Skip to content

Work through backlog foundations#156

Merged
BASIC-BIT merged 21 commits into
mainfrom
codex/backlog-mega-integration
Jul 3, 2026
Merged

Work through backlog foundations#156
BASIC-BIT merged 21 commits into
mainfrom
codex/backlog-mega-integration

Conversation

@BASIC-BIT

@BASIC-BIT BASIC-BIT commented Jul 3, 2026

Copy link
Copy Markdown
Owner

Summary

  • Adds the remaining narrow backlog foundations in one integration branch: public event .ics export, gated production auth smoke, billing schema/docs, reviewed seed imports, generated short links, Discord event-post export, Discord no-match claimed profile creation, bounded public section ordering, and owner field-visibility controls.
  • Ports the restream planning and agentic delivery docs/skills into the current docs/skill structure.
  • Keeps later candidate directions documented instead of silently turning them into product commitments.

Closes #14
Closes #15
Closes #20
Closes #27
Closes #58
Closes #92
Closes #117

Progresses #5
Progresses #121
Progresses #138

Verification

  • node --import file:///D:/bench/VRDex/node_modules/tsx/dist/loader.mjs --test tests/backend/*.test.ts passed: 148 tests.
  • corepack pnpm typecheck:backend passed.
  • corepack pnpm --filter web lint passed.
  • corepack pnpm --filter web typecheck passed.
  • corepack pnpm --filter web exec next build --webpack passed.
  • corepack pnpm lint:markdown passed.
  • corepack pnpm --filter docs build passed.
  • corepack pnpm --filter web exec playwright test --grep "@flow" --project=desktop-chromium --workers=2 passed: 6 tests.
  • git diff --check passed.
  • GitHub checks are green at c81f0df, including Playwright Data Flow, Playwright Hosted Data Flow, Playwright Image Diff, Playwright Public Preview, Build Web, Build Storybook, Storybook Image Diff, CodeQL, lint, typecheck, docs, backend, restream, and Vercel preview.
  • UI visual checks passed in the feature worktrees for owner privacy, bounded section ordering, public person/community profile pages, and the Discord post copy flow.

Notes

  • pnpm --filter web build with default Turbopack failed only in the local integration worktree because the temporary apps/web/node_modules junction points outside the repo root. The Webpack build passed, and CI uses a normal install layout.
  • The production auth smoke lane remains gated. VRDEX_PRODUCTION_AUTH_SMOKE_STORAGE_STATE_B64 still needs a safe dedicated production test-account storage state before that lane should be enabled.

@vercel

vercel Bot commented Jul 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
vr-dex-web Ready Ready Preview, Comment Jul 3, 2026 8:29am

Request Review

Comment thread tests/backend/event-discord-export.test.ts Fixed
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Storybook Image Diff

Outcome: success
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: storybook-image-diff

Changed Storybook baselines: none in this PR.

This check compares design-system component screenshots against committed baselines. Inline images show only added or modified Storybook baseline PNGs.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Storybook Component Screenshot Preview

Outcome: success
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: storybook-component-preview

Screenshots: primitive component stories captured on desktop and mobile.

This lane is separate from full-route Playwright screenshots and focuses on design-system component regressions.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Playwright Hosted Data-Flow

Outcome: success
Target: https://staging.vrdex.net
Hosted extended profile flow: enabled
Hosted auth helpers: enabled
Hosted adapter helpers: enabled
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: playwright-hosted-data-flow

This optional check runs the mutation-backed profile flow against a configured hosted dev/staging target with isolated E2E test data.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Playwright Data-Flow Preview

Outcome: success
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: playwright-data-flow

Captured flow:

  • test-gated profile submission form
  • gated helper rejection without the Playwright token
  • Convex profile creation
  • submission success state
  • public profile page readback
  • discovery search readback

Artifacts include screenshots, traces, and recorded video for the flow run.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Playwright Public Screenshot Preview

Outcome: success
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: playwright-public-preview

Screenshots: all public route checks passed on desktop and mobile.

Full screenshot set is available in the artifact. Pixel diff baselines are handled by the separate Playwright Image Diff check.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

Playwright Image Diff

Outcome: success
Run: https://github.com/BASIC-BIT/VRDex/actions/runs/28648443832
Artifact: playwright-image-diff

Changed screenshot baselines: 14

desktop-chromium / appearance-demo

desktop-chromium appearance-demo

desktop-chromium / community-profile

desktop-chromium community-profile

desktop-chromium / event-edit-signed-out

desktop-chromium event-edit-signed-out

desktop-chromium / event-profile

desktop-chromium event-profile

desktop-chromium / event-watch-surface

desktop-chromium event-watch-surface

desktop-chromium / person-profile

desktop-chromium person-profile

desktop-chromium / privacy-demo

desktop-chromium privacy-demo

mobile-chromium / appearance-demo

mobile-chromium appearance-demo

mobile-chromium / community-profile

mobile-chromium community-profile

mobile-chromium / event-edit-signed-out

mobile-chromium event-edit-signed-out

mobile-chromium / event-profile

mobile-chromium event-profile

mobile-chromium / event-watch-surface

mobile-chromium event-watch-surface

Showing 12 of 14; see the artifact for the rest.

This check compares public route screenshots against committed baselines. Inline images show only added or modified baseline PNGs.

@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

@BASIC-BIT BASIC-BIT marked this pull request as ready for review July 3, 2026 07:08
Copilot AI review requested due to automatic review settings July 3, 2026 07:08

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c81f0df4e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread convex/shortLinks.ts Outdated
Comment thread apps/web/src/app/l/[code]/page.tsx
Comment thread apps/web/src/lib/calendar/ics.ts Outdated

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR batches a large set of “backlog foundations” into one integration branch, adding new platform primitives across calendar export, generated short links, seed-import review staging, Discord event-post export, owner privacy + bounded appearance controls, and initial billing-state scaffolding, while also porting/expanding planning + agentic delivery docs.

Changes:

  • Add outbound public event .ics export (web route + serializer) and Discord-ready event post export (backend formatter + editor UI copy panel).
  • Introduce durable generated short links (/l/<code>) with Convex schema + resolver, plus initial billing snapshot schema/helpers and reviewed seed-import staging workflow.
  • Add claimed-owner field-visibility controls and bounded public profile section ordering (backend + account UI), plus docs/skills additions and workflow gating for production auth smoke.

Reviewed changes

Copilot reviewed 70 out of 81 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
tests/web/calendar-ics.test.ts Adds unit coverage for ICS escaping/folding + public event export contract.
tests/backend/short-links.test.ts Adds coverage for short-link code validation, reservation, and public resolution behavior.
tests/backend/seed-imports.test.ts Adds coverage for fake-fixture seed imports and publication blocker rules.
tests/backend/event-discord-export.test.ts Adds coverage for deterministic Discord post text export from public event projections.
tests/backend/billing-foundation.test.ts Adds coverage for Stripe status normalization and entitlement derivation.
package.json Adds top-level scripts for hosted production-auth smoke lane.
docs/README.md Links newly added billing foundation doc in docs index.
docs/planning/seed-import-model.md Documents implemented seed-import staging slice + guardrails and what remains deferred.
docs/planning/README.md Adds restreaming/media-control planning doc to planning index.
docs/planning/product-spec.md Expands restream direction notes and clarifies privacy/control recommendations.
docs/planning/dependency-map.md Captures bounded customization baseline decision and theme preset recommendation.
docs/planning/calendar-integration.md Documents first .ics export slice and scope boundaries.
docs/planning/architecture.md Adds restream/media-control architecture direction notes.
docs/developers/public-api.md States bounded section ordering must be known keys, not arbitrary blocks.
docs/deployment/vercel-preview.md Documents optional gated production authenticated smoke lane setup.
docs/deployment/convex-environments.md Documents env/secret expectations for optional production auth smoke lane.
docs/backend/profile-schema.md Documents new bounded section ordering, seed-import staging, and privacy/claim nuances.
docs/backend/profile-access-and-claims.md Clarifies ownership invariants, no-match claim creation, and privacy mutation expectations.
docs/backend/generated-short-links.md Introduces generated short links model, resolution rules, and creation contract.
docs/backend/event-schema.md Links generated short links doc and documents Discord export slice behavior.
docs/backend/billing-foundation.md Documents initial Stripe billing-state direction, schema, and env variable contract.
docs/agentic/README.md Adds feature-design loop + parallel worktree delivery docs to agentic index.
docs/agentic/parallel-worktree-delivery.md Adds repo-local guidance for parallel worktree fanout/converge delivery.
docs/agentic/feature-design-loop.md Adds repo-local guidance for holistic feature planning loops.
docs/agentic/codex.md Registers new repo-local skills/wrappers.
convex/shortLinks.ts Adds public resolver query and authenticated ensure mutations for short links.
convex/seedImports.ts Adds internal seed-import fixture ingest, review mutations/queries, and publication queue marker.
convex/schema.ts Adds billing tables, seed import staging tables, shortLinks table, and bounded section order field.
convex/README.md Documents new _billing.ts and billing foundation doc location.
convex/profiles.ts Adds public profile appearance projection and reserves short links during profile submission.
convex/profilePrivacy.ts Adds claimed-owner field visibility mutation + owned privacy profile listing + audit/search refresh.
convex/profileClaims.ts Adds explicit no-match claimed profile creation mutations for Discord-linked users.
convex/profileAssets.ts Adds bounded public section ordering mutation and returns section ordering in appearance profile list.
convex/events.ts Reserves short links during community event creation and returns link info in create payload.
convex/_shortLinks.ts Implements short-link code generation/validation, reservation, and public target resolution helpers.
convex/_seedImportValidators.ts Adds validators for seed import tables and mutation args.
convex/_profilePrivacy.ts Adds helpers for listing owned privacy profiles and applying field-visibility updates.
convex/_profileFieldVisibility.ts Centralizes allowed visibility keys/states and adds normalization/materialization helpers.
convex/_profileClaimCreation.ts Implements Discord linked-account no-match profile creation + claim request + ownership grant + short link.
convex/_profileAppearance.ts Implements bounded section ordering normalization and public appearance projection helper.
convex/_generated/api.d.ts Updates generated Convex API typings to include new modules and endpoints.
convex/_eventDiscordExport.ts Adds deterministic Discord event post formatter from public event projection.
convex/_billing.ts Adds Stripe status normalization, entitlement derivation helpers, and Convex validators.
apps/web/src/lib/calendar/ics.ts Adds ICS serializer utilities and public event ICS generator.
apps/web/src/convex/server.ts Adds server helper to resolve public short-link targets via Convex.
apps/web/src/convex/playwright-fixtures.ts Adds appearance section ordering to web Playwright fixtures for coverage.
apps/web/src/app/l/[code]/page.tsx Adds /l/<code> short-link route that resolves and redirects or 404s.
apps/web/src/app/events/[slug]/edit/page.tsx Adds Discord post export panel to event editor using server-side formatting.
apps/web/src/app/e/[slug]/calendar.ics/route.ts Adds public event ICS export endpoint.
apps/web/src/app/account/privacy/privacy-panel.tsx Adds claimed-owner field-visibility UI for privacy controls.
apps/web/src/app/account/privacy/page.tsx Adds account privacy page route and shell around privacy panel.
apps/web/src/app/account/appearance/page.tsx Updates appearance page copy to include bounded section ordering.
apps/web/src/app/account/appearance/appearance-panel.tsx Adds section ordering editor UI and saves ordering via Convex mutation.
apps/web/src/app/account/account-panel.tsx Adds navigation entry to the new privacy page.
apps/web/src/app/_components/profile-public-page.tsx Adds bounded section-order rendering of public profile sections using projected appearance.
apps/web/src/app/_components/event-discord-export-panel.tsx Adds client-side copy-to-clipboard panel for Discord post text.
apps/web/playwright.config.mjs Forces next dev --webpack in Playwright webserver config.
apps/web/package.json Adds hosted auth-smoke script and excludes it from generic hosted smoke.
apps/web/e2e/public-routes.ts Adds demo privacy route capture and updates appearance expectations.
apps/web/e2e/profile-submission.flow.spec.ts Switches flow navigation to retry helper to reduce ERR_ABORTED flake.
apps/web/e2e/production-auth.smoke.spec.ts Adds gated production authenticated account smoke spec using storageState secret.
apps/web/e2e/flow-navigation.ts Adds navigation helper with retry for ERR_ABORTED.
apps/web/e2e/auth-claim.flow.spec.ts Makes auth-claim flow serial and adds delete retries for transient network errors.
.opencode/skills/vrdex-parallel-worktree-delivery/SKILL.md Adds repo-local skill for parallel worktree delivery workflow.
.opencode/skills/vrdex-feature-design/SKILL.md Adds repo-local skill for feature design loop workflow.
.github/workflows/deployed-health.yml Adds gated production authenticated smoke lane wiring and summary output.
.codex/skills/vrdex-parallel-worktree-delivery/SKILL.md Adds Codex wrapper for the parallel worktree delivery skill.
.codex/skills/vrdex-feature-design/SKILL.md Adds Codex wrapper for the feature design skill.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread apps/web/src/app/_components/profile-public-page.tsx
Comment thread apps/web/src/app/account/appearance/appearance-panel.tsx Outdated
Comment thread convex/profiles.ts Outdated
Comment thread convex/profileAssets.ts Outdated
@greptile-apps

greptile-apps Bot commented Jul 3, 2026

Copy link
Copy Markdown

Greptile Summary

This PR adds several backlog foundation features across public exports, profile controls, auth smoke tests, billing, seed imports, and docs. The main changes are:

  • Public event .ics export and Discord-ready event post copy.
  • Generated short links for profiles, worlds, and events.
  • Owner profile appearance and field-visibility controls.
  • Discord no-match claimed profile creation.
  • Billing and seed-import schema foundations with tests and docs.
  • Gated production authenticated smoke coverage and updated planning/agentic docs.

Confidence Score: 4/5

This PR has one contained authorization issue that should be fixed before merging.

Most reviewed paths are well-contained and covered by tests, but the new short-link public mutations introduce a current security-boundary bug.

convex/shortLinks.ts

T-Rex T-Rex Logs

What T-Rex did

  • Ran a focused backend test invoking ensureForProfile with user B against a profile owned by user A, and observed a short link path and a shortLinks record inserted.
  • Compared base and head test runs for calendar-ics, Discord export, and production-auth; head run shows passes while base run showed missing tests or no tests.
  • Compared before/after artifact sets to verify the presence of new billing/seed-import/short-link tests and that the foundations were executed in head versus base.
  • Reviewed after-artifact UI and route states, confirming owner-field visibility controls, public section ordering, event export affordances, and that a generated short-link route returns a 404.
  • Compared doc artifacts before/after showing updates across agentic docs, restream planning docs, and docs-build artifacts.

View all artifacts

T-Rex Ran code and verified through T-Rex

Important Files Changed

Filename Overview
convex/shortLinks.ts Adds public short-link mutations, but the ensure mutations only authenticate users and do not authorize writes against the target owner/capability.
convex/_shortLinks.ts Implements short-link validation, generation, reservation, and public resolution with publication checks for profiles/worlds/events.
apps/web/src/app/l/[code]/page.tsx Adds dynamic short-link redirect page that resolves public targets and returns not found for missing links.
apps/web/src/app/e/[slug]/calendar.ics/route.ts Adds public event ICS route with backend fallback, not-found handling, and calendar attachment headers.
apps/web/src/lib/calendar/ics.ts Adds ICS generation helpers with text escaping, UTC timestamp formatting, and line folding.
convex/_profileFieldVisibility.ts Adds field visibility normalization/materialization helpers for public, unlisted, and private profile fields.
apps/web/src/app/account/privacy/privacy-panel.tsx Adds owner privacy UI for editing field visibility with demo/live states and Convex mutation integration.
convex/_eventDiscordExport.ts Adds Discord event-post formatter that uses public event fields and Discord timestamp markup.
apps/web/src/app/events/[slug]/edit/page.tsx Adds Discord export panel and canonical event URL construction to the event edit surface.
convex/_profileClaimCreation.ts Adds claimed Discord profile creation path that creates, claims, indexes, and short-links a no-match profile.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
  participant OwnerUI as Owner/UI
  participant Convex as Convex mutations/queries
  participant DB as Convex DB
  participant PublicWeb as Public Next.js routes
  participant Viewer as Viewer

  OwnerUI->>Convex: create/update profile, event, or claim
  Convex->>DB: insert/update target record
  Convex->>DB: ensureShortLinkForTarget(target)
  DB-->>Convex: shortLink code/path
  Convex-->>OwnerUI: "target path + /l/{code}"
  Viewer->>PublicWeb: "GET /l/{code}"
  PublicWeb->>Convex: resolvePublicByCode(code)
  Convex->>DB: load shortLink + target
  Convex-->>PublicWeb: public target path or null
  PublicWeb-->>Viewer: redirect to /p, /c, /w, or /e target
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
  participant OwnerUI as Owner/UI
  participant Convex as Convex mutations/queries
  participant DB as Convex DB
  participant PublicWeb as Public Next.js routes
  participant Viewer as Viewer

  OwnerUI->>Convex: create/update profile, event, or claim
  Convex->>DB: insert/update target record
  Convex->>DB: ensureShortLinkForTarget(target)
  DB-->>Convex: shortLink code/path
  Convex-->>OwnerUI: "target path + /l/{code}"
  Viewer->>PublicWeb: "GET /l/{code}"
  PublicWeb->>Convex: resolvePublicByCode(code)
  Convex->>DB: load shortLink + target
  Convex-->>PublicWeb: public target path or null
  PublicWeb-->>Viewer: redirect to /p, /c, /w, or /e target
Loading

Comments Outside Diff (3)

  1. General comment

    P1 Public event page has an ICS route but no visible calendar export affordance

    • Bug
      • The PR contract calls for a public event .ics export affordance. Head contains the route /e/[slug]/calendar.ics, but the rendered public event page for the Playwright fixture only shows normal media links (Afterglow event listing, Afterglow watch link, VRCDN copy link) and no Add to calendar, .ics, or calendar-download link. Users viewing an event cannot discover or click the export from the public surface.
    • Cause
      • apps/web/src/app/_components/event-public-page.tsx renders event details and links but does not render a link/button to /e/${event.slug}/calendar.ics, even though apps/web/src/app/e/[slug]/calendar.ics/route.ts exists.
    • Fix
      • Add a visible public event action, for example an Add to calendar/Download .ics link in the event action area pointing to /e/${event.slug}/calendar.ics with an appropriate download filename/label, and cover it in the route smoke/visual expectations.

    T-Rex Ran code and verified through T-Rex

  2. General comment

    P2 Fixture generated short-link route is not reachable

    • Bug
      • The PR contract includes generated short-link route behavior. In the real app on head, visiting /l/playwright-afterglow-harbor-sessions renders a 404 rather than redirecting or resolving to the fixture event page. This means the short-link route is not visibly deliverable from the public fixture used by the existing e2e routes.
    • Cause
      • The /l/[code] route is present, but the Playwright fixture data does not appear to include a resolvable generated short-link code for the fixture event, or the route lookup does not fall back to fixture short links.
    • Fix
      • Seed a generated short-link fixture for the public event/profile routes or make /l/[code] resolve fixture short links when VRDEX_ENABLE_PLAYWRIGHT_FIXTURES=true; then add e2e coverage asserting the redirect/canonical target.

    T-Rex Ran code and verified through T-Rex

  3. General comment

    P1 Head docs build fails under the required docs verification command

    • Bug
      • The validation objective requires docs build/lint to succeed on head for the new docs/skills structure. Base completed pnpm lint:markdown && pnpm --filter docs build successfully, but head's pnpm --filter docs build was killed and returned exit status 137 after markdown lint passed. This leaves the Docusaurus-rendered navigation/build contract unverified and failing for the PR head.
    • Cause
      • The head Docusaurus production build is terminated by the runtime with SIGKILL/exit 137 during docusaurus build; the captured output does not expose a more specific application stack trace.
    • Fix
      • Reproduce pnpm --filter docs build on head with build memory diagnostics enabled, then reduce/fix the source of the build-time resource spike or adjust the docs build environment so the required docs verification completes successfully.

    T-Rex Ran code and verified through T-Rex

Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
convex/shortLinks.ts:24-66
**Add target authorization**
These public mutations only require a signed-in user, so any authenticated account that obtains a `profileId`, `worldId`, or `eventId` can create a durable short link for a target they do not own or manage. The resolver hides unpublished targets, but the write still bypasses owner/community capability checks and permanently reserves codes for arbitrary records.

Reviews (1): Last reviewed commit: "Stabilize auth claim flow tests" | Re-trigger Greptile

Comment thread convex/shortLinks.ts

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 73 out of 88 changed files in this pull request and generated 3 comments.

Comment thread apps/web/src/app/account/appearance/appearance-panel.tsx Outdated
Comment thread apps/web/src/convex/playwright-fixtures.ts
Comment thread convex/_shortLinks.ts Outdated
@BASIC-BIT BASIC-BIT merged commit 17c1316 into main Jul 3, 2026
22 checks passed
@BASIC-BIT BASIC-BIT deleted the codex/backlog-mega-integration branch July 3, 2026 08:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants