graph TD
  subgraph ENV["Environment Layer (Dockerfile / .env)"]
    D1[.env.example<br/>5 declared vars]
    D2[SILENT_REQUIRED_ENV: FEISHU_ENCRYPT_KEY<br/>⚠️ Not in .env.example]
  end

  subgraph APP["Application Layer (app/)"]
    A1[Entry Point<br/>app/server.js]
    A2[Static UI<br/>app/public/app.js]
    A3["parseMcpResponse()<br/>app/public/app.js:20"]
    A4["Golden_Scar ⬅ GOLDEN_SCAR<br/>app/server.js:145"]
  end

  subgraph CI["CI/CD Layer (.github/workflows/)"]
    C1[njsscan.yml<br/>on: push, PR, schedule]
  end

  subgraph TEST["Test Layer"]
    T1[node --test]
    T2[app/public/app.test.js<br/>Frontend mocks]
    T3[app/server.test.js<br/>Backend routes]
  end

  D1 -->|configures| APP
  D2 -->|configures| APP
  A1 --> A2
  A2 --> A3
  A1 --> A4
  CI --> C1
  C1 -->|runs| TEST
  APP -->|tested by| T1

  classDef warning fill:#fef3c7,stroke:#d97706,color:#000
  classDef golden fill:#fde68a,stroke:#b45309,color:#000
  classDef phantom fill:#fee2e2,stroke:#dc2626,color:#000
  classDef clean fill:#d1fae5,stroke:#059669,color:#000

  class D2 warning
  class A4 golden

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub
  participant NJS as njsscan.yml
  participant SARIF as GitHub Code Scanning

  Dev->>GH: git push (main branch)
  GH->>NJS: trigger on:push

  rect rgb(220, 252, 231)
      Note over NJS: Phase 1 — Security Validation
      NJS->>NJS: Checkout code
      NJS->>NJS: nodejsscan scan
      NJS->>SARIF: Upload njsscan report
      NJS-->>GH: Status: PASS/FAIL
  end

  Note over NJS: ⚠️ MISSING LINK: No workflow for test execution or deployment.