chore: resolve package-lock conflict

frontend/cypress/e2e/activity_feed.cy.ts

@@ -0,0 +1,96 @@
+/// <reference types="cypress" />
+
+describe("/activity feed", () => {
+  const apiBase = "**/api/v1";
+
+  function stubStreamEmpty() {
+    // Return a minimal SSE response that ends immediately.
+    cy.intercept(
+      "GET",
+      `${apiBase}/activity/task-comments/stream*`,
+      {
+        statusCode: 200,
+        headers: {
+          "content-type": "text/event-stream",
+        },
+        body: "",
+      },
+    ).as("activityStream");
+  }
+
+  it("happy path: renders task comment cards", () => {
+    cy.intercept("GET", `${apiBase}/activity/task-comments*`, {
+      statusCode: 200,
+      body: {
+        items: [
+          {
+            id: "c1",
+            message: "Hello world",
+            agent_name: "Kunal",
+            agent_role: "QA 2",
+            board_id: "b1",
+            board_name: "Testing",
+            task_id: "t1",
+            task_title: "CI hardening",
+            created_at: "2026-02-07T00:00:00Z",
+          },
+          {
+            id: "c2",
+            message: "Second comment",
+            agent_name: "Riya",
+            agent_role: "QA",
+            board_id: "b1",
+            board_name: "Testing",
+            task_id: "t2",
+            task_title: "Coverage policy",
+            created_at: "2026-02-07T00:01:00Z",
+          },
+        ],
+      },
+    }).as("activityList");
+
+    stubStreamEmpty();
+
+    cy.visit("/activity", {
+      onBeforeLoad(win: Window) {
+        win.localStorage.clear();
+      },
+    });
+
+    cy.wait("@activityList");
+
+    cy.contains(/live feed/i).should("be.visible");
+    cy.contains("CI hardening").should("be.visible");
+    cy.contains("Coverage policy").should("be.visible");
+    cy.contains("Hello world").should("be.visible");
+  });
+
+  it("empty state: shows waiting message when no items", () => {
+    cy.intercept("GET", `${apiBase}/activity/task-comments*`, {
+      statusCode: 200,
+      body: { items: [] },
+    }).as("activityList");
+
+    stubStreamEmpty();
+
+    cy.visit("/activity");
+    cy.wait("@activityList");
+
+    cy.contains(/waiting for new comments/i).should("be.visible");
+  });
+
+  it("error state: shows failure UI when API errors", () => {
+    cy.intercept("GET", `${apiBase}/activity/task-comments*`, {
+      statusCode: 500,
+      body: { detail: "boom" },
+    }).as("activityList");
+
+    stubStreamEmpty();
+
+    cy.visit("/activity");
+    cy.wait("@activityList");
+
+    // UI uses query.error.message or fallback.
+    cy.contains(/unable to load feed|boom/i).should("be.visible");
+  });
+});

frontend/package-lock.json

@@ -4803,19 +4803,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/ansi-escapes/node_modules/type-fest": {
-      "version": "0.21.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
-      "dev": true,
-      "license": "(MIT OR CC0-1.0)",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -8310,6 +8297,16 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/hasha/node_modules/type-fest": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/hasown": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
@@ -14036,13 +14033,16 @@
       }
     },
     "node_modules/type-fest": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "engines": {
-        "node": ">=8"
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/typed-array-buffer": {

frontend/package.json

@@ -43,6 +43,7 @@
     "autoprefixer": "^10.4.24",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "cypress": "^14.0.0",
     "eslint": "^9",
     "eslint-config-next": "16.1.6",
     "jsdom": "^25.0.1",
@@ -54,7 +55,6 @@
     "tailwindcss": "^3.4.17",
     "tailwindcss-animate": "^1.0.7",
     "typescript": "^5",
-    "vitest": "^2.1.8",
-    "cypress": "^14.0.0"
+    "vitest": "^2.1.8"
   }
 }

frontend/src/auth/clerk.tsx

@@ -19,20 +19,29 @@ import type { ComponentProps } from "react";
 
 import { isLikelyValidClerkPublishableKey } from "@/auth/clerkKey";
 
+function isE2EAuthBypassEnabled(): boolean {
+  // Used only for Cypress E2E to keep tests secretless and deterministic.
+  // When enabled, we treat the user as signed in and skip Clerk entirely.
+  return process.env.NEXT_PUBLIC_E2E_AUTH_BYPASS === "1";
+}
+
 export function isClerkEnabled(): boolean {
   // IMPORTANT: keep this in sync with AuthProvider; otherwise components like
   // <SignedOut/> may render without a <ClerkProvider/> and crash during prerender.
+  if (isE2EAuthBypassEnabled()) return false;
   return isLikelyValidClerkPublishableKey(
     process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY,
   );
 }
 
 export function SignedIn(props: { children: ReactNode }) {
+  if (isE2EAuthBypassEnabled()) return <>{props.children}</>;
   if (!isClerkEnabled()) return null;
   return <ClerkSignedIn>{props.children}</ClerkSignedIn>;
 }
 
 export function SignedOut(props: { children: ReactNode }) {
+  if (isE2EAuthBypassEnabled()) return null;
   if (!isClerkEnabled()) return <>{props.children}</>;
   return <ClerkSignedOut>{props.children}</ClerkSignedOut>;
 }
@@ -58,6 +67,15 @@ export function useUser() {
 }
 
 export function useAuth() {
+  if (isE2EAuthBypassEnabled()) {
+    return {
+      isLoaded: true,
+      isSignedIn: true,
+      userId: "e2e-user",
+      sessionId: "e2e-session",
+      getToken: async () => "e2e-token",
+    } as const;
+  }
   if (!isClerkEnabled()) {
     return {
       isLoaded: true,

frontend/src/lib/backoff.test.ts

@@ -20,6 +20,23 @@ describe("createExponentialBackoff", () => {
     expect(backoff.nextDelayMs()).toBe(250); // capped
   });
 
+  it("clamps invalid numeric options and treats negative jitter as zero", () => {
+    vi.spyOn(Math, "random").mockReturnValue(0.9999);
+
+    // baseMs: NaN should clamp to min (50)
+    // maxMs: Infinity should clamp to min (= baseMs)
+    // jitter: negative -> treated as 0 (no extra delay)
+    const backoff = createExponentialBackoff({
+      baseMs: Number.NaN,
+      maxMs: Number.POSITIVE_INFINITY,
+      jitter: -1,
+    });
+
+    // With maxMs clamped to baseMs, delay will always be baseMs
+    expect(backoff.nextDelayMs()).toBe(50);
+    expect(backoff.nextDelayMs()).toBe(50);
+  });
+
   it("reset brings attempt back to zero", () => {
     vi.spyOn(Math, "random").mockReturnValue(0);
 
@@ -30,4 +47,15 @@ describe("createExponentialBackoff", () => {
     backoff.reset();
     expect(backoff.attempt()).toBe(0);
   });
+
+  it("uses defaults when options are omitted", () => {
+    vi.spyOn(Math, "random").mockReturnValue(0);
+
+    const backoff = createExponentialBackoff();
+    expect(backoff.attempt()).toBe(0);
+
+    // Default baseMs is 1000 (clamped within bounds), jitter default is 0.2.
+    // With Math.random=0, delay should be the normalized base (1000).
+    expect(backoff.nextDelayMs()).toBe(1000);
+  });
 });

frontend/vitest.config.ts

@@ -9,8 +9,16 @@ export default defineConfig({
       provider: "v8",
       reporter: ["text", "lcov"],
       reportsDirectory: "./coverage",
-      include: ["src/**/*.{ts,tsx}"],
+      // Policy (scoped gate): require 100% coverage on *explicitly listed* unit-testable modules first.
+      // We'll expand this include list as we add more unit/component tests.
+      include: ["src/lib/backoff.ts"],
       exclude: ["**/*.d.ts", "src/**/__generated__/**", "src/**/generated/**"],
+      thresholds: {
+        lines: 100,
+        statements: 100,
+        functions: 100,
+        branches: 100,
+      },
     },
   },
 });