Block a user
Rate-limited API responses (429) carry no CORS headers — browser masks them as CORS errors
Rate-limited API responses (429) carry no CORS headers — browser masks them as CORS errors
Resolved in spikersoft-backend PR #50 (merged to master). UseCors now runs before response caching and both rate limiters, so 429s carry Access-Control-Allow-Origin instead of masquerading…
/blog crashes with uncaught exception when the posts API is unreachable
/blog crashes with uncaught exception when the posts API is unreachable
Resolved in spikersoft-angular PR #90 (merged to master). BlogListComponent.loadBlogPosts() subscribes with a no-op error callback; the service's errorSignal drives the retry UI. Anonymous…
/ai renders blank for anonymous visitors — app-root stays visibility:hidden
/geography crashes on anonymous load — uncaught exception, component body never mounts
/ai renders blank for anonymous visitors — app-root stays visibility:hidden
Resolved in spikersoft-angular PR #90 (merged to master). Not an app bug — zero-height host-element false positive; the walk now asserts app-root attached + mat-toolbar.main-toolbar…
/geography crashes on anonymous load — uncaught exception, component body never mounts
Resolved in spikersoft-angular PR #90 (merged to master). loadInitialData() now catches API failures (snackbar + graceful degrade) and loadInterests() subscribes with an error handler.…
Decompose project knowledge into Cursor rules, skills, and AGENTS.md guardrails
[Epic] Full-coverage Playwright E2E walk of the Angular app with live Jaeger + Seq telemetry
Phase sub-issues + status
[E2E P8] Coverage gate — route-manifest report in CI, ratchet to 100%
[E2E P7] Realtime & media flows
[E2E P6] Staff/Admin surfaces
[E2E P3] Registration & verification flow (email code + Twilio SMS hook)
[E2E P5] Parent & family flows
[E2E P4] Authenticated core journeys
[E2E P2] data-testid selector convention across walked components
[E2E P1] Anonymous walk — every public route + primary actions
[E2E P0] Harness & telemetry foundation
GET /api/interests requires auth but the public /geography page calls it anonymously (401)