[Mobin-Karam]

Summary

• harden the Student v2 production Docker/nginx path, API proxy failures, cache policy, and service-worker startup
• add a production verifier that rejects legacy/SPA responses masquerading as /api/v2/openapi.json
• add a guarded, idempotent private-organization seed with all eight supported roles, including advisor mobinkaram and student mahakaram
• preserve the JSON-backed education catalog and seed all 212 textbooks for the student's grade/track selection
• add same-organization plan and learning-resource sharing across Backend, Student, Admin, and the shared capability contract
• close Admin API parity and CI coverage gaps for the added education flows

Private organization

The seed creates eight active organization members: platform admin, organization admin, advisor, teacher, mentor, content manager, guardian, and student. The platform administrator keeps a global role assignment while also belonging to the organization. Advisor, guardian, teacher, and mentor relationships are scoped to mahakaram.

Production seeding is denied unless ALLOW_PRODUCTION_BOOTSTRAP=true, all eight passwords are provided, each is at least 12 characters and mutually distinct, and the student national code passes Iranian checksum validation. Secrets and the national code are never printed.

See docs/operations/private-organization-bootstrap.md for the PaaS release command and environment variables.

Production finding

On 2026-09-21, https://st.mahakaram.ir/ returned the legacy v1 HTML artifact (last-modified 2026-08-25), while https://st.mahakaram.ir/api/v2/openapi.json also returned that HTML with HTTP 200 and text/html. The new verifier rejects this false-positive deployment state.

After merge, redeploy the apps/student/Dockerfile service and attach st.mahakaram.ir to that v2 Student service. Configure API_PROXY_TARGET with the private backend-v2 URL, then run:

node tooling/deployment/verify-student-production.mjs https://st.mahakaram.ir

Validation

• Backend typecheck/build and 30 suites / 158 tests passed
• private seed ran twice against a disposable development database and once in guarded production mode
• verified per database: 1 organization, 8 users, 8 active memberships, 8 role assignments, 4 active relationships, 212 textbooks
• Student: typecheck, 83 tests, 8 accessibility tests, build
• Admin: typecheck, 172 tests with branch coverage above threshold, 4 accessibility tests, build, route parity 177/177
• shared capability contract check: 8 roles and 86 backend capabilities synchronized
• Student production Docker build and local root/direct-route/OpenAPI/proxy/cache verification passed
• Graphify source fingerprint passed from a clean worktree

Deployment note

Merging does not update the live PaaS by itself. Redeploy the v2 Student service, configure the private API target and seed secrets in the PaaS secret manager, run the one-time production seed job, remove those one-time secrets, disable the bootstrap flag, and run the production verifier.