BUILD_PR PR_26175_CHARLIE_003 r2 storage standardization

Author: ToolboxAid

.env.example

@@ -50,6 +50,11 @@ GAMEFOUNDRY_DB_BACKUP_DIR=
 
 # Server-only project asset storage configuration.
 # Browser uploads must go through the server API and must not receive these secrets.
+# Approved GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX values:
+# DEV /dev/projects/
+# IST /ist/projects/
+# UAT /uat/projects/
+# PRD /prod/projects/
 GAMEFOUNDRY_STORAGE_ENDPOINT=
 GAMEFOUNDRY_STORAGE_ACCESS_KEY_ID=
 

admin/infrastructure.html

@@ -41,7 +41,7 @@ <h2>Admin</h2>
                                     <p>/dev/projects/</p>
                                     <p>/ist/projects/</p>
                                     <p>/uat/projects/</p>
-                                    <p>/prd/projects/</p>
+                                    <p>/prod/projects/</p>
                                 </div>
                             </details>
                         </div>
@@ -81,7 +81,7 @@ <h3 id="admin-infrastructure-image-zoom-title">Game Foundry Infrastructure</h3>
                                     <tr><td>DEV</td><td>/dev/projects/</td><td>Loading</td></tr>
                                     <tr><td>IST</td><td>/ist/projects/</td><td>Loading</td></tr>
                                     <tr><td>UAT</td><td>/uat/projects/</td><td>Loading</td></tr>
-                                    <tr><td>PRD</td><td>/prd/projects/</td><td>Loading</td></tr>
+                                    <tr><td>PRD</td><td>/prod/projects/</td><td>Loading</td></tr>
                                 </tbody>
                             </table>
                         </div>

assets/theme-v2/js/admin-infrastructure.js

@@ -6,7 +6,7 @@ const STORAGE_PATH_LANES = Object.freeze([
     Object.freeze({ lane: "DEV", path: "/dev/projects/" }),
     Object.freeze({ lane: "IST", path: "/ist/projects/" }),
     Object.freeze({ lane: "UAT", path: "/uat/projects/" }),
-    Object.freeze({ lane: "PRD", path: "/prd/projects/" }),
+    Object.freeze({ lane: "PRD", path: "/prod/projects/" }),
 ]);
 
 class AdminInfrastructureStoragePathStatus {

docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization-instruction-compliance-checklist.md

@@ -2,16 +2,21 @@
 
 | Requirement | Status | Evidence |
 |---|---:|---|
-| Active branch remains `PR_26172_CHARLIE_repository-compliance-stack` | PASS | Branch gate passed before PLAN changes. |
-| Worktree clean before PLAN | PASS | `git status --short` returned no output. |
-| Scope only R2 storage configuration standardization | PASS | PLAN is limited to `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX` and R2 storage config/status targets. |
-| Standardize around `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX` | PASS | PLAN names this as the authoritative project storage prefix variable. |
-| Include `/dev/projects/` | PASS | Approved prefix listed. |
-| Include `/ist/projects/` | PASS | Approved prefix listed. |
-| Include `/uat/projects/` | PASS | Approved prefix listed. |
-| Include `/prod/projects/` | PASS | Approved prefix listed. |
-| Do not implement telemetry | PASS | Telemetry is explicitly out of scope. |
-| Do not implement configurable runtime ports | PASS | Runtime-port work is explicitly out of scope. |
-| No implementation files changed in PLAN | PASS | PLAN creates report artifacts only. |
-| Required reports under `docs_build/dev/reports/` | PASS | PLAN, manual notes, checklist, Codex diff, and changed-files reports are produced. |
-| Repo-structured ZIP under `tmp/` | PASS | Planned artifact: `tmp/PR_26175_CHARLIE_003-r2-storage-standardization_PLAN_delta.zip`. |
+| Active branch remains `PR_26172_CHARLIE_repository-compliance-stack` | PASS | Branch gate returned `PR_26172_CHARLIE_repository-compliance-stack`. |
+| Worktree clean before BUILD | PASS | `git status --short` returned no output before edits. |
+| Local/origin sync before BUILD is `0 0` | PASS | Sync check returned `0 0`. |
+| Scope only R2 storage configuration standardization | PASS | Changes are limited to prefix config, safe status surfaces, validation, tests, and reports. |
+| Standardize around `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX` | PASS | Shared approved prefix list added in `storage-config.mjs`. |
+| Allow `/dev/projects/` | PASS | Included in `STORAGE_PROJECTS_ALLOWED_PREFIXES`; covered by tests/status surfaces. |
+| Allow `/ist/projects/` | PASS | Included in `STORAGE_PROJECTS_ALLOWED_PREFIXES`; covered by tests/status surfaces. |
+| Allow `/uat/projects/` | PASS | Included in `STORAGE_PROJECTS_ALLOWED_PREFIXES`; covered by tests/status surfaces. |
+| Allow `/prod/projects/` | PASS | Included in `STORAGE_PROJECTS_ALLOWED_PREFIXES`; PRD lane references updated to `/prod/projects/`. |
+| Reject unapproved project prefixes | PASS | New storage-config test rejects `/production/projects/`, `/qa/projects/`, and `/projects/`. |
+| Preserve R2 list/read/write/delete behavior | PASS | Connectivity action code paths were not changed; storage validation list/readiness passed with `--use-system-ca`. |
+| Preserve System Health and Infrastructure safe status surfaces | PASS | Targeted Admin Health Operations and Infrastructure Playwright validations passed. |
+| Do not expose secrets | PASS | Safe config excludes access and secret keys; validation output did not print credential values. |
+| Do not implement telemetry | PASS | No telemetry implementation was added. |
+| Do not implement configurable runtime ports | PASS | Runtime port code was not changed. |
+| Do not edit ignored local `.env` files | PASS | Only `.env.example` was updated. |
+| Required reports under `docs_build/dev/reports/` | PASS | PR report, manual notes, checklist, codex diff, and changed-files reports are produced. |
+| Repo-structured ZIP under `tmp/` | PASS | ZIP produced as `tmp/PR_26175_CHARLIE_003-r2-storage-standardization_delta.zip`. |

docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization-manual-validation-notes.md

@@ -1,31 +1,34 @@
 # PR_26175_CHARLIE_003 Manual Validation Notes
 
-## Manual Checks Completed During PLAN
+## Manual Checks Completed During BUILD
 
 - Confirmed active branch remained `PR_26172_CHARLIE_repository-compliance-stack`.
-- Confirmed worktree was clean before PLAN artifacts were created.
-- Confirmed branch local/origin sync was `0 0` before PLAN artifacts were created.
-- Reviewed active ProjectInstructions and Team Charlie ownership.
-- Reviewed R2 storage config, R2 provider, Admin Infrastructure, Admin System Health, storage validation script, and targeted Admin Playwright coverage.
-
-## Current State Observations
-
-- The active R2 storage config normalizes `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX`.
-- Server-side status already recognizes the approved storage lanes for Admin Infrastructure/System Health.
-- The storage config loader does not yet reject arbitrary normalized project prefixes.
-- `.env.example` includes `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX=` but no lane value.
-- Tracked `.env.dev`, `.env.ist`, `.env.uat`, and `.env.prd` files were not present in this workspace search.
-
-## Manual Checks Required During APPLY/Build
-
-- Verify project prefix validation accepts only `/dev/projects/`, `/ist/projects/`, `/uat/projects/`, and `/prod/projects/`.
-- Verify invalid prefix status is visible and actionable.
-- Verify R2 credential values are never printed.
-- Verify existing R2 connectivity behavior still uses the configured approved prefix.
-- Verify telemetry and configurable runtime ports were not implemented.
-
-## Skipped During PLAN
-
-- No implementation validation was run because this task is PLAN_PR only.
-- No Playwright validation was run because no runtime/UI files were changed.
-- No samples were run.
+- Confirmed worktree was clean before BUILD edits.
+- Confirmed branch local/origin sync was `0 0` before BUILD edits.
+- Reviewed ProjectInstructions and approved PLAN report.
+- Reviewed exact target files for R2 storage config, Local API status surface, Admin Infrastructure, storage validation, and targeted tests.
+
+## Behavioral Notes
+
+- `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX` now accepts only normalized project prefixes in the approved lane list.
+- PRD lane display now uses `/prod/projects/`.
+- Invalid project prefixes return a safe validation error that names approved values and does not expose credentials.
+- R2 list/read/write/delete code paths were not changed.
+- System Health and Infrastructure status surfaces continue to hide storage credentials.
+
+## Validation Notes
+
+- `git diff --check` passed.
+- `node --test tests/dev-runtime/StorageConfig.test.mjs` passed.
+- `node --test tests/dev-runtime/AdminHealthOperations.test.mjs` passed.
+- Targeted Admin Infrastructure Playwright storage path tests passed.
+- Targeted Admin System Health Playwright route tests passed.
+- `node scripts/validate-storage-config.mjs` failed on local certificate trust before a code failure was observed.
+- `node --use-system-ca scripts/validate-storage-config.mjs` passed and confirmed R2 list/readiness for `/dev/projects/`.
+
+## Skipped Validation
+
+- Full samples smoke was skipped because the approved scope was storage prefix standardization only.
+- Broad Playwright was skipped because targeted Admin status validations passed.
+- Telemetry validation was skipped because telemetry is out of scope.
+- Configurable runtime port validation was skipped because runtime ports are out of scope.

docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization.md

@@ -0,0 +1,82 @@
+# PR_26175_CHARLIE_003-r2-storage-standardization
+
+Team: Charlie
+
+Purpose: Standardize R2 project asset storage around `GAMEFOUNDRY_STORAGE_PROJECTS_PREFIX` and the approved project prefix set.
+
+## Branch Validation
+
+| Check | Expected | Actual | Status |
+|---|---|---|---|
+| Active branch | `PR_26172_CHARLIE_repository-compliance-stack` | `PR_26172_CHARLIE_repository-compliance-stack` | PASS |
+| Worktree before BUILD | clean | clean | PASS |
+| Local/origin sync before BUILD | `0 0` | `0 0` | PASS |
+| Team ownership | Charlie storage/infrastructure | R2 storage configuration standardization | PASS |
+
+## Implementation Summary
+
+- Added `STORAGE_PROJECTS_PREFIX_LANES` and `STORAGE_PROJECTS_ALLOWED_PREFIXES` as the shared approved project prefix contract.
+- Restricted `loadStorageConfig()` to normalized prefixes matching:
+  - `/dev/projects/`
+  - `/ist/projects/`
+  - `/uat/projects/`
+  - `/prod/projects/`
+- Updated Admin Infrastructure and Local API storage path status to use `/prod/projects/` for the PRD lane.
+- Kept R2 list/read/write/delete behavior unchanged and still routed through the configured project prefix.
+- Updated `.env.example` comments and `scripts/validate-storage-config.mjs` safe output to name approved prefixes.
+- Added focused `node:test` coverage for prefix normalization, allow-list validation, missing prefix handling, and safe config secret masking.
+
+## Files Changed
+
+- `.env.example`
+- `admin/infrastructure.html`
+- `assets/theme-v2/js/admin-infrastructure.js`
+- `scripts/validate-storage-config.mjs`
+- `src/dev-runtime/server/local-api-router.mjs`
+- `src/dev-runtime/storage/storage-config.mjs`
+- `tests/dev-runtime/StorageConfig.test.mjs`
+- `tests/playwright/tools/AdminPlatformToolsWireframes.spec.mjs`
+
+## Scope Guardrails
+
+| Requirement | Status | Notes |
+|---|---:|---|
+| Preserve R2 list/read/write/delete behavior | PASS | Connectivity action code paths were not changed. |
+| Preserve System Health safe status surface | PASS | Existing Admin Health Operations test and page spec passed. |
+| Preserve Infrastructure safe status surface | PASS | Storage path status rows now use the shared approved prefix list. |
+| Do not expose secrets | PASS | Safe config excludes access key and secret key values; validation output printed no secret values. |
+| Do not implement telemetry | PASS | No telemetry code was added. |
+| Do not implement configurable runtime ports | PASS | Runtime port logic was not changed. |
+| Do not edit local ignored `.env` files | PASS | Only `.env.example` was updated. |
+
+## Validation Lane Report
+
+| Command | Result |
+|---|---:|
+| `git diff --check` | PASS |
+| `node --test tests/dev-runtime/StorageConfig.test.mjs` | PASS, 5 tests |
+| `node --test tests/dev-runtime/AdminHealthOperations.test.mjs` | PASS, 4 tests |
+| `npx playwright test tests/playwright/tools/AdminPlatformToolsWireframes.spec.mjs --grep "Infrastructure storage path status"` | PASS, 4 tests |
+| `npx playwright test tests/playwright/tools/AdminHealthOperationsPage.spec.mjs` | PASS, 3 tests |
+| `node scripts/validate-storage-config.mjs` | FAIL due local Node certificate trust error before code changes were needed |
+| `node --use-system-ca scripts/validate-storage-config.mjs` | PASS; R2 list/readiness succeeded for `/dev/projects/` with 0 objects |
+
+## Validation Notes
+
+- The first `validate-storage-config` run loaded `.env`, confirmed all storage keys were present, and printed only safe endpoint, bucket, and prefix values. It failed on `UNABLE_TO_VERIFY_LEAF_SIGNATURE`.
+- The rerun with `--use-system-ca` passed and confirmed the R2 list/readiness behavior under the approved `/dev/projects/` prefix.
+- Active code, config, Admin UI, and targeted tests no longer use `/prd/projects/`.
+- Historical report references to `/prd/projects/` were left untouched as report history.
+
+## Skipped Lanes
+
+- Full samples smoke: skipped; out of scope for R2 prefix standardization.
+- Broad Playwright: skipped; targeted Admin Infrastructure and System Health specs passed.
+- Telemetry validation: skipped; telemetry is explicitly out of scope.
+- Configurable runtime port validation: skipped; runtime ports are explicitly out of scope.
+
+## BUILD Result
+
+BUILD status: PASS.
+
+Recommendation: Keep this commit on the Charlie stack for owner review.

docs_build/dev/reports/codex_changed_files.txt

@@ -1,5 +1,11 @@
-docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization_PLAN.md
-docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization-manual-validation-notes.md
+.env.example
+admin/infrastructure.html
+assets/theme-v2/js/admin-infrastructure.js
+docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization.md
 docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization-instruction-compliance-checklist.md
-docs_build/dev/reports/codex_review.diff
-docs_build/dev/reports/codex_changed_files.txt
+docs_build/dev/reports/PR_26175_CHARLIE_003-r2-storage-standardization-manual-validation-notes.md
+scripts/validate-storage-config.mjs
+src/dev-runtime/server/local-api-router.mjs
+src/dev-runtime/storage/storage-config.mjs
+tests/dev-runtime/StorageConfig.test.mjs
+tests/playwright/tools/AdminPlatformToolsWireframes.spec.mjs