починили скачивание

.ai/MODULE_MAP.md

@@ -2,12 +2,12 @@
 
 > High-level module structure for AI Context. Generated automatically.
 
-**Generated:** 2026-03-04T13:18:11.370535
+**Generated:** 2026-03-06T15:13:36.187520
 
 ## Summary
 
-- **Total Modules:** 83
+- **Total Modules:** 90
-- **Total Entities:** 2349
+- **Total Entities:** 2508
 
 ## Module Hierarchy
 
@@ -54,9 +54,9 @@
       ### 📁 `routes/`
 
       - 🏗️ **Layers:** API, UI (API)
-      - 📊 **Tiers:** CRITICAL: 11, STANDARD: 226, TRIVIAL: 8
+      - 📊 **Tiers:** CRITICAL: 12, STANDARD: 240, TRIVIAL: 8
-      - 📄 **Files:** 18
+      - 📄 **Files:** 19
-      - 📦 **Entities:** 245
+      - 📦 **Entities:** 260
 
       **Key Entities:**
 
@@ -86,15 +86,15 @@
         - 🔗 DEPENDS_ON -> ConfigManager
         - 🔗 DEPENDS_ON -> ConfigModels
         - 🔗 DEPENDS_ON -> backend.src.core.database
+        - 🔗 DEPENDS_ON -> backend.src.core.database.get_db
         - 🔗 DEPENDS_ON -> backend.src.core.superset_client
-        - 🔗 DEPENDS_ON -> backend.src.core.task_manager
 
         ### 📁 `__tests__/`
 
         - 🏗️ **Layers:** API, Domain, Domain (Tests), UI (API Tests), Unknown
-        - 📊 **Tiers:** STANDARD: 63, TRIVIAL: 134
+        - 📊 **Tiers:** STANDARD: 81, TRIVIAL: 134
-        - 📄 **Files:** 12
+        - 📄 **Files:** 13
-        - 📦 **Entities:** 197
+        - 📦 **Entities:** 215
 
         **Key Entities:**
 
@@ -126,9 +126,9 @@
     ### 📁 `core/`
 
     - 🏗️ **Layers:** Core
-    - 📊 **Tiers:** CRITICAL: 45, STANDARD: 88, TRIVIAL: 8
+    - 📊 **Tiers:** CRITICAL: 45, STANDARD: 94, TRIVIAL: 8
-    - 📄 **Files:** 10
+    - 📄 **Files:** 11
-    - 📦 **Entities:** 141
+    - 📦 **Entities:** 147
 
     **Key Entities:**
 
@@ -161,12 +161,26 @@
       - 🔗 DEPENDS_ON -> backend.src.core.auth.config
       - 🔗 DEPENDS_ON -> backend.src.core.logger
 
+      ### 📁 `__tests__/`
+
+      - 🏗️ **Layers:** Domain
+      - 📊 **Tiers:** STANDARD: 7
+      - 📄 **Files:** 1
+      - 📦 **Entities:** 7
+
+      **Key Entities:**
+
+        - ℂ **_RecordingNetworkClient** (Class)
+          - Records request payloads and returns scripted responses for ...
+        - 📦 **backend.src.core.__tests__.test_superset_profile_lookup** (Module)
+          - Verifies Superset profile lookup adapter payload normalizati...
+
       ### 📁 `auth/`
 
       - 🏗️ **Layers:** Core
-      - 📊 **Tiers:** CRITICAL: 26
+      - 📊 **Tiers:** CRITICAL: 28
       - 📄 **Files:** 6
-      - 📦 **Entities:** 26
+      - 📦 **Entities:** 28
 
       **Key Entities:**
 
@@ -252,9 +266,9 @@
       ### 📁 `task_manager/`
 
       - 🏗️ **Layers:** Core
-      - 📊 **Tiers:** CRITICAL: 10, STANDARD: 63, TRIVIAL: 5
+      - 📊 **Tiers:** CRITICAL: 10, STANDARD: 63, TRIVIAL: 6
       - 📄 **Files:** 7
-      - 📦 **Entities:** 78
+      - 📦 **Entities:** 79
 
       **Key Entities:**
 
@@ -338,9 +352,9 @@
     ### 📁 `models/`
 
     - 🏗️ **Layers:** Domain, Model
-    - 📊 **Tiers:** CRITICAL: 20, STANDARD: 33, TRIVIAL: 29
+    - 📊 **Tiers:** CRITICAL: 20, STANDARD: 35, TRIVIAL: 29
-    - 📄 **Files:** 12
+    - 📄 **Files:** 13
-    - 📦 **Entities:** 82
+    - 📦 **Entities:** 84
 
     **Key Entities:**
 
@@ -370,8 +384,8 @@
       - 🔗 DEPENDS_ON -> Role
       - 🔗 DEPENDS_ON -> TaskRecord
       - 🔗 DEPENDS_ON -> backend.src.core.task_manager.models
+      - 🔗 DEPENDS_ON -> backend.src.models.auth
       - 🔗 DEPENDS_ON -> backend.src.models.mapping
-      - 🔗 DEPENDS_ON -> sqlalchemy
 
       ### 📁 `__tests__/`
 
@@ -495,9 +509,9 @@
     ### 📁 `schemas/`
 
     - 🏗️ **Layers:** API
-    - 📊 **Tiers:** CRITICAL: 10, TRIVIAL: 3
+    - 📊 **Tiers:** CRITICAL: 10, STANDARD: 7, TRIVIAL: 3
-    - 📄 **Files:** 1
+    - 📄 **Files:** 2
-    - 📦 **Entities:** 13
+    - 📦 **Entities:** 20
 
     **Key Entities:**
 
@@ -507,20 +521,20 @@
         - Represents an AD Group to Role mapping in API responses.
       - ℂ **PermissionSchema** (Class) `[TRIVIAL]`
         - Represents a permission in API responses.
+      - ℂ **ProfilePreference** (Class)
+        - Represents persisted profile preference for a single authent...
+      - ℂ **ProfilePreferenceResponse** (Class)
+        - Response envelope for profile preference read/update endpoin...
+      - ℂ **ProfilePreferenceUpdateRequest** (Class)
+        - Request payload for updating current user's dashboard filter...
       - ℂ **RoleCreate** (Class) `[CRITICAL]`
         - Schema for creating a new role.
       - ℂ **RoleSchema** (Class) `[CRITICAL]`
         - Represents a role in API responses.
       - ℂ **RoleUpdate** (Class) `[CRITICAL]`
         - Schema for updating an existing role.
-      - ℂ **Token** (Class) `[TRIVIAL]`
+      - ℂ **SupersetAccountCandidate** (Class)
-        - Represents a JWT access token response.
+        - Canonical account candidate projected from Superset users pa...
-      - ℂ **TokenData** (Class) `[TRIVIAL]`
-        - Represents the data encoded in a JWT token.
-      - ℂ **User** (Class) `[CRITICAL]`
-        - Schema for user data in API responses.
-      - ℂ **UserBase** (Class) `[CRITICAL]`
-        - Base schema for user data.
 
     **Dependencies:**
 
@@ -529,14 +543,16 @@
     ### 📁 `scripts/`
 
     - 🏗️ **Layers:** Scripts, UI, Unknown
-    - 📊 **Tiers:** CRITICAL: 2, STANDARD: 25, TRIVIAL: 3
+    - 📊 **Tiers:** CRITICAL: 2, STANDARD: 27, TRIVIAL: 14
     - 📄 **Files:** 7
-    - 📦 **Entities:** 30
+    - 📦 **Entities:** 43
 
     **Key Entities:**
 
+      - ℂ **CleanReleaseTUI** (Class)
+        - Curses-based application for compliance monitoring.
       - 📦 **backend.src.scripts.clean_release_tui** (Module)
-        - Provide clean release TUI entrypoint placeholder for phased ...
+        - Interactive terminal interface for Enterprise Clean Release ...
       - 📦 **backend.src.scripts.create_admin** (Module)
         - CLI tool for creating the initial admin user.
       - 📦 **backend.src.scripts.init_auth_db** (Module) `[CRITICAL]`
@@ -550,12 +566,17 @@
       - 📦 **test_dataset_dashboard_relations** (Module) `[TRIVIAL]`
         - Auto-generated module for backend/src/scripts/test_dataset_d...
 
+    **Dependencies:**
+
+      - 🔗 DEPENDS_ON -> backend.src.services.clean_release.compliance_orchestrator
+      - 🔗 DEPENDS_ON -> backend.src.services.clean_release.repository
+
     ### 📁 `services/`
 
     - 🏗️ **Layers:** Core, Domain, Service
-    - 📊 **Tiers:** CRITICAL: 7, STANDARD: 76, TRIVIAL: 6
+    - 📊 **Tiers:** CRITICAL: 9, STANDARD: 104, TRIVIAL: 7
-    - 📄 **Files:** 7
+    - 📄 **Files:** 9
-    - 📦 **Entities:** 89
+    - 📦 **Entities:** 120
 
     **Key Entities:**
 
@@ -563,37 +584,37 @@
         - Provides high-level authentication services.
       - ℂ **EncryptionManager** (Class) `[CRITICAL]`
         - Handles encryption and decryption of sensitive data like API...
+      - ℂ **EnvironmentNotFoundError** (Class)
+        - Raised when environment_id from lookup request is unknown in...
       - ℂ **GitService** (Class)
         - Wrapper for GitPython operations with semantic logging and e...
       - ℂ **LLMProviderService** (Class)
         - Service to manage LLM provider lifecycle.
       - ℂ **MappingService** (Class)
         - Service for handling database mapping logic.
+      - ℂ **ProfileAuthorizationError** (Class)
+        - Raised when caller attempts cross-user preference mutation.
+      - ℂ **ProfileService** (Class) `[CRITICAL]`
+        - Implements profile preference read/update flow and Superset ...
+      - ℂ **ProfileValidationError** (Class)
+        - Domain validation error for profile preference update reques...
       - ℂ **ResourceService** (Class)
         - Provides centralized access to resource data with enhanced m...
-      - 📦 **backend.src.services** (Module)
-        - Package initialization for services module
-      - 📦 **backend.src.services.auth_service** (Module) `[CRITICAL]`
-        - Orchestrates authentication business logic.
-      - 📦 **backend.src.services.git_service** (Module)
-        - Core Git logic using GitPython to manage dashboard repositor...
-      - 📦 **backend.src.services.llm_prompt_templates** (Module)
-        - Provide default LLM prompt templates and normalization helpe...
 
     **Dependencies:**
 
+      - 🔗 DEPENDS_ON -> backend.src.core.auth.repository
       - 🔗 DEPENDS_ON -> backend.src.core.config_manager
       - 🔗 DEPENDS_ON -> backend.src.core.database
       - 🔗 DEPENDS_ON -> backend.src.core.superset_client
       - 🔗 DEPENDS_ON -> backend.src.core.task_manager
-      - 🔗 DEPENDS_ON -> backend.src.core.utils.matching
 
       ### 📁 `__tests__/`
 
-      - 🏗️ **Layers:** Domain, Domain Tests, Service, Unknown
+      - 🏗️ **Layers:** Domain, Domain Tests, Service, Service Tests, Unknown
-      - 📊 **Tiers:** STANDARD: 24, TRIVIAL: 17
+      - 📊 **Tiers:** STANDARD: 29, TRIVIAL: 17
-      - 📄 **Files:** 4
+      - 📄 **Files:** 5
-      - 📦 **Entities:** 41
+      - 📦 **Entities:** 46
 
       **Key Entities:**
 
@@ -601,6 +622,8 @@
           - Validate EncryptionManager encrypt/decrypt roundtrip, unique...
         - 📦 **backend.src.services.__tests__.test_llm_prompt_templates** (Module)
           - Validate normalization and rendering behavior for configurab...
+        - 📦 **backend.src.services.__tests__.test_rbac_permission_catalog** (Module)
+          - Verifies RBAC permission catalog discovery and idempotent sy...
         - 📦 **backend.src.services.__tests__.test_resource_service** (Module)
           - Unit tests for ResourceService
         - 📦 **test_encryption_manager** (Module)
@@ -615,13 +638,17 @@
       ### 📁 `clean_release/`
 
       - 🏗️ **Layers:** Domain, Infra
-      - 📊 **Tiers:** CRITICAL: 3, STANDARD: 12, TRIVIAL: 33
+      - 📊 **Tiers:** CRITICAL: 3, STANDARD: 16, TRIVIAL: 32
       - 📄 **Files:** 10
-      - 📦 **Entities:** 48
+      - 📦 **Entities:** 51
 
       **Key Entities:**
 
+        - ℂ **CleanComplianceOrchestrator** (Class)
+          - Coordinate clean-release compliance verification stages.
         - ℂ **CleanPolicyEngine** (Class)
+        - ℂ **CleanReleaseRepository** (Class)
+          - Data access object for clean release lifecycle.
         - 📦 **backend.src.services.clean_release** (Module)
           - Initialize clean release service package and provide explici...
         - 📦 **backend.src.services.clean_release.audit_service** (Module)
@@ -636,10 +663,6 @@
           - Prepare release candidate by policy evaluation and determini...
         - 📦 **backend.src.services.clean_release.report_builder** (Module) `[CRITICAL]`
           - Build and persist compliance reports with consistent counter...
-        - 📦 **backend.src.services.clean_release.repository** (Module)
-          - Provide repository adapter for clean release entities with d...
-        - 📦 **backend.src.services.clean_release.source_isolation** (Module)
-          - Validate that all resource endpoints belong to the approved ...
 
       **Dependencies:**
 
@@ -720,9 +743,9 @@
   ### 📁 `tests/`
 
   - 🏗️ **Layers:** Core, Domain (Tests), Logging (Tests), Test, Unknown
-  - 📊 **Tiers:** STANDARD: 86, TRIVIAL: 85
+  - 📊 **Tiers:** STANDARD: 87, TRIVIAL: 85
   - 📄 **Files:** 10
-  - 📦 **Entities:** 171
+  - 📦 **Entities:** 172
 
   **Key Entities:**
 
@@ -750,9 +773,9 @@
     ### 📁 `core/`
 
     - 🏗️ **Layers:** Domain, Unknown
-    - 📊 **Tiers:** STANDARD: 5, TRIVIAL: 33
+    - 📊 **Tiers:** STANDARD: 6, TRIVIAL: 45
     - 📄 **Files:** 4
-    - 📦 **Entities:** 38
+    - 📦 **Entities:** 51
 
     **Key Entities:**
 
@@ -779,12 +802,24 @@
         - 📦 **backend.tests.core.migration.test_dry_run_orchestrator** (Module)
           - Unit tests for MigrationDryRunService diff and risk computat...
 
+    ### 📁 `scripts/`
+
+    - 🏗️ **Layers:** Scripts
+    - 📊 **Tiers:** STANDARD: 1, TRIVIAL: 7
+    - 📄 **Files:** 1
+    - 📦 **Entities:** 8
+
+    **Key Entities:**
+
+      - 📦 **backend.tests.scripts.test_clean_release_tui** (Module)
+        - Unit tests for the interactive curses TUI of the clean relea...
+
     ### 📁 `components/`
 
     - 🏗️ **Layers:** Component, Feature, UI, UI -->, Unknown
-    - 📊 **Tiers:** STANDARD: 69, TRIVIAL: 4
+    - 📊 **Tiers:** STANDARD: 73, TRIVIAL: 4
     - 📄 **Files:** 14
-    - 📦 **Entities:** 73
+    - 📦 **Entities:** 77
 
     **Key Entities:**
 
@@ -824,21 +859,21 @@
       ### 📁 `auth/`
 
       - 🏗️ **Layers:** Component
-      - 📊 **Tiers:** TRIVIAL: 1
+      - 📊 **Tiers:** CRITICAL: 2
       - 📄 **Files:** 1
-      - 📦 **Entities:** 1
+      - 📦 **Entities:** 2
 
       **Key Entities:**
 
-        - 🧩 **ProtectedRoute** (Component) `[TRIVIAL]`
+        - 🧩 **ProtectedRoute** (Component) `[CRITICAL]`
-          - Wraps content to ensure only authenticated users can access ...
+          - Wraps content to ensure only authenticated and authorized us...
 
       ### 📁 `git/`
 
       - 🏗️ **Layers:** Component
-      - 📊 **Tiers:** STANDARD: 45
+      - 📊 **Tiers:** STANDARD: 46
       - 📄 **Files:** 6
-      - 📦 **Entities:** 45
+      - 📦 **Entities:** 46
 
       **Key Entities:**
 
@@ -890,9 +925,9 @@
       ### 📁 `storage/`
 
       - 🏗️ **Layers:** UI
-      - 📊 **Tiers:** STANDARD: 7
+      - 📊 **Tiers:** STANDARD: 8
       - 📄 **Files:** 2
-      - 📦 **Entities:** 7
+      - 📦 **Entities:** 8
 
       **Key Entities:**
 
@@ -1002,16 +1037,30 @@
 
       ### 📁 `auth/`
 
-      - 🏗️ **Layers:** Feature
+      - 🏗️ **Layers:** Domain, Feature
-      - 📊 **Tiers:** CRITICAL: 7
+      - 📊 **Tiers:** CRITICAL: 11, TRIVIAL: 1
-      - 📄 **Files:** 1
+      - 📄 **Files:** 2
-      - 📦 **Entities:** 7
+      - 📦 **Entities:** 12
 
       **Key Entities:**
 
+        - 📦 **frontend.src.lib.auth.permissions** (Module) `[CRITICAL]`
+          - Shared frontend RBAC utilities for route guards and menu vis...
         - 🗄️ **authStore** (Store) `[CRITICAL]`
           - Manages the global authentication state on the frontend.
 
+        ### 📁 `__tests__/`
+
+        - 🏗️ **Layers:** UI (Tests)
+        - 📊 **Tiers:** STANDARD: 1
+        - 📄 **Files:** 1
+        - 📦 **Entities:** 1
+
+        **Key Entities:**
+
+          - 📦 **frontend.src.lib.auth.__tests__.permissions** (Module)
+            - Verifies frontend RBAC permission parsing and access checks.
+
         ### 📁 `assistant/`
 
         - 🏗️ **Layers:** UI, Unknown
@@ -1041,9 +1090,9 @@
         ### 📁 `layout/`
 
         - 🏗️ **Layers:** UI, Unknown
-        - 📊 **Tiers:** STANDARD: 8, TRIVIAL: 48
+        - 📊 **Tiers:** STANDARD: 11, TRIVIAL: 47
-        - 📄 **Files:** 4
+        - 📄 **Files:** 5
-        - 📦 **Entities:** 56
+        - 📦 **Entities:** 58
 
         **Key Entities:**
 
@@ -1063,16 +1112,24 @@
             - Auto-generated module for frontend/src/lib/components/layout...
           - 📦 **TopNavbar** (Module) `[TRIVIAL]`
             - Auto-generated module for frontend/src/lib/components/layout...
+          - 📦 **frontend.src.lib.components.layout.sidebarNavigation** (Module)
+            - Build sidebar navigation categories filtered by current user...
+
+        **Dependencies:**
+
+          - 🔗 DEPENDS_ON -> frontend.src.lib.auth.permissions.hasPermission
 
           ### 📁 `__tests__/`
 
-          - 🏗️ **Layers:** Unknown
+          - 🏗️ **Layers:** UI (Tests), Unknown
-          - 📊 **Tiers:** TRIVIAL: 3
+          - 📊 **Tiers:** STANDARD: 1, TRIVIAL: 4
-          - 📄 **Files:** 1
+          - 📄 **Files:** 2
-          - 📦 **Entities:** 3
+          - 📦 **Entities:** 5
 
           **Key Entities:**
 
+            - 📦 **frontend.src.lib.components.layout.__tests__.sidebarNavigation** (Module)
+              - Verifies RBAC-based sidebar category and subitem visibility.
             - 📦 **test_breadcrumbs.svelte** (Module) `[TRIVIAL]`
               - Auto-generated module for frontend/src/lib/components/layout...
 
@@ -1347,9 +1404,9 @@
       ### 📁 `dashboards/`
 
       - 🏗️ **Layers:** UI, Unknown
-      - 📊 **Tiers:** STANDARD: 24, TRIVIAL: 61
+      - 📊 **Tiers:** STANDARD: 26, TRIVIAL: 63
       - 📄 **Files:** 1
-      - 📦 **Entities:** 85
+      - 📦 **Entities:** 89
 
       **Key Entities:**
 
@@ -1368,6 +1425,18 @@
           - 📦 **+page** (Module) `[TRIVIAL]`
             - Auto-generated module for frontend/src/routes/dashboards/[id...
 
+        ### 📁 `__tests__/`
+
+        - 🏗️ **Layers:** UI (Tests)
+        - 📊 **Tiers:** STANDARD: 1, TRIVIAL: 2
+        - 📄 **Files:** 1
+        - 📦 **Entities:** 3
+
+        **Key Entities:**
+
+          - 📦 **frontend.src.routes.dashboards.__tests__.dashboard_profile_override_integration** (Module)
+            - Verifies temporary show-all override and restore-on-return b...
+
       ### 📁 `datasets/`
 
       - 🏗️ **Layers:** UI, Unknown
@@ -1441,6 +1510,43 @@
           - 🧩 **MappingManagement** (Component) `[CRITICAL]`
             - Page for managing database mappings between environments.
 
+      ### 📁 `profile/`
+
+      - 🏗️ **Layers:** Unknown
+      - 📊 **Tiers:** TRIVIAL: 9
+      - 📄 **Files:** 1
+      - 📦 **Entities:** 9
+
+      **Key Entities:**
+
+        - 📦 **+page** (Module) `[TRIVIAL]`
+          - Auto-generated module for frontend/src/routes/profile/+page....
+
+        ### 📁 `__tests__/`
+
+        - 🏗️ **Layers:** UI (Tests)
+        - 📊 **Tiers:** STANDARD: 2
+        - 📄 **Files:** 2
+        - 📦 **Entities:** 2
+
+        **Key Entities:**
+
+          - 📦 **frontend.src.routes.profile.__tests__.profile_preferences_integration** (Module)
+            - Verifies profile binding happy path and degraded lookup manu...
+          - 📦 **frontend.src.routes.profile.__tests__.profile_settings_state_integration** (Module)
+            - Verifies profile settings preload, cancel without persistenc...
+
+          ### 📁 `fixtures/`
+
+          - 📊 **Tiers:** TRIVIAL: 1
+          - 📄 **Files:** 1
+          - 📦 **Entities:** 1
+
+          **Key Entities:**
+
+            - 📦 **frontend.src.routes.profile.__tests__.fixtures.profile_fixtures** (Module) `[TRIVIAL]`
+              - Shared fixture placeholders for profile page integration tes...
+
       ### 📁 `reports/`
 
       - 🏗️ **Layers:** UI, Unknown
@@ -1512,9 +1618,9 @@
 
         ### 📁 `repos/`
 
-        - 📊 **Tiers:** STANDARD: 3
+        - 📊 **Tiers:** STANDARD: 4
         - 📄 **Files:** 1
-        - 📦 **Entities:** 3
+        - 📦 **Entities:** 4
 
         ### 📁 `debug/`
 
@@ -1543,9 +1649,9 @@
         ### 📁 `storage/`
 
         - 🏗️ **Layers:** UI
-        - 📊 **Tiers:** STANDARD: 6
+        - 📊 **Tiers:** STANDARD: 7
         - 📄 **Files:** 1
-        - 📦 **Entities:** 6
+        - 📦 **Entities:** 7
 
         **Key Entities:**
 
@@ -1555,9 +1661,9 @@
     ### 📁 `services/`
 
     - 🏗️ **Layers:** Service
-    - 📊 **Tiers:** STANDARD: 33, TRIVIAL: 1
+    - 📊 **Tiers:** STANDARD: 35, TRIVIAL: 1
     - 📄 **Files:** 6
-    - 📦 **Entities:** 34
+    - 📦 **Entities:** 36
 
     **Key Entities:**
 
@@ -1586,17 +1692,15 @@
 
 ### 📁 `root/`
 
-- 🏗️ **Layers:** DevOps/Tooling, Domain, Unknown
+- 🏗️ **Layers:** DevOps/Tooling, Unknown
-- 📊 **Tiers:** CRITICAL: 11, STANDARD: 27, TRIVIAL: 12
+- 📊 **Tiers:** CRITICAL: 11, STANDARD: 17, TRIVIAL: 9
-- 📄 **Files:** 4
+- 📄 **Files:** 2
-- 📦 **Entities:** 50
+- 📦 **Entities:** 37
 
 **Key Entities:**
 
   - ℂ **ComplianceIssue** (Class) `[TRIVIAL]`
     - Represents a single compliance issue with severity.
-  - ℂ **ReportsService** (Class)
-    - Service layer for list/detail report retrieval and normaliza...
   - ℂ **SemanticEntity** (Class) `[CRITICAL]`
     - Represents a code entity (Module, Function, Component) found...
   - ℂ **SemanticMapGenerator** (Class) `[CRITICAL]`
@@ -1605,20 +1709,10 @@
     - Severity levels for compliance issues.
   - ℂ **Tier** (Class) `[TRIVIAL]`
     - Enumeration of semantic tiers defining validation strictness...
-  - 📦 **backend.src.services.reports.report_service** (Module)
-    - Aggregate, normalize, filter, and paginate task reports for ...
   - 📦 **check_test_data** (Module) `[TRIVIAL]`
     - Auto-generated module for check_test_data.py
   - 📦 **generate_semantic_map** (Module)
     - Scans the codebase to generate a Semantic Map, Module Map, a...
-  - 📦 **test_analyze** (Module) `[TRIVIAL]`
-    - Auto-generated module for test_analyze.py
-
-**Dependencies:**
-
-  - 🔗 DEPENDS_ON -> backend.src.core.task_manager.manager.TaskManager
-  - 🔗 DEPENDS_ON -> backend.src.models.report
-  - 🔗 DEPENDS_ON -> backend.src.services.reports.normalizer
 
 ## Cross-Module Dependencies
 
@@ -1655,6 +1749,10 @@ graph TD
     routes-->|DEPENDS_ON|backend
     routes-->|DEPENDS_ON|backend
     routes-->|DEPENDS_ON|backend
+    routes-->|DEPENDS_ON|backend
+    routes-->|DEPENDS_ON|backend
+    routes-->|DEPENDS_ON|backend
+    __tests__-->|TESTS|backend
     __tests__-->|TESTS|backend
     __tests__-->|TESTS|backend
     __tests__-->|TESTS|backend
@@ -1664,12 +1762,15 @@ graph TD
     __tests__-->|DEPENDS_ON|backend
     __tests__-->|DEPENDS_ON|backend
     __tests__-->|VERIFIES|backend
+    core-->|DEPENDS_ON|backend
+    core-->|DEPENDS_ON|backend
     core-->|USES|backend
     core-->|USES|backend
     core-->|DEPENDS_ON|backend
     core-->|DEPENDS_ON|backend
     core-->|DEPENDS_ON|backend
     core-->|DEPENDS_ON|backend
+    __tests__-->|TESTS|backend
     auth-->|USES|backend
     auth-->|USES|backend
     auth-->|USES|backend
@@ -1688,12 +1789,16 @@ graph TD
     models-->|DEPENDS_ON|backend
     models-->|USED_BY|backend
     models-->|INHERITS_FROM|backend
+    models-->|DEPENDS_ON|backend
+    models-->|INHERITS_FROM|backend
     __tests__-->|TESTS|backend
     llm_analysis-->|IMPLEMENTS|backend
     llm_analysis-->|IMPLEMENTS|backend
     storage-->|DEPENDS_ON|backend
     scripts-->|USES|backend
     scripts-->|USES|backend
+    scripts-->|DEPENDS_ON|backend
+    scripts-->|DEPENDS_ON|backend
     scripts-->|READS_FROM|backend
     scripts-->|READS_FROM|backend
     scripts-->|USES|backend
@@ -1708,6 +1813,13 @@ graph TD
     services-->|DEPENDS_ON|backend
     services-->|DEPENDS_ON|backend
     services-->|DEPENDS_ON|backend
+    services-->|DEPENDS_ON|backend
+    services-->|DEPENDS_ON|backend
+    services-->|DEPENDS_ON|backend
+    services-->|DEPENDS_ON|backend
+    services-->|DEPENDS_ON|backend
+    services-->|CALLS|backend
+    services-->|DEPENDS_ON|backend
     services-->|USES|backend
     services-->|USES|backend
     services-->|USES|backend
@@ -1716,6 +1828,7 @@ graph TD
     __tests__-->|TESTS|backend
     __tests__-->|DEPENDS_ON|backend
     __tests__-->|TESTS|backend
+    __tests__-->|TESTS|backend
     clean_release-->|DEPENDS_ON|backend
     clean_release-->|DEPENDS_ON|backend
     clean_release-->|DEPENDS_ON|backend
@@ -1753,9 +1866,12 @@ graph TD
     core-->|VERIFIES|backend
     migration-->|VERIFIES|backend
     migration-->|VERIFIES|backend
+    scripts-->|TESTS|backend
     __tests__-->|VERIFIES|components
     __tests__-->|VERIFIES|components
+    __tests__-->|TESTS|lib
     __tests__-->|VERIFIES|lib
+    __tests__-->|TESTS|lib
     reports-->|DEPENDS_ON|lib
     __tests__-->|TESTS|routes
     __tests__-->|TESTS|routes
@@ -1763,7 +1879,7 @@ graph TD
     __tests__-->|TESTS|lib
     __tests__-->|TESTS|lib
     __tests__-->|TESTS|routes
-    root-->|DEPENDS_ON|backend
+    __tests__-->|TESTS|routes
-    root-->|DEPENDS_ON|backend
+    __tests__-->|TESTS|routes
-    root-->|DEPENDS_ON|backend
+    __tests__-->|TESTS|routes
 ```

.ai/PROJECT_MAP.md

@@ -7,45 +7,6 @@
   - 🏗️ Layer: Unknown
   - ƒ **check_file** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
-- 📦 **backend.src.services.reports.report_service** (`Module`)
-  - 📝 Aggregate, normalize, filter, and paginate task reports for unified list/detail API use cases.
-  - 🏗️ Layer: Domain
-  - 🔒 Invariant: List responses are deterministic and include applied filter echo metadata.
-  - 🔗 DEPENDS_ON -> `backend.src.core.task_manager.manager.TaskManager`
-  - 🔗 DEPENDS_ON -> `backend.src.models.report`
-  - 🔗 DEPENDS_ON -> `backend.src.services.reports.normalizer`
-  - ℂ **ReportsService** (`Class`)
-    - 📝 Service layer for list/detail report retrieval and normalization.
-    - 🔒 Invariant: Service methods are read-only over task history source.
-    - ƒ **__init__** (`Function`)
-      - 📝 Initialize service with TaskManager dependency.
-      - 🔒 Invariant: Constructor performs no task mutations.
-    - ƒ **_load_normalized_reports** (`Function`)
-      - 📝 Build normalized reports from all available tasks.
-      - 🔒 Invariant: Every returned item is a TaskReport.
-    - ƒ **_to_utc_datetime** (`Function`)
-      - 📝 Normalize naive/aware datetime values to UTC-aware datetime for safe comparisons.
-      - 🔒 Invariant: Naive datetimes are interpreted as UTC to preserve deterministic ordering/filtering.
-    - ƒ **_datetime_sort_key** (`Function`)
-      - 📝 Produce stable numeric sort key for report timestamps.
-      - 🔒 Invariant: Mixed naive/aware datetimes never raise TypeError.
-    - ƒ **_matches_query** (`Function`)
-      - 📝 Apply query filtering to a report.
-      - 🔒 Invariant: Filter evaluation is side-effect free.
-    - ƒ **_sort_reports** (`Function`)
-      - 📝 Sort reports deterministically according to query settings.
-      - 🔒 Invariant: Sorting criteria are deterministic for equal input.
-    - ƒ **list_reports** (`Function`)
-      - 📝 Return filtered, sorted, paginated report collection.
-    - ƒ **get_report_detail** (`Function`)
-      - 📝 Return one normalized report with timeline/diagnostics/next actions.
-  - ƒ **print_entity** (`Function`) `[TRIVIAL]`
-    - 📝 Auto-detected function (orphan)
-- 📦 **test_analyze** (`Module`) `[TRIVIAL]`
-  - 📝 Auto-generated module for test_analyze.py
-  - 🏗️ Layer: Unknown
-  - ƒ **print_issues** (`Function`) `[TRIVIAL]`
-    - 📝 Auto-detected function (orphan)
 - 📦 **generate_semantic_map** (`Module`)
   - 📝 Scans the codebase to generate a Semantic Map, Module Map, and Compliance Report based on the System Standard.
   - 🏗️ Layer: DevOps/Tooling
@@ -206,6 +167,21 @@
       - 📝 Clears authentication state and storage.
     - ƒ **setLoading** (`Function`) `[CRITICAL]`
       - 📝 Updates the loading state.
+- 📦 **frontend.src.lib.auth.permissions** (`Module`) `[CRITICAL]`
+  - 📝 Shared frontend RBAC utilities for route guards and menu visibility.
+  - 🏗️ Layer: Domain
+  - 🔒 Invariant: Admin role always bypasses explicit permission checks.
+  - ƒ **normalizePermissionRequirement** (`Function`) `[CRITICAL]`
+    - 📝 Convert permission requirement string to canonical resource/action tuple.
+  - ƒ **isAdminUser** (`Function`) `[CRITICAL]`
+    - 📝 Determine whether user has Admin role.
+  - ƒ **hasPermission** (`Function`) `[CRITICAL]`
+    - 📝 Check if user has a required resource/action permission.
+  - ƒ **normalizeAction** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+- 📦 **frontend.src.lib.auth.__tests__.permissions** (`Module`)
+  - 📝 Verifies frontend RBAC permission parsing and access checks.
+  - 🏗️ Layer: UI (Tests)
 - 📦 **Debounce** (`Module`) `[TRIVIAL]`
   - 📝 Debounce utility for limiting function execution rate
   - 🏗️ Layer: Infra
@@ -559,12 +535,10 @@
   - 🔒 Invariant: Always shows active category and item
   - ⬅️ READS_FROM `app`
   - ⬅️ READS_FROM `lib`
-  - ⬅️ READS_FROM `t`
+  - ⬅️ READS_FROM `sidebarStore`
 - 📦 **Sidebar** (`Module`) `[TRIVIAL]`
   - 📝 Auto-generated module for frontend/src/lib/components/layout/Sidebar.svelte
   - 🏗️ Layer: Unknown
-  - ƒ **buildCategories** (`Function`) `[TRIVIAL]`
-    - 📝 Auto-detected function (orphan)
   - ƒ **handleItemClick** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
   - ƒ **handleCategoryToggle** (`Function`) `[TRIVIAL]`
@@ -690,6 +664,15 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **connectWebSocket** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **frontend.src.lib.components.layout.sidebarNavigation** (`Module`)
+  - 📝 Build sidebar navigation categories filtered by current user permissions.
+  - 🏗️ Layer: UI
+  - 🔒 Invariant: Admin role can access all categories and subitems through permission utility.
+  - 🔗 DEPENDS_ON -> `frontend.src.lib.auth.permissions.hasPermission`
+  - ƒ **isItemAllowed** (`Function`)
+    - 📝 Check whether a single menu node can be shown for a given user.
+  - ƒ **buildSidebarCategories** (`Function`)
+    - 📝 Build translated sidebar categories and filter them by RBAC permissions.
 - 📦 **test_breadcrumbs.svelte** (`Module`) `[TRIVIAL]`
   - 📝 Auto-generated module for frontend/src/lib/components/layout/__tests__/test_breadcrumbs.svelte.js
   - 🏗️ Layer: Unknown
@@ -697,6 +680,11 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **formatBreadcrumbLabel** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **frontend.src.lib.components.layout.__tests__.sidebarNavigation** (`Module`)
+  - 📝 Verifies RBAC-based sidebar category and subitem visibility.
+  - 🏗️ Layer: UI (Tests)
+  - ƒ **makeUser** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **ErrorPage** (`Page`)
   - 📝 Global error page displaying HTTP status and messages
   - 🏗️ Layer: UI
@@ -830,6 +818,8 @@
     - 📝 Fetches the list of available environments.
   - ƒ **fetchDashboards** (`Function`)
     - 📝 Fetches dashboards for a specific environment.
+  - ƒ **filterDashboardsWithRepositories** (`Function`)
+    - 📝 Keep only dashboards that already have initialized Git repositories.
 - 📦 **DashboardHub** (`Page`)
   - 📝 Dashboard Hub - Central hub for managing dashboards with Git status and task actions
   - 🏗️ Layer: UI
@@ -846,6 +836,10 @@
     - 📝 Normalize owners payload to unique non-empty display labels.
   - ƒ **DashboardHub.loadDashboards** (`Function`)
     - 📝 Load full dashboard dataset for current environment and hydrate grid projection.
+    - ƒ **DashboardHub.handleTemporaryShowAll** (`Function`)
+      - 📝 Temporarily disable profile-default dashboard filter for current page context.
+    - ƒ **DashboardHub.handleRestoreProfileFilter** (`Function`)
+      - 📝 Re-enable persisted profile-default filtering after temporary override.
   - ƒ **DashboardHub.formatDate** (`Function`)
     - 📝 Convert ISO timestamp to locale date string.
   - ƒ **DashboardHub.getGitSummaryLabel** (`Function`)
@@ -903,6 +897,10 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **handlePageSizeChange** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+  - ƒ **handleTemporaryShowAll** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **handleRestoreProfileFilter** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
   - ƒ **updateSelectionState** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
   - ƒ **handleCheckboxChange** (`Function`) `[TRIVIAL]`
@@ -1003,6 +1001,13 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **getPaginationRange** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **frontend.src.routes.dashboards.__tests__.dashboard_profile_override_integration** (`Module`)
+  - 📝 Verifies temporary show-all override and restore-on-return behavior for profile-default dashboard filtering.
+  - 🏗️ Layer: UI (Tests)
+  - ƒ **buildFilteredResponse** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **buildUnfilteredResponse** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **DashboardDetail** (`Page`)
   - 📝 Dashboard Detail View - Overview of charts and datasets linked to a dashboard
   - 🏗️ Layer: UI
@@ -1168,6 +1173,33 @@
     - 📝 Fetches databases from both environments and gets suggestions.
   - ƒ **handleUpdate** (`Function`) `[CRITICAL]`
     - 📝 Saves a mapping to the backend.
+- 📦 **+page** (`Module`) `[TRIVIAL]`
+  - 📝 Auto-generated module for frontend/src/routes/profile/+page.svelte
+  - 🏗️ Layer: Unknown
+  - ƒ **parseValidationErrorsFromError** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **setSavedSnapshot** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **loadPreference** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **loadLookupCandidates** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **handleSelectCandidate** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **handleEnvironmentChange** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **handleSave** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **handleCancel** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+- 📦 **frontend.src.routes.profile.__tests__.profile_settings_state_integration** (`Module`)
+  - 📝 Verifies profile settings preload, cancel without persistence, and saved-state reload behavior.
+  - 🏗️ Layer: UI (Tests)
+- 📦 **frontend.src.routes.profile.__tests__.profile_preferences_integration** (`Module`)
+  - 📝 Verifies profile binding happy path and degraded lookup manual fallback save flow.
+  - 🏗️ Layer: UI (Tests)
+- 📦 **frontend.src.routes.profile.__tests__.fixtures.profile_fixtures** (`Module`) `[TRIVIAL]`
+  - 📝 Shared fixture placeholders for profile page integration tests.
 - 🧩 **StoragePage** (`Component`)
   - 📝 Main page for unified file storage management.
   - 🏗️ Layer: UI
@@ -1177,6 +1209,8 @@
   - ➡️ WRITES_TO `page`
   - ƒ **loadFiles** (`Function`)
     - 📝 Fetches the list of files from the server.
+    - ƒ **resolveStorageQueryFromPath** (`Function`)
+      - 📝 Splits UI path into storage API category and category-local subpath.
   - ƒ **handleDelete** (`Function`)
     - 📝 Handles the file deletion process.
   - ƒ **handleNavigate** (`Function`)
@@ -1383,6 +1417,8 @@
   - 🏗️ Layer: Service
   - ƒ **getStorageAuthHeaders** (`Function`)
     - 📝 Returns headers with Authorization for storage API calls.
+  - ƒ **encodeStoragePath** (`Function`)
+    - 📝 Encodes a storage-relative path preserving slash separators.
   - ƒ **listFiles** (`Function`)
     - 📝 Fetches the list of files for a given category and subpath.
   - ƒ **uploadFile** (`Function`)
@@ -1391,6 +1427,8 @@
     - 📝 Deletes a file or directory from storage.
   - ƒ **downloadFileUrl** (`Function`)
     - 📝 Returns the URL for downloading a file.
+  - ƒ **downloadFile** (`Function`)
+    - 📝 Downloads a file using authenticated fetch and saves it in browser.
 - 🧩 **DashboardGrid** (`Component`)
   - 📝 Displays a grid of dashboards with selection and pagination.
   - 🏗️ Layer: Component
@@ -1423,8 +1461,16 @@
   - ƒ **handleBulkCommit** (`Function`)
   - ƒ **handleBulkPull** (`Function`)
   - ƒ **handleBulkPush** (`Function`)
+  - ƒ **handleBulkDelete** (`Function`)
+    - 📝 Removes selected repositories from storage and binding table.
   - ƒ **handleManageSelected** (`Function`)
     - 📝 Opens Git manager for exactly one selected dashboard.
+  - ƒ **resolveDashboardRef** (`Function`)
+    - 📝 Resolves dashboard slug from payload fields.
+  - ƒ **openGitManagerForDashboard** (`Function`)
+    - 📝 Opens Git manager for provided dashboard metadata.
+  - ƒ **handleInitializeRepositories** (`Function`)
+    - 📝 Opens Git manager from bulk actions to initialize selected repository.
   - ƒ **getSortStatusValue** (`Function`)
     - 📝 Returns sort value for status column based on mode.
   - ƒ **getStatusLabel** (`Function`)
@@ -1597,12 +1643,16 @@
   - ➡️ WRITES_TO `t`
   - ƒ **handleSelect** (`Function`)
     - 📝 Dispatches the selection change event.
-- 🧩 **ProtectedRoute** (`Component`) `[TRIVIAL]`
+- 🧩 **ProtectedRoute** (`Component`) `[CRITICAL]`
-  - 📝 Wraps content to ensure only authenticated users can access it.
+  - 📝 Wraps content to ensure only authenticated and authorized users can access it.
   - 🏗️ Layer: Component
-  - 🔒 Invariant: Redirects to /login if user is not authenticated.
+  - 🔒 Invariant: Redirects to /login if user is not authenticated and to fallback route when permission is denied.
+  - 📥 Props: requiredPermission: string | null , fallbackPath: string 
   - ⬅️ READS_FROM `app`
+  - ⬅️ READS_FROM `lib`
   - ⬅️ READS_FROM `auth`
+  - ƒ **verifySessionAndAccess** (`Function`) `[CRITICAL]`
+    - 📝 Validates active session and optional route permission before rendering protected slot.
 - 🧩 **TaskLogPanel** (`Component`)
   - 📝 Combines log filtering and display into a single cohesive dark-themed panel.
   - 🏗️ Layer: UI
@@ -1668,6 +1718,8 @@
     - 📝 Formats file size in bytes into a human-readable string.
   - ƒ **formatDate** (`Function`)
     - 📝 Formats an ISO date string into a localized readable format.
+  - ƒ **handleDownload** (`Function`)
+    - 📝 Downloads selected file through authenticated API request.
 - 🧩 **FileUpload** (`Component`)
   - 📝 Provides a form for uploading files to a specific category.
   - 🏗️ Layer: UI
@@ -1796,9 +1848,9 @@
 - 🧩 **GitManager** (`Component`)
   - 📝 Центральный UI управления Git с фокусом на рабочий поток аналитика (commit -> promote -> deploy).
   - 🏗️ Layer: Component
+  - ➡️ WRITES_TO `bindable`
   - ➡️ WRITES_TO `props`
   - ➡️ WRITES_TO `state`
-  - ➡️ WRITES_TO `derived`
   - ƒ **normalizeEnvStage** (`Function`)
     - 📝 Normalize environment stage with legacy fallback.
   - ƒ **stageBadgeClass** (`Function`)
@@ -1833,6 +1885,8 @@
     - 📝 Return currently selected git server config.
   - ƒ **resolveDefaultConfig** (`Function`)
     - 📝 Resolve default git config for current session.
+  - ƒ **resolvePushProviderLabel** (`Function`)
+    - 📝 Resolve lower-case provider label for auto-push checkbox.
   - ƒ **buildSuggestedRepoName** (`Function`)
     - 📝 Build deterministic repository name from dashboard title/id.
   - ƒ **handleCreateRemoteRepo** (`Function`)
@@ -1974,10 +2028,37 @@
   - ƒ **test_dashboard_dataset_relations** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
 - 📦 **backend.src.scripts.clean_release_tui** (`Module`)
-  - 📝 Provide clean release TUI entrypoint placeholder for phased implementation.
+  - 📝 Interactive terminal interface for Enterprise Clean Release compliance validation.
   - 🏗️ Layer: UI
-  - 🔒 Invariant: Entry point is executable and does not mutate release data in placeholder mode.
+  - 🔒 Invariant: TUI must provide a headless fallback for non-TTY environments.
-  - 🔗 BINDS_TO -> `specs/023-clean-repo-enterprise/ux_reference.md`
+  - 🔗 DEPENDS_ON -> `backend.src.services.clean_release.compliance_orchestrator`
+  - 🔗 DEPENDS_ON -> `backend.src.services.clean_release.repository`
+  - ℂ **CleanReleaseTUI** (`Class`)
+    - 📝 Curses-based application for compliance monitoring.
+    - ƒ **run_checks** (`Function`)
+      - 📝 Execute compliance orchestrator run and update UI state.
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **draw_header** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **draw_checks** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **draw_sources** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **draw_status** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **draw_footer** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **clear_history** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **refresh_screen** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **loop** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **tui_main** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
   - ƒ **main** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
 - 📦 **backend.src.scripts.migrate_sqlite_to_postgres** (`Module`)
@@ -2050,6 +2131,39 @@
     - 📝 Schema for updating an existing user.
   - ℂ **User** (`Class`) `[CRITICAL]`
     - 📝 Schema for user data in API responses.
+- 📦 **backend.src.schemas.profile** (`Module`)
+  - 📝 Defines API schemas for profile preference persistence and Superset account lookup flows.
+  - 🏗️ Layer: API
+  - 🔒 Invariant: Schema shapes stay stable for profile UI states and dashboards filter metadata.
+  - 🔗 DEPENDS_ON -> `pydantic`
+  - ℂ **ProfilePreference** (`Class`)
+    - 📝 Represents persisted profile preference for a single authenticated user.
+  - ℂ **ProfilePreferenceUpdateRequest** (`Class`)
+    - 📝 Request payload for updating current user's dashboard filter preference.
+  - ℂ **ProfilePreferenceResponse** (`Class`)
+    - 📝 Response envelope for profile preference read/update endpoints.
+  - ℂ **SupersetAccountLookupRequest** (`Class`)
+    - 📝 Query contract for Superset account lookup by selected environment.
+  - ℂ **SupersetAccountCandidate** (`Class`)
+    - 📝 Canonical account candidate projected from Superset users payload.
+  - ℂ **SupersetAccountLookupResponse** (`Class`)
+    - 📝 Response envelope for Superset account lookup (success or degraded mode).
+- 📦 **backend.src.core.superset_profile_lookup** (`Module`)
+  - 📝 Provides environment-scoped Superset account lookup adapter with stable normalized output.
+  - 🏗️ Layer: Core
+  - 🔒 Invariant: Adapter never leaks raw upstream payload shape to API consumers.
+  - 🔗 DEPENDS_ON -> `backend.src.core.utils.network.APIClient`
+  - 🔗 DEPENDS_ON -> `backend.src.core.logger`
+  - ℂ **SupersetAccountLookupAdapter** (`Class`)
+    - 📝 Lookup Superset users and normalize candidates for profile binding.
+    - ƒ **__init__** (`Function`)
+      - 📝 Initializes lookup adapter with authenticated API client and environment context.
+    - ƒ **get_users_page** (`Function`)
+      - 📝 Fetch one users page from Superset with passthrough search/sort parameters.
+    - ƒ **_normalize_lookup_payload** (`Function`)
+      - 📝 Convert Superset users response variants into stable candidates payload.
+    - ƒ **normalize_user_payload** (`Function`)
+      - 📝 Project raw Superset user object to canonical candidate shape.
 - 📦 **backend.src.core.superset_client** (`Module`)
   - 📝 Предоставляет высокоуровневый клиент для взаимодействия с Superset REST API, инкапсулируя логику запросов, обработку ошибок и пагинацию.
   - 🏗️ Layer: Core
@@ -2425,6 +2539,10 @@
       - 📝 Retrieves a permission by its unique ID.
     - ƒ **get_permission_by_resource_action** (`Function`) `[CRITICAL]`
       - 📝 Retrieves a permission by resource and action.
+    - ƒ **get_user_dashboard_preference** (`Function`) `[CRITICAL]`
+      - 📝 Retrieves dashboard preference by owner user ID.
+    - ƒ **save_user_dashboard_preference** (`Function`) `[CRITICAL]`
+      - 📝 Persists dashboard preference entity and returns refreshed row.
     - ƒ **list_permissions** (`Function`) `[CRITICAL]`
       - 📝 Lists all available permissions.
 - 📦 **test_auth** (`Module`)
@@ -2580,6 +2698,21 @@
       - 🔗 CALLS -> `self.load_excel_mappings`
       - 🔗 CALLS -> `superset_client.get_dataset`
       - 🔗 CALLS -> `superset_client.update_dataset`
+- 📦 **backend.src.core.__tests__.test_superset_profile_lookup** (`Module`)
+  - 📝 Verifies Superset profile lookup adapter payload normalization and fallback error precedence.
+  - 🏗️ Layer: Domain
+  - ℂ **_RecordingNetworkClient** (`Class`)
+    - 📝 Records request payloads and returns scripted responses for deterministic adapter tests.
+    - ƒ **__init__** (`Function`)
+      - 📝 Initializes scripted network responses.
+    - ƒ **request** (`Function`)
+      - 📝 Mimics APIClient.request while capturing call arguments.
+  - ƒ **test_get_users_page_sends_lowercase_order_direction** (`Function`)
+    - 📝 Ensures adapter sends lowercase order_direction compatible with Superset rison schema.
+  - ƒ **test_get_users_page_preserves_primary_schema_error_over_fallback_auth_error** (`Function`)
+    - 📝 Ensures fallback auth error does not mask primary schema/query failure.
+  - ƒ **test_get_users_page_uses_fallback_endpoint_when_primary_fails** (`Function`)
+    - 📝 Verifies adapter retries second users endpoint and succeeds when fallback is healthy.
 - 📦 **test_logger** (`Module`)
   - 📝 Unit tests for logger module
   - 🏗️ Layer: Infra
@@ -2694,7 +2827,7 @@
     - ƒ **_parse_datetime** (`Function`)
       - 📝 Safely parse a datetime string from the database
     - ƒ **_resolve_environment_id** (`Function`)
-      - 📝 Resolve environment id based on provided value or fallback to default
+      - 📝 Resolve environment id into existing environments.id value to satisfy FK constraints.
     - ƒ **__init__** (`Function`)
       - 📝 Initializes the persistence service.
     - ƒ **persist_task** (`Function`)
@@ -2723,6 +2856,8 @@
       - 📝 Delete all logs for a specific task.
     - ƒ **delete_logs_for_tasks** (`Function`)
       - 📝 Delete all logs for multiple tasks.
+  - ƒ **normalize_token** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
   - ƒ **json_serializable** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
 - 📦 **TaskManagerModule** (`Module`) `[CRITICAL]`
@@ -2958,6 +3093,10 @@
     - 📝 Delete repository in Gitea for a saved Gitea config.
   - ƒ **init_repository** (`Function`)
     - 📝 Link a dashboard to a Git repository and perform initial clone/init.
+  - ƒ **get_repository_binding** (`Function`)
+    - 📝 Return repository binding with provider metadata for selected dashboard.
+  - ƒ **delete_repository** (`Function`)
+    - 📝 Delete local repository workspace and DB binding for selected dashboard.
   - ƒ **get_branches** (`Function`)
     - 📝 List all branches for a dashboard's repository.
   - ƒ **create_branch** (`Function`)
@@ -3164,6 +3303,8 @@
     - 📝 Schema for dashboard deployment requests.
   - ℂ **RepoInitRequest** (`Class`)
     - 📝 Schema for repository initialization requests.
+  - ℂ **RepositoryBindingSchema** (`Class`)
+    - 📝 Schema describing repository-to-config binding and provider metadata.
   - ℂ **RepoStatusBatchRequest** (`Class`)
     - 📝 Schema for requesting repository statuses for multiple dashboards in a single call.
   - ℂ **RepoStatusBatchResponse** (`Class`)
@@ -3327,6 +3468,21 @@
     - 📝 Return paginated unified reports list.
   - ƒ **get_report_detail** (`Function`)
     - 📝 Return one normalized report detail with diagnostics and next actions.
+- 📦 **backend.src.api.routes.profile** (`Module`) `[CRITICAL]`
+  - 📝 Exposes self-scoped profile preference endpoints and environment-based Superset account lookup.
+  - 🏗️ Layer: API
+  - 🔒 Invariant: Endpoints are self-scoped and never mutate another user preference.
+  - 🔗 DEPENDS_ON -> `backend.src.services.profile_service`
+  - 🔗 DEPENDS_ON -> `backend.src.dependencies.get_current_user`
+  - 🔗 DEPENDS_ON -> `backend.src.core.database.get_db`
+  - ƒ **_get_profile_service** (`Function`)
+    - 📝 Build profile service for current request scope.
+  - ƒ **get_preferences** (`Function`)
+    - 📝 Get authenticated user's dashboard filter preference.
+  - ƒ **update_preferences** (`Function`)
+    - 📝 Update authenticated user's dashboard filter preference.
+  - ƒ **lookup_superset_accounts** (`Function`)
+    - 📝 Lookup Superset account candidates in selected environment.
 - 📦 **backend.src.api.routes.__init__** (`Module`)
   - 📝 Provide lazy route module loading to avoid heavyweight imports during tests.
   - 🏗️ Layer: API
@@ -3365,6 +3521,7 @@
   - 📦 **GitStatus** (`DataClass`)
   - 📦 **LastTask** (`DataClass`)
   - 📦 **DashboardItem** (`DataClass`)
+  - 📦 **EffectiveProfileFilter** (`DataClass`)
   - 📦 **DashboardsResponse** (`DataClass`)
   - 📦 **DashboardChartItem** (`DataClass`)
   - 📦 **DashboardDatasetItem** (`DataClass`)
@@ -3381,6 +3538,18 @@
     - 📝 Normalize query filter values to lower-cased non-empty tokens.
   - ƒ **_dashboard_git_filter_value** (`Function`)
     - 📝 Build comparable git status token for dashboards filtering.
+  - ƒ **_normalize_actor_alias_token** (`Function`)
+    - 📝 Normalize actor alias token to comparable trim+lower text.
+  - ƒ **_normalize_owner_display_token** (`Function`)
+    - 📝 Project owner payload value into stable display string for API response contracts.
+  - ƒ **_normalize_dashboard_owner_values** (`Function`)
+    - 📝 Normalize dashboard owners payload to optional list of display strings.
+  - ƒ **_project_dashboard_response_items** (`Function`)
+    - 📝 Project dashboard payloads to response-contract-safe shape.
+  - ƒ **_resolve_profile_actor_aliases** (`Function`)
+    - 📝 Resolve stable actor aliases for profile filtering without per-dashboard detail fan-out.
+  - ƒ **_matches_dashboard_actor_aliases** (`Function`)
+    - 📝 Apply profile actor matching against multiple aliases (username + optional display name).
   - ƒ **get_dashboards** (`Function`)
     - 📝 Fetch list of dashboards from a specific environment with Git status and last task status
     - 🔗 CALLS -> `ResourceService.get_dashboards_with_status`
@@ -3431,6 +3600,16 @@
   - ƒ **test_get_database_mappings_env_not_found** (`Function`)
   - ƒ **test_get_dashboard_tasks_history_filters_success** (`Function`)
   - ƒ **test_get_dashboard_thumbnail_success** (`Function`)
+  - ƒ **_build_profile_preference_stub** (`Function`)
+    - 📝 Creates profile preference payload stub for dashboards filter contract tests.
+  - ƒ **_matches_actor_case_insensitive** (`Function`)
+    - 📝 Applies trim + case-insensitive owners OR modified_by matching used by route contract tests.
+  - ƒ **test_get_dashboards_profile_filter_contract_owners_or_modified_by** (`Function`)
+  - ƒ **test_get_dashboards_override_show_all_contract** (`Function`)
+  - ƒ **test_get_dashboards_profile_filter_no_match_results_contract** (`Function`)
+  - ƒ **test_get_dashboards_page_context_other_disables_profile_default** (`Function`)
+  - ƒ **test_get_dashboards_profile_filter_matches_display_alias_without_detail_fanout** (`Function`)
+  - ƒ **test_get_dashboards_profile_filter_matches_owner_object_payload_contract** (`Function`)
   - ƒ **mock_deps** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
   - ƒ **mock_get_dashboards** (`Function`) `[TRIVIAL]`
@@ -3571,6 +3750,27 @@
   - ƒ **test_get_datasets_superset_failure** (`Function`)
   - ƒ **mock_deps** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **backend.src.api.routes.__tests__.test_profile_api** (`Module`)
+  - 📝 Verifies profile API route contracts for preference read/update and Superset account lookup.
+  - 🏗️ Layer: API
+  - ƒ **mock_profile_route_dependencies** (`Function`)
+    - 📝 Provides deterministic dependency overrides for profile route tests.
+  - ƒ **profile_route_deps_fixture** (`Function`)
+    - 📝 Pytest fixture wrapper for profile route dependency overrides.
+  - ƒ **_build_preference_response** (`Function`)
+    - 📝 Builds stable profile preference response payload for route tests.
+  - ƒ **test_get_profile_preferences_returns_self_payload** (`Function`)
+    - 📝 Verifies GET /api/profile/preferences returns stable self-scoped payload.
+  - ƒ **test_patch_profile_preferences_success** (`Function`)
+    - 📝 Verifies PATCH /api/profile/preferences persists valid payload through route mapping.
+  - ƒ **test_patch_profile_preferences_validation_error** (`Function`)
+    - 📝 Verifies route maps domain validation failure to HTTP 422 with actionable details.
+  - ƒ **test_patch_profile_preferences_cross_user_denied** (`Function`)
+    - 📝 Verifies route maps domain authorization guard failure to HTTP 403.
+  - ƒ **test_lookup_superset_accounts_success** (`Function`)
+    - 📝 Verifies lookup route returns success payload with normalized candidates.
+  - ƒ **test_lookup_superset_accounts_env_not_found** (`Function`)
+    - 📝 Verifies lookup route maps missing environment to HTTP 404.
 - 📦 **backend.tests.test_reports_detail_api** (`Module`)
   - 📝 Contract tests for GET /api/reports/{report_id} detail endpoint behavior.
   - 🏗️ Layer: Domain (Tests)
@@ -4000,6 +4200,13 @@
   - ℂ **ADGroupMapping** (`Class`) `[CRITICAL]`
     - 📝 Maps an Active Directory group to a local System Role.
     - 🔗 DEPENDS_ON -> `Role`
+- 📦 **backend.src.models.profile** (`Module`)
+  - 📝 Defines persistent per-user dashboard filter preferences.
+  - 🏗️ Layer: Domain
+  - 🔒 Invariant: Exactly one preference row exists per user_id.
+  - 🔗 DEPENDS_ON -> `backend.src.models.auth`
+  - ℂ **UserDashboardPreference** (`Class`)
+    - 📝 Stores Superset username binding and default "my dashboards" toggle for one authenticated user.
 - 📦 **test_models** (`Module`) `[TRIVIAL]`
   - 📝 Unit tests for data models
   - 🏗️ Layer: Domain
@@ -4083,6 +4290,52 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **test_report_validation** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **backend.src.services.profile_service** (`Module`) `[CRITICAL]`
+  - 📝 Orchestrates profile preference persistence, Superset account lookup, and deterministic actor matching.
+  - 🏗️ Layer: Domain
+  - 🔒 Invariant: Username normalization is trim+lower and shared by save and matching paths.
+  - 🔗 DEPENDS_ON -> `backend.src.models.profile`
+  - 🔗 DEPENDS_ON -> `backend.src.schemas.profile`
+  - 🔗 DEPENDS_ON -> `backend.src.core.superset_client`
+  - 🔗 DEPENDS_ON -> `backend.src.core.auth.repository`
+  - 🔗 DEPENDS_ON -> `backend.src.models.auth`
+  - 🔗 DEPENDS_ON -> `sqlalchemy.orm.Session`
+  - ℂ **ProfileValidationError** (`Class`)
+    - 📝 Domain validation error for profile preference update requests.
+  - ℂ **EnvironmentNotFoundError** (`Class`)
+    - 📝 Raised when environment_id from lookup request is unknown in app configuration.
+  - ℂ **ProfileAuthorizationError** (`Class`)
+    - 📝 Raised when caller attempts cross-user preference mutation.
+  - ℂ **ProfileService** (`Class`) `[CRITICAL]`
+    - 📝 Implements profile preference read/update flow and Superset account lookup degradation strategy.
+    - ƒ **__init__** (`Function`)
+      - 📝 Initialize service with DB session and config manager.
+    - ƒ **get_my_preference** (`Function`)
+      - 📝 Return current user's persisted preference or default non-configured view.
+    - ƒ **update_my_preference** (`Function`)
+      - 📝 Validate and persist current user's profile preference in self-scoped mode.
+    - ƒ **lookup_superset_accounts** (`Function`)
+      - 📝 Query Superset users in selected environment and project canonical account candidates.
+    - ƒ **matches_dashboard_actor** (`Function`)
+      - 📝 Apply trim+case-insensitive actor match across owners OR modified_by.
+    - ƒ **_resolve_environment** (`Function`)
+      - 📝 Resolve environment model from configured environments by id.
+    - ƒ **_get_preference_row** (`Function`)
+      - 📝 Return persisted preference row for user or None.
+    - ƒ **_get_or_create_preference_row** (`Function`)
+      - 📝 Return existing preference row or create new unsaved row.
+    - ƒ **_build_default_preference** (`Function`)
+      - 📝 Build non-persisted default preference DTO for unconfigured users.
+    - ƒ **_validate_update_payload** (`Function`)
+      - 📝 Validate username/toggle constraints for preference mutation.
+    - ƒ **_sanitize_username** (`Function`)
+      - 📝 Normalize raw username into trimmed form or None for empty input.
+    - ƒ **_normalize_username** (`Function`)
+      - 📝 Apply deterministic trim+lower normalization for actor matching.
+    - ƒ **_normalize_owner_tokens** (`Function`)
+      - 📝 Normalize owners payload into deduplicated lower-cased tokens.
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **backend.src.services.resource_service** (`Module`)
   - 📝 Shared service for fetching resource data with Git status and task status
   - 🏗️ Layer: Service
@@ -4181,6 +4434,26 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **__init__** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **backend.src.services.rbac_permission_catalog** (`Module`)
+  - 📝 Discovers declared RBAC permissions from API routes/plugins and synchronizes them into auth database.
+  - 🏗️ Layer: Service
+  - 🔒 Invariant: Synchronization is idempotent for existing (resource, action) permission pairs.
+  - 🔗 CALLS -> `backend.src.core.plugin_loader.PluginLoader.get_all_plugin_configs`
+  - 🔗 DEPENDS_ON -> `backend.src.models.auth.Permission`
+  - 📦 **HAS_PERMISSION_PATTERN** (`Constant`)
+    - 📝 Regex pattern for extracting has_permission("resource", "ACTION") declarations.
+  - 📦 **ROUTES_DIR** (`Constant`)
+    - 📝 Absolute directory path where API route RBAC declarations are defined.
+  - ƒ **_iter_route_files** (`Function`)
+    - 📝 Iterates API route files that may contain RBAC declarations.
+  - ƒ **_discover_route_permissions** (`Function`)
+    - 📝 Extracts explicit has_permission declarations from API route source code.
+  - ƒ **_discover_plugin_execute_permissions** (`Function`)
+    - 📝 Derives dynamic task permissions of form plugin:{plugin_id}:EXECUTE from plugin registry.
+  - ƒ **discover_declared_permissions** (`Function`)
+    - 📝 Builds canonical RBAC permission catalog from routes and plugin registry.
+  - ƒ **sync_permission_catalog** (`Function`)
+    - 📝 Persists missing RBAC permission pairs into auth database.
 - 📦 **backend.src.services** (`Module`)
   - 📝 Package initialization for services module
   - 🏗️ Layer: Core
@@ -4221,10 +4494,14 @@
       - 📝 Persist repository local_path in GitRepository table when record exists.
     - ƒ **_migrate_repo_directory** (`Function`)
       - 📝 Move legacy repository directory to target path and sync DB metadata.
+    - ƒ **_ensure_gitflow_branches** (`Function`)
+      - 📝 Ensure standard GitFlow branches (main/dev/preprod) exist locally and on origin.
     - ƒ **_get_repo_path** (`Function`)
       - 📝 Resolves the local filesystem path for a dashboard's repository.
     - ƒ **init_repo** (`Function`)
       - 📝 Initialize or clone a repository for a dashboard.
+    - ƒ **delete_repo** (`Function`)
+      - 📝 Remove local repository and DB binding for a dashboard.
     - ƒ **get_repo** (`Function`)
       - 📝 Get Repo object for a dashboard.
     - ƒ **list_branches** (`Function`)
@@ -4261,6 +4538,10 @@
       - 📝 Create repository in Gitea for authenticated user.
     - ƒ **delete_gitea_repository** (`Function`)
       - 📝 Delete repository in Gitea.
+    - ƒ **_gitea_branch_exists** (`Function`)
+      - 📝 Check whether a branch exists in Gitea repository.
+    - ƒ **_build_gitea_pr_404_detail** (`Function`)
+      - 📝 Build actionable error detail for Gitea PR 404 responses.
     - ƒ **create_github_repository** (`Function`)
       - 📝 Create repository in GitHub or GitHub Enterprise.
     - ƒ **create_gitlab_repository** (`Function`)
@@ -4374,6 +4655,18 @@
   - ƒ **test_extract_resource_name_from_task** (`Function`)
   - ƒ **test_get_last_task_for_resource_empty_tasks** (`Function`)
   - ƒ **test_get_last_task_for_resource_no_match** (`Function`)
+- 📦 **backend.src.services.__tests__.test_rbac_permission_catalog** (`Module`)
+  - 📝 Verifies RBAC permission catalog discovery and idempotent synchronization behavior.
+  - 🏗️ Layer: Service Tests
+  - 🔒 Invariant: Synchronization adds only missing normalized permission pairs.
+  - ƒ **test_discover_route_permissions_extracts_declared_pairs_and_ignores_tests** (`Function`)
+    - 📝 Ensures route-scanner extracts has_permission pairs from route files and skips __tests__.
+  - ƒ **test_discover_declared_permissions_unions_route_and_plugin_permissions** (`Function`)
+    - 📝 Ensures full catalog includes route-level permissions plus dynamic plugin EXECUTE rights.
+  - ƒ **test_sync_permission_catalog_inserts_only_missing_normalized_pairs** (`Function`)
+    - 📝 Ensures synchronization inserts only missing pairs and normalizes action/resource tokens.
+  - ƒ **test_sync_permission_catalog_is_noop_when_all_permissions_exist** (`Function`)
+    - 📝 Ensures synchronization is idempotent when all declared pairs already exist.
 - 📦 **backend.src.services.clean_release.compliance_orchestrator** (`Module`) `[CRITICAL]`
   - 📝 Execute mandatory clean compliance stages and produce final COMPLIANT/BLOCKED/FAILED outcome.
   - 🏗️ Layer: Domain
@@ -4381,14 +4674,16 @@
   - 🔗 DEPENDS_ON -> `backend.src.services.clean_release.stages`
   - 🔗 DEPENDS_ON -> `backend.src.services.clean_release.report_builder`
   - 🔗 DEPENDS_ON -> `backend.src.services.clean_release.repository`
+  - ℂ **CleanComplianceOrchestrator** (`Class`)
+    - 📝 Coordinate clean-release compliance verification stages.
+    - ƒ **start_check_run** (`Function`)
+      - 📝 Initiate a new compliance run session.
+      - ƒ **finalize_run** (`Function`)
+        - 📝 Finalize run status based on cumulative stage results.
   - ƒ **__init__** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
-  - ƒ **start_check_run** (`Function`) `[TRIVIAL]`
-    - 📝 Auto-detected function (orphan)
   - ƒ **execute_stages** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
-  - ƒ **finalize_run** (`Function`) `[TRIVIAL]`
-    - 📝 Auto-detected function (orphan)
 - 📦 **backend.src.services.clean_release.manifest_builder** (`Module`)
   - 📝 Build deterministic distribution manifest from classified artifact input.
   - 🏗️ Layer: Domain
@@ -4461,6 +4756,8 @@
   - 🏗️ Layer: Infra
   - 🔒 Invariant: Repository operations are side-effect free outside explicit save/update calls.
   - 🔗 DEPENDS_ON -> `backend.src.models.clean_release`
+  - ℂ **CleanReleaseRepository** (`Class`)
+    - 📝 Data access object for clean release lifecycle.
   - ƒ **save_candidate** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
   - ƒ **get_candidate** (`Function`) `[TRIVIAL]`
@@ -4491,6 +4788,8 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **get_violations_by_check_run** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+  - ƒ **clear_history** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **backend.src.services.clean_release.preparation_service** (`Module`)
   - 📝 Prepare release candidate by policy evaluation and deterministic manifest creation.
   - 🏗️ Layer: Domain
@@ -5066,6 +5365,8 @@
       - 📝 Test deleting with empty list (no-op).
     - ƒ **test_persist_task_with_datetime_in_params** (`Function`)
       - 📝 Test json_serializable handles datetime in params.
+    - ƒ **test_persist_task_resolves_environment_slug_to_existing_id** (`Function`)
+      - 📝 Ensure slug-like environment token resolves to environments.id before persisting task.
   - ƒ **_patched** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
   - ƒ **_make_task** (`Function`) `[TRIVIAL]`
@@ -5360,6 +5661,24 @@
       - 📝 Test deleting with empty list (no-op).
   - ƒ **_patched** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+- 📦 **backend.tests.scripts.test_clean_release_tui** (`Module`)
+  - 📝 Unit tests for the interactive curses TUI of the clean release process.
+  - 🏗️ Layer: Scripts
+  - 🔒 Invariant: TUI initializes, handles hotkeys (F5, F10) and safely falls back without TTY.
+  - ƒ **mock_stdscr** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_headless_fallback** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_tui_initial_render** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_tui_run_checks_f5** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **side_effect** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_tui_exit_f10** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_tui_clear_history_f7** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **backend.tests.core.test_git_service_gitea_pr** (`Module`)
   - 📝 Validate Gitea PR creation fallback behavior when configured server URL is stale.
   - 🏗️ Layer: Domain
@@ -5368,6 +5687,10 @@
     - 📝 Ensure helper returns host base URL and removes embedded credentials.
   - ƒ **test_create_gitea_pull_request_retries_with_remote_host_on_404** (`Function`)
     - 📝 Verify create_gitea_pull_request retries with remote URL host after primary 404.
+  - ƒ **test_create_gitea_pull_request_returns_branch_error_when_target_missing** (`Function`)
+    - 📝 Ensure Gitea 404 on PR creation is mapped to actionable target-branch validation error.
+  - ƒ **fake_gitea_request** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
   - ƒ **fake_gitea_request** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
 - 📦 **backend.tests.core.test_mapping_service** (`Module`)
@@ -5412,6 +5735,28 @@
     - 📝 Auto-detected function (orphan)
   - ƒ **test_superset_client_import_dashboard_guard** (`Function`) `[TRIVIAL]`
     - 📝 Auto-detected function (orphan)
+  - ƒ **test_git_service_init_repo_reclones_when_path_is_not_a_git_repo** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **test_git_service_ensure_gitflow_branches_creates_and_pushes_missing_defaults** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **fetch** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **push** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **__init__** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **create_head** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
+  - ƒ **remote** (`Function`) `[TRIVIAL]`
+    - 📝 Auto-detected function (orphan)
 - 📦 **backend.tests.core.test_migration_engine** (`Module`)
   - 📝 Unit tests for MigrationEngine's cross-filter patching algorithms.
   - 🏗️ Layer: Domain

frontend/src/components/storage/FileList.svelte

@@ -13,8 +13,9 @@
 <script lang="ts">
   // [SECTION: IMPORTS]
   import { createEventDispatcher } from 'svelte';
-  import { downloadFileUrl } from '../../services/storageService';
+  import { downloadFile } from '../../services/storageService';
   import { t } from '../../lib/i18n';
+  import { addToast } from '../../lib/toasts';
   // [/SECTION: IMPORTS]
 
   let {
@@ -68,6 +69,21 @@
     return new Date(dateStr).toLocaleString();
   }
   // [/DEF:formatDate:Function]
+
+  // [DEF:handleDownload:Function]
+  /**
+   * @purpose Downloads selected file through authenticated API request.
+   * @pre     file is a non-directory storage entry with category/path.
+   * @post    Browser download starts or user sees toast on failure.
+   */
+  async function handleDownload(file) {
+    try {
+      await downloadFile(file.category, file.path, file.name);
+    } catch (error) {
+      addToast(error?.message || 'Download failed', 'error');
+    }
+  }
+  // [/DEF:handleDownload:Function]
 </script>
 
 <!-- [SECTION: TEMPLATE] -->
@@ -112,13 +128,13 @@
           <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">{formatDate(file.created_at)}</td>
           <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
             {#if !isDirectory(file)}
-              <a
+              <button
-                href={downloadFileUrl(file.category, file.path)}
+                type="button"
-                download={file.name}
+                on:click={() => handleDownload(file)}
                 class="text-indigo-600 hover:text-indigo-900 mr-4"
               >
                 {$t.storage.table.download}
-              </a>
+              </button>
             {/if}
             <button
               on:click={() => dispatch('delete', { category: file.category, path: file.path, name: file.name })}
@@ -141,4 +157,4 @@
 <!-- [/SECTION: TEMPLATE] -->
 
 
-<!-- [/DEF:FileList:Component] -->
+<!-- [/DEF:FileList:Component] -->

frontend/src/services/storageService.js

@@ -28,6 +28,21 @@ function getStorageAuthHeaders() {
 }
 // [/DEF:getStorageAuthHeaders:Function]
 
+// [DEF:encodeStoragePath:Function]
+/**
+ * @purpose Encodes a storage-relative path preserving slash separators.
+ * @param   {string} path - Relative storage path.
+ * @returns {string} Encoded path safe for URL segments.
+ */
+function encodeStoragePath(path) {
+    return String(path || '')
+        .split('/')
+        .filter((part) => part.length > 0)
+        .map((part) => encodeURIComponent(part))
+        .join('/');
+}
+// [/DEF:encodeStoragePath:Function]
+
 // [DEF:listFiles:Function]
 /**
  * @purpose Fetches the list of files for a given category and subpath.
@@ -121,15 +136,50 @@ export async function deleteFile(category, path) {
  *          or the backend must allow unauthenticated downloads for valid paths.
  */
 export function downloadFileUrl(category, path) {
-    return `${API_BASE}/download/${category}/${path}`;
+    const safeCategory = encodeURIComponent(String(category || ''));
+    const safePath = encodeStoragePath(path);
+    return `${API_BASE}/download/${safeCategory}/${safePath}`;
 }
 // [/DEF:downloadFileUrl:Function]
 
+// [DEF:downloadFile:Function]
+/**
+ * @purpose Downloads a file using authenticated fetch and saves it in browser.
+ * @param   {string} category - File category.
+ * @param   {string} path - Relative path of the file.
+ * @param   {string} [filename] - Optional preferred filename.
+ * @returns {Promise<void>}
+ * @PRE     category/path identify an existing file and user has READ permission.
+ * @POST    Browser download is triggered or an Error is thrown.
+ */
+export async function downloadFile(category, path, filename) {
+    const response = await fetch(downloadFileUrl(category, path), {
+        headers: getStorageAuthHeaders(),
+    });
+
+    if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        throw new Error(errorData.detail || `Failed to download file: ${response.statusText}`);
+    }
+
+    const blob = await response.blob();
+    const objectUrl = window.URL.createObjectURL(blob);
+    const link = document.createElement('a');
+    link.href = objectUrl;
+    link.download = filename || String(path || '').split('/').pop() || 'download';
+    document.body.appendChild(link);
+    link.click();
+    document.body.removeChild(link);
+    window.URL.revokeObjectURL(objectUrl);
+}
+// [/DEF:downloadFile:Function]
+
 export default {
     listFiles,
     uploadFile,
     deleteFile,
-    downloadFileUrl
+    downloadFileUrl,
+    downloadFile
 };
 
-// [/DEF:storageService:Module]
+// [/DEF:storageService:Module]