From 3b7452c72ce2806377eb03b63057a1b19cc539ff Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 14:55:17 +0000
Subject: [PATCH 1/7] fix: make jose SignJWT test mock constructable under
 vitest 4

Vitest 4 requires vi.fn() mock implementations to use 'function' or 'class'
(not arrow functions) to be usable with 'new'. The SignJWT mock used an arrow
function, so 'new SignJWT()' in the agent login path threw 'is not a constructor',
causing 4 agent.login test failures. Converted all 14 jose mocks to function form.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 server/floatTopUp.approve.test.ts                 | 14 ++++++++------
 server/fraud.alerts.test.ts                       | 14 ++++++++------
 server/mdm.test.ts                                | 14 ++++++++------
 server/pos.test.ts                                | 14 ++++++++------
 server/security.owasp.test.ts                     | 14 ++++++++------
 server/settlement.test.ts                         | 14 ++++++++------
 server/transactions.create.test.ts                | 14 ++++++++------
 tests/integration/admin-dashboard.test.ts         | 14 ++++++++------
 tests/integration/agent-auth.test.ts              | 14 ++++++++------
 tests/integration/compliance-reporting.test.ts    | 14 ++++++++------
 tests/integration/disputes.test.ts                | 14 ++++++++------
 tests/integration/infrastructure-services.test.ts | 14 ++++++++------
 tests/integration/pos-features.test.ts            | 14 ++++++++------
 tests/integration/transactions.test.ts            | 14 ++++++++------
 14 files changed, 112 insertions(+), 84 deletions(-)

diff --git a/server/floatTopUp.approve.test.ts b/server/floatTopUp.approve.test.ts
index 28293b9ba..19104ad9c 100644
--- a/server/floatTopUp.approve.test.ts
+++ b/server/floatTopUp.approve.test.ts
@@ -73,12 +73,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/server/fraud.alerts.test.ts b/server/fraud.alerts.test.ts
index 2c289eb09..b3b965044 100644
--- a/server/fraud.alerts.test.ts
+++ b/server/fraud.alerts.test.ts
@@ -84,12 +84,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/server/mdm.test.ts b/server/mdm.test.ts
index 964d7733b..1e01e2949 100644
--- a/server/mdm.test.ts
+++ b/server/mdm.test.ts
@@ -91,12 +91,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/server/pos.test.ts b/server/pos.test.ts
index 2464171c4..39739774e 100644
--- a/server/pos.test.ts
+++ b/server/pos.test.ts
@@ -50,12 +50,14 @@ vi.mock("bcryptjs", () => ({
 
 // ─── Mock jose ────────────────────────────────────────────────────────────────
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/server/security.owasp.test.ts b/server/security.owasp.test.ts
index 4f0240dfc..e21a1f65e 100644
--- a/server/security.owasp.test.ts
+++ b/server/security.owasp.test.ts
@@ -82,12 +82,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockRejectedValue(new Error("Invalid token")),
   createRemoteJWKSet: vi.fn(),
 }));
diff --git a/server/settlement.test.ts b/server/settlement.test.ts
index 57550a535..f7260f87d 100644
--- a/server/settlement.test.ts
+++ b/server/settlement.test.ts
@@ -82,12 +82,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/server/transactions.create.test.ts b/server/transactions.create.test.ts
index 28ae10c3c..e4da2ee94 100644
--- a/server/transactions.create.test.ts
+++ b/server/transactions.create.test.ts
@@ -88,12 +88,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/tests/integration/admin-dashboard.test.ts b/tests/integration/admin-dashboard.test.ts
index c05e2c80c..e1d86f2e9 100644
--- a/tests/integration/admin-dashboard.test.ts
+++ b/tests/integration/admin-dashboard.test.ts
@@ -90,12 +90,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: { sub: "1", role: "admin" },
   }),
diff --git a/tests/integration/agent-auth.test.ts b/tests/integration/agent-auth.test.ts
index 86bd0f37b..d69f0b50d 100644
--- a/tests/integration/agent-auth.test.ts
+++ b/tests/integration/agent-auth.test.ts
@@ -46,12 +46,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/tests/integration/compliance-reporting.test.ts b/tests/integration/compliance-reporting.test.ts
index c74278d75..245fbbd7b 100644
--- a/tests/integration/compliance-reporting.test.ts
+++ b/tests/integration/compliance-reporting.test.ts
@@ -79,12 +79,14 @@ vi.mock("bcryptjs", () => ({
   hash: vi.fn().mockResolvedValue("$2b$10$hash"),
 }));
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi
     .fn()
     .mockResolvedValue({ payload: { sub: "1", role: "admin" } }),
diff --git a/tests/integration/disputes.test.ts b/tests/integration/disputes.test.ts
index bb8c42085..7f311de63 100644
--- a/tests/integration/disputes.test.ts
+++ b/tests/integration/disputes.test.ts
@@ -63,12 +63,14 @@ vi.mock("../../server/_core/platformClient", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",
diff --git a/tests/integration/infrastructure-services.test.ts b/tests/integration/infrastructure-services.test.ts
index fbb69deb4..da02960cc 100644
--- a/tests/integration/infrastructure-services.test.ts
+++ b/tests/integration/infrastructure-services.test.ts
@@ -79,12 +79,14 @@ vi.mock("bcryptjs", () => ({
   hash: vi.fn().mockResolvedValue("$2b$10$hash"),
 }));
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi
     .fn()
     .mockResolvedValue({ payload: { sub: "1", role: "admin" } }),
diff --git a/tests/integration/pos-features.test.ts b/tests/integration/pos-features.test.ts
index 5a0888e6f..742f1bf14 100644
--- a/tests/integration/pos-features.test.ts
+++ b/tests/integration/pos-features.test.ts
@@ -88,12 +88,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: { sub: "1", role: "admin" },
   }),
diff --git a/tests/integration/transactions.test.ts b/tests/integration/transactions.test.ts
index 1298ddf5d..d746012a5 100644
--- a/tests/integration/transactions.test.ts
+++ b/tests/integration/transactions.test.ts
@@ -76,12 +76,14 @@ vi.mock("bcryptjs", () => ({
 }));
 
 vi.mock("jose", () => ({
-  SignJWT: vi.fn().mockImplementation(() => ({
-    setProtectedHeader: vi.fn().mockReturnThis(),
-    setIssuedAt: vi.fn().mockReturnThis(),
-    setExpirationTime: vi.fn().mockReturnThis(),
-    sign: vi.fn().mockResolvedValue("mock.jwt.token"),
-  })),
+  SignJWT: vi.fn().mockImplementation(function () {
+    return {
+      setProtectedHeader: vi.fn().mockReturnThis(),
+      setIssuedAt: vi.fn().mockReturnThis(),
+      setExpirationTime: vi.fn().mockReturnThis(),
+      sign: vi.fn().mockResolvedValue("mock.jwt.token"),
+    };
+  }),
   jwtVerify: vi.fn().mockResolvedValue({
     payload: {
       sub: "1",

From 8c5b9fa2beeb7da859ea0cb4bab7deac4fd3627b Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:36:17 +0000
Subject: [PATCH 2/7] fix(ci): unblock Playwright E2E + resolve CodeQL check
 collision

- Add all production-required env vars + SECURITY_FAIL_OPEN=true to the
  Playwright and k6-smoke jobs so the server starts and the security
  orchestrator fails open when the Rust/Go/Python sidecars are absent in CI.
- Seed agent/admin/supervisor fixtures (scripts/seed-e2e.mjs) before the
  E2E and smoke runs so AGT001/1234 login works.
- AgentLogin: add data-digit hooks to the PIN pad and read the agent code
  from a ref so a fast Continue click uses the latest keyed value (fixes a
  controlled-input race under automation).
- Remove the duplicate CodeQL job from security-scan.yml; codeql.yml is the
  single authoritative analysis (fixes the SARIF category collision).

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 .github/workflows/ci.yml            | 36 +++++++++++++++++
 .github/workflows/security-scan.yml | 24 ++----------
 .gitignore                          |  4 ++
 client/src/pages/AgentLogin.tsx     | 17 ++++++--
 scripts/seed-e2e.mjs                | 61 +++++++++++++++++++++++++++++
 5 files changed, 118 insertions(+), 24 deletions(-)
 create mode 100644 scripts/seed-e2e.mjs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 23464ae34..bc3b79eb3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -270,6 +270,20 @@ jobs:
       KEYCLOAK_CLIENT_ID: pos-shell-app
       PLATFORM_BASE_URL: https://platform.staging.54link.io
       PLATFORM_API_KEY: ci-smoke-platform-key
+      # Required by server env validation in NODE_ENV=production (CI test values).
+      CRON_SECRET: ci-smoke-cron-secret-32-characters-x
+      INTERNAL_API_KEY: ci-smoke-internal-api-key-32-chars-
+      TX_SIGNING_SECRET: ci-smoke-tx-signing-secret-32-chars
+      KEYCLOAK_CLIENT_SECRET: ci-smoke-keycloak-client-secret-32-
+      PLATFORM_SERVICE_TOKEN: ci-smoke-platform-service-token-32
+      MINIO_SECRET_KEY: ci-smoke-minio-secret-key-32-chars-
+      MINIO_ACCESS_KEY: ci-smoke-minio-access-key-32-chars-
+      APISIX_ADMIN_KEY: ci-smoke-apisix-admin-key-32-chars-
+      TERMII_API_KEY: ci-smoke-termii-api-key-32-chars-xx
+      FLUVIO_API_KEY: ci-smoke-fluvio-api-key-32-chars-xx
+      MQTT_PASSWORD: ci-smoke-mqtt-password-32-chars-xxx
+      # Security sidecars are not deployed in CI — fail open.
+      SECURITY_FAIL_OPEN: "true"
     services:
       postgres:
         image: postgres:16-alpine
@@ -306,6 +320,9 @@ jobs:
         run: pnpm db:push
         continue-on-error: true
 
+      - name: Seed smoke test data (agents/admin/supervisor fixtures)
+        run: node scripts/seed-e2e.mjs
+
       - name: Start server in background
         run: |
           node dist/index.js &
@@ -375,6 +392,22 @@ jobs:
       BASE_URL: http://localhost:3000
       TEST_ADMIN_EMAIL: admin@54link.ng
       TEST_ADMIN_PASS: TestAdmin123!
+      # Required by server env validation in NODE_ENV=production (CI test values).
+      CRON_SECRET: ci-e2e-cron-secret-32-characters-xx
+      INTERNAL_API_KEY: ci-e2e-internal-api-key-32-chars-xx
+      TX_SIGNING_SECRET: ci-e2e-tx-signing-secret-32-chars-x
+      KEYCLOAK_CLIENT_SECRET: ci-e2e-keycloak-client-secret-32-ch
+      PLATFORM_API_KEY: ci-e2e-platform-api-key-32-chars-xx
+      PLATFORM_SERVICE_TOKEN: ci-e2e-platform-service-token-32-ch
+      MINIO_SECRET_KEY: ci-e2e-minio-secret-key-32-chars-xx
+      MINIO_ACCESS_KEY: ci-e2e-minio-access-key-32-chars-xx
+      APISIX_ADMIN_KEY: ci-e2e-apisix-admin-key-32-chars-xx
+      TERMII_API_KEY: ci-e2e-termii-api-key-32-chars-xxxx
+      FLUVIO_API_KEY: ci-e2e-fluvio-api-key-32-chars-xxxx
+      MQTT_PASSWORD: ci-e2e-mqtt-password-32-chars-xxxxx
+      # Security sidecars (Rust DDoS / Go PBAC / Python Fraud ML) are not
+      # deployed in CI — fail open so requests are not blocked by their absence.
+      SECURITY_FAIL_OPEN: "true"
     services:
       postgres:
         image: postgres:16-alpine
@@ -414,6 +447,9 @@ jobs:
         run: pnpm db:push
         continue-on-error: true
 
+      - name: Seed E2E test data (agents/admin/supervisor fixtures)
+        run: node scripts/seed-e2e.mjs
+
       - name: Start server in background
         run: |
           node dist/index.js &
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index bdc4a1052..96c5355a9 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -59,26 +59,10 @@ jobs:
         with:
           sarif_file: trivy-results.sarif
 
-  codeql:
-    name: CodeQL Analysis
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      matrix:
-        language: [javascript-typescript]
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+  # CodeQL analysis is owned by the dedicated codeql.yml workflow (JS/TS, Go,
+  # Python). A duplicate job here uploaded a second SARIF for the same
+  # javascript-typescript category, causing a category collision that failed
+  # the "CodeQL Analysis" check. Removed to keep a single authoritative run.
 
   secret-scan:
     name: Secret Detection
diff --git a/.gitignore b/.gitignore
index e1dcbe709..45b05a229 100644
--- a/.gitignore
+++ b/.gitignore
@@ -146,3 +146,7 @@ services/python/ml-pipeline/models/weights/*.json
 services/python/ml-pipeline/models/lakehouse/
 services/python/ml-pipeline/models/registry/
 /data/
+
+# Playwright E2E artifacts
+test-results/
+playwright-report/
diff --git a/client/src/pages/AgentLogin.tsx b/client/src/pages/AgentLogin.tsx
index 3b1265962..f84860a95 100644
--- a/client/src/pages/AgentLogin.tsx
+++ b/client/src/pages/AgentLogin.tsx
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useRef } from "react";
 import { trpc } from "../lib/trpc";
 import { usePosStore } from "../store/posStore";
 import { toast } from "sonner";
@@ -17,6 +17,7 @@ type Screen = "code" | "pin" | "forgot_phone" | "forgot_newpin";
 
 export default function AgentLogin() {
   const [agentCode, setAgentCode] = useState("");
+  const agentCodeRef = useRef("");
   const [pin, setPin] = useState("");
   const [step, setStep] = useState<Screen>("code");
   const [loading, setLoading] = useState(false);
@@ -45,7 +46,10 @@ export default function AgentLogin() {
   });
 
   const handleCodeSubmit = () => {
-    if (agentCode.trim().length < 3) {
+    // Read from the ref so the latest keyed value is used even if the React
+    // state update from the input's onChange has not committed yet.
+    const code = (agentCodeRef.current || agentCode).trim();
+    if (code.length < 3) {
       toast.error("Enter a valid agent code");
       return;
     }
@@ -63,7 +67,7 @@ export default function AgentLogin() {
     if (newPin.length === 4) {
       setLoading(true);
       loginMutation.mutate({
-        agentCode: agentCode.trim().toUpperCase(),
+        agentCode: (agentCodeRef.current || agentCode).trim().toUpperCase(),
         pin: newPin,
       });
     }
@@ -200,7 +204,11 @@ export default function AgentLogin() {
           <input
             type="text"
             value={agentCode}
-            onChange={e => setAgentCode(e.target.value.toUpperCase())}
+            onChange={e => {
+              const v = e.target.value.toUpperCase();
+              agentCodeRef.current = v;
+              setAgentCode(v);
+            }}
             onKeyDown={e => e.key === "Enter" && handleCodeSubmit()}
             placeholder="e.g. AGT001"
             className="w-full rounded-2xl px-4 py-4 text-white text-lg font-bold outline-none mb-4"
@@ -316,6 +324,7 @@ export default function AgentLogin() {
             {PAD_KEYS.map((key, idx) => (
               <button
                 key={idx}
+                data-digit={key && key !== "DEL" ? key : undefined}
                 onClick={() => key && handlePinKey(key)}
                 disabled={loading || !key}
                 className="h-16 rounded-2xl font-bold text-xl transition-all active:scale-90 disabled:opacity-0"
diff --git a/scripts/seed-e2e.mjs b/scripts/seed-e2e.mjs
new file mode 100644
index 000000000..19b2ff672
--- /dev/null
+++ b/scripts/seed-e2e.mjs
@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * seed-e2e.mjs — Minimal, schema-correct seed for Playwright E2E tests.
+ *
+ * Inserts the agent/admin/supervisor fixtures the E2E specs log in with
+ * (AGT001 / PIN 1234, ADMIN1 / PIN 0000, SUP001 / PIN 9999). Uses the current
+ * camelCase column names and bcrypt-hashed PINs so the tRPC agent.login flow
+ * accepts them.
+ *
+ * Idempotent: re-running upserts by agentCode.
+ */
+import pg from "pg";
+import bcrypt from "bcryptjs";
+
+const { Pool } = pg;
+
+const AGENTS = [
+  { code: "AGT001", name: "Emeka Obi", phone: "08012345678", pin: "1234", tier: "Gold", role: "agent" },
+  { code: "AGT002", name: "Fatima Yusuf", phone: "08023456789", pin: "2345", tier: "Silver", role: "agent" },
+  { code: "AGT003", name: "Chidi Nwosu", phone: "08034567890", pin: "3456", tier: "Platinum", role: "agent" },
+  { code: "ADMIN1", name: "Admin User", phone: "08099999999", pin: "0000", tier: "Platinum", role: "admin" },
+  { code: "SUP001", name: "Supervisor Ade", phone: "08098765432", pin: "9999", tier: "Gold", role: "supervisor" },
+];
+
+async function main() {
+  const connectionString =
+    process.env.DATABASE_URL || process.env.POSTGRES_URL;
+  if (!connectionString) {
+    console.error("[seed-e2e] DATABASE_URL / POSTGRES_URL not set");
+    process.exit(1);
+  }
+  const pool = new Pool({ connectionString });
+
+  for (const a of AGENTS) {
+    const pinHash = await bcrypt.hash(a.pin, 10);
+    await pool.query(
+      `INSERT INTO agents ("agentCode", name, phone, "pinHash", tier, role, "isActive", "hierarchyRole")
+       VALUES ($1, $2, $3, $4, $5::agent_tier, $6, true, $6)
+       ON CONFLICT ("agentCode") DO UPDATE
+         SET name = EXCLUDED.name,
+             phone = EXCLUDED.phone,
+             "pinHash" = EXCLUDED."pinHash",
+             tier = EXCLUDED.tier,
+             role = EXCLUDED.role,
+             "isActive" = true`,
+      [a.code, a.name, a.phone, pinHash, a.tier, a.role]
+    );
+    console.log(`[seed-e2e] upserted ${a.code} (${a.role})`);
+  }
+
+  const { rows } = await pool.query(
+    'SELECT count(*)::int AS n FROM agents'
+  );
+  console.log(`[seed-e2e] agents in DB: ${rows[0].n}`);
+  await pool.end();
+}
+
+main().catch((err) => {
+  console.error("[seed-e2e] failed:", err);
+  process.exit(1);
+});

From 94db729bd899b4e00701fe56fcd131d20ac61a48 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:42:13 +0000
Subject: [PATCH 3/7] chore: trigger CI on PR #77 (base repointed to main)

Co-Authored-By: Patrick Munis <pmunis@gmail.com>

From 94e3ebfaab8a0b8a1537c16cc6085697f4a12ccb Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 17:15:40 +0000
Subject: [PATCH 4/7] fix(ci): stabilize CodeQL Python (disk) + E2E post-login
 strict-mode selector

- CodeQL Python: drop the mass 'pip install every requirements.txt' loop that
  exhausted the runner disk (~80MB left) and crashed analyze; CodeQL uses
  buildless Python extraction and does not need installed deps.
- E2E: the post-login dashboard gate expect(page.locator('text=Cash In'))
  matched two legitimate elements (quick-action chip + dashboard tile),
  a strict-mode violation. Add .first() to match the click on the next line.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 .github/workflows/codeql.yml             | 12 +++++-------
 e2e/01-agent-login-cashin.spec.ts        |  4 ++--
 e2e/02-admin-fraud-alert.spec.ts         |  2 +-
 e2e/03-float-topup-approval.spec.ts      |  2 +-
 e2e/04-sim-orchestrator-coverage.spec.ts |  2 +-
 e2e/05-offline-queue-sync.spec.ts        |  4 ++--
 6 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4113b0d06..85c296a5c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -170,13 +170,11 @@ jobs:
         with:
           python-version: "3.12"
 
-      - name: Install Python dependencies
-        run: |
-          pip install --upgrade pip
-          for req in services/python/*/requirements.txt; do
-            pip install -r "$req" 2>/dev/null || true
-          done
-        continue-on-error: true
+      # NOTE: CodeQL uses buildless extraction for Python, so installing
+      # dependencies is not required for analysis. Installing every service's
+      # requirements.txt into one environment exhausted the runner disk
+      # (~80 MB left) and intermittently crashed the analyze step, so it is
+      # omitted intentionally.
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v3
diff --git a/e2e/01-agent-login-cashin.spec.ts b/e2e/01-agent-login-cashin.spec.ts
index 807c77075..08253f358 100644
--- a/e2e/01-agent-login-cashin.spec.ts
+++ b/e2e/01-agent-login-cashin.spec.ts
@@ -26,11 +26,11 @@ test.describe("Agent Login and Cash-In Flow", () => {
     }
 
     // ── 4. Wait for POS Shell dashboard ─────────────────────────────────────
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
 
     // ── 5. Navigate to Cash In ───────────────────────────────────────────────
     await page.locator("text=Cash In").first().click();
-    await expect(page.locator("text=Cash In")).toBeVisible();
+    await expect(page.locator("text=Cash In").first()).toBeVisible();
 
     // ── 6. Enter amount ──────────────────────────────────────────────────────
     const amountInput = page
diff --git a/e2e/02-admin-fraud-alert.spec.ts b/e2e/02-admin-fraud-alert.spec.ts
index 346a8af55..4c6507f9b 100644
--- a/e2e/02-admin-fraud-alert.spec.ts
+++ b/e2e/02-admin-fraud-alert.spec.ts
@@ -17,7 +17,7 @@ test.describe("Admin Panel Fraud Alert Flow", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
   });
 
   test("should navigate to admin panel and update fraud alert status", async ({
diff --git a/e2e/03-float-topup-approval.spec.ts b/e2e/03-float-topup-approval.spec.ts
index 6f97f36eb..23eee3bed 100644
--- a/e2e/03-float-topup-approval.spec.ts
+++ b/e2e/03-float-topup-approval.spec.ts
@@ -15,7 +15,7 @@ test.describe("Float Top-Up Approval Workflow", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
 
     // Navigate to admin panel
     await page.goto("/admin");
diff --git a/e2e/04-sim-orchestrator-coverage.spec.ts b/e2e/04-sim-orchestrator-coverage.spec.ts
index 8272fb3c5..c93e1f8b7 100644
--- a/e2e/04-sim-orchestrator-coverage.spec.ts
+++ b/e2e/04-sim-orchestrator-coverage.spec.ts
@@ -15,7 +15,7 @@ test.describe("SIM Orchestrator Coverage Map", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
 
     // Navigate to admin panel
     await page.goto("/admin");
diff --git a/e2e/05-offline-queue-sync.spec.ts b/e2e/05-offline-queue-sync.spec.ts
index 6d94dece3..9ecc3fed3 100644
--- a/e2e/05-offline-queue-sync.spec.ts
+++ b/e2e/05-offline-queue-sync.spec.ts
@@ -19,7 +19,7 @@ test.describe("Offline Queue and Auto-Sync", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
 
     // ── Simulate offline ─────────────────────────────────────────────────────
     await context.setOffline(true);
@@ -44,6 +44,6 @@ test.describe("Offline Queue and Auto-Sync", () => {
     // This is a soft assertion — sync may happen in background
     const isVisible = await onlineIndicator.isVisible().catch(() => false);
     // Even if toast is not visible, the page should still be functional
-    await expect(page.locator("text=Cash In")).toBeVisible({ timeout: 5_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 5_000 });
   });
 });

From 004748551a81b049bfd78e6411cdd3618db773b8 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 17:37:43 +0000
Subject: [PATCH 5/7] style: prettier-format e2e specs after strict-mode
 selector fix

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 e2e/01-agent-login-cashin.spec.ts        | 4 +++-
 e2e/02-admin-fraud-alert.spec.ts         | 4 +++-
 e2e/03-float-topup-approval.spec.ts      | 4 +++-
 e2e/04-sim-orchestrator-coverage.spec.ts | 4 +++-
 e2e/05-offline-queue-sync.spec.ts        | 8 ++++++--
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/e2e/01-agent-login-cashin.spec.ts b/e2e/01-agent-login-cashin.spec.ts
index 08253f358..f2f2d047a 100644
--- a/e2e/01-agent-login-cashin.spec.ts
+++ b/e2e/01-agent-login-cashin.spec.ts
@@ -26,7 +26,9 @@ test.describe("Agent Login and Cash-In Flow", () => {
     }
 
     // ── 4. Wait for POS Shell dashboard ─────────────────────────────────────
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 15_000,
+    });
 
     // ── 5. Navigate to Cash In ───────────────────────────────────────────────
     await page.locator("text=Cash In").first().click();
diff --git a/e2e/02-admin-fraud-alert.spec.ts b/e2e/02-admin-fraud-alert.spec.ts
index 4c6507f9b..634ee531a 100644
--- a/e2e/02-admin-fraud-alert.spec.ts
+++ b/e2e/02-admin-fraud-alert.spec.ts
@@ -17,7 +17,9 @@ test.describe("Admin Panel Fraud Alert Flow", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 15_000,
+    });
   });
 
   test("should navigate to admin panel and update fraud alert status", async ({
diff --git a/e2e/03-float-topup-approval.spec.ts b/e2e/03-float-topup-approval.spec.ts
index 23eee3bed..b9292748a 100644
--- a/e2e/03-float-topup-approval.spec.ts
+++ b/e2e/03-float-topup-approval.spec.ts
@@ -15,7 +15,9 @@ test.describe("Float Top-Up Approval Workflow", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 15_000,
+    });
 
     // Navigate to admin panel
     await page.goto("/admin");
diff --git a/e2e/04-sim-orchestrator-coverage.spec.ts b/e2e/04-sim-orchestrator-coverage.spec.ts
index c93e1f8b7..ca640107a 100644
--- a/e2e/04-sim-orchestrator-coverage.spec.ts
+++ b/e2e/04-sim-orchestrator-coverage.spec.ts
@@ -15,7 +15,9 @@ test.describe("SIM Orchestrator Coverage Map", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 15_000,
+    });
 
     // Navigate to admin panel
     await page.goto("/admin");
diff --git a/e2e/05-offline-queue-sync.spec.ts b/e2e/05-offline-queue-sync.spec.ts
index 9ecc3fed3..1e0abc17a 100644
--- a/e2e/05-offline-queue-sync.spec.ts
+++ b/e2e/05-offline-queue-sync.spec.ts
@@ -19,7 +19,9 @@ test.describe("Offline Queue and Auto-Sync", () => {
     for (const digit of ["1", "2", "3", "4"]) {
       await page.locator(`button[data-digit="${digit}"]`).first().click();
     }
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 15_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 15_000,
+    });
 
     // ── Simulate offline ─────────────────────────────────────────────────────
     await context.setOffline(true);
@@ -44,6 +46,8 @@ test.describe("Offline Queue and Auto-Sync", () => {
     // This is a soft assertion — sync may happen in background
     const isVisible = await onlineIndicator.isVisible().catch(() => false);
     // Even if toast is not visible, the page should still be functional
-    await expect(page.locator("text=Cash In").first()).toBeVisible({ timeout: 5_000 });
+    await expect(page.locator("text=Cash In").first()).toBeVisible({
+      timeout: 5_000,
+    });
   });
 });

From 2409c1dfd867155a966936bc9a691fdf86adcb75 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:12:26 +0000
Subject: [PATCH 6/7] fix(ci): seed deterministic E2E login fixtures in active
 Playwright workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The active E2E check is e2e-playwright.yml (NODE_ENV=test), which seeded only
via seed-comprehensive.mjs — randomized AGT#### agents with no PIN hash. The
specs log in as AGT001/1234, ADMIN1/0000, SUP001/9999, so login never reached
the dashboard and every post-login assertion failed. Add scripts/seed-e2e.mjs
(idempotent upsert of the fixtures) after the comprehensive seed.

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 .github/workflows/e2e-playwright.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/e2e-playwright.yml b/.github/workflows/e2e-playwright.yml
index 31f49d186..8bc316810 100644
--- a/.github/workflows/e2e-playwright.yml
+++ b/.github/workflows/e2e-playwright.yml
@@ -97,6 +97,16 @@ jobs:
         env:
           POSTGRES_URL: ${{ env.POSTGRES_URL }}
 
+      # The specs authenticate as fixed fixtures (AGT001/1234, ADMIN1/0000,
+      # SUP001/9999). seed-comprehensive only generates randomized AGT#### rows
+      # with no PIN hash, so add the deterministic login fixtures the E2E flow
+      # logs in with. Idempotent upsert by agentCode.
+      - name: Seed E2E login fixtures (AGT001/ADMIN1/SUP001)
+        run: node scripts/seed-e2e.mjs
+        env:
+          POSTGRES_URL: ${{ env.POSTGRES_URL }}
+          DATABASE_URL: ${{ env.DATABASE_URL }}
+
       - name: Build application
         run: pnpm build
 

From 701ae755ad8548161d5f56ad125e77abe9aa5f02 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 18:57:45 +0000
Subject: [PATCH 7/7] fix(ci): disable per-IP rate limiters for E2E; fix
 drifted login selectors

The in-process connection throttle (50 req/10s) and per-IP rate limiters
return 503/429 when Playwright drives the whole app from a single IP, so
the app shell and API become unreachable mid-suite. Gate them behind an
explicit, default-off DISABLE_RATE_LIMITS flag and set it for the E2E jobs.

Also fix two genuine test-selector bugs in spec 08 (strict-mode match on
the SSO text, and a malformed mixed CSS+text selector for the PIN pad).

Co-Authored-By: Patrick Munis <pmunis@gmail.com>
---
 .github/workflows/ci.yml               | 22 ++++++++++--------
 .github/workflows/e2e-playwright.yml   |  4 ++++
 e2e/08-agent-login-cashin-full.spec.ts |  8 +++----
 server/_core/index.ts                  | 14 ++++++++++--
 server/middleware/securityHardening.ts | 31 ++++++++++++++++++--------
 5 files changed, 55 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc3b79eb3..2c546367e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,13 +23,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          fetch-depth: 0  # Full history needed for Gitleaks commit scanning
+          fetch-depth: 0 # Full history needed for Gitleaks commit scanning
 
       - name: Run Gitleaks secret scan
         uses: gitleaks/gitleaks-action@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # Optional: for org-level scanning
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Optional: for org-level scanning
         with:
           args: >
             --redact
@@ -408,6 +408,10 @@ jobs:
       # Security sidecars (Rust DDoS / Go PBAC / Python Fraud ML) are not
       # deployed in CI — fail open so requests are not blocked by their absence.
       SECURITY_FAIL_OPEN: "true"
+      # The app drives every request from a single IP under Playwright, which
+      # trips the in-process connection throttle and per-IP rate limiters
+      # (503/429). Disable them for the E2E run; production keeps them on.
+      DISABLE_RATE_LIMITS: "true"
     services:
       postgres:
         image: postgres:16-alpine
@@ -869,8 +873,8 @@ jobs:
       - name: Run OWASP ZAP Baseline Scan
         uses: zaproxy/action-baseline@v0.15.0
         with:
-          target: 'http://localhost:3000'
-          rules_file_name: '.zap/rules.tsv'
+          target: "http://localhost:3000"
+          rules_file_name: ".zap/rules.tsv"
           cmd_options: >
             -a
             -j
@@ -878,17 +882,17 @@ jobs:
             -I
           fail_action: true
           allow_issue_writing: true
-          artifact_name: 'zap-baseline-report'
+          artifact_name: "zap-baseline-report"
         continue-on-error: false
 
       - name: Run OWASP ZAP API Scan
         uses: zaproxy/action-api-scan@v0.10.0
         with:
-          target: 'http://localhost:3000/api/trpc'
+          target: "http://localhost:3000/api/trpc"
           format: openapi
-          rules_file_name: '.zap/rules.tsv'
-          cmd_options: '-a -j -l WARN'
-          artifact_name: 'zap-api-report'
+          rules_file_name: ".zap/rules.tsv"
+          cmd_options: "-a -j -l WARN"
+          artifact_name: "zap-api-report"
         continue-on-error: true
 
       - name: Upload ZAP reports
diff --git a/.github/workflows/e2e-playwright.yml b/.github/workflows/e2e-playwright.yml
index 8bc316810..9a694232d 100644
--- a/.github/workflows/e2e-playwright.yml
+++ b/.github/workflows/e2e-playwright.yml
@@ -67,6 +67,10 @@ jobs:
       VITE_FRONTEND_FORGE_API_KEY: e2e-frontend-forge-key
       VITE_FRONTEND_FORGE_API_URL: http://localhost:3001/api
       NODE_ENV: test
+      # The app drives every request from a single IP under Playwright, which
+      # trips the in-process connection throttle and per-IP rate limiters
+      # (503/429). Disable them for the E2E run; production keeps them on.
+      DISABLE_RATE_LIMITS: "true"
 
     steps:
       - name: Checkout repository
diff --git a/e2e/08-agent-login-cashin-full.spec.ts b/e2e/08-agent-login-cashin-full.spec.ts
index 5431affec..16689a8fc 100644
--- a/e2e/08-agent-login-cashin-full.spec.ts
+++ b/e2e/08-agent-login-cashin-full.spec.ts
@@ -30,7 +30,9 @@ test.describe("Agent Login & Cash-In — Full Flow", () => {
     ).toBeVisible();
 
     // Verify SSO link exists
-    await expect(page.locator("text=/supervisor|admin.*sso/i")).toBeVisible();
+    await expect(
+      page.locator("text=/supervisor|admin.*sso/i").first()
+    ).toBeVisible();
   });
 
   test("should reject empty agent code", async ({ page }) => {
@@ -50,9 +52,7 @@ test.describe("Agent Login & Cash-In — Full Flow", () => {
 
     // Should show PIN pad or PIN entry screen
     await expect(
-      page
-        .locator('[data-digit], input[type="password"], text=/enter.*pin/i')
-        .first()
+      page.locator('[data-digit], input[type="password"]').first()
     ).toBeVisible({ timeout: 10_000 });
   });
 
diff --git a/server/_core/index.ts b/server/_core/index.ts
index eb62c3d07..1e6152b7d 100644
--- a/server/_core/index.ts
+++ b/server/_core/index.ts
@@ -139,6 +139,11 @@ async function startServer() {
 
   // ── Security headers ────────────────────────────────────────────────────────
   const isDev = process.env.NODE_ENV === "development";
+  // In-process rate limiters key on client IP. End-to-end test runs drive the
+  // whole app from a single IP, so the auth/global limiters trip and start
+  // returning 429 mid-suite. Allow an explicit opt-out for CI/E2E; production
+  // keeps every limiter on by default.
+  const disableRateLimits = process.env.DISABLE_RATE_LIMITS === "true";
   const keycloakOrigin = process.env.KEYCLOAK_URL
     ? new URL(process.env.KEYCLOAK_URL).origin
     : null;
@@ -296,7 +301,7 @@ async function startServer() {
       );
     },
   });
-  app.use(globalLimiter);
+  if (!disableRateLimits) app.use(globalLimiter);
 
   // Stricter limiter for auth endpoints: 50 requests per 15 minutes per IP
   const authLimiter = rateLimit({
@@ -309,7 +314,12 @@ async function startServer() {
       error: "Too many authentication attempts, please try again later.",
     },
   });
-  app.use("/api/auth", authLimiter);
+  if (!disableRateLimits) app.use("/api/auth", authLimiter);
+  if (disableRateLimits) {
+    console.log(
+      "[Security] In-process rate limiters disabled (DISABLE_RATE_LIMITS=true)"
+    );
+  }
 
   // ── Stripe Webhook (must be BEFORE express.json() for signature verification) ──
   app.post(
diff --git a/server/middleware/securityHardening.ts b/server/middleware/securityHardening.ts
index 907475683..203ba2240 100644
--- a/server/middleware/securityHardening.ts
+++ b/server/middleware/securityHardening.ts
@@ -540,7 +540,14 @@ export function applySecurityMiddleware(app: any) {
     );
     return;
   }
-  app.use(ddosThrottling);
+  // The connection throttle and the per-IP rate limiters key on client IP and
+  // count every request (a single SPA page load fires 400+ asset/module
+  // requests). End-to-end test runs drive the whole app from one IP, so these
+  // trip and return 503/429 mid-suite. Allow an explicit opt-out for CI/E2E;
+  // production keeps them on by default.
+  const disableRateLimits = process.env.DISABLE_RATE_LIMITS === "true";
+
+  if (!disableRateLimits) app.use(ddosThrottling);
   app.use(securityHeaders);
   app.use(xssProtection);
   app.use(sqlInjectionProtection);
@@ -548,16 +555,22 @@ export function applySecurityMiddleware(app: any) {
   app.use(bruteForceProtection);
   app.use(requestSizeLimit());
 
-  // Rate limit auth endpoints
-  app.use("/api/oauth", authRateLimiter);
-  app.use("/api/auth", authRateLimiter);
+  if (!disableRateLimits) {
+    // Rate limit auth endpoints
+    app.use("/api/oauth", authRateLimiter);
+    app.use("/api/auth", authRateLimiter);
 
-  // Rate limit API endpoints
-  app.use("/api/trpc", apiRateLimiter);
+    // Rate limit API endpoints
+    app.use("/api/trpc", apiRateLimiter);
 
-  // Rate limit webhook endpoints
-  app.use("/api/stripe/webhook", webhookRateLimiter);
-  app.use("/api/webhooks", webhookRateLimiter);
+    // Rate limit webhook endpoints
+    app.use("/api/stripe/webhook", webhookRateLimiter);
+    app.use("/api/webhooks", webhookRateLimiter);
+  } else {
+    console.log(
+      "[Security] Connection throttle + rate limiters disabled (DISABLE_RATE_LIMITS=true)"
+    );
+  }
 
   console.log(
     "[Security] All security middleware applied (Sprint 91: +brute-force, +fingerprinting, +DDoS throttling)"