.forgejo/workflows/deps-audit.yml

@@ -1,25 +0,0 @@
-# Weekly dependency guard (QA-B0-02 durable fix): dependency rot must surface
-# as a red scheduled run, not wait for the next manual audit. Fails on any
-# high+ vulnerability in production deps; prints the outdated report either way.
-name: deps-audit
-on:
-  schedule:
-    - cron: '0 11 * * 1' # Mondays 11:00 UTC (~06:00 America/Chicago)
-  workflow_dispatch:
-
-jobs:
-  audit:
-    runs-on: docker
-    container:
-      image: node:22-bookworm
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install (lockfile-exact)
-        run: npm ci
-
-      - name: Audit production deps (fail on high or critical)
-        run: npm audit --omit=dev --audit-level=high
-
-      - name: Outdated report (informational)
-        run: npm outdated || true

docs/DEPLOY_CHECKLIST.md

@@ -1,45 +0,0 @@
-# Production Deploy Checklist
-
-The environment/config items that are **not** enforced by code or CI and must be
-verified on the production instance itself. Each has a boot-time warning or a
-QA-plan pointer; this list is the single place they live (previously they only
-existed in session notes).
-
-## Required environment (production)
-
-| Variable                     | Why                                                                                                                                                                                                                                                                 | Symptom if missing                                            |
-| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
-| `TOKEN_ENCRYPTION_KEY`       | At-rest secrets (SimpleFIN token, SMTP/OIDC secrets, login IP/UA) otherwise fall back to a key stored **inside the database** — anyone with DB/backup read access can decrypt. On first boot with the key set, stored `v2:` ciphertexts migrate to env-keyed `e2:`. | Boot warning: `TOKEN_ENCRYPTION_KEY is not set in production` |
-| `WEBAUTHN_RP_ID`             | Passkeys bind cryptographically to this hostname; the `localhost` default silently breaks all passkey sign-ins behind a real domain. Bare hostname, no scheme/port (e.g. `bills.example.com`). Changing it later invalidates registered keys.                       | Boot warning: `WEBAUTHN_RP_ID is not set in production`       |
-| `WEBAUTHN_ORIGIN` (optional) | Pin the exact expected origin for WebAuthn ceremonies when the app is served from a non-default origin. When unset, the API origin plus any request origin whose hostname equals the RP ID is accepted.                                                             | Passkey enroll/sign-in fails origin verification              |
-
-## One-time settings (Admin panel / DB)
-
-- [ ] **Turn OFF `simplefin_debug_logging`** on the production instance
-      (Admin → bank sync config). It is a debugging aid; leaving it on logs
-      more sync detail than production needs.
-
-## Build/runtime infrastructure
-
-- [ ] **`cdn.sheetjs.com` egress** — the lockfile pins `xlsx` to the official
-      SheetJS dist tarball (the npm registry line is abandoned with unfixed
-      high CVEs). CI runners and Docker builds must be able to reach it for
-      `npm ci`.
-- [ ] **Node version alignment** — `package.json` engines, the Dockerfile base
-      image, and the CI image must agree (all `node:22` today). Bump all three
-      together.
-- [ ] Volumes/permissions/migrations: handled by `docker-entrypoint.sh`
-      (`chmod 700` data dirs, non-root `bill` user, `RUN_DB_MIGRATIONS=true`)
-      — covered by QA batch B16.
-
-## Standing dependency guard
-
-- `renovate.json` is in the repo — enable Renovate on the Forgejo instance for
-  grouped weekly update PRs.
-- Until then, `.forgejo/workflows/deps-audit.yml` runs weekly: it fails on any
-  high+ vulnerability (`npm audit --omit=dev --audit-level=high`) and prints
-  `npm outdated`, so dependency rot surfaces as a red scheduled run instead of
-  waiting for the next manual audit.
-- Deferred upgrade, tracked: **TypeScript 7** typechecks this codebase clean but
-  `typescript-eslint` (peer `<6.1.0`) cannot parse under it yet — revisit when
-  typescript-eslint ships TS 7 support.

e2e/control-census.spec.js-snapshots/census-analytics-probe-linux.txt

@@ -6,7 +6,7 @@ button | Print / Save PDF
 button | Refresh
 button | Reset filters
 button | Search billsCtrl K
-button | Tracker
+button | Tracker#
 input:checkbox | (unnamed)
 input:number | (unnamed)
 link | About
@@ -17,7 +17,7 @@ link | Release Notes
 link | Skip to main content
 select | # months# months# months
 select | # months# months# months# months
-select | All billsAdobe Creative CloudAmazon PrimeAMC A-ListApple iCl
+select | All bills<script>alert(#)</script>Adobe Creative CloudAmazon
 select | All categoriesBeautyCoffeeCredit CardsDining OutEntertainmen
 select | JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNo
 select | LineArea

e2e/control-census.spec.js-snapshots/census-banking-probe-linux.txt

@@ -2,7 +2,7 @@ button | Current theme: Dark. Click to change.
 button | Open Tanstack query devtools
 button | Open user menu
 button | Search billsCtrl K
-button | Tracker
+button | Tracker#
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-bills-probe-linux.txt

@@ -1,11 +1,13 @@
 button | #st bucket
 button | #th bucket
+button | <script>alert(#)</script>
 button | AMC A-List
 button | Add Bill
 button | Adobe Creative Cloud
 button | Amazon Prime
 button | Apple iCloud+
 button | Autopay
+button | Big
 button | Cadence
 button | Capital One Quicksilver
 button | Car Insurance
@@ -31,6 +33,8 @@ button | Homeowners Insurance
 button | Inactive
 button | Internet Provider
 button | Mortgage
+button | Move <script>alert(#)</script> down
+button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
@@ -39,6 +43,8 @@ button | Move Amazon Prime down
 button | Move Amazon Prime up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
+button | Move Big down
+button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -77,6 +83,8 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
+button | Move Zero down
+button | Move Zero up
 button | Netflix
 button | Open Tanstack query devtools
 button | Open user menu
@@ -84,8 +92,9 @@ button | Search & filters# of # shown · no filters
 button | Search billsCtrl K
 button | Spotify
 button | Student Loan
-button | Tracker
+button | Tracker#
 button | Trash Service
+button | Zero
 combobox | Filter by billing schedule
 combobox | Filter by category
 combobox | Use a bill template

e2e/control-census.spec.js-snapshots/census-calendar-probe-linux.txt

@@ -7,7 +7,7 @@ button | Refresh calendar
 button | Search billsCtrl K
 button | Subscribe Calendar
 button | Today
-button | Tracker
+button | Tracker#
 button | View #/#/#
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-categories-probe-linux.txt

@@ -52,7 +52,7 @@ button | Rename Subscriptions
 button | Rename Utilities
 button | Search billsCtrl K
 button | Show Empty
-button | Tracker
+button | Tracker#
 input:text | New category name...
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-data-probe-linux.txt

@@ -6,7 +6,7 @@ button | ImportBring in existing data
 button | Open Tanstack query devtools
 button | Open user menu
 button | Search billsCtrl K
-button | Tracker
+button | Tracker#
 button | TransactionsReview & match
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-health-probe-linux.txt

@@ -5,7 +5,7 @@ button | Open Tanstack query devtools
 button | Open user menu
 button | Refresh
 button | Search billsCtrl K
-button | Tracker
+button | Tracker#
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-payoff-probe-linux.txt

@@ -7,7 +7,7 @@ button | Print
 button | Required Minimum: help
 button | Search billsCtrl K
 button | Time Savings: help
-button | Tracker
+button | Tracker#
 button | ▲
 button | ▼
 combobox | Capital One Quicksilver$#

e2e/control-census.spec.js-snapshots/census-profile-probe-linux.txt

@@ -1,14 +1,14 @@
 button | Add key
 button | Change Password
 button | Current theme: Dark. Click to change.
-button | Last LoginJul # # #:# AMDesktop · Chrome on Linux#
+button | Last LoginJul # # #:# PMDesktop · Chrome on Linux#
 button | Open Tanstack query devtools
 button | Open user menu
 button | Save Privacy Settings
 button | Save Profile
 button | Search billsCtrl K
 button | Set up
-button | Tracker
+button | Tracker#
 input:password | (unnamed)
 input:text | Display name
 link | About

e2e/control-census.spec.js-snapshots/census-settings-probe-linux.txt

@@ -15,7 +15,7 @@ button | Search billsCtrl K
 button | Send test
 button | System
 button | Theme: help
-button | Tracker
+button | Tracker#
 combobox | MM/DD/YYYY
 combobox | Sunday
 combobox | Tracker

e2e/control-census.spec.js-snapshots/census-snowball-probe-linux.txt

@@ -26,7 +26,7 @@ button | Restore Ramsey Order
 button | Save Order
 button | Search billsCtrl K
 button | Toggle plan details
-button | Tracker
+button | Tracker#
 input:number | #
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-spending-probe-linux.txt

@@ -17,7 +17,7 @@ button | Previous month
 button | Search billsCtrl K
 button | Shopping
 button | Shopping$# transactionavg $#/mo$# left
-button | Tracker
+button | Tracker#
 button | Uncategorized
 button | Uncategorized$# transaction
 button | View

e2e/control-census.spec.js-snapshots/census-subscriptions-probe-linux.txt

@@ -40,7 +40,7 @@ button | Search subscriptions# of # shown · no filters
 button | Search transactionsall bank transactions · no filters
 button | Spotify
 button | Track Subscription
-button | Tracker
+button | Tracker#
 button | View recommendation details
 input:search | Search by merchant, description, or payee…
 input:search | Search recommendations…

e2e/control-census.spec.js-snapshots/census-summary-probe-linux.txt

@@ -1,11 +1,15 @@
 button | Current theme: Dark. Click to change.
 button | Edit
+button | Move <script>alert(#)</script> down
+button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
 button | Move Adobe Creative Cloud up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
+button | Move Big down
+button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -42,6 +46,8 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
+button | Move Zero down
+button | Move Zero up
 button | Next month
 button | Open Tanstack query devtools
 button | Open user menu
@@ -49,7 +55,7 @@ button | Previous month
 button | Print / PDF
 button | Search billsCtrl K
 button | Today
-button | Tracker
+button | Tracker#
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-tracker-probe-linux.txt

@@ -12,9 +12,11 @@ button | Current theme: Dark. Click to change.
 button | Debt
 button | Due
 button | Due Soon, click to mark paid
+button | Edit <script>alert(#)</script>
 button | Edit AMC A-List
 button | Edit Adobe Creative Cloud
 button | Edit Apple iCloud+
+button | Edit Big
 button | Edit Capital One Quicksilver
 button | Edit Car Insurance
 button | Edit Car Payment
@@ -33,18 +35,25 @@ button | Edit Netflix
 button | Edit Spotify
 button | Edit Student Loan
 button | Edit Trash Service
+button | Edit Zero
 button | Edit monthly starting amounts
 button | Expected
 button | Export or print this month
 button | Hide
+button | Hide overdue panel
 button | Keyboard shortcuts
 button | Last Month
+button | Late, click to mark paid
+button | Move <script>alert(#)</script> down
+button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
 button | Move Adobe Creative Cloud up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
+button | Move Big down
+button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -81,6 +90,8 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
+button | Move Zero down
+button | Move Zero up
 button | Next month
 button | Open Tanstack query devtools
 button | Open calendar for this month
@@ -90,19 +101,25 @@ button | Paid
 button | Paid Date
 button | Paid, click to mark unpaid
 button | Pay all due (#)
+button | Pay now
 button | Pin Due
 button | Previous month
+button | Review overdue bills# items ready for pay, skip, or snooze$#
 button | Search & sort# of # shown · no filters
 button | Search billsCtrl K
+button | Skip
+button | Snooze
 button | Status
 button | Today
-button | Tracker
+button | Tracker#
 button | Unpaid
 button | Upcoming, click to mark paid
 button | —
+checkbox | Select <script>alert(#)</script>
 checkbox | Select AMC A-List
 checkbox | Select Adobe Creative Cloud
 checkbox | Select Apple iCloud+
+checkbox | Select Big
 checkbox | Select Capital One Quicksilver
 checkbox | Select Car Insurance
 checkbox | Select Car Payment
@@ -121,10 +138,13 @@ checkbox | Select Netflix
 checkbox | Select Spotify
 checkbox | Select Student Loan
 checkbox | Select Trash Service
+checkbox | Select Zero
 combobox | Filter by billing schedule
 combobox | Filter by category
 combobox | Sort by
+input:number | <script>alert(#)</script> payment amount
 input:number | Apple iCloud+ payment amount
+input:number | Big payment amount
 input:number | Capital One Quicksilver payment amount
 input:number | Car Payment payment amount
 input:number | Cell Phone payment amount

playwright.config.js

@@ -51,8 +51,6 @@ module.exports = defineConfig({
         // probe-only: enables WebAuthn for the seeded user mid-test, which would
         // race the password logins in these parallel UI projects
         /webauthn\.probe\.spec\.js/,
-        // census-project-only: snapshots depend on pristine seed data
-        /control-census\.spec\.js/,
       ],
     },
     {
@@ -66,8 +64,6 @@ module.exports = defineConfig({
         // probe-only: enables WebAuthn for the seeded user mid-test, which would
         // race the password logins in these parallel UI projects
         /webauthn\.probe\.spec\.js/,
-        // census-project-only: snapshots depend on pristine seed data
-        /control-census\.spec\.js/,
       ],
     },
     // Find-mode diagnostics (adversarial API probe + authenticated a11y scan).
@@ -75,22 +71,11 @@ module.exports = defineConfig({
     // so open findings here don't turn the default suite red. Run on demand:
     // `npm run test:e2e:probe`. Fold a spec into the default projects once its
     // findings are fixed (it becomes a passing regression guard).
-    // Control census (Appendix E automation): read-only snapshots of every
-    // page's interactive controls. Own project ordered BEFORE the probe so the
-    // snapshots always see pristine seed data — api.probe/webauthn mutate the
-    // scratch DB (adversarial bills, passkey enrollment) and would otherwise
-    // make the baselines depend on spec ordering.
-    {
-      name: 'census',
-      testMatch: /control-census\.spec\.js/,
-      use: { ...devices['Desktop Chrome'] },
-      dependencies: ['setup'],
-    },
     {
       name: 'probe',
-      testMatch: /(api\.probe|a11y\.authed|webauthn\.probe)\.spec\.js/,
+      testMatch: /(api\.probe|a11y\.authed|webauthn\.probe|control-census)\.spec\.js/,
       use: { ...devices['Desktop Chrome'] },
-      dependencies: ['setup', 'census'],
+      dependencies: ['setup'],
     },
     // Cross-browser (WebAuthn/Select behavior differs) — enable when ready:
     // { name: 'firefox', use: { ...devices['Desktop Firefox'] }, dependencies: ['setup'], testIgnore: /auth\.setup\.js/ },

renovate.json

@@ -1,32 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "timezone": "America/Chicago",
-  "schedule": ["before 6am on monday"],
-  "labels": ["dependencies"],
-  "rangeStrategy": "bump",
-  "packageRules": [
-    {
-      "description": "Group all non-major updates into one weekly PR",
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "non-major dependencies"
-    },
-    {
-      "description": "Majors stay separate — each needs its own verification pass (see docs/QA_PLAN.md B0 dependency recon)",
-      "matchUpdateTypes": ["major"],
-      "dependencyDashboardApproval": true
-    },
-    {
-      "description": "xlsx is pinned to the official SheetJS CDN tarball (npm line is abandoned with unfixed CVEs) — do not touch",
-      "matchPackageNames": ["xlsx"],
-      "enabled": false
-    },
-    {
-      "description": "typescript is capped at 6.x until typescript-eslint supports TS 7 (peer <6.1.0)",
-      "matchPackageNames": ["typescript"],
-      "allowedVersions": "<7.0.0"
-    }
-  ],
-  "vulnerabilityAlerts": { "enabled": true },
-  "osvVulnerabilityAlerts": true
-}