---
name: step-01-inventory
description: Locate and inventory all 5 mandatory routing elements in the codebase
next_step: steps/step-02-conformity.md
---

# Step 1: Inventory

## MANDATORY EXECUTION RULES:
- Read EVERY file identified — do NOT guess from file names alone
- Record exact file paths AND line numbers for each finding
- If an element is ABSENT, search for alternative implementations before declaring missing
- Use parallel tool calls where possible for speed

## YOUR TASK:
For each of the 5 mandatory elements, locate the implementation, read it, and record key characteristics.

---

## EXECUTION SEQUENCE:

### 1. componentRegistry

**Search strategy:**
1. Glob: `**/componentRegistry*`, `**/pageRegistry*`, `**/PageRegistry*` in {web_root}
2. If not found: Grep for `React.lazy` or `lazy(` across all `.ts`/`.tsx` files
3. If not found: Grep for `import.*Page` to find eager imports pattern

**Record:**
- File path and total lines
- Registration mechanism (PageRegistry.register, object literal, Map, etc.)
- Import style: lazy (`React.lazy(() => import(...))`) vs eager (`import X from`)
- Number of registered components
- Key naming convention (dot-separated, slash-separated, flat)
- Where it's imported/loaded (main.tsx, App.tsx, etc.)

### 2. ProtectedRoute

**Search strategy:**
1. Glob: `**/ProtectedRoute*`, `**/RouteGuard*`, `**/AuthRoute*` in {web_root}
2. If not found: Grep for `permissions.*check\|requiredPermission\|canAccess` in routing files
3. If not found: Grep for `Navigate.*login\|redirect.*unauthorized` in route wrappers

**Record:**
- File path and total lines
- How permissions are received (props, context, hook)
- Where permission data comes from (API via hook, static constants, hardcoded)
- What happens on unauthorized (redirect, 403 page, null render)
- Whether it contains any hardcoded route or permission lists

### 3. DynamicRouter

**Search strategy:**
1. Glob: `**/DynamicRouter*`, `**/AppRouter*`, `**/RouterConfig*` in {web_root}
2. If not found: Grep for `<Route.*path=` to find where routes are defined
3. Also check: `App.tsx` for inline route definitions

**Record:**
- File path and total lines
- Route generation method (iterates API data, static JSX, hybrid)
- How components are resolved (from registry, inline import, direct reference)
- Whether ProtectedRoute wrapping is applied
- Handling of nested routes / outlets
- Loading state handling (Suspense, loader, etc.)
- Any hardcoded routes within the file (count and list them)

### 4. useRouteConfig

**Search strategy:**
1. Glob: `**/useRouteConfig*`, `**/useRoutes*`, `**/useNavigation*` in {web_root}
2. If not found: Grep for `fetch.*navigation\|fetch.*routes\|fetch.*menu` in hooks
3. If not found: Grep for `/api/navigation` or `/api/routes` in service files

**Record:**
- File path and total lines
- API endpoint called
- Data transformation (flat list, tree, maps)
- Return shape (routes, permissions, loading, error)
- Caching strategy (React Query, SWR, useState, context)
- When it re-fetches (auth change, mount only, interval)

### 5. Navigation API

**Search strategy (backend):**
1. Glob: `**/Navigation*Controller*` in {api_root}
2. Grep for `[HttpGet].*menu\|[HttpGet].*route\|[HttpGet].*navigation` in controllers
3. Also check: service files with Glob `**/NavigationService*` in {infra_root}

**Search strategy (frontend, as consumer):**
1. Grep for `/api/navigation` or `navigation/menu` in {web_root}/services/

**Record:**
- Controller file path, endpoint path, HTTP method
- Service file path (business logic)
- Response DTO structure (what fields are returned)
- Whether response is filtered by user permissions/JWT
- Whether ComponentKey is included in response
- Whether PermissionPath is included in response
- Feature gating support (RequiredFeature field)

---

### 6. Cross-reference with MCP Results

If `{mcp_results}` is available from step-00:

```
For componentRegistry:
  - Compare manual key count with MCP componentRegistry.registeredKeys.length
  - Note any missingKeys reported by MCP
  - Flag if MCP found issues not visible from manual inspection

For Navigation API:
  - Compare seed data routes (from MCP validate_conventions) with manual API analysis
  - Note any backend routes with no frontend counterpart

For API clients:
  - Use MCP apiClients.issues to enrich anti-pattern detection later (step-02)
  - Record hardcoded paths found by MCP
```

### 7. Compile Inventory Table

After all 5 elements are investigated, compile:

```
## Element Inventory

| # | Element | Status | File | Lines | Key Characteristics |
|---|---------|--------|------|-------|-------------------|
| 1 | componentRegistry | FOUND/ABSENT | {path} | {n} | {summary} |
| 2 | ProtectedRoute | FOUND/ABSENT | {path} | {n} | {summary} |
| 3 | DynamicRouter | FOUND/ABSENT | {path} | {n} | {summary} |
| 4 | useRouteConfig | FOUND/ABSENT | {path} | {n} | {summary} |
| 5 | Navigation API | FOUND/ABSENT | {path} | {n} | {summary} |

MCP Cross-reference (if available):
| MCP Check | Issues Found | Aligned with Manual |
|-----------|-------------|-------------------|
| componentRegistry keys | {N missing} | {yes/no + detail} |
| API client paths | {N hardcoded} | {yes/no + detail} |
| Seed data sync | {N missing} | {yes/no + detail} |

-> Proceeding to conformity analysis...
```

---

## SUCCESS METRICS:
- All 5 elements searched with at least 2 search strategies each
- Exact file paths and line numbers recorded
- Key characteristics noted for each found element
- ABSENT elements confirmed after exhaustive search
- Inventory table displayed

## NEXT STEP:
After displaying inventory, proceed directly to `./step-02-conformity.md`
