.github/9
ISSUE_TEMPLATE/3bug_report.md config.yml feature_request.md
workflows/3ci.yml clean-clone.yml release.yml
CODEOWNERS dependabot.yml pull_request_template.md
apps/630
api/250
src/243
common/30
__tests__/3authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts
filters/1all-exceptions.filter.ts
guards/3auth.guard.ts internal-service.guard.ts rate-limit.guard.ts
interceptors/2actor-context.interceptor.ts bigint-serialization.interceptor.ts
middleware/2idempotency.test.ts idempotency.ts
pipes/1zod-validation.pipe.ts
actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts
config/1env.ts
lib/11
__tests__/5crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts
authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts
modules/197
ai/28
__tests__/4ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts
generator/4executor.ts generate.controller.ts generate.dto.ts generate.service.ts
ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts
api-keys/3api-keys.controller.ts api-keys.module.ts api-keys.service.ts
audit/2audit-log.controller.ts audit.module.ts
auth/4auth.controller.ts auth.module.ts auth.service.ts dto.ts
automations/5automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts
blocks/5
__tests__/1batch-version-cas.test.ts
block.service.ts blocks.controller.ts blocks.module.ts dto.ts
comments/4comments.controller.ts comments.module.ts comments.service.ts dto.ts
databases/9
__tests__/3normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts
database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts
docs/2docs.controller.ts docs.module.ts
files/10
__tests__/1quota.test.ts
dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts
forms/18debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts
health/3health.controller.ts health.module.ts health.service.ts
integrations/3integrations.controller.ts integrations.module.ts integrations.service.ts
internal/12
__tests__/2flush-query-shape.test.ts internal.endpoints.test.ts
ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts
notifications/3notifications.controller.ts notifications.module.ts notifications.service.ts
oauth/6
__tests__/1oauth.scopes.test.ts
oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts
org/15audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts
orgs/5dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts
pages/4dto.ts page.service.ts pages.controller.ts pages.module.ts
scim/15
__tests__/3email-mapping.test.ts etag.test.ts filters.test.ts
etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts
search/4
__tests__/1search.service.test.ts
search.controller.ts search.module.ts search.service.ts
sessions/3sessions.controller.ts sessions.module.ts sessions.service.ts
share/3share.controller.ts share.module.ts share.service.ts
sso/16
__tests__/4enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts
enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts
teams/4dto.ts teams.controller.ts teams.module.ts teams.service.ts
users/4dto.ts users.controller.ts users.module.ts users.service.ts
webhooks/3webhooks.controller.ts webhooks.module.ts webhooks.service.ts
workspaces/4dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts
types/1xmldom.d.ts
app.module.ts constants.ts main.ts
_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts
realtime/33
src/17auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts
test/11auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts
.env.example Dockerfile package.json README.md tsconfig.json
web/255
src/244
app/45
__tests__/1theme-tokens.test.ts
(app)/26
w/25
[workspace]/25
ask/1page.tsx
databases/1
[id]/1page.tsx
favorites/1page.tsx
files/1page.tsx
notifications/1page.tsx
page/4
[id]/4
[block]/1page.tsx
share/1page.tsx
layout.tsx page.tsx
search/1page.tsx
settings/10
appearance/1page.tsx
automations/3
[id]/1page.tsx
new/1page.tsx
page.tsx
billing/1page.tsx
developers/1page.tsx
members/1page.tsx
permissions/1page.tsx
teams/1page.tsx
page.tsx
shared/1page.tsx
templates/1page.tsx
trash/1page.tsx
layout.tsx page.tsx
layout.tsx
(auth)/4
login/1page.tsx
register/1page.tsx
reset-password/1page.tsx
layout.tsx
api/2
metrics/1route.ts
v1/1
health/1route.ts
f/1
[slug]/1page.tsx
health/1
ready/1route.ts
org/2
[orgId]/2
admin/2
integrations/1page.tsx
page.tsx
share/1
[id]/1page.tsx
error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx
components/118
admin/10
org-admin/8ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx
ScimCard.tsx SsoTabs.tsx
ai/6ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx
automations/5action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx
collaboration/6CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx
comments/3comment-panel.tsx comment-thread.tsx mention-input.tsx
database/27
__tests__/2cell-editor.test.tsx cell-renderer.test.tsx
AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx
dialogs/7
__tests__/1move-to-dialog.test.tsx
create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx
editor/19
__tests__/3code-block-text.test.ts code-block.test.tsx expandable.test.tsx
block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx
files/4FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx
form/4form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx
layout/8
__tests__/1page-tree-icon.test.tsx
command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx
mentions/3
__tests__/1mention-model.test.ts
mention-model.ts MentionPopup.tsx
search/3ask-ai-search.tsx results-list.tsx search-dialog.tsx
settings/10
api-keys/4ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx
webhooks/5CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx
settings-shell.tsx
ui/3confirm-dialog.tsx form.tsx toaster.tsx
hooks/21
__tests__/4realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx
realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts
lib/50
__tests__/21ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts
files/7
__tests__/2picker.test.ts upload.test.ts
api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts
ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts
stores/8
__tests__/1block-patch-store.test.ts
block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts
instrumentation.ts middleware.ts
.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts
worker/92
src/87
__tests__/13ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts
health/1server.ts
lib/12
__tests__/1clamav.test.ts
clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts
processors/56
automations/28
__tests__/3condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts
executors/17assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts
condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts
files/15
__tests__/4errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts
steps/4finalize.ts metadata.ts scan.ts thumbnails.ts
cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts
search-index/4builders.ts grants.ts index.ts processor.ts
ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts
config.ts events.ts index.ts logger.ts queues.ts
.env.example Dockerfile package.json README.md tsconfig.json
docs/73
api/17ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md
architecture/10ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md
database/2database-architecture.md redis-keys.md
development/8admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md
product/4functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md
requirements/1requirements-matrix.md
security/5audit-report.md files.md forms.md license-allowlist.md security-architecture.md
tasks/16phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md
ui/9ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md
support-matrix.md
infrastructure/71
caddy/1Caddyfile
docker/6
init/101-extensions.sql
opensearch/1init-indices.json
.env.docker docker-compose.yml opensearch-init.sh README.md
kubernetes/40
observability/20
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1sync-sources.mjs
alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml
postgres/7configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml
api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml
nginx/2nginx.conf README.md
observability/14
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1dashboard-completeness.mjs
README.md
terraform/8compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf
packages/289
ai/24
src/20
providers/7anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts
schemas/2database.ts generate.ts
adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts
package.json README.md tsconfig.json vitest.config.ts
auth/11
src/7index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
collaboration/17
src/13awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
config/7
src/4eslint.base.js index.ts prettier.base.json tsconfig.base.json
package.json README.md tsconfig.json
database-client/5
src/2index.test.ts index.ts
package.json README.md tsconfig.json
database-engine/33
src/29
filter/2filter.test.ts index.ts
formula/8evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts
query/6group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts
relations/2index.ts relations.test.ts
rollups/2index.ts rollups.test.ts
values/5dates.ts index.ts registry.ts types.ts values.test.ts
views/3buttons.ts index.ts views.test.ts
index.ts
package.json README.md tsconfig.json vitest.config.ts
editor/25
src/21
marks/1highlight.ts
nodes/2equation.ts mention.ts
autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
observability/20
src/16
__tests__/8db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts
index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts
package.json README.md tsconfig.json vitest.config.ts
permissions/11
src/7index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts
package.json README.md tsconfig.json vitest.config.ts
search/22
src/18chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
shared/61
src/57
dto/17ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts
events/8audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts
realtime/6comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts
automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts
package.json README.md tsconfig.json vitest.config.ts
storage/16
src/12client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
ui/37
src/33
components/19avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx
color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
prisma/16
migrations/13
20260927000000_init/1migration.sql
20260928000000_search_documents_content_hash/1migration.sql
20260929000000_workspace_usage_storage_bytes/1migration.sql
20260930000000_form_submitted_notification_type/1migration.sql
20261001000000_ai_phase12/1migration.sql
20261002000000_webhooks_secret_encrypted_dlq/1migration.sql
20261002111436_webhook_delivery_latency/1migration.sql
20261002120000_org_admin_2fa_retention_unique/1migration.sql
20261002215124_audit_export/1migration.sql
20261003210000_perf_indexes_hot_paths/1migration.sql
20261004004500_perf_indexes_hot_paths_2/1migration.sql
migration_lock.toml README.md
schema.prisma seed.ts verify.ts
scripts/7backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh
tests/169
e2e/63
.auth/1user.json
fixtures/7
files/6clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt
realtime.ts
mocks/2oidc-issuer.ts saml-idp.ts
playwright-report/3
data/2a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm
index.html
reports/1files-security.json
specs/34ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts
test-results-final-flow/3
final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2test-failed-1.png trace.zip
.last-run.json
utils/4api.ts dnd.ts search-lag.ts wait.ts
.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json
fixtures/1
files/1make-sparse.ts
integration/60
ai-capability/2ai-app.capability.test.ts gateway.capability.test.ts
drill/2seed-drill.mjs verify-restore.mjs
fixtures/5
files/5clip.mp4 clip.wav doc.pdf hero-1400.png note.txt
helpers/3api.ts containers.ts seed.ts
realtime/11control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts
ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts
performance/28
fixtures/1search-100k.ts
helpers/2seed-100k.mjs seed-1k-load.mjs
reports/7api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json
api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs
security/16
helpers/1app.ts
audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts
README.md
.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json
requirements-matrix.mddocs/requirements/requirements-matrix.md← requirements28,983 B← Back to the app

Requirements Matrix — AI Software Factory

Traceability. Rows = every PR-xxx from product-requirements.md (read and mirrored there first — that file is the canonical ID source; this matrix must stay 1:1 with it: 167 requirements, PR-001 … PR-167). Columns: requirement (short title), priority (P0 MVP / P1 / P2 enterprise), phase (0–15 per ROADMAP.md; a comma list means the requirement lands across those phases), task file (in docs/tasks/), status.

Status legend: ⬜ not started · 🟨 in progress · ✅ done (task file's Definition of Done met). At scaffold time everything is ⬜ — this matrix is updated as tasks complete (the phase owner ticks rows when their task's DoD is verified).

Coverage sections below: NFRs → verifying tests and API endpoints → requirements (the two other traceability directions).

1. Requirement registry (167 rows)

ID Requirement Pri Phase Task file Status
PR-001 Register (email + password, server validation) P0 1 phase-01-authentication.md ⬜
PR-002 Email verification (24 h single-use token) P0 1 phase-01-authentication.md ⬜
PR-003 Login → access JWT 15 m + rotating refresh 30 d P0 1 phase-01-authentication.md ⬜
PR-004 Refresh rotation + replay → family revocation P0 1 phase-01-authentication.md ⬜
PR-005 Logout; session listing & revocation P0 1 phase-01-authentication.md ⬜
PR-006 Password reset (1 h, single-use, session revoke) P0 1 phase-01-authentication.md ⬜
PR-007 bcrypt(12) hashing, timing-safe, no logging P0 1 phase-01-authentication.md ⬜
PR-008 Profile view/update (name, avatar, locale, tz, theme) P0 1 phase-01-authentication.md ⬜
PR-009 Auth-endpoint rate limiting P0 1 phase-01-authentication.md ⬜
PR-010 Mandatory auth audit events P0 1 phase-01-authentication.md ⬜
PR-011 SSO: OIDC + SAML, enforce mode P2 14 phase-14-enterprise.md ⬜
PR-012 SSO identity linking + SCIM deactivation P2 14 phase-14-enterprise.md ⬜
PR-013 Auto personal workspace at registration P0 2 phase-02-workspace.md ⬜
PR-014 Create workspaces (unique slug) P0 2 phase-02-workspace.md ⬜
PR-015 Rename/re-icon/delete workspace (cascade preview) P0 2 phase-02-workspace.md ⬜
PR-016 Four workspace roles (RBAC) P0 2 phase-02-workspace.md ⬜
PR-017 Role-change rules + last-owner protection + audit P0 2 phase-02-workspace.md ⬜
PR-018 Email invitations (accept/decline/revoke/expiry) P0 2 phase-02-workspace.md ⬜
PR-019 Teams: CRUD, membership, ordering, privacy P0 2 phase-02-workspace.md ⬜
PR-020 Sidebar (Home/Inbox/Search/Favorites/Teams/Private/Shared/Trash) P0 2 phase-02-workspace.md ⬜
PR-021 Workspace settings sections P0 2 phase-02-workspace.md ⬜
PR-022 Organizations + org policies P2 14 phase-14-enterprise.md ⬜
PR-023 SCIM user & group provisioning P2 14 phase-14-enterprise.md ⬜
PR-024 Per-workspace usage limits enforcement P2 14 phase-14-enterprise.md ⬜
PR-025 Page CRUD P0 3 phase-03-pages.md ⬜
PR-026 Nesting + fractional tree ordering P0 3 phase-03-pages.md ⬜
PR-027 Full page surface (icon/cover/title/desc/blocks/comments/…) P0 3 phase-03-pages.md ⬜
PR-028 Trash: soft delete / restore / purge P0 3 phase-03-pages.md ⬜
PR-029 Archives (separate from trash) P0 3 phase-03-pages.md ⬜
PR-030 Favorites (ordered, sidebar) P0 3 phase-03-pages.md ⬜
PR-031 Page version history + restore-as-new-version P0 3 phase-03-pages.md ⬜
PR-032 Private pages P0 3 phase-03-pages.md ⬜
PR-033 Virtualized tree (100k < 2 s) P0 3 phase-03-pages.md ⬜
PR-034 Block-tree model (stable ids, fractional position) P0 4 phase-04-editor.md ⬜
PR-035 Text blocks (paragraph, h1–h3, quote, callout) P0 4 phase-04-editor.md ⬜
PR-036 List blocks (bulleted, numbered, todo, toggle) P0 4 phase-04-editor.md ⬜
PR-037 Media blocks (image, file = P0; video/audio/bookmark/embed = P1) P0/P1 4, 9 phase-04-editor.md, phase-09-files.md ⬜
PR-038 Code block (P0) + equation block (P1) P0/P1 4 phase-04-editor.md ⬜
PR-039 Layout blocks (divider P0; spacer, columns P1) P0/P1 4 phase-04-editor.md ⬜
PR-040 Advanced blocks (table, synced_block P0; child rows, linked_database P1) P0/P1 4, 5 phase-04-editor.md, phase-05-databases.md ⬜
PR-041 Full keyboard model (Enter/Tab/arrows/⌘A ladder/…) P0 4 phase-04-editor.md ⬜
PR-042 Mouse interactions (hover controls, multi-select, resize) P0 4 phase-04-editor.md ⬜
PR-043 Undo/redo + copy/paste (internal + markdown/HTML) P0 4 phase-04-editor.md ⬜
PR-044 Keyboard/ARIA equivalent for every mouse op P0 4 phase-04-editor.md ⬜
PR-045 Slash command menu (18 commands) P0 4 phase-04-editor.md ⬜
PR-046 Slash UX (groups, fuzzy, keyboard) P0 4 phase-04-editor.md ⬜
PR-047 /database dynamic creation (property picker) P0 4, 5 phase-04-editor.md, phase-05-databases.md ⬜
PR-048 Block context menu (full item list) P0 4 phase-04-editor.md ⬜
PR-049 Page context menu (full item list) P0 3, 4 phase-03-pages.md, phase-04-editor.md ⬜
PR-050 Block drag: reorder/nest/indicators/auto-scroll P0 4 phase-04-editor.md ⬜
PR-051 Multi-block drag P0 4 phase-04-editor.md ⬜
PR-052 Cross-page drag + drag between columns P0 4 phase-04-editor.md ⬜
PR-053 Database row/card dragging (board = status update) P0 5 phase-05-databases.md ⬜
PR-054 Sidebar page drag (reorder + reparent) P0 3, 4 phase-04-editor.md ⬜
PR-055 OS file/image drop into editor & cells P0 9 phase-09-files.md ⬜
PR-056 dnd-kit + non-drag keyboard DnD alternative P0 4 phase-04-editor.md ⬜
PR-057 Database container (properties/records/views) P0 5 phase-05-databases.md ⬜
PR-058 24 property types (core 15 in P0; rel/rollup/formula/button P1) P0/P1 5, 6 phase-05-databases.md, phase-06-relations.md ⬜
PR-059 Single TITLE property invariant P0 5 phase-05-databases.md ⬜
PR-060 Record = page (1:1 join, properties bar) P0 5 phase-05-databases.md ⬜
PR-061 Record create/update/archive/duplicate P0 5 phase-05-databases.md ⬜
PR-062 Table view (virtualized 100k, inline edit, bulk bar) P0 5 phase-05-databases.md ⬜
PR-063 List view P1 5 phase-05-databases.md ⬜
PR-064 Board view (kanban, drag = property update) P0 5 phase-05-databases.md ⬜
PR-065 Calendar view (day/week/month, ranges) P1 5 phase-05-databases.md ⬜
PR-066 Gallery view (card grid + layout config) P1 5 phase-05-databases.md ⬜
PR-067 Timeline view (Gantt, drag/resize bars) P1 5 phase-05-databases.md ⬜
PR-068 Chart + Dashboard as view types P1 5, 12 phase-05-databases.md ⬜
PR-069 Form view (published form over database) P1 10 phase-10-forms.md ⬜
PR-070 Per-view settings (filter/sort/group/props/display) P0 5 phase-05-databases.md ⬜
PR-071 Nested filters (AND/OR/NOT, 20+ operators) P0 5 phase-05-databases.md ⬜
PR-072 Multi-key sort (nulls first/last) P0 5 phase-05-databases.md ⬜
PR-073 Multi-level group (collapsible, counts) P0 5 phase-05-databases.md ⬜
PR-074 Property management (add/rename/reorder/hide/delete) P0 5 phase-05-databases.md ⬜
PR-075 Relations (1:1, 1:N, M:N, bidirectional) P0 6 phase-06-relations.md ⬜
PR-076 Relation cells (search popover, sync both sides) P0 6 phase-06-relations.md ⬜
PR-077 Rollups (COUNT/SUM/AVG/MIN/MAX/PERCENT/UNIQUE + filter) P1 6 phase-06-relations.md ⬜
PR-078 Event-driven rollup recompute P1 6 phase-06-relations.md ⬜
PR-079 Formula engine (safe parser/AST, zero eval) P1 6 phase-06-relations.md ⬜
PR-080 Formula function set (16 fns + prop()) P1 6 phase-06-relations.md ⬜
PR-081 Formula dependencies + recompute + return type P1 6 phase-06-relations.md ⬜
PR-082 Database buttons (7 action types) P1 6 phase-06-relations.md ⬜
PR-083 Button validation, caller-permission execution, logging P1 6 phase-06-relations.md ⬜
PR-084 Realtime WS server (rooms, auth, heartbeat, pruning) P1 7 phase-07-collaboration.md ⬜
PR-085 Yjs CRDT sync (server-authoritative, debounced persist) P1 7 phase-07-collaboration.md ⬜
PR-086 Presence (avatars, cursors, awareness) P1 7 phase-07-collaboration.md ⬜
PR-087 Realtime latency < 200 ms p95 P1 7 phase-07-collaboration.md ⬜
PR-088 Realtime comments over the socket P1 7 phase-07-collaboration.md ⬜
PR-089 Reconnect + Yjs resume (Redis update log) P1 7 phase-07-collaboration.md ⬜
PR-090 Offline mode (IndexedDB queue, CRDT merge) P1 7 phase-07-collaboration.md ⬜
PR-091 Comments on page/block/selection/record P0 3, 5, 7 phase-03-pages.md, phase-05-databases.md, phase-07-collaboration.md ⬜
PR-092 Thread ops (reply, resolve, reopen, edit, delete) P0 3 phase-03-pages.md ⬜
PR-093 Reactions (one per user/emoji/target) P0 3 phase-03-pages.md ⬜
PR-094 Mentions @user/@team/@page/@database + notify P0 7 phase-07-collaboration.md ⬜
PR-095 Notifications (8 types; in-app P0, email P1) P0/P1 7 phase-07-collaboration.md ⬜
PR-096 Inbox (unread, deep links, preferences) P0 7 phase-07-collaboration.md ⬜
PR-097 Independent mention read-state P0 7 phase-07-collaboration.md ⬜
PR-098 Search everything (7 entity types) P0 8 phase-08-search.md ⬜
PR-099 Full-text + prefix + fuzzy P0 8 phase-08-search.md ⬜
PR-100 Search filters + highlighted snippets P0 8 phase-08-search.md ⬜
PR-101 Recent searches + suggestions P0 8 phase-08-search.md ⬜
PR-102 Index pipeline (events → OpenSearch, lag < 30 s) P0 8 phase-08-search.md ⬜
PR-103 Query-time permission filtering P0 8 phase-08-search.md ⬜
PR-104 Search < 500 ms p95 P0 8 phase-08-search.md ⬜
PR-105 S3 storage + presigned upload/download P0 9 phase-09-files.md ⬜
PR-106 File pipeline (scan → metadata → thumbnail → READY) P0 9 phase-09-files.md ⬜
PR-107 Supported kinds + previews P0/P1 9 phase-09-files.md ⬜
PR-108 Virus quarantine (never served) P0 9 phase-09-files.md ⬜
PR-109 File metadata, versions, permissions, trash P0 9 phase-09-files.md ⬜
PR-110 Files in editor / database / forms P0 9 phase-09-files.md ⬜
PR-111 500 MB multipart + storage quotas P0 9 phase-09-files.md ⬜
PR-112 RBAC base matrix (4 roles) P0 2 phase-02-workspace.md ⬜
PR-113 Resource levels (None/View/Comment/Edit/Full) P0 3 phase-03-pages.md ⬜
PR-114 effective = max(role, grants) + tree walk-up + deny override P0 3 phase-03-pages.md ⬜
PR-115 Server-side re-validation on every op P0 2 phase-02-workspace.md ⬜
PR-116 Grant management UI (share dialog, inherit) P0 3 phase-03-pages.md ⬜
PR-117 Share scopes (5) P0 3 phase-03-pages.md ⬜
PR-118 Public pages (options: comments/duplicate/index/password/expiry) P0 3 phase-03-pages.md ⬜
PR-119 Permission/share audit events P0 3 phase-03-pages.md ⬜
PR-120 Enterprise policy expressions + guest restrictions P2 14 phase-14-enterprise.md ⬜
PR-121 Template types + frozen snapshots + builtins P1 10 phase-10-forms.md (adjacent) ⬜
PR-122 Instantiate from template (fresh ids) P1 10 phase-05-databases.md ⬜
PR-123 Template browser in creation flows P1 10 phase-05-databases.md ⬜
PR-124 Import (md/html/csv/json/notion zip) P1 10 phase-10-forms.md (adjacent) ⬜
PR-125 Export (md/html/pdf/csv/json) P1 10 phase-10-forms.md (adjacent) ⬜
PR-126 Import/export: permission-checked, audited, job progress P1 10 phase-10-forms.md (adjacent) ⬜
PR-127 Form builder (10 question types, validation, mapping) P1 10 phase-10-forms.md ⬜
PR-128 Public forms (unauthenticated, branding, closed) P1 10 phase-10-forms.md ⬜
PR-129 Submission → record + form.submitted event P1 10 phase-10-forms.md ⬜
PR-130 Form responses view P1 10 phase-10-forms.md ⬜
PR-131 Charts (6 types + full config) P1 10 phase-10-forms.md (adjacent) ⬜
PR-132 Dashboards (8 widget types, grid, filters) P1 10 phase-10-forms.md (adjacent) ⬜
PR-133 Public read-only dashboards P1 10 phase-10-forms.md (adjacent) ⬜
PR-134 Automation model (trigger→conditions→actions, BullMQ) P1 11 phase-11-automation.md ⬜
PR-135 8 trigger types P1 11 phase-11-automation.md ⬜
PR-136 9 action types P1 11 phase-11-automation.md ⬜
PR-137 Retries (×8 backoff), dead-letter, timeouts P1 11 phase-11-automation.md ⬜
PR-138 Run history + logs UI P1 11 phase-11-automation.md ⬜
PR-139 Pure matcher/evaluator + actor permissions on runs P1 11 phase-11-automation.md ⬜
PR-140 automation.executed audit P1 11 phase-11-automation.md ⬜
PR-141 AI gateway (5 provider families, zero-code swap) P1 12 phase-12-ai.md ⬜
PR-142 Ask AI chat (workspace context, history) P1 12 phase-12-ai.md ⬜
PR-143 Page AI (summarize/rewrite/improve/translate, diff preview) P1 12 phase-12-ai.md ⬜
PR-144 Database AI (generate/extract/formula) P1 12 phase-12-ai.md ⬜
PR-145 RAG search (hybrid + citations) P1 12 phase-12-ai.md ⬜
PR-146 Generation via structured tool calls (never raw SQL) P1 12 phase-12-ai.md ⬜
PR-147 AI logging + per-workspace token budgets P1 12 phase-12-ai.md ⬜
PR-148 REST API v1 surface (pages/dbs/query/search/files/…) P1 13 phase-13-api.md ⬜
PR-149 API keys (scoped, hashed, per-key limit) P1 13 phase-13-api.md ⬜
PR-150 OAuth2 (auth code) P1 13 phase-13-api.md ⬜
PR-151 Webhooks (6 event families, HMAC, retry, log) P1 13 phase-13-api.md ⬜
PR-152 OpenAPI spec + CI contract check + docs P1 13 phase-13-api.md ⬜
PR-153 API error envelope + key-auth e2e P1 13 phase-13-api.md ⬜
PR-154 Audit viewer (filters + export) P2 14 phase-14-enterprise.md ⬜
PR-155 Organization policies (enforced) P2 14 phase-14-enterprise.md ⬜
PR-156 Retention policies (PURGE/HOLD, nightly job) P2 14 phase-14-enterprise.md ⬜
PR-157 Admin console P2 14 phase-14-enterprise.md ⬜
PR-158 Security baseline (headers, cookies, CSRF, CORS, rate limits) P0 1, 15 phase-01-authentication.md, phase-15-production.md ⬜
PR-159 Performance targets (6 metrics + 100k dbs) P0 3, 4, 5, 15 phase-15-production.md ⬜
PR-160 Scalability (10k WS, 1k rps, 100k queries) P1 15 phase-15-production.md ⬜
PR-161 Reliability (99.9 % SLO, graceful degradation) P1 15 phase-15-production.md ⬜
PR-162 Observability (OTel, Prometheus, Grafana, Loki, alerts) P2 15 phase-15-production.md ⬜
PR-163 Backup/DR (PITR, RPO 5 m, RTO 1 h, drills) P2 15 phase-15-production.md ⬜
PR-164 Theming (light/dark/system, tokens only) P0 0 phase-00-foundation.md ⬜
PR-165 Accessibility (WCAG 2.2 AA) P0 4, ongoing phase-04-editor.md ⬜
PR-166 i18n readiness (keys, Intl, no hard-coded EN) P2 15 phase-15-production.md ⬜
PR-167 Browser support matrix + responsive P0 0 phase-00-foundation.md ⬜

Count check: 167 rows (PR-001…PR-167, contiguous). 92 rows are fully P0, 55 fully P1, 13 P2, and 7 rows (PR-037, PR-038, PR-039, PR-040, PR-058, PR-095, PR-107) split P0/P1 across sub-features — their P0 parts ship in the MVP. The MVP (all P0 content) spans Phases 0–9 exactly as product-requirements §5 states.

2. Coverage: NFRs → verifying tests

From non-functional-requirements.md; suite locations per testing.md.

NFR Target Verifying test(s) Gate
NFR-1 page load < 2 s e2e perf fixture (navigationStart→load, median of 3) + Lighthouse CI e2e job
NFR-2 editor < 50 ms in-app editor.interaction.duration otel metric (1 % sample) + 1 000-keystroke e2e nightly + phase-4 exit
NFR-3 block move < 16 ms e2e rAF-delta on 500-block page drag phase-4 exit
NFR-4 search < 500 ms k6 search-latency.js (1M-doc fixture) + server-side query timing nightly
NFR-5 API p95 < 300 ms k6 api-load.js per-endpoint + otel histogram nightly + staging SLO
NFR-6 realtime < 200 ms realtime-latency.js (2-peer, 500 edits) phase-7 exit
NFR-7 100k-block page < 2 s e2e seeded fixture + CDP memory snapshot phase-3 exit
NFR-8 100k-record db e2e fixture + db-query.js (100-row page < 300 ms) phase-5 exit
NFR-9 500 MB upload e2e 500 MB + k6 upload.js (20 VUs × 50 MB) phase-9 exit
NFR-10 concurrent edit no loss e2e 2-browser opposite-ends ×20 phase-7 exit
NFR-11 batch 100 records < 1 s k6 db-query.js write section nightly
NFR-12 import 10k blocks < 60 s e2e import timing phase-10
NFR-S1 100k records/db fixture + EXPLAIN ANALYZE archive + insert soak phase-15
NFR-S2 10k concurrent editors ws-load.js (Artillery, 30 min) phase-15
NFR-S3 1 000 rps api-load.js 30-min hold phase-15
NFR-S4 5k events/s, lag < 30 s event-bus.js + bus.consumer.lag metric phase-15
NFR-S5 10M docs, p95 < 500 ms OpenSearch stats + search-latency.js phase-15
NFR-S6 50 TB / 1k files/s quota integration + pipeline depth under load phase-15
NFR-R1 99.9 % API SLO 28-d SLO burn dashboard (staging→prod) ongoing
NFR-R2 realtime down ⇒ usable chaos integration (kill realtime mid-edit) phase-7
NFR-R3 search down ⇒ 503 + empty state chaos (dead SEARCH_URL) + 13-flow run phase-8
NFR-R4 redis down ⇒ 503 on enqueue-bound ops chaos (redis failover drill) phase-15
NFR-R5 zero loss on committed ops outbox reconciliation integration test every PR
NFR-R6 pod kill < 30 s impact k8s chaos (delete pod under load) phase-15
NFR-R7 error budget → freeze release checklist (SLO dashboard read) release gate
NFR-SE1 ASVS L2 Phase-15 ASVS audit + SCA + pen test phase-15
NFR-SE2 0 authz bypasses integration permission decision matrix (100 % cells) every PR (CI gate)
NFR-SE3 0 injection vectors e2e security/ payload suite + ZAP baseline every PR / staging
NFR-SE4 0 secrets in repo/history gitleaks + trufflehog CI every PR
NFR-SE5 auth brute-force limits hold credential-stuffing load test (5k attempts) phase-15
NFR-SE6 EICAR blocked 100 %; no unsigned reads files integration (EICAR + signed-URL expiry) phase-9
NFR-SE7 100 % mandatory audit events audit scenario script integration suite every PR (auth/perms) + phase-14
NFR-SE8 TLS 1.2+ / HSTS ≥ 1 y TLS scanner + header assertions in e2e staging CI
NFR-P1 tenant isolation cross-tenant matrix (50 pairs, 0 leaks) every PR (CI gate)
NFR-P2 no PII in logs PII-scrubber test (seeded strings absent from logs) every PR (logging)
NFR-P3 platform retention defaults retention integration tests (per scope) phase-14
NFR-P4 enterprise retention (PURGE/HOLD) policy→job→purge/hold integration (phase-14 exit) phase-14
NFR-P5 export/delete user data owner export + cascade-delete integration phase-14
NFR-P6 cookie/tracking policy cookie audit in e2e (no third-party cookies) phase-15
NFR-B1 PG PITR restore drill to T-10 min (quarterly) phase-15 + quarterly
NFR-B2 S3 versioning recovery versioned-restore test phase-15
NFR-B3 OpenSearch snapshot restore snapshot restore + alias swap test phase-15
NFR-B4 RPO ≤ 5 min drill measurement (now − last WAL/snapshot) phase-15 + quarterly
NFR-B5 RTO ≤ 1 h full DR drill (timed, documented) phase-15 + quarterly
NFR-B6 backup verification backup.verified jobs + staleness alert phase-15
NFR-B7 config reconstructable clone-to-cluster drill (DR drill step) phase-15
NFR-O1–O6 offline (edit, durability, sync, conflicts, scope) offline.spec.ts (Playwright network emulation) + codec convergence tests phase-7
NFR-M1/M2 coverage 90 % engines / 70 % apps Vitest/Jest coverageThreshold gates every PR
NFR-M3 formula fuzz nightly 10k fuzz job (0 crash/hang) + PR smoke 1k nightly
NFR-M4 strict TS, no any typecheck + eslint no-explicit-any (ratchet) every PR
NFR-M5 dependency policy PR template + SCA gate every PR
NFR-M6 import boundaries eslint import/no-restricted-paths (0 exceptions) every PR
NFR-M7 CI build < 15 min turbo timing regression check every merge
NFR-M8 docs currency PR checklist + docs-touch check (informational) every PR
NFR-I1–I6 i18n readiness eslint i18n rule + Intl integration tests + RTL logical-property audit every PR / phase-15
NFR-H1 one-command local Phase-0 CI matrix (clean clone) every merge
NFR-H2 prod from git clone-to-cluster drill phase-15
NFR-H3 resource floor staging sizing parity check phase-15
NFR-H4 zero-downtime upgrade rolling-deploy under load test phase-15
NFR-H5 telemetry opt-out env default check (OTEL_ENABLED=false) + no-egress test phase-15

3. Coverage: API endpoints → requirements

REST API v1 surface (full contract in docs/api/, generated from packages/shared + Nest decorators — PR-152). Auth = session cookie or API-key/OAuth bearer. ⚿ = permission required (level per security-architecture §3).

Endpoint (v1) Purpose Requirement(s)
POST /auth/register · POST /auth/verify · POST /auth/login · POST /auth/logout · POST /auth/refresh auth lifecycle PR-001…005
GET /auth/sessions · DELETE /auth/sessions/:id session management PR-005
POST /auth/password/forgot · POST /auth/password/reset password reset PR-006
GET /users/me · PATCH /users/me profile PR-008
POST /workspaces · GET /workspaces · PATCH /workspaces/:id · DELETE /workspaces/:id workspace CRUD PR-013…015
GET/PATCH /workspaces/:id/members · POST /workspaces/:id/invitations (+accept/revoke) members & invites PR-016…018
GET/POST /workspaces/:id/teams · PATCH /teams/:id · members teams PR-019
GET /workspaces/:id/sidebar (tree, depth-limited, cursor) sidebar data PR-020
GET/PATCH /workspaces/:id/settings settings PR-021
POST /organizations · members · POST /scim/v2/* · retention policies org + enterprise PR-022…024, PR-155, PR-156
GET/POST /workspaces/:id/pages (+children, ?depth) · PATCH/DELETE /pages/:id · `POST /pages/:id/restore purge duplicate
GET /pages/:id/versions · POST /pages/:id/versions/:v/restore version history PR-031
GET/POST /pages/:id/blocks · PATCH /blocks/:id · POST /blocks:batch (move/insert, fractional, 1 txn) · DELETE /blocks/:id block engine PR-034…044
GET/POST /workspaces/:id/databases · PATCH /databases/:id (+properties, views) database schema PR-057, PR-074, PR-070
GET /databases/:id/records (view query: filter/sort/group/pageSize/cursor) · POST /databases/:id/records (batch ≤ 100) · PATCH /records/:id · DELETE /records/:id records (record = page) PR-060, PR-061, PR-062, PR-071…073, PR-148
POST /databases/:id/query the shared query engine (UI + API parity) PR-070…073, PR-148
relation/rollup/formula/button endpoints (POST /databases/:id/relations, …/rollups, …/formulas (parse+validate), …/buttons, POST /buttons/:id/run) computed layer PR-075…083
GET/POST /files:prepare · POST /files/:id:complete · GET /files/:id (signed URL) · GET /files/:id/download file pipeline PR-105…111
GET/POST /pages/:id/comments (+replies, reactions, resolve) comments PR-091…093
GET /notifications (+mark-read) · preferences inbox PR-095…097
POST /search · GET /search/suggest search PR-098…104
GET/POST /workspaces/:id/templates · POST /templates/:id/instantiate templates PR-121…123
POST /imports · POST /exports (jobs + progress) import/export PR-124…126
GET/POST /databases/:id/forms (+questions) · POST /forms/:id/publish · public POST /public/forms/:slug/submissions forms PR-127…130, PR-069
charts/dashboards (POST /databases/:id/charts, POST /workspaces/:id/dashboards, widgets) dashboards PR-131…133, PR-068
GET/POST /workspaces/:id/automations (+triggers/conditions/actions) · POST /automations/:id/run · runs + logs automation PR-134…140
GET/POST /ai/chat (SSE) · POST /ai/actions/* (summarize/rewrite/generate) · POST /ai/search (RAG) AI PR-141…147
GET /api/v1/openapi.json · /docs contract + docs PR-152
API keys (POST /workspaces/:id/api-keys, revoke, list) · OAuth (/oauth/authorize, /oauth/token) public API auth PR-149, PR-150
webhooks (POST /workspaces/:id/webhooks, list/deliveries) · inbound POST /api/v1/webhooks/inbound/:path webhooks PR-151, PR-135 (WEBHOOK trigger)
permissions (GET/POST /pages/:id/permissions, DELETE …/:grantId, share dialog data) · POST /pages/:id/shares permissions & sharing PR-113…119
public (unauthenticated) GET /share/:token (page render) · GET /forms/:slug public surfaces PR-118, PR-128, PR-133
admin (POST /admin/search/reindex, queue reprocess, audit export) ops PR-102, PR-137, PR-154
realtime (WS, not REST): ws?token=… join/update/presence frames collaboration PR-084…090

Unmapped-by-design: /healthz/* (liveness/readiness — no PR, infra contract), static assets. Every other route must appear in this table (the OpenAPI contract test enforces the reverse direction too: no live endpoint without a documented requirement).

4. Maintenance rules for this matrix

  1. 1:1 with the registry: a PR id exists in exactly one of product-requirements.md + this file; adding a requirement means adding it to both in the same PR (phase owner's job; CI can diff the id sets — the id list is grep-stable: PR-\d{3}).
  2. Status discipline: a row turns 🟨 when its task file's work starts, ✅ only when the task's Definition of Done is verified (AGENTS.md rule 30) — the ✅ commit must include the test evidence (suite name / run link).
  3. Phase changes (a requirement slipping or landing early) are recorded here + in ROADMAP, with the task file as the arbiter.
  4. Coverage sections update when a test suite is added or an endpoint is introduced; a new endpoint without a row in §3 fails the PR review (coding-standards DOC1).