VolcanicCore/docs/superpowers/followups.md

Cross-Plan Follow-ups

Items surfaced during review of one plan that belong to a later plan. Prevents silent drops.

Deferred to Plan 7 (CI + observability + hardening)

Originally scoped as Plan 5, then re-deferred to Plan 6 when Plan 5 became the N8N Node Editor Dialog and Plan 6 became Pinned Node Data. These items now go to Plan 7.

• CI pipeline. There is no automated CI yet. Add a workflow (Gitea Actions if the repo is hosted on Gitea, otherwise GitHub Actions) that runs dotnet build, dotnet test, pnpm --dir frontend test, pnpm --dir frontend build, and the Playwright smoke on push to main. The Playwright job needs pnpm exec playwright install --with-deps chromium before pnpm --dir frontend test:e2e. Bonus: build + push the Docker image on tag pushes.
• Persist ASP.NET Core DataProtection keys under /data. The Plan-4 Dockerfile smoke run showed the default DataProtection key ring is written to /root/.aspnet/DataProtection-Keys inside the container — ephemeral. On container replacement (redeploy, OOM restart, host reboot) every issued cookie is invalidated and every logged-in user is silently kicked out. Fix in Plan 7: wire AddDataProtection().PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(settings.DataDirectory, "dp-keys"))) in Program.cs and cover with an xUnit test that verifies the directory is created on first boot.

Deferred from Plan 6 (Pinned Node Data)

• Skip upstream execution when downstream has a pin. Currently upstream ancestors of a pinned node still run and their output is discarded. Would need dependency analysis + a "no successors need my output" pass.
• Pin both input AND output on the same action node. Action nodes only expose the input editor; output-pin on action nodes would let operators "canned-response" a node during test runs.
• Multi-port pinning. Only port 0 today.
• Pin sharing / templates. Copy-pin-between-nodes UI.
• Diff indicator in the dialog: show "what this node WOULD have received" vs. "what the pin says it will receive".
• Backend index/column for querying "workflows with pinned data." Currently a stale pin on a live workflow can only be found by opening it in the editor.

Deferred from Plan 5 (Node Editor Dialog)

• Webhook stand-by mode. Trigger option where an active workflow pauses on the webhook node and only continues when a matching HTTP request arrives, instead of running through the first request. Needs pause/resume semantics in Executor; separate spec.
• Drag-and-drop insertion from JsonTree to ExpressionField. Currently only click-to-insert at caret is supported.
• Multi-color / semantic highlighting inside {…} (property vs bracket vs literal). Single amber color ships in Plan 5.
• Cross-node expressions like {nodes.<id>.output.body} and {nodes.<id>.output[0].json.body}. Requires the executor to expose a scoped-view of run state to TemplateEngine.
• JsonTree accessibility. Add role="tree"/role="treeitem" + aria-expanded/aria-level on branch buttons so screen readers can navigate the structure. MVP ships without these; usable for sighted operators only.
• msw module alias cleanup. frontend/src/testing/msw.ts exports both server (new) and mswServer (legacy). Four existing test files still use mswServer. Migrate them and drop the alias so there's one canonical name.
• WebhookUrlHint setTimeout leak on unmount. The 1500ms setCopied(false) fires even if the dialog closes mid-window. Harmless in React 18 but a lingering timer. Guard with a ref or useEffect cleanup.
• useMemo around normalizePorts in NodeEditorDialog. Runs every render, allocating fresh Port[] arrays; blocks downstream React.memo on PortsColumn. Cheap-per-run but wasteful.
• Tab-wrap focus-trap test. Implementation is in place; jsdom doesn't simulate real browser tab-order so it's not unit-tested. Add a Playwright smoke assertion if the behavior ever regresses in practice.
• Preview numeric-precision drift. frontend/src/expr/templateEngine.ts renders JS numbers via String(v), which loses fidelity vs the backend's GetRawText() for over-precision or non-normalized JSON (e.g., 1.50, 9007199254740993). Documented in the header comment; would need JSON source-text preservation to fix.