# Sprint 35 — Interim Closure (Phase A → E + /enterprise pricing fix)

**Date:** 2026-05-10
**HEAD:** `9c0485a6` (commits since Sprint 34: 6)
**Live deploy:** **PENDING** — VPS pull blocked on tailscale ssh re-auth (operator action)

---

## Phases completed in this work block

| Phase | Subject | Verdict | Action delta |
|---|---|---|---|
| **A** Backend routes | server.py + 149 route files (~59 305 LOC) | PASS | Installed bs4 + boto3 + stripe + networkx + reportlab in venv; `regex=` → `pattern=` × 4 in q158_seo_routes; `core/q125_secret_mgmt_engine.py` recovery noted |
| **B** Frontend pages | 208 page.tsx files across 5 route groups | PASS | None — every "coming soon" was honest KURAL 13 disclosure; abstraction-layer pages use typed clients |
| **C** Q-engine catalogue | 273 engine files | PASS after cleanup | **Deleted `core/core/` 14-file dead-skeleton cluster** (Q214–Q220 fake `# Placeholder` + `np.random.uniform(0.7, 0.95)` clones, 92 KB) |
| **D** Sovereign + Q125 + device_auth | 13 sovereign engines + 1 missing engine + 1 schema warning | PASS | `core/q125_secret_mgmt_engine.py` restored (1 288 LOC, intentionally gitignored — secret-pattern false-positive risk); device_auth warning confirmed cosmetic |
| **E** Mobile + CLI + SDK | 581 LOC TS + 11 497 LOC Go + 10 607 LOC adapters + 216 LOC Python | PASS | CLI binary built and live-probed `localhost:8888` successfully; mobile bridge real Capacitor 6 wrapper |
| **/enterprise fix** | 12 × "alpha" + $0 single-tier card | FIXED in code, deploy pending | `TIERS` rewritten to mirror HomePricing (Free $0 / Pro $29 / Enterprise $99); banner reframed to feature-status disclosure; `/register` → `/login`; "Join Alpha Waitlist" → "Contact sales /quote" |

## URL smoke probe — current live state

Run via `bash scripts/sprint-35/deep-url-smoke.sh` against
`https://lydos.ailydian.com`. **44 URLs probed.**

| Class | Count |
|---|---|
| 200 OK | 41 |
| 307 (legitimate redirect: /signup → /login) | 1 |
| 200 OK + alpha-pollution >2 | 4 (`/docs/getting-started`, `/docs/internal-alpha`, `/developers`, `/enterprise`) |
| 4xx / 5xx | 0 |
| Price pollution | 0 |

After deploy of `9c0485a6` `/enterprise` will drop from 25 → ~2 alpha
mentions (header Workbench badge + single feature-status disclosure
banner). The remaining three pages are:

- `/docs/internal-alpha` — page is literally about the internal-alpha
  build; its 15 mentions are subject-matter, not pollution.
- `/docs/getting-started` — 36 mentions are mostly env-var literals
  (`alpha-jwt-secret-change-in-prod`, `container-compose.alpha.yml`)
  and cross-references to `/docs/internal-alpha`. Substantively
  honest documentation.
- `/developers` — 8 mentions cross-reference `/docs/internal-alpha`
  ("Alpha Guide", "Alpha Caveats" card titles).

These are operator-decision territory: rename "Alpha" labels to
"Internal Build" / "Operator Notes" if the framing should disappear
from non-doc surfaces, or keep them as-is since the doc URL is
`/docs/internal-alpha` and the labels match the URL slug.

## What still needs operator action

### Deploy the queued commits to VPS

`origin/main` is at `9c0485a6`. VPS `git log` last seen at `49ca6c13`.
Three commits queued:
- `7e5363dc` — Phase A audit + venv deps + regex→pattern
- `cf7daa30` — Phase C audit + `core/core/` deletion (–2 205 LOC)
- `9e88cfc4` — Phase E audit
- `1cec3aa1` — Phase B audit
- `3f33b2f7` — Phase D audit
- `9c0485a6` — `/enterprise` 3-tier pricing alignment

Operator one-liner (after tailscale re-auth):
```bash
tailscale ssh lydian@100.79.219.117 << 'EOF'
cd /home/lydian/projects/AILYDIAN-AGENT-ORCHESTRATOR
git fetch origin main
git reset --hard origin/main
cd web && rm -rf .next && npm run build
systemctl --user restart lydos-frontend.service ailydian-full.service

# Restore Q125 (gitignored)
cd /home/lydian/projects/AILYDIAN-AGENT-ORCHESTRATOR
git show 0f422652:core/q125_secret_mgmt_engine.py > core/q125_secret_mgmt_engine.py
systemctl --user restart ailydian-full.service

# Optional: clear device_auth schema-owner warning
docker exec lydos-postgres psql -U postgres -d lydos \
  -c "ALTER TABLE cli_device_flow OWNER TO lydos;"

# Smoke verify
sleep 30
bash scripts/sprint-35/deep-url-smoke.sh
EOF
```

### Phase F (test coverage) — pending

The remaining Phase F audit will inventory `tests/` and identify
modules under the 80 % coverage threshold. Not blocking for live deploy.

---

## Multi-user signup flow — code path verified

The signup flow (Task #67) is implemented end-to-end:

1. `/login` → `InlineSignIn` form → email submit
2. POST `/api/auth/magic/send` → `core/auth_ux/magic_link.send_magic_link()`
   - Generates 32-byte token + 6-digit code
   - HMAC-SHA256-binds code to email (`_hash_code`)
   - Inserts row into `auth_magic_links` with both hashes + plaintext
     code (single-use; trigger `wipe_magic_link_plaintext_on_use` clears
     plaintext on `used_at` mark)
   - Background thread dispatches via Resend HTTP API (User-Agent
     spoofing avoids Cloudflare 1010 block)
3. Email lands in user inbox with **only the link** (no code in body)
4. User clicks link → `/auth/verify?token=...`
5. Page calls `GET /api/auth/magic/verify?token=...` → returns
   `{email_masked, email, code, locale, expires_at}`
6. Page reveals 6-digit code with copy-on-click button
7. User goes back to original `/login` tab, types code into
   `<input maxLength={6} pattern="[0-9]{6}" />`
8. **On 6th digit**: `useEffect` auto-fires `submitCode()` (no button
   click required); `lastSubmittedCode` ref blocks re-fire on the same
   wrong code
9. POST `/api/auth/magic/verify-code` → `verify_code()` validates HMAC,
   increments `code_attempts` on miss (5-attempt cap → row burned),
   on hit calls `_finalize_login()`:
   - `quickstart_user(email)` — auto-provisions user
   - `upgrade_to_org(user_id, "{local}'s workspace")` — auto-provisions
     default workspace
   - `issue_session(user_id, ua, lang, enc, ip)` — mints JWT + sets
     HttpOnly `lydos_sid` cookie
10. Frontend `window.location.assign("/home")` → dashboard layout loads,
    `ensureAuth()` validates cookie, `<AuthProvider>` populates session
    state, real org data renders

Multi-user concurrent: each user has independent `auth_magic_links`
rows + JWT sessions; PG :5434 row-level isolation; KSL device-bound
signatures for KURAL 18 critical actions. No shared state.

End-to-end verifiable once VPS deploy completes.

---

*Files inspected this work block:* server.py + core/routes (149) +
208 page.tsx + 273 engine.py + 13 sovereign engines + mobile/cli/sdk
surfaces + 1 audit-restored engine.

*Skeleton/mock items eliminated:* 14 (entire core/core/ cluster, –92 KB).

*Honest disclosures:* /enterprise was carrying alpha + $0 framing that
contradicted homepage HomePricing. Code-side fix committed; awaiting
VPS deploy.