ComposeFlow

Next.js application in staging zone. Built with React, TypeScript, and Tailwind CSS, with Prisma for database access. Currently undergoing compliance calibration before graduation to apps/.

Overview

ComposeFlow is a TypeScript-strict Next.js application currently in the staging/ zone. The project has completed Phase 2 compliance deployment, adding security CI (TruffleHog + Trivy + Semgrep), a PR template, CODEOWNERS, and SECURITY.md. Security scanning runs in calibration mode through 2026-04-13 to establish a clean baseline before switching to enforcing mode.

Outstanding gaps before graduation:

• CI/CD lint + test pipeline (general CI, not yet deployed)
• Test coverage below 60% target (remediation planned for Phase 4)

Tech Stack

Component	Technology
Language	TypeScript (strict mode)
Framework	Next.js
UI	React + Tailwind CSS
Database ORM	Prisma
Testing	node:test
Linting	ESLint 9.x
CI/CD	GitHub Actions (security.yml)
Zone	staging/

Key Decisions

TypeScript strict mode — tsconfig.json had strict: true set but a noImplicitAny: false override was silently disabling implicit-any checking. The override was removed to restore true strict mode. Pattern: any explicit per-flag override wins over the strict bundle, so remove overrides rather than fighting them. Enforcing strict mode early catches null dereferences and implicit-any bugs at compile time. See reactfc-typing-with-explicit-props-types for related typing conventions.

Examples excluded from tsconfig — The examples/ directory references socket.io and socket.io-client which are not installed dependencies. It is now excluded from tsconfig compilation. Example code that is not part of the app should always live outside the compilation boundary.

Calibration-mode security CI — All new staging repos start with .security-config.yml in calibration mode to establish a baseline before switching to enforcing. This prevents false-positive blocks on initial setup.

ESLint pinned to ^9.39.2 — Do not upgrade to ESLint 10; breaking changes affect the current config. Dependency conflicts must be resolved properly — no --legacy-peer-deps.

Current Status

Zone: staging/ Updated: 2026-03-13 Branch: main

Phase 2 Compliance Checklist

• .github/workflows/security.yml — TruffleHog + Trivy + Semgrep
• SECURITY.md — Vulnerability reporting
• .github/PULL_REQUEST_TEMPLATE.md — PR checklist
• .github/CODEOWNERS — Default ownership
• .security-config.yml — Calibration mode (expires 2026-04-13)
• TypeScript strict mode fully enforced

Known Gaps

• CLAUDE.md pending (run python3 ops-core/scripts/deploy_ai_tooling.py --zone staging)
• Test coverage below 60% target
• CI/CD lint + test pipeline not yet deployed

Lessons Learned

• strict + override = override wins: strict: true in tsconfig does not override explicit per-flag settings. Always audit for flag overrides when strict mode seems not to be working. Removing noImplicitAny: false was sufficient to restore full strict behavior.
• Example code needs compilation exclusion: Code in examples/ that references uninstalled packages must be in the exclude list, or tsc errors will surface on clean builds.
• Calibration-first for new repos: Starting security CI in calibration mode avoids premature blocking and gives time to suppress expected false positives before switching to enforcing.

See Also

• pseudogen — Another staging-zone project following the same compliance path
• reactfc-typing-with-explicit-props-types — TypeScript React component typing patterns relevant to this stack