fix(proof): include route-owned Vite dynamic assets

[bizzybee90]

Purpose

Repair the fail-closed governed proof mismatch that identified one exact Channels Vite script as absent from the route asset closure. Route manifests now include the selected route module's exact Vite dynamicImports descendants while the global entry point remains static-only.

Included scope

• Traverse exact route-owned Vite dynamic imports and their static/dynamic descendants.
• Preserve the entry point as static-only even if a malformed dynamic edge points back to index.html.
• Add synthetic nested-dynamic, cross-route exclusion, real-build closure, exact Channels runtime, and capacity coverage.

Explicit exclusions

• No generic URL or asset allowlist.
• No product UI, request, timeout, count, authentication, database, provider, credential, workflow, or deployment behavior change.
• No production deployment.

Architecture placement

Current owner / directory: existing product-proof asset manifest builder and tests under scripts/.

Dependencies and duplicate-system check: extends the existing artifact/digest-bound Vite graph traversal; no new asset registry or proof subsystem.

Security and tenancy impact

• Authentication / authorization: none.
• Tenant isolation: unchanged; the manifest contains public built assets only and remains exact-source/deployment bound.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none; no raw request URL, credential, tenant identity, or diagnostic payload is retained.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; rollback is the single commit revert.

Verification

• Behavioural tests: proof-first regression failed on unchanged source; focused manifest and policy suites 59/59; complete product-proof suite 1,165 pass, one expected database skip, with one known local real-build failure caused only by the lock-matched dependency directory being symlinked outside the worktree. The modified generator separately passed against the exact retained preview bundle and included /assets/WebsiteVoiceRuntimeStart-ChA7n3e1.js only for Channels (58/127 assets), not Settings.
• CI / security review: scoped ESLint, Prettier, syntax and diff checks pass; security self-review reports zero findings. Fresh hosted exact-head CI, blank DB, CodeQL, Semgrep, ledger and CodeRabbit review are mandatory.

Release safety

• Deployment scope: private no-index preview only after protected exact-head merge.
• Monitoring / stop conditions: stop on any required gate failure, route-closure overflow, unrelated route inheritance, changed diagnostic class, cleanup/postflight/recovery failure, or incomplete writer/readback chain.
• Rollback or containment: predecessor source 24a6283a500be84ed96ba67f04ae424778fd522e; current verified preview run 31566985625, manifest 6ee4591d2a5c691c4a6d990aa6f08580d8813f621a0d9804204bb0cb5cb7ff00; code rollback only.

Documentation and generated files

• Docs / diagrams / ADR updates: none; existing proof architecture is unchanged.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under the branch policy after merge.
• Any PR-size or branch-retention exception is documented below, or neither applies.

Policy exceptions (leave blank when none apply)

PR-size exception rationale:

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• Bug Fixes

  • Improved route asset detection for dynamically loaded modules.
  • Ensured dynamically loaded Website Voice and device-panel assets are assigned only to the channels route.
  • Prevented unrelated Dashboard and settings routes from including channels-specific assets, reducing unnecessary route content.

• Tests

  • Expanded build compatibility and route-manifest coverage for dynamic asset loading.
  • Added verification that generated files, styles, and assets are correctly scoped to each route.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 62752ef1-4e7a-4cd8-a94a-b871ec6d7766

📥 Commits

Reviewing files that changed from the base of the PR and between 6e25b80 and 06688b4.

📒 Files selected for processing (1)

• scripts/product-proof-real-build-compatibility.test.mjs

---

📝 Walkthrough

Walkthrough

The asset manifest now traverses static imports globally and dynamic imports from the selected route. Tests verify that Website Voice assets belong to channels and remain absent from settings and Dashboard routes.

Changes

Dynamic route asset coverage

Layer / File(s)	Summary
Route traversal logic scripts/product-proof-asset-manifest.mjs	routeAssetPaths separately tracks static and dynamic manifest traversal. It prevents repeated traversal and dynamic re-entry through the index entry.
Dynamic route validation scripts/product-proof-asset-manifest.test.mjs, scripts/product-proof-real-build-compatibility.test.mjs	Synthetic and real-build tests compute route manifest closures, verify nested Website Voice assets on channels, and exclude them from settings and Dashboard routes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant routeAssetPaths
  participant indexEntry
  participant selectedRouteModule
  participant manifestEntries
  routeAssetPaths->>indexEntry: Traverse static imports
  routeAssetPaths->>selectedRouteModule: Traverse selected route dynamic imports
  selectedRouteModule->>manifestEntries: Resolve nested dynamic imports
  routeAssetPaths-->>routeAssetPaths: Prevent repeated and index-entry traversal

Loading

Possibly related PRs

• bizzybee90/bizzybee-app#381: Modifies the same asset manifest implementation and related compatibility tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: including route-owned Vite dynamic assets.
Description check	✅ Passed	The description covers the template sections, scope, impact, verification, release safety, and completion checks with relevant details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-route-dynamic-assets-20260812

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. Track spend and usage in your billing settings.

---

_{Comment @coderabbitai help to get the list of available commands.}