[thomasluizon]

Closes thomasluizon/orbit-tickets#1413

The production API must accept the shipped web and Android requests while serving the redesign builds. This promotes the complete API redesign tree from redesign/main at 0a32fab3e366d0029c8ea3d478841215ee1d8b88 onto main at 8356d4debec5b48105734eb7d5dfd28559332da8, preserving the existing main reset and calendar-sync concurrency fixes. The PR is intended for squash merge.

The runtime changes land across src/Orbit.Api, src/Orbit.Application, src/Orbit.Domain and src/Orbit.Infrastructure, with their tests, migration designers, snapshot, embedded OAuth assets and generated OpenAPI document. Carrying the tree keeps dependent behavior and generated output together despite the divergent branch histories. The imported workflow and harness-test differences are unchanged from the redesign branch; the commit hook also formats imported C# files.

Two delivery changes complete the compatibility and release requirements:

• LocalizedErrorResultFilter keeps calendar connection failures recognizable by both shipped clients. Their shared classifier inspects English message substrings, so localizing these two messages would hide the reconnect flow for Portuguese accounts. Error codes and statuses remain unchanged.
• .github/workflows/release.yml requires the production /health commit to equal the released SHA, matching its existing staging check. Release remains a manual dispatch after merge.

tests/Orbit.Infrastructure.Tests/Compatibility/README.md records the audit and reproduction commands. RedesignMigrationCompatibilityTests.cs checks the real PostgreSQL model, migration operations and history guards. Compatibility/MainSchemaProbe.cs.txt runs against an archive of the actual main source to verify old binaries against the added schema.

Compatibility table

The OpenAPI documents have 194 baseline operations and 201 promoted operations. oasdiff v1.33.0, the version in the repository's pinned action, reports no breaking changes using the existing severity overrides. No removal is exempted based on assumed client usage.

Contract	Change	Compatibility
Routes, fields, enums, required parameters	No removals, renames or retypes; no new requirement on an existing operation	Preserved
GET /api/Calendar/events	Optional includeImported=false; declares the existing event array as its 200 response	Default retains the existing filtering and serialized fields; imported markers appear only with opt-in
SkipHabitRequest	Optional nullable skipId	Old bodies and the existing 204 response remain valid
ChatResponse	Optional periodInsight, daySummary, streak, calendar, recordLists, accountRows, followUps	Existing response fields remain
GoalListCardItem	Optional trackingStatus, progressPercentage, projectedCompletionDate, daysToDeadline	Existing item fields remain
MetricsCard	Optional series, topHabitName, topHabitEmoji, habitId, habitTitle, weeklyCompletionRate, monthlyCompletionRate, lastCompletedDate	Existing metric fields remain
PendingAgentOperation	Optional changes, changeTargetCount, items, previewFingerprint, actionKey	Existing approval fields remain
ProfileResponse	Optional activeApiKeyCount	Existing profile fields remain
New route	GET /api/Chat/records/{kind}	Additive record paging
New route	POST /api/Habits/{id}/skip/{skipId}/undo	Additive skip undo
New route	PUT /api/Profile/clock-format	Additive preference write
New route	POST /api/ai/pending-operations/{id}/preview/refresh	Additive preview refresh
New route	POST /api/ai/pending-operations/{id}/revise	Additive preview revision
New route	GET /api/notifications/subscriptions	Additive subscription list
New route	GET /oauth/assets/{name}	Additive font assets

Source inspection also covers responses whose controllers do not declare their payload
types in OpenAPI:

Response	Change	Compatibility
Notifications	Optional totalCount	Existing items and unreadCount, default limit and offset remain
Habit metrics	Optional habitId, habitTitle	Existing metric values remain
Retrospective	Optional dateFrom, dateTo, metrics.completionSeries, and habitId on habit statistics	Existing metrics, narrative and cache fields remain
Profile export settings	Nullable uses24HourClock	Existing settings, including the stored historical color scheme, remain
Validation failure	Additional errorDetails with codes and messages	Existing type, status, requestId, errors: string[] remain
Chat SSE	Additional step variant and optional domain, access fields	Steps require supportsToolSteps=true; existing event variants remain
Chat client context	Optional capability fields for previews, steps, follow-ups and cards; optional messageOrigin	Missing capabilities keep legacy behavior
Calendar connection errors	Portuguese localization breaks a shipped English substring classifier	Keep these two messages in English for both languages, preserving their codes and statuses
Profile color scheme	Historical writes remain accepted; profile reads return the existing orange key	The shipped profile schema accepts nullable strings; no enum value is introduced or removed

AgentContextSnapshot.ColorScheme was removed from the internal prompt context only.
BuildAgentContextSnapshot and BuildDynamicSupplement are its only production
producer and consumer; no controller or MCP tool returns this record.

The production web SHA and Android 1.3.57 (116) are both b84bdc9ed91d57b147c7a8f76980c89cfe7ebdae. Deployment 6803094988 confirms the Android SHA, version, version code, open track and production API URL. The shared calendar classifier, web hook, Android hook, calendar schema, chat schemas and profile schema were read at that exact commit. Neither client repository was modified.

Migration compatibility

Missing migration	Effect on an existing main database
AddPendingOperationRevision	Nullable PreviewFingerprint; RevisionNumber NOT NULL DEFAULT 0, so old inserts can omit both
LinkGamificationNotificationsToProgress	Adds an archive table, saves original titles and bodies, then updates recognized notifications in batches of 1000 to the existing /progress destination; no existing schema is removed
AddClockFormatPreference	Nullable Users.Uses24HourClockPreference, so old inserts and rows need no value
AddHabitSkipUndo	Adds a table and two nonunique indexes; its habit foreign key cascades deletion, so old habit deletion remains valid

The complete model diff preserves all existing tables, columns, types, keys and foreign keys. Added columns are nullable or have defaults, and the new indexes are nonunique. The notification migration changes existing display data after archiving its originals; its existing batch and rollback tests pass. No existing migration or MinSupportedVersion value is changed.

AddPendingOperationRevision sorts before main's last migration, AddMarketingContacts. EF applies missing migration IDs using history; generating a script only from the last main ID would omit this migration. The test generates the complete idempotent PostgreSQL script and verifies the history guard for all four missing IDs.

The archived-main proof compiles the original main domain and persistence code, creates its SQLite schema, applies SQL emitted by EF from the three real structural migrations, then checks legacy reads, inserts, updates, omitted-column defaults and deletion with a populated undo table. It passes. The PostgreSQL notification rewrite was reviewed and covered by migration-operation tests; it was not executed against a live database. No application server was started.

Test evidence

• dotnet build Orbit.slnx --nologo: passed, 0 errors, 18 existing warnings.
• dotnet test --no-build --nologo: passed all 9,451 tests: Domain 661, Application 5,452, Infrastructure 3,306, Analyzers 32; no failures or skips.
• oasdiff breaking origin/main:src/Orbit.Api/openapi.json src/Orbit.Api/openapi.json --fail-on ERR: passed with no breaking changes. The build leaves the committed document unchanged.
• dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~RedesignMigrationCompatibilityTests --nologo: all 3 passed.
• dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~RedesignSchemaProbeTests --nologo, from the archived main source with the committed proof copied in: passed. The compatibility report contains the full reproduction procedure.
• node --test tools/__tests__/check-timeless.test.mjs: all 19 passed. Workflow syntax, timeless text, suppression allowlist, root allowlist, dash baseline and git diff --check pass.

Calendar regression observations:

1. Before changing the test or implementation, dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~LocalizedErrorResultFilterTests|FullyQualifiedName~CalendarControllerTests' --nologo passed all 28 existing tests with the defect present.
2. With the defect still present, dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~CalendarConnectionFailures_StayRecognizableByShippedClients --nologo ran the strengthened test through the actual error filter and account-language resolver. English passed; both Portuguese cases failed because google agenda messages do not match the shipped English classifier. Result: 2 passed, 2 failed for the intended reason.
3. After the fix, dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~LocalizedErrorResultFilterTests|FullyQualifiedName~CalendarControllerTests' --nologo passed all 32 tests, including all 4 regression cases and the existing Portuguese localization checks for other errors.

Release-check observations:

• The unchanged HealthCheckResponseTests passed all 7 cases before the workflow fix; those tests do not inspect the release workflow.
• The old production predicate jq -e '.status == "Healthy"' accepted the observed healthy response while the intended release SHA differed: exit 0, true.
• The strengthened predicate jq -e --arg sha "$COMMIT_SHA" '.status == "Healthy" and .commit == $sha' rejected that mismatched SHA: exit 1, false. Extracted from the fixed workflow, it also accepted the observed matching SHA: exit 0, true.
• actionlint -ignore '^unexpected key "queue" for "concurrency" section\. expected one of "cancel-in-progress", "group"$': passed across all workflows, using the repository's existing queue compatibility rule.
• Before fix: dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~AgentChatWriteHoldTests passed all 58 existing cases.
• Added regression: dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~ExecutePendingOperation_InitialPreview_BindsApprovalToTargetSet failed as intended: stored fingerprint was null and changed targets incorrectly remained current.
• After fix: all three regression cases pass; 141 focused Infrastructure tests and seven Application fixture tests pass.
• dotnet build Orbit.slnx: exit 0, zero errors.
• dotnet test: exit 0, 9,454 passed.
• OpenAPI breaking-change check against origin/main: passed.
• Commit hooks: passed.

External interface evidence

The new production release read of /health.commit was confirmed with curl --fail-with-body --silent --show-error https://api.useorbit.org/health. The complete public response was:

{"status":"Healthy","commit":"649c9dbe6b873d77ba071134b725a36e81a0a3b0","checks":[{"name":"background-services","status":"Healthy","description":"All background services running"},{"name":"database","status":"Healthy","description":"Database reachable"}]}

The producer is also visible in WebApplicationExtensions.WriteHealthCheckResponseAsync, which serializes commit from RENDER_GIT_COMMIT. No unconfirmed Render response field was added.

The EF checks were exercised against the installed EF Core 10.0.13 and PostgreSQL provider. The actual model diff produced AddColumnOperation entries for Users.Uses24HourClockPreference (nullable), PendingAgentOperations.PreviewFingerprint (nullable) and PendingAgentOperations.RevisionNumber (nonnullable, default 0), one CreateTableOperation for HabitSkipUndos, and two CreateIndexOperation entries. The real migration operations confirm the undo foreign key references Habits with cascade deletion. No migration response fixture was invented; the unit tests re-derive this from the compiled migration classes and model.

Assumptions

• Promote the pinned redesign tree and its generated companions, rather than merging divergent commit histories or selectively copying controllers; the work order requests the redesign tree on a main-based branch.
• Preserve recognizable English messages for the two calendar connection errors for every client version, rather than inventing an unshipped language-negotiation capability or raising the client floor.
• Leave the promotion fixes on this delivery branch, rather than modifying redesign/main outside the order. The redesign payload already exists there; only the calendar shim, production health check, proof artifacts and hook formatting need a later sync.
• Reused the existing guarded revision write and nullable PreviewFingerprint column instead of adding a migration.

Manual steps

• After squash merge, open the thomasluizon/orbit-api GitHub Actions Release API workflow (.github/workflows/release.yml) on main and dispatch with exact inputs environment=production, branch=main. Success requires /health.status=Healthy, /health.commit equal to the merged SHA, and the existing Render live-commit check. No deployment was dispatched by this worker.
• After merge, add the sync note in thomasluizon/orbit-tickets#746: all redesign content promoted by this PR already exists on redesign/main, so the standing sync must not replay that payload. Only this branch's compatibility fix, production health check, proof artifacts and hook formatting are new to redesign. Completion is the note on Stop Stripe and Play renewals when account deletion is confirmed #746 and a sync containing only those delivery differences.
• After review and squash merge, use GitHub Actions → Release API → Run workflow from main, with environment=production and branch=main. Verify /health reports the merged commit.
• After merge, update thomasluizon/orbit-tickets#746 using the sync guidance in the existing compatibility README.
• No new configuration, secrets, or manual migrations.

[pullfrog]

Caution

Initial approval previews are not bound to their stored execution state, allowing a bulk delete to include habits absent from the displayed preview.

Reviewed changes This runtime-focused review examined the redesign promotion's production compatibility, approval flow, authorization boundaries, and migration/release safeguards.

• Chat approval and cards: Every chat write gains an approval hold, with editable previews, revision/refresh routes, optional response cards, follow-ups, and opt-in tool-step events.
• Habit and account behavior: Skip undo adds guarded persistence, while calendar imports, clock preferences, notification paging, and API-key metadata extend existing operations.
• Client compatibility: Localized errors preserve calendar reconnect detection, and historical color values remain accepted while profile reads use the granted accent.
• Persistence and delivery: Four additive migrations and compatibility proofs accompany the promotion; production health verification now requires the released commit SHA.
• Presentation and tooling: OAuth assets, email templates, notification wording, scheduler reads, and workflow branch coverage are also updated.

Verification: all 3,306 Infrastructure unit tests passed. A temporary regression test reproduced the initial-preview gap and was then removed; the working tree is clean. This was not an exhaustive line-by-line audit of every generated and test-only hunk in the promotion.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed 9b7ffe55, the sole commit since the prior Pullfrog review, and verified the resolved finding against its discussion and current approval flow.

• Persisted initial preview bindings: Bound the displayed preview to stored pending-operation state before returning the approval card, using the existing guarded revision write.
• Added approval regression coverage: Verified that expanded target sets return stale_preview without executing, while unchanged targets and legacy approvals remain executable.
• Updated executor fixtures: Supplied the store dependency across chat, MCP, executor, and bulk-create tests.

Verification: all 3,309 Infrastructure unit tests and 26 focused Application unit tests passed, with no failures or skips. This was an incremental re-review, not a fresh exhaustive audit of the entire redesign promotion. The observed SonarCloud failure and remaining pending CI checks are separate merge gates.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed 00f9b823, the sole commit since the prior Pullfrog review, including the affected transaction, repository, and undo-validation paths.

• Returned the refresh outcome: Replaced the captured bulk-skip flag with the transaction's boolean result, preserving conflict handling before mutations or saves.
• Added conflict regression coverage: Verified failed refreshes return ConcurrentUpdateConflict without saving or advancing the habit, and updated transaction mocks to the generic overload.
• Made split loading explicit: Added AsSplitQuery to undo-preview validation, consistent with the repository's existing query behavior.

Verification: all 5,453 Application tests and 3,309 Infrastructure tests passed, with no failures or skips. The working tree is clean. To keep this re-review focused on the requested incremental changes, I read the complete three-file commit diff and its full-PR hunks rather than repeating an exhaustive audit of the unchanged redesign promotion. Several CI checks were still pending when inspected; this approval does not certify those gates.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the merge commit ff1fed1f since the prior Pullfrog review, including its complete three-file first-parent diff and the mutation workflow's current full-PR hunks.

• Merged mutation sharding: Applied the two Domain shards to PR runs, preserving the complete configured Domain mutation scope and passing each pattern as a separate --mutate argument.
• Preserved base-branch comparison: Retained github.base_ref for PR fetches and Stryker comparison while adding CPU-based concurrency; nightly execution remains independent of a PR base.
• Imported analyzer package centralization: Carried main's analyzer-test package configuration unchanged, including its transitive cryptography pin.

Verification: all 12 workflow shell-argument cases passed across the four matrix entries, both PR bases, and nightly execution. The harness stubbed Git fetch and Stryker; it did not run mutation testing. All 32 analyzer tests passed with no failures or skips. The working tree is clean.

This review deliberately follows the requested incremental scope rather than repeating an exhaustive audit of the unchanged redesign promotion. No API runtime or contract code changed; several CI gates were still queued when inspected.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
170 New issues
0 Accepted issues

Measures
0 Security Hotspots
89.0% Coverage on New Code
1.2% Duplication on New Code

See analysis details on SonarQube Cloud