Motir

Type: test · Executor: coding_agent · Repo: motir-core · ONE PR. The story's per-repo coverage + integration gate, run after its code cards merge because it measures their real, merged output.

⚠️ RE-SCOPED 2026-08-30 — and the body you may have read before this was the WRONG one

This card's title was updated to the scope below while its description was left describing the old one — "coverage floor over the moved surface, the host/origin seams, and a guard that every app/(public) segment has a declared host". That happened because a plan correction replaced a proposal's whole patch and silently dropped the new body (the same failure family as MOTIR-3934). The body is now rewritten to match the title. There is no moved surface here and no host to declare: motir-core serves no public pages, and app/(public) is deleted by MOTIR-3951.

The gate is over what this story actually ships: a public read contract, and the origin this application EMITS.

What it covers

1. The contract's shape. The subject route's response asserted against the fields the public project page renders, and the enumerated-from-the-filesystem guard that every app/api/public/* route is versioned and documented — a route added later must not escape by being forgotten. MOTIR-3946 ships that guard; this card is where its adequacy is asserted.

2. The anonymous posture, per route, derived not remembered. Every app/api/public/* READ answers with no session, over a route set enumerated from the filesystem so it cannot drift. follow is the one deliberate exception and is asserted as an exception rather than skipped — the idiom tests/navigation/proxy-matcher.test.ts and tests/seo/robots.test.ts both use, and the one tests/api/two-factor-api-gate.test.ts already applies to this directory.

3. The origin seam, as MOTIR-3881 re-scoped it — read that card first. What stood here asserted "an unset public-site origin resolves to the APPLICATION origin … the deployed state until the cutover", and both halves are stale: motir.co already resolves to motir-marketing, so there is no unconfigured production window to protect, and nearly every reader of publicSiteOrigin() lives in the pages being deleted. What survives, and what this card asserts:

   • exactly one module reads each origin variable (the tree grep, in the appUrlSeam shape);
   • the follow-digest email's links resolve to the public site — the only shipped consumer left, and the only place this application puts a URL somewhere it cannot take back;
   • an unset public-site origin has a stated, tested behaviour that never puts localhost into an email that leaves the building;
   • app/sitemap.ts lists nothing served by another host.

4. The coverage floor on every file this story's pull requests touch, measured by CI rather than locally.

⚠️ What this card does NOT cover, and who does

The public journey and its acceptance video are not here. That walk happens on motir.co, rendered by another repository; MOTIR-3886 moved with it. A Playwright spec in motir-core could only walk the half that remains, which would be a receipt for the wrong thing.

The deletion is not here either. MOTIR-3951 removes app/(public) and carries its own assertions — the route manifest, the service-method caller sweep, and the /follow/* disposition.

Acceptance criteria

• Every app/api/public/* read is asserted to answer with no session, over a route set derived from the filesystem; follow's 401 is asserted as the deliberate exception.
• The subject route's response shape is asserted against the fields the public project page renders, so the contract cannot drift from its specification.
• The follow digest's rendered links resolve to the public site, and the unset-origin arm is exercised with a production-shaped configuration — the case a locally-configured developer never hits.
• The single-reader rule is asserted by a tree grep, in the existing appUrlSeam shape.
• app/sitemap.ts is asserted to list nothing served by another host.
• ≥90% branch/function/line coverage on every file this story's pull requests touch, measured by CI.
• No assertion in this card depends on a page this repository is about to stop serving — if one does, it belongs to MOTIR-3951 or to the rendering story, not here.

Context refs

• motir-core/app/api/public/ — the surface under test
• motir-core/lib/services/publicFollowDigestService.ts — the surviving origin consumer
• motir-core/tests/hosting/appUrlSeam.test.ts — the single-reader idiom
• motir-core/tests/navigation/proxy-matcher.test.ts · tests/seo/robots.test.ts · tests/api/two-factor-api-gate.test.ts — the derive-from-the-filesystem idiom this card's guards follow
• motir-core/docs/decisions/public-surface-hosts.md — the arrangement being gated