Files

T

s.esmaeiliandClaude Opus 5 004a3945c2 parity(docs): record user decisions D0-D12 and urgent investigation results

Phase 0 gate passed. All rulings recorded in docs/parity/DECISIONS.md and
applied to PROTECTED.md, PROGRESS.md and ISSUES.md. No source code changed.

Urgent investigations requested by the user, all evidence-cited:

- percent trace: the target's implementation is WRONG. `percent` is the
  customer's OWN column in the reference (customer_add.php:32), a per-customer
  making-charge offset used to shift catalogue filter bounds
  (ApiMobileController.php:391-396,76-77). The target reads the referring
  agent's wagePercent instead (admin-customers.service.ts:245) and never
  writes the field at all. It is NOT part of the price formula -- that extra
  percent comes from a global ConfigStatic row (ProductVariant.php:50,183).
  Two unrelated `percent` keys exist and must not be confused with it.

- @Public audit: 15 routes across 7 controllers, grouped by risk. Group A is
  5 ledger routes (4 writes) that contradict decision D1; group B is 3 order
  routes incl. a public status change accepting a client-supplied
  actorAdminUserId; group C is 8 reads, of which only the catalogue, pricing,
  slider and uploads are legitimately public.

- Login leak: it is in the TARGET. GET /customers is public and returns every
  active customer with national ID numbers, debts and ID-document URLs.
  passwordHash is correctly excluded. Not possible in the reference.

Also logged 5 customer-module defects found in the deep check the user asked
for (CUST-01..05), including the fullName collapse the user reported.

Skill updated per D12: Step C gains rule C0 (field-by-field matrix, never
page-by-page) and Step E gains rule E0 (mandatory 4-step round-trip test).

[ref: henza_server, henza_admin]

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-21 23:26:35 +03:30

6.1 KiB

Raw Blame History

PROGRESS — Reference Parity Project

Read this file FIRST at the start of every session and after every /compact. Rules live in CLAUDE.md (workspace root). Method lives in the reference-parity-audit skill.

Current state

Field	Value
Phase	Phase 0 ✅ passed → Phase 1 starting
Branch	`parity/phase-0` (next: `parity/phase-1-admin`)
Status	Gate passed. Decisions D0–D12 recorded in `DECISIONS.md`. Urgent traces (percent, @Public, login leak) done and delivered.
Next step	Show the user the `percent` trace + `@Public` list (done), get approval on (a) protecting the 5 ledger routes and (b) the `percent` schema change → then build `01-ADMIN-MATRIX.md` field-by-field (D12)
Blocked on	user approval for: the 5 `@Public` ledger routes (D7), the `percent` column (D9), the D0 migration file (approval required before running)
Last updated	2026-09-21

⚠️ Read `DECISIONS.md` before doing anything

All user rulings live there (D0–D12). Highlights that change how work is done:

D12 — the matrix is FIELD-BY-FIELD, not page-by-page, and a 4-step round-trip test per entity is mandatory. Both rules were added to the reference-parity-audit skill (Step C rule C0, Step E rule E0).
D0 — split fullName into firstName/lastName via an additive migration; show the migration and get approval before running it.
D4 — never port broken behaviour, but match calculations/rounding/messages exactly; annotate each non-replication «عمداً تکرار نشد — ISSUE #n».
D2 — target-only features get status ➕ and are left alone.

Phase checklist

P0.1 — All 3 reference folders readable (henza_server, henza_admin, henza_pwa)
P0.2 — Branch parity/phase-0 + docs/parity/ created
P0.3 — Inventory all 7 projects → _inv-*.md (8111 lines total) → consolidated in 00-INVENTORY.md
P0.4 — Mapping tables, missing list, extra list (00-INVENTORY.md §2–4)
P0.5 — Draft PROTECTED.md
P0.6 — GATE passed — PROTECTED.md confirmed, D0–D12 recorded
P0.7 — Urgent traces delivered: percent, @Public list, login leak
P0.8 — Skill updated with rules C0 (field-by-field) and E0 (round-trip test)
P1.0 — user approves: 5 ledger routes, percent column, D0 migration ← HERE
Phase 1 — Admin parity (branch parity/phase-1-admin, 01-ADMIN-MATRIX.md)
GATE: "Admin parity is complete and tested. Shall we move on to the apps (user-app & user-app-v2)?"
Phase 2 — Apps parity (02-APPS-MATRIX.md, both user apps)
Phase 3 — Work through ISSUES.md (only when user asks)

Answered — see `DECISIONS.md` for the full text

#	Ruling
D0	Split `fullName` → `firstName`/`lastName`, additive migration, backfill, sync, report multi-token rows. Approval needed before running.
D1	Target's stricter auth stands. Build the "reference operation ↔ rid" matrix; explain 172 vs 174.
D2	Audit only what the reference has. Target-only features → ➕, untouched.
D3	Build the 5 missing screens in Phase 2, both apps, plus analytics, `isLoaded`/`sts_verify_step_two` guards, guest toast+home, and v2's cart ceiling.
D4	Don't port breakage; do match calculations/rounding/messages. Unit-test the price formula.
D5	Leave the stray folder; delete last, own commit.
D6	OTP must verify — parity gap, fix it (plus expiry + attempt limits, which exceed the reference).
D7	`@Public` ledger routes: list delivered, awaiting approval to protect.
D8	Login leak: target, full customer book incl. national IDs and debts.
D9	`percent`: trace delivered — the target's implementation is wrong.
D10	Sales expert: keep `AdminUser`; investigate the 5 missing fields; propose `SalesExpertProfile`.
D11	`singleCustomer.vue` → diff-send.
D12	Field-by-field matrix + mandatory round-trip test. Added to the skill.

Open — awaiting user approval

Protect the 5 @Public ledger-write routes (DECISIONS.md group A).
percent schema change — add makingChargeOffsetPercent to Customer.
D0 migration file — must be shown and approved before it runs.

Key context (survives context loss)

Domain correction: the reference is a gold-jewellery B2B/B2C e-commerce system, not a gold bank. No buy/sell order book, no spread, no deposit/withdraw, no P2P transfer, no KYC levels, no daily limits (only gram_level), no payment callback route, no cron, no websockets. See 00-INVENTORY.md §0.
The gold price formula (Phase 1 row #1) — henza_server/app/Models/ProductVariant.php:183-190: +extra% → +7% margin → +9% VAT on the non-metal portion only → ×grams → floor(/1000)*1000. Three superseded commented-out variants above it apply VAT to the whole price — do not port those.
A large prior port already happened — see docs/ADMIN-PORT-PLAN.md and docs/CHANGELOG-PORT-HISTORY.md (80 views, 25 Nest modules, 29 Prisma models, 154 admin routes, 144/144 rids). Prior port notes no view was ever visually verified in a browser.
Stack changed across the port: Laravel→NestJS/Prisma, Vue2/Vuesax→Vue3/antd. Port behaviour, not code style.
Reference scale is inflated: 541 admin .vue files but only ~69 reachable (rest are Vuexy template demos); 9 reference router files are dead (not imported); ~28 legacy Django-era DB tables have no migrations.
v1 ⇄ v2 logic gaps (5, all v2 behind v1) are parity work, not design: ISSUES.md MON-01, V2-01..05.

Inventory files (Phase 0 working files)

File	Scope	Lines
`_inv-ref-server.md`	henza_server	1313
`_inv-tgt-api.md`	apps/api	1179
`_inv-ref-admin.md`	henza_admin	1705
`_inv-tgt-admin.md`	apps/admin-panel	1261
`_inv-ref-pwa.md`	henza_pwa	1178
`_inv-tgt-userapp.md`	apps/user-app	612
`_inv-tgt-userappv2.md`	apps/user-app-v2	700

Consolidated into 00-INVENTORY.md. Issues found: ISSUES.md (26 entries).

6.1 KiB Raw Blame History Unescape Escape

PROGRESS — Reference Parity Project

Current state

⚠️ Read DECISIONS.md before doing anything

Phase checklist

Answered — see DECISIONS.md for the full text

Open — awaiting user approval

Key context (survives context loss)

Inventory files (Phase 0 working files)

6.1 KiB

Raw Blame History

⚠️ Read `DECISIONS.md` before doing anything

Answered — see `DECISIONS.md` for the full text