[ExcelDsigN-tech]

Summary

Closes #726
Closes #746
Closes #748
Closes #753

This PR covers four issues, each in its own commit. Getting #753 working turned up some things that were already broken on main. Those fixes are in a separate fix: commit, listed at the end.

Changes

#726 Accessibility: skip link, focus and live announcements

• When you navigate within the app, AppShell moves focus to <main> and announces "Navigated to {page}" in a polite live region.
  • A fresh page load keeps the browser's own focus order, even under StrictMode.
  • Switching language is not treated as a navigation.
• The toast container is now the only live region; individual toasts no longer nest aria-live.
• The task detail page announces task and stream status changes.
• New a11y.navigatedTo string in en, es and zh.
• New Playwright spec frontend/tests/e2e/a11y-skip-link.spec.ts covers:
  • the skip link
  • focus moving to <main> on route change
  • focus left alone on first load

#746 Log redaction for secrets, tokens and API keys

• Signature, JWT and credential keys are redacted.
• Prompt, completion and request/response bodies become [REDACTED_BODY].
• JWTs are scrubbed out of free-text strings.
• req/res serializers now log only these fields: id, method, path (query string dropped), ip and statusCode.
• logger.child() bindings are sanitized. Pino serializes them once and never passes them through logMethod or formatters.bindings, so a secret bound to a child logger used to be written as-is on every line.
• Canary test logger.redaction.test.ts logs a known secret through every logging path and fails if it reaches the output.
• The redaction layers are documented in docs/SECURITY_CHECKLIST.md.

#748 Contract-test live routes against the OpenAPI spec in CI

• New backend/tests/openapiRouteDiff.test.ts walks the live Express router and fails with a two-sided diff:
  • routes the app serves that the spec doesn't document
  • routes the spec documents that the app doesn't serve
• It runs in npm run test:contract, which CI already calls.
• The existing response-contract suite (feat(backend): Add automated OpenAPI contract tests that validate every route against its spec schema #815) now sends requests to app.httpServer. createApp() returns a handle, not an Express app, so before this every request threw app.address is not a function.

#753 docker-compose integration profile for full-stack CI

• docker-compose.yml gets a test profile with a smoke runner service.

• The compose file itself is fixed:

  • The Stellar healthcheck grepped for text Horizon never returns, so the node never became healthy.
  • DATABASE_URL was a sqlite:// URL, which resolveDatabasePath() rejects.
  • The volume path was wrong.
  • The backend now sets STELLAR_NETWORK=local.

• tests/e2e/compose-smoke.mjs checks, in order:

  1. backend liveness
  2. agent registration with a signed challenge
  3. task submission
  4. the first SSE event

  It uses Node built-ins only, so there is no install step.

• New integration-compose CI job:

  • builds the backend image with a buildx layer cache
  • runs the smoke suite
  • checks the backend exits 0 on SIGTERM
  • uploads the compose logs if anything fails

  It has a 20 min timeout, only runs when a paths filter matches, and is part of ci-gate.

• Documented in tests/e2e/README.md.

Fixes for things already broken on main

The issues above needed these to work:

• Backend Dockerfile:
  • It ran npm install --workspace=backend, but the repo has no workspaces. It now installs from backend/package-lock.json.
  • Moved to Node 24, since better-sqlite3@13 needs Node 22 or later.
  • Uses --ignore-scripts, because the prebuilt binaries ship in the package.
  • Gives the non-root user a writable data directory.
• .dockerignore: added, so host node_modules (glibc builds) never get into the Alpine image.
• config/index.ts: package.json is now imported, so tsc emits dist/package.json. Before this, npm start after npm run build crashed.
• copy-migrations.js: it copied SQL to dist/db/migrations, but the compiled loader reads dist/src/db/migrations.
• Horizon and Soroban RPC clients: they now allow http:// only when STELLAR_NETWORK=local, so the backend can reach the compose standalone node. TLS is still required everywhere else.

Verification & Testing

• Backend npx jest --runInBand, compared with main (at 1d5ccc6, before the latest upstream merge) on the same machine:
  • main: 138 failing, 2152 passing
  • this branch: 132 failing, 2189 passing
  • The same 30 suites fail on both, and no test that passes on main fails here.
• Canary test logger.redaction.test.ts: 29/29 pass.
• Route drift test openapiRouteDiff.test.ts: passes.
• Frontend unit tests for the touched files: no new failures compared with main.
• Playwright a11y-skip-link.spec.ts: 3/3 pass, stable across repeated runs, including after merging the latest main.
• docker compose --profile test up --exit-code-from smoke smoke: passes in about 22s against real containers. docker compose stop backend then exits 0 after a clean graceful shutdown.
• Backend tsc --noEmit is clean. Frontend has the same 107 type errors as current main, and none are new.
• cargo test / cargo fmt / clippy: N/A, no contract changes.

Contributor Checklist

• PR title follows Conventional Commits
• All CI checks pass locally. Not all of them, and these failures are already on main:
  • Backend doesn't compile on current main: src/services/venice/client.ts has a syntax error ('catch' or 'finally' expected, line 561) left by a merge. Fixing that exposes 16 more type errors from half-merged Add health-aware Venice fallback key rotation #741 and Apply per-endpoint timeout budgets with AbortController #742 (TIMEOUT_BUDGET_*_MS missing from Config, getVeniceKeyHealthStore and keyHealth undefined). Until that's fixed on main, the backend build, the Docker image and integration-compose will fail on every PR, including this one. This PR doesn't touch those files.
  • Contract suite (feat(backend): Add automated OpenAPI contract tests that validate every route against its spec schema #815): now that it actually runs, 7 tests fail. The endpoints need database fixtures (they return 500/503/400), and only 12 operations are checkable against a floor of 20.
  • Lint: one error, in qualityScoreCache.ts, a file this PR doesn't touch.
  • format:check: fails on about 1,184 files on main. Only files new in this PR were formatted.
• Documentation updated (docs/SECURITY_CHECKLIST.md, tests/e2e/README.md)
• No secrets or credentials committed

Follow-ups (not in this PR)

• Frontend Docker image is also broken:

  • it uses the same --workspace install
  • npm run build || true hides type errors
  • there's no preview script

  Once it's fixed, the compose smoke run can cover the frontend too.

• feat(backend): Add automated OpenAPI contract tests that validate every route against its spec schema #815 contract suite needs seeded fixtures before it can check the documented 200 responses.

[drips-wave]

@ExcelDsigN-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@ExcelDsigN-tech is attempting to deploy a commit to the Jaja's projects Team on Vercel.

A member of the Team first needs to authorize it.