[Task] Classify backend endpoints without static frontend reachability #26

New Issue

2026-07-30T17:34:19+02:00

zemion commented

2026-07-30 17:34:19 +02:00

The platform inventory currently reports backend endpoints with no statically visible frontend API reference. Many are intentionally headless, webhook, public, worker, compatibility, or provider endpoints; the rest may reveal missing UI or dead API surface.

Acceptance criteria

Every unmatched endpoint is classified as UI-reachable, intentionally headless, public/integration, worker/internal, compatibility, missing UI, or removable.
Dynamic path construction and capability/provider calls are resolved through declarations rather than fragile string matching.
Missing user-facing paths become module issues; dead or obsolete endpoints are removed under the compatibility policy.
CI detects new unclassified public endpoints.
The report never assumes that an endpoint is safe or unused solely because static frontend matching failed.

Initial output is generated under audit-reports/platform-inventory/.

The platform inventory currently reports backend endpoints with no statically visible frontend API reference. Many are intentionally headless, webhook, public, worker, compatibility, or provider endpoints; the rest may reveal missing UI or dead API surface. ## Acceptance criteria - Every unmatched endpoint is classified as UI-reachable, intentionally headless, public/integration, worker/internal, compatibility, missing UI, or removable. - Dynamic path construction and capability/provider calls are resolved through declarations rather than fragile string matching. - Missing user-facing paths become module issues; dead or obsolete endpoints are removed under the compatibility policy. - CI detects new unclassified public endpoints. - The report never assumes that an endpoint is safe or unused solely because static frontend matching failed. Initial output is generated under `audit-reports/platform-inventory/`.

zemion added the

type

task

area/api area/devex codex/ready

module/core labels 2026-07-30 17:34:19 +02:00

zemion referenced this issue

2026-07-30 17:46:46 +02:00

[User Story] Establish and apply a whole-system GovOPlaN interface pattern language #11

zemion commented

2026-08-02 05:32:26 +02:00

Implemented and pushed in GovOPlaN/govoplan@50e9607.

Added an exact, version-controlled endpoint declaration registry with all required categories.
Dynamic suffixes are canonicalized without relying on fragile frontend string matching.
Strict inventory now covers 784 backend endpoints: 218 need declarations, with 0 unclassified and 0 stale declarations.
The module-matrix CI workflow runs the inventory in strict mode, so a new unmatched public endpoint blocks CI.
User-facing gaps were routed to Access #18, Approvals #2, Calendar #21, Files #40, Encryption #4, Identity Trust #2, Organizations #6, Reporting #4/#5/#6, Search #1, and Campaign #26.

Verification: strict inventory passed; inventory/deployment/publication suite 54 passed, 2 subtests; production WebUI build passed.

Acceptance criteria are met; closing.

Implemented and pushed in `GovOPlaN/govoplan@50e9607`. - Added an exact, version-controlled endpoint declaration registry with all required categories. - Dynamic suffixes are canonicalized without relying on fragile frontend string matching. - Strict inventory now covers **784 backend endpoints**: 218 need declarations, with **0 unclassified** and **0 stale** declarations. - The module-matrix CI workflow runs the inventory in strict mode, so a new unmatched public endpoint blocks CI. - User-facing gaps were routed to Access [#18](https://git.add-ideas.de/GovOPlaN/govoplan-access/issues/18), Approvals #2, Calendar #21, Files #40, Encryption #4, Identity Trust #2, Organizations #6, Reporting #4/#5/#6, Search #1, and Campaign #26. Verification: strict inventory passed; inventory/deployment/publication suite `54 passed, 2 subtests`; production WebUI build passed. Acceptance criteria are met; closing.

zemion closed this issue

2026-08-02 05:32:26 +02:00

zemion commented

2026-08-02 05:41:44 +02:00

Post-push CI exposed an infrastructure prerequisite: govoplan-decisions, govoplan-mandates, govoplan-parties, and govoplan-services are private. The strict inventory workflow currently stops at repository bootstrap before it can execute.

GovOPlaN/govoplan@d9003bf now securely forwards the short-lived GITEA_TOKEN checkout header to child clones without printing or persisting it. Local bootstrap/security-wrapper tests pass (25 passed, 17 subtests), and the public-repository clones succeed. Gitea still denies the four private repositories by design.

Required one-time setting: GovOPlaN -> Settings -> Actions -> General -> Cross-Repository Access, grant the govoplan Actions token read access to those four repositories. Then rerun Module Matrix (and the two audit jobs). Alternatively, explicitly decide to make those module repositories public; this implementation does not change repository visibility implicitly.

Reopening until the strict CI run reaches and passes endpoint classification.

Post-push CI exposed an infrastructure prerequisite: `govoplan-decisions`, `govoplan-mandates`, `govoplan-parties`, and `govoplan-services` are private. The strict inventory workflow currently stops at repository bootstrap before it can execute. `GovOPlaN/govoplan@d9003bf` now securely forwards the short-lived `GITEA_TOKEN` checkout header to child clones without printing or persisting it. Local bootstrap/security-wrapper tests pass (`25 passed, 17 subtests`), and the public-repository clones succeed. Gitea still denies the four private repositories by design. Required one-time setting: `GovOPlaN -> Settings -> Actions -> General -> Cross-Repository Access`, grant the `govoplan` Actions token read access to those four repositories. Then rerun Module Matrix (and the two audit jobs). Alternatively, explicitly decide to make those module repositories public; this implementation does not change repository visibility implicitly. Reopening until the strict CI run reaches and passes endpoint classification.

zemion reopened this issue

2026-08-02 05:41:45 +02:00

zemion added codex/needs-human

and removed

codex/ready labels 2026-08-02 05:41:45 +02:00

zemion commented

2026-08-03 20:31:39 +02:00

Revalidated and completed in GovOPlaN/govoplan@62501d3.

Cross-repository Actions access now reaches every private module checkout.
The exact endpoint registry covers the current platform with 0 unclassified and 0 stale declarations.
The endpoint-only release gate is now independent from translation-catalog debt; full --strict still enforces both concerns.
Campaign artifact reconciliation was classified as a privileged worker/recovery operation.
Gitea Module Matrix run #461 passed end to end, including endpoint inventory, PostgreSQL Search, worker guarantees, and module permutations.

The linked module issues remain the canonical implementation backlog for deliberately identified UI/product gaps; they do not leave any endpoint unclassified. The parent acceptance criteria are now proven in CI.

Revalidated and completed in `GovOPlaN/govoplan@62501d3`. - Cross-repository Actions access now reaches every private module checkout. - The exact endpoint registry covers the current platform with **0 unclassified** and **0 stale** declarations. - The endpoint-only release gate is now independent from translation-catalog debt; full `--strict` still enforces both concerns. - Campaign artifact reconciliation was classified as a privileged worker/recovery operation. - Gitea Module Matrix [run #461](https://git.add-ideas.de/GovOPlaN/govoplan/actions/runs/461) passed end to end, including endpoint inventory, PostgreSQL Search, worker guarantees, and module permutations. The linked module issues remain the canonical implementation backlog for deliberately identified UI/product gaps; they do not leave any endpoint unclassified. The parent acceptance criteria are now proven in CI.

zemion removed the codex/needs-human

status

needs-info

labels 2026-08-03 20:31:40 +02:00

zemion closed this issue

2026-08-03 20:31:40 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#26