# Adesso Handover — Readiness Report & Open Items > Date: 2026-06-01. Branch: `chore/adesso-handover-readiness`. > Audience: Adesso delivery team + operator. > Scope: result of a repository-wide readiness review (8 dimensions: structure, > code quality, config/build, CI/CD, security, docs, agent files, deps/tests). > This document separates **what was changed in this branch** (safe, reversible, > no runtime-logic change) from **recommendations** that need a human decision or > a dedicated, test-backed pass. --- ## 1. Executive summary The repository is already in solid handover shape: extensive ADRs, a documented migration catalogue (`MIGRATIONS.md`), a vendor-handover package, security workflows, and a portability gate. The review found **no critical hidden defects in the runtime**. TypeScript is clean, the test suite is green (768 passing / 40 `it.todo` / 1 skipped, verified 2026-06-01), the production build succeeds (CI-equivalent `SKIP_ENV_VALIDATION`), and the strict portability gate passes. The main gaps were **documentation drift** (the README still described the removed multi-tenant control plane), **missing config metadata** (no `engines`/`packageManager`), a **Dockerfile build-breaker**, and several **handover-hygiene** items. The safe subset of these was fixed in this branch. The remaining items are listed below as recommendations — none block a handover, but a few are security-relevant and should be actioned before Adesso receives production access. --- ## 2. Changed in this branch (safe, no runtime-logic change) | Area | Change | | --- | --- | | Docker | Removed vestigial `COPY .../proxy.ts` (file renamed to `middleware.ts`; the line broke `docker build`). | | Config | Added `engines` (`node >=20.9.0`, the next 16 floor) + `packageManager` + `.nvmrc` (`24`, the validated baseline). | | Env | Documented 6 missing env vars in `.env.example` (`CSP_ENFORCE`, `NEXT_PUBLIC_APP_URL`, `NEXT_PUBLIC_SENTRY_DSN`, `LOG_LEVEL`/`LOG_SERVICE`/`LOG_RELEASE`). | | README | Fixed wrong clone URL (`KADi-backend`→`Kadi-v2`), removed references to deleted modules (control-plane/provisioning/owner), `proxy.ts`→`middleware.ts`, real `lib/` structure, real scripts (`check:portability`, `new:module`), `MIGRATIONS.md` as DB source of truth. | | Docs | `DEPLOYMENT.md` middleware path; new `CONTRIBUTING.md`; vendor-handover "Start here" + superseded marker on the 2026-04-29 snapshot. | | CLAUDE.md | Fixed tech-stack error (no `XLSX` dep), added offline/PWA + Upstash + observability, added Handover Context, full command list incl. strict `check:portability`, Stop Conditions, translated the German docs-rules section. | | AGENTS.md | Added a scope banner (human-review guideline, **not** AI-agent config — point AI tools to `CLAUDE.md`). | | Tests | `vitest.config.ts` coverage paths now point to existing modules (the four control-plane paths were deleted). | | Scripts | `check-secrets.mjs`: dropped the 6 removed control-plane provisioning vars + the deleted `lib/control-plane/client.ts` allowlist entry → `check:secrets` is now warning-free. | | CI | PR template: `pnpm typecheck`→`npm run typecheck`. | Validation after changes (verified 2026-06-01): `typecheck` ✓, `test` ✓ (768 passing), `check:portability` strict ✓, `check:secrets` ✓ (0 warnings), `build` ✓ (CI-equivalent). `lint` unchanged at the pre-existing 56 errors (see §3). --- ## 3. Recommendations — dedicated, test-backed passes (not done here) Deferred on purpose: these touch runtime logic, the lockfile, or a large surface, and should be done as their own reviewed PRs rather than bundled into a docs/config cleanup right before handover. **A. ESLint errors (P1).** `npm run lint` reports **56 errors / 123 warnings** (verified). Main groups: `setState` synchronously in `useEffect` (~20), component definitions inside render (~12), unescaped JSX entities (~10), `react-hooks/exhaustive-deps` (23 warnings). They are currently **soft-gated** in CI (`continue-on-error`). Recommendation: fix in grouped, test-backed passes, then flip the lint gate to hard. Do not mass-fix the `setState`/effect group blindly — those are behaviour-sensitive. **B. Dependency / security bumps (P1).** Per the dependency audit: `next` 16.2.4 → 16.2.7 (patch, security), move `shadcn` from `dependencies` to `devDependencies` (it is a CLI scaffolder and pulls transitive CVEs into the prod graph), `@supabase/supabase-js` 2.100→2.106 (review auth/realtime changelog). **Deliberately not applied here** to avoid `package-lock.json` churn across npm versions in a docs/config PR — do it in a dedicated branch with `npm run build` + full test verification. **C. SQL layout (P2).** 132 `.sql` files sit flat in the repo root (plus the `MO-*` module folders). They are **not** dead — `MIGRATIONS.md` catalogs them and is the apply-order source of truth. A `db/` reorg (bootstrap/migrations/rollbacks/ seeds/rls/review-only) would improve navigation but rewrites every doc path, so it needs operator coordination. There is **no Supabase CLI migration tracking** — migrations are applied manually; consider adding an `apply-migrations` helper. **D. `MIGRATIONS.md` completeness (P2).** The audit reports ~42 forward migrations (Intake, Agenda, PMO, QAF, Avatars, GDPR series) present as files but not yet listed as classified rows in `MIGRATIONS.md`. Add them with class / depends-on / RLS-effect / apply-status so Adesso can reproduce the full schema. **E. CI hardening (P2).** Recommended (not applied — workflow edits were gated): add `permissions: contents: read` to `codex-review.yml`; pin the Semgrep container image to a released tag; align Node versions across workflows; consider SHA-pinning third-party actions; decide whether `claude-pr-review`/`codex-review` stay (they send PR diffs to external APIs — see §4). **F. Root hygiene (P3).** `Supplier_Pulse_Funktionsuebersicht.docx` (binary, in git, unreferenced), `migrate-colors.mjs` (one-shot tool, job done — move to `scripts/` or remove), 88 stale merged branches. Low risk, operator call. --- ## 4. Decisions required from the operator (before Adesso gets prod access) These are **security-/governance-relevant** and were intentionally left for a human decision — Aria did not act on them: 1. **Sentry auth token.** `.env.sentry-build-plugin` (local, gitignored, **not** committed) holds a real `SENTRY_AUTH_TOKEN`. Rotate it before handover; never ship the file. 2. **Demo seeds with real data.** `supabase/seed/supabase-seed-g61-demo*.sql` contain real BMW part numbers and supplier names. Confirm they are cleared for Adesso, or move them out of the handover set (the vendor-handover rules forbid internal real names). 3. **`SECURITY.md` contact** is a `` placeholder — fill with a real address or enable GitHub private vulnerability reporting. 4. **ASVS L2 open fails** (from `docs/security/asvs-l2.md`): admin MFA, `user_profiles` RLS double-policy re-audit, markdown HTML sanitiser (XSS), 14 PMO server actions relying on RLS only. Decide which are Day-0 go-live blockers vs documented accepted risk. 5. **External-AI CI workflows.** `claude-pr-review` sends PR diffs to a US cloud API. For BMW data governance, decide keep vs remove before handover. 6. **Push target.** This branch targets `origin/main`. The separate `Kadi-v2-handover` remote is 439 commits behind — clarify whether/when it gets synced for the Adesso delivery. --- ## 5. Risk register (summary) | Risk | Severity | Status | Recommendation | | --- | --- | --- | --- | | Docker build-breaker (`proxy.ts` COPY) | High | Fixed | — | | README described removed architecture | High | Fixed | — | | No `engines`/`packageManager` | Medium | Fixed | — | | `check:secrets` spurious warnings | Low | Fixed | — | | 56 ESLint errors (soft-gated) | Medium | Open | §3A, test-backed pass | | `next` 13 CVEs (patch available) | High | Open | §3B, dedicated bump | | Sentry token live | High | Open | §4.1, operator rotate | | Real data in demo seeds | High | Open | §4.2, operator clear/remove | | ASVS L2 fails | High | Open | §4.4, operator triage | | 132 SQL flat in root | Medium | Open | §3C, operator-coordinated | --- ## 6. Source Generated from an 8-dimension read-only audit on 2026-06-01. Counts marked "verified" were measured directly (`lint`, `test`, `check:*`, `build`); counts attributed to "the audit" (e.g. 42 migrations, dependency CVEs) come from the audit pass and should be re-confirmed before acting.