devmethod-ai 0.1.0-rc.2 → 0.2.0

package/examples/clair-from-zero/app/styles.css

@@ -0,0 +1,128 @@
+:root{--paper:#f7f3eb;--ink:#292923;--muted:#726e63;--rust:#97472f;--line:#d9d3c7;--panel:#eee9df;--serif:Georgia,'Times New Roman',serif;--sans:Arial,Helvetica,sans-serif}
+*{box-sizing:border-box}
+body{margin:0;background:var(--paper);color:var(--ink);font-family:var(--sans);font-size:14px}
+button,input,textarea{font:inherit}
+button,a,input,textarea{-webkit-tap-highlight-color:transparent}
+button{cursor:pointer}
+button{color:inherit}
+button:focus-visible,a:focus-visible,input:focus-visible,textarea:focus-visible,[tabindex]:focus-visible{outline:3px solid var(--rust);outline-offset:5px}
+button:hover{filter:brightness(.86)}
+[hidden]{display:none!important}
+.page{max-width:1480px;padding:0 64px;margin:auto}
+.masthead{height:100px;display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--line);gap:24px}
+.brand{font-family:var(--serif);font-size:44px;letter-spacing:-3px;color:var(--ink);text-decoration:none}
+.brand-dot{color:var(--rust);font-size:28px;display:inline-block;vertical-align:top;margin:5px 0 0 7px}
+.masthead-note,.edition,.eyebrow,.hero-aside>span,.footer-note{font-size:10px;letter-spacing:1.8px;font-weight:600}
+.edition{color:var(--muted)}
+.hero{display:flex;align-items:center;justify-content:space-between;padding:57px 0 50px}
+.eyebrow{color:var(--rust);margin:0 0 23px}
+.hero h1{font:normal clamp(58px,5.7vw,82px)/1.04 var(--serif);letter-spacing:-3.3px;margin:0}
+.hero h1 em{font-weight:normal;color:var(--rust)}
+.intro{font-size:15px;line-height:1.7;color:var(--muted);margin:23px 0 0}
+.hero-aside{width:28%;text-align:center;padding-top:8px}
+.hero-aside p{font:italic 24px/1.4 var(--serif);margin:18px 0;color:var(--muted)}
+.hero-aside>span{font-size:9px;color:var(--muted)}
+.sun{position:relative;width:90px;height:90px;margin:0 auto}
+.sun i{position:absolute;top:44px;left:0;width:90px;height:1px;background:var(--rust)}
+.sun i:nth-child(2){transform:rotate(45deg)}
+.sun i:nth-child(3){transform:rotate(90deg)}
+.sun i:nth-child(4){transform:rotate(135deg)}
+.sun:after{content:'';position:absolute;inset:30px;border:1px solid var(--rust);border-radius:50%;background:var(--paper)}
+.workspace{display:grid;grid-template-columns:minmax(0,1.8fr) minmax(290px,1fr);gap:48px;border-top:1px solid var(--ink);padding-top:32px;padding-bottom:55px}
+.section-heading{display:flex;justify-content:space-between;align-items:center;margin-bottom:25px}
+.section-heading h2{font:normal 30px var(--serif);letter-spacing:-.6px;margin:0}
+.count{font:normal 27px var(--serif);color:var(--muted)}
+.list-toolbar{display:flex;justify-content:space-between;align-items:center;gap:16px}
+.filters{display:flex;gap:19px}
+.filters button{font-size:12px;border:0;background:transparent;padding:9px 0;color:var(--muted);border-bottom:2px solid transparent;white-space:nowrap}
+.filters button[aria-pressed=true]{color:var(--rust);border-bottom-color:var(--rust);font-weight:bold}
+.filters span{font-size:10px;margin-left:3px}
+.progress-label{font-size:10px;color:var(--muted);white-space:nowrap}
+.progress-track{height:2px;background:var(--line);margin:10px 0 0}
+.progress-track div{height:100%;background:var(--rust);transition:width .2s ease}
+.empty-state{min-height:285px;display:flex;align-items:center;justify-content:center;flex-direction:column;text-align:center;padding:32px 10px}
+.empty-mark{font-size:43px;color:var(--rust);margin:0 0 15px}
+.empty-state h3{font:normal 25px var(--serif);margin:0 0 12px;letter-spacing:-.3px}
+.empty-state p{line-height:1.7;color:var(--muted);font-size:13px;margin:0}
+.text-button{border:0;background:none;color:var(--rust);font-size:12px;border-bottom:1px solid var(--rust);padding:0 0 5px;margin-top:22px}
+.text-button span{margin-left:14px}
+.list-foot{display:flex;justify-content:space-between;gap:15px;border-top:1px solid var(--line);padding-top:19px;font-size:10px;color:var(--muted)}
+.list-foot button{border:0;padding:0 0 2px;background:transparent;color:var(--rust);font-size:10px;border-bottom:1px solid var(--rust)}
+.composer{background:var(--panel);padding:29px 29px 23px;align-self:start}
+.composer .eyebrow{font-size:9px;margin-bottom:16px}
+.composer h2{font:normal 29px/1.15 var(--serif);letter-spacing:-.7px;margin:0 0 27px}
+.composer h2 em{color:var(--rust)}
+label{display:block;font-size:11px;font-weight:bold;margin:0 0 10px}
+label>span:not(.optional){color:var(--rust)}
+.optional{font-weight:normal;color:var(--muted)}
+input,textarea{width:100%;border:1px solid #c9c1b2;border-radius:0;color:var(--ink);background:#faf7f1;padding:13px 12px;font-size:12px;line-height:1.5}
+input{margin-bottom:20px}
+textarea{resize:vertical;min-height:91px}
+input::placeholder,textarea::placeholder{color:#817b6f}
+input[aria-invalid=true]{border-color:var(--rust)}
+.add-button{margin-top:17px;display:flex;align-items:center;justify-content:space-between;background:var(--rust);color:white;border:0;padding:14px 17px;width:100%;font-size:12px}
+.add-button span{font-size:21px;line-height:1}
+.form-tip{font-size:11px;line-height:1.6;color:var(--muted);margin:20px 0 0}
+.form-error{color:#8a2c20;font-size:12px;line-height:1.5;margin:12px 0 0}
+#task-list{list-style:none;padding:0;margin:0}
+.task{display:grid;grid-template-columns:24px minmax(0,1fr) 30px;align-items:start;gap:14px;border-bottom:1px solid var(--line);padding:23px 0}
+.task:last-child{border-bottom:0}
+.task-check{width:22px;height:22px;padding:0;border:1px solid #9c9586;background:transparent;margin-top:2px;display:grid;place-items:center}
+.task.done .task-check{background:var(--rust);border-color:var(--rust);color:white}
+.task h3{font:normal 21px/1.3 var(--serif);margin:0;overflow-wrap:anywhere}
+.task p{margin:8px 0 0;color:var(--muted);font-size:12px;line-height:1.6;white-space:pre-wrap;overflow-wrap:anywhere}
+.task.done h3{text-decoration:line-through;color:var(--muted)}
+.task-delete{background:none;border:0;padding:3px;color:var(--muted);width:30px;height:30px}
+.task-delete svg{width:16px;height:18px;fill:none;stroke:currentColor;stroke-width:1.4}
+.task-state{font-size:9px;color:var(--rust);letter-spacing:1px;display:block;margin-top:9px}
+.undo-bar{position:fixed;bottom:24px;left:50%;transform:translateX(-50%);display:flex;align-items:center;gap:25px;max-width:calc(100% - 32px);width:max-content;background:var(--ink);color:var(--paper);padding:15px 20px;box-shadow:0 8px 25px #29292325;font-size:12px}
+.undo-bar button{background:none;color:var(--paper);border:0;padding:5px;text-decoration:underline}
+.undo-bar #dismiss-undo{text-decoration:none;font-size:22px;padding:0 3px}
+.storage-alert{border:1px solid var(--rust);padding:18px;margin-bottom:24px;color:var(--rust);font-size:13px;line-height:1.5}
+.storage-alert p{margin:0 0 12px}
+.storage-alert button{background:none;border:1px solid var(--rust);color:var(--rust);padding:8px 12px}
+footer{border-top:1px solid var(--line);display:flex;align-items:center;gap:24px;padding:25px 0 30px;color:var(--muted)}
+.footer-brand{font:normal 27px var(--serif);letter-spacing:-1.5px}
+footer p{font-size:10px;line-height:1.6;margin:0}
+.footer-note{margin-left:auto;font-size:9px}
+.sr-only{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap}
+.skip{position:fixed;top:-100px;left:20px;background:var(--ink);color:white;padding:12px;z-index:10}
+.skip:focus{top:12px}
+.noscript{padding:20px;color:var(--rust)}
+@media(min-width:1500px){.hero{padding-top:70px;padding-bottom:65px}
+}
+@media(max-width:1000px){.page{padding:0 35px}
+.workspace{gap:28px;grid-template-columns:minmax(0,1.4fr) minmax(275px,1fr)}
+.progress-label{display:none}
+.composer{padding:25px 22px}
+.masthead-note{display:none}
+}
+@media(max-width:700px){.page{padding:0 22px}
+.masthead{height:80px}
+.brand{font-size:39px}
+.edition{font-size:8px;letter-spacing:1px}
+.hero{padding:35px 0}
+.hero h1{font-size:55px;letter-spacing:-2.5px}
+.hero .eyebrow{font-size:9px;margin-bottom:19px}
+.intro{font-size:13px;line-height:1.7;margin-top:20px}
+.hero-aside{display:none}
+.workspace{display:flex;flex-direction:column;gap:32px;padding-top:24px;padding-bottom:35px}
+.composer{order:-1;width:100%;padding:24px}
+.composer h2{font-size:27px}
+.composer h2 br{display:none}
+.composer .eyebrow{margin-bottom:10px}
+.composer h2{margin-bottom:24px}
+.form-tip{display:none}
+.section-heading{margin-bottom:16px}
+.section-heading h2{font-size:28px}
+.empty-state{min-height:280px}
+.empty-state h3{font-size:23px}
+.list-foot{font-size:9px;line-height:1.7}
+.list-foot button{font-size:10px;align-self:start}
+.footer-note{display:none}
+footer{gap:20px;padding-bottom:90px}
+.task h3{font-size:20px}
+.undo-bar{gap:13px;font-size:11px;padding:12px 15px}
+}
+@media(prefers-reduced-motion:reduce){*{transition:none!important;scroll-behavior:auto!important}
+}

package/examples/clair-from-zero/browser-check.cjs

@@ -0,0 +1,2 @@
+const {chromium}=require(process.env.PLAYWRIGHT_MODULE || 'playwright');const assert=require('node:assert/strict');const fs=require('node:fs');
+(async()=>{const browser=await chromium.launch({channel:'chrome',headless:true});const context=await browser.newContext({viewport:{width:1280,height:900},reducedMotion:'reduce'});const p=await context.newPage();const errors=[];p.on('pageerror',e=>errors.push(e.message));await p.goto('http://127.0.0.1:8766');assert.equal(await p.locator('.task').count(),0);await p.locator('.add-button').click();assert.equal(await p.locator('#form-error').isVisible(),true);await p.locator('#task-title').fill('Vérifier le parcours');await p.locator('#task-note').fill('Une note de démonstration.');await p.locator('.add-button').click();assert.equal(await p.locator('.task').count(),1);await p.locator('.task-check').first().click();await p.locator('[data-filter="active"]').click();assert.equal(await p.locator('.task').count(),0);await p.locator('[data-filter="done"]').click();assert.equal(await p.locator('.task').count(),1);await p.reload();await p.locator('[data-filter="all"]').click();assert.equal(await p.locator('.task').count(),1);await p.locator('.task-delete').first().click();assert.equal(await p.locator('.task').count(),0);await p.locator('#undo-button').click();assert.equal(await p.locator('.task').count(),1);await p.locator('#demo-button').click();assert.ok(await p.locator('.task').count()>=1);fs.mkdirSync('docs/media/from-zero/captures',{recursive:true});await p.screenshot({path:'docs/media/from-zero/captures/clair-desktop.png',fullPage:true});await p.setViewportSize({width:390,height:844});await p.screenshot({path:'docs/media/from-zero/captures/clair-mobile.png',fullPage:true});assert.equal(await p.evaluate(()=>document.documentElement.scrollWidth<=innerWidth),true);await p.locator('#task-title').focus();await p.keyboard.type('Ajout clavier');await p.keyboard.press('Tab');await p.keyboard.press('Tab');assert.equal(await p.locator('.add-button').evaluate(e=>e===document.activeElement),true);await p.keyboard.press('Enter');assert.ok(await p.locator('.task').filter({hasText:'Ajout clavier'}).count());const blocked=await browser.newContext();await blocked.addInitScript(()=>{Storage.prototype.setItem=()=>{throw new DOMException('Blocked','QuotaExceededError');};});const b=await blocked.newPage();await b.goto('http://127.0.0.1:8766');await b.locator('#task-title').fill('Conserver ma saisie');await b.locator('.add-button').click();assert.equal(await b.locator('#storage-alert').isVisible(),true);assert.equal(await b.locator('.task').count(),1);assert.deepEqual(errors,[]);console.log('PASS: empty state, blank validation, add/note, complete/filter, reload persistence, delete/undo, demo, keyboard submit, mobile overflow, storage failure retains task and alerts.');await browser.close();})();

package/examples/clair-from-zero/tests/domain.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createTask,toggleTask,removeTask,restoreTask,filterTasks,decodeTasks,encodeTasks} from '../app/domain.mjs';
+import {readTasks,writeTasks,STORAGE_KEY} from '../app/storage.mjs';
+const a = createTask('Lire','Une note','a'), b = createTask('Marcher','','b');
+test('creation trims inputs; rejects blank and over-limit values', () => {
+  assert.deepEqual(createTask('  Titre  ',' Note ','id'),{id:'id',title:'Titre',note:'Note',done:false});
+  for (const title of ['','   ','\n\t','x'.repeat(161)]) assert.throws(() => createTask(title,'','id'));
+  assert.throws(() => createTask('Titre','x'.repeat(501),'id'));
+  assert.equal(createTask('x'.repeat(160),'x'.repeat(500),'id').note.length,500);
+});
+test('toggle is immutable and filters preserve order', () => {
+  const initial = [a,b], changed = toggleTask(initial,'a');
+  assert.equal(a.done,false); assert.equal(changed[0].done,true);
+  assert.deepEqual(filterTasks(changed,'done'),[changed[0]]); assert.deepEqual(filterTasks(changed,'active'),[b]);
+  assert.deepEqual(filterTasks(changed,'all'),changed); assert.deepEqual(toggleTask(changed,'a'),initial);
+});
+test('delete and undo restore original position even after adding another task', () => {
+  const initial=[a,b], {tasks,removed}=removeTask(initial,'a'), c=createTask('Écrire','','c');
+  assert.deepEqual(tasks,[b]); assert.deepEqual(restoreTask([...tasks,c],removed),[a,b,c]);
+  assert.deepEqual(restoreTask(initial,removed),initial); assert.equal(removeTask(initial,'missing').removed,null);
+  assert.deepEqual(restoreTask([],null),[]);
+});
+test('empty persistence and Unicode round-trip; HTML remains literal text', () => {
+  assert.deepEqual(decodeTasks(null),[]);
+  const task=createTask('<img src=x onerror=alert(1)>','Été\n日本語','x');
+  assert.deepEqual(decodeTasks(encodeTasks([task])),[task]);
+});
+test('untrusted storage schema rejects invalid data and duplicate IDs', () => {
+  for(const raw of ['not JSON','null','{}','[]',JSON.stringify({version:2,tasks:[]}),JSON.stringify({version:1,tasks:[a,a]}),JSON.stringify({version:1,tasks:[{...a,done:'true'}]}),JSON.stringify({version:1,tasks:[{...a,title:' '}]}),JSON.stringify({version:1,tasks:[{...a,note:null}]})]) assert.throws(()=>decodeTasks(raw));
+});
+test('storage adapter uses versioned key; failures propagate rather than fake success', () => {
+  const map=new Map(), storage={getItem:key=>map.get(key)??null,setItem:(key,value)=>map.set(key,value)};
+  writeTasks(storage,[a,b]); assert.ok(map.has(STORAGE_KEY)); assert.deepEqual(readTasks(storage),[a,b]);
+  assert.throws(()=>writeTasks({setItem(){throw new Error('quota');}},[a]),/quota/);
+  assert.throws(()=>readTasks({getItem(){throw new Error('blocked');}}),/blocked/);
+});

package/examples/fullstack/CONTRACT.md

@@ -0,0 +1,23 @@
+# Task slice contract
+
+Status: implemented fixture contract, owned by the fullstack slice. This fictional local example demonstrates one feature; it is not a production service architecture recommendation.
+
+| Boundary | Observable contract |
+|---|---|
+| `POST /tasks` | JSON object with only `title`; normalize with JavaScript `trim`; require 1–120 UTF-16 code units and reject U+0000 anywhere in the title; generate UUID; return `201` and `{ id, title }` after insertion |
+| Invalid creation | `400` for missing/non-string/empty/too-long title or U+0000, array body or unknown fields; no persistence call |
+| `GET /tasks` | `200` with at most 100 `{ id, title }` rows sorted by title then ID using PostgreSQL ordering; no cursor/pagination |
+| Infrastructure failure | `500` with generic Nest response; driver connection details are not exposed to callers |
+| Next initial read | Server-only HTTP request with no cache and 3-second timeout; validate shape and omit unknown fields before sending props to the client |
+| UI filter | Case-insensitive substring search in the currently loaded rows; trims search text; no mutation or fetch |
+| API unavailable | Render a readable alert; this demonstration page returns HTML successfully and is not a health endpoint |
+
+No authentication, authorization, tenant separation, updates, deletion, business uniqueness, idempotency keys, events or production deployment are in scope. The API, web commands and database bind to loopback. A repeated POST creates another task; do not automatically retry an ambiguous mutation. There is no third-party call or paid operation.
+
+The domain owns title normalization and validation, including rejection of U+0000 before persistence because PostgreSQL text cannot store that character. `Tasks` is the use case and owns the consumer-defined `TaskStore` port. Nest handles transport, `PostgresTasks` handles Drizzle, and composition assembles them. The client model is a separately validated HTTP representation; no client import reaches API internals. `useTaskFilter` owns only query state and calls a pure transformation.
+
+Persistence uses one SQL INSERT per creation, already atomic in PostgreSQL. UUID primary-key uniqueness, SQL nonempty-space checks and a varchar length limit provide database safeguards. JavaScript trims more whitespace and counts UTF-16 code units differently from PostgreSQL character length; the application remains authoritative for the full title rule. No cross-row invariant requires a multi-statement transaction in this scope.
+
+Migration `0000_tasks.sql` creates the table; Drizzle's journal records application. Apply with `npm run db:migrate` against an isolated database. Replaying the migrator must not recreate the table. Do not edit an applied migration; add a forward migration. There is no tested production rollback/backup/restore policy. Destroying the local Compose fixture is the documented reset, never a production recovery procedure.
+
+Acceptance evidence is mapped in [README](README.md). Code, schema/migration, versions, environment or this contract changing invalidates the affected result. A passing HTTP test with an in-memory store does not prove PostgreSQL behavior; the real database and end-to-end suites establish their own narrower claims.

package/examples/fullstack/DEPENDENCIES.md

@@ -0,0 +1,18 @@
+# Fixture dependency security decision
+
+On 2026-09-13, `npm audit --json` reported three high-severity dependency entries: `multer`, `@nestjs/platform-express`, and `@nestjs/core`. The Nest entries propagated the vulnerable transitive multer dependency; they were not three independent application flaws. Nest platform-express 12.0.1 pins multer 2.2.0 in its published npm metadata.
+
+The following maintainer advisories identify multer 2.3.0 as the patched release:
+
+- [Crafted multipart field names](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm).
+- [File descriptor leak on aborted uploads](https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf).
+- [Async fileFilter size-limit bypass](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72).
+- [Oversized array indices in field names](https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4).
+
+Sources were consulted on 2026-09-13, together with `npm view @nestjs/platform-express@12.0.1 dependencies --json` and `npm view multer@2.3.0 engines version --json`. The published patched package supports this fixture's runtime range.
+
+Applicability assessment: the fixture installs the adapter but configures no Multer middleware or Nest file-upload interceptor. Its task controller expects JSON; the HTTP suite checks that a multipart request is rejected before persistence. The current routes therefore do not activate the affected upload parser, based on source inspection and this boundary check. This is not a claim that the original dependency was safe for an application adding uploads.
+
+The fixture applies a narrow npm override from `@nestjs/platform-express` to `multer: 2.3.0`, preserving the Nest/React/Next major versions. The lockfile records the patched resolution. Do not use an automatic forced framework downgrade suggested by audit. Remove the override when the deliberately selected Nest adapter version natively resolves a patched compatible multer; then regenerate the lockfile and rerun the relevant checks.
+
+Validation for this change: a clean lockfile install, npm audit, domain/HTTP/web-model tests and the production Next/Nest/PostgreSQL end-to-end suite. Their actual results belong to the commit review and mission evidence. This fixture has no upload feature, so it does not claim validation of file upload behavior or a complete security audit. Audit results are time-bound and do not prove absence of all vulnerabilities.

package/examples/fullstack/README.md

@@ -0,0 +1,100 @@
+# Next.js / NestJS / PostgreSQL fixture
+
+A fictional local task list demonstrates a complete server-rendered read path and a validated creation API. It includes an actual Next application, Nest HTTP server, strict TypeScript, a Drizzle adapter and a PostgreSQL migration. Dependencies and tests are isolated from DevMethod's offline CLI.
+
+Read [the contract](CONTRACT.md) before changing the slice. The installed dependency versions are pinned in [package.json](package.json) and [package-lock.json](package-lock.json); PostgreSQL's image is pinned by digest in [compose.yaml](compose.yaml). Use the existing versions when evaluating a mission rather than installing current releases.
+
+## Run from a clean checkout
+
+Prerequisites: Node.js 22+ and npm, Docker with Compose and permission to bind local ports. The recorded run used Node 23.10.0, npm 10.9.2 and Docker 27.5.1 on macOS. That is observed fixture compatibility, not a recommendation to deploy that Node version. Install with a supported project runtime and record your own result.
+
+From the DevMethod repository:
+
+```sh
+cd examples/fullstack
+npm ci --ignore-scripts
+export NEXT_TELEMETRY_DISABLED=1
+npm test
+docker compose -p devmethod-fixture up -d --wait
+export DATABASE_URL=postgresql://fixture:fixture-local-only@127.0.0.1:55439/tasks
+npm run test:db
+npm run test:e2e
+```
+
+The password above is a deliberately public, local-only fixture credential, not a secret or production configuration. Use only a disposable database: these suites apply migrations and insert/delete their own test rows. `test:db` and `test:e2e` fail when `DATABASE_URL` is missing, rather than reporting a skipped test as passed.
+
+`npm test` compiles the API and runs six domain/use-case/HTTP/web-model tests. `test:db` verifies real migrations, replay, durability and database constraints. `test:e2e` builds API and Next production output, starts both HTTP servers on ephemeral loopback ports, creates a task through Nest, verifies its title in Next HTML, and verifies the API-unavailable rendering. It cleans up its task and HTTP processes.
+
+To explore the feature after the tests, run in one terminal:
+
+```sh
+npm run db:migrate
+npm run start:api
+```
+
+In a second terminal, still in this directory:
+
+```sh
+export NEXT_TELEMETRY_DISABLED=1
+npm run start:web
+```
+
+In a third terminal create a fictional task and open the page:
+
+```sh
+curl --fail-with-body -X POST http://127.0.0.1:3101/tasks \
+  -H 'content-type: application/json' -d '{"title":"Review the mission contract"}'
+curl --fail http://127.0.0.1:3101/tasks
+```
+
+Open [the local task list](http://127.0.0.1:3100), type `review` into the labeled filter and verify only matching tasks remain. Clear the input and verify the list returns. This browser/hydration protocol is **not run** in the recorded evidence. Initial HTML and the pure filter function are tested separately. Creation is deliberately through HTTP; there is no creation form.
+
+Stop the foreground API/web processes with Ctrl-C. Remove only this disposable Compose project's container, anonymous data volume and network when finished:
+
+```sh
+docker compose -p devmethod-fixture down -v
+```
+
+## Evidence and limits
+
+Observed on 2026-09-13 for the candidate source tree committed with this example; use `git log -1 -- examples/fullstack` to resolve its introducing revision. These are automated fixture checks, not native Codex/Claude/Cursor behavioral evaluations or an independent design review.
+
+| Acceptance criterion | Change | Executed verification | Result |
+|---|---|---|---|
+| Reject invalid titles before persistence | Domain and use case | `npm test` | passed |
+| Preserve HTTP status/shape and hide infrastructure details | Nest controller | `npm test` | passed |
+| Normalize filter and validate server data | Web model | `npm test` | passed |
+| Apply migration once, replay safely, enforce SQL constraints and persist across connections | Drizzle adapter / SQL migration | `npm run test:db` | passed |
+| Render a task created through the real API and database | Next server boundary | `npm run test:e2e` including production build | passed |
+| Show a useful unavailable state | Next page | `npm run test:e2e` | passed |
+| Browser hydration, keyboard filtering and visual quality | Client view/hook | Manual protocol above | not run |
+| Production auth, deployment, transaction concurrency, restore | Outside slice | None | not run |
+
+The first sandboxed HTTP run was blocked by loopback permissions and was rerun with local server access. An occupied initial database port was changed to 55439 without touching the existing service. Two test-harness issues (nested driver error comparison and cleanup order) were corrected before the final passing run; they were not product compatibility failures. Commands need network access for initial npm/image installation; the DevMethod CLI's offline contract does not extend to fetching example dependencies.
+
+For a revision-specific evaluation, record the exact commit, command, environment, exit code and output in your mission evidence outside this source fixture. Re-run affected checks when source, contract, lockfile or environment changes. Never turn this historical table into fresh evidence for a later edit.
+
+## Troubleshooting
+
+- Port 55439 occupied: set `FIXTURE_DB_PORT` to an unused local port before Compose, and change the port in `DATABASE_URL` to match. Do not stop another project's service.
+- Database test blocked: verify Docker is running, Compose is healthy and the URL points to this disposable database. An unavailable database is not a passing persistence check.
+- Page unavailable: verify API/database startup and `TASKS_API_URL` (defaults to `http://127.0.0.1:3101`). The web server never needs database credentials.
+- Migration/schema mismatch: inspect migration history and create a forward migration; do not erase a real database to satisfy the fixture.
+- Missing package dependencies: run `npm ci --ignore-scripts` here, not at the DevMethod root. `npm run build` emits ignored runtime files; neither installation nor tests deploy anything.
+
+Official technical provenance is recorded in the [optional stack profiles](../../docs/STACK-PROFILES.md), consulted 2026-09-13. A linked third-party skill is not installed or validated by this example.
+
+## Mission, context, evidence and resumption
+
+After installing this fixture's dependencies, run from the DevMethod repository root:
+
+```sh
+node dist/cli.js mission --dest examples/fullstack --mission mission.json --json
+node scripts/fullstack-mission.mjs
+node dist/cli.js context-check --dest examples/fullstack --context evidence/context.json --json
+node dist/cli.js resume --dest examples/fullstack --checkpoint evidence/checkpoint.json --json
+```
+
+The walkthrough actually runs `npm test`, records its output and pins its inputs, and saves ignored metadata/evidence. A successful unchanged run reports ready. It records AC-TITLE only; database/e2e checks remain separate evidence in the table above. Tests are deterministic fixture checks, not a native agent transcript. The script never deploys, runs models or modifies a contract.
+
+To exercise stale resumption in a disposable checkout, edit CONTRACT.md after the walkthrough and inspect resume again: source-changed and reverify must appear. Restore the exact bytes to return to the pinned content, or inspect the new contract and rerun affected verification. A branch change also requires reassessment; an unresolved dependency should remain in blockers until explicitly resolved. Completed scope sets nextAction to null and supplies no new task. Root mission/checkpoint tests reproduce these cases without mutating this example. If saving evidence itself changes Git status, restore the fixture's evidence/ ignore entry before recapturing context.

package/examples/fullstack/api/application/tasks.ts

@@ -0,0 +1,13 @@
+import { randomUUID } from 'node:crypto';
+import { Task, taskTitle } from '../domain/task';
+export interface TaskStore {
+  list(): Promise<Task[]>;
+  insert(task: Task): Promise<Task>;
+}
+export class Tasks {
+  constructor(private readonly store: TaskStore) {}
+  list(): Promise<Task[]> { return this.store.list(); }
+  create(title: unknown): Promise<Task> {
+    return this.store.insert({ id: randomUUID(), title: taskTitle(title) });
+  }
+}

package/examples/fullstack/api/domain/task.ts

@@ -0,0 +1,12 @@
+export const MAX_TITLE_LENGTH = 120;
+export interface Task { id: string; title: string }
+export class InvalidTitle extends Error {}
+export function taskTitle(value: unknown): string {
+  if (typeof value !== 'string') throw new InvalidTitle('Title must be a string.');
+  if (value.includes('\u0000')) throw new InvalidTitle('Title must not contain a null character.');
+  const title = value.trim();
+  if (!title || title.length > MAX_TITLE_LENGTH) {
+    throw new InvalidTitle(`Title must contain 1–${MAX_TITLE_LENGTH} characters after trimming.`);
+  }
+  return title;
+}

package/examples/fullstack/api/http.ts

@@ -0,0 +1,26 @@
+import 'reflect-metadata';
+import { BadRequestException, Body, Controller, Get, Inject, Module, Post } from '@nestjs/common';
+import { NestFactory } from '@nestjs/core';
+import { Tasks, TaskStore } from './application/tasks';
+import { InvalidTitle } from './domain/task';
+@Controller('tasks')
+class TasksController {
+  constructor(@Inject(Tasks) private readonly tasks: Tasks) {}
+  @Get() list() { return this.tasks.list(); }
+  @Post() async create(@Body() body: unknown) {
+    if (!body || typeof body !== 'object' || Array.isArray(body) ||
+        Object.keys(body).some((key) => key !== 'title')) {
+      throw new BadRequestException('Expected an object containing only title.');
+    }
+    try { return await this.tasks.create((body as { title?: unknown }).title); }
+    catch (error) {
+      if (error instanceof InvalidTitle) throw new BadRequestException(error.message);
+      throw error;
+    }
+  }
+}
+export async function createApp(store: TaskStore) {
+  @Module({ controllers: [TasksController], providers: [{ provide: Tasks, useValue: new Tasks(store) }] })
+  class AppModule {}
+  return NestFactory.create(AppModule, { logger: false });
+}

package/examples/fullstack/api/infrastructure/migrate.ts

@@ -0,0 +1,15 @@
+import { resolve } from 'node:path';
+import { Pool } from 'pg';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+export async function migrateDatabase(pool: Pool): Promise<void> {
+  await migrate(drizzle(pool), { migrationsFolder: resolve(__dirname, '../../migrations') });
+}
+if (require.main === module) {
+  if (!process.env.DATABASE_URL) throw new Error('DATABASE_URL is required.');
+  const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+  migrateDatabase(pool).finally(() => pool.end()).catch(() => {
+    console.error('Migration failed. Inspect the database locally; connection details are not logged.');
+    process.exitCode = 1;
+  });
+}

package/examples/fullstack/api/infrastructure/postgres.ts

@@ -0,0 +1,18 @@
+import { asc } from 'drizzle-orm';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { Pool } from 'pg';
+import { TaskStore } from '../application/tasks';
+import { Task } from '../domain/task';
+import { tasks } from './schema';
+export class PostgresTasks implements TaskStore {
+  private readonly db;
+  constructor(pool: Pool) { this.db = drizzle(pool); }
+  list(): Promise<Task[]> {
+    return this.db.select().from(tasks).orderBy(asc(tasks.title), asc(tasks.id)).limit(100);
+  }
+  async insert(task: Task): Promise<Task> {
+    const [created] = await this.db.insert(tasks).values(task).returning();
+    if (!created) throw new Error('Insert returned no task.');
+    return created;
+  }
+}

package/examples/fullstack/api/infrastructure/schema.ts

@@ -0,0 +1,6 @@
+import { check, pgTable, uuid, varchar } from 'drizzle-orm/pg-core';
+import { sql } from 'drizzle-orm';
+export const tasks = pgTable('tasks', {
+  id: uuid('id').primaryKey(),
+  title: varchar('title', { length: 120 }).notNull(),
+}, (table) => [check('tasks_title_nonempty', sql`length(trim(${table.title})) > 0`)]);

package/examples/fullstack/api/main.ts

@@ -0,0 +1,17 @@
+import { Pool } from 'pg';
+import { createApp } from './http';
+import { PostgresTasks } from './infrastructure/postgres';
+async function main() {
+  if (!process.env.DATABASE_URL) throw new Error('DATABASE_URL is required.');
+  const pool = new Pool({ connectionString: process.env.DATABASE_URL, connectionTimeoutMillis: 3000 });
+  try {
+    await pool.query('select 1');
+    const app = await createApp(new PostgresTasks(pool));
+    try { await app.listen(Number(process.env.PORT ?? 3101), '127.0.0.1'); }
+    catch (error) { await app.close(); throw error; }
+    for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+      process.once(signal, () => { void app.close().finally(() => pool.end()); });
+    }
+  } catch (error) { await pool.end(); throw error; }
+}
+main().catch(() => { console.error('API startup failed. Check local database configuration.'); process.exitCode = 1; });

package/examples/fullstack/api/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "CommonJS",
+    "moduleResolution": "Node",
+    "strict": true,
+    "esModuleInterop": true,
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "outDir": "../build",
+    "rootDir": ".",
+    "skipLibCheck": true
+  },
+  "include": [
+    "**/*.ts"
+  ]
+}

package/examples/fullstack/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  db:
+    image: postgres:17.6-alpine@sha256:ef257d85f76e48da1c64832459b59fcaba1a4dac97bf5d7450c77753542eee94
+    environment:
+      POSTGRES_USER: fixture
+      POSTGRES_PASSWORD: fixture-local-only
+      POSTGRES_DB: tasks
+    ports:
+      - "127.0.0.1:${FIXTURE_DB_PORT:-55439}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fixture -d tasks"]
+      interval: 2s
+      timeout: 2s
+      retries: 20

package/examples/fullstack/migrations/0000_tasks.sql

@@ -0,0 +1,5 @@
+CREATE TABLE "tasks" (
+  "id" uuid PRIMARY KEY,
+  "title" varchar(120) NOT NULL,
+  CONSTRAINT "tasks_title_nonempty" CHECK (length(trim("title")) > 0)
+);

package/examples/fullstack/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1789257600000,
+      "tag": "0000_tasks",
+      "breakpoints": true
+    }
+  ]
+}

package/examples/fullstack/mission.json

@@ -0,0 +1,34 @@
+{
+  "format": 1,
+  "id": "TASK-LIST",
+  "path": "standard",
+  "outcome": "Create validated tasks through Nest and render them in Next using PostgreSQL persistence.",
+  "scope": ["Task title validation", "Nest HTTP boundary", "Drizzle persistence", "Next read and filter boundaries"],
+  "exclusions": ["Authentication", "Deployment", "Creation form", "Broker integration"],
+  "invariants": ["Web cannot access database credentials", "Business validation precedes persistence", "Preserve the pinned framework versions"],
+  "uncertainties": ["Browser hydration requires a separate manual or browser check"],
+  "owner": "fixture-maintainer",
+  "status": "active",
+  "nextAction": "Review recorded unit evidence and run database/e2e checks under the documented local fixture contract.",
+  "stopConditions": ["Acceptance checks are recorded with current evidence", "A required dependency is unavailable"],
+  "acceptance": [
+    {"id": "AC-TITLE", "description": "Invalid titles fail before persistence", "changes": ["api/domain/task.ts", "api/http.ts"], "verification": "npm test", "kind": "automated"},
+    {"id": "AC-STORE", "description": "Tasks persist across PostgreSQL connections", "changes": ["api/infrastructure/postgres.ts", "migrations/0000_tasks.sql"], "verification": "npm run test:db", "kind": "automated"},
+    {"id": "AC-WEB", "description": "Next renders a task created through the real API and reports unavailability", "changes": ["web/app/page.tsx", "web/features/tasks/server/list-tasks.ts"], "verification": "npm run test:e2e", "kind": "automated"}
+  ],
+  "sources": [
+    {"id": "runtime", "path": "package.json", "level": "project", "reason": "Pins versions and commands", "authority": "Executable fixture configuration", "kind": "fact", "revision": "working-tree"},
+    {"id": "lock", "path": "package-lock.json", "level": "project", "reason": "Pins resolved dependencies", "authority": "Dependency resolution for this fixture", "kind": "fact", "revision": "working-tree"},
+    {"id": "contract", "path": "CONTRACT.md", "level": "domain", "reason": "Defines title and HTTP semantics", "authority": "Accepted fictional fixture contract", "kind": "accepted-decision", "revision": "working-tree"},
+    {"id": "domain", "path": "api/domain/task.ts", "level": "domain", "reason": "Implements title validation", "authority": "Observed implementation, subordinate to accepted contract", "kind": "fact", "revision": "working-tree"},
+    {"id": "application", "path": "api/application/tasks.ts", "level": "domain", "reason": "Enforces use-case boundaries", "authority": "Observed implementation", "kind": "fact", "revision": "working-tree"},
+    {"id": "http", "path": "api/http.ts", "level": "mission", "reason": "Implements the HTTP acceptance boundary", "authority": "Observed HTTP implementation", "kind": "fact", "revision": "working-tree"},
+    {"id": "api-types", "path": "api/tsconfig.json", "level": "project", "reason": "Controls compiled runtime semantics", "authority": "Compiler configuration", "kind": "fact", "revision": "working-tree"},
+    {"id": "web-model", "path": "web/features/tasks/model/tasks.ts", "level": "mission", "reason": "Validates and filters task data", "authority": "Observed pure model", "kind": "fact", "revision": "working-tree"},
+    {"id": "unit-tests", "path": "tests/unit.test.cjs", "level": "execution", "reason": "Defines title acceptance checks", "authority": "Executable check, not a recorded outcome", "kind": "fact", "revision": "working-tree"},
+    {"id": "http-tests", "path": "tests/http.test.cjs", "level": "execution", "reason": "Defines HTTP acceptance checks", "authority": "Executable check, not a recorded outcome", "kind": "fact", "revision": "working-tree"},
+    {"id": "web-tests", "path": "tests/web-model.test.cjs", "level": "execution", "reason": "Defines pure model checks", "authority": "Executable check, not a recorded outcome", "kind": "fact", "revision": "working-tree"}
+  ],
+  "dependencies": [],
+  "contradictions": []
+}