riotpiao.com/tasks/04-phase3-delivery.md

Phase 3 — Surface E: delivery tree

~3 days. Zero new data sources, zero new attack surface, highest signal — reads as platform engineering, not hobby.

RED

• delivery_test.go — apps group correctly by sync-wave; Secret names absent from output (kind+count only); repoURL absent from output
• delivery.test.tsx — 550-node tree renders under frame budget with virtualization on
• delivery.e2e.ts (Playwright, hard requirement) — load /delivery, click app node, assert side panel opens with virtualized resource tree, assert no Secret names appear in DOM

GREEN

• GET /api/delivery — Argo apps, wave-grouped (0→8), resource children lazy; capped 256 KB
• GET /api/delivery/{app}/resources — cursor-paginated at 100 items (prometheus alone has 68 resources today)
• Frontend: React Flow, wave columns left→right from sync-wave annotations. Click app → side panel with react-arborist virtualized resource tree, lazy-loaded children
• Live sync animation OutOfSync → Syncing → Synced driven by Application watch (reuse Phase 2 SSE /api/stream, add delivery event type)
• Redaction check specific to this surface: 21 Secret resources appear in Argo trees today — render kind+count only, never names (includes sops-secrets); status.conditions[].message echoes raw errors with internal hostnames — emit condition type only

REFACTOR

• simplify pass on wave-grouping + virtualized tree code

Verify

# trigger an Argo sync, observe wave-ordered animation
argocd app sync homelab-root
pnpm test:e2e delivery.e2e.ts   # required, must pass before merge

Also in scope for this phase: delete fabricated stats in app/page.tsx ("40% CPU reduction", "99.2% uptime", "Mission-critical", "60% latency cut") — wire each card to a real number from /api/topology or /api/delivery, or remove the claim. Five of six landing cards link to routes that don't exist (/infrastructure, /systems, /llm, /kafka, /opensource) — fix or remove.

Next: 05-phase4-terminal.md