@atlashub/smartstack-cli 3.36.0 → 3.38.0

package/templates/skills/apex/steps/step-02-plan.md

@@ -52,98 +52,16 @@ IF delegate_mode:
 
 ---
 
-## 1. Map Changes to Layers
-
-For each element identified in step-01 (create or modify), assign to a SmartStack layer:
-
-| Layer | Category | Order |
-|-------|----------|-------|
-| 0 | Domain (entities, enums, exceptions) | Sequential |
-| 0 | Infrastructure - EF Configs | Sequential |
-| 0 | Infrastructure - Migration (BLOCKING) | Sequential |
-| 1 | Application (services, DTOs, validators) | Parallel |
-| 1 | API (controllers) | Parallel |
-| 1 | Infrastructure - Seed Data | Parallel |
-| 2 | Frontend (pages, components) | Parallel |
-| 2 | I18n (translations) | Parallel |
-| 3 | Tests | Sequential |
-
-**Entity Definition Template:** Each entity in the plan MUST include:
-```
-Entity: {EntityName}
-  - tenantMode: strict | optional | scoped | none
-  - codePattern: auto-generated strategy (if applicable)
-  - fkFields: [{field, targetEntity}] (if applicable)
-  - acceptance criteria: [AC1, AC2, ...]
-```
-
-The `tenantMode` decision (from step-01, section 4a) drives EF query filters, seed data approach, and API authorization. See `smartstack-layers.md` for tenant mode seed data strategies.
-
----
-
-## 2. Assign Skill/MCP per File
-
-For EACH file in the plan, specify HOW it will be created/modified:
-
-```markdown
-### Layer 0 — Domain + Infrastructure (sequential)
-
-| # | File | Action | Tool |
-|---|------|--------|------|
-| 1 | Domain/Entities/.../MyEntity.cs | create | MCP scaffold_extension |
-| 2 | Infrastructure/.../MyEntityConfiguration.cs | create | MCP scaffold_extension |
-| 3 | Migration | create | MCP suggest_migration + dotnet ef |
-
-### Layer 1 — Application + API (parallel)
-
-| # | File | Action | Tool |
-|---|------|--------|------|
-| 4 | Application/Services/.../MyService.cs | create | MCP scaffold_extension |
-| 5 | Application/DTOs/.../MyDto.cs | create | MCP scaffold_extension |
-| 6 | Api/Controllers/.../MyController.cs | create | /controller skill |
-| 7 | Seeding/Data/NavigationApplicationSeedData.cs | create | ref smartstack-layers.md (once per app) |
-| 7b | Seeding/Data/ApplicationRolesSeedData.cs | create | ref smartstack-layers.md (once per app) |
-| 7c | Infrastructure/Services/CodeGeneration/ | create | ref code-generation.md (ICodeGenerator<T> + DI, per entity with codePattern != manual) |
-| 8 | Seeding/Data/.../NavigationModuleSeedData.cs | create | ref smartstack-layers.md |
-| 8b | Application/Authorization/Permissions.cs | create | MCP generate_permissions → static constants |
-| 9 | Seeding/Data/.../PermissionsSeedData.cs | create | MCP generate_permissions |
-| 10 | Seeding/Data/.../RolesSeedData.cs | create | ref smartstack-layers.md |
-
-### Layer 2 — Frontend + I18n (parallel)
-
-| # | File | Action | Tool |
-|---|------|--------|------|
-| 11 | src/pages/{Ctx}/{App}/{Mod}/ListPage.tsx | create | /ui-components skill |
-| 11b | src/pages/{Ctx}/{App}/{Mod}/CreatePage.tsx | create | /ui-components skill (EntityLookup for FK fields) |
-| 11c | src/pages/{Ctx}/{App}/{Mod}/EditPage.tsx | create | /ui-components skill (EntityLookup for FK fields) |
-| 11d | src/pages/{Ctx}/{App}/{Mod}/{Section}Page.tsx | create | /ui-components skill (per section in `{sections}`) |
-| 11e | src/pages/{Ctx}/{App}/{Mod}/{Section}DetailPage.tsx | create | /ui-components skill (per section in `{sections}`) |
-| 12 | src/services/api/{module}Api.ts | create | MCP scaffold_api_client |
-| 13 | src/routes/{module}.tsx | create | MCP scaffold_routes |
-| 14 | src/i18n/locales/{lang}/{module}.json | create | ref smartstack-frontend.md (4 languages: fr, en, it, de) |
-
-**FK Field Guidance:** If step-01 identified `fkFields[]`, every Create/Edit page MUST use `EntityLookup` for those fields (see `smartstack-frontend.md` section 6). The corresponding backend GetAll endpoints (Layer 1) MUST support `?search=` parameter.
-
-### Layer 2b — Documentation (after frontend pages exist)
-
-| # | File | Action | Tool |
-|---|------|--------|------|
-| 14b | src/pages/docs/business/{app}/{module}/doc-data.ts | create | /documentation skill |
-| 14c | src/pages/docs/business/{app}/{module}/index.tsx | create | /documentation skill |
-
-### Layer 3 — Tests (sequential)
-
-| # | File | Action | Tool |
-|---|------|--------|------|
-| 15 | tests/.../MyEntityTests.cs | create | MCP scaffold_tests |
-| 16 | tests/.../MyServiceTests.cs | create | MCP scaffold_tests |
-```
-
----
-
-## 3. Identify Parallelization (Agent Teams)
-
-If NOT economy_mode AND Layer 1 has both backend and frontend work:
+## 1-3. Layer Mapping, Skill Assignment, Parallelization
+
+> **Reference:** Load `references/planning-layer-mapping.md` for detailed planning procedures:
+> - Layer assignment matrix (Domain/Infrastructure/Application/API/Seed/Frontend/Tests)
+> - Entity definition template (tenantMode, codePattern, fkFields, ACs)
+> - Skill/MCP assignment table (per file, per layer)
+> - Layer 0/1/2b/3 file lists with tools
+> - FK field guidance (EntityLookup + backend ?search= parameter)
+> - Parallelization strategy (Agent Teams for Layer 1 backend+frontend)
+> - Delegate mode fast path (PRD task mapping to layers)
 
 ```
 Layer 0: SEQUENTIAL (agent principal)

package/templates/skills/apex/steps/step-03-execute.md

@@ -77,11 +77,12 @@ For each entity:
 2. Verify ALL EF configurations are registered (ApplyConfigurationsFromAssembly or individual)
 3. MCP suggest_migration → get standardized name
 4. dotnet ef migrations add {Name} --project src/{Infra}.csproj --startup-project src/{Api}.csproj -o Persistence/Migrations
-5. Cleanup corrupted EF Core artifacts:
-   for d in src/*/bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
+5. Cleanup corrupted EF Core artifacts (WSL Roslyn bug — creates literal `bin\Debug` folder):
+   for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
 6. dotnet ef database update (if local DB)
 7. dotnet build → MUST PASS
 8. Verify: dotnet ef migrations has-pending-model-changes → MUST report "No pending model changes"
+9. Post-build cleanup (WSL recreates artifacts): for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
 ```
 
 **BLOCKING:** If build fails after migration, fix EF configs before proceeding.
@@ -91,6 +92,8 @@ For each entity:
 
 ```bash
 dotnet build
+# Cleanup WSL Roslyn artifacts (literal bin\Debug folders)
+for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
 ```
 
 **MUST PASS before Layer 1. If NuGet error, run `dotnet restore` first. If file lock (MSB3021), use `--output /tmp/{project}_build`.**
@@ -99,111 +102,33 @@ dotnet build
 
 ## Layer 1 — Application + API + Seed Data
 
-### NavRoute and Permission Kebab-Case (CRITICAL)
-
-> **ALL NavRoute segments and permission codes MUST use kebab-case for multi-word identifiers.**
-> Root cause (test-apex-007): Controllers had `[NavRoute("business.humanresources.employees")]`
-> instead of `[NavRoute("business.human-resources.employees")]`. This mismatched seed data routes
-> and permission codes, causing 404s and permission denials at runtime.
-
-**Rules:**
-- NavRoute: `business.human-resources.employees` (NEVER `business.humanresources.employees`)
-- Permissions: `business.human-resources.employees.read` (segments MATCH NavRoute exactly)
-- Seed data codes: `human-resources` (NEVER `humanresources`)
-- C# class names stay PascalCase (`HumanResourcesController`) — only route/permission strings use kebab-case
-- POST-CHECKs 41 + 48 validate this. Fix BEFORE committing.
-
-### Controller Route Attribute (BLOCKING)
-
-> **Controllers with `[NavRoute]` must NOT have `[Route]` attribute.**
-> Root cause (test-apex-007): ALL 7 controllers had BOTH `[Route("api/...")]` AND `[NavRoute("...")]`.
-> In SmartStack, `[NavRoute]` resolves routes dynamically from Navigation entities in the database at startup.
-> Having `[Route]` alongside causes route conflicts → all endpoints return 404.
-
-**Rules:**
-- `[NavRoute("context.app.module")]` is the ONLY route attribute needed on controllers
-- **FORBIDDEN:** `[Route("api/business/human-resources/employees")]` alongside `[NavRoute]`
-- **FORBIDDEN:** `[Route("api/[controller]")]` alongside `[NavRoute]`
-- If generating via MCP `scaffold_extension` with `navRoute` option → output is correct (NavRoute only)
-- If generating via `/controller` skill → verify NO `[Route]` is added
-- POST-CHECK 50 validates this. Fix BEFORE committing.
-
-### Validators DI Registration (CRITICAL)
-
-> After creating validators, they MUST be registered in DI. Without registration, `[FromBody]` DTOs are never validated.
-
-```
-In DependencyInjection.cs (or ServiceCollectionExtensions.cs):
-  services.AddValidatorsFromAssemblyContaining<Create{Entity}DtoValidator>();
-```
-
-POST-CHECK 46 validates this. If validators exist but no DI registration → BLOCKING.
-
-### If economy_mode: Sequential execution
-
-Execute each item from the plan sequentially using skills and MCP.
-
-### Date Fields — Use DateOnly (CRITICAL)
-
-> **ALL date-only fields in DTOs MUST use `DateOnly`, NEVER `string`.**
-> Root cause (test-apex-007): WorkLog DTO had `string Date` instead of `DateOnly Date`.
-> This causes: no date validation, inconsistent date formats, parsing errors.
-
-**Type mapping for DTOs:**
-| Domain type | DTO type | Example |
-|-------------|----------|---------|
-| `DateTime` | `DateTime` | `CreatedAt`, `UpdatedAt` |
-| Date-only field | `DateOnly` | `Date`, `StartDate`, `EndDate`, `BirthDate` |
-| `string` for date | **FORBIDDEN** | Never use `string` for dates |
-| `DateTime` for date-only | **Avoid** | Use `DateOnly` when no time component needed |
-
-POST-CHECK 47 validates this. If a DTO has `string` type for a property named `*Date*` → BLOCKING.
-
-### Code Generation (if entities have codePattern != "manual")
-
-For each entity with auto-generated code pattern (from feature.json or step-02 decisions):
-
-```
-1. Create CodePatternConfig for the entity (strategy, prefix, digits from codePattern)
-2. Register ICodeGenerator<TEntity> in DependencyInjection.cs (Infrastructure layer)
-   → See references/code-generation.md for DI registration pattern
-3. Update CreateDto: REMOVE Code property (auto-generated, not user-provided)
-4. Update CreateDtoValidator: REMOVE Code regex rule (not in DTO anymore)
-5. Update service CreateAsync: inject ICodeGenerator<TEntity>, call NextCodeAsync()
-   → Code is auto-generated BEFORE entity creation
-   → See references/code-generation.md for service integration pattern
-6. Keep Code in ResponseDto (returned to frontend after creation)
-7. Keep Code in UpdateDto ONLY if code is mutable (rare — discuss with user)
-```
-
-**CRITICAL:** If `codePattern.strategy == "manual"` (or no codePattern), keep the current behavior:
-Code stays in CreateDto, user provides it, validator has regex rule.
-
-**For frontend tasks (economy_mode):** Follow the same rules as exec-frontend above:
-- `MCP scaffold_api_client` → API client + types + React Query hook
-- `MCP scaffold_routes` with `outputFormat: 'clientRoutes'` for lazy imports
-- **INVOKE `/ui-components` skill** (read SKILL.md + ALL patterns) — MANDATORY for ALL page types
-- **Create ALL 4 page types per module:**
-  - `ListPage.tsx` — entity list with SmartTable/EntityCard
-  - `DetailPage.tsx` — entity detail view
-  - `EntityCreatePage.tsx` (route: `/create`) — FULL PAGE form, NEVER modal
-  - `EntityEditPage.tsx` (route: `/:id/edit`) — FULL PAGE form, NEVER modal
-- **Wire ALL routes in App.tsx:** `index` (ListPage), `:id` (DetailPage), `create` (CreatePage), `:id/edit` (EditPage)
-- **FK FIELDS (CRITICAL):** Any Guid FK property (e.g., EmployeeId, DepartmentId) MUST use `EntityLookup` component — NEVER a `<select>` dropdown, NEVER a `<input type="text">`. A `<select>` loaded from API state is NOT a substitute for EntityLookup. See `smartstack-frontend.md` section 6.
-- **ZERO modals/popups/drawers for forms — ALL forms are full pages with their own URL**
-- **TABS ON DETAIL PAGES (CRITICAL):** Tabs MUST switch content LOCALLY via `setActiveTab()` — NEVER `navigate()` to another page. Sub-resource data (e.g., employee's leaves) loads inline via API call filtered by parent entity ID. See `smartstack-frontend.md` section 3 "Tab Behavior Rules".
-- **Form tests: Generate `EntityCreatePage.test.tsx` and `EntityEditPage.test.tsx` (co-located)**
-- **SECTION PERMISSIONS:** After calling `MCP generate_permissions` for the module navRoute (3 segments: `{context}.{app}.{module}`), also call it for EACH section navRoute (4 segments: `{context}.{app}.{module}.{section}`)
-- **SECTION ROUTES:** After generating module routes, add section child routes to the module's `children` array. Wire `PermissionGuard` for section routes with section-level permissions.
-- **SUB-RESOURCE COMPLETENESS:** If a section controller has sub-resource endpoints (e.g., `[HttpGet("types")]` for LeaveTypes inside LeavesController), you MUST EITHER:
-  - Create dedicated frontend pages for the sub-resource (ListPage, CreatePage, EditPage) with routes wired in App.tsx, OR
-  - NOT include any `navigate()` button that links to those sub-resource pages
-  - **Prefer separate controllers** with `[NavRoute(..., Suffix = "types")]` — see `smartstack-api.md` Sub-Resource Pattern
-  - A dead link (navigate to a route with no page) is a BLOCKING issue (POST-CHECK 42)
-- Read `references/smartstack-frontend.md` for mandatory patterns (sections 3b + 8)
-- Generate i18n JSON files for all 4 languages (fr, en, it, de) — `src/i18n/locales/{lang}/{module}.json`
-- **I18n REGISTRATION (CRITICAL):** After creating i18n JSON files, register EACH new namespace in the i18n config file (config.ts/index.ts/i18n.ts). Unregistered namespaces → `useTranslation(['module'])` returns empty strings at runtime. POST-CHECK 45 validates this.
-- All pages must follow loading → error → content pattern with CSS variables
+> **Reference:** Load `references/execution-layer1-rules.md` for critical Layer 1 rules:
+> - NavRoute and permission kebab-case (POST-CHECKs 41 + 48)
+> - Controller route attributes (POST-CHECK 50)
+> - Validators DI registration (POST-CHECK 46)
+> - DateOnly vs string (POST-CHECK 47)
+> - Code generation patterns (ICodeGenerator<T> registration)
+
+### Backend Tasks (sequential or parallel)
+
+- **Services/DTOs:** MCP scaffold_extension
+- **Controllers:** use /controller skill for complex, MCP scaffold_extension for simple
+- **IMPORTANT:** ALL GetAll endpoints MUST support `?search=` query parameter (enables EntityLookup on frontend)
+- **Seed data:** MCP generate_permissions, then follow smartstack-layers.md templates
+
+### Frontend Tasks (sequential or parallel)
+
+> **Reference:** Load `references/execution-frontend-patterns.md` for complete frontend patterns:
+> - API client generation (MCP scaffold_api_client)
+> - Route scaffolding (MCP scaffold_routes)
+> - Page types (ListPage, DetailPage, CreatePage, EditPage)
+> - FK field handling (EntityLookup component)
+> - Form structure (ZERO modals — all full pages)
+> - Detail page tabs (local state only)
+> - Testing patterns (co-located form tests)
+> - Section-level routes and permissions
+> - Sub-resource handling
+> - I18n JSON structure and registration (POST-CHECK 45)
 
 ### If NOT economy_mode: Agent Teams (parallel)
 
@@ -266,15 +191,15 @@ Spawn 2 teammates (Opus, full tools):
       → EntityEditPage.test.tsx (co-located next to page)
       → Cover: rendering, validation, submit, pre-fill, navigation, errors
       → See smartstack-frontend.md section 8 for test templates
-    - **SECTION PERMISSIONS:** After MCP generate_permissions for the module navRoute (3 segments),
-      also call MCP generate_permissions for EACH section navRoute (4 segments: {context}.{app}.{module}.{section})
+    - **SECTION PERMISSIONS:** After MCP generate_permissions for the module navRoute (2 segments),
+      also call MCP generate_permissions for EACH section navRoute (3 segments: {app}.{module}.{section})
     - **SECTION ROUTES:** Add section child routes to the module's children array.
       Wire PermissionGuard for section routes with section-level permissions.
     - I18n: Generate 4 JSON files per module namespace (fr, en, it, de)
       → Follow JSON template from smartstack-frontend.md
       → Keys: actions, labels, errors, validation, columns, form, messages, empty
       → ALL t() calls MUST use namespace prefix + fallback: t('ns:key', 'Default text')
-    - MUST use src/pages/{Context}/{App}/{Module}/ hierarchy (NOT flat)
+    - MUST use src/pages/{App}/{Module}/ hierarchy (NOT flat)
 
     After ALL tasks done:
     SendMessage(type:'message', recipient:'team-lead', content:'FRONTEND_COMPLETE', summary:'Frontend layer done')"
@@ -295,7 +220,7 @@ shutdown_request → shutdown_response → TeamDelete("apex-exec")
 | Skill | When | Context to provide |
 |-------|------|--------------------|
 | /controller | Custom routes, complex auth, file upload | entity, CRUD actions, permissions, routes |
-| /application | Full context/app/module from scratch | context, app, module names |
+| /application | Full app/module from scratch | app, module names |
 | /ui-components | Complex pages (tables, grids, dashboards) | entity, fields, page type |
 | /efcore | Complex EF configs, inheritance | relationships, indexes |
 | /notification | In-app or email notifications | trigger, recipients, template |
@@ -339,6 +264,7 @@ After Layer 1 completes:
 
 2. Build gate:
    dotnet build → MUST PASS
+   for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
    npm run typecheck → MUST PASS (if frontend)
 ```
 
@@ -346,146 +272,18 @@ After Layer 1 completes:
 
 ## FRONTEND COMPLIANCE GATE (MANDATORY before commit)
 
-> **BLOCKING:** Do NOT commit frontend changes until ALL checks pass.
-> These issues are the most common failures in generated code — verify EVERY item.
-
-**Run these checks on ALL generated/modified `.tsx` files BEFORE creating the frontend commit:**
-
-### Gate 1: CSS Variables (Theme System)
-
-```bash
-# Check for hardcoded Tailwind colors — MUST use CSS variables
-ALL_PAGES=$(find src/pages/ src/components/ -name "*.tsx" 2>/dev/null | grep -v node_modules | grep -v "\.test\.")
-if [ -n "$ALL_PAGES" ]; then
-  HARDCODED=$(grep -Pn '(bg|text|border)-(?!\[)(red|blue|green|gray|white|black|slate|zinc|neutral|stone)-' $ALL_PAGES 2>/dev/null)
-  if [ -n "$HARDCODED" ]; then
-    echo "FAIL: Hardcoded Tailwind colors found — must use CSS variables"
-    echo "$HARDCODED"
-  else
-    echo "PASS: CSS variables"
-  fi
-fi
-```
-
-**If hardcoded colors found, replace BEFORE committing:**
-- `bg-white` → `bg-[var(--bg-card)]`
-- `bg-gray-50` → `bg-[var(--bg-primary)]`
-- `text-gray-900` → `text-[var(--text-primary)]`
-- `text-gray-500/600` → `text-[var(--text-secondary)]`
-- `border-gray-200` → `border-[var(--border-color)]`
-- `bg-blue-600` / `text-blue-600` → `bg-[var(--color-accent-500)]` / `text-[var(--color-accent-500)]`
-- `hover:bg-blue-700` → `hover:bg-[var(--color-accent-600)]`
-- `text-red-500` → `text-[var(--error-text)]`
-- `bg-green-500` → `bg-[var(--success-bg)]`
-
-### Gate 2: Forms as Pages (ZERO Modals/Drawers/Slide-overs)
-
-```bash
-# Check for modal/dialog/drawer/slide-over imports and inline form patterns — FORBIDDEN
-PAGE_FILES=$(find src/pages/ -name "*.tsx" 2>/dev/null)
-if [ -n "$PAGE_FILES" ]; then
-  FAIL=false
-
-  # 2a. Component imports
-  MODAL_IMPORTS=$(grep -Pn "import.*(?:Modal|Dialog|Drawer|Popup|Sheet|SlideOver|Overlay)" $PAGE_FILES 2>/dev/null)
-  if [ -n "$MODAL_IMPORTS" ]; then
-    echo "FAIL: Modal/Dialog/Drawer component imports — forms MUST be full pages"
-    echo "$MODAL_IMPORTS"
-    FAIL=true
-  fi
-
-  # 2b. State variables for inline forms (catches drawers/slide-overs without imports)
-  MODAL_STATE=$(grep -Pn "useState.*(?:isOpen|showModal|showDialog|showCreate|showEdit|showForm|isCreating|isEditing|showDrawer|showPanel|showSlideOver|selectedEntity|editingEntity)" $PAGE_FILES 2>/dev/null)
-  if [ -n "$MODAL_STATE" ]; then
-    echo "FAIL: Inline form state detected — forms MUST be separate page components with own routes"
-    echo "$MODAL_STATE"
-    FAIL=true
-  fi
-
-  if [ "$FAIL" = true ]; then
-    echo ""
-    echo "Fix: Create EntityCreatePage.tsx (route: /create) and EntityEditPage.tsx (route: /:id/edit)"
-    echo "See smartstack-frontend.md section 3b"
-  else
-    echo "PASS: No modals/drawers"
-  fi
-fi
-```
-
-**If modals/drawers found:** Replace with separate `EntityCreatePage.tsx` (route: `/{module}/create`) and `EntityEditPage.tsx` (route: `/{module}/:id/edit`). See `smartstack-frontend.md` section 3b.
-
-### Gate 3: I18n File Structure
-
-```bash
-# Verify translation files exist as separate JSON per language
-if [ ! -d "src/i18n/locales" ]; then
-  echo "FAIL: Missing src/i18n/locales/ directory — create it with 4 languages"
-else
-  for LANG in fr en it de; do
-    JSON_FILES=$(find "src/i18n/locales/$LANG" -name "*.json" 2>/dev/null | wc -l)
-    if [ "$JSON_FILES" -eq 0 ]; then
-      echo "FAIL: No JSON files in src/i18n/locales/$LANG/"
-    else
-      echo "PASS: $LANG ($JSON_FILES files)"
-    fi
-  done
-fi
-```
-
-**If i18n structure wrong:** Create `src/i18n/locales/{fr,en,it,de}/{module}.json` following the template in `smartstack-frontend.md` section 2. NEVER embed translations in a single `.ts` file.
-
-### Gate 4: Lazy Loading
-
-```bash
-# Check for static page imports in route/App files
-APP_TSX=$(find src/ -name "App.tsx" -not -path "*/node_modules/*" 2>/dev/null | head -1)
-ROUTE_FILES=$(find src/routes/ -name "*.tsx" -o -name "*.ts" 2>/dev/null)
-if [ -n "$APP_TSX" ]; then
-  STATIC_IMPORTS=$(grep -Pn "^import .+ from '@/pages/" "$APP_TSX" $ROUTE_FILES 2>/dev/null)
-  if [ -n "$STATIC_IMPORTS" ]; then
-    echo "FAIL: Static page imports in App.tsx/routes — MUST use React.lazy()"
-    echo "$STATIC_IMPORTS"
-  else
-    echo "PASS: Lazy loading"
-  fi
-fi
-```
-
-### Gate 5: useTranslation in Pages
-
-```bash
-# Verify pages use i18n
-PAGE_FILES=$(find src/pages/ -name "*.tsx" 2>/dev/null | grep -v "\.test\." | grep -v node_modules)
-if [ -n "$PAGE_FILES" ]; then
-  TOTAL=$(echo "$PAGE_FILES" | wc -l)
-  WITH_I18N=$(grep -l "useTranslation" $PAGE_FILES 2>/dev/null | wc -l)
-  if [ "$WITH_I18N" -eq 0 ]; then
-    echo "FAIL: No pages use useTranslation — all text must be translated"
-  else
-    echo "PASS: $WITH_I18N/$TOTAL pages use useTranslation"
-  fi
-fi
-```
-
-> **ALL 5 gates MUST pass before creating the frontend commit.** If ANY gate fails, fix the issues first.
-
-### Explicit I18n File Creation
-
-When creating i18n files, generate EXACTLY this structure:
-
-```
-src/i18n/locales/
-├── fr/{module}.json    ← French (primary)
-├── en/{module}.json    ← English
-├── it/{module}.json    ← Italian
-└── de/{module}.json    ← German
-```
+> **Reference:** Load `references/execution-frontend-gates.md` for all 5 mandatory checks:
+> 1. CSS Variables (theme system) — POST-CHECK 13
+> 2. Forms as Pages (ZERO modals/drawers/slide-overs)
+> 3. I18n File Structure (4 languages, separate JSON files)
+> 4. Lazy Loading (React.lazy() — no static imports)
+> 5. useTranslation in Pages (all text translated)
 
-Each file MUST contain these keys: `title`, `description`, `actions`, `labels`, `columns`, `form`, `errors`, `validation`, `messages`, `empty`. See `smartstack-frontend.md` section 2 for the complete JSON template.
+**BLOCKING:** Do NOT commit frontend changes until ALL 5 gates pass.
 
-**When delegating to `/ui-components`:** ALWAYS include these explicit instructions in the delegation context:
-- "CSS: Use CSS variables ONLY — `bg-[var(--bg-card)]`, `text-[var(--text-primary)]`. NEVER use hardcoded Tailwind colors like `bg-white` or `text-gray-900`."
-- "Forms: Create/Edit forms are FULL PAGES with own routes (e.g., `/create`, `/:id/edit`). NEVER use modals/dialogs."
+When delegating to `/ui-components` skill, include explicit instructions:
+- "CSS: Use CSS variables ONLY — `bg-[var(--bg-card)]`, `text-[var(--text-primary)]`."
+- "Forms: Create/Edit forms are FULL PAGES with own routes (e.g., `/create`, `/:id/edit`)."
 - "I18n: ALL text must use `t('namespace:key', 'Fallback')`. Generate JSON files in `src/i18n/locales/`."
 
 ---

package/templates/skills/apex/steps/step-04-examine.md

@@ -130,83 +130,14 @@ fi
 
 ---
 
-## 4. Build Verification
+## 4-5. Build & Migration Validation
 
-```bash
-# Cleanup corrupted EF Core design-time artifacts (Roslyn BuildHost bug on Windows)
-for d in src/*/bin?Debug; do [ -d "$d" ] && echo "Removing corrupted artifact: $d" && rm -rf "$d"; done
-
-# Backend
-dotnet clean && dotnet restore && dotnet build
-
-# Frontend (if applicable)
-npm run typecheck
-```
-
-**BLOCKING:** Both must pass. If failure, classify error per `references/error-classification.md` before attempting fix:
-- Category A (missing package) → `dotnet add package` → rebuild
-- Category B (assembly conflict) → resolve version → rebuild
-- Category C (DI missing) → fix DI registration → rebuild
-- Category D (migration broken) → fix migration → rebuild
-- Category E (config) → fix config → rebuild
-- Category F (source code) → fix code → rebuild
-
----
-
-## 5. Database & Migration Validation (if needs_migration)
-
-### 5a. Pending Model Changes Check
-
-```bash
-INFRA_PROJECT=$(ls src/*Infrastructure*/*.csproj 2>/dev/null | head -1)
-API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
-
-dotnet ef migrations has-pending-model-changes \
-  --project "$INFRA_PROJECT" \
-  --startup-project "$API_PROJECT"
-```
-
-**BLOCKING** if pending changes detected → migration is missing.
-
-### 5b. Migration Application Test (SQL Server LocalDB)
-
-```bash
-DB_NAME="SmartStack_Apex_Examine_$(date +%s)"
-CONN_STRING="Server=(localdb)\\MSSQLLocalDB;Database=$DB_NAME;Integrated Security=true;TrustServerCertificate=true;Connect Timeout=120;"
-
-dotnet ef database update \
-  --connection "$CONN_STRING" \
-  --project "$INFRA_PROJECT" \
-  --startup-project "$API_PROJECT"
-```
-
-**BLOCKING** if migration fails on SQL Server. Common issues:
-- SQLite-only syntax in migrations (fix: regenerate migration)
-- Column type mismatches (fix: update EF configuration)
-- Missing foreign key targets (fix: reorder migrations)
-
-### 5c. Integration Tests on Real SQL Server
-
-```bash
-# Integration tests use DatabaseFixture → real SQL Server LocalDB
-# This validates: LINQ→SQL, multi-tenant isolation, soft delete, EF configs
-INT_TEST_PROJECT=$(ls tests/*Tests.Integration*/*.csproj 2>/dev/null | head -1)
-if [ -n "$INT_TEST_PROJECT" ]; then
-  dotnet test "$INT_TEST_PROJECT" --no-build --verbosity normal
-fi
-```
-
-Tests running against SQL Server catch issues that SQLite misses:
-- Case sensitivity in string comparisons
-- Date/time function differences
-- IDENTITY vs AUTOINCREMENT behavior
-- Global query filter translation to T-SQL
-
-### 5d. Cleanup
-
-```bash
-sqlcmd -S "(localdb)\MSSQLLocalDB" -Q "IF DB_ID('$DB_NAME') IS NOT NULL BEGIN ALTER DATABASE [$DB_NAME] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [$DB_NAME]; END" 2>/dev/null
-```
+> **Reference:** Load `references/examine-build-validation.md` for detailed procedures:
+> - Build verification (dotnet clean → restore → build + npm typecheck)
+> - Error classification (categories A-F per error-classification.md)
+> - Migration validation (pending changes, SQL Server apply, cleanup)
+> - Integration tests (real SQL Server LocalDB)
+> - Test database management
 
 ---
 
@@ -216,7 +147,9 @@ sqlcmd -S "(localdb)\MSSQLLocalDB" -Q "IF DB_ID('$DB_NAME') IS NOT NULL BEGIN AL
 |------|--------|
 | NavigationApplicationSeedData | MUST be first, deterministic GUID for application (NOT for context — context is looked up by code), 4 lang translations |
 | ApplicationRolesSeedData | 4 roles (admin, manager, contributor, viewer), deterministic GUIDs, references NavigationApplicationSeedData.ApplicationId |
-| NavigationModuleSeedData | Deterministic GUIDs (SHA256), 4 languages, GetModuleEntry + GetTranslationEntries |
+| NavigationModuleSeedData | Deterministic GUIDs (SHA256), 4 languages (fr, en, it, de), GetModuleEntry + GetTranslationEntries |
+| ↳ Section methods (same file) | (conditional: if sections exist) GetSectionEntries + GetSectionTranslationEntries, 4 languages, deterministic GUIDs, query actual module from DB for FK |
+| ↳ Resource methods (same file) | (conditional: if resources exist) GetResourceEntries + resource translations, 4 languages, deterministic GUIDs, query actual section from DB for FK |
 | Permissions.cs | Static constants class with `public static class {Module} { Read, Create, Update, Delete }`, paths match PermissionsSeedData |
 | PermissionsSeedData | MCP generate_permissions used, paths match Permissions.cs, wildcard + CRUD |
 | RolesSeedData | Admin=wildcard(*), Manager=CRU, Contributor=CR, Viewer=R. Role-permission entries reference permission paths from PermissionsSeedData |
@@ -268,7 +201,10 @@ AC2: {criterion} → PASS / FAIL (evidence: {file:line or test})
 | I18n registration | Namespaces registered in i18n config (POST-CHECK 45) | PASS / N/A |
 | Validators DI | FluentValidation registered in DI (POST-CHECK 46) | PASS / N/A |
 | Route/NavRoute conflict | No [Route] alongside [NavRoute] on controllers (POST-CHECK 50) | PASS / N/A |
-| POST-CHECKs | 50 checks from references/post-checks.md | PASS / N/A |
+| Role-permission matrix | Admin=wildcard, Manager=CRU, Contributor=CR, Viewer=R (POST-CHECK 51) | PASS / N/A |
+| PermissionAction enum | No Enum.Parse, only typed enum values 0-10 (POST-CHECK 52) | PASS / N/A |
+| Navigation translations | 4 langs per level, section/resource translations present (POST-CHECK 53) | PASS / N/A |
+| POST-CHECKs | 53 checks from references/post-checks.md | PASS / N/A |
 | Acceptance criteria | AC1..ACn | {X}/{Y} PASS |
 ```
 

package/templates/skills/apex/steps/step-05-deep-review.md

@@ -51,14 +51,14 @@ For each changed file, check:
 - [ ] Services follow CQRS pattern
 - [ ] DTOs separate from domain entities
 - [ ] Controllers return DTOs, not entities
-- [ ] Frontend in correct hierarchy (Context/App/Module)
+- [ ] Frontend in correct hierarchy (App/Module)
 
 **SmartStack conventions:**
 - [ ] Deterministic GUIDs in seed data (not Guid.NewGuid())
 - [ ] 4 languages in translations
 - [ ] CSS variables (not hardcoded colors)
 - [ ] SmartTable/SmartForm (not raw HTML tables/forms)
-- [ ] Correct Layout wrapper per context
+- [ ] Correct Layout wrapper per application
 
 **FK Fields & Forms:**
 - [ ] FK Guid fields use `EntityLookup` component (NEVER `<input>`, NEVER `<select>`)

package/templates/skills/apex/steps/step-08-run-tests.md

@@ -17,6 +17,8 @@ next_step: COMPLETE
 
 ```bash
 dotnet build --no-restore
+# Cleanup WSL Roslyn artifacts (literal bin\Debug folders)
+for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
 ```
 
 **MUST PASS before running tests.**