docs: refresh VeriLink handover for Plans 1–5

[messagesgoel-blip]

Summary

• Rewrite docs/superpowers/plans/HANDOVER.md to reflect Plans 1–5 on main (PRs feat: VeriRank engine + trust-engine gRPC server (Plan 1) #1, feat: Plan 1+2 — Trust engine + Control-plane TS foundation #4–test: add missing control-plane integration cases #9), plan coverage audit, and next work (design §13 step 10+).
• Update AGENTS.md stack + CI list for Go/TS monorepo and integration CI jobs.

Out of band (shared memory, not in this PR)

• Added /srv/storage/shared/memory/verilink-productization-arc.md
• Indexed VeriLink in /srv/storage/shared/memory/MEMORY.md and refreshed the VeriLink row in /srv/storage/AGENTS.md

Test plan

• Docs-only review
• Confirm HANDOVER next-step guidance matches productization design §13

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 70cb6d7b-af60-4275-9ab7-c4f9c2822461

📥 Commits

Reviewing files that changed from the base of the PR and between b2f7e2d and 822d333.

📒 Files selected for processing (2)

• AGENTS.md
• docs/superpowers/plans/HANDOVER.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/verilink-handover-sota

---

_{Comment @coderabbitai help to get the list of available commands.}

[messagesgoel-blip]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[qodo-code-review]

PR Summary by Qodo

Refresh VeriLink handover and monorepo guidance for Plans 1–5

📝 Documentation 🕐 10-20 Minutes

AI Description

• Reframes the handover around completed Plans 1–5 and current productization state.
• Directs future work to network scoring and subsequent design sequencing.
• Aligns agent stack and CI guidance with the Go/TypeScript monorepo.

Diagram

graph TD
  D["Product Design"] --> H["Product Handover"] --> N["Step 10+"]
  P["Plans 1-5"] --> H
  R["Current Monorepo"] --> H
  R --> A["Agent Guide"]
  C["Integration CI"] --> A

Loading

High-Level Assessment

The chosen approach is appropriate: one consolidated handover captures completed-plan coverage and next-step sequencing, while AGENTS.md remains the operational source for stack and CI guidance. Keeping the previous Plan 5-specific handover would leave stale execution instructions and fragment the current productization context.

Files changed (2) +91 / -78

Documentation (2) +91 / -78

AGENTS.mdAlign repository guidance with the live monorepo and CI gates +16/-11

Align repository guidance with the live monorepo and CI gates

• Documents the Go and TypeScript architecture, current services, Postgres usage, and RFC 9421 security support. Expands the blocking CI list to include scoped linting, generated-proto verification, and Go and control-plane integration jobs.

AGENTS.md

HANDOVER.mdReplace the Plan 5 handover with a Plans 1–5 productization overview +75/-67

Replace the Plan 5 handover with a Plans 1–5 productization overview

• Rewrites the handover to audit delivered work across Plans 1–5, summarize the current platform surfaces, and record known follow-ups. Replaces obsolete Plan 5 execution instructions with productization steps 10–18, key references, and current development commands.

docs/superpowers/plans/HANDOVER.md

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 15 rules

1. Auth hardening sequencing skipped 🐞 Bug ⛨ Security

Description

The handover directs the next session to step 10 despite acknowledging that step 8's
external-base-url hardening remains unfinished. This can leave @target-uri authority binding
dependent on forwarded headers that are unsafe when an upstream proxy does not sanitize them or the
edge is directly reachable.

Code

docs/superpowers/plans/HANDOVER.md[6]

+> **Next session:** Start productization sequencing **step 10** (network score computation), unless the user picks a different track

Relevance

⭐ Low

Team previously rejected correcting HANDOVER next-step guidance; current sequencing also reflects
explicit user judgment.

PR-#7

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The handover itself records external-base-url as unfinished, while the canonical design includes
it in step 8. The executable defaults it to empty, and the fallback derives scheme and authority
from X-Forwarded-Proto, Host, and X-Forwarded-Host.

docs/superpowers/plans/HANDOVER.md[40-44]
docs/superpowers/specs/2026-07-25-verilink-productization-design.md[921-923]
cmd/edge-verifier/main.go[18-25]
internal/edgeverifier/proxy.go[136-153]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The handover advances directly to productization step 10 while `external-base-url`, a step 8 request-auth requirement, remains an acknowledged follow-up. When it is unset, the edge reconstructs the signed target URI from forwarded headers, whose safety depends on deployment topology and trusted-proxy sanitization.

## Issue Context
Revise the next-session guidance to make authority binding a prerequisite for continuing the productization sequence. Require `external-base-url` for production deployments or explicitly define and enforce trusted-proxy header handling before retaining the fallback.

## Fix Focus Areas
- docs/superpowers/plans/HANDOVER.md[3-6]
- docs/superpowers/plans/HANDOVER.md[40-44]
- docs/superpowers/plans/HANDOVER.md[61-72]
- docs/superpowers/specs/2026-07-25-verilink-productization-design.md[921-923]
- cmd/edge-verifier/main.go[18-25]
- internal/edgeverifier/proxy.go[136-153]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Test sequence changes directory twice 🐞 Bug ≡ Correctness

Description

After the unit-test command changes the shell into control-plane, the next command attempts to
enter control-plane/control-plane and fails. Copying the documented block therefore never runs the
integration tests.

Code

docs/superpowers/plans/HANDOVER.md[105]

cd control-plane && npm run test:integration
-```

Relevance

⭐ Low

Team previously rejected fixes to broken executable instructions in the same plans documentation.

PR-#7

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Lines 103 and 105 are in one shell block and both change into control-plane; the package manifest
confirms both scripts execute from that same package directory.

docs/superpowers/plans/HANDOVER.md[93-110]
control-plane/package.json[6-14]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The sequential quick-reference block runs `cd control-plane` twice. Because the first `cd` persists in the shell, the second command fails before executing the integration tests.

## Issue Context
Enter `control-plane` once and run both npm scripts there, or scope each command in a subshell so each starts from the repository root.

## Fix Focus Areas
- docs/superpowers/plans/HANDOVER.md[102-105]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}