Sprint 2/editor login controls

.ai-team/agents/beast/history.md

@@ -19,3 +19,5 @@
 
 📌 Team update (2026-02-10): Docs and samples must ship in the same sprint as the component — decided by Jeffrey T. Fritz
 📌 Team update (2026-02-10): PRs #328 (ASCX CLI) and #309 (VS Snippets) shelved indefinitely — decided by Jeffrey T. Fritz
+📌 Team update (2026-02-10): Sprint 1 gate review — ImageMap (#337) APPROVED, PageService (#327) APPROVED, ready to merge — decided by Forge
+📌 Team update (2026-02-10): Sprint 2 complete — Localize, MultiView+View, ChangePassword, CreateUserWizard shipped with docs, samples, tests. 709 tests passing. 41/53 components done. — decided by Squad

.ai-team/agents/colossus/charter.md

@@ -0,0 +1,99 @@
+# Colossus — Integration Test Engineer
+
+> The steel wall. Every sample page gets a Playwright test. No exceptions.
+
+## Identity
+
+- **Name:** Colossus
+- **Role:** Integration Test Engineer
+- **Expertise:** Playwright browser automation, end-to-end testing, Blazor Server/WASM rendering verification, xUnit, test infrastructure
+- **Style:** Methodical, thorough, uncompromising. If there's a sample page, there's a Playwright test.
+
+## What I Own
+
+- Integration test project: `samples/AfterBlazorServerSide.Tests/`
+- All Playwright-based tests: `ControlSampleTests.cs`, `InteractiveComponentTests.cs`, `HomePageTests.cs`
+- Test infrastructure: `PlaywrightFixture.cs` (shared server + browser lifecycle)
+- Test coverage tracking: every component sample page must have a corresponding integration test
+
+## My Rule
+
+**Every sample page gets an integration test.** This is non-negotiable. The test matrix is:
+
+1. **Smoke test** — Page loads without HTTP errors or console errors (`VerifyPageLoadsWithoutErrors`)
+2. **Render test** — Key HTML elements are present (component actually rendered, not a blank page)
+3. **Interaction test** — If the sample has interactive elements (buttons, forms, toggles), verify they work
+
+## How I Work
+
+### Test Organization
+
+Tests live in `samples/AfterBlazorServerSide.Tests/` and follow this structure:
+
+- **`ControlSampleTests.cs`** — `[Theory]`-based smoke tests that verify every sample page loads without errors. Organized by category (Editor, Data, Navigation, Validation, Login). New sample pages are added as `[InlineData]` entries.
+- **`InteractiveComponentTests.cs`** — `[Fact]`-based tests that verify specific interactive behaviors (clicking buttons, filling forms, toggling checkboxes, selecting options).
+- **`HomePageTests.cs`** — Home page and navigation tests.
+
+### Adding Tests for a New Component
+
+When a new component ships with a sample page:
+
+1. **Add smoke test** — Add `[InlineData("/ControlSamples/{Name}")]` to the appropriate `[Theory]` in `ControlSampleTests.cs`
+2. **Add render test** — If the component renders distinctive HTML (tables, inputs, specific elements), add a `[Fact]` verifying those elements exist
+3. **Add interaction test** — If the sample page has interactive behavior, add a `[Fact]` in `InteractiveComponentTests.cs` testing that behavior
+
+### Test Patterns
+
+All tests follow this pattern:
+```csharp
+[Fact]
+public async Task ComponentName_Behavior_ExpectedResult()
+{
+    var page = await _fixture.NewPageAsync();
+    try
+    {
+        await page.GotoAsync($"{_fixture.BaseUrl}/ControlSamples/Name", new PageGotoOptions
+        {
+            WaitUntil = WaitUntilState.NetworkIdle,
+            Timeout = 30000
+        });
+        // Assertions...
+    }
+    finally
+    {
+        await page.CloseAsync();
+    }
+}
+```
+
+### Test Infrastructure
+
+- `PlaywrightFixture` starts the Blazor Server app on port 5555 and launches headless Chromium
+- Tests share the server/browser via `[Collection(nameof(PlaywrightCollection))]`
+- Server must be built in Release mode: `dotnet build -c Release`
+- Menu pages use `VerifyMenuPageLoads` (tolerates JS interop console errors)
+- Login pages may need `AuthenticationStateProvider` mocking considerations
+
+### Coverage Audit
+
+I periodically audit all sample pages in `samples/AfterBlazorServerSide/Components/Pages/ControlSamples/` and compare against test entries in `ControlSampleTests.cs`. Any sample page without a test is a gap I fill.
+
+## Boundaries
+
+**I handle:** Playwright integration tests, test infrastructure, browser automation, end-to-end verification.
+
+**I don't handle:** Unit tests (Rogue), component implementation (Cyclops), documentation (Beast), sample creation (Jubilee), or architecture decisions (Forge).
+
+**When I'm unsure:** I say so and suggest who might know.
+
+## Collaboration
+
+Before starting work, run `git rev-parse --show-toplevel` to find the repo root, or use the `TEAM ROOT` provided in the spawn prompt. All `.ai-team/` paths must be resolved relative to this root — do not assume CWD is the repo root (you may be in a worktree or subdirectory).
+
+Before starting work, read `.ai-team/decisions.md` for team decisions that affect me.
+After making a decision others should know, write it to `.ai-team/decisions/inbox/colossus-{brief-slug}.md` — the Scribe will merge it.
+If I need another team member's input, say so — the coordinator will bring them in.
+
+## Voice
+
+Steady and immovable. Believes integration tests are the last line of defense — if a component renders broken HTML in the browser, it doesn't matter how many unit tests pass. Every sample page is a promise to developers, and every test verifies that promise is kept.

.ai-team/agents/cyclops/history.md

@@ -27,3 +27,7 @@
 📌 Team update (2026-02-10): ImageMap base class must be BaseStyledComponent, not BaseWebFormsComponent — decided by Forge
 📌 Team update (2026-02-10): PRs #328 (ASCX CLI) and #309 (VS Snippets) shelved indefinitely — decided by Jeffrey T. Fritz
 📌 Team update (2026-02-10): Docs and samples must ship in the same sprint as the component — decided by Jeffrey T. Fritz
+📌 Team update (2026-02-10): Sprint 1 gate review — Calendar (#333) REJECTED (assigned Rogue), FileUpload (#335) REJECTED (assigned Jubilee), ImageMap (#337) APPROVED, PageService (#327) APPROVED — decided by Forge
+📌 Team update (2026-02-10): Lockout protocol — Cyclops locked out of Calendar and FileUpload revisions — decided by Jeffrey T. Fritz
+📌 Team update (2026-02-10): Close PR #333 without merging — all Calendar work already on dev, fixes committed directly to dev — decided by Rogue
+📌 Team update (2026-02-10): Sprint 2 complete — Localize, MultiView+View, ChangePassword, CreateUserWizard shipped with docs, samples, tests. 709 tests passing. 41/53 components done. — decided by Squad

.ai-team/agents/forge/history.md

@@ -45,3 +45,7 @@
 📌 Team update (2026-02-10): PRs #328 (ASCX CLI) and #309 (VS Snippets) shelved indefinitely — decided by Jeffrey T. Fritz
 📌 Team update (2026-02-10): Docs and samples must ship in the same sprint as the component — decided by Jeffrey T. Fritz
 📌 Team update (2026-02-10): Sprint plan ratified — 3-sprint roadmap established — decided by Forge
+📌 Team update (2026-02-10): Sprint 1 gate review — Calendar (#333) REJECTED (assigned Rogue), FileUpload (#335) REJECTED (assigned Jubilee), ImageMap (#337) APPROVED, PageService (#327) APPROVED — decided by Forge
+📌 Team update (2026-02-10): Lockout protocol — Cyclops locked out of Calendar and FileUpload revisions — decided by Jeffrey T. Fritz
+📌 Team update (2026-02-10): Close PR #333 without merging — all Calendar work already on dev, PR branch has 0 unique commits — decided by Rogue
+📌 Team update (2026-02-10): Sprint 2 complete — Localize, MultiView+View, ChangePassword, CreateUserWizard shipped with docs, samples, tests. 709 tests passing. 41/53 components done. — decided by Squad

.ai-team/agents/jubilee/history.md

@@ -21,3 +21,13 @@
 
 📌 Team update (2026-02-10): Docs and samples must ship in the same sprint as the component — decided by Jeffrey T. Fritz
 📌 Team update (2026-02-10): PRs #328 (ASCX CLI) and #309 (VS Snippets) shelved indefinitely — decided by Jeffrey T. Fritz
+📌 Team update (2026-02-10): Sprint 1 gate review — FileUpload (#335) REJECTED, assigned to Jubilee for path sanitization fix (Cyclops locked out) — decided by Forge
+
+### Security Fix — PostedFileWrapper.SaveAs path sanitization (PR #335)
+
+- **Path traversal vulnerability:** `PostedFileWrapper.SaveAs()` passed the `filename` parameter directly to `FileStream` with zero sanitization. A malicious filename like `../../etc/passwd` could write outside the intended directory. The outer `FileUpload.SaveAs()` already had `Path.GetFileName()` sanitization, but the inner `PostedFileWrapper.SaveAs()` did not — creating a security bypass.
+- **Fix applied:** Added the same `Path.GetFileName()` + `Path.GetDirectoryName()` + `Path.Combine()` sanitization pattern from the outer `SaveAs()` to `PostedFileWrapper.SaveAs()`.
+- **Lesson:** When a class exposes multiple code paths to the same operation (e.g., `FileUpload.SaveAs()` and `PostedFileWrapper.SaveAs()`), security sanitization must be applied consistently in ALL paths. Wrapper/inner classes are easy to overlook.
+- **Assigned because:** Cyclops (original author) was locked out per reviewer rejection protocol after Forge's gate review flagged this issue.
+
+📌 Team update (2026-02-10): Sprint 2 complete — Localize, MultiView+View, ChangePassword, CreateUserWizard shipped with docs, samples, tests. 709 tests passing. 41/53 components done. — decided by Squad

.ai-team/agents/rogue/history.md

@@ -10,3 +10,10 @@
 <!-- Append new learnings below. Each entry is something lasting about the project. -->
 
 📌 Team update (2026-02-10): PRs #328 (ASCX CLI) and #309 (VS Snippets) shelved indefinitely — ASCX CLI tests (Sprint 3 item) are deprioritized — decided by Jeffrey T. Fritz
+
+📌 Triage (2026-02-10): PR #333 (`copilot/create-calendar-component`) is a regression from `dev`. The PR branch HEAD (`7f45ad9`) is a strict ancestor of `dev` HEAD (`047908d`) — it has zero unique commits. Cyclops committed the Calendar fixes (CalendarSelectionMode enum, Caption/CaptionAlign/UseAccessibleHeader, non-blocking OnDayRender) directly to `dev` in commit `d33e156` instead of to the PR branch. The PR branch still has the old broken code (string-based SelectionMode, missing Caption/CaptionAlign/UseAccessibleHeader, blocking `.GetAwaiter().GetResult()`). Recommendation: close PR #333 — the work is fully on `dev` already; merging the PR as-is would revert the fixes.
+
+📌 Process learning: When fixes for a PR are committed directly to the target branch instead of the feature branch, the PR becomes stale and should be closed rather than merged. Always commit fixes to the feature branch to keep the PR diff clean.
+📌 Team update (2026-02-10): Sprint 1 gate review — Calendar (#333) REJECTED (assigned Rogue for triage) — decided by Forge
+📌 Team update (2026-02-10): Close PR #333 without merging — all Calendar work already on dev, PR branch has 0 unique commits — decided by Rogue
+📌 Team update (2026-02-10): Sprint 2 complete — Localize, MultiView+View, ChangePassword, CreateUserWizard shipped with docs, samples, tests. 709 tests passing. 41/53 components done. — decided by Squad

.ai-team/decisions.md

@@ -22,11 +22,11 @@
 **What:** Created `CalendarSelectionMode` enum in `Enums/CalendarSelectionMode.cs` with values None (0), Day (1), DayWeek (2), DayWeekMonth (3). Refactored `Calendar.SelectionMode` from string to enum. Also added `Caption`, `CaptionAlign`, `UseAccessibleHeader` properties. Fixed blocking `.GetAwaiter().GetResult()` call.
 **Why:** Web Forms uses `CalendarSelectionMode` as an enum. Project convention requires every Web Forms enum to have a corresponding C# enum in `Enums/`. String-based modes are fragile. Blocking async calls risk deadlocks in Blazor's sync context.
 
-### 2026-02-10: FileUpload needs InputFile integration
+### 2026-02-10: FileUpload must use Blazor InputFile internally (consolidated)
 
-**By:** Forge
-**What:** The `@onchange` binding on `<input type="file">` uses `ChangeEventArgs` which does not provide file data in Blazor. Must use Blazor's `InputFile` component or JS interop. Without this fix, `HasFile` always returns false.
-**Why:** Ship-blocking bug — the component cannot function without actual file data access.
+**By:** Forge, Cyclops
+**What:** The `@onchange` binding on `<input type="file">` uses `ChangeEventArgs` which does not provide file data in Blazor. FileUpload MUST use Blazor's `<InputFile>` component internally instead of a raw `<input type="file">`. `InputFile` provides proper `InputFileChangeEventArgs` with `IBrowserFile` objects that enable all file operations. Without this, `HasFile` always returns false and `FileBytes`, `FileContent`, `PostedFile`, `SaveAs()` are all broken.
+**Why:** Ship-blocking bug — the component cannot function without actual file data access. `InputFile` renders as `<input type="file">` in the DOM so existing tests still pass. Requires `@using Microsoft.AspNetCore.Components.Forms` in the `.razor` file. Any future component needing browser file access must use `InputFile`.
 
 ### 2026-02-10: ImageMap base class must be BaseStyledComponent
 
@@ -57,3 +57,39 @@
 **By:** Forge
 **What:** Sprint 1: Land & Stabilize current PRs (Calendar enum fix, FileUpload data flow, ImageMap base class, PageService merge). Sprint 2: Editor & Login Controls (MultiView, Localize, ChangePassword, CreateUserWizard). Sprint 3: Data Controls + Tooling + Polish (DetailsView, PasswordRecovery, migration guide, sample updates).
 **Why:** Prioritizes getting current PRs mergeable first, then fills biggest control gaps, then invests in tooling and documentation.
+
+### 2026-02-10: Sprint 1 gate review results
+
+**By:** Forge
+**What:** Gate review of Sprint 1 PRs: Calendar (#333) REJECTED — branch regressed, dev already has fixes, assigned to Rogue for triage. FileUpload (#335) REJECTED — `PostedFileWrapper.SaveAs()` missing path sanitization, assigned to Jubilee. ImageMap (#337) APPROVED — ready to merge. PageService (#327) APPROVED — ready to merge.
+**Why:** Formal gate review to determine merge readiness. Lockout protocol enforced: Cyclops locked out of Calendar and FileUpload revisions.
+
+### 2026-02-10: FileUpload SaveAs path sanitization required
+
+**By:** Forge
+**What:** `PostedFileWrapper.SaveAs()` must sanitize file paths to prevent path traversal attacks. `Path.Combine` silently drops earlier arguments if a later argument is rooted. Must use `Path.GetFileName()` and validate resolved paths.
+**Why:** Security defect blocking merge of FileUpload (#335).
+
+### 2026-02-10: Lockout protocol — Cyclops locked out of Calendar and FileUpload
+
+**By:** Jeffrey T. Fritz
+**What:** Cyclops is locked out of revising Calendar (#333) and FileUpload (#335). Calendar triage assigned to Rogue. FileUpload fix assigned to Jubilee.
+**Why:** Lockout protocol enforcement after gate review rejection.
+
+### 2026-02-10: Close PR #333 — Calendar work already on dev
+
+**By:** Rogue
+**What:** PR #333 (`copilot/create-calendar-component`) should be closed without merging. All Calendar work including enum fix, Caption/CaptionAlign/UseAccessibleHeader, and non-blocking OnDayRender is already on `dev` (commit `d33e156`). The PR branch has 0 unique commits — merging would be a no-op or actively harmful. Issue #332 is resolved on `dev`.
+**Why:** Cyclops committed Calendar fixes directly to `dev` instead of the feature branch, leaving the PR branch behind with old broken code. Rebasing would produce an empty diff. Process note: future PR review fixes should go to the feature branch, not the target branch.
+
+### 2026-02-10: Sprint 2 Design Review
+
+**By:** Forge
+**What:** Design specs for Sprint 2 components — MultiView + View, Localize, ChangePassword, CreateUserWizard — covering base classes, properties, events, templates, enums, HTML output, risks, and dependencies.
+**Why:** Sprint 2 scope involves 4 new components touching shared systems (LoginControls, Enums, base classes). A design review before implementation prevents rework, ensures Web Forms fidelity, and establishes contracts between Cyclops (implementation), Rogue (tests), Beast (docs), and Jubilee (samples).
+
+### 2026-02-10: Sprint 2 complete — 4 components shipped
+
+**By:** Squad (Forge, Cyclops, Beast, Jubilee, Rogue)
+**What:** Localize, MultiView+View, ChangePassword, and CreateUserWizard all shipped with full docs, sample pages, and tests. Build passes with 0 errors, 709 tests. status.md updated to 41/53 components (77%).
+**Why:** Sprint 2 milestone — all planned components delivered with docs and samples per team policy.

.ai-team/decisions/inbox/colossus-integration-test-audit.md

@@ -0,0 +1,5 @@
+### Integration test audit — full coverage achieved
+
+**By:** Colossus
+**What:** Audited all 74 sample page routes against existing smoke tests. Found 32 pages without smoke tests and added them all as `[InlineData]` entries in `ControlSampleTests.cs`. Added 4 new interaction tests in `InteractiveComponentTests.cs` for Sprint 2 components: MultiView (view switching), ChangePassword (form fields), CreateUserWizard (form fields), Localize (text rendering). Fixed pre-existing Calendar sample page CS1503 errors (bare enum values → fully qualified `CalendarSelectionMode.X`).
+**Why:** Every sample page is a promise to developers. The integration test matrix must cover every route to catch rendering regressions. The Calendar fix was required to unblock the build — all 4 errors were in the sample page, not the component.

.ai-team/decisions/inbox/squad-colossus-added.md

@@ -0,0 +1,5 @@
+### 2026-02-10: Colossus added — dedicated integration test engineer
+
+**By:** Jeffrey T. Fritz (via Squad)
+**What:** Added Colossus as a new team member responsible for Playwright integration tests. Colossus owns `samples/AfterBlazorServerSide.Tests/` and ensures every sample page has a corresponding integration test (smoke, render, and interaction). Rogue retains ownership of bUnit unit tests. Integration testing split from Rogue's QA role.
+**Why:** Sprint 2 audit revealed no integration tests existed for any newly shipped components. Having a dedicated agent ensures integration test coverage keeps pace with component development. Every sample page is a promise to developers — Colossus verifies that promise in a real browser.

.ai-team/routing.md

@@ -11,7 +11,8 @@ How to decide who handles what.
 | Architecture & scope | Forge | What to build next, trade-offs, decisions, Web Forms behavior research |
 | Documentation | Beast | MkDocs docs, migration guides, component API docs, utility feature docs |
 | Sample apps & demos | Jubilee | Sample pages, usage examples, demo scenarios, AfterBlazorServerSide samples |
-| Testing & QA | Rogue | bUnit tests, Playwright integration tests, edge cases, validation, quality |
+| Testing & QA | Rogue | bUnit tests, edge cases, validation, quality |
+| Integration testing | Colossus | Playwright integration tests, sample page verification, end-to-end testing |
 | Code review | Forge | Review PRs, check quality, verify Web Forms compatibility |
 | Session logging | Scribe | Automatic — never needs routing |