Rebuild Dispatch with shared services and private DSP state

.github/pull_request_template.md

@@ -1,2 +1,8 @@
-Describe the resulting behavior and relevant verification. Identify Core, DSP and
-plugin changes, compatibility requirements, and any migration steps.
+Describe the problem and resulting behavior.
+
+Validation:
+
+- Typecheck, service tests, artifact build, and UI checks
+- State whether native browser/provider behavior was exercised
+
+This repository does not deploy on merge. Live setup is a separate operator action.

.github/workflows/checks.yml

@@ -4,41 +4,32 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+permissions:
+  contents: read
 concurrency:
   group: platform-checks-${{ github.ref }}
   cancel-in-progress: true
-permissions:
-  contents: read
 jobs:
   platform:
     runs-on: ubuntu-24.04
-    timeout-minutes: 40
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: 22
+          node-version: 22.23.2
           cache: npm
-          cache-dependency-path: |
-            core/dashboard/package-lock.json
-            dsp/dashboard/package-lock.json
-            dsp/tooling/frontend/package-lock.json
-      - uses: ./.github/actions/prepare-test-host
-      - run: npm run bootstrap -- "$RUNNER_TEMP/platform"
-      - run: npm run check -- "$RUNNER_TEMP/platform"
-      - run: npm run build -- "$RUNNER_TEMP/platform"
-      - run: npm test -- "$RUNNER_TEMP/platform"
-      - run: npm run test:integration -- "$RUNNER_TEMP/platform"
-      - name: Verify updates in browser
-        run: |
-          cd "$RUNNER_TEMP/platform/core/dashboard"
-          npx playwright install --with-deps chromium
-          npx playwright test --config playwright.updates.config.cjs
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - run: npm ci --ignore-scripts
+      - run: npm run check
+      - run: npm run format:check
+      - run: npm test
+      - run: npm audit --omit=dev --audit-level=high
+      - run: npm run build
+      - run: npm run test:artifact
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:ui
+      - name: Remove temporary verification data
         if: always()
-        with:
-          name: verification
-          path: /tmp/dispatch-updates-browser
-          retention-days: 7
+        run: node tooling/clean-test-output.mjs

.gitignore

@@ -1,11 +1,17 @@
 node_modules/
-__pycache__/
-*.pyc
+.build/
+.runtime/
 .env
 .env.*
-playwright-report/
+!.env.example
+*.sqlite*
+*.db
+*.db-*
+*.key
+*.pem
+*.log
+coverage/
 test-results/
-core/dashboard/public/assets/frontend.js
-core/dashboard/public/assets/styles.css
-dsp/dashboard/public/assets/frontend.js
-dsp/dashboard/public/assets/styles.css
+playwright-report/
+*.tsbuildinfo
+.DS_Store

.prettierignore

@@ -0,0 +1,5 @@
+node_modules/
+.build/
+integrations/paycom/provider/
+package-lock.json
+docs/design/

.prettierrc.json

@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100
+}

DEVELOPMENT.md

@@ -1,35 +1,67 @@
 # Development
 
-Use Node 22/24, npm, Python 3 and Linux. Build in a new directory outside source:
-
-```sh
-npm run bootstrap -- /absolute/build/workspace
-npm run check -- /absolute/build/workspace
-npm run build -- /absolute/build/workspace
-npm test -- /absolute/build/workspace
-npm run test:integration -- /absolute/build/workspace
-```
-
-Bootstrap assembles portable Core and DSP source trees, copies top-level plugins
-into the DSP build workspace, merges shared UI source with each product's owned
-entry points, and installs locked compiler dependencies plus versioned SDK copies.
-These assembled trees are disposable, not additional source repositories. After
-editing source, bootstrap a fresh workspace before final verification.
-
-DSP browser collector tests need trusted Chrome, Xvfb, setpriv and X11 libraries;
-the hosted checks prepare these on an isolated runner. Tests use synthetic data.
-
-Use feature branches and PRs. The owner authorizes autonomous PR creation and
-merging after review and successful checks. Publication and installation remain
-separate. See RELEASES.md. Never develop in live/ or installed DSP directories.
-
-After building both dashboards, run plugin previews from the assembled Core tree:
-
-```sh
-/absolute/build/workspace/core/bin/dispatch create plugin sample-notes
-/absolute/build/workspace/core/bin/dispatch plugin dev /absolute/plugin/source
-```
-
-The preview serves each synthetic DSP's DSP dashboard and uses independent test
-accounts/state. An external DSP dashboard can be supplied through the explicit
-DISPATCH_DSP_DASHBOARD development setting. Production always uses release receipts.
+## Start and stop
+
+`npm run dev` seeds three synthetic DSPs, starts the API on loopback 5180, and
+starts Vite on loopback 5173. The permanent Dev DSP uses Preview’s separate job
+database and browser manager. In this convenient local mode, both environments
+run the current source. Testing two different artifacts uses the separate
+Preview process and gateway, exercised by the operations and artifact tests.
+
+No npm command installs a system service, changes a proxy, opens a public port,
+reads archived credentials, or changes the future live directories.
+`npm run build` writes only `.build/` inside this repository. It bundles API and
+worker code, installs locked production dependencies into the artifact, and
+writes a complete SHA-256 inventory. It does not activate the artifact.
+
+Use Ctrl+C to stop `npm run dev`. Remove its explicitly selected fixture state
+directory only after the process exits. The browser verification scripts remove
+their own temporary state automatically; `tooling/clean-test-output.mjs` removes
+the known screenshots and reports. Do not remove unrelated `/tmp` entries.
+
+## Workflows to exercise
+
+1. Sign in as the platform owner. Search DSPs and open Northline Logistics.
+2. Browse employees, search by name/code, open an employee, and inspect timecards.
+3. Open Connections, save synthetic Paycom credentials, and collect data.
+4. Use password `require-verification` to exercise the owner verification flow;
+   fixture code is `123456`. `invalid-password` exercises a failed connection.
+5. Enable a daily schedule in the DSP’s timezone. Check Jobs for completion.
+6. Create a DSP, generate an owner invitation, accept it, and test owner/manager/
+   member boundaries. Development mail is written privately to
+   `local/platform/development-mail` inside the selected fixture state root.
+7. Suspend and resume a DSP. The permanent Dev DSP cannot be suspended.
+8. Import a build into a disposable state root with the CLI and inspect Releases.
+   Deployment controls remain disabled unless an operator explicitly enables them.
+
+Browser assistance is available for real native fixture/provider sessions that
+need verification. The fast in-memory fixtures support code verification and do
+not fabricate browser screenshots.
+
+## Checks
+
+`npm test` covers account/role/CSRF boundaries, DSP view tampering, provisioning,
+invitations, reset revocation, encrypted credential binding, schedules, durable
+jobs, failed-publication preservation, artifact integrity, private-state
+preservation, backup checksums, and separate Preview routing. Native and compiled
+supervisor tests are opt-in commands because they require a built artifact.
+
+`npm run test:ui` checks the built API and dashboard together: owner login, DSP
+search, employee detail, punches, credentials, verification, collection results,
+restricted member navigation, mobile layout, and JavaScript errors.
+
+CI runs typechecking, service tests, dependency audit, the build, the compiled
+supervisor simulation, and browser checks. It has read-only repository permission.
+There is no release-publishing or deployment workflow in this rebuild.
+
+## Changes and data compatibility
+
+Update shared contracts and both producer/consumer paths together. Validate
+provider data before publication and preserve the last successful dataset on
+failure. Never accept a DSP filesystem path from a request. Provider workers
+must not receive the platform state root or vault path.
+
+Shared account schemas are controlled by the production process. Preview refuses
+to migrate that shared database. Shared authentication, routing, or account-schema
+changes require an isolated full-platform staging run before promotion. A Dev
+DSP alone cannot validate a replacement for the gateway currently routing to it.