# Roadmap Audit Workflow (SPQ-v2 / roadmap_5.2.md)

When asked to "plan the next step" from a roadmap, roadmap items marked NOT DONE or PARTIAL may already be deployed. Status headers in the roadmap are stale if tests pass against a previous session's work. Always verify before assuming implementation is needed.

## Audit Checklist

### 1. Check the codebase

```bash
# Does the migration file exist in the repo?
ls pb_migrations/*<keyword>*

# Does the source code already reference the feature?
grep -rn <keyword> src/ --include='*.ts' --include='*.tsx'
```

### 2. Check the PB container (server-side items)

```bash
# Get the container ID
export PB_CID=$(docker ps --format '{{.ID}}' --filter name=pocketbase)

# Is the migration file in the container?
docker exec $PB_CID ls /pb_data/migrations/ | grep <version>

# Has it been applied?
docker exec $PB_CID /usr/local/bin/pocketbase migrate up --dir=/pb_data --migrationsDir=/pb_data/migrations
# Expected success: "No new migrations to apply."
```

### 3. Check server infrastructure (nginx, systemd)

```bash
# Does the nginx snippet exist?
ls /etc/nginx/snippets/spq-*

# Is it included in the site config?
grep spq- /etc/nginx/sites-enabled/shopproquote

# Are systemd services running?
systemctl status spq-ai-validator

# Do nginx headers pass the syntax check?
sudo nginx -t
```

### 4. Verify live behavior

```bash
# Check response headers on production
curl -sI https://shopproquote.graj-media.com/ | grep -iE 'content-security|content-type|frame|referrer|permissions'

# Check port bindings
ss -tlnp | grep <port>
```

### 5. Report findings

Structure the response:
- What's already deployed (with evidence)
- What's actually remaining (be specific, minimal)
- What's deferred per user preference (and why)
- Let the user decide go/no-go on remaining work

## Pitfalls

- The Master Status Audit table in the roadmap may be wrong — it's maintained by hand
- Execution Memos at the bottom are the authoritative record of what was completed
- A migration file in the repo doesn't mean it's applied to the container
- Some features have frontend done but server-side not deployed (marked PARTIAL in roadmap)
- The user may skip low-value remaining work (e.g., dev proxy fixes when they run prod only)
- Always offer to update the roadmap status and append an Execution Memo after verifying