@atlashub/smartstack-cli 3.37.0 → 3.38.0

package/templates/skills/ai-prompt/steps/step-00-init.md

@@ -0,0 +1,47 @@
+# Step 0: Initialization
+
+## YOUR TASK
+Gather context about the AI integration requirements before implementation.
+
+## EXECUTION SEQUENCE
+
+### 1. Identify AI Use Case
+- What type of AI integration? (prompt execution, chat, content generation, validation, analysis)
+- What model/provider should be used? (Claude, GPT-4, GPT-4o, Gemini, local model)
+- What is the input schema? (user query, structured data, multiple parameters)
+- What is the expected output? (text, JSON, structured object, classification)
+
+### 2. Check Existing Patterns
+- Search existing `Application/Common/Interfaces/IAiCompletionService` usage
+- Identify reusable patterns: AiProviderInstance configuration, OutputSchema definitions
+- Check for existing Prompt entities with similar use cases
+- Review error handling patterns for API failures and quota limits
+
+### 3. Plan Implementation
+- Determine required files:
+  - Prompt entity and PromptBlock creation
+  - OutputSchema if structured response needed
+  - Service integration with IAiCompletionService
+  - Frontend API client and React hook
+- Identify dependencies:
+  - Which AI provider instance to use? (API keys, budget limits)
+  - Token budget and cost implications
+  - Error handling strategy (fallback provider, graceful degradation)
+- Map variables and placeholders for dynamic content
+
+### 4. Define Success Criteria
+- Prompt executes with correct model and parameters
+- Response validates against OutputSchema (if applicable)
+- Token usage logged and budget respected
+- Error handling covers API downtime and quota exhaustion
+- Frontend integrates with loading/error states
+
+## SUCCESS METRICS
+- AI use case clearly identified and documented
+- Implementation plan with all required files listed
+- Dependencies identified (provider instance, budget, error handling)
+- Decision on structured vs. unstructured response
+- Token budget and cost reviewed
+
+## NEXT STEP
+Proceed to `./step-01-implementation.md` to implement the Prompt, OutputSchema, Service integration, and Frontend components.

package/templates/skills/apex/SKILL.md

@@ -11,7 +11,7 @@ argument-hint: "[-a] [-x] [-s] [-e] [-r] [-pr] <task description>"
 ---
 
 <objective>
-Execute incremental SmartStack development using the APEX methodology. This skill knows the SmartStack hierarchy (context/application/module/section/resource), delegates code creation to existing skills (/controller, /application, /ui-components, /efcore, /notification, /workflow) and MCP tools, and validates via MCP conventions.
+Execute incremental SmartStack development using the APEX methodology. This skill knows the SmartStack hierarchy (application/module/section/resource), delegates code creation to existing skills (/controller, /application, /ui-components, /efcore, /notification, /workflow) and MCP tools, and validates via MCP conventions.
 
 **Key principle:** /apex ORCHESTRATES — it never generates SmartStack code directly. All generation goes through skills and MCP tools.
 </objective>
@@ -57,7 +57,6 @@ Execute incremental SmartStack development using the APEX methodology. This skil
 | `{delegate_mode}` | boolean | Delegated by `/ralph-loop` via `-d` flag |
 | `{delegate_prd_path}` | string? | Path to PRD file (`.ralph/prd.json` or `.ralph/prd-{module}.json`) |
 | `{foundation_mode}` | boolean | Foundation mode: entities-only (no services/controllers/frontend). Used by ralph-loop Phase 0. |
-| `{context_code}` | string | "business", "platform", "personal" |
 | `{app_name}` | string | Application name |
 | `{module_code}` | string | Module code |
 | `{sections}` | object[] | Sections (MANDATORY, min 1) with code/labels/icon/displayOrder |
@@ -84,7 +83,7 @@ Execute incremental SmartStack development using the APEX methodology. This skil
 
 | Step | File | Model | Purpose |
 |------|------|-------|---------|
-| 00 | `steps/step-00-init.md` | Sonnet | Parse flags, detect context, verify MCP, define hierarchy (5 levels), challenge need |
+| 00 | `steps/step-00-init.md` | Sonnet | Parse flags, detect application, verify MCP, define hierarchy (4 levels), challenge need |
 | 01 | `steps/step-01-analyze.md` | Opus | Explore existing code (Agent Teams or direct) |
 | 02 | `steps/step-02-plan.md` | Opus | Layer-by-layer plan with skill/MCP mapping |
 | 03 | `steps/step-03-execute.md` | Opus | Orchestrate execution via skills and MCP |
@@ -158,7 +157,7 @@ Execute incremental SmartStack development using the APEX methodology. This skil
 </error_handling>
 
 <success_criteria>
-- SmartStack context detected (context/app/module)
+- SmartStack hierarchy detected (app/module)
 - Plan validated with skill/MCP mapped for each file
 - Code created/corrected via existing skills and MCP (no direct generation)
 - MCP validate_conventions: 0 errors

package/templates/skills/apex/_shared.md

@@ -13,15 +13,6 @@
 3. `.ralph/prd-*.json` → PRDs exist
 4. `src/pages/` → React frontend exists
 
-### Context-to-Folder Mapping
-
-| Context | Backend | Controller | Frontend Layout |
-|---------|---------|------------|----------------|
-| `business` | `Business` | `Business` | `BusinessLayout` |
-| `platform.administration` | `Platform/Administration` | `Admin` | `AdminLayout` |
-| `platform.support` | `Platform/Support` | `Support` | `AdminLayout` |
-| `personal` | `Personal` | `User` | `UserLayout` |
-
 ---
 
 ## Delegate Mode Context
@@ -32,7 +23,6 @@ When `/ralph-loop` invokes `/apex -d {prd_path}`:
 
 1. **Read PRD** from `{delegate_prd_path}` (`.ralph/prd.json` or `.ralph/prd-{module}.json`)
 2. **Extract context:**
-   - `context_code` = `prd.project.context` (e.g., "business")
    - `app_name` = `prd.project.application` (e.g., "HumanResources")
    - `module_code` = `prd.project.module` (e.g., "EmployeeManagement")
    - `sections` = from `_seedDataMeta.coreSeedData.navigationSections` in infrastructure tasks
@@ -72,23 +62,23 @@ Write back to {delegate_prd_path}
 
 | Level | Permission format | Segments |
 |-------|------------------|----------|
-| Module | `{context}.{app}.{module}.{action}` | 3+1 segments |
-| Section | `{context}.{app}.{module}.{section}.{action}` | 4+1 segments |
-| Resource | `{context}.{app}.{module}.{section}.{resource}.{action}` | 5+1 segments |
+| Module | `{app}.{module}.{action}` | 2+1 segments |
+| Section | `{app}.{module}.{section}.{action}` | 3+1 segments |
+| Resource | `{app}.{module}.{section}.{resource}.{action}` | 4+1 segments |
 
 **Examples:**
-- Module: `business.human-resources.employees.read` (3+1)
-- Section: `business.human-resources.employees.departments.read` (4+1)
-- Resource: `business.human-resources.employees.departments.export.execute` (5+1)
+- Module: `human-resources.employees.read` (2+1)
+- Section: `human-resources.employees.departments.read` (3+1)
+- Resource: `human-resources.employees.departments.export.execute` (4+1)
 
 > **CRITICAL — Permission codes use the SAME kebab-case segments as NavRoute codes.**
 > Every dot-separated segment in a permission path is a navigation entity code.
 > Multi-word codes MUST be kebab-case: `human-resources`, NOT `humanresources`.
 >
-> SmartStack.app reference: `business.support-client.my-tickets.read`, `platform.administration.email-templates.read`
+> SmartStack.app reference: `support-client.my-tickets.read`, `administration.email-templates.read`
 >
-> **FORBIDDEN:** `business.humanresources.employees.read` (concatenated — no kebab-case)
-> **CORRECT:** `business.human-resources.employees.read` (kebab-case — matches NavRoute)
+> **FORBIDDEN:** `humanresources.employees.read` (concatenated — no kebab-case)
+> **CORRECT:** `human-resources.employees.read` (kebab-case — matches NavRoute)
 
 ### Generation (step-03)
 
@@ -144,7 +134,7 @@ Write back to {delegate_prd_path}
 | Skill | When to delegate |
 |-------|-----------------|
 | `/controller` | Complex controller with custom routes |
-| `/application` | New context/application/module structure |
+| `/application` | New application/module structure |
 | `/ui-components` | Complex React pages (tables, grids, dashboards) |
 | `/efcore` | Complex EF Core configurations |
 | `/notification` | In-app or email notifications |

package/templates/skills/apex/references/analysis-methods.md

@@ -0,0 +1,141 @@
+# Analysis Methods — FK Detection, Tenant Modes, Code Patterns, Gap Analysis
+
+> **Loaded by:** step-01-analyze.md (sections 4-7)
+> **Purpose:** Detailed methods for analyzing existing code and planning entity-level requirements.
+
+---
+
+## FK Field Detection
+
+For each entity found (or to be created), identify FK relationships:
+- Properties ending in "Id" with matching navigation property
+- Record: `{ entity, fkProperty, targetEntity, isRequired }`
+
+**Why:** FK fields drive two critical requirements:
+1. **Frontend:** Each FK field MUST use `<EntityLookup />` (NEVER `<input>`, NEVER `<select>`)
+2. **Backend:** Each target entity's GetAll MUST support `?search=` parameter + return `PaginatedResult<T>`
+
+See `references/execution-frontend-patterns.md` for EntityLookup patterns.
+
+---
+
+## Tenant Mode Decision
+
+For each entity found (or to be created), determine the `tenantMode`:
+
+| Mode | Meaning | Examples | EF Filter |
+|------|---------|----------|-----------|
+| `strict` | Data belongs to one tenant | Employee, Order, Invoice | `TenantId == current` |
+| `optional` | Can be shared or tenant-specific | Department, Currency, JobTitle | `TenantId == current OR TenantId == null` |
+| `scoped` | Explicit scope rules | Settings, Workflow, EmailTemplate | `TenantId == current AND Scope == current` |
+| `none` | Platform-wide (never filtered) | Navigation, Permission, User | No TenantId |
+
+**Why:** Tenant mode drives EF query filters, seed data generation, and API access control.
+
+**Reference:** See `references/smartstack-api.md` for TenantId handling patterns and `smartstack-layers.md` for seed data strategies per tenant mode.
+
+---
+
+## Code Pattern Detection
+
+For each entity found (or to be created), identify code generation needs:
+
+```
+IF feature.json exists AND entity has codePattern:
+  → Use codePattern config from feature.json (strategy, prefix, digits, etc.)
+  → Record in analysis: entity has auto-generated code
+
+ELSE IF feature.json exists BUT entity has NO codePattern:
+  → Record: entity needs codePattern decision in step-02
+  → Apply heuristic default based on entity name:
+    Invoice/Order/Receipt → timestamp-daily
+    Ticket/Incident → timestamp-minute
+    Contract/Policy → year-sequential
+    Reference/Category → uuid-short
+    Employee/Customer/Project → sequential
+
+ELSE (no feature.json):
+  → Propose codePattern during step-02 planning based on task description
+```
+
+**Why:** Code generation strategy drives CreateDto structure, service injection (ICodeGenerator<T>), and DI registration.
+
+**Reference:** See `references/code-generation.md` for strategy table, volume-to-digits calculation, and backend patterns.
+
+---
+
+## Gap Analysis
+
+Compare what EXISTS vs what the TASK REQUIRES:
+
+```
+For each element: EXISTS+COMPLETE → "skip" | EXISTS+INCOMPLETE → "modify" | MISSING → "create"
+```
+
+Cross-reference with step-00 challenge responses:
+- Each entity: entity, EF config, service, controller, frontend pages → exists/missing
+- Each section: NavigationSectionSeedData, frontend route → exists/missing
+- If dependencies: verify FK target entities and their `?search=` support
+
+---
+
+## Scope Re-Check (after exploration)
+
+**Re-validate scope after code exploration reveals the true entity count.**
+Step-00 guard uses the user's description (may undercount). Now we know the actual entities.
+
+```
+IF NOT delegate_mode:
+  actual_entities = count of entities marked "create" in gap analysis
+  actual_sections = count of sections marked "create"
+
+  IF actual_entities > 6:
+    WARNING: "Code exploration reveals {actual_entities} entities.
+     This exceeds the recommended maximum (4) for a single /apex invocation.
+     Risk: incomplete migrations, lost conventions, missing pages.
+     Consider: split into {ceil(actual_entities/4)} iterations of ~4 entities each."
+
+    Ask user to confirm or re-scope.
+```
+
+---
+
+## Analysis Validation — User Checkpoint
+
+**Objective:** Present findings and validate scope BEFORE planning.
+
+### Present Findings
+
+```
+ANALYSIS FINDINGS
+═══════════════════════════════════════════════════════════════
+
+Entities expected / found / to create: {summary}
+Sections expected / found / to create: {summary}
+FK Relationships: {fkFields summary}
+Dependencies: {cross-module refs or "none"}
+Complexity: {module_complexity}
+```
+
+### Validate with User (if NOT auto_mode)
+
+Question template (same as step-01 section 6b):
+- "Scope is correct" (Recommended)
+- "Add elements" → update entities/sections, re-run gap analysis
+- "Reduce scope" → update accordingly
+- "Change approach" → potentially restart from step-00
+
+---
+
+## Analysis Summary Output
+
+```
+**APEX SmartStack - Analysis Complete**
+
+Navigation: {app_name} → {module_code} → {sections[].code}
+Entities: {entity_name → create | modify | skip}
+Existing: entities, configs, services, controllers, pages, seed data, tests (with paths)
+Required: create / modify / skip lists
+Profile: complexity, dependencies, FK fields, workflow, notifications
+ACs: AC1..ACn (inferred from PRD/feature/task/challenge)
+```

package/templates/skills/apex/references/challenge-questions.md

@@ -5,26 +5,6 @@
 
 ---
 
-## Context Detection (section 2)
-
-If hierarchy cannot be inferred, ask the user:
-
-```yaml
-questions:
-  - header: "Context"
-    question: "What is the SmartStack context for this work?"
-    options:
-      - label: "Business (Recommended)"
-        description: "Business application module"
-      - label: "Platform"
-        description: "Platform administration or support"
-      - label: "Personal"
-        description: "Personal user space"
-    multiSelect: false
-```
-
----
-
 ## 4a. Application Validation
 
 If `{app_name}` was NOT clearly inferred from the task description:
@@ -37,7 +17,7 @@ questions:
       - label: "<best guess from task> (Recommended)"
         description: "Inferred from your task description"
       - label: "New application"
-        description: "Create a new application in the {context_code} context"
+        description: "Create a new application"
       - label: "Existing application"
         description: "Add to an existing application (specify in Other)"
     multiSelect: false

package/templates/skills/apex/references/core-seed-data.md

@@ -26,15 +26,14 @@ const permissions = coreSeedData.permissions || [];
 const rolePerms = coreSeedData.rolePermissions || [];
 
 // Derived context (from guardrail or PRD)
-const navRoute = meta.navRoute;         // e.g. "business.human-resources.projects"
-const contextCode = meta.contextCode;   // e.g. "business"
+const navRoute = meta.navRoute;         // e.g. "human-resources.projects"
 const appCode = meta.appCode;           // e.g. "human-resources"
 const moduleCode = task.module;         // e.g. "projects"
 
 // If _seedDataMeta is absent, fallback to PRD source
 if (!navRoute) {
   const prd = readJSON('.ralph/prd.json');
-  const navRoute = `${prd.source?.context || 'business'}.${prd.source?.application || prd.metadata?.module}.${task.module}`;
+  const navRoute = `${prd.source?.application || prd.metadata?.module}.${task.module}`;
 }
 ```
 
@@ -42,8 +41,7 @@ if (!navRoute) {
 
 | Variable | Example | Source |
 |----------|---------|--------|
-| `navRoute` | `business.human-resources.projects` | `_seedDataMeta.navRoute` |
-| `contextCode` | `business` | `_seedDataMeta.contextCode` |
+| `navRoute` | `human-resources.projects` | `_seedDataMeta.navRoute` |
 | `appCode` | `human-resources` | `_seedDataMeta.appCode` |
 | `moduleCode` | `projects` | `task.module` |
 | `navModules[]` | `[{code, label, icon, route, translations}]` | `coreSeedData.navigationModules` |
@@ -72,24 +70,15 @@ From `seedDataCore.navigationApplications[0]` in feature.json (generated by BA s
 | `{appLabel_xx}` | `navigationApplications[0].labels.xx` (fr, en, it, de) |
 | `{appDesc_xx}` | `navigationApplications[0].description.xx` |
 | `{appIcon}` | `navigationApplications[0].icon` |
-| `{contextCode}` | `navigationApplications[0].context` or `_seedDataMeta.contextCode` |
 
 ### GUID Generation Rule
 
-> **CRITICAL — NavigationContext IDs are NEVER generated as deterministic GUIDs.**
-> Contexts (`business`, `platform`, `personal`) are pre-seeded by SmartStack core with hardcoded GUIDs.
-> The `contextId` parameter in `GetApplicationEntry(Guid contextId)` is resolved at runtime
-> by querying `db.NavigationContexts.FirstOrDefaultAsync(c => c.Code == "business", ct)`.
-> **FORBIDDEN:** `GenerateDeterministicGuid("nav:business")` or any ContextId constant in SeedConstants.
 
 ```csharp
-// Deterministic GUID for APPLICATION (not context — contexts are pre-seeded by SmartStack core)
+// Deterministic GUID for APPLICATION
 public static readonly Guid ApplicationId =
-    GenerateDeterministicGuid("navigation-application-{contextCode}.{appCode}");
-// Example: GenerateDeterministicGuid("navigation-application-business.human-resources")
-//
-// FORBIDDEN — Context IDs must NOT be generated:
-// public static readonly Guid BusinessContextId = GenerateDeterministicGuid("nav:business"); // WRONG!
+    GenerateDeterministicGuid("navigation-application-{appCode}");
+// Example: GenerateDeterministicGuid("navigation-application-human-resources")
 ```
 
 ### Template
@@ -108,23 +97,22 @@ public static class NavigationApplicationSeedData
 {
     // Deterministic GUID for this application
     public static readonly Guid ApplicationId =
-        GenerateDeterministicGuid("navigation-application-{contextCode}.{appCode}");
+        GenerateDeterministicGuid("navigation-application-{appCode}");
 
     /// <summary>
     /// Returns navigation application entry for seeding into core.nav_Applications.
     /// </summary>
-    public static NavigationApplicationSeedEntry GetApplicationEntry(Guid contextId)
+    public static NavigationApplicationSeedEntry GetApplicationEntry()
     {
         return new NavigationApplicationSeedEntry
         {
             Id = ApplicationId,
-            ContextId = contextId,
             Code = "{appCode}",
             Label = "{appLabel_en}",
             Description = "{appDesc_en}",
             Icon = "{appIcon}",              // Lucide React icon name
             IconType = IconType.Lucide,
-            Route = ToKebabCase("/{contextCode}/{appCode}"),
+            Route = ToKebabCase("/{appCode}"),
             DisplayOrder = 1,
             IsActive = true
         };
@@ -245,7 +233,7 @@ private static Guid GenerateDeterministicGuid(string seed)
 
 // Usage: GUIDs are derived from the navigation path
 public static readonly Guid ModuleId = GenerateDeterministicGuid("navigation-module-{navRoute}");
-// Example: GenerateDeterministicGuid("navigation-module-business.human-resources.projects")
+// Example: GenerateDeterministicGuid("navigation-module-human-resources.projects")
 ```
 
 ### Template
@@ -279,7 +267,7 @@ public static class {ModulePascal}NavigationSeedData
             Description = "{desc_en}",
             Icon = "{icon}",              // Lucide React icon name
             IconType = IconType.Lucide,
-            Route = ToKebabCase($"/{contextCode}/{appCode}/{moduleCode}"),
+            Route = ToKebabCase($"/{appCode}/{moduleCode}"),
             DisplayOrder = {displayOrder},
             IsActive = true
         };
@@ -337,7 +325,7 @@ public static class {ModulePascal}NavigationSeedData
 
     /// <summary>
     /// Converts PascalCase route segments to kebab-case for web URLs.
-    /// Example: /business/HumanResources/TimeManagement → /business/human-resources/time-management
+    /// Example: /HumanResources/TimeManagement → /human-resources/time-management
     /// </summary>
     private static string ToKebabCase(string route)
     {
@@ -406,20 +394,20 @@ public class NavigationTranslationSeedEntry
 // Section GUID: deterministic from navRoute + section code
 public static readonly Guid {SectionPascal}SectionId =
     GenerateDeterministicGuid("navigation-section-{navRoute}.{sectionCode}");
-// Example: GenerateDeterministicGuid("navigation-section-business.human-resources.employees.list")
+// Example: GenerateDeterministicGuid("navigation-section-human-resources.employees.list")
 
 // Resource GUID: deterministic from navRoute + section code + resource code
 public static readonly Guid {ResourcePascal}ResourceId =
     GenerateDeterministicGuid("navigation-resource-{navRoute}.{sectionCode}.{resourceCode}");
-// Example: GenerateDeterministicGuid("navigation-resource-business.human-resources.employees.list.employees-grid")
+// Example: GenerateDeterministicGuid("navigation-resource-human-resources.employees.list.employees-grid")
 ```
 
 ### Section Methods (add to {ModulePascal}NavigationSeedData.cs)
 
 > **ROUTE SPECIAL CASES (list and detail):**
 > The `list` and `detail` sections are view modes of the module, NOT functional sub-areas.
-> - `list` section route = module route (e.g., `/business/human-resources/employees`) — NO `/list` suffix
-> - `detail` section route = module route + `/:id` (e.g., `/business/human-resources/employees/:id`) — NOT `/detail/:id`
+> - `list` section route = module route (e.g., `/human-resources/employees`) — NO `/list` suffix
+> - `detail` section route = module route + `/:id` (e.g., `/human-resources/employees/:id`) — NOT `/detail/:id`
 > - FORBIDDEN: `/{module}/list`, `/{module}/detail/:id`
 > - Other sections (dashboard, approve, import) = module route + `/{section-kebab}` (normal)
 
@@ -542,9 +530,9 @@ public static IEnumerable<NavigationResourceSeedEntry> GetResourceEntries(Guid s
             // Then append: /{resource-kebab}
             //
             // Example: resource "export" under section "dashboard":
-            //   Route = /business/human-resources/employees/dashboard/export
+            //   Route = /human-resources/employees/dashboard/export
             // Example: resource "employees-grid" under section "list":
-            //   Route = /business/human-resources/employees/employees-grid (NOT /employees/list/employees-grid)
+            //   Route = /human-resources/employees/employees-grid (NOT /employees/list/employees-grid)
             new NavigationResourceSeedEntry
             {
                 Id = {Resource1Pascal}ResourceId,
@@ -678,22 +666,20 @@ MCP returns:
 ### Step B: Write Permissions.cs (Application layer)
 
 > **CRITICAL — Permission paths use the SAME kebab-case as NavRoute codes.**
-> `{navRoute}` is already kebab-case (e.g., `business.human-resources.employees`).
+> `{navRoute}` is already kebab-case (e.g., `human-resources.employees`).
 > NEVER strip hyphens or derive codes from C# class names.
-> FORBIDDEN: `business.humanresources.employees.read` → CORRECT: `business.human-resources.employees.read`
-> SmartStack.app reference: `business.support-client.my-tickets.read`
+> FORBIDDEN: `humanresources.employees.read` → CORRECT: `human-resources.employees.read`
+> SmartStack.app reference: `support-client.my-tickets.read`
 
 ```csharp
 // Add to Application/Common/Authorization/Permissions.cs
-// IMPORTANT: {navRoute} uses kebab-case segments (e.g., "business.human-resources.employees")
+// IMPORTANT: {navRoute} uses kebab-case segments (e.g., "human-resources.employees")
 // Do NOT derive permission codes from C# identifiers — use navRoute directly
-public static class {ContextPascal}
+public static class {AppPascal}
 {
-    public const string Access = "{contextCode}.{appCode}";
-
     public static class {ModulePascal}
     {
-        public const string View = "{navRoute}.read";       // e.g., "business.human-resources.employees.read"
+        public const string View = "{navRoute}.read";       // e.g., "human-resources.employees.read"
         public const string Create = "{navRoute}.create";
         public const string Update = "{navRoute}.update";
         public const string Delete = "{navRoute}.delete";
@@ -949,11 +935,9 @@ public class ApplicationRoleSeedEntry
 
 ### Context-Based Role Mapping
 
-| Context | Admin | Manager | Contributor | Viewer |
-|---------|-------|---------|-------------|--------|
-| `platform.*` | CRUD | CRU | CR | R |
-| `business.*` | CRUD | CRU | CR | R |
-| `personal.*` | CRUD | CRU | CR | R |
+| Application | Admin | Manager | Contributor | Viewer |
+|-------------|-------|---------|-------------|--------|
+| Any | CRUD | CRU | CR | R |
 
 ### Template
 
@@ -1059,7 +1043,7 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
         // NOTE: Idempotence is at MODULE level (not application level).
         // If the application already exists, we load it and continue to seed any missing modules.
         // This allows adding Module 2+ to an existing application without re-running the full seed.
-        var appEntry = NavigationApplicationSeedData.GetApplicationEntry(Guid.Empty); // contextId resolved below
+        var appEntry = NavigationApplicationSeedData.GetApplicationEntry();
         var existingApp = await context.NavigationApplications
             .FirstOrDefaultAsync(a => a.Code == appEntry.Code, ct);
 
@@ -1070,13 +1054,8 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
         }
         else
         {
-            var parentContext = await context.NavigationContexts
-                .FirstAsync(c => c.Code == "{contextCode}", ct);
-
-            // Re-get entry with resolved contextId
-            appEntry = NavigationApplicationSeedData.GetApplicationEntry(parentContext.Id);
             app = NavigationApplication.Create(
-                appEntry.ContextId, appEntry.Code, appEntry.Label,
+                appEntry.Code, appEntry.Label,
                 appEntry.Description, appEntry.Icon, appEntry.IconType,
                 appEntry.Route, appEntry.DisplayOrder);
             context.NavigationApplications.Add(app);
@@ -1218,12 +1197,12 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
     public async Task SeedPermissionsAsync(ICoreDbContext context, CancellationToken ct)
     {
         var exists = await context.Permissions
-            .AnyAsync(p => p.Path == "{contextCode}.{appCode}.*", ct);
+            .AnyAsync(p => p.Path == "{appCode}.*", ct);
         if (exists) return;
 
         // Application-level wildcard
         var appWildcard = Permission.CreateWildcard(
-            "{contextCode}.{appCode}.*", PermissionLevel.Application,
+            "{appCode}.*", PermissionLevel.Application,
             "Full {appLabel_en} access");
         context.Permissions.Add(appWildcard);
 
@@ -1245,7 +1224,7 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
     public async Task SeedRolePermissionsAsync(ICoreDbContext context, CancellationToken ct)
     {
         var exists = await context.RolePermissions
-            .AnyAsync(rp => rp.Permission!.Path.StartsWith("{contextCode}.{appCode}."), ct);
+            .AnyAsync(rp => rp.Permission!.Path.StartsWith("{appCode}."), ct);
         if (exists) return;
 
         // CRITICAL: Resolve roles by Code from DB — NEVER use deterministic GUIDs.
@@ -1258,7 +1237,7 @@ public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
 
         // Resolve permissions
         var permissions = await context.Permissions
-            .Where(p => p.Path.StartsWith("{contextCode}.{appCode}."))
+            .Where(p => p.Path.StartsWith("{appCode}."))
             .ToListAsync(ct);
 
         // Apply role-permission mappings from all modules
@@ -1349,9 +1328,8 @@ Before marking the task as completed, verify ALL:
 
 **Application-Level (FIRST — before modules):**
 - [ ] `NavigationApplicationSeedData.cs` created (once per application, at `Infrastructure/Persistence/Seeding/Data/`)
-- [ ] Application GUID is deterministic (SHA256 of `"navigation-application-{contextCode}.{appCode}"`)
-- [ ] **NO ContextId constant in SeedConstants** — Context IDs are pre-seeded by SmartStack core (hardcoded GUIDs, NOT deterministic)
-- [ ] **SeedDataProvider queries context by code at runtime:** `db.NavigationContexts.FirstOrDefaultAsync(c => c.Code == "{contextCode}", ct)`
+- [ ] Application GUID is deterministic (SHA256 of `"navigation-application-{appCode}"`)
+- [ ] GetApplicationEntry() takes no parameters (no contextId)
 - [ ] Application translations created (4 languages: fr, en, it, de, EntityType = Application)
 - [ ] `IClientSeedDataProvider.SeedNavigationAsync()` uses `NavigationApplicationSeedData` (NO hardcoded `{appLabel_en}` / `{appIcon}` placeholders)
 - [ ] `ApplicationRolesSeedData.ApplicationId` references `NavigationApplicationSeedData.ApplicationId` (NO `{ApplicationGuid}` placeholder)

package/templates/skills/apex/references/examine-build-validation.md

@@ -0,0 +1,87 @@
+# Examine Build & Migration Validation
+
+> **Loaded by:** step-04-examine.md (sections 4-5)
+> **Purpose:** Build verification, migration validation, database testing procedures.
+
+---
+
+## Build Verification
+
+```bash
+# Cleanup corrupted EF Core design-time artifacts (Roslyn BuildHost bug on Windows/WSL)
+for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && echo "Removing corrupted artifact: $d" && rm -rf "$d"; done
+
+# Backend
+dotnet clean && dotnet restore && dotnet build
+
+# Post-build cleanup (WSL Roslyn recreates literal bin\Debug folders after each build)
+for d in src/*/bin?Debug bin?Debug; do [ -d "$d" ] && rm -rf "$d"; done
+
+# Frontend (if applicable)
+npm run typecheck
+```
+
+**BLOCKING:** Both must pass. If failure, classify error per `references/error-classification.md`:
+- Category A (missing package) → `dotnet add package` → rebuild
+- Category B (assembly conflict) → resolve version → rebuild
+- Category C (DI missing) → fix DI registration → rebuild
+- Category D (migration broken) → fix migration → rebuild
+- Category E (config) → fix config → rebuild
+- Category F (source code) → fix code → rebuild
+
+---
+
+## Migration Validation (if needs_migration)
+
+### Pending Model Changes Check
+
+```bash
+INFRA_PROJECT=$(ls src/*Infrastructure*/*.csproj 2>/dev/null | head -1)
+API_PROJECT=$(ls src/*Api*/*.csproj 2>/dev/null | head -1)
+
+dotnet ef migrations has-pending-model-changes \
+  --project "$INFRA_PROJECT" \
+  --startup-project "$API_PROJECT"
+```
+
+**BLOCKING** if pending changes detected → migration is missing.
+
+### Migration Application Test (SQL Server LocalDB)
+
+```bash
+DB_NAME="SmartStack_Apex_Examine_$(date +%s)"
+CONN_STRING="Server=(localdb)\\MSSQLLocalDB;Database=$DB_NAME;Integrated Security=true;TrustServerCertificate=true;Connect Timeout=120;"
+
+dotnet ef database update \
+  --connection "$CONN_STRING" \
+  --project "$INFRA_PROJECT" \
+  --startup-project "$API_PROJECT"
+```
+
+**BLOCKING** if migration fails on SQL Server. Common issues:
+- SQLite-only syntax in migrations (fix: regenerate migration)
+- Column type mismatches (fix: update EF configuration)
+- Missing foreign key targets (fix: reorder migrations)
+
+### Integration Tests on Real SQL Server
+
+```bash
+# Integration tests use DatabaseFixture → real SQL Server LocalDB
+# This validates: LINQ→SQL, multi-tenant isolation, soft delete, EF configs
+INT_TEST_PROJECT=$(ls tests/*Tests.Integration*/*.csproj 2>/dev/null | head -1)
+if [ -n "$INT_TEST_PROJECT" ]; then
+  dotnet test "$INT_TEST_PROJECT" --no-build --verbosity normal
+fi
+```
+
+Tests running against SQL Server catch issues that SQLite misses:
+- Case sensitivity in string comparisons
+- Date/time function differences
+- IDENTITY vs AUTOINCREMENT behavior
+- Global query filter translation to T-SQL
+
+### Cleanup
+
+```bash
+sqlcmd -S "(localdb)\MSSQLLocalDB" -Q "IF DB_ID('$DB_NAME') IS NOT NULL BEGIN ALTER DATABASE [$DB_NAME] SET SINGLE_USER WITH ROLLBACK IMMEDIATE; DROP DATABASE [$DB_NAME]; END" 2>/dev/null
+```