[mvalancy]

Core could lose queued layout changes or newer form edits when saves completed late. Folder access, magic-link replay and password-login controls also needed stronger enforcement. This integrates the existing graph workflow work with those fixes and required browser gates that reject missing, skipped or flaky evidence.

The reviewed implementation and test stack is merged into this audit branch. Final frozen head: 385e7679fabc60b80cd65cf0a1aa4cdf3d592514. It includes the reviewed Zod and MCP stdout follow-ups. Its complete tree matches candidate 9246730, whose only changes from locally validated combined candidate df1fac1 are two evidence documents. The earlier functional integration 84f1c0d exactly matched the original fully tested browser candidate bdf82cc.

Changes

• Preserve failed layout saves across in-app Graph/List navigation while the tab stays open, isolate queues by account, and retain newer details drafts and scoped undo history through delayed save completion.
• Enforce folder ownership/current stored roles, consume magic links atomically once, bound failed GraphQL password attempts, and reject missing/default production signing secrets before startup.
• Validate Node 22.18+ and Node 24, update runtime dependencies and containers, and enforce production high/critical dependency and bundle gates. Pin the actual MCP SDK consumer to patched Zod 4.6.7 and give the audit step a fresh per-attempt cache.
• Keep operational MCP diagnostics on stderr. A real entry-point/Neo4j regression verifies JSON-RPC output, persisted data, error recovery, child shutdown and fail-stop cleanup.
• Use owned browser fixtures, real saved-data readback, locked touch input and measured graph performance. Keep the earlier failures and test corrections visible.
• Make required browser gates reject incomplete, skipped, flaky or synthetic-failure evidence; retain bounded diagnostics and safe-path failure attachments; make new-user, mobile and performance selections strict CI gates.

Validation

The repository validation ledger records exact source revisions, commands, retained failures, scoped merge commits and limits. The local browser counts below belong to the retained e120df4/bdf82cc runs; local install/build/unit/harness/type/lint/bundle/database/audit results belong to combined candidate df1fac1. Final public-head CI is reported separately below. Local evidence:

Gate	Result
Workspace unit suites	603 passed; 26 explicitly DB-gated skips
Evidence/harness regressions	161 passed, zero skips
Headed new-user acceptance	42 passed, zero retries/skips
Strict smoke	6 passed, no flaky/skipped cases
Complete strict mobile	27 passed, zero retries/skips
Strict performance / headed graph effects	3 / 3 passed, separate suites
Real Neo4j contract	9 passed on an owned disposable database, including actual MCP stdio
One-off HTTP authorization probe	8 checks passed; separate from the committed regression harness

Local build, types, lint, fresh lockfile installation and bundle budget pass. Both production API image variants (packages/server/Dockerfile and deployment/Dockerfile) were rebuilt locally at exact 385e767: missing-secrets rejection, configured health/Neo4j, generated-admin login, matching authenticated me, and anonymous me=null pass; Node 22.23.4, Zod 4.6.7 and production mode were verified. Optional MCP was offline in these image probes; its compiled entry point was validated separately. Temporary containers, identities and private credential files were removed. Images remain local; no deployment occurred. The earlier production scan reported eight moderate findings only; a fresh scan on unchanged 78a90cc then correctly blocked approval with the Zod high advisory. Both responses remain recorded. The patched combined candidate's fresh-cache audit passes with zero high/critical and eight moderate findings. The discrepancy's exact metadata/cache cause is unproven; development-dependency findings remain separately documented.

Final public CI passes on 385e767. CI run 40025965786 passed CI Success, every intended Smoke Gate test stage, static checks, all unit jobs, the real Neo4j/MCP contract, build/bundle and the fresh-cache production dependency threshold. Comprehensive run 40025965837 passed both Node 22.18/Node 24 matrix jobs and installer/deploy-config checks. GitHub tested synthetic merge checkout e463f4a3846e87b2c6fbe48e1be93102087cd70e; its entire tree 6bf014bcc30eb6e21c0deeae4db9c7d4effeaac2 matches the frozen PR head. The main/nightly-only production-stack job is intentionally skipped on PRs and is not counted as a pass; local production-image validation is separate. Current checks. Historical run 40022720276 completed all browser gates on the earlier application tree; it is not the patched dependency's final security pass. Cancelled isolated branch runs are not counted as passes.

Final uploaded browser artifact 12533273048 was independently inspected: 6 smoke, 42 headed new-user, 27 mobile and 3 performance cases passed, with zero failed/warned/skipped cases, all exit codes 0, no timeout and no evidence errors. Every normalized report starts and ends on clean, unchanged checkout e463f4a with source fingerprint a07170414e585b9e2c2356d836b07e1071b0f8ace69b1b12185f64ac60085ab8. New-user/mobile/performance commands explicitly use one worker and zero retries. The separate living-graph log confirms 3 passed. Strict adapters reject flaky/failed attempts; raw Playwright JSON and inline per-case performance metric attachments are not retained in this normalized artifact. The performance assertions themselves passed.

Review and release limits

This PR includes pre-existing graph workflow commits from improve/real-workflows-responsive, alongside the scoped audit fixes. It is broader than a single bug fix. The original 19 scoped PRs, documentation PR #178, and MCP follow-ups #179/#180 have been reviewed and merged into this audit branch; issue #156 carries progress and review links.

Merged into dev as 9068cd31824991330c6d92196654e53e04e29063 at 2026-10-23 22:22:22 UTC using Matthew’s explicitly authorized admin merge. The complete resulting tree exactly matches the validated head. Matthew separately authorized permanently disabling only dev admin enforcement and documenting a high testing bar for agents; independent read-back verified every other protection field unchanged. Non-admin review count remains one and force pushes/deletions remain disabled. This is an admin merge, not a submitted non-author approval. Named required status checks remain a follow-up in #187. Policy documentation subsequently merged in #188; final dev is ef495eff15ed7aac51e72dc7a1db1bb96d2b3695, with unchanged application/test/build/dependency content. Final branch CI and Node/installer CI both passed on actual ef495ef. The earlier 9068cd3 CI was superseded/cancelled, not passed. No identity or authentication scopes changed.

No deployment has occurred. A read-only desktop/phone check confirms graphdone.com's sign-in page renders, but the live release remains Core f8fb968 / Cloud 304629e, built September 13. Its health endpoint reports worker liveness with the database explicitly not probed. Hosted email/OAuth, D1 mutations and persistence, complete accessibility, all 62 acceptance questions and a comprehensive release-security claim remain unverified or blocked as documented in the ledger.

Final evidence: browser artifact 12537396736, source fingerprint e375ead712ec55ec23749d7b90d852f056a873e78d851bc76d320c4033a6921d. Strict reports contain zero failed/warned/skipped cases, no timeout/evidence errors, and clean unchanged start/end source. Complete closeout record.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[github-actions]

🧪 Comprehensive Test Suite

• Unit suites (Node 22.18.0 & 24.x) — core, web, server, mcp-server: ✅ passed
• Installer & deploy config: ✅ passed

Full-stack smoke gate runs in the CI workflow.

[mvalancy]

Production-image validation is complete on frozen public head 385e7679fabc60b80cd65cf0a1aa4cdf3d592514:

• API image: sha256:a1972a2814c9cb94ea3265b94398b2e8a90620bb3ebbc24e1133e11cde52a263.
• Generic image: sha256:0303345260104afa2748c7a90eac986fe94c6a3683160a6e7f97d3a3e2555dbd.
• Both OCI revision labels match the frozen source. Both builds exit 0.
• Each no-network startup without secrets exits 1 with the expected rejection. Each configured production startup reports healthy API/owned Neo4j, successful generated-admin login and matching authenticated me; anonymous me is null.
• Node 22.23.4, Zod 4.6.7 and NODE_ENV=production were checked inside both images. Optional hosted MCP remains offline for these API images, as expected; the separate compiled MCP/stdin-stdout probe is recorded elsewhere.
• Generated test identities, temporary containers and private credential files were removed. The owned local API/Vite/Neo4j test services are stopped; unrelated services were not changed. Image tags are local only.

These are build/startup/behavior checks, not an OS/container-vulnerability clearance. The images retain the existing dependency packaging; development-tool advisory scope remains documented. No image was pushed to a registry and nothing was deployed.

Final public CI is run 40025965786, with Node matrix/installer run 40025965837 already passing. Static/unit/database/audit jobs pass; strict browser stages are still running. Final approval remains pending.

[mvalancy]

Ready for final non-author review at frozen 385e7679fabc60b80cd65cf0a1aa4cdf3d592514; base remains 8a7de052eb60fe517f45681dc42b5b169d09c660.

@Patel230 @jeffreygh — the requested review is the remaining protected-merge prerequisite. Final CI, supported-Node/installer CI, independent normalized-artifact inspection and both local production-image checks pass. The PR body and repository ledger distinguish the tested revisions, regression evidence and remaining limits.

The continuing independent closeout work is recorded in #156, including the newly verified device-local guest path and focused follow-ups #181–#187. None of those observations changes this PR's source or claims hosted D1/email/OAuth acceptance. All planned changes for this integration are concrete and reviewable; no approval is being inferred from agent comments or admin access.

After legitimate approval, the remaining actions are normal protected integration, verification of the resulting dev commit and applicable push checks, then evidence-backed closure of #156/#162. No force push, protection weakening, identity switch or deployment is proposed.