Auto close stale quests older than 30 days with no pr linked

[ekwe7]

closes #232

Description

This PR implements the automated cleanup pipeline for abandoned and stale items on the quest board via a secure Cron endpoint (GET /api/cron/close-stale-quests). Previously, quests could be initialized or claimed indefinitely without resolution, causing the active dashboard to accumulate unmaintained or stalled listings.

By executing a daily sweeping lifecycle evaluation, the engine isolates stale in-progress items (no activity within 30 days) and shifts them to an abandoned status, while old unassigned requests decay cleanly into an expired status. This preserves workspace state optimization and frees up platform bandwidth.

Changes

⚙️ Automation Cron API Pipeline (pages/api/cron/close-stale-quests.ts)

• Cryptographic Vault Access Guard: Enforced strict authorization headers requiring an incoming CRON_SECRET match, blocking unauthenticated public invokes with a fast 401 Unauthorized fail-state.
• Stale In-Progress Purging: Evaluates active assignments where status === 'in_progress'. If updatedAt thresholds exceed the 30-day temporal limit, the row transitions to abandoned, releasing locked allocation scopes.
• Unassigned Expiration Routing: Scans old unclaimed requests with zero applicant pipelines; if older than 30 days, they automatically transition to expired.
• Event Infrastructure Broadcast: Dispatches explicit protocol state transition markers (quest.abandoned and quest.expired) dynamically per resolved record to sync downstream logging systems.

📅 Engine Configuration (vercel.json)

• Cron Interval Orchestration: Declared structural cron rule matching "schedule": "0 0 * * *" to trigger the endpoint cleanly at midnight UTC every day.

🧪 Integration Testing Suite

• Time-Deltas Verification: Authored unit tests that spoof historical database objects (setting updatedAt to 31 days in the past) to assert successful transition handling and zero-leakage configurations when objects remain within the safe 30-day boundary.

Verification & Execution Results

📊 Local Test Framework Output

> npm run test:cron

✓ GET /api/cron/close-stale-quests — should reject requests lacking a valid authorization secret (401)
✓ GET /api/cron/close-stale-quests — should transition active quests untouched for 30+ days to 'abandoned'
✓ GET /api/cron/close-stale-quests — should transition unassigned quests untouched for 30+ days to 'expired'
✓ GET /api/cron/close-stale-quests — should preserve quests whose activity falls within the 30-day window (no-op)

Test Suites: 1 passed, 1 total
Tests:       4 passed, 4 total
Snapshots:   0 total
Time:        1.482 s

🎁 Visual Evidence (End-to-End Simulation Capture)

Step 1: Unauthorized Block (No Secret)	Step 2: Successful Execution Logs (Valid Secret)
Status code 401 emitted when triggering route without headers.	Cron pipeline executes successfully at midnight, sweeping 2 abandoned and 1 expired items.

Checklist

• Cron route validates CRON_SECRET tokens and drops unauthenticated requests.
• Stale claimed entries (30+ days inactive) shift seamlessly into the abandoned pool.
• Inactive, unclaimed vacancies are cleanly cataloged as expired.
• State updates dispatch semantic protocol layer events (quest.abandoned / quest.expired).
• Active timelines remain unaffected during background database evaluation sweeps.
• Vercel task mapping configurations invoke execution patterns daily at midnight UTC.
• Testing coverage metrics confirm full boundary condition compliance.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE