create-wakii-stack 0.0.0-stage → 0.1.0

package/stack-template/.github/workflows/convergence.yml

@@ -0,0 +1,209 @@
+name: convergence
+
+# SF-5 (FI-81, story FI-76) — convergence proof: e2e 2 chiều (happy login→task→feed
+# QUA KAFKA + saga assign svc-fail → assignment_failed → DLQ assert) trên compose
+# 10 services + copy-dir standalone + scaffold output build được.
+# File RIÊNG của convergence — KHÔNG đụng workflow-templates (SF-1 sở hữu).
+# Browser walkthrough KHÔNG nằm ở đây (human gate tại checkpoint — docs/walkthrough.md).
+
+on:
+  push:
+    branches: ["**"]
+  workflow_dispatch:
+
+permissions:
+  contents: read # least-privilege (P2 security-audit SF-7 — các workflow khác: repo-wide follow-up)
+
+jobs:
+  e2e-smoke:
+    name: "e2e 2 chiều — compose login→task→feed (Kafka) + saga → assignment_failed → DLQ"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30 # 10 services + kafka build/boot — nới từ 20 của SF-7
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Boot postgres + kafka trước (topic phải tồn tại TRƯỚC consumer subscribe)
+        # Học SF-3 (commit 8de8921 — cùng class bug): kafka-go group reader join
+        # khi topic CHƯA tồn tại → empty assignment → không bao giờ tự refresh
+        # metadata → consumer kẹt im lặng (stable group, 0 fetch, 0 error).
+        # Boot postgres+kafka riêng → tạo topic → MỚI boot consumers.
+        run: docker compose -f platform/docker-compose.yml --env-file platform/.env.example up -d --build postgres kafka
+
+      - name: Wait kafka healthy + tạo topic tường minh task-events + task-events.dlq
+        # Demo dùng auto-create (task-events.md) nhưng auto-create có race: relay
+        # publish / consumer subscribe lúc topic chưa kịp tồn tại. Tạo
+        # --if-not-exists TRƯỚC khi boot services (conventions/09: không dùng
+        # depends_on kafka — tạo topic là bước CI, không phải ràng buộc compose).
+        run: |
+          for i in $(seq 1 45); do
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092 >/dev/null 2>&1 && break
+            sleep 2
+          done
+          for topic in task-events task-events.dlq; do
+            docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 \
+              --create --if-not-exists --topic "$topic" --partitions 1 --replication-factor 1
+          done
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-topics.sh --bootstrap-server localhost:9092 --list
+
+      - name: Boot full stack (10 services, health-gated chain — kafka lazy-connect)
+        run: docker compose -f platform/docker-compose.yml --env-file platform/.env.example up -d --build
+
+      - name: Wait gateway chain ready (poll /api/auth/readyz — gateway không có /readyz riêng)
+        run: |
+          for i in $(seq 1 60); do
+            curl -sf --max-time 3 http://localhost:8080/api/auth/readyz 2>/dev/null | grep -q '"status":"ok"' && exit 0
+            sleep 2
+          done
+          echo "gateway chain chưa ready sau 120s"; exit 1
+
+      - name: e2e 2 chiều — scripts/smoke/e2e.sh (happy + saga; DLQ best-effort, marker SAGA_TASK_ID)
+        run: |
+          set -o pipefail
+          bash scripts/smoke/e2e.sh 2>&1 | tee /tmp/e2e.log
+
+      - name: Assert DLQ chính thức — kafka-console-consumer đọc task-events.dlq
+        # Run 3/4 lesson: docker compose exec từ TRONG e2e.sh fail âm thầm
+        # (stderr nuốt) trong khi CÙNG lệnh từ workflow run: block đọc được
+        # message DLQ ở CẢ 3 run (dump step: originalEvent task.assigned +
+        # retries:3, đúng saga taskId). → Assert chính thức nằm ở đây: parse
+        # marker SAGA_TASK_ID= từ e2e log, arrival gate bằng kafka-get-offsets
+        # (in tức thì, không quirk console-consumer trên topic rỗng), rồi
+        # console-consumer đọc nội dung grep taskId (acceptance saga nửa 2).
+        if: success()
+        run: |
+          SAGA_TASK_ID="$(grep -aoE 'SAGA_TASK_ID=[0-9a-f-]{36}' /tmp/e2e.log | tail -1 | cut -d= -f2 || true)"
+          if [ -z "$SAGA_TASK_ID" ]; then
+            echo "Không có SAGA_TASK_ID (SMOKE_SAGA=0 hoặc saga không chạy) — skip DLQ assert"
+            exit 0
+          fi
+          echo "Assert DLQ cho saga task $SAGA_TASK_ID"
+          ARRIVED=0
+          for i in $(seq 1 12); do
+            END_OFF="$(docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+              exec -T kafka /opt/kafka/bin/kafka-get-offsets.sh --bootstrap-server localhost:9092 \
+              --topic task-events.dlq | sed -E 's/.*:([0-9]+)$/\1/')"
+            echo "attempt $i: task-events.dlq end offset = ${END_OFF:-<empty>}"
+            case "$END_OFF" in ''|*[!0-9]*) END_OFF=0;; esac
+            [ "$END_OFF" -ge 1 ] && { ARRIVED=1; break; }
+            sleep 5
+          done
+          [ "$ARRIVED" = "1" ] || { echo "DLQ end offset vẫn 0 sau 60s — go chưa publish DLQ"; exit 1; }
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 \
+            --topic task-events.dlq --from-beginning --timeout-ms 10000 > /tmp/dlq.log 2>/dev/null
+          if grep -q "$SAGA_TASK_ID" /tmp/dlq.log; then
+            echo "PASS DLQ: event gốc của task $SAGA_TASK_ID nằm ở task-events.dlq — acceptance saga đủ 2 nửa (status + DLQ)"
+            head -c 600 /tmp/dlq.log
+          else
+            echo "FAIL: DLQ có message nhưng không thấy taskId=$SAGA_TASK_ID"; head -c 600 /tmp/dlq.log; exit 1
+          fi
+
+      - name: Dump compose state + logs + DLQ khi fail (CÙNG --env-file — interpolation ẩn lỗi thật)
+        if: failure()
+        run: |
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example ps -a
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs --tail=100
+          echo "=== consumer logs (node-svc relay/compensation + go-svc consumer) ==="
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example logs --tail=200 node-svc go-svc
+          echo "=== task-events end offset + nội dung (relay đã publish chưa?) ==="
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-get-offsets.sh --bootstrap-server localhost:9092 \
+            --topic task-events || true
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 \
+            --topic task-events --from-beginning --timeout-ms 10000 2>/dev/null | tail -20 || true
+          echo "=== task-events.dlq hiện có ==="
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example \
+            exec -T kafka /opt/kafka/bin/kafka-console-consumer.sh --bootstrap-server localhost:9092 \
+            --topic task-events.dlq --from-beginning --timeout-ms 10000 2>/dev/null | tail -20 || true
+
+  copy-dir-smoke:
+    name: "copy-dir standalone — node-svc + fe-shared + ui-kit ra tmp"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Copy node-svc ra tmp + build/test standalone (theo README node-svc)
+        run: |
+          REPO_ROOT="$PWD"
+          mkdir -p "$RUNNER_TEMP/standalone" "$RUNNER_TEMP/contracts/db" "$RUNNER_TEMP/contracts/events/fixtures"
+          cp -r services/node-svc "$RUNNER_TEMP/standalone/node-svc"
+          # Contracts standalone tests resolve repo-relative từ standalone/node-svc:
+          #   schema-diff.test → ../../contracts/db/tasks-schema.sql (canonical DDL —
+          #   outbox KHÔNG vào canonical, chỉ schema tasks là cross-service contract)
+          #   app/relay/compensation tests (SF-2) → ../../contracts/events/fixtures/*.json
+          #   (golden envelope — load chung 2 đầu node/go, task-events.md)
+          cp contracts/db/tasks-schema.sql "$RUNNER_TEMP/contracts/db/"
+          cp contracts/events/fixtures/*.json "$RUNNER_TEMP/contracts/events/fixtures/"
+          cd "$RUNNER_TEMP/standalone/node-svc"
+          corepack enable
+          corepack prepare pnpm@9.15.9 --activate # pin đúng repo packageManager — corepack default 12.x ERR_PNPM_IGNORED_BUILDS (run 39013476302)
+          pnpm install --frozen-lockfile --ignore-workspace
+          pnpm test
+          pnpm build
+
+      - name: Copy app/shared + app/ui-kit ra tmp + typecheck standalone
+        # Cả 2 package FE consumed QUA SOURCE (không build riêng) — typecheck = sanity
+        # standalone với flags CLI (không dùng tsconfig trong package). ui-kit chứa
+        # .tsx primitives (SF-1, VU-53): thiếu --jsx → TS6142; standalone không có
+        # consumer để cung cấp types react (thiết kế: KHÔNG khai runtime dep react —
+        # consumer map @types/react qua tsconfig paths, xem app/shell/tsconfig.json) →
+        # standalone tự đóng vai consumer: cài @types/react pin đúng shell + --jsx
+        # react-jsx (đối xứng jsx automatic runtime rspack/vitest — mfToolkit $comment).
+        # fix 2026-10-17: run 39000358809 fail TS6142 đúng class này.
+        run: |
+          REPO_ROOT="$PWD" # checkout cwd — tmp copy nằm NGOÀI repo, path phải absolute
+          # 2 package khai "catalog:" → cần workspace catalog khi standalone
+          # (P0 code-review SF-7: thiếu = ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC).
+          # Mini workspace = catalog block trích từ root pnpm-workspace.yaml.
+          # LƯU Ý: KHÔNG dùng --ignore-workspace — catalog là workspace feature,
+          # ignore-workspace tắt luôn catalog → lại ERR_CATALOG.
+          sed -n '/^catalog:/,$p' "$REPO_ROOT/pnpm-workspace.yaml" > "$RUNNER_TEMP/catalog.yaml"
+          # pnpm 9.15.9 bắt buộc packages field — catalog-only workspace chết
+          # "ERROR packages field missing or empty" (run 39014181194; pnpm 12 chịu nên
+          # local repro pass). "." = self-member → mọi `pnpm add` phải kèm -w.
+          { printf 'packages:\n  - "."\n'; cat "$RUNNER_TEMP/catalog.yaml"; } > "$RUNNER_TEMP/standalone-ws.yaml"
+          corepack enable
+          corepack prepare pnpm@9.15.9 --activate # pin đúng repo packageManager — corepack default 12.x ERR_PNPM_IGNORED_BUILDS (run 39013476302)
+          for DIR in shared ui-kit; do
+            echo "=== standalone typecheck: app/$DIR ==="
+            mkdir -p "$RUNNER_TEMP/standalone/$DIR"
+            # $REPO_ROOT tuyệt đối BẮT BUỘC: vòng 1 cd vào tmp — path tương đối app/* mất
+            cp -r "$REPO_ROOT/app/$DIR/." "$RUNNER_TEMP/standalone/$DIR/"
+            cd "$RUNNER_TEMP/standalone/$DIR"
+            cp "$RUNNER_TEMP/standalone-ws.yaml" pnpm-workspace.yaml
+            pnpm install --no-frozen-lockfile
+            pnpm add -Dw @types/react@19.2.2 # -w: standalone là workspace root (self-member)
+            pnpm exec tsc --noEmit --strict --skipLibCheck --target ES2022 --module ESNext --moduleResolution Bundler --jsx react-jsx src/index.ts
+          done
+
+  scaffold-verify:
+    name: "scaffold output build được — demo-app"
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Chạy scaffold → project mới tên demo-app
+        run: bash scripts/scaffold/scaffold.sh demo-app --out "$RUNNER_TEMP/demo-app"
+
+      - name: Output install + build FE shell + compose config
+        # Narrowing đã duyệt (context pack sf-7 ACCEPTANCE: "CI verify scaffold output
+        # build được") — full e2e trên output = human gate cần Docker (SCAFFOLD.md).
+        run: |
+          cd "$RUNNER_TEMP/demo-app"
+          corepack enable
+          corepack prepare pnpm@9.15.9 --activate # pin đúng repo packageManager — corepack default 12.x ERR_PNPM_IGNORED_BUILDS (run 39013476302)
+          pnpm install --no-frozen-lockfile
+          pnpm --filter "@demo-app/shell" build
+          docker compose -f platform/docker-compose.yml --env-file platform/.env.example config -q

package/stack-template/.github/workflows/git-guard.yml

@@ -0,0 +1,44 @@
+name: git-guard
+
+# Enforce branch-name + commit-message rules trên MỌI PR (docs/git-flow.md).
+# CI-level = ai cũng bị bất kể setup local; muốn feedback sớm hơn → cài hook:
+#   git config core.hooksPath .githooks
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  guard:
+    name: branch + commit message rule
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # cần history so với base branch
+
+      - name: Branch name rule — wakii-dev/<loại>-<slug>
+        run: |
+          BRANCH="${GITHUB_HEAD_REF}"
+          echo "branch: $BRANCH"
+          if ! echo "$BRANCH" | grep -qE '^wakii-dev/(story|sf|fix|docs|chore|feat)-[a-z0-9][a-z0-9-]*$'; then
+            echo "✗ Branch '$BRANCH' vi phạm rule."
+            echo "  Đúng: wakii-dev/<story|sf|fix|docs|chore|feat>-<slug-kebab>  (vd: wakii-dev/fix-gosvc-recent-events)"
+            exit 1
+          fi
+          echo "✓ branch OK"
+
+      - name: Commit message rule — conventional (bỏ merge commits)
+        run: |
+          BASE="origin/${GITHUB_BASE_REF}"
+          git fetch origin "${GITHUB_BASE_REF}" --quiet
+          BAD="$(git log --no-merges --format='%s' "$BASE..HEAD" | grep -vE '^(feat|fix|refactor|docs|test|chore|style|perf|build|ci|revert)(\([a-z0-9./-]+\))?!?: .+' || true)"
+          if [ -n "$BAD" ]; then
+            echo "✗ Commit message vi phạm convention (type(scope): mô tả):"
+            echo "$BAD"
+            echo "  Đúng: 'fix(go-svc): recentEvents test chết theo lịch' / 'docs(flow): git flow'"
+            exit 1
+          fi
+          echo "✓ commit messages OK"

package/stack-template/.github/workflows/publish-uikit.yml

@@ -0,0 +1,96 @@
+name: publish-uikit
+
+# ============================================================================
+# Publish @wakii/ui-kit lên npmjs.org khi push vào nhánh `release/ui-kit`
+# (chỉ đạo user 2026-10-24: "workflow action publish new version cho ui-kit,
+# trigger khi push vào nhánh release/ui-kit"). Chạy tay được qua workflow_dispatch.
+#
+# ⚠️ ĐIỀU KIỆN ĐỂ WORKFLOW NÀY CHẠY THẬT (đọc trước khi bật):
+#  (a) Secret NPM_TOKEN (npm_... classic Automation — account npm wakii, quyền
+#      publish scope @wakii; xem app/ui-kit/RELEASE.md bảng token đầu file)
+#      phải được set trong: repo Settings → Secrets and variables → Actions →
+#      New repository secret, tên đúng `NPM_TOKEN`.
+#  (b) 2026-10-24: repo đang DISABLE GitHub Actions (vấn đề billing — CLAUDE.md
+#      mục CI; gate thực tế đang là .husky/pre-push). Workflow này chỉ fire khi
+#      Actions được bật lại — khi đó push nhánh release/ui-kit hoặc Run workflow.
+#
+# Pipeline: install workspace → gates (test + typecheck + build) → gọi thẳng
+# scripts/publish-npm.sh với env NPM_TOKEN (script tự: rebuild dist → TMP copy
+# TÁCH NGUỒN dist + src/styles → python strip devDeps/scripts/overrides +
+# publishConfig registry npmjs → .npmrc TMP từ NPM_TOKEN → npm publish) →
+# tag v<version> + GitHub release với notes trích từ app/ui-kit/CHANGELOG.md.
+# ============================================================================
+on:
+  push:
+    branches: [release/ui-kit]
+  workflow_dispatch:
+
+permissions:
+  contents: write # tag v<version> + GitHub release; npm publish đi qua secret NPM_TOKEN (không dùng GITHUB_TOKEN)
+
+concurrency:
+  group: publish-uikit-${{ github.ref }}
+  cancel-in-progress: false # publish đang chạy không bị huỷ giữa chừng
+
+jobs:
+  publish:
+    name: gates (test / typecheck / build) → publish npmjs → tag + release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # pnpm 9.15.9 — đồng bộ packageManager root package.json (chuẩn workflow ui-kit.yml)
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+          scope: '@wakii'
+
+      - name: Install workspace (frozen lockfile — lock của cả monorepo)
+        run: pnpm install --frozen-lockfile
+
+      # Gates trước publish — fail là dừng, không publish
+      - name: Gate — test (vitest)
+        run: pnpm --filter @wakii/ui-kit test
+      - name: Gate — typecheck (tsc --noEmit)
+        run: pnpm --filter @wakii/ui-kit typecheck
+      - name: Gate — build (tsup + CSS compiled)
+        run: pnpm --filter @wakii/ui-kit build
+
+      # Publish đúng quy trình script ĐÃ FIX: TMP copy tách nguồn (dist + src/styles
+      # copy RIÊNG — basename trap làm mất CSS tokens) + guard src/styles tồn tại
+      # → python strip devDeps/scripts/overrides + publishConfig registry → NPM_TOKEN
+      # env ưu tiên (không đụng ~/.npmrc của runner) → npm publish --access public.
+      - name: Publish @wakii/ui-kit lên npmjs.org
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: bash app/ui-kit/scripts/publish-npm.sh
+
+      - name: Tag v<version> + GitHub release (notes trích CHANGELOG)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=$(node -p "require('./app/ui-kit/package.json').version")
+          TAG="v${VERSION}"
+          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "Tag ${TAG} đã tồn tại — coi như đã release version này, bỏ qua."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "${TAG}" -m "@wakii/ui-kit ${TAG}"
+          git push origin "${TAG}"
+          # Notes: mục CHANGELOG khớp version (so khớp prefix LITERAL bằng index()
+          # — tránh regex với dấu '.' trong version), cắt tới heading `## [` kế tiếp.
+          awk -v ver="[${VERSION}]" '
+            index($0, "## " ver) == 1 { found = 1; next }
+            found && /^## \[/ { exit }
+            found { print }
+          ' app/ui-kit/CHANGELOG.md > /tmp/notes.md
+          [ -s /tmp/notes.md ] || printf 'Release %s của @wakii/ui-kit (CHANGELOG.md chưa có mục %s).\n' "${TAG}" "${VERSION}" > /tmp/notes.md
+          gh release create "${TAG}" --title "@wakii/ui-kit ${TAG}" --notes-file /tmp/notes.md --target "${GITHUB_SHA}"

package/stack-template/.github/workflows/remotes-activity.yml

@@ -0,0 +1,82 @@
+name: remotes-activity
+
+# SF-6 (FI-74) — remote `activity`: typecheck + vitest + rspack build + boot-smoke
+# (docker build + up + HTTP 200 + fetch được remoteEntry.js — spec slice mục 6).
+# Lưu ý: job chạy trên pnpm-lock.yaml của NHÁNH — nếu SF-5 đang regenerate song song, lockfile
+# stale là việc coordinator resolve khi merge, KHÔNG phải bug code (P2 plan-critic note).
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "app/remotes/activity/**"
+      - "app/shared/**"
+      - "pnpm-workspace.yaml"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/remotes-activity.yml"
+  pull_request:
+    paths:
+      - "app/remotes/activity/**"
+      - "app/shared/**"
+      - "pnpm-workspace.yaml"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/remotes-activity.yml"
+
+permissions:
+  contents: read # least-privilege (P2 security-audit SF-7 — follow-up repo-wide)
+
+jobs:
+  build-test:
+    name: typecheck + vitest + build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Install (workspace, frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm --filter @wakii/remote-activity typecheck
+      - name: Tests (vitest + testing-library)
+        run: pnpm --filter @wakii/remote-activity test
+      - name: Build (rspack production)
+        run: pnpm --filter @wakii/remote-activity build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: remote-activity-dist
+          path: app/remotes/activity/dist/
+          retention-days: 3
+
+  boot-smoke:
+    name: boot-smoke (docker build + up + 200 + remoteEntry)
+    runs-on: ubuntu-latest
+    needs: build-test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Docker build (multi-stage node→nginx, context = repo root)
+        run: docker build -f app/remotes/activity/Dockerfile -t boilerplate-remote-activity .
+      - name: Up container
+        run: docker run -d --name remote-activity -p 4002:4002 boilerplate-remote-activity
+      - name: Smoke — HTTP 200 trên / (standalone index)
+        run: |
+          for i in $(seq 1 24); do
+            if curl -fsS -o /dev/null -w "%{http_code}" http://localhost:4002/ | grep -q 200; then
+              echo "boot-smoke OK (HTTP 200)"; exit 0
+            fi
+            sleep 2
+          done
+          echo "boot-smoke FAILED — remote activity không trả 200 sau 48s"; docker logs remote-activity; exit 1
+      - name: Smoke — fetch được remoteEntry.js (spec slice mục 6)
+        run: |
+          code=$(curl -fsS -o /tmp/remoteEntry.js -w "%{http_code}" http://localhost:4002/remoteEntry.js)
+          [ "$code" = "200" ] || { echo "remoteEntry fetch FAILED ($code)"; exit 1; }
+          grep -q "activity" /tmp/remoteEntry.js || { echo "remoteEntry không chứa MF name 'activity'"; exit 1; }
+          echo "remoteEntry.js OK (HTTP 200 + MF name 'activity')"
+      - name: Smoke — publicPath prod bakes /remotes/activity/ (conventions/08)
+        run: |
+          grep -q "/remotes/activity/" /tmp/remoteEntry.js || { echo "publicPath prod thiếu /remotes/activity/"; exit 1; }
+          echo "publicPath OK (/remotes/activity/)"

package/stack-template/.github/workflows/remotes-tasks.yml

@@ -0,0 +1,82 @@
+name: remotes-tasks
+
+# SF-6 (FI-74) — remote `tasks`: typecheck + vitest + rspack build + boot-smoke
+# (docker build + up + HTTP 200 + fetch được remoteEntry.js — spec slice mục 6).
+# Lưu ý: job chạy trên pnpm-lock.yaml của NHÁNH — nếu SF-5 đang regenerate song song, lockfile
+# stale là việc coordinator resolve khi merge, KHÔNG phải bug code (P2 plan-critic note).
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - "app/remotes/tasks/**"
+      - "app/shared/**"
+      - "pnpm-workspace.yaml"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/remotes-tasks.yml"
+  pull_request:
+    paths:
+      - "app/remotes/tasks/**"
+      - "app/shared/**"
+      - "pnpm-workspace.yaml"
+      - "pnpm-lock.yaml"
+      - ".github/workflows/remotes-tasks.yml"
+
+permissions:
+  contents: read # least-privilege (P2 security-audit SF-7 — follow-up repo-wide)
+
+jobs:
+  build-test:
+    name: typecheck + vitest + build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Install (workspace, frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck
+        run: pnpm --filter @wakii/remote-tasks typecheck
+      - name: Tests (vitest + testing-library)
+        run: pnpm --filter @wakii/remote-tasks test
+      - name: Build (rspack production)
+        run: pnpm --filter @wakii/remote-tasks build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: remote-tasks-dist
+          path: app/remotes/tasks/dist/
+          retention-days: 3
+
+  boot-smoke:
+    name: boot-smoke (docker build + up + 200 + remoteEntry)
+    runs-on: ubuntu-latest
+    needs: build-test
+    steps:
+      - uses: actions/checkout@v4
+      - name: Docker build (multi-stage node→nginx, context = repo root)
+        run: docker build -f app/remotes/tasks/Dockerfile -t boilerplate-remote-tasks .
+      - name: Up container
+        run: docker run -d --name remote-tasks -p 4001:4001 boilerplate-remote-tasks
+      - name: Smoke — HTTP 200 trên / (standalone index)
+        run: |
+          for i in $(seq 1 24); do
+            if curl -fsS -o /dev/null -w "%{http_code}" http://localhost:4001/ | grep -q 200; then
+              echo "boot-smoke OK (HTTP 200)"; exit 0
+            fi
+            sleep 2
+          done
+          echo "boot-smoke FAILED — remote tasks không trả 200 sau 48s"; docker logs remote-tasks; exit 1
+      - name: Smoke — fetch được remoteEntry.js (spec slice mục 6)
+        run: |
+          code=$(curl -fsS -o /tmp/remoteEntry.js -w "%{http_code}" http://localhost:4001/remoteEntry.js)
+          [ "$code" = "200" ] || { echo "remoteEntry fetch FAILED ($code)"; exit 1; }
+          grep -q "tasks" /tmp/remoteEntry.js || { echo "remoteEntry không chứa MF name 'tasks'"; exit 1; }
+          echo "remoteEntry.js OK (HTTP 200 + MF name 'tasks')"
+      - name: Smoke — publicPath prod bakes /remotes/tasks/ (conventions/08)
+        run: |
+          grep -q "/remotes/tasks/" /tmp/remoteEntry.js || { echo "publicPath prod thiếu /remotes/tasks/"; exit 1; }
+          echo "publicPath OK (/remotes/tasks/)"