agent/docs/mvp-verification.md

MVP Verification

Backend

Run:

Set-Location backend
go test ./... -v

Expected: all backend tests pass.

PostgreSQL Integration

Set DATABASE_URL to the live PostgreSQL test database before running integration checks. Do not commit real credentials.

Run:

Set-Location backend
go test -tags integration ./internal/db -run TestPostgresPing -v

Expected: TestPostgresPing passes.

Web

The frontend is Svelte-only.

Run:

Set-Location apps/web
npx tsc --noEmit -p tsconfig.app.json
npm test -- --run
npm run build
npx playwright test

Expected: TypeScript check, component tests, production build, and Playwright smoke/E2E tests pass.

Desktop

Run:

Set-Location apps/web
npm run build
Set-Location ../desktop
npm run build

Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stable Rust toolchain is complete.

Current machine status:

• rustup was installed through winget.
• The latest desktop build attempt fails before project compilation because cargo is not available on PATH: program not found.
• Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run npm run build from apps/desktop.

Latest Audit Verification

Last audited: 2026-07-18.

• backend: go test ./... -v passed.
• apps/web: npx tsc --noEmit -p tsconfig.app.json passed.
• apps/web: npm test -- --run passed.
• apps/web: npm run build passed.
• apps/web: npx playwright test passed.
• apps/desktop: npm run build blocked by missing Cargo/Rust toolchain on the current machine.

Audit fixes included:

• Signed expiring auth session tokens replaced forgeable user:<id> tokens.
• Project and inbox HTTP handlers now read the authenticated user from bearer middleware instead of hard-coding user 1.
• Project dashboard loading now checks project ownership before returning counters.
• Inbox confirmation preserves provenance with source_inbox_item_id on generated tasks, notes, and sources.
• Task sharing now rejects note/source links from another project.
• AI user keys are encrypted before storage, decrypted on selection, and can be checked with a per-user action rate limit.
• Web API calls now use the backend /api prefix and the Svelte shell includes an inbox suggestion confirmation E2E path.

Manual MVP Flow

1. Open the client and enter the server IP or domain on the login screen.
2. Create or log in as a private-deployment user.
3. Create a project.
4. Add text to project inbox.
5. Click Analyze/Organize.
6. Confirm one task and one note from the suggestion list.
7. Assign the task to another system user.
8. Explicitly share one note with the task.
9. Search for text from the note body in global search.
10. Open an AI session under the project and reference the note.
11. Use Tauri quick capture to send text into the active project inbox.