epic: vertical slice – one request end to end

[Fluory]

Goal

One quote request travels end to end through all layers – login, tenant isolation, upload, AI extraction with grounding, review, idempotent export – on local Docker. This is milestone M1 – secure core (docs/product/roadmap.md).

Issues (in order)

• chore(app): TS app skeleton, docker compose and verify commands #3
• feat(identity,tenancy): invite-only login, companies and forced RLS #4
• feat(intake): upload a request and enqueue processing atomically #5
• feat(ai-service): stateless extraction service with grounding verifier #6
• feat(jobs,extraction): process requests in the worker with retries and visible errors #7
• feat(review): review fields beside their source, correct, approve or reject #8
• feat(export): export approved requests exactly once to the ERP mock #9

Acceptance

• Demo of the full slice on docker compose up with synthetic data
• Cross-tenant, atomic-enqueue and exactly-once tests green in CI

Only the first issue is ready; the orchestrator sets ready on the next ones.

[Fluory]

Morning report (final, 2026-09-23 ~09:15 UTC) – overnight implementation run

The whole work queue is implemented. Every issue has its own stacked PR, all ready for review, none merged. Each got a fresh independent review subagent; findings and resolutions are posted as a comment on each PR.

Issue	PR	State	verify / CI	Open decisions
#3 app skeleton	#21	ready for review	local verify green; CI check + compose-smoke green	#3: DB roles created by init script, migration only verifies them
#4 identity + tenancy	#31	ready for review	local verify green; CI green; security review	#4: invitation by link (no e-mail), one company per user, no password reset
#5 intake upload	#32	ready for review	local verify green; CI green; security review	#5: no per-user upload rate limit; .msg signature-only check
#6 AI service	#33	ready for review	pytest green; CI green	#6: token min. 24 chars; live Vertex call unverified
#7 jobs/worker	#34	ready for review	local verify green; CI green	retry parameters (5 × 30 s…30 min) to confirm
#8 review UI	#35	ready for review	local verify + Playwright smoke green; CI green	#8: source view is a text view of the PDF page/mail, not a rendered PDF
#9 ERP export	#36	ready for review	local verify + smoke through „Exportiert"; CI green	#9: ERP mock keeps idempotency keys in memory (reversible)
#29 RLS guard	#37	ready for review	local verify green; CI green; security review	–
#30 user management	#38	ready for review	local verify + smoke green; CI green; security review: 1 blocker found and fixed	–
#22 full field set	#39	ready for review	local verify + pytest + smoke green; CI green	live Vertex call with line items unverified
#23 formats (XLSX/DOCX/MSG/OCR)	#40	ready for review	local verify green (Unit 135, Integration 98, pytest 387); CI green; security review: 1 blocker (OLE bomb in .msg) found and fixed	#23: OCR is off by default (AI_PDF_OCR=off); the RapidOCR models come from modelscope.cn, prefetch via PREFETCH_OCR_MODELS – source and approval needed before enabling
#24 evals	#41	ready for review	pytest + replay gate PASSED; CI green (incl. new step „AI eval gate (replay)")	#24: gate threshold 5 points to agree with the customer; recorded answers are hand-written (no credentials), so the gate cannot see prompt regressions; scan cases run without OCR in CI
#25 line-item review UI	#42	ready for review	verify + both smoke flows green; CI green	–
#26 request list	#43	ready for review	verify green; CI green	–
#27 duplicates UI	#44	ready for review	verify green (fresh DB 0000 → 0015); CI green	decision-needed on #27: possible duplicates are still processed automatically; the decision happens at review, approval requires it (most reversible option)
#28 observability	#45	ready for review	verify:full green on the top of the stack (head 09af010, fresh DB): Unit 154/154, Integration 114/114, depcruise, build, audit (no high, 1 moderate), both E2E flows, eval gate PASSED; pytest 423 passed / 2 skipped (docling model tests need AI_TEST_DOCLING_MODELS=1); CI green; security review	–

Merge order (stack, merge commits, not squash): #21 → #31 → #32 → #33 → #34 → #35 → #36 → #37 → #38 → #39 → #40 → #41 → #42 → #43 → #44 → #45. Each PR's base is the previous branch; after a merge GitHub retargets the next PR.

Security notes:

• feat(identity): simple user and role management for admins #30 / Better Auth: the organization plugin grants its creatorRole every plugin permission regardless of the configured roles, and some plugin endpoints (/organization/leave, /organization/list-members) have no role check. feat(identity): simple user and role management for admins #38 makes the creator role unreachable and disables all /organization/* endpoints except set-active; tested with a mutation probe.
• feat(ai-service): XLSX, DOCX, MSG and scanned PDFs #23 / Outlook .msg: a crafted OLE file could make the parser allocate without bound. feat(ai-service): XLSX, DOCX, MSG and scanned PDFs #40 rejects malformed OLE structures, caps part size (16 MiB) and DOCX blocks, and adds a shared parse budget across attachments.
• feat(observability): correlated structured logs and full health #28: /api/health is public and now reports dependency reachability and backlog (cached 10 s) – put it behind the proxy/auth before a public deployment (documented in api.md).

Not verified in this run (no credentials by design): any live Vertex AI call (adapter built against the SDK docs, covered with recorded-response fixtures); OCR model download in CI.

Follow-ups worth an issue:

1. The ERP export does not send line items yet (contract v1 knows three header fields only) – corrected line items are audited but do not reach the ERP.
2. field_corrections.item_index has no DB CHECK (>= 0) – validated in the app.
3. Request list has no pagination.
4. OCR evals in CI (the after_ocr expectations are ready) once the model source is approved.
5. Verifier weakness (eval case t03): a quote across a table cell boundary fails the unit check.
6. AI service log format (ts, upper-case level) differs from pino – align before log shipping.
7. Page component tests for /requests/:id (covered by E2E only).

Housekeeping: the remote helper branch claude/feat-ai-ts-22 (fully merged into #39) could not be deleted (network error) – safe to delete. Worktree RequestFlow-wt-3 was not touched.

Environment notes: Docker Hub answered 429 all night → local services ran as native PostgreSQL 17 + SeaweedFS; docker compose up is proven by the CI job compose-smoke. Local verify for #35 ran on Node 22 (PATH drift after a restart); from #36 on, Node 24.

Next run starts with: review/merge of the stack in the order above. Then the follow-ups above, starting with 1 (line items in the ERP export – needs a contract v2 decision) and the open decisions on #23 and #27.

---

Generated by Claude Code

[Fluory]

Stack merged (2026-09-23, on the orchestrator's instruction)

All 16 PRs are merged into main with merge commits, in stack order: #21 → #31 → #32 → #33 → #34 → #35 → #36 → #37 → #38 → #39 → #40 → #41 → #42 → #43 → #44 → #45.

• Each PR was retargeted to main and merged only after the required check passed against main. feat(tenancy): guard test – every app table has forced RLS #37 and feat(evals): eval runner, 15 weighted synthetic cases and CI gate #41–feat(observability): correlated structured logs and full health #45 needed one fresh run each: their first run on the new base came before the PRs below them were merged, so the PR guard counted those PRs' files as their own. The code was unchanged, and a body update (new base recorded) triggered the fresh run.
• main's tree is identical to the head of feat(observability): correlated structured logs and full health #45 (09af010), which passed verify:full locally (Unit 154/154, Integration 114/114, both E2E flows, eval gate PASSED, pytest 423 passed / 2 skipped).
• Issues chore(app): TS app skeleton, docker compose and verify commands #3–feat(export): export approved requests exactly once to the ERP mock #9 and feat(ai-service): full field set including line items #22–feat(identity): simple user and role management for admins #30 were closed by their PRs. The epics epic: vertical slice – one request end to end #2, epic: full extraction and quality gate #17 and epic: robustness and operations #18 stay open for you to close.
• Follow-ups are filed as issues feat(export): send reviewed line items to the ERP (contract v2) #46–chore(observability): align the AI service log format with the web/worker logs #51 (no ready label – priority and ready are yours).
• The merged head branches are still on the remote (plus the helper branch claude/feat-ai-ts-22) and can be deleted.

---

Generated by Claude Code

[Fluory]

Closed on the orchestrator's instruction: every issue of this epic (#3–#9) is merged into main (PRs #21, #31–#36). Follow-ups are tracked in #46–#51; the design is in PR #53 (#52).

---

Generated by Claude Code