Brings the convoy branch up to date with main so the architect's
Boot-the-brief pass reads the current framework + AGENTS.md context:
- Next.js 16.2.6 + ESLint v9 flat config + typescript@^5.9.3 devDep
(PR #4, merged via rebase: e57ea17 + 7540b2c)
- Agent pipeline v0.5.0 bootstrap (PR #1, merged via rebase:
1944b1e + 9aaa599 + 177ba5f)
- bump-next-js scope commit (PR #3, merged via rebase: 84aa381)
No conflicts expected — the convoy's a8bab93 only adds
.convoys/fix-auth-bypass.md (101 lines) which doesn't exist on main.
Note: docs PR #5 (AGENTS.md gotchas #9-11 covering the typescript
devDep, ESLint v9 pin rationale, and Turbopack default) is still
open and NOT included in this merge. The architect prompt inlines
those gotchas explicitly for context.
Conductor output for the highest-priority convoy in the launch
sequence. Closes P0 ship-blocker #8 from .convoys/ship-readiness.md.
Vercel is currently refusing to deploy any branch (including main)
due to a CVE in next@15.4.3 ("Vulnerable version of Next.js
detected"). Last successful main deploy: 2025-08-01. Until this
convoy lands, every downstream preview-smoke / visual-diff gate is
non-functional.
Classification: feature
Skip: ia, ux, flag
Next role: role-architect
Routing straight to architect (IA + UX skipped — no information
architecture or UX change). Architect reads the Next 15 → 16
migration guide and produces 1–3 briefs covering the bump itself,
any required code migrations (likely next.config.js
images.domains → images.remotePatterns), and Vercel preview
verification.
Audit cohort (post-PR draft, /multitask group):
reviewer + design-system-auditor + a11y-auditor
Out of scope here (own convoys):
- React 18 → 19 bump → bump-react (if/when desired)
- App Router migration → out of horizon
- @playwright/test install → adopt-playwright-smoke
- ESLint baseline cleanup → fix-lint-baseline
Convoy file: .convoys/bump-next-js.md
Analytics: emitted via scripts/log-convoy-event.sh
Co-authored-by: Cursor <cursoragent@cursor.com>
The throwaway bootstrap PR exposed three pre-existing issues that
weren't visible before the pipeline was installed:
1. ESLint had no config (`.eslintrc.json` missing) even though the
`lint` script and deps were both present. `next lint` was prompting
interactively in CI. Added `.eslintrc.json` extending
`next/core-web-vitals` (Next.js Strict).
2. Running lint surfaced ~100 pre-existing errors, including several
real bugs (conditional React hook calls in components/pages).
Marked the CI lint job `continue-on-error: true` with an explicit
TODO so PRs aren't blocked while a follow-up convoy
(fix-lint-baseline) cleans up the codebase. Lint output is still
visible in PR logs.
3. Vercel is platform-blocking every deployment with "Vulnerable
version of Next.js detected" — locked at 15.4.3, latest is 16.2.6.
The last successful Vercel deploy on main was 2025-08-01. Until
Next.js is bumped, every preview-smoke / visual-diff gate is
non-functional. Added as P0 #8 with a new `bump-next-js` convoy at
the front of the launch sequence.
Updated `.convoys/ship-readiness.md`:
- P0 #8: Vercel deploy blocked by Next.js CVE
- P1 #11.5: pre-existing lint baseline
- Launch sequence: prepend `bump-next-js` at step 0, add
`fix-lint-baseline` at step 3.5
Co-authored-by: Cursor <cursoragent@cursor.com>
Conductor output for the first real convoy after the agent-pipeline
bootstrap. Closes P0 ship-blockers #1, #2, #4, #5 and the auth-route
slice of #6 from .convoys/ship-readiness.md.
Classification: server-only
Skip: ia, ux, visual, a11y, design
Next role: role-architect
The convoy is unflagged (auth fixes don't ship behind a feature flag).
Architect produces a slice plan with explicit slice_dependencies so
implementers can /multitask the disjoint briefs (dev-endpoint delete +
CORS tighten + rate-limit wiring) once the central JWT secret helper
lands.
Out of scope here (own convoys):
- P0 #3 default admin creds + README → drop-public-setup
- P0 #7 Layout default-prop email leak → fix-layout-default-user
- P0 #6 full (search/import/upload) → add-rate-limiting
Convoy file: .convoys/fix-auth-bypass.md
Analytics: emitted via scripts/log-convoy-event.sh
Co-authored-by: Cursor <cursoragent@cursor.com>
The throwaway bootstrap PR exposed three pre-existing issues that
weren't visible before the pipeline was installed:
1. ESLint had no config (`.eslintrc.json` missing) even though the
`lint` script and deps were both present. `next lint` was prompting
interactively in CI. Added `.eslintrc.json` extending
`next/core-web-vitals` (Next.js Strict).
2. Running lint surfaced ~100 pre-existing errors, including several
real bugs (conditional React hook calls in components/pages).
Marked the CI lint job `continue-on-error: true` with an explicit
TODO so PRs aren't blocked while a follow-up convoy
(fix-lint-baseline) cleans up the codebase. Lint output is still
visible in PR logs.
3. Vercel is platform-blocking every deployment with "Vulnerable
version of Next.js detected" — locked at 15.4.3, latest is 16.2.6.
The last successful Vercel deploy on main was 2025-08-01. Until
Next.js is bumped, every preview-smoke / visual-diff gate is
non-functional. Added as P0 #8 with a new `bump-next-js` convoy at
the front of the launch sequence.
Updated `.convoys/ship-readiness.md`:
- P0 #8: Vercel deploy blocked by Next.js CVE
- P1 #11.5: pre-existing lint baseline
- Launch sequence: prepend `bump-next-js` at step 0, add
`fix-lint-baseline` at step 3.5
Co-authored-by: Cursor <cursoragent@cursor.com>
