- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
DB); auth.spec redirect test asserts outright under the flag; non-admin
/admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
(no literal in tree), failure echoes artifact path, dev-guide documents the
gate, stale verify-release comment fixed
Durable @next integration-line publish: on next pushes, compute <patch+1>-next.<pipeline#> prerelease versions (in-CI, uncommitted) and publish @mosaicstack/* under the next dist-tag; gateway image sha-only on next. Strict guardrails: next-only, never writes latest, never tags from next; main path unchanged. PR-event CI 1631 fully green + review-of-record APPROVE (head b1a887a2). Guardrails independently verified.
Co-Authored-By: Claude Opus 4.8 <[email protected]>