[emmzy4tech]

Closes #1574
Closes #1573
Closes #1571
Closes #1570

BE-002 — AWS KMS & Vault HSM custodial relayer signer (#1574)

• backend/src/services/kmsSignerService.ts: Ed25519 signing offloaded to AWS KMS (ECC_NIST_EDWARDS25519, ED25519_SHA_512 RAW) or HashiCorp Vault Transit. Only the 32-byte transaction hash leaves the process; the private key never enters application memory. Every signature is verified against the custodial public key before use.
• Every signing attempt (success or failure) emits a hash-chained audit record with the IAM/CloudTrail request id (KMS) or Vault request_id. Only SHA-256 digests are logged, never the payload or signature bytes.
• The software signer works only with NODE_ENV=development|test. In production with no HSM configured, startup fails.
• backend/src/config/vault.ts: dependency-free Vault client (token / Kubernetes / AppRole auth, token caching, timeouts) plus a least-privilege policy template.
• backend/src/services/stellarService.ts: relayer service that fee-bumps, signs via the HSM, and submits envelopes. It refuses unsigned inner transactions and fees above the cap.
• New env vars documented in backend/.env.example.

FE-050 — Bundle splitting & CWV (#1573)

• Monaco, ReactFlow/html2canvas/jsPDF, the TWAP chart and the snippet editor now load through next/dynamic.
• Command palette, render-warning modal and offline notification are deferred out of the root layout.
• Client-only splitChunks with async-only cache groups for the heavy editor, canvas, chart and EVM/WASM libraries.
• next/font replaces the render-blocking Google Fonts stylesheet.
• Course links prefetch on hover/focus/touch instead of in the viewport.
• More libraries added to optimizePackageImports.

FE-048 — Virtualized audit log grid (#1571)

• /admin/audit-logs uses VirtualizedLogTable (react-window List): only the rows on screen are rendered. Columns resize and shift-click adds secondary sort columns.
• Debounced search over a precomputed index takes ~6 ms on 50k rows.
• LogDetailModal: JSON payload inspector, rendered without dangerouslySetInnerHTML.
• CSV export of the filtered and sorted view, protected against spreadsheet formula injection.
• There is no backend audit-log list endpoint yet, so the hook falls back to a clearly labelled demo dataset.

FE-047 — Micro-frontend sandbox (#1570)

• MicroFrontendContainer: iframe with sandbox="allow-scripts allow-same-origin", a restrictive Permissions Policy and no-referrer. Widgets on the host origin are rejected, because with allow-same-origin they could escape the sandbox.
• rpcBridge.ts: typed postMessage RPC. Each message is checked for source window, exact origin, size, envelope shape, per-mount session token, rate limit, method allowlist, granted permission and valid params. Responses are posted only to the manifest origin, never *.
• No method exposes host DOM, cookies, storage or credentials.
• Signing requests need explicit student approval in host UI.

Testing

• Added backend/tests/kmsSignerService.test.ts, frontend/src/services/sandbox/__tests__/rpcBridge.test.ts and frontend/src/hooks/__tests__/useAuditLogs.test.ts.
• node_modules were not installed locally, so the jest/vitest suites, tsc and next build were not run. Instead:
  • All 23 changed TS/TSX files pass a TypeScript syntax check.
  • The same scenarios were run as Node checks against the transpiled source, with only the missing externals stubbed: 13/13 passed.
• Still to do: run npm test in both packages, next build + npm run check:bundle, and Lighthouse, to confirm the 180 kB / LCP / INP targets.

🤖 Generated with Claude Code

[vercel]

@emmzy4tech is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[ayomideadeniran]

Thank you for your contribution! This PR is currently under review. If I find any incorrect implementation or issues, I will leave comments on what needs to be adjusted next.

[drips-wave]

@emmzy4tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits