# Historial (append-only) > Añadir entradas al final. No reescribir historial previo. ## 2026-08-14 — F-001 Scaffold modular monolith skeleton — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0 - Entregable: skeleton TypeScript + Fastify en project/ con boundary checker testeado; specs/F-001-scaffold completos; spec/tech.md con justificación de dependencias - Artefactos: work/artifacts/F-001/ (architect.md, implementer.md, reviewer.json, security.json, qa.json, documenter.md, leader-close.json) - Nota: el boundary checker detectó una violación real durante build (test escapando del módulo) y se corrigió moviendo los tests de composición a src/app ## 2026-08-14 — F-002 Database foundation with module-owned schemas — DONE - Gates: reviewer APPROVED, security APPROVED (con ronda de hardening), qa APPROVED, verify.sh exit 0 - Entregable: migraciones node-pg-migrate (up/down/no-op probados contra PostgreSQL 16 real), pool fail-fast, docker-compose (Postgres + Redis), convención _ documentada - Nota: security devolvió un hallazgo bajo (interpolación de identificador en DDL de tests); se mitigó con validación estricta + tests de regresión - Artefactos: work/artifacts/F-002/ ## 2026-08-14 — F-003 HTTP foundation and request context — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0 - Entregable: request_id (generado o propagado-sanitizado), logs JSON correlacionados, error envelope v2 con requestId, hook de validación parseJson (zod), server con logging inyectable - Nota: doc stage rebotó a build para escribir README (project/ está gateado a build/implementer/running); comportamiento correcto del guardrail - Artefactos: work/artifacts/F-003/ ## 2026-08-14 — F-004 Typed config and feature flags — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0 - Entregable: loadConfig fail-fast (DATABASE_URL requerido, errores solo con nombres de variables), módulo flags tras FeatureFlagProvider (default OFF, flip en runtime sin redeploy), app.flags decorado - Nota: los tests detectaron un bug real en build (case-normalization del store); corregido antes de gates con test de regresión - Cero dependencias nuevas - Artefactos: work/artifacts/F-004/ ## 2026-08-14 — F-005 Identity: register, login, sessions — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, verify.sh exit 0 - Entregable: módulo identity hexagonal (domain/application/infrastructure/api), migración 002 reversible, argon2id OWASP tras puerto PasswordHasher, sesiones opacas (solo SHA-256 del token en DB), cookie HttpOnly+Secure+SameSite=Lax, rate limit 10 fallos -> 429 + Retry-After tras interfaz, 401 idéntico anti-enumeración con timing igualado - Nota: review detectó falta de tests para COOKIE_SECURE; fix aplicado antes de aprobar el gate. Suite de migraciones F-002 actualizada a rollback completo (count:0) por tener ahora 2 migraciones - Deps nuevas: argon2, @fastify/cookie (justificadas en spec/tech.md) - Artefactos: work/artifacts/F-005/ ## F-006 — Users: profile, addresses, RBAC (closed) - Users module: profile + address CRUD (users_profiles, users_addresses, migration 004); roles on identity_users (migration 003) - RBAC: owner-or-admin via shared/auth.ts injected from composition root; authz before existence checks; SQL scoped by user_id - Identity: session-authenticator export + role in model/responses; @fastify/cookie moved to app root - Zero new dependencies; tests: unit 52 + integration 22; live smoke covered 401/403/200 paths; gates APPROVED ## F-007 — Categories module (closed) - Categories module: category tree with adjacency-list `parent_id`, globally unique slugs, SEO title/description, migration 005 (`categories_categories`). - API: public `GET /categories/tree` and `GET /categoria/:slug`; admin-only create/update/delete via shared auth injected at composition root. - Integrity: duplicate slug -> 409, self/descendant parent cycles -> 422, delete non-leaf -> 409; public URLs never require internal id. - Zero new dependencies; tests: category unit tests green, integration acceptance tests present (skipped without TEST_DATABASE_URL); gates APPROVED. - Artefactos: work/artifacts/F-007/ ## F-008 — Catalog core: products domain (closed) - Catalog module: product aggregate with states `draft`, `active`, `archived`, unique slugs, SEO metadata, migration 006 (`catalog_products`, `catalog_product_categories`). - API: public active-only `GET /productos/:slug` and `GET /products/search`; admin-only create/update via shared auth injected at composition root. - Integrity: duplicate slug -> 409, unknown category assignment -> 422; product-category assignment validates category ids without TypeScript imports from categories internals. - Domain purity: catalog domain has zero database/HTTP imports; covered by test and boundary lint. - Zero new dependencies; tests: catalog unit/domain tests green, integration acceptance tests present (skipped without TEST_DATABASE_URL); gates APPROVED. - Artefactos: work/artifacts/F-008/ ## F-009 — Brands module (closed) - Brands module: brand entity with globally unique slug, SEO metadata, migration 007 (`brands_brands`). - Catalog integration: nullable `catalog_products.brand_id`; product search supports `brandSlug` active-only filter without TypeScript imports from brands internals. - API: public `GET /marca/:slug`; admin-only brand create/update; duplicate brand slug -> 409. - Zero new dependencies; tests: product search unit green, brands/catalog integration acceptance tests present (skipped without TEST_DATABASE_URL); gates APPROVED. - Artefactos: work/artifacts/F-009/ ## F-010 — Variants, SKU/EAN and product rich data (closed) - Catalog variants: `catalog_product_variants` with globally unique SKU and optional unique EAN; admin create/update endpoints. - Rich data: `catalog_product_rich_data` stores ingredients, allergens, nutrition, nutrition provenance, organic flag/certification. - Provenance: nutrition source required for every nutrition payload; manual nutrition blocks external-source overwrite in application use case. - Scope kept tight: no OpenFoodFacts sync job, images, stock, or prices. - Zero new dependencies; tests: rich-data unit green, catalog integration acceptance tests present (skipped without TEST_DATABASE_URL); gates APPROVED. - Artefactos: work/artifacts/F-010/ ## F-011 — Product images — done (2026-08-15T14:43:57Z) - Added catalog-owned product/variant images with `catalog_product_images`. - Added image metadata: URL, alt text, ordering position and role (`main`/`gallery`). - Added storage boundary with local-first URL adapter; no CDN, upload or processing pipeline. - Added admin attach/detach/reorder endpoints and public product image serialization. - Gates: reviewer/security/qa APPROVED. - Evidence: lint, typecheck, unit tests and verify green; integration tests remain skipped without `TEST_DATABASE_URL`. ## F-012 — Search: interface plus PostgreSQL FTS — done (2026-08-15T14:53:15Z) - Split catalog search behind `ProductSearchRepository`, separate from product CRUD persistence. - Added PostgreSQL FTS adapter over product, brand and category text. - Added FTS migration indexes in `010_catalog_search_fts.js`. - Search keeps active-only public behavior, brand filtering, pagination and stable ordering. - Added structured `catalog_search` telemetry with sanitized bounded query metadata and duration. - Gates: reviewer/security/qa APPROVED. - Evidence: lint, typecheck, unit tests and verify green; integration tests remain skipped without `TEST_DATABASE_URL`. ## F-013 — Storefront shell (Next.js) — done (2026-08-15T15:33:17Z) - Added standalone Next.js storefront package under `project/storefront/`. - Added App Router layout, navigation, footer and server-rendered home page. - Added Tailwind CSS styling and frontend package scripts for lint/typecheck/build. - Added typed public API client for backend catalog endpoints, guarded with `server-only`. - Backend internals remain isolated; storefront does not import `project/src/**`. - Gates: reviewer/security/qa APPROVED. - Evidence: storefront lint/typecheck/build green; backend lint/typecheck/test green; verify green. ## 2026-08-15 — F-014 Storefront catalog pages (SSG/ISR) - Status: done. - Added storefront product/category/brand/search catalog pages with ISR and metadata/OpenGraph. - Added protected `POST /api/revalidate` for catalog paths. - Added backend `categorySlug` filtering for `/products/search`. - Gates approved: reviewer, security, QA. - Final `./scripts/verify.sh`: PASS. ## 2026-08-15 — F-015 SEO core: structured data, sitemap, redirects - Status: done. - Added Organization, Product and BreadcrumbList JSON-LD to storefront pages. - Added generated `sitemap.xml` and `robots.txt`. - Added env-backed local 301 redirect store through Next proxy. - Added public `GET /brands` for sitemap brand URLs. - Gates approved: reviewer, security, QA. - Final `./scripts/verify.sh`: PASS. ## 2026-08-15T16:17:23Z — F-016 Inventory module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: isolated inventory module with atomic stock operations, public InventoryService, PostgreSQL migration, API routes, and tests. - Evidence: work/artifacts/F-016/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T16:25:43Z — F-017 Pricing module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: server-side pricing with VAT, public PricingService, price history, API routes, migration, and tests. - Evidence: work/artifacts/F-017/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T17:32:49Z — F-018 Cart module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: authenticated cart storing product/variant/quantity only, recalculating price and stock from services. - Evidence: work/artifacts/F-018/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T17:44:59Z — F-019 Promotions v1 - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: server-side promotions with promo code validation and cart discount recalculation. - Evidence: work/artifacts/F-019/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:03:20Z — F-020 Shipping module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: server-side shipping zones/methods with free shipping threshold behind ShippingService.calculate. - Evidence: work/artifacts/F-020/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:09:18Z — F-021 Orders module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: orders module with item snapshots and explicit state machine. - Evidence: work/artifacts/F-021/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:27:55Z — F-022 Checkout orchestrator with idempotency - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: orchestrator coordinating cart, pricing, promotions, inventory, shipping, orders and stub payment; idempotency_key prevents duplicate reservations. - Evidence: work/artifacts/F-022/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:38:19Z — F-023 Payments: provider interface + Stripe + webhooks - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: PaymentProvider interface with Stripe-style adapter; signed webhook with HMAC-SHA256 and 5-min tolerance; idempotent via unique constraint. - Evidence: work/artifacts/F-023/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:48:25Z — F-024 Notifications: transactional email - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: notifications dispatch through EmailProvider port with idempotent event_id persistence. - Evidence: work/artifacts/F-024/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:51:34Z — F-025 Reviews module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: verified-purchase reviews with moderation, aggregate and one-review-per-order-item guarantee. - Evidence: work/artifacts/F-025/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T18:56:11Z — F-026 CMS module - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: simple CMS with slug routing and draft/publish states. - Evidence: work/artifacts/F-026/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T19:01:44Z — F-027 Caching layer - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: read-through cache with explicit contracts; admin/metrics routes; loader fallback when adapter fails. - Evidence: work/artifacts/F-027/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T19:28:52Z — F-028 Security hardening - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: rate limiter, audit log, admin MFA enrollment. - Evidence: work/artifacts/F-028/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T19:34:14Z — F-029 Observability - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: tracer/meter abstraction, /ops/metrics route, checkout tracing span and business metrics. - Evidence: work/artifacts/F-029/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T19:38:17Z — F-030 E2E suite - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: E2E checkout-flow test happy path + empty cart failure against real PostgreSQL. - Evidence: work/artifacts/F-030/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T20:04:26Z — F-031 Start Script Dev - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: project/scripts/start-dev.sh levanta docker, migraciones y dev server. - Evidence: work/artifacts/F-031/ - Verify: ./scripts/verify.sh passed ## 2026-08-15T20:07:20Z — F-032 Fix DATABASE_URL - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: start-dev.sh crea .env y usa npm run start. - Verify: ./scripts/verify.sh passed ## 2026-08-15T20:09:12Z — F-033 Fix npm start .env - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: start script ahora usa --env-file. - Verify: ./scripts/verify.sh passed ## 2026-08-15T22:28:37Z — F-034 Fix export vars - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: start-dev.sh exporta DATABASE_URL y NODE_ENV explicitamente. - Verify: ./scripts/verify.sh passed ## 2026-08-15T22:36:31Z — F-035 Document Caveman Architecture - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: project/CAVEMAN.md creado con arquitectura completa del proyecto. - Verify: ./scripts/verify.sh passed ## 2026-08-15T22:43:56Z — F-036 Homepage frontend - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: Next.js homepage SSR con Hero, FeaturedProducts, CategoriesGrid, BrandsSection. - Evidence: work/artifacts/F-036/ - Frontend dev: cd frontend && npx next dev ## 2026-08-15T23:08:00Z — F-037 Seed data - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: Script seed idempotente con 11 categorías, 6 marcas, 12 productos, precios, stock, shipping. - Evidence: work/artifacts/F-037/ - Command: cd project && npm run db:seed ## 2026-08-15T23:15:03Z — F-038 Category pages - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: /categories listing + /categories/[slug] detail with SSR products. - Evidence: work/artifacts/F-038/ - Backend: http://localhost:3000 - Frontend: http://localhost:3003 ## 2026-08-16T08:17:33Z — F-039 Product detail page - Status: done - Gates: reviewer APPROVED, security APPROVED, QA APPROVED - Summary: /products listing + /products/[slug] SSR with pricing (€10.83/€8.95), stock, add-to-cart. - Evidence: work/artifacts/F-039/ - Frontend: http://localhost:3003 ## 2026-08-19 — F-048 Complete migration and consolidate approved work — DONE - Gates: reviewer APPROVED, security APPROVED (upload remediation), QA APPROVED, verify.sh exit 0. - Summary: consolidación de F-029/F-030 y FIX-11..FIX-19; migraciones 024-028 compatibles y reversibles; toolchains backend/admin/frontend/storefront verdes. - Evidence: backend 124 unit tests + 56 integration tests; migration fresh up/no-op/down/up; builds Next verdes; 0 vulnerabilidades high en npm audit. - Security: `/api/upload` requiere sesión backoffice y valida tamaño, MIME, magic bytes y filename server-side. - Harness: `new_ticket.py` usa gate reviewer, soporta `--start` exclusivo y `--normalize-gates`. - Artefactos: work/artifacts/F-048/. ## 2026-08-19 — F-069 Shipping method descriptions editable in admin — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, leader-close APPROVED, verify.sh exit 0 - Entregable: descripción editable de métodos de envío end-to-end. Migración 029 (`shipping_methods.description text`); backend GET/POST/PATCH incluyen `description`; nuevo endpoint público `GET /shipping/methods?country=…&postalCode=…` (read-only, filtra active=true); admin `MethodForm` con input de descripción; storefront `CheckoutClient` consume el catálogo real y renderiza la descripción por método (array hardcodeado eliminado). - Security: `description` es `z.string().max(500)`, plain text; write path requiere admin role (sin cambios); public GET es read-only y filtra SQL-level. - Tests: backend 124 passed, 56 skipped; typecheck green en frontend/admin/backend. - Artefactos: work/artifacts/F-069/. ## 2026-08-19 — F-070 Show product attributes on frontend product detail page — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, leader-close APPROVED, verify.sh exit 0 - Entregable: los atributos del producto (bio, vegano, sin-gluten, etc.) ahora aparecen como badges en la ficha de producto del frontend. Añadido `ProductAttribute` tipo + `attributes` campo a la interfaz `Product`; mapeo de labels en español (16 valores); componente `ProductAttributes` con badges accesibles; integrado tras el `

` en `products/[slug]/page.tsx`. Backend ya devolvía atributos vía `serializeProduct` — sin cambios de backend. - Seguridad: cambio solo frontend, sin nuevas deps, sin endpoints, sin auth ni env vars; `attributes` es read-only del API existente; el componente badge no usa `dangerouslySetInnerHTML`. - Tests: `npx tsc --noEmit` exit 0, `npx eslint` en 4 archivos exit 0, `./scripts/verify.sh` exit 0. - Artefactos: work/artifacts/F-070/. ## 2026-08-19 — F-071 Editable emoji and color for categories — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, leader-close APPROVED, verify.sh exit 0 - Entregable: se añaden campos `emoji` y `color` a las categorías end-to-end. Migración 030 (`emoji VARCHAR(10)`, `color TEXT`, ambos nullable); backend domain/repository/routes actualizados; frontend CategoriesGrid y categories/page.tsx usan emoji/color almacenados con fallback a maps hardcoded; admin formulario con inputs de emoji+color y CategoryRow usa `cat.emoji ?? 📁`; storefront pagina de categoría muestra el emoji. Backend rebuildado y reiniciado; PATCH /categories/:id con emoji+color verificado → HTTP 200. - Seguridad: 2 columnas nullable sin migración de datos; validación zod (emoji max 10, color max 200); color se renderiza como className (sin dangerouslySetInnerHTML). - Tests: typecheck green en backend/frontend/admin/storefront; eslint exit 0; verify.sh exit 0. - Artefactos: work/artifacts/F-071/. ## 2026-08-19 — F-072 Active tax rates listed in product edit prices tab — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, leader-close APPROVED, verify.sh exit 0 - Entregable: PricingSection ahora carga dinámicamente los tipos impositivos activos desde GET /admin/tax-rates. Dropdown muestra las 3 tarifas activas (4%, 10%, 21%) en lugar de las 2 hardcodeadas. Cálculo de PVP usa el porcentaje dinámico. Backend soporta 'super-reduced' (tipo VatRate + CHECK constraint en BD). Migration 031 aplicada. API verificada: PUT con vatRate='super-reduced' → HTTP 200. - Seguridad: valor adicional a CHECK constraint (aditivo, sin riesgo de datos); Zod valida en backend; tipos TypeScript extendidos (solo seguridad en compile-time). - Tests: typecheck backend/admin exit 0; eslint exit 0; verify.sh exit 0. - Artefactos: work/artifacts/F-072/. ## 2026-08-19 — F-073 Activate/deactivate VAT types in admin tax rates page — DONE - Gates: reviewer APPROVED, security APPROVED, qa APPROVED, leader-close APPROVED, verify.sh exit 0 - Entregable: Página de IVA (/tax-rates) ahora tiene un interruptor (pill toggle switch) en la columna Estado para activar/desactivar tipos directamente sin entrar en modo edición. Cambio solo frontend, sin cambios en backend ni BD. - Tests: typecheck admin exit 0; eslint exit 0; verify.sh exit 0. - Artefactos: work/artifacts/F-073/.