[PePoDev]

Summary

Implements Milestone 2 (catalog and studio) by following docs/superpowers/plans/2026-10-26-catalog-and-studio.md, which is also in this PR. The first commit adds the plan; each of the other 21 commits is one plan task, in plan order.

• Tasks 1-5: hardening from the post-Milestone 1 architecture review
  • Organization requests are authorized once, inside the transaction that does the work.
  • Error responses keep their cause and carry JSON Pointer diagnostics.
  • Test resets truncate every table and reseed system data.
  • Migrations run as a non-superuser corqty_owner.
  • A catalog test checks that every table has RLS and every SECURITY DEFINER function is locked down.
• Tasks 6-7: web app moved from Vite and React Router to Next.js 16.4 App Router
  • Adds TanStack Query, MSW-based tests, permission-aware UI and oxlint.
  • The web port is now 3000.
• Tasks 8-14: catalog backend
  • Domain rules: graph model, port-type and cycle rules, JSON Schema 2020-12 checks, node definition and publish validation, canonical checksums.
  • Storage: RLS-protected catalog tables with seeded system definitions and blueprints.
  • API: node definitions, blueprints, workflows, drafts with revision preconditions, and atomic publishing of immutable versions.
• Tasks 15-18: studio
  • Workflow list and catalog pages.
  • XYFlow canvas with typed, cycle-safe connections.
  • Inspector with all 10 widgets.
  • Draft autosave, Validate and Publish with diagnostics on nodes and ports.
• Task 19: Compose smoke test and docs.
• Tasks 20-21: fixes for issues an adversarial review found in tasks 9-18.
  • Validation cost is bounded: no schema references in user schemas, a 16 KiB size cap, at most 50 ports per side and 200 diagnostics, and validation runs on blocking threads.
  • Closes the API races: draft-save lock order, a 409 for concurrent blueprint creation, and no duplicate audit row on a repeat deprecation.
  • Drafts stay in sync when you return to the studio, and the studio recovers from failed saves.

Upgrade note

Task 4 changes how the database roles are created. Recreate local databases once:

docker compose down -v

docker compose -f docker-compose.test.yml down -v

Test plan

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace (75 tests)
• pnpm web:lint, pnpm web:test (87 tests), pnpm web:build
• docker compose up --build --wait on a fresh stack, then scripts/smoke-foundation.ps1. Verified locally with Windows PowerShell 5.1; CI runs it under PowerShell 7.
• For every plan task, its section applied literally to the parent commit reproduces that commit byte for byte.
• CI green on Linux

🤖 Generated with Claude Code