spelech · spelech · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [ main, develop ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, develop ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -100,8 +100,10 @@ jobs:
         run: dotnet build --configuration Release
 
       - name: Start server & probe health
+        env:
+          ASPNETCORE_URLS: "http://localhost:8150"
         run: |
-          dotnet run --project src/CodeMaster.Web/CodeMaster.Web.csproj --configuration Release &
+          dotnet run --project src/CodeMaster.Web/CodeMaster.Web.csproj --configuration Release --no-build &
           APP_PID=$!
           echo "Server started with PID $APP_PID"
 

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -4,7 +4,7 @@ on:
   push:
     branches: [ main, develop ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, develop ]
   schedule:
     - cron: '0 6 * * 1'
 

diff --git a/Directory.Build.props b/Directory.Build.props
@@ -5,9 +5,9 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
     <AnalysisLevel>latest</AnalysisLevel>
-    <Version>1.0.0</Version>
-    <AssemblyVersion>1.0.0.0</AssemblyVersion>
-    <FileVersion>1.0.0.0</FileVersion>
+    <Version>1.5.0</Version>
+    <AssemblyVersion>1.5.0.0</AssemblyVersion>
+    <FileVersion>1.5.0.0</FileVersion>
   </PropertyGroup>
 
   <ItemGroup>

diff --git a/addon/CHANGELOG.md b/addon/CHANGELOG.md
@@ -2,6 +2,55 @@
 
 All notable changes to the CodeMaster Home Assistant Add-on will be documented in this file.
 
+## [1.5.0] - 2026-09-06
+
+### Added
+- Pluggable Hardware Entity Transports: Introduced `ITransport`, `ILockTransport`, `IKeypadTransport`, and `ISensorTransport` interfaces with central `ITransportRegistry`.
+- Direct Z-Wave JS Server WebSocket Transport (`ZWaveWebSocketTransport`): Connects directly to `zwave-js-server` via JSON-RPC, eliminating the requirement to enable the MQTT gateway in Z-Wave JS UI.
+- Native Hardware Detection: Validated against physical mesh hardware: Node 18 (August Smart Lock Pro), Node 39 (Schlage BE469ZP Touchscreen Deadbolt), and Node 40 (Ring Keypad v2).
+- Dynamic System Settings Persistence: SQLite `system_settings` table backing `SettingsController` (`GET/PUT /api/settings`, `POST /api/settings/test-connection`) with container environment variable fallbacks and live hot-reconnection.
+- Interactive Settings View & Zustand Store: Real-time segmented transport selector, live WebSocket connection latency & node diagnostic probe, and MQTT credential management.
+- Smart Door Setup Wizard: Auto-populates discovered Z-Wave locks and keypads directly from the active WebSocket session.
+
+## [1.4.0] - 2026-09-06
+
+### Added
+- In-modal PIN validation error alert banner (`role="alert"`) and visual border highlighting in `UserManagement` UI with auto-dismiss on keystroke.
+- Strict 4–8 numeric digit PIN validation in REST API (`UsersController.SetPin`) and MCP tool (`codemaster__create_guest_pin`).
+- Closed-loop test harness assertions replacing trivial checks: live SSE event delivery stream tests, hardware slot error handling, and non-numeric credential rejection tests.
+
+### Fixed
+- Fixed SSE event serialization formatting (`s_sseJsonOptions`) using camelCase naming policy and string enum serialization for real-time frontend streaming.
+
+## [1.3.0] - 2026-09-06
+
+### Added
+- Real-time live activity audit streaming via Server-Sent Events (`EventSource`) at `/api/logs/stream` integrated with Zustand `useAuditStore`.
+- Home Assistant dynamic Ingress reverse-proxy integration with automated `<meta name="base-path">` and `<base href>` runtime HTML injection.
+- Home Assistant Add-on `/data/options.json` configuration ingestion mapping `mqtt_host`, `mqtt_port`, `mqtt_username`, and `mqtt_password` directly to engine options.
+- Manual lock/unlock audit event dispatch to `INotificationDispatcher` (Apprise) with typed client constructor resolution.
+
+## [1.2.0] - 2026-09-06
+
+### Added
+- Authenticated AES-256-GCM `ICredentialEncryptionService` protecting sensitive PIN credentials at rest with dynamic key derivation and transparent legacy plaintext fallback.
+- Cryptographically salted PIN hashing with constant-time equality verification (`PinSecurityHelper.VerifyPinHash`) preventing timing attacks.
+- Physical Lock Code Revocation on user deletion and MCP revocation (`ClearUserHardwareSlotsAsync`) clearing active lock deadbolt slot codes.
+- Timezone-aware access policy evaluation supporting arbitrary `TimeZoneId` mappings (e.g. `America/Chicago`) for localized recurring schedules.
+
+## [1.1.0] - 2026-09-06
+
+### Added
+- Hosted `MqttInboundConsumerService` for reliable continuous consumption and processing of the bounded MQTT channel.
+- Automatic Door Policy Assignments in `UsersController.Create` and `SavePolicy` with multi-door targeting.
+- Automated Home Assistant MQTT Discovery entity registration and unregistration on door lifecycle events.
+- Live real-time lock state and contact sensor telemetry reconciliation via `UpdateDoorStates`.
+
+### Fixed
+- Fixed auto-lock countdown calculation to expose live remaining seconds via dynamic expiration timestamp.
+- Added numeric PIN validation (`All(char.IsAsciiDigit)`) in `HardwareSlotSyncWorker` preventing raw hashes being sent to physical locks.
+- Fixed `HardwareSlotRepository.ClearSlotAsync` marking slots as Synced instead of PendingSync.
+
 ## [1.0.0] - 2026-09-06
 
 ### Added

diff --git a/addon/config.yaml b/addon/config.yaml
@@ -1,6 +1,6 @@
 name: "CodeMaster"
 description: "Universal Access Control & Lock/Keypad Synchronization Engine"
-version: "1.0.0"
+version: "1.5.0"
 slug: "codemaster"
 arch:
   - amd64

diff --git a/docs/screenshots/01-dashboard-doors.png b/docs/screenshots/01-dashboard-doors.png
diff --git a/docs/screenshots/02-users-and-schedules.png b/docs/screenshots/02-users-and-schedules.png
diff --git a/docs/screenshots/03-activity-audit-log.png b/docs/screenshots/03-activity-audit-log.png
diff --git a/docs/screenshots/04-door-setup-wizard.png b/docs/screenshots/04-door-setup-wizard.png
diff --git a/docs/screenshots/05-mobile-responsive.png b/docs/screenshots/05-mobile-responsive.png
diff --git a/docs/superpowers/plans/2026-09-06-codemaster-remediation.md b/docs/superpowers/plans/2026-09-06-codemaster-remediation.md
@@ -0,0 +1,89 @@
+# CodeMaster Remediation & Production Hardening Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Transform CodeMaster from a vibe-coded prototype into an enterprise-grade access control engine by resolving all critical pipeline disconnects, data orphan bugs, security/encryption gaps, hardware sync safety issues, and frontend streaming limitations across 3 minor releases (v1.1.0, v1.2.0, v1.3.0).
+
+**Architecture:** 
+1. Build `MqttInboundConsumerService` consuming `MqttInboundChannel` to process keypad events, lock states, and sensor changes in real time.
+2. Fix policy assignment links (`AccessAssignments`) and schedule evaluation.
+3. Introduce AES-256-GCM reversible encryption for hardware slot codes and salted PIN hashing.
+4. Enforce physical lock clearance on user deletion/revocation.
+5. Provide genuine SSE streaming in the React UI, dynamic Ingress basePath resolution, and HA `/data/options.json` support.
+
+**Tech Stack:** .NET 10, C# 13, Dapper, SQLite (WAL), System.Threading.Channels, MQTTnet, React 19, TypeScript, Vitest, Playwright.
+
+---
+
+## Global Constraints
+- Target .NET 10 (`net10.0`), C# 13, `<Nullable>enable</Nullable>`.
+- Container immutability: all changes build into Docker images cleanly.
+- Verify release version synchronization with `python3 verify_release.py --ci --skip-tests`.
+- Maintain >= 80% test coverage with zero ESLint warnings (`npm run lint`).
+- Only mock when absolutely necessary and ensure mock data matches realistic hardware payloads.
+
+---
+
+## Release Set 1: Core Pipeline & Policy Engine (v1.1.0)
+Branch: `feature/v1.1.0-pipeline-and-policy-engine`
+
+### Task 1.1: Build `MqttInboundConsumerService` Background Worker
+- [ ] Implement `src/CodeMaster.Engine/Services/MqttInboundConsumerService.cs` as a `BackgroundService` that reads from `_inboundChannel.Reader.ReadAllAsync(stoppingToken)`.
+- [ ] Route keypad events to `RingMqttKeypadProvider` and `BuiltInLockKeypadProvider`.
+- [ ] On valid keypad entry, call `AccessPolicyEvaluator`, unlock door, update auto-lock state, write `AccessLog`, and broadcast event.
+- [ ] Route lock telemetry and door contact states to `DoorOperationService.UpdateDoorStates`.
+- [ ] Register `MqttInboundConsumerService` in `Program.cs` and add `codemaster/#` to `MqttOptions.SubscribedTopics`.
+
+### Task 1.2: Auto-Lock Countdown Tracking & State Machine Lifecycle
+- [ ] Enhance `AutoLockStateMachine` to track expiration timestamp and `RemainingSeconds`.
+- [ ] Update `DoorOperationService.GetRemainingAutoLockSecondsAsync` to query state machine.
+
+### Task 1.3: Fix Policy Assignment in `UsersController.SavePolicy` & `UserManagement.tsx`
+- [ ] Modify `SavePolicy` in `UsersController.cs` to assign user to policy and selected/all doors via `AccessAssignment`.
+- [ ] Update `useUserStore.ts` and `UserManagement.tsx` to handle door assignments.
+
+### Task 1.4: Hardware Slot Sync Guard & Status Reset
+- [ ] Ensure `HardwareSlotSyncWorker.cs` never sends hashed values to physical locks.
+- [ ] Fix `HardwareSlotRepository.ClearSlotAsync` to reset `SyncStatus` to `Synced`.
+
+### Task 1.5: Automated Home Assistant Discovery & Release v1.1.0
+- [ ] Publish Home Assistant discovery messages on door registration and MQTT connect.
+- [ ] Add unit and closed-loop tests verifying the pipeline.
+- [ ] Bump version to 1.1.0 and merge to `develop`.
+
+---
+
+## Release Set 2: Cryptographic Security & Hardware Safety (v1.2.0)
+Branch: `feature/v1.2.0-security-and-hardware-safety`
+
+### Task 2.1: AES-256-GCM Reversible Encryption Service
+- [ ] Implement `ICredentialEncryptionService` using AES-256-GCM.
+- [ ] Store authenticated encrypted ciphertext in `EncryptedValue`.
+
+### Task 2.2: Salted PIN Hashing & Constant-Time Verification
+- [ ] Generate secure random salts for PIN hashes.
+- [ ] Use constant-time equality check (`CryptographicOperations.FixedTimeEquals`).
+
+### Task 2.3: Physical Lock Clearance on Revocation/Deletion
+- [ ] When deleting a user in `UsersController` or revoking in MCP `DoorTools`, clear physical lock slots via `lockProvider.ClearSlotCodeAsync`.
+
+### Task 2.4: Timezone Awareness in Access Schedules & Release v1.2.0
+- [ ] Support local timezone in `AccessPolicy.IsActiveAt` before checking time/day windows.
+- [ ] Bump version to 1.2.0 and merge to `develop`.
+
+---
+
+## Release Set 3: Frontend Live Streaming, Ingress & Integration (v1.3.0)
+Branch: `feature/v1.3.0-frontend-streaming-and-ingress`
+
+### Task 3.1: Live SSE Event Streaming in Frontend
+- [ ] Connect `EventSource('/api/logs/stream')` in `useAuditStore.ts` and update `LiveEventFeed.tsx`.
+
+### Task 3.2: Dynamic Home Assistant Ingress Base-Path Support
+- [ ] Inject `X-Ingress-Path` into `index.html` via ASP.NET middleware.
+- [ ] Update `apiClient.getBasePath()` to support Ingress subpaths.
+
+### Task 3.3: Home Assistant OS `options.json` & Apprise Options Fix
+- [ ] Load optional `/data/options.json` in `Program.cs`.
+- [ ] Fix `AppriseOptions` binding and trigger notifications on access events.
+- [ ] Bump version to 1.3.0 and merge to `develop`.