Memory Wiki

I'll start by examining the build plan, past faults, chassis, and existing Module 4 code to make informed structural decisions.

Now let me look at the existing Module 4 code and the build plan's Module 4 section:

Let me read the actual implementation files in each module:

Let me also check the migration files and the chassis's profe_audit_log interface:

Now let me check the email admin repository and see if there are any test directories:

I now have a complete picture of all four existing modules. Let me write the final Project Brief.

Let me verify the file was written correctly and provide the summary:

Here is my complete analysis and deliverable summary: --- ## Summary ### What I Did I thoroughly re-evaluated Module 4's module structure by reading the build plan V3, past faults log, all four existing module implementations (brevo_service, mail_queue, email_templates, email_admin), chassis interfaces, migration files, and cross-cutting concerns from Modules 1-3. ### Structural Decisions | Original Module | Decision | Rationale | |----------------|----------|-----------| | `brevo_service` (T21) | **KEEP** | Different concern from mail_queue (API wrapper vs queue management). Webhook handling is cleanly embedded. | | `mail_queue` (T22) | **KEEP** | Core module. Add **wp_mail() override** which is missing. | | `email_templates` (T23) | **KEEP** | Templates are DB records (not PHP classes as originally stated). Add **seed migration** for 27 templates. | | `email_admin` (T24) | **KEEP** | NOT redundant with admin_app (T51). Provides backend REST endpoints that the React SPA will consume. | **No modules combined, split, removed, or added.** The 4-module structure is correct. But **critical fixes** are needed within the existing modules. ### Critical Findings (Gaps Found) 1. **SECURITY CRITICAL: Webhook signature verification missing** — `BrevoApiClient::verifyWebhookSignature()` exists but is never called in `handleWebhook()`. Any POST to the webhook endpoint is accepted without verification. 2. **Missing: `wp_mail()` override** — WordPress's native email function is not intercepted, so other plugins' emails bypass Brevo. 3. **Missing: Template seed data** — 27 templates described in the build plan have no seed migration. Table exists but is empty. 4. **Missing: Tests** — Zero test files across all 4 modules (violates FAULT-005/009). 5. **Code smell: Duplicate exception files** — Each module has exception classes in two locations (both top-level and Exception/ subdirectory). 6. **FAULT-011 risk** — Need to audit for quadruple-backslash issue in DI container lookups. ### File Created `/root/.hermes/plans/pb-m4-email.md` — 431 lines, 31,741 bytes. The PB contains: - **§0** Executive Summary with 4 architectural corrections from build plan - **§1** Locked from Past Modules (7 subsections covering identity, DB, security, events, module contract, CSRF pattern) - **§2** Module Breakdown with architectural decision table, module map, all 3 table schemas - **§3** Critical Design Decisions (11 decisions, 5 flagged as requiring changes) - **§4** Risk Assessment (7 risks with mitigations) - **§5** Build Order (3-phase plan: Fixes → Tests → Final Review) - **§6** Module File Manifest (per-file status for all 4 modules) - **§7** Forward Signal Items (5 items deferred to future modules) - **Appendix A** Event Inventory (13 events) - **Appendix B** Template List (27 pre-defined template identifiers)