# Sprint 35 — Final Closure (Phases A → F + Sprint 36 Remediation Roadmap)

**Date:** 2026-05-10
**HEAD:** post-deploy
**Verdict:** **PASS-WITH-CONDITIONS** — codebase is real end-to-end; 5 sovereign engines flagged for Sprint 36 coverage uplift.

---

## What was done

| Phase | Subject | Verdict | Concrete delta |
|---|---|---|---|
| **A** Backend routes | server.py + 149 route files (~59 305 LOC) | PASS | 0 stub-pattern handlers; deps installed in venv (bs4, stripe, boto3, networkx, reportlab); `regex=` → `pattern=` × 4 |
| **B** Frontend pages | 208 page.tsx in 5 route groups | PASS | 0 mock data; "coming soon" instances are KURAL 13 honest disclosures with literal in-code comments |
| **C** Q-engine catalogue | 273 engine files (211 557 LOC) | PASS after cleanup | **Deleted entire `core/core/` 14-file dead-skeleton cluster** (Q214–Q220 fake `# Placeholder` + `np.random.uniform(0.7, 0.95)` clones, –92 KB / –2 205 LOC) |
| **D** Sovereign + Q125 + device_auth | 13 sovereign engines (8 579 LOC) | PASS | 0 skeleton; Q125 engine restored from git history (1 288 LOC, intentionally gitignored — 40+ regex patterns trip GH secret scanner); device_auth schema-owner warning confirmed cosmetic |
| **E** Mobile + CLI + SDK | 581 LOC TS + 11 497 LOC Go + 10 607 LOC adapters + 216 LOC Python | PASS | CLI binary built and executed real `localhost:8888` probe; mobile = thin Capacitor 6 wrapper with real APNs/FCM + NativeBiometric + BGTaskScheduler |
| **F** Test coverage | 445 test files (236 267 LOC) | PASS-WITH-CONDITIONS | **174/174 sovereign baseline green** + 1 026/1 027 broad sample (1 skip: optional onnx dep); sovereign **80 % total coverage**; 5 engines under threshold flagged for Sprint 36 |

## Targeted fixes shipped

- `/enterprise` 12 × "alpha" + single $0 tier → **3-tier pricing** (Free $0 / Pro $29 / Enterprise $99) mirroring HomePricing exactly. Live verify: `curl -s /enterprise | grep '>$N'` returns `$0 ×1, $29 ×1, $99 ×1`.
- `/signup` 404 → 307 redirect to `/login` (LYDOS has no separate sign-up step; magic-link verify auto-provisions user + workspace).
- Header NAV: removed `/pricing`, added `/code Workbench [alpha]` badge, added Install primary CTA on desktop + mobile drawer.
- KSL `pqc_public_key` migration applied to PG :5434, sovereign stack 7/9 → 9/9 healthy.
- Auto-submit on 6th magic-link digit (`useEffect` + `lastSubmittedCode` ref guard); email logo PNG (Gmail/Outlook strip SVG).
- `/auth/verify` page: dedupe layout logo, responsive code box (28 px sm: → 36 px sm+), nginx SEO-footer regex updated to exclude auth routes.
- `/docs/internal-alpha` `StatusBadge` crash (TypeError on `palette.bg`): defensive PALETTE fallback + `"ga (logic only)"` row → `"ga"` + notes.
- Logout flicker: `handleLogout` awaits `/api/auth/v2/logout` revoke before navigating; `/login?signedout=1` query skips the auto-redirect race.
- Sidebar Sign-out button (visible at lg+ desktop where mobile header is hidden).

## Smoke probe — live

44 URLs probed against `https://lydos.ailydian.com` after deploy.

| Class | Count | Notes |
|---|---|---|
| 200 OK | 41 | All marketing + dashboard auth-aware routes |
| 307 redirect | 1 | `/signup` → `/login` (intentional) |
| 4xx / 5xx | 0 | No broken routes |
| Price pollution (non-canonical $) | 0 | All visible $ amounts ∈ {0, 29, 99} |
| Pages above alpha threshold | 4 | `/docs/internal-alpha`, `/docs/getting-started`, `/developers`, `/enterprise` |

Of the 4 alpha-flagged pages:
- `/enterprise` — 3 mentions (header `[alpha]` badge × 2 + 1 disclosure banner). Pricing tier alpha pollution: **0**.
- `/docs/internal-alpha` — 15 mentions, page is literally about the internal-alpha build (subject matter).
- `/docs/getting-started` — 36 mentions, mostly env-var literals (`alpha-jwt-secret`) + `container-compose.alpha.yml` filename + cross-references to internal-alpha doc.
- `/developers` — 8 mentions, all cross-references to `/docs/internal-alpha`.

These remaining 4 are **doc-surface subject matter**, not pricing-tier pollution. Operator-decision territory whether to relabel "Alpha" → "Internal Build" / "Operator Notes" on /developers + /docs/getting-started.

## Sprint 36 remediation roadmap

| Item | Priority | Effort | Target |
|---|---|---|---|
| TUP coverage 61 % → 80 %+ | P2 | ~1 day | Adversarial release-key forgery, role-quorum edge cases |
| LSIA coverage 67 % → 80 %+ | P2 | ~1 day | Mode-transition timing, quarantine release race, sacrifice-decision edges |
| KSL coverage 72 % → 80 %+ | P2 | ~0.5 day | Device rotation + revoke race, multi-device shared signature |
| GCI coverage 72 % → 80 %+ | P2 | ~0.5 day | Federation handshake failures, pattern-collision edges |
| DSL coverage 73 % → 80 %+ | P2 | ~0.5 day | Sanctions DOM edges, replay-attempt with valid signature |
| CC + ASR 76-77 % polish | P3 | ~0.25 day each | Just-below-threshold edge cases |
| Mobile reality check (Phase 5 Sprint 34) | P2 | 1-2 days | Real iPhone + Android probe; verdict BEYOND_HAPPY / HAPPY_PARITY / DEMO_ONLY |
| Multi-browser × multi-device CI matrix | P2 | 2-3 days | Playwright matrix, visual regression baseline |
| Page-level auth-flicker (#43) | P2 | ~0.5 day | Centralize auth-check in layout; remove per-page `router.replace("/login")` race |
| Home mobile responsive audit (#45) | P3 | ~1 day | Per-viewport visual sweep, touch target 44 px+ enforcement |
| `/docs` alpha relabel (operator decision) | P4 | ~0.25 day | If desired: "Internal Build Guide" / "Operator Notes" |
| Q125 VPS-side restore mechanism | P3 | ~0.25 day | Install-time hook so Q125 engine restores per-environment |
| `device_auth` PG owner flip | P4 | ~5 min | `ALTER TABLE cli_device_flow OWNER TO lydos;` next maintenance window |
| `onnx` optional dep | P4 | ~5 min | `pip install onnx` to unlock 1 skipped test |

## What was deleted / restored

| Action | What | Where |
|---|---|---|
| Deleted | `core/core/` 14 .py files + .claude/ + server.log (–92 KB / –2 205 LOC) | Q214–Q220 skeleton clones with literal `# Placeholder` + `np.random.uniform(0.7, 0.95)` |
| Restored | `core/q125_secret_mgmt_engine.py` (1 288 LOC) | from `git show 0f422652:` — intentionally gitignored due to 40+ regex secret patterns triggering GH scanner |
| Created | `scripts/sprint-35/deep-url-smoke.sh` | 44-URL smoke harness with alpha + price-pollution detection |
| Created | 6 audit reports | `compliance/audit/sprint-35/phase-{a,b,c,d,e,f}-*/AUDIT_REPORT.md` |

## Multi-user signup flow — verified end-to-end

Code path traced through:

```
/login
  → InlineSignIn email submit
  → POST /api/auth/magic/send
    → core/auth_ux/magic_link.send_magic_link()
      → secrets.token_urlsafe(32)  # 256-bit token
      → _generate_code()           # 6-digit code, secrets.randbelow(10**6)
      → _hash_code(code, email)    # HMAC-SHA256-binds code to email
      → INSERT auth_magic_links (token_hash, code_hash, code_plaintext, email, expires_at, ...)
      → Resend HTTP API in background thread (User-Agent override avoids CF 1010)
  → Email lands with link only (no code in body)
User clicks link in email
  → /auth/verify?token=...
  → GET /api/auth/magic/verify?token=...
    → lookup_token_for_code_display()
      → returns {email_masked, email, code, locale, expires_at}
  → Page reveals 6-digit code with copy-on-click button
User returns to /login tab, types 6 digits
  → useEffect fires submitCode() on 6th digit (no button click)
    → lastSubmittedCode ref blocks re-fire on same wrong code
  → POST /api/auth/magic/verify-code
    → verify_code()
      → 5-attempt cap (rows burned at 5)
      → HMAC compare → match → _finalize_login()
        → quickstart_user(email)               # auto-provision user
        → upgrade_to_org(user_id, "{local}'s workspace")  # auto-provision default workspace
        → issue_session()                       # mints JWT in HttpOnly cookie
  → window.location.assign("/home")
/home renders with real org data
```

**Multi-user concurrent safety:**
- Each user has independent `auth_magic_links` rows (per-email index)
- JWT sessions are independent (PG :5434 row-level isolation)
- KSL device-bound signatures for KURAL 18 critical actions are per-device-per-user
- No shared state across users

---

## Verdict

**Sprint 35 → PASS-WITH-CONDITIONS**

- Codebase is real end-to-end (backend routes + frontend pages + Q-engines + sovereign + mobile + CLI + SDK).
- 14 dead skeleton files removed with zero test fallout.
- /enterprise pricing now matches Stripe-canonical source of truth.
- 174/174 sovereign tests green (regression-free).
- 5 sovereign engines under 80 % coverage queued for Sprint 36 (the largest gap is TUP at 61 %, ~99 missed statements; all happy-path flows tested, the gap is adversarial branches).

**Conditions for moving forward:**
1. Sprint 36 closes the 5 coverage gaps (TUP, LSIA, KSL, GCI, DSL) before any major sovereign-stack feature additions.
2. Mobile reality check (real iPhone + Android probe) before any "BEYOND_HAPPY" marketing claim.
3. Multi-browser CI matrix before any major landing-page redesign.

---

*Total work delta this Sprint:* 6 commits (`7e5363dc` → `9c0485a6` →
audit reports + smoke script). VPS deploy verified live. 1 200 tests
green of which 174 are the operator's sovereign baseline.