Outstanding work tracker (post-Wave-10)

[Davidslv]

Follow-up to #2 (closed). Captures only the work that is actually still pending.

Source-of-truth for "done" is the repo state on main, not prior checklists.

Progress as of 1cca764: Phase 1 + Phase 2 + Phase 3 + Phase 4A + Phase 5A/5B + 5D-CI + Phase 6 quality gates (the parts that do not need live infrastructure) + Wave 11 all shipped. Remaining: Phase 4B (Admin — deferred), Phase 5D regeneration (manual), Phase 6 manual ops (Stripe test mode + Docker build), Phase 7 (launch). See § Closed since this tracker was opened at the bottom for the full receipts.

---

Phase 1 — gem foundation — DONE

1.5 seams:install

• Auto-add gem "seams" to host Gemfile — 7e4922b
• script/collate_coverage.rb — 7e4922b
• script/run_affected_tests.sh — 7e4922b
• doc/ARCHITECTURE.md template generated into the host — 7e4922b

1.6 generic seams:engine

• Template app/models/<name>/application_record.rb — 55ed7ea
• Template config/locales/en.yml — 55ed7ea
• Template Gemfile — 55ed7ea
• Template Rakefile — 55ed7ea
• Template per-engine test/dummy/ (uses DummyAppWriter) — 55ed7ea

1.7 seams:remove

• Generate drop-table migration for all <name>_* tables — 8b452e5
• Run bundle install after removal — fa89db6

1.8 CLI commands

• lib/seams/cli.rb top-level aggregator class — 6b7e181
• seams:list reports inter-engine dependencies — 6b7e181 (subscribes / depends-on lines parsed from each engine's Publisher.subscribe calls)
• seams:test --changed (rake task seams:test:changed) — 6b7e181 (resolves merge-base via git, falls back to all-engines on shallow clones)
• seams:quality aggregation (rake task seams:quality:all) — 6b7e181 (RuboCop + Brakeman + bundler-audit + SimpleCov collation)

---

Phase 2 — Auth + Notifications

2A Auth — DONE

• Per-engine dummy app with User + Authenticatable + ActionCable + ActionMailer — f920d94
• Factories (sessions, oauth_providers, api_tokens, users) — f920d94
• Full spec coverage (model, service, controller, request, mailer, contract) — f920d94
• Verify generated auth engine boots, login flow works end-to-end — f920d94

2B Notifications — DONE

• Notifications::TypeRegistry — ac01613
• --channels generator flag — ac01613
• HTML + text variants in NotificationMailer — 3367a0b
• Mailer layout view — 3367a0b
• Auto-enable ActionCable + ActionMailer in host app — Rails 8 default; documented in README
• Per-engine dummy app — 31c8596
• Factories — 31c8596
• Full spec coverage — 31c8596 + 3367a0b
• Verify bell partial actually renders + ActionCable broadcasts — 3367a0b

2C integration

• Verify auth + notifications work together in a fresh Rails app — 5492a66 (integration_full asserts the canonical user.signed_up.auth event creates a Notifications::Notification row via the AuthSubscriber)

---

Phase 3 — Billing — DONE

3A Billing engine — service-object refactor

• --gateway generator flag — 8ea9d69
• Billing::ServiceResult value object — 8ea9d69
• Billing::StripeService base class — 8ea9d69
• Billing::Customers::FindOrCreateService — da15c37
• Billing::Subscriptions::CancelService — da15c37
• Billing::Subscriptions::ChangePlanService — da15c37
• Billing::Subscriptions::ReactivateService — da15c37
• Billing::Invoices::SyncService — da15c37
• Billing::Webhooks::EventRouter — 38a5caf
• Billing::Webhooks::ProcessEventJob — 38a5caf
• 12 webhook handler classes (now 13, including LTD checkout fork) — 38a5caf
• Billing::SubscriptionsController — 926db77
• Per-engine dummy app — pre-existing
• spec/support/stripe_helpers.rb — 8ea9d69
• spec/fixtures/stripe/events/*.json — 8ea9d69 (13 fixtures)
• Full spec coverage including gateway contract shared_examples — 926db77
• Factories — 8ea9d69
• Verify Stripe Checkout flow works in test mode — 926db77 (README walkthrough)

3A scope review — decisions taken

• ❌ Billing::Customer model — deferred (ref-only).
• ❌ Billing::LineItem model — deferred.
• ❌ Billing::Payment model — deferred.
• ✅ Billing::InvoicesController — shipped in 926db77.
• ✅ Billing::CurrencyHelper — shipped in 8ea9d69.

3B integration

• Verify billing + auth + notifications work together in a fresh Rails app — a568aca (integration_full asserts invoice.paid.billing → BillingSubscriber → Notifications::Notification(template: billing/invoice_paid))

---

Phase 4 — Teams + Admin

4A Teams

• --with generator flag (invitations / roles) — 1763da0
• Account scoping helper (Current.team — pairs with Core's TenantScoped) — 1763da0 (Teams::AccountScoped concern)
• Views: team list, team settings, members table, invitations list — 656e9b5
• Per-engine dummy app — pre-existing (DummyAppWriter)
• Factories — 1763da0 (team / membership / invitation / host User)
• Full spec coverage — 1763da0 + 656e9b5 (model specs + factories + 12 new generator specs)
• Verify teams engine boots and lifecycle works end-to-end — 656e9b5 (integration_full asserts Team.create + Membership.create + team.created.teams event in the host)

4B Admin engine — deferred decision

Earlier scope decision: drop the Admin engine, use ActiveAdmin or Avo. No work planned unless the decision is reversed.

• seams:admin generator
• Admin::AdminUser model + admin_users migration
• Auth::AdminUser on a separate auth_admin_users table
• Admin::Administrable concern
• Admin::DashboardController
• Admin::UsersController
• Admin::SessionsController with impersonation
• --with=impersonation flag
• Tailwind layout with sidebar
• Views (dashboard, users, shared partials)
• Routes
• Config (role_method, impersonation_enabled)
• Per-engine dummy app + specs
• Verify admin engine boots, dashboard renders, impersonation works

4C integration

• Verify all 5 (or 6 with admin) engines work together in a fresh Rails app
• Verify admin dashboard reads from auth + billing + teams + notifications via defined?() guards
• Verify team-scoped billing

---

Phase 5 — infrastructure + reference app

5A CI

• Verify generated .github/workflows/ci.yml is structurally valid — 1cca764 (parses as YAML, declares the four required jobs, runners pinned to ubuntu-latest, every action pinned to a major version). Real act / PR run remains a manual one-off check

5B deployment

• Verify the generated Dockerfile builds successfully with multiple engines

5D reference example app

• CI on the example repo runs the full pipeline on every push — already in place at https://github.com/Davidslv/seams-example/.github/workflows/ci.yml (push + pull_request triggers)
• Once the canonical generator flags exist, regenerate the example with: seams:engine billing --gateway=stripe, seams:engine notifications --channels=in_app,email, seams:engine teams --with=invitations,roles, seams:engine admin --with=impersonation

---

Phase 6 — quality gates

6A full integration test suite

• Login flow works in the integration test — f920d94 (auth_login_flow_spec runs inside the integration_full pipeline via the engines/auth/spec/runtime glob)
• Bell partial renders + ActionCable broadcasts — 3367a0b (notifications_bell_broadcast_spec runs in integration_full via the engines/notifications/spec/runtime glob, asserts broadcast_to with the right payload)
• Stripe Checkout flow works against test mode — manual operator step; full walkthrough documented in the Billing engine README ("Verifying the Stripe Checkout flow against test mode" section, 926db77)
• Admin dashboard renders cross-engine — blocked on the deferred Phase 4B Admin-engine decision
• Cross-engine events fire end-to-end — 5492a66 (auth signup → Notification) + a568aca (billing invoice → Notification) + 656e9b5 (team.created → subscriber)
• seams:list shows correct dependencies — 6b7e181 (parses each engine.rb for Publisher.subscribe calls and emits depends-on lines)
• seams:test:changed detects changes correctly — 6b7e181 (resolves merge-base via git, falls back to all-engines on shallow clones)
• seams:quality:all produces a valid aggregated report — 6b7e181 (RuboCop + Brakeman + bundler-audit + SimpleCov collation, prints unified summary)
• Generated CI pipeline YAML is valid — 1cca764 (paired with 5A)
• Docker build succeeds with all engines — manual operator step (Dockerfile structural checks shipped in 1cca764; real docker build requires a Docker daemon)

---

Phase 7 — launch

• Publish to RubyGems (free tier: core + auth + notifications)
• Pro-tier engines gated behind a licence-key check
• Stripe Checkout for licence purchases on davidslv.uk/seams
• Marketing page with feature comparison, pricing, demo video
• Newsletter announcement
• LinkedIn post
• Reddit r/rails post
• Dev.to article
• Update Modular Rails book page to reference Seams
• Update Davidslv/ruby-architecture issue Audit findings — full fix list (round-7 reviewers) #3 (launch plan)

---

Wave 11 — PII encryption + GDPR — DONE

• Auth::User: encrypts :email, deterministic: true, downcase: true — 5dd68c0
• Auth::OAuthProvider: encrypts :provider_uid, deterministic: true — 5dd68c0
• One-shot seams:auth:rotate_pii_encryption rake task — 5dd68c0
• Generator spec coverage — 5dd68c0
• Integration spec round-trip — 5dd68c0
• README "GDPR / data protection" section — 5dd68c0
• (deferred) Auth::ExportUserData service for Article 15 / 20 portability

---

Closed since this tracker was opened

Commit	Phase / Wave	Scope
5dd68c0	Wave 11	PII encryption + GDPR README
f920d94	Phase 2A finish	Auth factories + spec coverage
31c8596	Phase 2B (1/3)	Notifications dummy app + factories + model specs
ac01613	Phase 2B (2/3)	TypeRegistry + --channels flag
3367a0b	Phase 2B (3/3)	HTML+text mailer variants + bell broadcast spec
8b452e5	Phase 1.7	seams:remove drop-table migration
7e4922b	Phase 1.5	Install gaps (gem + scripts + ARCHITECTURE.md)
8ea9d69	Phase 3 (1/4)	ServiceResult + StripeService + --gateway + CurrencyHelper + factories + 13 fixtures
da15c37	Phase 3 (2/4)	5 service objects + 4 new Stripe::Client endpoints
38a5caf	Phase 3 (3/4)	Webhook router refactor — Handler base + EventRouter + ProcessEventJob + 13 handlers
926db77	Phase 3 (4/4)	Subscriptions/Invoices controllers + gateway contract shared_examples + README
55ed7ea	Phase 1.6	Generic engine: ApplicationRecord + locales + Gemfile + Rakefile + dummy app
6b7e181	Phase 1.8	CLI aggregator + seams:test:changed + seams:quality:all + seams:list deps
fa89db6	Phase 1.7 follow-up	seams:remove runs bundle install --quiet after removal
5492a66	Phase 2C integration	rails_new_spec asserts user.signed_up.auth → AuthSubscriber → Notifications::Notification
a568aca	Phase 3B integration	rails_new_spec asserts invoice.paid.billing → BillingSubscriber → Notifications::Notification
1763da0	Phase 4A (1/2)	Teams --with flag + AccountScoped concern + factories
656e9b5	Phase 4A (2/2)	Teams views + lifecycle integration verification
1cca764	Phase 5A + 5B + 5D-CI	Static verification of generated CI YAML + Dockerfile; confirmed seams-example CI exists

Closed earlier (pre-#5, kept for traceability)

• Auth API tokens (ApiToken model, GenerateApiToken, ApiAuthenticatable) — Wave 10
• Rate limiting (SessionsController 10/min, RegistrationsController 5/hr, PasswordResetsController 5/hr) — Wave 10
• CleanupExpiredSessionsJob + Auth::ApplicationJob — Wave 10
• Engine registry events: api_token.issued.auth, api_token.revoked.auth — Wave 10