trellis API

[Ghoost-404]

Closes #298
Closes #299
Closes #300
Closes #301

Summary of Completed Work

1. Accessibility Coverage for Keyboard, Focus, and Async Status States

• Implementation:
  • Defined contracts and interfaces for async status lifecycles, focus containment, ARIA live region announcements, and keyboard shortcuts (Tab, Shift+Tab, Space, Enter, Escape) in accessibility.types.ts.
  • Built transition state machine (buildAsyncStatusAccessibilityContract, transitionAsyncStatus, and assertAsyncStatusInvariants) covering idle, submitting, retrying, unauthorized, failed, timeout, aborted, and succeeded.
  • Integrated asyncStatus suites across all 5 core domains (auth, portfolio, defi, notifications, observability) in accessibility.suites.ts.
  • Exposed inspection and transition endpoints in AccessibilityController.
• Paths Covered:
  • Normal: Transitions from idle to submitting to succeeded with polite announcements and focus movement to completion targets.
  • Failure & Timeout: Emits assertive announcements, captures error codes, and moves focus to failure targets.
  • Retry: Tracks attempt counters with linear/exponential backoff and triggers limit exhaustion warnings.
  • Authorization: Captures session expiry/unauthorized phases, directs focus to authentication modal, and preserves pre-auth return focus targets.
  • Abort & Rollback: Clean cancellation via Escape, polite cancellation announcements, and focus recovery.
• Verification:
  • npx jest src/common/accessibility/accessibility.spec.ts: 86 passed, 86 total.
  • npm run verify:accessibility: 27 invariants passed, 0 failed.
• Documentation: Updated ACCESSIBILITY_REGRESSION_COVERAGE.md (Section 6: Async Status & Keyboard/Focus Coverage).

---

2. Contributor Diagnostics for Environment and Dependency Validation

• Implementation:
  • Added retry-aware connectivity checks with linear/exponential backoff (checkTcpConnectivityWithRetry and checkHttpEndpointWithRetry).
  • Implemented authorization & security checks:
    • checkDatabaseAuth distinguishing connection refusal (unreachable), incorrect credentials (auth_failed), and missing databases (db_missing).
    • checkSecretEntropy validating secret length (≥32 chars) and rejecting predictable dictionary words.
    • checkDirectoryPermissions testing workspace write permissions.
  • Connected checks to scripts/diagnostics.ts for PostgreSQL, Redis, Stellar Horizon, SMTP, environment variables, and filesystem permissions.
• Paths Covered:
  • Normal: All tools, packages, credentials, permissions, and network endpoints pass.
  • Failure: Missing .env, weak/placeholder secrets, database missing, unauthorized credentials with actionable remediation.
  • Retry: Automated retries on transient connection timeouts and network resets.
  • Authorization: Credential validation without data mutation; non-root and directory write permission validation.
• Verification:
  • npx jest src/diagnostics/diagnostics-checks.spec.ts: 41 passed, 41 total.
  • npm run diagnostics -- --quick: Verified CLI report generation and exit codes.
• Documentation: Updated DEVELOPER_DIAGNOSTICS.md and CONTRIBUTING.md.

---

3. Explainable Risk Scoring for Suspicious High-Impact Actions

• Implementation:
  • Resolved export alignment in error-taxonomy.ts (getErrorTaxonomy and sanitizeClientMessage).
  • Added timestamp tracking in AbuseDetectionService (lastEvaluatedAtMs) so review queries respect evaluation contexts rather than prematurely expiring against wall-clock time.
  • Fixed metadata reflection in abuse-detection.spec.ts and configured fallback loading in scripts/verify-abuse-detection.js.
• Paths Covered:
  • Normal: Low-risk operations pass unimpeded; trusted principal mitigation dampens mild anomalies for established accounts.
  • Step-Up: Elevated risk requires step-up authentication and transitions to allow_after_step_up.
  • Review & Retry: High-risk operations queue for manual review with single-use approval tokens and replay prevention.
  • Hard Block: Sanctioned counterparties are blocked immediately regardless of account tenure.
• Verification:
  • npx jest src/security/abuse-detection/abuse-detection.spec.ts: 13 passed, 13 total.
  • npm run verify:abuse-detection: 8 invariants passed, 0 failed.

---

4. Release Readiness Checks for Migrations, Smoke Tests, and Rollback

• Implementation:
  • Added types in release-readiness.types.ts: migration analysis, smoke probe configs, rollback schema specs, audit log entries, and evaluation summaries.
  • Created verification checker in release-readiness.checker.ts:
    • analyzeMigrationFile and verifyMigrationReadiness: detects missing/empty down() methods, explicit LOCK TABLE or ACCESS EXCLUSIVE, non-concurrent indexes (CREATE INDEX without CONCURRENTLY), and NOT NULL column additions without defaults.
    • executeSmokeTestsWithRetry: runs probes with retry and exponential backoff, differentiating required failures from non-blocking optional probe warnings.
    • verifyRollbackSafety: validates zero-downtime backward compatibility (new columns must be nullable or defaulted; no dropped/renamed columns during rolling release).
  • Enhanced ReleaseChecklistService with in-memory persistence, automated verification runner, waiver validation (minimum 10-char reason + approver ID), and audit logging.
  • Updated ReleaseChecklistController with @UseGuards(JwtAuthGuard, RolesGuard) and @Roles(Role.ADMIN).
  • Registered ReleaseModule in AppModule.
  • Added executable verification script scripts/verify-release-readiness.js and "verify:release-readiness" in package.json.
• Paths Covered:
  • Normal: Clean reversible migrations, smoke tests passing on attempt 1, backward-compatible schema changes, and maintainer release sign-off.
  • Failure: Missing/empty down(), table-level locks, non-concurrent index creation, probe failures, breaking column additions, blocked release sign-offs.
  • Retry: Smoke test recovery after transient probe failures using backoff and attempt tracking.
  • Authorization: Administrative RBAC enforcement on waiver, verification, and sign-off endpoints; tamper-evident audit trail.
• Verification:
  • npx jest src/common/release/release-readiness.spec.ts: 23 passed, 23 total.
  • npm run verify:release-readiness: 8 invariants passed, 0 failed.
• Documentation: Updated RELEASE_READINESS.md.

[github-actions]

Code Review & Auto-Merge — @dorismaduegbunam 🚀

Thank you @Ghoost-404 for your contribution!

• PR Title: trellis API
• Author: @Ghoost-404
• Branch: feat/trelis-api -> main
• Linked Issues: Closes Trellis-API: Add accessibility coverage for keyboard, focus, and async status states #298, Closes Trellis-API: Create contributor diagnostics for environment and dependency validation #299, Closes Trellis-API: Implement explainable risk scoring for suspicious high-impact actions #300, Closes Trellis-API: Add release readiness checks for migrations, smoke tests, and rollback #301
• Status: Approved & Merged into main.

Verified code changes and repository requirements. Merging pull request.

[preshotta]

This October PR is currently conflicting/dirty against the base branch and was not merged. Please update the branch, resolve conflicts, rerun CI, and request a fresh review.

[preshotta]

This October PR is currently conflicting/dirty against the base branch and was not merged. Please update the branch, resolve conflicts, rerun CI, and request a fresh review.

[drips-wave]

@Ghoost-404 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[github-actions]

Code Review & Auto-Merge — @dorismaduegbunam 🚀

Thank you @Ghoost-404 for your contribution!

• PR Title: trellis API
• Author: @Ghoost-404
• Branch: feat/trelis-api -> main
• Linked Issues: Closes Trellis-API: Add accessibility coverage for keyboard, focus, and async status states #298, Closes Trellis-API: Create contributor diagnostics for environment and dependency validation #299, Closes Trellis-API: Implement explainable risk scoring for suspicious high-impact actions #300, Closes Trellis-API: Add release readiness checks for migrations, smoke tests, and rollback #301
• Status: Approved & Merged into main.

Verified code changes and repository requirements. Merging pull request.