@atlashub/smartstack-cli 3.14.0 → 3.15.0

package/templates/skills/ralph-loop/references/category-rules.md

@@ -43,6 +43,17 @@ Rules:
 **MCP:** `suggest_migration` → get migration name
 
 Execution sequence:
+0. Ensure `dotnet ef` is on PATH (platform-aware):
+   ```bash
+   if ! dotnet ef --version &>/dev/null; then
+     for TOOLS_DIR in "$USERPROFILE/.dotnet/tools" "$HOME/.dotnet/tools" "$LOCALAPPDATA/Microsoft/dotnet/tools"; do
+       [ -n "$TOOLS_DIR" ] && [ -d "$TOOLS_DIR" ] && export PATH="$TOOLS_DIR:$PATH"
+     done
+     dotnet ef --version &>/dev/null || { echo "ERROR: dotnet-ef not found. Install: dotnet tool install --global dotnet-ef"; exit 1; }
+   fi
+   ```
+   > **Why:** On Windows (Git Bash), `$USERPROFILE/.dotnet/tools` is the correct path.
+   > NEVER use `$HOME/.dotnet/tools` alone — on WSL, `$HOME` resolves to `/home/{user}` where .NET SDK is not installed.
 1. Call `mcp__smartstack__suggest_migration` → get standardized name
 2. `dotnet ef migrations add {Name} --project src/{Infra}.csproj --startup-project src/{Api}.csproj -o Persistence/Migrations`
 3. `dotnet ef database update --project src/{Infra}.csproj --startup-project src/{Api}.csproj`
@@ -110,6 +121,11 @@ dotnet build --no-restore
 **BLOCKING:** Build MUST pass before proceeding to application/api/test/frontend.
 If build fails, fix infrastructure code first.
 
+> **NOTE:** If build passes but you suspect assembly issues (e.g., new packages added to Infrastructure
+> that may not be in the meta-package), also run a quick startup check:
+> `dotnet run --project {ApiProject} --urls "http://localhost:5098" &` and verify the process survives 5 seconds.
+> See `references/error-classification.md` for error classification if it crashes.
+
 ---
 
 ## Application
@@ -186,11 +202,12 @@ Rules:
 
 **Execution sequence (IN ORDER):**
 1. `mcp__smartstack__scaffold_api_client` → API client + types + React Query hook
-2. `mcp__smartstack__scaffold_routes` → routes inside correct Layout wrapper
-3. Create pages using SmartStack components
-4. Create preferences hook: `use{Module}Preferences.ts`
-5. Generate i18n (4 languages: fr, en, it, de)
-6. `npm run typecheck` MUST pass (BLOCKING)
+2. `mcp__smartstack__scaffold_routes` (with `outputFormat: "clientRoutes"`) → route registry + route fragments
+3. **Wire routes to App.tsx** → insert `<Route>` entries inside correct Layout wrapper (BOTH standard AND tenant-prefixed `/t/:slug/...` blocks)
+4. Create pages using SmartStack components
+5. Create preferences hook: `use{Module}Preferences.ts`
+6. Generate i18n (4 languages: fr, en, it, de)
+7. `npm run typecheck` MUST pass (BLOCKING)
 
 **Components:**
 - Lists: `SmartTable` + `SmartFilter` (NOT HTML `<table>`)
@@ -229,6 +246,8 @@ import axios from 'axios'                    → use @/services/api/apiClient
 <Route path="/business/app/mod" />           → MUST be nested inside Layout
 Only fr/en translations                      → MUST have 4 languages
 src/pages/{Module}/                          → MUST be src/pages/{Context}/{App}/{Module}/
+Routes generated but NOT added to App.tsx    → MUST wire routes to App.tsx after scaffold_routes
+Routes in standard block only               → MUST also add to /t/:slug/ tenant block
 '00000000-0000-0000-0000-000000000000'       → use dynamic ID from auth context or route params
 const api = axios.create(...)                → use @/services/api/apiClient (single instance)
 useXxx with raw axios inside hooks           → hooks MUST use the shared apiClient from @/services/api
@@ -252,38 +271,63 @@ useXxx with raw axios inside hooks           → hooks MUST use the shared apiCl
 
 **Execution sequence:**
 
-1. **Ensure test project exists:**
+1. **Ensure test projects exist:**
    ```bash
-   TEST_PROJECT="tests/${PROJECT_NAME}.Tests.Unit"
-   if [ ! -d "$TEST_PROJECT" ]; then
-     dotnet new xunit -n "${PROJECT_NAME}.Tests.Unit" -o "$TEST_PROJECT"
-     dotnet add "$TEST_PROJECT" package Moq
-     dotnet add "$TEST_PROJECT" package FluentAssertions
-     for proj in src/*/*.csproj; do dotnet add "$TEST_PROJECT" reference "$proj"; done
-     dotnet sln add "$TEST_PROJECT/${PROJECT_NAME}.Tests.Unit.csproj"
+   # Unit test project
+   UNIT_TEST_PROJECT="tests/${PROJECT_NAME}.Tests.Unit"
+   if [ ! -d "$UNIT_TEST_PROJECT" ]; then
+     dotnet new xunit -n "${PROJECT_NAME}.Tests.Unit" -o "$UNIT_TEST_PROJECT"
+     dotnet add "$UNIT_TEST_PROJECT" package Moq
+     dotnet add "$UNIT_TEST_PROJECT" package FluentAssertions
+     for proj in src/*/*.csproj; do dotnet add "$UNIT_TEST_PROJECT" reference "$proj"; done
+     dotnet sln add "$UNIT_TEST_PROJECT/${PROJECT_NAME}.Tests.Unit.csproj"
+   fi
+
+   # Integration test project (SQL Server LocalDB)
+   INT_TEST_PROJECT="tests/${PROJECT_NAME}.Tests.Integration"
+   if [ ! -d "$INT_TEST_PROJECT" ]; then
+     dotnet new xunit -n "${PROJECT_NAME}.Tests.Integration" -o "$INT_TEST_PROJECT"
+     dotnet add "$INT_TEST_PROJECT" package FluentAssertions
+     dotnet add "$INT_TEST_PROJECT" package Microsoft.AspNetCore.Mvc.Testing
+     dotnet add "$INT_TEST_PROJECT" package Microsoft.EntityFrameworkCore.SqlServer
+     dotnet add "$INT_TEST_PROJECT" package Microsoft.Data.SqlClient
+     dotnet add "$INT_TEST_PROJECT" package Respawn
+     for proj in src/*/*.csproj; do dotnet add "$INT_TEST_PROJECT" reference "$proj"; done
+     dotnet sln add "$INT_TEST_PROJECT/${PROJECT_NAME}.Tests.Integration.csproj"
    fi
    ```
 
-2. **Generate tests via MCP** (NOT manually):
-   - Domain: `scaffold_tests` with target_layer="domain"
-   - Service: `scaffold_tests` with target_layer="application"
-   - Controller: `scaffold_tests` with target_layer="api", test_type="integration"
-   - Security: `scaffold_tests` with test_type="security"
+2. **Generate test infrastructure** (FIRST, before entity tests):
+   - `scaffold_tests` with target="infrastructure" → generates DatabaseFixture, DatabaseCollection, SmartStackTestFactory, TestAuthHandler, TestTenantService, IntegrationTestBase, TestDataSeeder
+   - These use **SQL Server LocalDB** (not SQLite) → real migrations, real LINQ→SQL
 
-3. **Run tests (BLOCKING):**
+3. **Generate entity tests via MCP** (NOT manually):
+   - Domain: `scaffold_tests` with target="entity"
+   - Service: `scaffold_tests` with target="service"
+   - Controller: `scaffold_tests` with target="controller", testTypes=["integration"]
+   - Repository: `scaffold_tests` with target="repository", testTypes=["integration"]
+   - Security: `scaffold_tests` with target="controller", testTypes=["security"]
+
+4. **Run tests (BLOCKING):**
    ```bash
-   dotnet build "$TEST_PROJECT" --no-restore
-   dotnet test "$TEST_PROJECT" --no-build --verbosity normal
+   dotnet build --no-restore
+   dotnet test --no-build --verbosity normal
    ```
+   Integration tests run against **real SQL Server LocalDB** via DatabaseFixture:
+   - Migrations are applied automatically (validates migration chain)
+   - Queries execute real T-SQL (validates LINQ→SQL translation)
+   - Multi-tenant isolation is enforced via global query filters on SQL Server
+   - Respawn resets data between tests (~50ms)
 
-4. **Fix loop:** If tests fail → analyze → fix code (NOT tests) → rebuild → retest → loop until 100% pass
+5. **Fix loop:** If tests fail → analyze → fix code (NOT tests) → rebuild → retest → loop until 100% pass
 
-5. **Coverage check:** `analyze_test_coverage` → must be >= 80%
+6. **Coverage check:** `analyze_test_coverage` → must be >= 80%
 
 **Completion criteria (ALL required):**
-- Test project exists
-- Tests generated via MCP
-- `dotnet test` exits 0 (all pass)
+- Unit test project exists
+- Integration test project exists with SQL Server LocalDB infrastructure
+- Tests generated via MCP (scaffold_tests)
+- `dotnet test` exits 0 (all pass — including integration tests on SQL Server)
 - Coverage >= 80%
 - No `[Fact(Skip = "...")]`
 
@@ -294,12 +338,72 @@ useXxx with raw axios inside hooks           → hooks MUST use the shared apiCl
 **Execution sequence:**
 
 1. `dotnet clean && dotnet restore && dotnet build` → MUST pass
+
+1a. **DB migration validation (BLOCKING — if infrastructure tasks exist):**
+   ```bash
+   INFRA_PROJECT=$(ls src/*Infrastructure*/*.csproj 2>/dev/null | head -1)
+   API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
+   if [ -n "$INFRA_PROJECT" ] && [ -n "$API_PROJECT" ]; then
+     # Check no pending model changes
+     dotnet ef migrations has-pending-model-changes \
+       --project "$INFRA_PROJECT" --startup-project "$API_PROJECT"
+     # Apply migrations on fresh SQL Server LocalDB
+     DB_NAME="SmartStack_Validation_$(date +%s)"
+     CONN_STRING="Server=(localdb)\\MSSQLLocalDB;Database=$DB_NAME;Integrated Security=true;TrustServerCertificate=true;Connect Timeout=120;"
+     dotnet ef database update --connection "$CONN_STRING" \
+       --project "$INFRA_PROJECT" --startup-project "$API_PROJECT"
+     # Cleanup
+     sqlcmd -S "(localdb)\MSSQLLocalDB" -Q "IF DB_ID('$DB_NAME') IS NOT NULL BEGIN ALTER DATABASE [$DB_NAME] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [$DB_NAME]; END" 2>/dev/null
+   fi
+   ```
+   If FAIL → migration is broken → fix before continuing
+
+1b. **Runtime assembly validation (BLOCKING):**
+   ```bash
+   API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
+   if [ -n "$API_PROJECT" ]; then
+     dotnet run --project "$API_PROJECT" --urls "http://localhost:5098" > /tmp/ralph-validation-startup.log 2>&1 &
+     VAL_PID=$!
+
+     # Wait up to 10 seconds
+     STARTED=false
+     for i in $(seq 1 10); do
+       if ! kill -0 $VAL_PID 2>/dev/null; then
+         # Process crashed
+         CRASH_LOG=$(cat /tmp/ralph-validation-startup.log 2>/dev/null)
+         echo "VALIDATION FAILED: API startup crash"
+         echo "$CRASH_LOG"
+         break
+       fi
+       HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:5098/health 2>/dev/null)
+       if [ "$HTTP_CODE" != "000" ]; then
+         STARTED=true
+         break
+       fi
+       sleep 1
+     done
+
+     kill $VAL_PID 2>/dev/null
+     wait $VAL_PID 2>/dev/null
+     rm -f /tmp/ralph-validation-startup.log
+
+     if [ "$STARTED" != "true" ]; then
+       # Classify error per references/error-classification.md
+       # Provide actionable fix command
+       # DO NOT proceed to tests — fix the startup issue first
+       echo "VALIDATION FAILED: Runtime assembly error detected"
+     fi
+   fi
+   ```
+
 2. `dotnet test` (full suite) → MUST pass
 3. `mcp__smartstack__validate_conventions` → 0 errors
 4. Generate validation report in progress.txt
 
 **Completion criteria:**
 - Build exit code 0
-- Test exit code 0
+- DB migrations apply on SQL Server LocalDB (no pending model changes)
+- Runtime startup check passes (no assembly errors)
+- Test exit code 0 (unit tests + integration tests on real SQL Server)
 - MCP validation 0 errors
 - Production ready = true

package/templates/skills/ralph-loop/references/compact-loop.md

@@ -70,7 +70,13 @@ Batch: {batch.length} [{firstCategory}] → {batch.map(t => `[${t.id}] ${t.descr
 2. **BUILD verification (BLOCKING per task):**
    - Backend (domain/infra/app/api): `dotnet build --no-restore` → MUST exit 0
    - Frontend: `npm run typecheck` → MUST exit 0
-3. If build fails → read FULL error output → fix source code → rebuild → loop until pass
+3. If build fails → **CLASSIFY ERROR FIRST** (read `references/error-classification.md`):
+   - **Category A/B (assembly/package):** Run `dotnet add package {Name}` → `dotnet restore` → rebuild. Do NOT edit source code.
+   - **Category C (DI):** Edit DI registration file only → rebuild.
+   - **Category D (migration):** Run migration commands → rebuild.
+   - **Category E (config):** Edit config file → rebuild.
+   - **Category F (code):** Fix source code → rebuild → loop until pass.
+   - **If 2+ rebuild attempts fail on same error and Category F was chosen:** Re-classify — likely wrong category.
 4. **ARTIFACT verification (BLOCKING per task):**
    - `files_created` MUST NOT be empty for code-generating tasks
    - Category-specific checks (see below)
@@ -97,7 +103,7 @@ Batch: {batch.length} [{firstCategory}] → {batch.map(t => `[${t.id}] ${t.descr
 |----------|--------|
 | `infrastructure` with `_migrationMeta` | Migration sequence: `suggest_migration` MCP → `dotnet ef migrations add` → `dotnet ef database update` → `dotnet build` |
 | `infrastructure` with seed data keywords | **MANDATORY:** Read `references/core-seed-data.md` → implement templates → `dotnet build` |
-| `frontend` | MCP-first: `scaffold_api_client` → `scaffold_routes` → create pages → `npm run typecheck && npm run lint` |
+| `frontend` | MCP-first: `scaffold_api_client` → `scaffold_routes` (outputFormat: clientRoutes) → **wire to App.tsx (standard + tenant blocks)** → create pages → `npm run typecheck && npm run lint` |
 | `test` | **Create tests:** `scaffold_tests` MCP → **Run:** `dotnet test --verbosity normal` → **Fix loop:** if fail → fix SOURCE CODE → rebuild → retest → repeat until 100% pass |
 | `validation` | `dotnet clean && dotnet restore && dotnet build` → `dotnet test` (full) → `validate_conventions` MCP |
 
@@ -116,7 +122,27 @@ Batch: {batch.length} [{firstCategory}] → {batch.map(t => `[${t.id}] ${t.descr
    ```
    If FAIL → fix source code (NOT tests) → rebuild → retest → loop until 100% pass
 
-2bis. **DI completeness (if application tasks in batch):**
+2bis. **Runtime assembly check (if api/validation tasks in batch):**
+   ```bash
+   API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
+   if [ -n "$API_PROJECT" ]; then
+     dotnet run --project "$API_PROJECT" --urls "http://localhost:5098" > /tmp/ralph-startup-check.log 2>&1 &
+     CHECK_PID=$!
+     sleep 5
+     if ! kill -0 $CHECK_PID 2>/dev/null; then
+       CRASH_OUTPUT=$(cat /tmp/ralph-startup-check.log 2>/dev/null)
+       echo "RUNTIME ASSEMBLY ERROR DETECTED"
+       # Classify per references/error-classification.md
+       # If Category A: dotnet add package → rebuild → DO NOT count as iteration failure
+     fi
+     kill $CHECK_PID 2>/dev/null
+     wait $CHECK_PID 2>/dev/null
+     rm -f /tmp/ralph-startup-check.log
+   fi
+   ```
+   If FAIL → classify error per `references/error-classification.md` → apply fix → rebuild → verify again
+
+2ter. **DI completeness (if application tasks in batch):**
    Verify `Application/DependencyInjection.cs` registers all validators and services:
    - Count validators in `Validators/` folder
    - Verify `AddValidatorsFromAssemblyContaining` is present
@@ -138,6 +164,38 @@ Batch: {batch.length} [{firstCategory}] → {batch.map(t => `[${t.id}] ${t.descr
 4. **MCP validation:**
    `mcp__smartstack__validate_conventions` ONCE for the whole batch
 
+5. **DB validation (if infrastructure/migration tasks in batch):**
+   ```bash
+   # Quick check: pending model changes after batch?
+   INFRA_PROJECT=$(ls src/*Infrastructure*/*.csproj 2>/dev/null | head -1)
+   API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
+   if [ -n "$INFRA_PROJECT" ] && [ -n "$API_PROJECT" ]; then
+     dotnet ef migrations has-pending-model-changes \
+       --project "$INFRA_PROJECT" \
+       --startup-project "$API_PROJECT"
+     if [ $? -ne 0 ]; then
+       echo "MIGRATION MISSING: Model has uncommitted changes"
+       # Create fix task for missing migration
+     fi
+
+     # If batch included migration tasks: verify migration applies on real SQL Server
+     DB_NAME="SmartStack_Ralph_Check_${iteration}"
+     CONN_STRING="Server=(localdb)\\MSSQLLocalDB;Database=$DB_NAME;Integrated Security=true;TrustServerCertificate=true;Connect Timeout=120;"
+     dotnet ef database update \
+       --connection "$CONN_STRING" \
+       --project "$INFRA_PROJECT" \
+       --startup-project "$API_PROJECT"
+     if [ $? -ne 0 ]; then
+       echo "MIGRATION BROKEN: Cannot apply migrations on SQL Server"
+       # Fix migration → rebuild → DO NOT commit until this passes
+     fi
+
+     # Cleanup temp database
+     sqlcmd -S "(localdb)\MSSQLLocalDB" -Q "IF DB_ID('$DB_NAME') IS NOT NULL BEGIN ALTER DATABASE [$DB_NAME] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [$DB_NAME]; END" 2>/dev/null
+   fi
+   ```
+   If FAIL → migration is broken → fix → rebuild → DO NOT commit
+
 **Error resolution cycle:**
 1. Read the FULL error output (not just first line)
 2. Identify root cause: file path + line number

package/templates/skills/ralph-loop/references/core-seed-data.md

@@ -19,6 +19,8 @@ const coreSeedData = meta.coreSeedData || {};
 
 // Navigation hierarchy
 const navModules = coreSeedData.navigationModules || coreSeedData.navigation || [];
+const navSections = coreSeedData.navigationSections || [];
+const navResources = coreSeedData.navigationResources || [];
 const permissions = coreSeedData.permissions || [];
 const rolePerms = coreSeedData.rolePermissions || [];
 
@@ -44,6 +46,8 @@ if (!navRoute) {
 | `appCode` | `humanresources` | `_seedDataMeta.appCode` |
 | `moduleCode` | `projects` | `task.module` |
 | `navModules[]` | `[{code, label, icon, route, translations}]` | `coreSeedData.navigationModules` |
+| `navSections[]` | `[{code, label, icon, route, parentCode, permission, sort}]` | `coreSeedData.navigationSections` |
+| `navResources[]` | `[{code, type, entity, parentCode, permission}]` | `coreSeedData.navigationResources` |
 | `permissions[]` | `[{path, action, description}]` | `coreSeedData.permissions` |
 | `rolePerms[]` | `[{role, permissions[]}]` | `coreSeedData.rolePermissions` |
 
@@ -187,6 +191,198 @@ public class NavigationTranslationSeedEntry
 
 ---
 
+## 2b. Navigation Sections & Resources (in same NavigationSeedData.cs)
+
+> **CONDITIONAL:** Only generate if `seedDataCore.navigationSections[]` exists and is non-empty in feature.json.
+> Sections and resources are added as additional methods in the **same** `{ModulePascal}NavigationSeedData.cs` file.
+
+### GUID Generation Rules
+
+```csharp
+// Section GUID: deterministic from navRoute + section code
+public static readonly Guid {SectionPascal}SectionId =
+    GenerateDeterministicGuid("navigation-section-{navRoute}.{sectionCode}");
+// Example: GenerateDeterministicGuid("navigation-section-business.ressourceshumaines.employees.list")
+
+// Resource GUID: deterministic from navRoute + section code + resource code
+public static readonly Guid {ResourcePascal}ResourceId =
+    GenerateDeterministicGuid("navigation-resource-{navRoute}.{sectionCode}.{resourceCode}");
+// Example: GenerateDeterministicGuid("navigation-resource-business.ressourceshumaines.employees.list.employees-grid")
+```
+
+### Section Methods (add to {ModulePascal}NavigationSeedData.cs)
+
+```csharp
+// --- Add AFTER GetTranslationEntries() in {ModulePascal}NavigationSeedData.cs ---
+
+// Deterministic GUIDs for sections
+public static readonly Guid {Section1Pascal}SectionId =
+    GenerateDeterministicGuid("navigation-section-{navRoute}.{section1Code}");
+// Repeat for each section...
+
+/// <summary>
+/// Returns navigation section entries for seeding into core.nav_Sections.
+/// </summary>
+public static IEnumerable<NavigationSectionSeedEntry> GetSectionEntries(Guid moduleId)
+{
+    return new[]
+    {
+        new NavigationSectionSeedEntry
+        {
+            Id = {Section1Pascal}SectionId,
+            ModuleId = moduleId,
+            Code = "{section1Code}",
+            Label = "{section1_label_en}",
+            Description = "{section1_desc_en}",
+            Icon = "{section1_icon}",
+            IconType = IconType.Lucide,
+            Route = "/{contextCode}/{appCode}/{moduleCode}/{section1Code}",
+            DisplayOrder = {section1_sort},
+            IsActive = true
+        }
+        // Repeat for each section...
+    };
+}
+
+/// <summary>
+/// Returns 4-language translations for sections.
+/// </summary>
+public static IEnumerable<NavigationTranslationSeedEntry> GetSectionTranslationEntries()
+{
+    var entries = new List<NavigationTranslationSeedEntry>();
+
+    // Section: {section1Code}
+    var sec1Id = {Section1Pascal}SectionId;
+    entries.AddRange(new[]
+    {
+        new NavigationTranslationSeedEntry
+        {
+            EntityType = NavigationEntityType.Section,
+            EntityId = sec1Id,
+            LanguageCode = "fr",
+            Label = "{section1_label_fr}",
+            Description = "{section1_desc_fr}"
+        },
+        new NavigationTranslationSeedEntry
+        {
+            EntityType = NavigationEntityType.Section,
+            EntityId = sec1Id,
+            LanguageCode = "en",
+            Label = "{section1_label_en}",
+            Description = "{section1_desc_en}"
+        },
+        new NavigationTranslationSeedEntry
+        {
+            EntityType = NavigationEntityType.Section,
+            EntityId = sec1Id,
+            LanguageCode = "it",
+            Label = "{section1_label_it}",
+            Description = "{section1_desc_it}"
+        },
+        new NavigationTranslationSeedEntry
+        {
+            EntityType = NavigationEntityType.Section,
+            EntityId = sec1Id,
+            LanguageCode = "de",
+            Label = "{section1_label_de}",
+            Description = "{section1_desc_de}"
+        }
+    });
+    // Repeat for each section...
+
+    return entries;
+}
+```
+
+### Resource Methods (add to {ModulePascal}NavigationSeedData.cs)
+
+> **CONDITIONAL:** Only generate if `seedDataCore.navigationResources[]` exists and is non-empty.
+
+```csharp
+// --- Add AFTER GetSectionTranslationEntries() ---
+
+// Deterministic GUIDs for resources
+public static readonly Guid {Resource1Pascal}ResourceId =
+    GenerateDeterministicGuid("navigation-resource-{navRoute}.{parentSectionCode}.{resource1Code}");
+// Repeat for each resource...
+
+/// <summary>
+/// Returns navigation resource entries for a given section.
+/// </summary>
+public static IEnumerable<NavigationResourceSeedEntry> GetResourceEntries(Guid sectionId)
+{
+    var entries = new List<NavigationResourceSeedEntry>();
+
+    // Resources for section: {section1Code}
+    if (sectionId == {Section1Pascal}SectionId)
+    {
+        entries.AddRange(new[]
+        {
+            new NavigationResourceSeedEntry
+            {
+                Id = {Resource1Pascal}ResourceId,
+                SectionId = sectionId,
+                Code = "{resource1Code}",
+                Label = "{resource1_label_en}",
+                EntityType = "{resource1_entity}",
+                Route = "/{contextCode}/{appCode}/{moduleCode}/{section1Code}/{resource1Code}",
+                DisplayOrder = 1
+            }
+            // Repeat for each resource in this section...
+        });
+    }
+    // Repeat if-block for each section with resources...
+
+    return entries;
+}
+```
+
+### Additional DTO Classes (add to bottom of file)
+
+```csharp
+/// <summary>Seed entry DTO for navigation section.</summary>
+public class NavigationSectionSeedEntry
+{
+    public Guid Id { get; init; }
+    public Guid ModuleId { get; init; }
+    public string Code { get; init; } = null!;
+    public string Label { get; init; } = null!;
+    public string Description { get; init; } = null!;
+    public string Icon { get; init; } = null!;
+    public IconType IconType { get; init; }
+    public string Route { get; init; } = null!;
+    public int DisplayOrder { get; init; }
+    public bool IsActive { get; init; }
+}
+
+/// <summary>Seed entry DTO for navigation resource.</summary>
+public class NavigationResourceSeedEntry
+{
+    public Guid Id { get; init; }
+    public Guid SectionId { get; init; }
+    public string Code { get; init; } = null!;
+    public string Label { get; init; } = null!;
+    public string? EntityType { get; init; }
+    public string? Route { get; init; }
+    public int DisplayOrder { get; init; }
+}
+```
+
+### Placeholder Values Source
+
+| Placeholder | Source in feature.json |
+|-------------|----------------------|
+| `{sectionCode}` | `seedDataCore.navigationSections[].code` |
+| `{section_label_xx}` | `specification.navigation.entries[]` where `level == "section"` → `labels.xx` |
+| `{section_icon}` | `seedDataCore.navigationSections[].icon` |
+| `{section_sort}` | `seedDataCore.navigationSections[].sort` |
+| `{section_route}` | `seedDataCore.navigationSections[].route` |
+| `{resourceCode}` | `seedDataCore.navigationResources[].code` |
+| `{resource_entity}` | `seedDataCore.navigationResources[].entity` |
+| `{parentSectionCode}` | `seedDataCore.navigationResources[].parentCode` |
+
+---
+
 ## 3. PermissionsSeedData.cs — MCP-First
 
 ### Step A: Call MCP (PRIMARY)
@@ -542,6 +738,43 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
         }
         // Repeat for each module...
         await ((DbContext)context).SaveChangesAsync(ct);
+
+        // --- Sections (if seedDataCore.navigationSections exists) ---
+        // Module 1 sections
+        foreach (var secEntry in {Module1Pascal}NavigationSeedData.GetSectionEntries(mod1.Id))
+        {
+            var sec = NavigationSection.Create(
+                secEntry.ModuleId, secEntry.Code, secEntry.Label,
+                secEntry.Description, secEntry.Icon, secEntry.IconType,
+                secEntry.Route, secEntry.DisplayOrder);
+            context.NavigationSections.Add(sec);
+        }
+        // Repeat for each module that has sections...
+        await ((DbContext)context).SaveChangesAsync(ct);
+
+        // --- Section translations ---
+        foreach (var t in {Module1Pascal}NavigationSeedData.GetSectionTranslationEntries())
+        {
+            context.NavigationTranslations.Add(
+                NavigationTranslation.Create(t.EntityType, t.EntityId, t.LanguageCode, t.Label, t.Description));
+        }
+        // Repeat for each module that has sections...
+        await ((DbContext)context).SaveChangesAsync(ct);
+
+        // --- Resources (if seedDataCore.navigationResources exists) ---
+        // Module 1 resources (resolved per section)
+        foreach (var secEntry in {Module1Pascal}NavigationSeedData.GetSectionEntries(mod1.Id))
+        {
+            foreach (var resEntry in {Module1Pascal}NavigationSeedData.GetResourceEntries(secEntry.Id))
+            {
+                var res = NavigationResource.Create(
+                    resEntry.SectionId, resEntry.Code, resEntry.Label,
+                    resEntry.EntityType, resEntry.Route, resEntry.DisplayOrder);
+                context.NavigationResources.Add(res);
+            }
+        }
+        // Repeat for each module that has resources...
+        await ((DbContext)context).SaveChangesAsync(ct);
     }
 
     public async Task SeedRolesAsync(ICoreDbContext context, CancellationToken ct)
@@ -648,23 +881,33 @@ When processing multiple modules in the same ralph-loop run:
 ### Module 1 (first): Creates everything from scratch
 
 1. `ApplicationRolesSeedData.cs` (application-level, once per app)
-2. `{Module1}NavigationSeedData.cs`
+2. `{Module1}NavigationSeedData.cs` (module + sections + resources + all translations)
 3. `{Module1}PermissionsSeedData.cs`
 4. `{Module1}RolesSeedData.cs`
-5. `{AppPascalName}SeedDataProvider.cs` (new, with 4 methods)
+5. `{AppPascalName}SeedDataProvider.cs` (new, with 4 methods — including section/resource seeding)
 6. DI registration (new)
 
 ### Module 2+ (subsequent): Append to existing provider
 
 1. `ApplicationRolesSeedData.cs` (already exists — skip)
-2. `{Module2}NavigationSeedData.cs` (new file)
+2. `{Module2}NavigationSeedData.cs` (new file — include sections + resources if defined in feature.json)
 3. `{Module2}PermissionsSeedData.cs` (new file)
 4. `{Module2}RolesSeedData.cs` (new file)
-5. `{AppPascalName}SeedDataProvider.cs` (**modify** — add using, add entries in Navigation/Permissions/RolePermissions methods)
+5. `{AppPascalName}SeedDataProvider.cs` (**modify** — add using, add entries in Navigation/Permissions/RolePermissions methods, **including section/resource seeding for the new module**)
 6. DI registration (already exists — skip)
 
 **Detection:** Check if `{AppPascalName}SeedDataProvider.cs` exists. If yes, READ it and ADD the new module's entries to the appropriate methods (Navigation, Permissions, RolePermissions). Do NOT modify SeedRolesAsync().
 
+### Section/Resource Conditionality
+
+Sections and resources are **optional per module**. When processing a module's feature.json:
+
+| Condition | Action |
+|-----------|--------|
+| `seedDataCore.navigationSections` absent or empty | Skip `GetSectionEntries()` / `GetSectionTranslationEntries()` / section seeding in provider |
+| `seedDataCore.navigationResources` absent or empty | Skip `GetResourceEntries()` / resource seeding in provider |
+| Both present | Generate all section + resource methods and provider code |
+
 ---
 
 ## 8. Verification Checklist (BLOCKING)
@@ -680,11 +923,14 @@ Before marking the task as completed, verify ALL:
 - [ ] MCP `generate_permissions` called (or fallback used)
 - [ ] Role-permission mappings assigned (Admin, Manager, Contributor, Viewer)
 - [ ] `IClientSeedDataProvider` generated with 4 methods (Navigation, Roles, Permissions, RolePermissions)
-- [ ] Execution order: Navigation → Roles → Permissions → RolePermissions
+- [ ] Execution order: Navigation (modules → sections → resources) → Roles → Permissions → RolePermissions
 - [ ] Each Seed method is idempotent (checks existence before inserting)
 - [ ] Factory methods used throughout (NEVER `new Entity()`)
 - [ ] `SaveChangesAsync` called per group (Navigation → Roles → Permissions → RolePermissions)
 - [ ] DI registration added: `services.AddScoped<IClientSeedDataProvider, ...>()`
+- [ ] NavigationSections seeded (if `seedDataCore.navigationSections` present in feature.json)
+- [ ] NavigationResources seeded (if `seedDataCore.navigationResources` present in feature.json)
+- [ ] Section/Resource translations created (4 languages each, EntityType = Section/Resource)
 - [ ] `dotnet build` passes after generation
 
 **If ANY check fails, the task status = 'failed'.**