smoke: SDLC dispatcher end-to-end test (mergeClasses + nav spec wording)

[DmytroZaichenkoDev]

Smoke test for the SDLC dispatcher.

What's in here

Two focused changes packaged together so both AI agents have something to review:

• libs/chat-shared/src/utils/merge-class.ts — refactor function mergeClasses to arrow form per CLAUDE.md utils convention, expand the JSDoc to describe the classnames → tailwind-merge pipeline. Same exported name + signature; no consumer changes.
• openspec/specs/navigation-routing/spec.md — align the wording of the "accessible labels and tooltip" requirement with the sibling requirement above it (both now use "Each `DialGhostIconButton` in the top section of ``"). Scenarios unchanged.

Why this PR exists

Base is sdlc-test-base — a temporary sandbox base for smoke-testing the new SDLC dispatcher (.github/workflows/dispatch-pr.yml) end-to-end before the platform lands on development-1.0. Opening this PR should fire the dispatcher and run two agents in round 1:

• code-review (wraps /code-review-and-quality skill)
• spec-validation (wraps /spec-validation skill — CLI floor + drift check)

Each should post a sticky comment + upload a stage-output-<name> artifact.

Do not merge

This PR is for validating the dispatcher flow only. After agent runs are observed:

• Close without merge
• Delete sdlc-smoke-test and sdlc-test-base branches on origin
• Open the real platform PR from chore/security-review-labeled-trigger → development-1.0

[ai-dial-actions]

Hey there and thank you for opening this pull request! 👋🏼

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Details:

Unknown release type "smoke" found in pull request title "smoke: SDLC dispatcher end-to-end test (mergeClasses + nav spec wording)".

Available types:
 - feat
 - fix
 - docs
 - test
 - ci
 - chore

[github-actions]

❌ security-review: 5 intentionally planted security vulnerabilities detected in sdlc-smoke-test-fixtures/vuln-sample.ts (fixture file — DO NOT MERGE per file header): hard-coded secret, SQL injection, code injection (eval), reflected XSS, missing authz + secret leak to logs.

Severity	Location	Message
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:11 (OWASP A02 – Cryptographic Failures / CWE-798 Use of Hard-coded Credentials)	Hard-coded API secret: API_KEY = 'sk-live-9f8e7d6c5b4a3f2e1d0c9b8a7654321'. Committing a live credential exposes it to anyone with repo access and in git history permanently.
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:16 (OWASP A03 – Injection / CWE-89 SQL Injection)	SQL injection: untrusted user input (req.query.id) is concatenated directly into a raw SQL string. An attacker can manipulate the query to dump, modify, or delete arbitrary data.
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:23 (OWASP A03 – Injection / CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code)	Code injection via eval() on attacker-controlled input (req.query.expr). An attacker can execute arbitrary JavaScript in the server process, achieving full remote code execution.
high	sdlc-smoke-test-fixtures/vuln-sample.ts:30 (OWASP A03 – Injection / CWE-79 Cross-site Scripting)	Reflected XSS: req.query.name is interpolated unescaped into an HTML response. An attacker can inject script tags or event handlers that execute in the victim's browser.
high	sdlc-smoke-test-fixtures/vuln-sample.ts:35 (OWASP A01 – Broken Access Control / OWASP A09 – Security Logging and Monitoring Failures / CWE-532 Insertion of Sensitive Information into Log File)	Secret leaked to application logs and missing authorization check: adminAction logs the hard-coded API_KEY via console.log and returns a success response with no authentication or authorization guard. Any caller can invoke privileged functionality, and the secret ends up in log aggregation systems.

Run details

[github-actions]

❌ code-review: Fixture file sdlc-smoke-test-fixtures/vuln-sample.ts contains 5 intentionally planted security defects (hard-coded secret, SQL injection, code injection via eval, reflected XSS, missing authz + secret in log). File header explicitly states DO NOT MERGE.

Severity	Location	Message
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:11	Hard-coded secret: API_KEY is a live-looking API key committed directly to source. Must never appear in the repository, even in test fixtures.
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:16	SQL injection: req.query.id (untrusted user input) is concatenated directly into the SQL string passed to db.query(). An attacker can manipulate the query arbitrarily.
critical	sdlc-smoke-test-fixtures/vuln-sample.ts:23	Code injection: eval() is called with req.query.expr, an attacker-controlled string. This allows arbitrary server-side JavaScript execution.
high	sdlc-smoke-test-fixtures/vuln-sample.ts:30	Reflected XSS: req.query.name is interpolated into an HTML response without escaping. An attacker can inject arbitrary HTML/JS into the page.
high	sdlc-smoke-test-fixtures/vuln-sample.ts:35	Secret leaked to logs + missing authorization: API_KEY is written to console.log on every invocation, and adminAction() performs no authentication or authorization check before executing privileged behavior.
info	sdlc-smoke-test-fixtures/vuln-sample.ts:1	FYI: This file is a deliberate SDLC smoke-test fixture. All five findings above are intentionally planted. The file header says 'DO NOT MERGE' and instructs deletion after validation. No production code is affected.

Run details