Plan: Tier 1 Review Remediation (2026-04-19)

Write this plan as .adoc at the path above.

Add to nav.adoc under Active: * Tier 1 Review Remediation

Create a parent GitLab epic (or reuse an existing one linked to milestone %1).

Create one GitLab issue per remaining step (Steps 2–9). Each:

glab mr update 81 --label "feat,craig-web,P2-medium"

glab mr update 83 --label "docs"

For each of #176, #182, #183, #184, #185, #186, #187: glab issue update N --milestone "2026 Q2 — Close Active Plans" (verify exact name via glab api …​/milestones?state=active)

Add pub const CRAIG_SERVICES: &[&str] = &[…​] to docker.rs (9 entries, match the existing).

Remove local CRAIG_SERVICES from devstack.rs:21 and cmd/dev.rs:10; replace uses with crate::docker::CRAIG_SERVICES.

In check_docs.rs:110 replace child.stdin.as_mut().unwrap().write_all(&curl.stdout)?; with child.stdin.as_mut().context("sha256sum stdin not available")?.write_all(&curl.stdout)?; (add anyhow::Context to imports if missing).

In devstack.rs:94 Err branch of check_staleness, log the error before falling through: tracing::warn!(error = %e, "staleness check failed — doing cold start");.

Extract helper (module-private):

async fn insert_with_unique_retry<F, Fut, T>(
    max_retries: usize,
    mut try_insert: F,
) -> Result<T, sqlx::Error>
where
    F: FnMut() -> Fut,
    Fut: std::future::Future<Output = Result<T, sqlx::Error>>,
{
    let mut last_err: Option<sqlx::Error> = None;
    for attempt in 0..max_retries {
        match try_insert().await {
            Ok(v) => return Ok(v),
            Err(sqlx::Error::Database(db_err)) if db_err.is_unique_violation() => {
                tracing::warn!(attempt = attempt + 1, constraint = db_err.constraint(),
                    "unique violation — retrying");
                last_err = Some(sqlx::Error::Database(db_err));
                continue;
            }
            Err(e) => return Err(e),
        }
    }
    Err(last_err.unwrap_or_else(|| sqlx::Error::Protocol("retries exhausted".into())))
}

Refactor ReportSink::Database::accept retry loop to call insert_with_unique_retry(5, || store::reports::create_report(…​input.clone())). Closure regenerates id/confirmation_code per invocation.

Add four tests:

Implement MockDbError test struct implementing sqlx::error::DatabaseError with code() → "23505" and constraint() → Some("public_reports_confirmation_code_key").

connect_database_invalid_url_returns_err — connect_database("postgres://x:y@127.0.0.1:1/db", 1, Duration::from_millis(100)) wrapped in tokio::time::timeout(Duration::from_secs(2), …​); assert Err containing "failed to connect to database".

init_auth_unreachable_issuer_returns_err — init_auth("http://127.0.0.1:1/realms/none", None); assert Err containing "failed to fetch JWKS from Keycloak".

connect_mq_invalid_url_returns_err — connect_mq("amqp://invalid:1/%2f"); assert Err containing "failed to connect to RabbitMQ".

Strengthen bootstrap_result_fields_are_public — instantiate a BootstrapResult from zeroed defaults (or equivalent) so the test actually exercises the struct rather than just compiling a field-access closure.

check_docs — factor out sha256_url and download_file behind a trait or pub(crate) fn that tests can stub. Three tests drive all three CheckDocsOutcome variants:

validate::check_preflight — refactor to check_preflight_with_probes(skip_docker, nextest_probe, docker_probe) where probes are impl Fn() → Result<()>. Two tests:

devstack — factor dispatch logic into a pure decide_action(force, markers_exist, staleness_result) → StartAction enum (ColdStart, AlreadyCurrent, ContainersDown, CachedRebuild, NoCacheRebuild, VolumeWipe). Unit-test all 6 variants. IO in ensure_ready stays.

craig-test-lib::ports_env_overrides — tests with tempfile::tempdir():

Add cargo xtask dev restart-service <name>:

Add tests/e2e/lib/helpers.ts::restartCraigWebAndWait() — shells out to cargo xtask dev restart-service craig-web via child_process.execFileSync and returns after the devstack health-check clears.

Add auth-cookies.spec.ts with four tests:

concurrent reports receive distinct confirmation codes (public-report.spec.ts): use Promise.all([…​5 submits…​]), collect confirmation codes from responses, assert all 5 unique and match /^RPT-\d{8}-[A-F0-9]{4}$/. Proves !92’s retry loop works under parallel load.

empty case dropdown on /placement/new shows no-data state (placement.spec.ts): navigate as a user predicted to have 0 open cases. If seed provides at least one such case for the chosen user, test.skip() with a clear comment. Otherwise assert dropdown has only the placeholder option or shows a "No cases assigned" message.

partner with no agreements shows empty state (exchange.spec.ts): use the fixture partner created by the existing create exchange partner test (which starts with zero agreements) or create fresh, navigate to its detail page, assert empty-state copy instead of a table or error.

Reconcile Rules Engine endpoint count: count actual #[utoipa::path] occurrences in services/craig-rules/src/api/ and update whichever doc diverges (CLAUDE.md says 9; services.md says 10). Scan other Phase Status rows while touching CLAUDE.md.

Run Plan Completion Audit per .claude/docs/delivery-protocol.md — spawn a subagent to verify every acceptance criterion + doc update + issue closure with commit SHAs.

Update this plan’s Status table — all steps Complete.

Move nav entry from Active → Archive; add row to archive.adoc under Code Quality.