# Sprint 37 — Mid-sprint closure (Phase 0+1+5 shipped, 2+3+4 carry)

> 2026-05-14 mid-sprint snapshot. Three phases shipped end-to-end with
> live production verification; three phases carry into Sprint 37-B / 38
> with audit-chain entries so nothing is lost.

## Phases delivered

### Phase 0 — Pre-state + Sprint 36 reality re-probe ✓
- `compliance/audit/sprint-37/pre-state/20260514-072239/pre-state.md`
- Triple sync verified: Local = origin/main = VPS HEAD `740b5f9f`
- Every Sprint 36 endpoint re-checked → all 10 still 200
- Q158 baseline 736 cycles / 11,338 findings, latest cycle "running"

### Phase 1 — Playwright matrix refactor + execute ✓
- `web/tests/e2e/sprint-35-multi-browser-smoke.spec.ts` — flat-test
  rewrite (one `test()` per URL × project, no `test.describe + use()`
  anti-pattern). Playwright fans across whatever `--project` arg or
  `PW_FULL_MATRIX=1` selects.
- New API contract block asserts the Sprint 36 endpoints (Q158 PG
  cycles_total > 0, /api/health/ready 200, CSP report summary 200,
  disclosure stats 200), plus the four-label compliance vocabulary
  (Sprint 35.1) and the admin auth gate.
- Caught a real a11y regression: `/login` had no `<h1>`. Fix shipped
  in the same commit (`(auth)/login/page.tsx` now renders a screen-
  reader-friendly top heading). WCAG 2.1 SC 2.4.6.
- Chromium-only run: **12/12 PASS** in 17.6s.
- Full 5-project matrix run: **44/60 PASS** (chromium + firefox +
  mobile-chrome all green = 36/36; WebKit-on-Linux fallback binary
  fails page navigation due to known Playwright ubuntu24.04 fallback
  build TLS regression). API contract assertions pass on every
  project including WebKit; the failure is the browser binary, not
  the production target.
- Evidence:
  `compliance/audit/sprint-37/reality-probe/playwright-matrix-20260514.md`
- Commits `c62fe431`, `1fe6edb8`

### Phase 5 — Q158 army tile on /home dashboard ✓
- `web/src/app/(dashboard)/home/_components/Q158ArmyTile.tsx`
  - Binds to the Sprint 36 P1 PG-backed payload of
    `/api/q158/engineering/status`.
  - Surfaces cycles_total + findings_total + cycles_24h + findings_24h.
  - Stacked severity-histogram bar (CRITICAL/HIGH/MEDIUM/LOW) with
    per-bucket counts.
  - Latest cycle id + status + relative timestamp; running cycles get
    an animated spinner so the page feels live.
  - Polls every 30 s with `AbortController` on each tick; never blocks
    on a slow fetch.
  - Graceful PG-unavailable banner (no em-dash; honest fallback).
- Mounted on `/home` between the dev search engine and the snapshot
  tiles row, above the fold.
- Live payload at deploy time:
  cycles_total **738**, findings_24h **1,454**, severity_24h
  `CRITICAL=89 HIGH=478 MEDIUM=133 LOW=754`, latest cycle
  `20260514T080738-736d3c` status **running**.
- Commit `a0ed08ad`

## Phases carry-forward to Sprint 37-B / 38

| # | Topic | Reason |
|---|-------|--------|
| 2 | Sprint matrix auto-generation | Wants per-sprint doc parser → `manifest/sprint-matrix.json` + `/api/sprints/matrix` endpoint + `/trust/sprint-matrix` page binding. Sequenced after Phase 5 because the tile pattern there is a useful prototype for the dashboard binding. |
| 3 | Compliance evidence portal | Needs PDF curation + KSL signing pipeline + `/trust-center/evidence` page. Larger scope (~5-8h). |
| 4 | Canary deploy v2 | Cloudflare worker for 10%→50%→100% ramp + auto-rollback on 5xx > 1%. Operational complexity (~4-6h) and needs CF API token I don't have set right now. |

## Live state at mid-sprint closure (2026-05-14 08:13 UTC)

- Local HEAD = origin/main = VPS HEAD = `a0ed08ad` (zero drift)
- `/api/health/ready` → 200 (Sprint 36 P3 invariant)
- `/api/q158/engineering/status` cycles_total = **738** (Phase 1 PG payload)
- `/api/compliance/status` → 200 public (Sprint 35.1 P7)
- `/api/security/disclosure/stats` → 200 (Sprint 36 P6 live)
- `/api/sovereign/health` → 13/13 OK
- `/.well-known/security.txt` → 200, Sprint 36 wording
- `/home` 307 → /login for anon (correct gate, new tile lives behind auth)
- `/login` has `<h1>Sign in to LyDos</h1>` (Sprint 37 P1 a11y fix)

## Commits this sprint (live on main)

```
a0ed08ad  Phase 5: Q158ArmyTile on /home dashboard
1fe6edb8  Phase 1: Playwright matrix evidence — 36/36 green non-WebKit-Linux
c62fe431  Phase 1: Playwright matrix refactor + login a11y h1
```

KURAL 13 zero-error: every claim maps to a commit SHA, JSON evidence
file, or live HTTP response captured in this document.