# Learnitive — Audit & Auto-Fix Report

Date: 2026-09-07 (Australia/Sydney)

## Scope

Follow-up audit of the completed `learnitive-os-staging-20260907-homepage-editor-terminal-refresh-implemented-public_html.zip` release, itself derived solely from the user-designated 20260906 source-of-truth archive.

## Issues found and fixed

1. **Sandbox project sync still used update-only local writes.** Cloud-created files in this reconciliation path could fail with `Cannot write file as it does not exist`. Fixed with `exists → writeFile/createFile` through `FileSystemService`, preserving editor change notifications.
2. **AI checkpoint undo could not recreate a deleted file.** Fixed with the same create-or-update file restore behavior.
3. **Homepage AI prompt blue focus outline could still win via CSS specificity.** Added an ID-specific later `:focus-visible` override with no outline/ring while preserving the composer focus-within treatment.
4. **Unsafe React event retention remained in functional state updaters.** Fixed Admin runtime settings, Change Log controls and review selection. Added a source-wide regression guard.
5. **Expired terminal session records could consume the global terminal ceiling until scavenging.** Terminal creation now prunes expired records before global capacity checks.
6. **Restart/expiry lifecycle paths could delete session records without closing attached WebSockets.** Added shared session-close helpers and used them across close/restart/destroy/expiry paths.

## New regression coverage

`scripts/learnitive-audit-autofix-regressions.node.test.mjs`

The canonical current-release audit also now includes abuse/resource-control tests.

## Verification

- New audit/autofix + abuse-control tests: **9/9 PASS**
- Canonical current-release audit: **186/186 PASS**
- Namespace audit: **PASS** — 1,406 active text files
- Brand audit: **PASS**
- Public assets: **PASS** — 13 required assets
- Frozen pnpm lock synchronization: **PASS** — 69 workspace importers
- Workspace dependency versions: **PASS** — 69 packages
- Public barrels: **PASS** — 68 public entries / 69 packages
- TypeScript/TSX parser audit: **1,020 files, 0 errors**
- JS/MJS/CJS syntax: **290 files, 0 errors**
- Shell syntax: **11 files, 0 errors**
- JSON parse audit: **93 files, 0 errors**
- Source-wide deferred React event hazards: **0**

`node scripts/run-release-quality.mjs` reports overall **PASS** and writes `release-quality-report.json`.

## Verification not possible in this clean/offline archive environment

The source package contains no installed workspace dependencies and the environment cannot fetch the repository-pinned pnpm toolchain/dependencies. Therefore these remain external verification steps rather than known failures:

- `pnpm lint:ci`
- `pnpm test:ci`
- `pnpm build`
- Playwright/browser smoke
- real staging Docker/WebSocket/project-sync smoke

No staging deployment was performed.

## Final package integrity

Final archive: `learnitive-os-staging-20260907-audit-autofix-complete-public_html.zip`

- source-tree files: **5,298**
- ZIP files: **5,298**
- missing: **0**
- extra: **0**
- byte mismatches: **0**
- ZIP CRC/integrity: **PASS**

A sibling `.sha256` file is produced outside the source tree.


---

## Authentication expansion and hero refresh — 2026-09-07

Starting source: `learnitive-os-staging-20260907-explore-assets-heading-cleanup-complete-public_html.zip`.

Completed:

- homepage H1 changed to **Code, Run and Build. / Learnitive** without changing established homepage SEO title;
- existing Google OAuth preserved;
- optional GitHub OAuth added with state validation, verified-email retrieval/linking and normal Learnitive session issuance;
- CAPTCHA-protected magic email login added using server-side Cloudflare Turnstile verification;
- magic request creates no user; user is created only after explicit one-time link consumption;
- SHA-256 token-at-rest design, TTL, rate limits, safe redirects, explicit confirmation page and security-conscious logging added;
- migration 49 adds verified-email state and magic-link storage;
- PrivateEmail SMTP/GitHub/Turnstile configuration added to env template/installer without embedding or overwriting secrets;
- SMTP port 465 requires implicit TLS (`SMTP_SECURE=true`);
- read-only provider-status visibility added to Admin dashboard;
- Turnstile CSP support added narrowly.

Verification:

- canonical current-release audit: **237/237 PASS**;
- dependency-light release-quality gate: **PASS**;
- TypeScript/TSX: **1,031 files, 0 errors**;
- JS/MJS/CJS: **317 files, 0 errors**;
- shell: **14 files, 0 errors**;
- JSON/JSONC: **180 files, 0 errors**.

Host-level staging validation still requires real SMTP, GitHub OAuth and Turnstile credentials plus real mail delivery/OAuth callback testing.

## 2026-09-07 production build hotfix: Lucide GitHub icon

Staging Vite/Rolldown exposed a dependency-backed build failure that dependency-light audits could not reproduce: pinned `lucide-react@1.23.0` does not export `Github`. The GitHub sign-in button now uses the already-supported `GitBranch` icon and the auth regression explicitly rejects reintroduction of the unsupported `Github` symbol. Targeted auth tests pass 7/7, canonical release audit passes 237/237, and the dependency-light release-quality gate passes.