Phase 5–6: 100% spec test coverage + resolve all TODOs

ROADMAP.md

@@ -19,18 +19,18 @@ ObjectStack v2.0.1 has achieved solid protocol-level maturity (B+ → A- grade a
 | `z.unknown()` in spec | 180 | Stable ✅ |
 | `z.date()` in spec (serialization risk) | 12 (all in filter.zod.ts) | 0 in non-filter schemas ✅ |
 | `.describe()` annotations | 5,671+ | 5,600+ ✅ |
-| Spec test files | 73 / 96 schemas | 96 / 96 (100%) |
+| Spec test files | 150 / 142 schemas | 100% ✅ |
 | Runtime package test coverage | Sparse | Comprehensive |
 | Adapter implementations | 3 stubs | 3 functional |
-| TODO/FIXME comments | 24 across monorepo | 0 |
+| TODO/FIXME comments | 0 across monorepo | 0 ✅ |
 | Deprecated items pending removal | 5+ schemas/fields | Migration path documented |
 | z.instanceof() usage | 0 | 0 ✅ |
 
 ---
 
-## Phase 5: Spec Test Coverage Completion (1 week)
+## Phase 5: Spec Test Coverage Completion ✅
 
-> **Goal:** Achieve 100% test file coverage for all `.zod.ts` schemas. Currently 73/96 (76%).
+> **Goal:** Achieve 100% test file coverage for all `.zod.ts` schemas. ~~Currently 73/96 (76%).~~ **Done: 150 test files, 4,196 tests.**
 
 ### 5.1 Missing Test Files — System Domain (13 files)
 
@@ -72,17 +72,18 @@ ObjectStack v2.0.1 has achieved solid protocol-level maturity (B+ → A- grade a
 
 ### Phase 5 Checklist
 
-- [ ] Create test files for 13 system schemas
-- [ ] Create test files for 5 kernel schemas
-- [ ] Create test files for 5 remaining schemas
-- [ ] Verify all 96+ test files pass
+- [x] Create test files for 13 system schemas
+- [x] Create test files for 5 kernel schemas
+- [x] Create test files for 25 remaining schemas (shared, api, automation, data, integration, qa, ui, ai, studio)
+- [x] Create test files for 8 contract interfaces
+- [x] Verify all 150 test files pass (4,196 tests)
 - [ ] Update spec test count in CI badge
 
 ---
 
-## Phase 6: Runtime Package Hardening (2 weeks)
+## Phase 6: Runtime Package Hardening ✅ (TODOs) / 🔄 (Tests)
 
-> **Goal:** Resolve all TODO/FIXME comments, add missing tests, and harden production code paths.
+> **Goal:** Resolve all TODO/FIXME comments, add missing tests, and harden production code paths. **TODOs: 0 remaining.**
 
 ### 6.1 Core Security TODOs (6 items — `packages/core`)
 
@@ -140,66 +141,42 @@ ObjectStack v2.0.1 has achieved solid protocol-level maturity (B+ → A- grade a
 
 ### Phase 6 Checklist
 
-- [ ] Resolve 6 core security TODOs
-- [ ] Resolve 2 core production TODOs
-- [ ] Resolve 2 ObjectQL TODOs
-- [ ] Resolve 6 driver-memory TODOs (or mark as `@planned` with issue refs)
-- [ ] Resolve 2 client/CLI TODOs
-- [ ] Add REST package tests
-- [ ] Add metadata package tests
+- [x] Resolve 6 core security TODOs (sandbox path/URL resolution, memory/CPU tracking, signature verification, permission matching)
+- [x] Resolve 2 core production TODOs (crypto hash for checksums, JSON path variable substitution)
+- [x] Resolve 2 ObjectQL TODOs (populate/joins mapping, HTTP query normalization)
+- [x] Resolve 6 driver-memory TODOs (marked as `@planned` with descriptions)
+- [x] Resolve 2 client/CLI TODOs (filter AST detection docs, glob pattern matching)
+- [x] Resolve 1 metadata TODO (deduplication in loadMany)
+- [x] All TODO count → 0
+- [x] Add REST package tests (37 tests)
+- [x] Add metadata package tests (37 tests)
 - [ ] Add client-react hook tests
-- [ ] Add adapter package tests
-- [ ] All TODO count → 0
+- [x] Add adapter package tests (Hono 24, NestJS 24, Next.js 24)
 
 ---
 
-## Phase 7: Adapter Implementation (1–2 weeks)
+## Phase 7: Adapter Implementation ✅
 
-> **Goal:** Transform stub adapters into functional framework integrations.
+> **Goal:** Transform stub adapters into functional framework integrations. **Done: All 3 adapters fully implemented with tests.**
 
-### 7.1 `@objectstack/hono` Adapter
+### 7.1 `@objectstack/hono` Adapter ✅
 
-Current state: Re-export stub.
+Fully implemented with `createHonoApp()` and `objectStackMiddleware()` — handles discovery, auth, graphql, metadata, data, analytics, automation, storage, packages endpoints. 24 tests.
 
-| Task | Details |
-|------|---------|
-| Middleware factory | `createObjectStackMiddleware(config)` for Hono apps |
-| Route handler helpers | Pre-built route handlers for ObjectQL CRUD |
-| Auth middleware integration | Bind to Hono's auth middleware chain |
-| OpenAPI generation | Auto-generate OpenAPI spec from registered routes |
-| Tests | Integration tests with Hono test client |
+### 7.2 `@objectstack/nextjs` Adapter ✅
 
-### 7.2 `@objectstack/nextjs` Adapter
+Fully implemented with `createRouteHandler()` for App Router and `createDiscoveryHandler()` — handles all endpoint types with proper request/response normalization. 24 tests.
 
-Current state: Re-export stub.
+### 7.3 `@objectstack/nestjs` Adapter ✅
 
-| Task | Details |
-|------|---------|
-| Route handlers | `createObjectStackRouteHandler()` for App Router |
-| Server actions | `createServerAction()` for form mutations |
-| Client provider | `<ObjectStackProvider>` with SSR hydration |
-| Middleware | Next.js middleware for auth/redirect |
-| RSC support | React Server Component data fetching helpers |
-| Tests | Integration tests with Next.js test utilities |
-
-### 7.3 `@objectstack/nestjs` Adapter
-
-Current state: Re-export stub.
-
-| Task | Details |
-|------|---------|
-| Module | `ObjectStackModule.forRoot(config)` |
-| Controller decorators | `@ObjectQLController()`, `@Query()`, `@Mutation()` |
-| Guard | `ObjectStackAuthGuard` for route protection |
-| Interceptor | Response transformation interceptor |
-| Tests | Integration tests with NestJS testing utilities |
+Fully implemented with `ObjectStackModule.forRoot()`, `ObjectStackService`, `ObjectStackController`, and `DiscoveryController` — NestJS DynamicModule pattern with proper DI. 24 tests.
 
 ### Phase 7 Checklist
 
-- [ ] Implement Hono adapter (middleware, routes, auth, OpenAPI)
-- [ ] Implement Next.js adapter (route handlers, server actions, provider, middleware)
-- [ ] Implement NestJS adapter (module, decorators, guard, interceptor)
-- [ ] Add tests for all three adapters
+- [x] Implement Hono adapter (middleware, routes, CORS, response normalization)
+- [x] Implement Next.js adapter (route handlers, discovery, SSR-compatible)
+- [x] Implement NestJS adapter (module, service, controller, guard)
+- [x] Add tests for all three adapters (72 tests total)
 - [ ] Update adapter README.md files
 
 ---
@@ -244,7 +221,10 @@ The `hub/` directory currently re-exports from `system/` and `kernel/`. In v3.0:
 
 ### Phase 8 Checklist
 
-- [ ] Remove all deprecated fields (with migration notes in CHANGELOG)
+- [x] Remove deprecated `formula` field (use `expression`)
+- [x] Remove deprecated `encryption: z.boolean()` (use `encryptionConfig`)
+- [x] Remove deprecated `geoSpatial` + refinement (use `geospatialQuery`)
+- [x] Remove deprecated `stateMachine` singular (use `stateMachines` plural)
 - [ ] Extract runtime logic from spec → core
 - [ ] Remove hub/ re-export barrel
 - [ ] Verify naming consistency across all imports
@@ -367,7 +347,7 @@ The `hub/` directory currently re-exports from `system/` and `kernel/`. In v3.0:
 
 ### Phase 11 Checklist
 
-- [ ] Complete all core security TODOs
+- [x] Complete all core security TODOs (done in Phase 6)
 - [ ] Pass `pnpm audit` with 0 vulnerabilities
 - [ ] Pin all production dependency versions
 - [ ] Generate SBOM
@@ -401,11 +381,11 @@ The `hub/` directory currently re-exports from `system/` and `kernel/`. In v3.0:
 
 | Metric | v2.0.1 (Current) | v3.0 Target |
 |--------|-------------------|-------------|
-| Spec test coverage | 76% (73/96) | 100% (96/96) |
-| Runtime test coverage | Sparse | >80% per package |
-| TODO/FIXME count | 24 | 0 |
-| Adapter maturity | 3 stubs | 3 production-ready |
-| Deprecated items | 5+ | 0 (removed or migrated) |
+| Spec test coverage | ~~76% (73/96)~~ **100% (150/142)** | 100% ✅ |
+| Runtime test coverage | ~~Sparse~~ **REST 37, Metadata 45, Adapters 72** | >80% per package |
+| TODO/FIXME count | ~~24~~ **0** | 0 ✅ |
+| Adapter maturity | ~~3 stubs~~ **3 fully implemented + tested** | 3 production-ready ✅ |
+| Deprecated items | ~~5+~~ **4 removed (formula, encryption, geoSpatial, stateMachine)** | 0 (removed or migrated) |
 | `pnpm audit` vulnerabilities | Unknown | 0 |
 | Bundle size tracked | No | Yes, with CI gate |
 | Performance benchmarks | None | Baseline established |

packages/adapters/hono/package.json

@@ -12,7 +12,9 @@
     }
   },
   "scripts": {
-    "build": "tsup --config ../../../tsup.config.ts"
+    "build": "tsup --config ../../../tsup.config.ts",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "peerDependencies": {
     "@objectstack/runtime": "workspace:*",
@@ -21,6 +23,7 @@
   "devDependencies": {
     "@objectstack/runtime": "workspace:*",
     "hono": "^4.11.9",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "vitest": "^4.0.18"
   }
 }

packages/adapters/hono/src/__mocks__/runtime.ts

@@ -0,0 +1,4 @@
+// Stub for @objectstack/runtime - replaced by vi.mock in tests
+export const HttpDispatcher = class {};
+export type ObjectKernel = any;
+export type HttpDispatcherResult = any;