | Rationale |
|---|---|
| One phase at a time | Prevents merge conflicts across structural changes |
| Green tests before moving to next phase | Each phase is independently safe to ship |
| No feature additions during refactoring | Scope creep defeats the purpose |
| Phase 2 and 3 may run in parallel | Timeline component split (frontend) is independent of query optimization (backend) |
| Phase 4 and 5 may run in parallel | Estimate components and package boundaries don't overlap |
| Rule | Rationale |
| --------------------------------------- | ---------------------------------------------------------------------------------- |
| One phase at a time | Prevents merge conflicts across structural changes |
| Green tests before moving to next phase | Each phase is independently safe to ship |
| No feature additions during refactoring | Scope creep defeats the purpose |
| Phase 2 and 3 may run in parallel | Timeline component split (frontend) is independent of query optimization (backend) |
| Phase 4 and 5 may run in parallel | Estimate components and package boundaries don't overlap |
## Verification Checklist (Per Phase)
- [ ] `pnpm --filter @capakraken/engine exec vitest run` — 254+ tests pass
- [ ] `pnpm --filter @capakraken/api exec vitest run` — 187+ tests pass
- [ ] `pnpm --filter @capakraken/application exec vitest run` — 67+ tests pass
- [ ] `pnpm --filter @capakraken/web exec tsc --noEmit` — zero errors
- [ ] `pnpm --filter @capakraken/api exec tsc --noEmit` — zero errors (excluding pre-existing dispo-import issues if Phase 5.2 not yet done)
- [ ] `pnpm --filter @nexus/engine exec vitest run` — 254+ tests pass
- [ ] `pnpm --filter @nexus/api exec vitest run` — 187+ tests pass
- [ ] `pnpm --filter @nexus/application exec vitest run` — 67+ tests pass
- [ ] `pnpm --filter @nexus/web exec tsc --noEmit` — zero errors
- [ ] `pnpm --filter @nexus/api exec tsc --noEmit` — zero errors (excluding pre-existing dispo-import issues if Phase 5.2 not yet done)
- [ ] Dev server starts and serves pages without 500 errors
- [ ] Manual smoke test: timeline renders, estimate workspace tabs work, allocation CRUD works
## Metrics to Track
| Metric | Current | Target (Post-Refactor) |
|---|---|---|
| `TimelineView.tsx` lines | 1,903 | < 350 |
| `EstimateWorkspaceClient.tsx` lines | 1,298 | < 250 |
| `formatMoney` copies | 7 | 1 |
| Timeline payload size (filtered, 50 resources) | ~2 MB (estimated) | < 500 KB |
| `useMemo` max dependency count | 28 | < 10 |
| API test count | 187 | 200+ (add tests for new helpers) |
| Total test count | 508 | 520+ |
| Metric | Current | Target (Post-Refactor) |
| ---------------------------------------------- | ----------------- | -------------------------------- |
| `TimelineView.tsx` lines | 1,903 | < 350 |
| `EstimateWorkspaceClient.tsx` lines | 1,298 | < 250 |
| `formatMoney` copies | 7 | 1 |
| Timeline payload size (filtered, 50 resources) | ~2 MB (estimated) | < 500 KB |
| `useMemo` max dependency count | 28 | < 10 |
| API test count | 187 | 200+ (add tests for new helpers) |
| Total test count | 508 | 520+ |
docs/sanity-check.md
+107 -92
View File
@@ -1,4 +1,4 @@
# CapaKraken Sanity Check
# Nexus Sanity Check
**Date:** 2026-04-05
**Purpose:** Living reference covering terminology, process flows, wizard/blueprint validation, and feature gaps.
@@ -18,15 +18,16 @@
### 1.1 Allocation / DemandRequirement / Assignment
| Term | Definition | Where |
|---|---|---|
| **DemandRequirement** | First-class DB entity — an unfilled staffing need on a project (role, headcount, hours, budget). No `resourceId`. | `packages/db` model, `packages/shared/types/allocation.ts` |
| **Assignment** | First-class DB entity — a resource assigned to a project for a date range with hours/cost. Has `resourceId` (required) and optional `demandRequirementId`. | `packages/db` model, `packages/shared/types/allocation.ts` |
| **Allocation** | **Legacy read-model interface** — unified view merging demands and assignments via `isPlaceholder` flag. No DB table. | `packages/shared/types/allocation.ts` lines 29-47 |
| **AllocationLike** | Union-compatible shape keeping `isPlaceholder` for backwards compat with UI components. | `packages/shared/types/allocation.ts` lines 135-156 |
| **"allocation entry"** | Facade term used in use-case files (`update-allocation-entry.ts`, `load-allocation-entry.ts`, `delete-allocation-entry.ts`) to mean "either a DemandRequirement or an Assignment". | `packages/application/src/use-cases/allocation/` |
| Term | Definition | Where |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| **DemandRequirement** | First-class DB entity — an unfilled staffing need on a project (role, headcount, hours, budget). No `resourceId`. | `packages/db` model, `packages/shared/types/allocation.ts` |
| **Assignment** | First-class DB entity — a resource assigned to a project for a date range with hours/cost. Has `resourceId` (required) and optional `demandRequirementId`. | `packages/db` model, `packages/shared/types/allocation.ts` |
| **Allocation** | **Legacy read-model interface** — unified view merging demands and assignments via `isPlaceholder` flag. No DB table. | `packages/shared/types/allocation.ts` lines 29-47 |
| **AllocationLike** | Union-compatible shape keeping `isPlaceholder` for backwards compat with UI components. | `packages/shared/types/allocation.ts` lines 135-156 |
| **"allocation entry"** | Facade term used in use-case files (`update-allocation-entry.ts`, `load-allocation-entry.ts`, `delete-allocation-entry.ts`) to mean "either a DemandRequirement or an Assignment". | `packages/application/src/use-cases/allocation/` |
**Known inconsistencies:**
- The tRPC router is still named `allocation` (not `planning` or `demand-assignment`)
- `CreateAllocationSchema` coexists with `CreateDemandRequirementSchema` and `CreateAssignmentSchema`
- `createDemand` is an undocumented alias for `createDemandRequirement` in the router
@@ -34,21 +35,21 @@
### 1.2 Resource / User
| Term | Definition |
|---|---|
| **User** | Auth/login identity with email, password hash, SystemRole, MFA, dashboard preferences. Optional 1:1 link to Resource. |
| Term | Definition |
| ------------ | --------------------------------------------------------------------------------------------------------------------- |
| **User** | Auth/login identity with email, password hash, SystemRole, MFA, dashboard preferences. Optional 1:1 link to Resource. |
| **Resource** | Staffable person with EID, rates (LCR/UCR), skills, chapter, availability, dynamic fields. Optional 1:1 link to User. |
**Status: Clean.** No inconsistencies found. UI labels correctly use "User" in admin/auth context and "Resource" in planning/staffing context.
### 1.3 Blueprint / DynamicFields / Widget
| Term | Definition |
|---|---|
| **Blueprint** | Configuration template defining custom fields for Resources or Projects. Contains `fieldDefs`, `defaults`, `validationRules`, `rolePresets`. |
| **BlueprintFieldDefinition** | Schema for a single custom field (type, label, key, validation, options). Stored in Blueprint.fieldDefs JSONB. |
| **DynamicFields** | `Record<string, unknown>` — actual custom field values stored on Resource/Project. |
| **Widget** | Dashboard component (stat-cards, charts, tables). Completely separate from blueprints. |
| Term | Definition |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Blueprint** | Configuration template defining custom fields for Resources or Projects. Contains `fieldDefs`, `defaults`, `validationRules`, `rolePresets`. |
| **BlueprintFieldDefinition** | Schema for a single custom field (type, label, key, validation, options). Stored in Blueprint.fieldDefs JSONB. |
| **DynamicFields** | `Record<string, unknown>` — actual custom field values stored on Resource/Project. |
| **Widget** | Dashboard component (stat-cards, charts, tables). Completely separate from blueprints. |
**Status: Clean.** No confusion between blueprint fields and dashboard widgets.
@@ -59,47 +60,50 @@
Appears on 9+ models: Resource, StagedResource, StagedAssignment, EstimateDemandLine, RateCardLine, ResourceCostSnapshot, EffortRule, ExperienceMultiplierRule.
**Known inconsistencies:**
- `chapter` (display name), `chapterCode` (StagedResource), `chapterToken` (StagedAssignment) — three naming variants for the same concept in import pipeline
- No referential integrity, no centralized rename, no metadata (color, description)
- Grouping in reports/staffing relies on exact string matching
### 1.5 Rate Fields
| Field | Found On | Meaning | Unit |
|---|---|---|---|
| `lcrCents` | Resource, StagedResource, ResourceCostSnapshot | Labor Cost Rate (hourly) | Integer cents |
| `ucrCents` | Resource, StagedResource, ResourceCostSnapshot | Utilization Cost Rate (hourly) | Integer cents |
| `dailyCostCents` | Assignment | Daily assignment cost | Integer cents |
| `costRateCents` | EstimateDemandLine, RateCardLine | Cost rate per hour | Integer cents |
| `billRateCents` | EstimateDemandLine, RateCardLine | Bill rate per hour | Integer cents |
| `budgetCents` | DemandRequirement, Project | Budget allocation | Integer cents |
| Field | Found On | Meaning | Unit |
| ---------------- | ---------------------------------------------- | ------------------------------ | ------------- |
| `lcrCents` | Resource, StagedResource, ResourceCostSnapshot | Labor Cost Rate (hourly) | Integer cents |
| `ucrCents` | Resource, StagedResource, ResourceCostSnapshot | Utilization Cost Rate (hourly) | Integer cents |
| `dailyCostCents` | Assignment | Daily assignment cost | Integer cents |
| `costRateCents` | EstimateDemandLine, RateCardLine | Cost rate per hour | Integer cents |
| `billRateCents` | EstimateDemandLine, RateCardLine | Bill rate per hour | Integer cents |
| `budgetCents` | DemandRequirement, Project | Budget allocation | Integer cents |
**Known inconsistencies:**
- Resources use `lcrCents`/`ucrCents` (domain jargon); Estimates use `costRateCents`/`billRateCents` (generic). Same concept, different names.
- Assignments store `dailyCostCents` (daily); all other rates are hourly. Time dimension is implicit.
- No `billRateCents` on Assignment — billing lives only in the estimating domain.
### 1.6 Estimate Domain
| Term | Definition |
|---|---|
| **Estimate** | Top-level container with name, project link (optional), status, base currency. |
| **EstimateVersion** | Immutable snapshot within an estimate. Contains demand lines, scope items, assumptions, metrics. |
| **EstimateDemandLine** | Effort line with role, resource, hours, rates, totals. The financial building block. |
| **ScopeItem** | Deliverable/work item (shot, asset) with frame/item counts. |
| **ResourceCostSnapshot** | Point-in-time rate capture for audit trail. |
| Term | Definition |
| ------------------------ | ------------------------------------------------------------------------------------------------ |
| **Estimate** | Top-level container with name, project link (optional), status, base currency. |
| **EstimateVersion** | Immutable snapshot within an estimate. Contains demand lines, scope items, assumptions, metrics. |
| **EstimateDemandLine** | Effort line with role, resource, hours, rates, totals. The financial building block. |
| **ScopeItem** | Deliverable/work item (shot, asset) with frame/item counts. |
| **ResourceCostSnapshot** | Point-in-time rate capture for audit trail. |
**Status: Clean.** "Demand line" (estimating) and "demand requirement" (planning) are distinct concepts, well-separated in code.
### 1.7 Dispo / Import
| Term | Definition |
|---|---|
| **Dispo** | Short for "Disposition" (German resource planning). Legacy system name (`DISPO_V2`). |
| **ImportBatch** | Generic import container. `sourceSystem` defaults to `"DISPO_V2"`. |
| **Staged\*** | Prefix for all import staging models (StagedResource, StagedProject, etc.). |
| Term | Definition |
| --------------- | ------------------------------------------------------------------------------------ |
| **Dispo** | Short for "Disposition" (German resource planning). Legacy system name (`DISPO_V2`). |
| **ImportBatch** | Generic import container. `sourceSystem` defaults to `"DISPO_V2"`. |
| **Staged\*** | Prefix for all import staging models (StagedResource, StagedProject, etc.). |
**Known inconsistencies:**
- Dual routes: `/admin/imports` (new, with tabs) and `/admin/dispo-imports` (old, standalone). Both still active.
- Router named `dispoRouter` rather than generic `importRouter`.
@@ -116,6 +120,7 @@ DRAFT ──→ ACTIVE ──→ ON_HOLD ──→ COMPLETED
```
**Guard conditions:**
- Permission: `MANAGE_PROJECTS` + `managerProcedure`
- **No state machine enforcement** — any status can transition to any other status. CANCELLED → ACTIVE is allowed.
@@ -129,6 +134,7 @@ DRAFT ──→ ACTIVE ──→ ON_HOLD ──→ COMPLETED
**Estimate status:** `DRAFT → IN_REVIEW → APPROVED → ARCHIVED`
**Version status:**
```
WORKING ──submit──→ SUBMITTED ──approve──→ APPROVED
│
@@ -139,6 +145,7 @@ Other APPROVED versions → SUPERSEDED (on approve of different version)
```
**Guard conditions (enforced):**
- Submit: version must be `WORKING` (throws otherwise)
- Approve: version must be `SUBMITTED` (throws otherwise)
- Revision: no existing `WORKING` version; source must be locked
@@ -157,14 +164,15 @@ DemandRequirement ──rank resources──→ StaffingSuggestion[] ──fill
**Scoring (4 factors):**
| Factor | Weight | Logic |
|---|---|---|
| Skill | 40% | Required skills (70%) + preferred (30%), proficiency 1-5 normalized |
| Availability | 30% | 100 minus 10 per conflict day |
| Cost | 20% | 100 at/under budget LCR, linear to 0 at 2x |
| Utilization | 10% | 100 if 20%+ below target, degrades linearly |
| Factor | Weight | Logic |
| ------------ | ------ | ------------------------------------------------------------------- |
| Skill | 40% | Required skills (70%) + preferred (30%), proficiency 1-5 normalized |
| Availability | 30% | 100 minus 10 per conflict day |
| Cost | 20% | 100 at/under budget LCR, linear to 0 at 2x |
| Utilization | 10% | 100 if 20%+ below target, degrades linearly |
**Fill guards:**
- Demand must not be CANCELLED or COMPLETED
- Duplicate check (same resource + project + overlapping dates)
- Availability check (fails if >5 conflict days)
@@ -179,11 +187,13 @@ EstimateDemandLine ──handoff──→ DemandRequirement + optional Assignmen
```
**Guards:**
- Version must be `APPROVED`
- Estimate must be linked to a project
- No duplicate handoff (checks existing entries for same version)
**Logic per demand line (hours > 0):**
- If `resourceId` present: creates DemandRequirement + Assignment (both `PROPOSED`)
- If no `resourceId`: creates DemandRequirement only (placeholder)
- If assignment creation fails (resource not found, conflicts): falls back to placeholder
@@ -204,6 +214,7 @@ CANCELLED ──re-approve──→ APPROVED
```
**Guards:**
- Approve: source must be PENDING, CANCELLED, or REJECTED
- Reject: source must be PENDING only
- Cancel: source must not be CANCELLED; actor must be ADMIN/MANAGER or original requester
@@ -226,6 +237,7 @@ DRAFT → STAGING → STAGED → REVIEW_READY → APPROVED → COMMITTING → CO
**Commit preconditions:** batch in STAGED/REVIEW_READY/APPROVED; no blocking unresolved records; no staged PUBLIC_HOLIDAY records.
**Commit transaction (600s timeout):**
1. Upsert utilization categories and role seeds
2. Upsert resources by EID, roles, vacation entitlements, availability rules
3. Upsert projects by shortCode (TBD → DRAFT, others → ACTIVE)
@@ -242,12 +254,12 @@ DRAFT → STAGING → STAGED → REVIEW_READY → APPROVED → COMMITTING → CO
**Pure function:** `computeBudgetStatus(budgetCents, winProbability, allocations, dateRange)`
| Threshold | Level | Code |
|---|---|---|
| >= 70% | info | `BUDGET_INFO` |
| >= 85% | warning | `BUDGET_WARNING` |
| >= 95% | critical | `BUDGET_CRITICAL` |
| > 100% | critical | `BUDGET_EXCEEDED` |
| Threshold | Level | Code |
| --------- | -------- | ----------------- |
| >= 70% | info | `BUDGET_INFO` |
| >= 85% | warning | `BUDGET_WARNING` |
| >= 95% | critical | `BUDGET_CRITICAL` |
| > 100% | critical | `BUDGET_EXCEEDED` |
**Allocation splits:** CONFIRMED + ACTIVE → `confirmedCents`; PROPOSED → `proposedCents`; COMPLETED/CANCELLED → ignored.
@@ -281,13 +293,13 @@ Rules Engine → cost attribution and chargeability effect per absence type
**File:** `apps/web/src/components/projects/ProjectWizard.tsx` (1294 lines, 5 steps)
| Step | Name | Validation | Issues |
|---|---|---|---|
| 0 | Blueprint & Identity | shortCode (regex), name (non-empty) | OK |
| 1 | Timeline & Budget | dates valid, budget >= 0 | OK |
| 2 | Staffing Demand | **None** | Can advance with empty role names, zero headcount |
| 3 | Suggestions | **None** | Only shown if requiredSkills non-empty |
| 4 | Review & Create | **None** | No re-validation before submit |
| Step | Name | Validation | Issues |
| ---- | -------------------- | ----------------------------------- | ------------------------------------------------- |
| 0 | Blueprint & Identity | shortCode (regex), name (non-empty) | OK |
| 1 | Timeline & Budget | dates valid, budget >= 0 | OK |
| 2 | Staffing Demand | **None** | Can advance with empty role names, zero headcount |
| 3 | Suggestions | **None** | Only shown if requiredSkills non-empty |
| 4 | Review & Create | **None** | No re-validation before submit |
**Critical findings:**
@@ -303,13 +315,13 @@ Rules Engine → cost attribution and chargeability effect per absence type
**File:** `apps/web/src/components/estimates/EstimateWizard.tsx` (833 lines, 5 steps)
| Step | Name | Validation | Issues |
|---|---|---|---|
| 0 | Setup | name.trim() only | No check on currency, status, version label |
| 1 | Assumptions | **None** | Empty assumptions allowed |
| 2 | Scope | **None** | Empty scope allowed |
| 3 | Staffing | **None** | Zero rates, missing resources pass through |
| 4 | Review | name.trim() only | No financial validation |
| Step | Name | Validation | Issues |
| ---- | ----------- | ---------------- | ------------------------------------------- |
| 0 | Setup | name.trim() only | No check on currency, status, version label |
| 1 | Assumptions | **None** | Empty assumptions allowed |
| 2 | Scope | **None** | Empty scope allowed |
| 3 | Staffing | **None** | Zero rates, missing resources pass through |
| 4 | Review | name.trim() only | No financial validation |
**Critical findings:**
@@ -319,23 +331,23 @@ Rules Engine → cost attribution and chargeability effect per absence type
3. **Scope XLSX import works.** Uses exceljs with fuzzy column matching, 10MB/5000 row limits.
4. **Financial summary is correctly computed** (hours * rateCents with rounding). Margin percent rounded to nearest integer.
4. **Financial summary is correctly computed** (hours \* rateCents with rounding). Margin percent rounded to nearest integer.
### 3.3 Blueprint Validation Engine
**File:** `packages/engine/src/blueprint/validator.ts` (92 lines)
| FieldType | Runtime Validation | Gap |
|---|---|---|
| NUMBER | Type check, min/max | Full |
| BOOLEAN | true/false check | Full |
| SELECT | Value in options | Full |
| MULTI_SELECT | All values in options | Full |
| URL | `new URL()` test | Full |
| EMAIL | Regex check | Basic |
| TEXT | Required only | **No minLength/maxLength/pattern** |
| TEXTAREA | Required only | **No minLength/maxLength** |
| DATE | Required only | **No format/range validation** |
| FieldType | Runtime Validation | Gap |
| ------------ | --------------------- | ---------------------------------- |
| NUMBER | Type check, min/max | Full |
| BOOLEAN | true/false check | Full |
| SELECT | Value in options | Full |
| MULTI_SELECT | All values in options | Full |
| URL | `new URL()` test | Full |
| EMAIL | Regex check | Basic |
| TEXT | Required only | **No minLength/maxLength/pattern** |
| TEXTAREA | Required only | **No minLength/maxLength** |
| DATE | Required only | **No format/range validation** |
**Disconnect:** The Zod `generateDynamicZodSchema` (in `blueprint.schema.ts`) handles minLength/maxLength/pattern, but the runtime `validateCustomFields` does not. Both exist but serve different purposes — the Zod schema is not called during entity mutations.
@@ -347,33 +359,35 @@ Rules Engine → cost attribution and chargeability effect per absence type
## 4. Feature Gap Register
| # | Gap | Severity | Area | Recommendation |
|---|---|---|---|---|
| **G-01** | ProjectWizard never renders blueprint fieldDefs — `dynamicFields: {}` always sent | **High** | Wizard | Add dynamic field rendering in Step 1 or a new step. Load fieldDefs from selected blueprint, render form inputs by type, validate before submit. |
| **G-02** | rolePresets unvalidated at API, storage, and consumption layers | **High** | Blueprint | Add a proper Zod schema for rolePresets matching `StaffingRequirement[]`. Validate on write, validate on read in wizard. |
| **G-03** | ProjectWizard Steps 2-3 have no validation | **Medium** | Wizard | Add required checks: role name non-empty, hoursPerDay > 0, headcount >= 1. |
| **G-04** | EstimateWizard has near-zero validation (only name.trim()) | **Medium** | Wizard | Add per-step validation: currency required (Step 0), demand lines need hours > 0 and rates > 0 (Step 3). |
| **G-05** | Project lifecycle has no transition guards (CANCELLED → ACTIVE is allowed) | **Medium** | Process | Add an allowed-transitions map in the `updateStatus` mutation. |
| **G-06** | Blueprint TEXT/TEXTAREA/DATE fields lack runtime validation for minLength/maxLength/pattern/date-range | **Medium** | Validation | Extend `validateCustomFields` to check all constraints that `generateDynamicZodSchema` already supports. |
| **G-07** | Global blueprint fields not validated server-side during entity create/update | **Medium** | Validation | Include global blueprint fieldDefs in `assertBlueprintDynamicFields` resolution. |
| **G-08** | Chapter is a freeform string (9+ models) with no lookup table | **Medium** | Data model | Consider promoting to a first-class entity or at minimum a managed dropdown populated from `SELECT DISTINCT`. |
| **G-09** | LCR/UCR vs costRate/billRate naming split across domains | **Low** | Terminology | Document the mapping explicitly. Consider aliasing in shared types. |
| **G-10** | Dual dispo import routes (`/admin/imports` and `/admin/dispo-imports`) | **Low** | UI | Deprecate and redirect the old route. |
| **G-11** | `packages/ui` nearly empty — all components in apps/web | **Low** | Architecture | Not urgent. Migrate shared components when a second app is needed. |
| **G-12** | Legacy `CreateAllocationSchema` / `UpdateAllocationSchema` still active alongside first-class schemas | **Low** | Terminology | Mark as deprecated in code comments. Plan removal when all consumers migrated. |
| **G-13** | ProjectWizard review step does not show skills, assignment details, or total cost | **Low** | UX | Enhance review panel to surface all collected data. |
| **G-14** | PostProject-creation assignment/demand creation errors silently swallowed | **Medium** | Reliability | Replace empty catch with error reporting and partial-creation recovery UI. |
| **G-15** | Vacation cancel does not reverse entitlement deduction | **Low** | Process | Verify if this is intentional. If approved vacation is cancelled, usedDays should be decremented. |
| # | Gap | Severity | Area | Recommendation |
| -------- | ------------------------------------------------------------------------------------------------------ | ---------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **G-01** | ProjectWizard never renders blueprint fieldDefs — `dynamicFields: {}` always sent | **High** | Wizard | Add dynamic field rendering in Step 1 or a new step. Load fieldDefs from selected blueprint, render form inputs by type, validate before submit. |
| **G-02** | rolePresets unvalidated at API, storage, and consumption layers | **High** | Blueprint | Add a proper Zod schema for rolePresets matching `StaffingRequirement[]`. Validate on write, validate on read in wizard. |
| **G-03** | ProjectWizard Steps 2-3 have no validation | **Medium** | Wizard | Add required checks: role name non-empty, hoursPerDay > 0, headcount >= 1. |
| **G-04** | EstimateWizard has near-zero validation (only name.trim()) | **Medium** | Wizard | Add per-step validation: currency required (Step 0), demand lines need hours > 0 and rates > 0 (Step 3). |
| **G-05** | Project lifecycle has no transition guards (CANCELLED → ACTIVE is allowed) | **Medium** | Process | Add an allowed-transitions map in the `updateStatus` mutation. |
| **G-06** | Blueprint TEXT/TEXTAREA/DATE fields lack runtime validation for minLength/maxLength/pattern/date-range | **Medium** | Validation | Extend `validateCustomFields` to check all constraints that `generateDynamicZodSchema` already supports. |
| **G-07** | Global blueprint fields not validated server-side during entity create/update | **Medium** | Validation | Include global blueprint fieldDefs in `assertBlueprintDynamicFields` resolution. |
| **G-08** | Chapter is a freeform string (9+ models) with no lookup table | **Medium** | Data model | Consider promoting to a first-class entity or at minimum a managed dropdown populated from `SELECT DISTINCT`. |
| **G-09** | LCR/UCR vs costRate/billRate naming split across domains | **Low** | Terminology | Document the mapping explicitly. Consider aliasing in shared types. |
| **G-10** | Dual dispo import routes (`/admin/imports` and `/admin/dispo-imports`) | **Low** | UI | Deprecate and redirect the old route. |
| **G-11** | `packages/ui` nearly empty — all components in apps/web | **Low** | Architecture | Not urgent. Migrate shared components when a second app is needed. |
| **G-12** | Legacy `CreateAllocationSchema` / `UpdateAllocationSchema` still active alongside first-class schemas | **Low** | Terminology | Mark as deprecated in code comments. Plan removal when all consumers migrated. |
| **G-13** | ProjectWizard review step does not show skills, assignment details, or total cost | **Low** | UX | Enhance review panel to surface all collected data. |
| **G-14** | PostProject-creation assignment/demand creation errors silently swallowed | **Medium** | Reliability | Replace empty catch with error reporting and partial-creation recovery UI. |
| **G-15** | Vacation cancel does not reverse entitlement deduction | **Low** | Process | Verify if this is intentional. If approved vacation is cancelled, usedDays should be decremented. |
---
## Priority Matrix
**Fix immediately (High severity):**
- G-01: Blueprint fieldDefs not rendered in ProjectWizard
- G-02: rolePresets unvalidated
**Fix soon (Medium severity):**
- G-03, G-04: Wizard validation gaps
- G-05: Project lifecycle transition guards
- G-06, G-07: Blueprint validation completeness
@@ -381,4 +395,5 @@ Rules Engine → cost attribution and chargeability effect per absence type
- G-14: Silent failure on post-creation
**Track / document (Low severity):**
- G-09 through G-13, G-15: Terminology docs, route cleanup, architecture notes
docs/sdlc.md
+11 -11
View File
@@ -1,4 +1,4 @@
# Secure Development Lifecycle (SDLC) — CapaKraken
# Secure Development Lifecycle (SDLC) — Nexus
> Version: 1.0 | Date: 2026-03-27
@@ -14,22 +14,22 @@ Feature Branch -> Pull Request -> CI Pipeline -> Code Review -> Merge to main ->
Every pull request must pass:
1. **TypeScript strict check**: `pnpm --filter @capakraken/web exec tsc --noEmit`
1. **TypeScript strict check**: `pnpm --filter @nexus/web exec tsc --noEmit`
2. **Linting**: `pnpm lint` (ESLint with strict rules)
3. **Unit tests**: `pnpm test:unit` (Vitest, engine + staffing packages)
4. **E2E tests**: Playwright tests for critical user flows
## Security Gates
| Gate | Tool | Stage |
|------|------|-------|
| Type safety | TypeScript strict mode | Build |
| Input validation | Zod schemas on all tRPC procedures | Build + Runtime |
| Dependency vulnerabilities | Dependabot + `pnpm audit` | PR + Weekly |
| Audit logging | `createAuditEntry()` required for data mutations | Code review |
| RBAC enforcement | `requirePermission()` on new procedures | Code review |
| No hardcoded secrets | PR review checklist | Code review |
| SQL injection prevention | Prisma ORM (parameterized queries only) | Architecture |
| Gate | Tool | Stage |
| -------------------------- | ------------------------------------------------ | --------------- |
| Type safety | TypeScript strict mode | Build |
| Input validation | Zod schemas on all tRPC procedures | Build + Runtime |
| Dependency vulnerabilities | Dependabot + `pnpm audit` | PR + Weekly |
| Audit logging | `createAuditEntry()` required for data mutations | Code review |
| RBAC enforcement | `requirePermission()` on new procedures | Code review |
| No hardcoded secrets | PR review checklist | Code review |
| SQL injection prevention | Prisma ORM (parameterized queries only) | Architecture |
## PR Review Checklist
docs/security-architecture.md
+5 -5
View File
@@ -1,4 +1,4 @@
# Security Architecture — CapaKraken
# Security Architecture — Nexus
> Version: 1.0 | Date: 2026-03-27
@@ -68,7 +68,7 @@ publicProcedure
- The admin settings mutation no longer persists new secret values into `SystemSettings`; secret inputs must be provisioned through environment or a deployment-time secret manager, and legacy database copies can be cleared explicitly
- The admin UI now exposes runtime secret source/status plus an explicit "clear legacy DB secrets" cleanup path so operators can complete the migration without direct database writes
- Production startup now validates Auth.js runtime configuration and refuses to boot if `AUTH_SECRET`/`NEXTAUTH_SECRET` is missing, left on a known development placeholder, paired with a non-HTTPS public auth URL, shorter than 32 characters, or failing a Shannon-entropy check (≥ 3.5 bits/char)
- User passwords: minimum 12 characters, maximum 128 characters; single `PASSWORD_MIN_LENGTH` / `PASSWORD_MAX_LENGTH` constant (`@capakraken/shared/constants`) is imported by every client-side pre-submit validator and server-side Zod schema — prevents client/server policy drift
- User passwords: minimum 12 characters, maximum 128 characters; single `PASSWORD_MIN_LENGTH` / `PASSWORD_MAX_LENGTH` constant (`@nexus/shared/constants`) is imported by every client-side pre-submit validator and server-side Zod schema — prevents client/server policy drift
#### Secret rotation
@@ -223,7 +223,7 @@ cannot escalate to JS execution in this application.
## 10. Dependency Security
- **Dependabot** configured for automated dependency updates
- `pnpm audit` runs in the scheduled [nightly-security.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/nightly-security.yml) workflow, and high-signal architecture guardrails run on every PR in [ci.yml](/home/hartmut/Documents/Copilot/capakraken/.github/workflows/ci.yml)
- `pnpm audit` runs in the scheduled [nightly-security.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/nightly-security.yml) workflow, and high-signal architecture guardrails run on every PR in [ci.yml](/home/hartmut/Documents/Copilot/nexus/.github/workflows/ci.yml)
- Lockfile integrity verified on install
- transitive audit hotspots such as `flatted` and `picomatch` are pinned through root `pnpm.overrides` to keep dev-tooling CVEs from drifting back in through nested dependencies
- runtime workbook parsing and export generation now use `exceljs` boundaries instead of direct `xlsx` usage in application, engine, and web paths
@@ -246,7 +246,7 @@ Browser -> Next.js (port 3100) -> tRPC -> Prisma -> PostgreSQL (port 5433)
### Authentication and Access
- PostgreSQL uses password-based authentication (`capakraken` user with strong password)
- PostgreSQL uses password-based authentication (`nexus` user with strong password)
- Connection restricted to the Docker internal network (port 5433 on host, 5432 inside container)
- No direct internet access to the database — all queries routed through Prisma ORM via the application layer
- Application uses a single database user; no shared or anonymous access
@@ -264,7 +264,7 @@ Browser -> Next.js (port 3100) -> tRPC -> Prisma -> PostgreSQL (port 5433)
- `log_statement=ddl` — all DDL statements (CREATE, ALTER, DROP)
- `log_min_duration_statement=1000` — slow queries (>1s) logged for performance review
- `log_line_prefix='%t [%p] %u@%d '` — timestamp, PID, user, and database in every log line
- **SUPERUSER removed** from the application database user (`capakraken`); hardening script at `scripts/harden-postgres.sh`
- **SUPERUSER removed** from the application database user (`nexus`); hardening script at `scripts/harden-postgres.sh`
- **Minimal privilege grants**: application user has only SELECT, INSERT, UPDATE, DELETE on tables and USAGE/SELECT on sequences — no CREATE, DROP, or SUPERUSER capabilities
### Recommendations for Further Production Hardening
docs/security-audit-2026-03-15.md
+4 -4
View File
@@ -2,7 +2,7 @@
## Scope
Static security review of the current CapaKraken codebase, focused on:
Static security review of the current Nexus codebase, focused on:
- authentication and authorization boundaries
- sensitive read/write API routes
@@ -15,7 +15,7 @@ This review was done by parallel audit slices across API routes, auth/session co
## Executive Summary
The main security problem is not one isolated bug. It is that CapaKraken currently treats "authenticated" as broadly equivalent to "allowed to see most planning data". That shows up in four places:
The main security problem is not one isolated bug. It is that Nexus currently treats "authenticated" as broadly equivalent to "allowed to see most planning data". That shows up in four places:
1. any signed-in user can currently create a vacation request for any `resourceId`
2. many sensitive read routes are only protected by `protectedProcedure`
@@ -119,7 +119,7 @@ Any signed-in user connected to the timeline SSE endpoint can receive metadata a
**Impact**
CapaKraken parses spreadsheet data from files, including browser-side and import-related flows, with a library version that has known high-severity issues when reading crafted workbooks. Export-only flows are lower risk; read/parse flows are the real problem.
Nexus parses spreadsheet data from files, including browser-side and import-related flows, with a library version that has known high-severity issues when reading crafted workbooks. Export-only flows are lower risk; read/parse flows are the real problem.
**Recommended fix**
@@ -193,7 +193,7 @@ The caller is limited to their linked resource, which is good, but the endpoint
**Evidence**
- `packages/db/src/reset-dispo-import.ts:24-31` defaults to `admin@capakraken.dev` / `admin123`
- `packages/db/src/reset-dispo-import.ts:24-31` defaults to `admin@nexus.dev` / `admin123`
- `packages/db/src/reset-dispo-import.ts:107-115` uses `prisma.$executeRawUnsafe(...)`
**Impact**
docs/showcase-execution-batches.md
+4 -3
View File
@@ -1,7 +1,7 @@
# Showcase Execution Batches
**Date:** 2026-04-01
**Purpose:** Canonical execution list for the remaining work to turn CapaKraken into a clean, deterministic, reviewable reference project for disciplined AI-assisted engineering.
**Purpose:** Canonical execution list for the remaining work to turn Nexus into a clean, deterministic, reviewable reference project for disciplined AI-assisted engineering.
## How To Use This List
@@ -25,6 +25,7 @@ Why first:
the timeline is the highest-risk UX surface and still not boringly reliable enough for the showcase goal.
Progress note:
- 2026-04-01: overlay cleanup on timeline `viewMode` changes and initial-loading transitions landed with targeted e2e regression coverage for allocation popovers across view switches.
- 2026-04-01: viewport-change behavior was tightened so point-anchored timeline popovers close on scroll/resize, while element-anchored hover cards remain repositionable; the viewport regression now passes with a non-happy-path e2e.
- 2026-04-01: active timeline gestures now cancel on window blur / hidden-tab transitions instead of leaving drag or resize state stranded; regression coverage verifies a mid-resize focus loss reverts the preview and allows the next interaction to proceed cleanly.
@@ -37,7 +38,7 @@ Slices:
- `todo` verify drag, resize, and selection interactions do not compete under rapid input changes
- `todo` verify SSE first-load, reconnect, and live-update behavior under churn
- `todo` close explicit edge/failure test gaps in timeline e2e and targeted component tests
- `todo` continue shrinking [TimelineView.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/timeline/TimelineView.tsx) into narrower ownership units without changing behavior
- `todo` continue shrinking [TimelineView.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/timeline/TimelineView.tsx) into narrower ownership units without changing behavior
Done criteria:
@@ -76,7 +77,7 @@ Slices:
- `todo` split resource read orchestration out of `resource-read-shared.ts` into focused read helpers without changing API contracts
- `todo` keep router files thin and procedure-support focused
- `todo` continue breaking down large frontend ownership surfaces, starting with [ProjectWizard.tsx](/home/hartmut/Documents/Copilot/capakraken/apps/web/src/components/projects/ProjectWizard.tsx)
- `todo` continue breaking down large frontend ownership surfaces, starting with [ProjectWizard.tsx](/home/hartmut/Documents/Copilot/nexus/apps/web/src/components/projects/ProjectWizard.tsx)
- `todo` add focused tests around extracted helpers before broadening further
Done criteria:
docs/showcase-quality-backlog.md
+13 -13
View File
@@ -1,7 +1,7 @@
# Showcase Quality Backlog
**Date:** 2026-04-01
**Purpose:** Canonical working backlog for the current north star: turn CapaKraken into a clean, reviewable, deterministic reference project for disciplined AI-assisted software engineering.
**Purpose:** Canonical working backlog for the current north star: turn Nexus into a clean, reviewable, deterministic reference project for disciplined AI-assisted software engineering.
## North Star
@@ -19,10 +19,10 @@ The goal is:
This backlog consolidates the still-relevant work from:
- [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md)
- [architecture-hardening-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/architecture-hardening-backlog.md)
- [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/domain-slices-backlog.md)
- [api-router-procedure-support-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/api-router-procedure-support-backlog.md)
- [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md)
- [architecture-hardening-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/architecture-hardening-backlog.md)
- [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/domain-slices-backlog.md)
- [api-router-procedure-support-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/api-router-procedure-support-backlog.md)
## Working Rules
@@ -71,7 +71,7 @@ Immediate checks:
### P1. Timeline Interaction, Overlay, And SSE Stability
Status: active
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/domain-slices-backlog.md)
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/domain-slices-backlog.md)
Remaining work:
@@ -89,7 +89,7 @@ Definition of done:
### P2. Holiday/Vacation Correctness And Explainability Parity
Status: active
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/domain-slices-backlog.md)
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/domain-slices-backlog.md)
Remaining work:
@@ -106,8 +106,8 @@ Definition of done:
Status: next structural cleanup
Sources:
- [api-router-procedure-support-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/api-router-procedure-support-backlog.md)
- [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md)
- [api-router-procedure-support-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/api-router-procedure-support-backlog.md)
- [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md)
Remaining work:
@@ -123,7 +123,7 @@ Definition of done:
### P4. Notification/Task/Broadcast Reliability Residuals
Status: active but below timeline/resource cleanup
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/capakraken/docs/domain-slices-backlog.md)
Source: [domain-slices-backlog.md](/home/hartmut/Documents/Copilot/nexus/docs/domain-slices-backlog.md)
Remaining work:
@@ -138,7 +138,7 @@ Definition of done:
### P5. Measurable Guardrails In CI
Status: open
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md)
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md)
Remaining work:
@@ -154,7 +154,7 @@ Definition of done:
### P6. Operational Standardization
Status: open
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md)
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md)
Remaining work:
@@ -169,7 +169,7 @@ Definition of done:
### P7. Reference-Project Artifacts
Status: open
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/capakraken/docs/ai-excellence-due-diligence-roadmap.md)
Source: [ai-excellence-due-diligence-roadmap.md](/home/hartmut/Documents/Copilot/nexus/docs/ai-excellence-due-diligence-roadmap.md)
Remaining work: