feat: NDSEP Phase 44 full codebase merge

[devin-ai-integration]

Summary

Fully extracted and merged the NDSEP Phase 44 codebase from two Google Drive tarballs:

• ndsep_phase44_final.tar (681 files, earlier snapshot from April 3)
• ndsep_phase44_final_20260426_181302.tar (4589 files, latest version from April 26)

The April 26 tarball was used as the authoritative base since it is the newer, more complete version containing all Phase 35–44 changes.

What's included (844 files, 259K lines):

• Client: React/TypeScript PWA with shadcn/ui components, 80+ pages, i18n, offline support
• Server: Node.js/Express with tRPC, Drizzle ORM, PostgreSQL, WebSocket, PDF generation
• Workers: Go (compliance engine, DPI, IPAM, etc.), Python (ML, drift detection, ROPA), Rust (financial ledger, BGP validator, residency enforcer)
• Infrastructure: Docker Compose, Kubernetes manifests, Airflow DAGs, Prometheus configs
• Mobile: Flutter + React Native apps
• Testing: Playwright E2E, Vitest unit tests
• CI/CD: GitHub Actions workflow
• Docs: Security audit reports, deployment guide, changelogs (Phase 35–44)

Fixes applied on top of the tarballs:

1. CI pnpm version: Updated from v9 to v10.4.1 to match packageManager field
2. Rust compile fix: Added with-serde_json-1 feature to tokio-postgres for lakehouse_writer
3. Rust formatting: Ran cargo fmt on all worker source files
4. Hardcoded paths: Replaced /home/ubuntu/ndsep/ with ./ in 8 files (tests, scripts, workers)
5. Cleanup: Removed compiled binaries, __pycache__, .manus-logs, build artifacts; updated .gitignore

CI Status:

• TypeScript check, Build, Go, Python, Rust, Security Scan — all pass
• Unit tests — 866 pass, 93 skipped
• 58 integration test failures — pre-existing in the tarball (phase15/16/43/44 require running server + seeded DB)
• Trivy — external security scan integration (not from the CI workflow)

Review & Testing Checklist for Human

• Verify the codebase structure matches expectations for the NDSEP project
• Check that certs/ndsep-signing.crt and certs/ndsep-signing.key are acceptable to commit (consider rotating)
• Review .env.production.example for any real secrets
• Consider separating integration tests from unit tests in CI (phase15/16/20/43/44 need a running server)
• Run locally with pnpm install && pnpm run dev to verify the app starts

Notes

• The .manus/ directory debug query logs were excluded from the commit
• Compiled Go/Rust binaries were stripped (reduced from 1.5GB tar to ~70MB source)
• The Trivy check failure is from an external GitHub integration, not the CI workflow (which has continue-on-error: true)

Link to Devin session: https://app.devin.ai/sessions/638573251e5f4e859a5f3b205afec3cd

[devin-ai-integration]

Original prompt from Patrick

https://drive.google.com/file/d/1FXnnJMcZrzVwrS4M22ndDJWTsC_rVpT0/view?usp=sharing
https://drive.google.com/file/d/1uYwYhlc5IYKVICSIw-ggGX8KBrxf5uYG/view?usp=sharing

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-advanced-security]

Trivy found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[devin-ai-integration]

End-to-End Test Results

Ran the merged codebase locally with PostgreSQL, seeded demo data, and tested the full-stack flow via browser.

All 5 tests passed.

Test Results

#	Test	Result
1	Server Health & API Layer (/api/health, /api/ready)	✅ PASSED
2	Demo Login → Admin Dashboard (auth + frontend render)	✅ PASSED
3	Organizations Page — DB Query (10 Nigerian orgs displayed)	✅ PASSED
4	Compliance Engine — Complex Component Rendering	✅ PASSED
5	API Endpoints (Prometheus metrics + tRPC auth.me)	✅ PASSED

Key Evidence

Organizations page showing seeded Nigerian orgs (MTN, NNPC, LUTH, Jumia, NPA) with correct sectors and compliance statuses:

Compliance Engine with Active Policies, Violations by Severity chart, and OPA Rego Policy Editor:

tRPC auth.me confirms authenticated session:

{"id":1, "openId":"demo-admin-user-001", "name":"NDPC Admin (Demo)", "role":"admin"}

Setup Notes

Beyond pnpm install && pnpm dev, the following were required:

1. PostgreSQL with ndsep_user / ndsep_db
2. drizzle-kit migrate (36 core tables)
3. Manual: psql -f drizzle/create_dpco_tables.sql (adds dpco_org_id to users)
4. Manual: psql -f drizzle/0016_billing_tables.sql (fixes scheduler error)
5. node scripts/seed.mjs (10 Nigerian orgs + compliance data)
6. .env needs VITE_OAUTH_PORTAL_URL=https://manus.im (any valid URL)

CI Notes

• Go, Python, Rust, Security Scan — pass
• Node.js CI: 58 integration test failures are pre-existing in the source tarballs (require running server + seeded DB)
• Trivy: External scan integration, not from CI workflow

---

Devin session