# Nexus Phase 3 Readiness — Evidence Summary

**Date:** 2026-06-05  
**Scope:** `nexus-phase-3-readiness`  
**Branch:** `integration/platform-sprint-before-phase1`  
**Build tag reference:** `nexus-build-87` (split SHA `67441c1`, monorepo `79757e8` after this work)

---

## Task 1 — Git audit

| Item | Value |
|------|-------|
| Remote | `https://github.com/Ninjajago99/ninja-nexus.git` |
| Branch | `integration/platform-sprint-before-phase1` |
| HEAD (monorepo, pre-commit) | `79757e8` — docs(nexus): record build 87 remote and Coolify setup |
| Working tree | Monorepo dirty outside `Ninja Nexus/` (Renninja-v3) — **not committed** |

Recent commits:

```
79757e8 docs(nexus): record build 87 remote and Coolify setup
c392747 chore(release): record build 87 Coolify publish evidence
a237daa fix(release): seed POC users when Nexus config lacks SeedPocUsers
1bf72dd feat(platform): complete Nexus build 87 platform POC
4ed0fd4 feat(nexus): add identity platform, setup flow, and platform lock
```

---

## Task 2 — CI

Added `.github/workflows/ci.yml` at Ninja Nexus repo root (subtree root).

| Project | Path | TFM |
|---------|------|-----|
| Nexus.Contracts | `platform/contracts/Nexus.Contracts/Nexus.Contracts.csproj` | net8.0 |
| NexusIdentity.Api | `source/nexus-identity/NexusIdentity.Api/NexusIdentity.Api.csproj` | net8.0 |
| NexusShell | `source/nexus-shell/NexusShell/NexusShell.csproj` | net10.0-windows |
| NexusShell.Tests | `source/nexus-shell/NexusShell.Tests/NexusShell.Tests.csproj` | net10.0-windows |
| NexusInstaller | `source/nexus-installer/NexusInstaller.csproj` | net8.0-windows (optional, built in CI) |

**Triggers:** push `main`, push `integration/platform-sprint-before-phase1`, PR to `main`  
**Runner:** `windows-latest`  
**SDKs:** .NET 8.x + 10.x  
**Steps:** checkout → setup-dotnet → restore → build Release → test  
**No deploy, no secrets, no Coolify.**

---

## Task 3 — Local build/test commands

Run from `Ninja Nexus/` (repo root after subtree split):

```powershell
$root = (Get-Location).Path

dotnet build "$root\platform\contracts\Nexus.Contracts\Nexus.Contracts.csproj" -c Release
dotnet build "$root\source\nexus-identity\NexusIdentity.Api\NexusIdentity.Api.csproj" -c Release
dotnet build "$root\source\nexus-shell\NexusShell\NexusShell.csproj" -c Release
dotnet build "$root\source\nexus-installer\NexusInstaller.csproj" -c Release
dotnet test "$root\source\nexus-shell\NexusShell.Tests\NexusShell.Tests.csproj" -c Release
```

**Result (2026-06-05):** All builds PASS (0 errors). NexusShell.Tests **12/12 passed**. NU1510/CS0067/CS0169 warnings only.

---

## Task 4 — Coolify discovery

Script: `scripts/coolify/verify-nexus-coolify.ps1` (token via `~/.renninja-secrets/coolify-api-token.ps1`, never logged).

| Resource | UUID | Status |
|----------|------|--------|
| Project "Ninja Nexus" | `d38yxbj3hi8pie1mjh5jff7f` | exists |
| `nexus-downloads` | `vh3442no566kew57rzji7qha` | running — **https://nexus.ninjakernen.info** |
| `nexus-backend` | `x6vd3qnxkzdx2p5k7h5j40sy` | running — **http://x6vd3qnxkzdx2p5k7h5j40sy.85.208.48.244.sslip.io** |
| `nexus-db` | `qtjb1lwa9g3qk6jt33vi6d1m` | running:healthy |

**Note:** Coolify `nexus-downloads` uses an inline minimal Dockerfile (autoindex `/downloads/`), not the repo `deployment/coolify/nexus-downloads/Dockerfile`. Gateway nginx + static files are applied via `post_deployment_command` from `deploy-nexus-downloads.ps1`.

---

## Task 5 — `/health` fix

### Problem

`GET https://nexus.ninjakernen.info/health` returned **404**. Backend direct URL was healthy:

```
GET http://x6vd3qnxkzdx2p5k7h5j40sy.85.208.48.244.sslip.io/health → 200 {"status":"healthy","version":"0.1.0-poc"}
```

Root cause: `publish-coolify.ps1` overwrote `post_deployment_command` with file uploads only (no nginx gateway). Even after `deploy-nexus-downloads.ps1`, `nginx -s reload` failed because nginx runs as **PID 1** in the Coolify container.

### Fix applied (safe API patch)

1. Updated `deployment/coolify/nexus-downloads/nginx.conf` — `/health` serves static `health.json` via `alias`.
2. Added `deployment/coolify/nexus-downloads/www/health.json` (build 87 metadata).
3. Updated `scripts/coolify/deploy-nexus-downloads.ps1`:
   - Upload `health.json` in post-deploy
   - End command with `nginx -t && kill -HUP 1` (reload via signal to PID 1)
4. Ran `deploy-nexus-downloads.ps1` against Coolify API (no token printed).

### Verification

| URL | Before | After |
|-----|--------|-------|
| `/health` | 404 | **200** `{"status":"healthy","version":"0.1.0-identity2","build":87,"source":"nexus-downloads-gateway"}` |
| `/downloads/latest.json` | 200 build 87 | **200 build 87** (unchanged) |

Fallback: `/health.json` also returns 200 with same payload.

---

## Task 6 — Login 404 (documented)

| Endpoint | Public domain | Backend sslip | Shell default |
|----------|---------------|---------------|---------------|
| `POST /connect/token` | Was 404 (no nginx proxy) → **200 after gateway redeploy** | 200 | **`http://localhost:5050/connect/token`** |
| `GET /api/users/me` | Proxied via nginx `/api/` when gateway applied | 200 with token | localhost |

**Build 87 scope:** Nexus Shell authenticates against **embedded local Identity host** (`appsettings.json` → `Authority: http://localhost:5050`). Public web login / hosted portal is **not** Build 87 scope.

Code references:

- `source/nexus-shell/NexusShell/appsettings.json` — `Authority: http://localhost:5050`
- `source/nexus-shell/NexusShell/Services/AuthService.cs` — `PostAsync("connect/token", ...)`
- `source/nexus-shell/NexusShell/Services/IdentityHostService.cs` — `DefaultAuthority = http://localhost:5050`

**Operational note:** Run `deploy-nexus-downloads.ps1` after `publish-coolify.ps1` to preserve nginx proxy routes (`known-limitations.md`).

---

## Task 7 — Build 87 download verification

`GET https://nexus.ninjakernen.info/downloads/latest.json`:

| Field | Value |
|-------|-------|
| build | **87** |
| version | `0.1.0-identity2` |
| sha256 (ZIP) | `9abb6b166b2cd79393d87c0c7526ddada4e4c9e03af4cd288200623d450f9d06` |
| installerSha256 | `4d337872daaf2c06…` (full hash in manifest) |

| Check | Result |
|-------|--------|
| Download ZIP + SHA256 | **match** |
| Download NexusSetup.exe + SHA256 | **match** |
| Installer HEAD | 200 |

---

## Task 8 — Phase 3 readiness gate

| Gate | Status |
|------|--------|
| GitHub remote `ninja-nexus` | OK |
| CI workflow on push/PR | **Added** (pending first GitHub Actions run) |
| Local Release build + tests | **PASS** |
| Coolify downloads channel build 87 | **PASS** |
| Public `/health` | **FIXED** (200) |
| Public web login as product feature | **Out of scope** — Shell uses localhost Identity |
| SignalR / remote admin / registry | **Not in scope** (per mission) |

**Phase 3 ready for continued sprint:** Yes for CI + health + CDN; public hosted login remains a future platform decision.

---

## Task 9 — Commit / push workflow

Monorepo path: `C:\Users\jtrs\Documents\renninjadk`  
Nexus-only changes under `Ninja Nexus/`.

Push to `ninja-nexus` remote:

```powershell
git add "Ninja Nexus/.github" "Ninja Nexus/deployment/coolify/nexus-downloads" `
  "Ninja Nexus/scripts/coolify/deploy-nexus-downloads.ps1" `
  "Ninja Nexus/docs/evidence/nexus-phase-3-readiness"
git commit -m "chore(nexus): prepare phase 3 CI and public health"
git subtree split -P "Ninja Nexus" -b nexus-export
git push origin nexus-export:integration/platform-sprint-before-phase1
```

Verify remote: `git remote -v` → `ninja-nexus.git`

---

## Files changed (this mission)

| File | Change |
|------|--------|
| `.github/workflows/ci.yml` | New GitHub Actions CI |
| `deployment/coolify/nexus-downloads/nginx.conf` | Static `/health` via `health.json` |
| `deployment/coolify/nexus-downloads/www/health.json` | Static health payload |
| `scripts/coolify/deploy-nexus-downloads.ps1` | health.json upload + `kill -HUP 1` reload |
| `docs/evidence/nexus-phase-3-readiness/SUMMARY.md` | This document |

Coolify runtime updated via API (post_deploy nginx + health.json); not stored in git beyond scripts/config above.
