Commit 3c744ed
authored
phase 0: brainstorm, plan, scaffold, and audit (#3)
* phase 0 brainstorm: resolve hosting decisions, cascade to specs and briefs
The four open questions in the technical design's section 13 are now
resolved on 2026-05-09:
* Hosting domain: meridian-demo.pages.dev (Cloudflare default).
* Backend host: Fly.io free tier with auto-stop on idle and auto-start
on first request, not a VPS plus systemd.
* Demo symbol set: AAPL, SPY, NVDA, TSLA, GOOG.
* Audit log on the live demo: WebSocket-only, in-memory ring buffer,
not persisted to disk.
Section 13 of the design spec now records these as resolved decisions.
The Phase 9 frontend gains an explicit cold-start "engine warming up"
state for the Fly auto-wake window (5 to 15 seconds). Phase 10 moves
from VPS plus systemd to Fly Dockerfile plus fly.toml; the window-cost
estimate drops from 85 percent to 75 percent accordingly. The CLI
meridian-replay --audit flag is unaffected, since that flag is for
offline diffing against the Python reference, not for the live demo.
Cascading edits propagate the new stack through SPEC.md, STATUS.md,
README.md, GETTING-STARTED.md, the design spec sections 2.3, 3, 5.3,
5.5, 9, 11, and 13, and the briefs for the PM (00), Engine Developer
(03), Security Engineer (08), DevOps Engineer (09), Performance Engineer
(12), and Observability Engineer (14).
STATUS.md flips Phase 0 to in_progress as part of opening the phase.
* phase 0: write rolling implementation plan at docs/plan.md
The plan is the PM session's per-phase source of truth, complementing
STATUS.md (which is the simpler "which phase is next" pointer). Each
phase block covers: goal, status, window cost, inputs, outputs,
dispatch order, high-level tasks, exit criteria, and risks. Phase 0 is
fully detailed because it is in flight; Phases 1 through 11 are at
medium grain and will be expanded with bite-sized-step companion plans
under docs/superpowers/plans/ when each phase opens.
Decisions and constraints from the 2026-05-09 brainstorm and the
design spec section 13 are reflected throughout: meridian-demo.pages.dev,
Fly.io free tier with cold-start UX requirement, five-symbol demo
(AAPL, SPY, NVDA, TSLA, GOOG), in-memory WebSocket-only audit log on
the live demo, Phase 10 window cost reduced to ~75 percent.
The plan also lists the 10 matching invariants in Phase 3 verbatim so
the property test suite has a single source of truth, and codifies the
cross-cutting testing, performance, security, documentation, and
concurrency disciplines that span phases.
* phase 0 dispatch: specialist outputs plus React 19 / Fly-serves reconciliation
The four parallel Phase 0 specialists have returned and their outputs land here in one consolidated commit.
UI/UX Designer (05):
* docs/design/tokens.md (every visual token from canonical.html, with an embedded Tailwind config block ready to drop into frontend/tailwind.config.ts).
* docs/design/wireframes.md (per-component layouts, data-component names, micro-interactions, connection state visual treatments).
Security Engineer (08):
* docs/security/threat-model.md (STRIDE on four surfaces: WebSocket endpoint, static-file serving, replay tape, build pipeline).
* docs/security/checklist.md (per-phase hardening checklist; Phase 10 Fly hardening items expanded).
* docs/security/secrets.md (FLY_API_TOKEN, CLOUDFLARE_API_TOKEN, fly secrets set, rotation procedures).
* Three [citation needed] markers in the threat model are deferred to the Citation and Fact Auditor dispatch.
DevOps Engineer (09):
* CMakeLists.txt root plus apps/{bench,replay,server}/CMakeLists.txt stubs plus tests/CMakeLists.txt. cmake -B build -S . -G Ninja configures cleanly.
* .github/workflows/ci.yml with engine matrix (clang plus gcc) and a frontend job. Caches keyed on toolchain plus pnpm-lock.yaml.
* frontend/ Vite scaffold via pnpm create vite, Tailwind 3.4, with the embedded config from tokens.md applied verbatim to frontend/tailwind.config.ts.
* .gitignore extended for .cache/, pnpm-lock.yaml.bak, and frontend/.env*.
* docs/setup-guide.md section 12.1 documents the manual GitHub branch-protection toggle.
Documentation Engineer (15):
* README.md rewritten as a Phase 0 stub with every metric and URL labeled "target" or "v1 will".
* docs/architecture.md as a 15-minute orientation for a developer new to the codebase.
* docs/setup-guide.md skeleton (DevOps fills it across phases).
* docs/adr/0001-cpp20-library-plus-drivers.md (status Accepted, dated 2026-05-09).
PM reconciliation in this commit:
* React 18 became React 19 throughout (SPEC.md, README.md, design spec sections 3 and 5.5, docs/plan.md, docs/architecture.md, agents/04-frontend-developer.md). DevOps's pnpm create vite defaulted to React 19; we accept that rather than downgrade. Vega's frontend stays on React 18; matching majors across the constellation is a non-goal.
* Design spec section 5.4 corrected: meridian-server serves WSS /ws plus /healthz plus /metrics, NOT GET / for the static React app. Cloudflare Pages owns the SPA per the section 13 resolution. The Security Engineer flagged this ambiguity and the PM resolved it. docs/architecture.md updated to match.
The Citation and Fact Auditor dispatches next; that pass resolves the three [citation needed] markers and audits README.md, docs/architecture.md, the ADR, the threat model, the design spec, and this plan.
* phase 0 audit: resolve auditor findings F1 through F4 and land the audit report
The Citation and Fact Auditor's Phase 0 pass at docs/audits/citation-audit-2026-05-09.md found 53 verified, 2 unverified, and 2 wrong claims across the Phase 0 documentation surface. The auditor resolved the three [citation needed] markers in docs/security/threat-model.md in place (uWebSockets advisory history, Fly.io free-tier wake latency, Cloudflare Pages _headers mechanism) by replacing each with a footnoted citation naming the verifying source and the 2026-05-09 verification date.
This commit lands four PM follow-ups that the auditor flagged as Phase 0 close blockers:
F1: Property-test case-count divergence. SPEC.md and design spec section 8.2 previously said "at least 1000 generated cases per CI run", while docs/plan.md and design spec section 2.3 said "10,000 generated sequences each". The two numbers serve different purposes; the docs now state both: at least 1000 cases per invariant per CI run as the continuous regression discipline, and a one-time 10,000-sequence validation pass with zero failures as the Phase 3 acceptance criterion (per section 2.3 success criteria).
F2: SPEC.md "Project summary" previously asserted "the headline 6.2M events per second number is defensible in isolation" as fact. No benchmark has run; the number was aspirational. Reframed: "the headline 6M events per second target will be defensible in isolation once measured in Phase 5." ADR 0001 quotes SPEC.md verbatim and is updated to match.
F3: GoogleTest is pinned by tag v1.15.2 in CMakeLists.txt, while threat-model.md and checklist.md required pinning by SHA, not tag. The auditor's recommendation: pin by commit SHA or by an immutable upstream release tag (release tags only; branch tags like main, master, HEAD remain forbidden because they retarget). Both the threat-model entry and the Phase 10 hardening checklist item now reflect this.
F4: Design spec section 10 repo layout previously named the frontend directory web/. CLAUDE.md, docs/plan.md, the actual scaffold, and every other doc use frontend/. Section 10 now matches; component list updated to match the wireframes (Header, Hero, Ladder, DepthChart, Tape, PerfPanel, Footer, EngineWarmingUp).
With these fixes landed and the audit report committed, the Phase 0 documentation surface is clean of unverified or wrong claims.
* phase 0: status board updated to reflect closeout state
STATUS.md "Last updated" advances and Resume notes section now describes the four-commit branch state (1ad71f3, 8862eab, 23ed376, 60a9e89), the next concrete task (user authorizes push, PM runs the standard push protocol against the first CI run), and the deferred branch-protection toggle on main. docs/plan.md Phase 0 task list is updated to mark items 4 through 6 as done with the produced commits cited; item 7 (the merge gate) remains pending until the user signals push.
The phase status itself stays at in_progress until the PR merges, per the PM brief's definition of done. The check-in protocol runs in the chat alongside this commit; the user's continue / pause / stop answer is captured in Resume notes when received.1 parent b7012e0 commit 3c744ed
50 files changed
Lines changed: 6038 additions & 102 deletions
File tree
- .github/workflows
- agents
- apps
- bench
- replay
- server
- docs
- adr
- audits
- design
- security
- superpowers/specs
- frontend
- public
- src
- assets
- tests
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
28 | 28 | | |
29 | 29 | | |
30 | 30 | | |
| 31 | + | |
31 | 32 | | |
32 | 33 | | |
33 | 34 | | |
| |||
52 | 53 | | |
53 | 54 | | |
54 | 55 | | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
55 | 62 | | |
56 | 63 | | |
57 | 64 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
25 | 25 | | |
26 | 26 | | |
27 | 27 | | |
28 | | - | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
5 | | - | |
| 5 | + | |
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
| 9 | + | |
10 | 10 | | |
11 | | - | |
| 11 | + | |
12 | 12 | | |
13 | | - | |
| 13 | + | |
14 | 14 | | |
15 | | - | |
16 | | - | |
17 | | - | |
18 | | - | |
19 | | - | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
20 | 22 | | |
21 | 23 | | |
22 | 24 | | |
23 | 25 | | |
24 | 26 | | |
25 | 27 | | |
26 | 28 | | |
27 | | - | |
28 | | - | |
29 | | - | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
30 | 32 | | |
31 | | - | |
| 33 | + | |
32 | 34 | | |
33 | 35 | | |
34 | 36 | | |
35 | 37 | | |
36 | 38 | | |
37 | 39 | | |
38 | 40 | | |
39 | | - | |
40 | | - | |
41 | | - | |
42 | | - | |
43 | | - | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
44 | 52 | | |
45 | | - | |
| 53 | + | |
| 54 | + | |
46 | 55 | | |
47 | 56 | | |
48 | 57 | | |
49 | 58 | | |
50 | 59 | | |
51 | | - | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
52 | 67 | | |
53 | | - | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
54 | 73 | | |
55 | 74 | | |
56 | 75 | | |
57 | 76 | | |
58 | 77 | | |
59 | 78 | | |
60 | | - | |
| 79 | + | |
61 | 80 | | |
62 | 81 | | |
63 | | - | |
64 | | - | |
65 | | - | |
66 | | - | |
| 82 | + | |
| 83 | + | |
67 | 84 | | |
68 | 85 | | |
69 | 86 | | |
70 | 87 | | |
71 | 88 | | |
72 | 89 | | |
73 | | - | |
74 | | - | |
75 | | - | |
76 | | - | |
77 | | - | |
78 | | - | |
79 | | - | |
80 | | - | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
81 | 98 | | |
82 | 99 | | |
83 | 100 | | |
84 | 101 | | |
85 | | - | |
| 102 | + | |
0 commit comments