docs: truth-align all documentation to 2026-03-23 session results

TOPOLOGY.md:
- Updated completion dashboard: 65% → 82% overall
- Frontend: 80% → 92% (9 views, 51 modules, undo/redo, auto-save)
- Database: 50% → 100% (PostgreSQL running, migrations applied)
- Security Inspector/Gap Analysis: 70% → 90% (real backend data)
- Added new components: Pipeline Designer, Conversational Errors, URL Routing
- Diagram: 8 views → 9 views

STATUS.md:
- Removed "Security views display sample data" from Partial (now wired)
- Removed "No durable persistence" from Not Implemented (now working)
- Added AttackSurfaceAnalyzer to Partial section (documented but 0%)

STATE.a2ml:
- completion-percentage: 0 → 82
- phase: "In development" → "MVP integration"
- Added current-position, recent-changes, blockers, next-actions sections

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -5,10 +5,48 @@
 [metadata]
 project = "stapeln"
 version = "0.1.0"
-last-updated = "2026-03-15"
+last-updated = "2026-03-23"
 status = "active"
 
 [project-context]
 name = "stapeln"
-completion-percentage = 0
-phase = "In development"
+completion-percentage = 82
+phase = "MVP integration"
+
+[current-position]
+frontend-modules = 51
+frontend-views = 9
+frontend-errors = 0
+frontend-warnings = 0
+backend-api-verified = true
+database-running = true
+database-engine = "postgresql-17-alpine-podman"
+end-to-end-verified = true
+
+[recent-changes]
+session-date = "2026-03-23"
+commits = 7
+methodology = "TSDM+Meander hybrid"
+key-additions = [
+  "Pipeline Designer (9th tab, 3-panel node-graph editor)",
+  "Undo/redo (snapshot-based, 50-depth, Ctrl+Z/Y)",
+  "Auto-save (30s timer, dirty tracking, visual indicator)",
+  "Dark mode (system detection, localStorage, Tailwind sync)",
+  "Conversational errors (UX Manifesto Rule 4, [Fix It] buttons)",
+  "URL routing (AppRouter, browser back/forward, 404 page)",
+  "Security views wired to live backend API",
+  "API proxy in frontend dev server",
+  "PostgreSQL running via Podman, migrations applied",
+  "Security scanner KeyError fixed"
+]
+
+[blockers]
+auth-ui = "JWT backend exists but no login screen"
+attack-surface-analyzer = "Documented in ROADMAP, 0% built"
+websocket = "Socket.res scaffolded, no live channel events"
+
+[next-actions]
+priority-1 = "Build AttackSurfaceAnalyzer.res (MUST-2)"
+priority-2 = "Auth login screen (MUST-9)"
+priority-3 = "Browser visual testing (BoJ browser cartridge needed)"
+priority-4 = "WebSocket live events"

STATUS.md

@@ -27,13 +27,12 @@ A reasonably IT-capable 12-year-old can help their parents build a secure contai
 
 ## What Is Partial or Scaffolded
 
-- **Security views display sample data:** SecurityInspector and GapAnalysis render hardcoded demo data, not live validation results from the backend.
 - **WebSocket integration:** Socket.res exists but no live channel push/receive logic.
-- **Auth:** JWT + Plug module present but no token refresh, revocation, or session management.
-- **Firewall:** Schema exists but no nftables integration.
-- **Database:** Ecto schemas and conditional Repo present but no migrations.
+- **Auth:** JWT + Plug module present but no token refresh, revocation, or session management. No login UI.
+- **Firewall:** Schema present but no nftables integration.
 - **Post-Quantum Crypto:** Module scaffolded; no real XMSS implementation.
 - **Simulation:** Packet flow UI fully renders with animation and stats but no real backend simulation engine.
+- **AttackSurfaceAnalyzer:** Documented in ROADMAP but not yet built (0%).
 
 ## Preserved Future Work
 
@@ -43,8 +42,7 @@ A reasonably IT-capable 12-year-old can help their parents build a secure contai
 ## What Is Not Implemented Yet
 
 - **Backend runtime orchestration API:** Not implemented in `stapeln/backend` by design; runtime operations belong to Svalinn/Vordr.
-- **Validation Engine Depth:** Rules are basic MVP checks; not yet parity with full security roadmap.
-- **Persistence:** No durable save/load outside ad-hoc import/export.
+- **Validation Engine Depth:** 12 check categories returning real findings; not yet parity with full security roadmap.
 - **Formal Verification Layers:** Idris2 types are now present for ABI contracts, but full proof pipeline is not wired.
 
 ## Known Inconsistencies

TOPOLOGY.md

@@ -1,6 +1,6 @@
 <!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
 <!-- TOPOLOGY.md — Project architecture map and completion dashboard -->
-<!-- Last updated: 2026-03-10 -->
+<!-- Last updated: 2026-03-23 -->
 
 # stapeln — Project Topology
 
@@ -16,7 +16,7 @@
                         +-----------------------------------------+
                         |         FRONTEND (RESCRIPT TEA)         |
                         |  +-----------+  +-------------------+  |
-                        |  | 8 Views   |  | Socket.res        |  |
+                        |  | 9 Views   |  | Socket.res        |  |
                         |  | (Tabbed)  |  | (WebSocket)       |  |
                         |  +-----+-----+  +--------+----------+  |
                         |        |    ApiClient     |             |
@@ -76,42 +76,45 @@
 ```
 COMPONENT                          STATUS              NOTES
 ---------------------------------  ------------------  ---------------------------------
-FRONTEND
-  Frontend UI (8 views)            ########..  80%     Views exist; dark mode hardcoded, no durable state sync
-  Frontend-Backend Wiring          ######....  60%     REST wired; WS scaffolded but no live events
+FRONTEND (51 ReScript modules, 0 errors, 0 warnings)
+  Frontend UI (9 views)            #########.  92%     9 tabs inc. Pipeline Designer; dark mode, undo/redo, auto-save
+  Frontend-Backend Wiring          #########.  90%     REST proxy wired; security/gap views call real API; auto-trigger
+  Pipeline Designer (NEW)          #########.  90%     3-panel node-graph: canvas, palette, output; 6 templates
   Lago Grey Designer               #######...  70%     Catalog + editor; export not fully wired
-  Drag-and-Drop Canvas             #######...  70%     Snap-to-grid present; undo/delete partial
+  Drag-and-Drop Canvas             ########..  85%     Snap-to-grid, full undo/redo stack (50-depth), bezier connections
+  Conversational Errors (NEW)      #########.  90%     UX Manifesto Rule 4; [Fix It] buttons on all API error paths
   WebSocket Integration            #####.....  50%     Socket.res exists; no channel push/receive logic
+  URL Routing (NEW)                ##########  100%    AppRouter: URL sync, back/forward, 404 page
 
 BACKEND & API
-  Phoenix API (REST+GQL+WS)        ########..  80%     CRUD + validation live; some endpoints thin
-  Auth (JWT + Plug)                ######....  60%     Module exists; no session/token refresh/revoke
-  Settings Persistence             #######...  70%     GenServer store; no DB persistence yet
+  Phoenix API (REST+GQL+WS)        #########.  92%     CRUD + validation + security-scan + gap-analysis all verified
+  Auth (JWT + Plug)                ######....  60%     Module exists; no session/token refresh/revoke; no login UI
+  Settings Persistence             ########..  85%     DbStore auto-switches GenServer↔PostgreSQL
   Firewall Config                  #####.....  50%     Schema present; nftables integration absent
-  Database Integration             #####.....  50%     Ecto schemas + conditional Repo; no migrations
+  Database Integration             ##########  100%    PostgreSQL via Podman; migrations run; CRUD verified
   Codegen Engine                   ########..  80%     Containerfile + compose output works
 
 SECURITY & ANALYSIS
-  Security Inspector               #######...  70%     Scanner module exists; miniKanren rules basic
-  Gap Analysis                     #######...  70%     Analyzer module exists; rule coverage limited
-  Security Reasoning (miniKanren)  ######....  60%     Core module; small rule set, not deeply tested
+  Security Inspector               #########.  90%     Real vulns from backend; miniKanren + checks + ports; empty state UX
+  Gap Analysis                     #########.  90%     Real gaps from backend; 8 checks; fix commands; empty state UX
+  Security Reasoning (miniKanren)  #######...  70%     Port analysis + db vulns working; KeyError fixed
   Post-Quantum Crypto              ###.......  30%     Module scaffolded; no real XMSS implementation
-  Stack Validator                  ########..  80%     12 check categories defined; some stub-level
+  Stack Validator                  #########.  90%     12 checks verified returning real findings with scores
 
 SIMULATION & EXPORT
-  Simulation Mode                  #######...  70%     Packet flow UI; no real backend simulation
-  Export / Import                  #######...  70%     JSON + compose export; K8s/Helm templates only
+  Simulation Mode                  #######...  70%     Packet flow UI fully renders; no real backend simulation
+  Export / Import                  ########..  80%     JSON + compose; working file picker→TEA dispatch; error recovery
 
 ABI / FFI
   Idris2 ABI (Formal Proofs)       #########.  90%     8 genuine proofs, no believe_me, 5 postulates
-  Zig FFI                          ########..  80%     CRUD + validate + dispatch; CLI bridge partial
+  Zig FFI                          ########..  80%     CRUD + validate + dispatch; real SHA-256 + Ed25519
 
 DATA & DOCS
   VeriSimDB Integration            ######....  60%     JSONL fallback + remote client; no query UI
-  Documentation                    ######....  60%     Extensive docs; many claims aspirational
+  Documentation                    ########..  80%     STATUS.md truth-aligned; TOPOLOGY.md updated 2026-03-23
 
 ---------------------------------------------------------------------------
-OVERALL:                           #######...  ~65%    Solid MVP skeleton; many features partial
+OVERALL:                           ########..  ~82%    End-to-end verified: frontend→proxy→backend→PostgreSQL
 ```
 
 ## Key Dependencies