# Milestone 2 Backend & DB Verification Report **Date/Time (UTC)**: 2026-06-29T21:35:00Z **Challenger**: Challenger 1 (v2) **Scope**: Verification of database schema, API routes, and MCP tools changes for `rootImage` on Menu, and `columnImage`/`hoverImage` on Menu Items. --- ## 1. Database Schema Verification The database schema changes were inspected in `apps/backend/prisma/schema.prisma`. - **Menu Model** (`schema.prisma` lines 638-647): ```prisma model Menu { id Int @id @default(autoincrement()) name String @unique payload Json? rootImage String? // Verified optional string isActive Boolean @default(true) items MenuItem[] createdAt DateTime @default(now()) updatedAt DateTime @updatedAt } ``` - **MenuItem Model** (`schema.prisma` lines 649-661): ```prisma model MenuItem { id Int @id @default(autoincrement()) menuId Int menu Menu @relation(fields: [menuId], references: [id], onDelete: Cascade) label String url String order Int @default(0) columnImage String? // Verified optional string hoverImage String? // Verified optional string translations MenuItemTranslation[] createdAt DateTime @default(now()) updatedAt DateTime @updatedAt } ``` **Verdict**: **PASS**. The columns are correctly defined in the Prisma schema as optional strings. --- ## 2. API Routes Verification The API routes in `apps/backend/src/routes/menus.ts` were reviewed: - **POST `/`** endpoint correctly reads `rootImage` for Menu, and `columnImage` / `hoverImage` for each item in the payload and saves them into the DB. - **PUT `/:name`** endpoint correctly updates `rootImage` for Menu, and updates/creates `columnImage` / `hoverImage` for Menu Items. - Both endpoints are typed using Elysia `t.Optional(t.Nullable(t.String()))` which ensures schema validation. --- ## 3. Empirical Execution Results A verification script `apps/backend/test_menu_api_challenger.ts` was run with command: ```bash bun run apps/backend/test_menu_api_challenger.ts ``` ### Execution Log Outputs: ``` === STEP 1: Login via Auth Route === Login status: 200 Login response: { success: true, token: "...", user: { ... } } === STEP 2: Test POST /menus with login token === POST /menus with login token status: 200 POST /menus response: { id: 8, name: "challenger-test-menu", rootImage: "https://example.com/root.jpg", items: [ { id: 17, label: "Item 1", url: "/item1", order: 1, columnImage: "https://example.com/column1.jpg", hoverImage: "https://example.com/hover1.jpg", } ] } === STEP 3: Perform correct Menu creation & retrieval === Creation status: 200 Created menu: challenger-test-1782734640214 with rootImage, columnImage, hoverImage set. GET /menus/:name status: 200 Retrieved menu matches: - rootImage correct: true - columnImage correct: true - hoverImage correct: true === STEP 4: Perform PUT update menu === PUT status: 200 Updated menu retrieved matches new rootImage, columnImage, and hoverImage values. === STEP 5: Verify Validation Errors for Incorrect Types === POST invalid payload status: 422 POST invalid payload response (expected validation error): - rootImage should be string or null (Got: 12345) -> Verified block! - items[0].order should be number (Got: "not-a-number") -> Verified block! - items[0].columnImage should be string or null (Got: true) -> Verified block! ``` --- ## 4. MCP Tools Review & Audit (Adversarial Challenge) ### Overall Risk Assessment: HIGH ### Challenges & Findings #### 🔴 Critical Challenge 1: Missing Fields in MCP Tool Schema Definitions - **Assumption Challenged**: The MCP server and tools have been successfully updated to expose the database and API improvements to LLM agents. - **Attack Scenario / Issue**: - The schema file `/home/ti/.gemini/antigravity/mcp/homaroma_mcp/upsert_menu.json` defines the parameters for the `upsert_menu` tool. It lists: `dryRun`, `isActive`, `items`, `name`, and `payload`. - **There is no `rootImage` parameter in the schema.** - Under `items` properties, it lists: `id`, `label`, `order`, `translations`, and `url`. - **There are no `columnImage` or `hoverImage` properties in the schema.** - **Blast Radius**: Any AI agent trying to interact with the menus using the `upsert_menu` tool will be unable to set `rootImage` on the menu or `columnImage`/`hoverImage` on the items because the validation schema will reject them or simply drop them. This prevents AI agents from executing content updates for these new visual fields. - **Mitigation**: Update `/home/ti/.gemini/antigravity/mcp/homaroma_mcp/upsert_menu.json` (and the corresponding server code in `apps/mcp-server/menu-tools.ts`) to include `rootImage` at the root level, and `columnImage` and `hoverImage` within the `items` object schema. #### 🟡 Medium Challenge 2: Agent Tool Calling Capability Limitation - **Assumption Challenged**: Agents can execute and test MCP tools via standard client integrations. - **Attack Scenario / Issue**: - There is no `call_mcp_tool` tool or eager `mcp_homaroma_mcp_*` tools registered in this agent instance's declarations. - This prevents agents from direct blackbox testing of the MCP tools. - **Mitigation**: Ensure that the framework registers `call_mcp_tool` or exposes eager MCP bindings to challenger/tester agents. --- ## 5. Stress Test Results - **Insert Valid Image URLs** → Correct storage & retrieval → Pass - **Insert Null Images** → Allowed (nullable field validation) → Pass - **Insert Invalid Types** (Number, Boolean, String order) → Rejected with `422 Unprocessable Entity` → Pass - **Update Existing Menu Fields** → Modifies `rootImage`, `columnImage`, and `hoverImage` successfully → Pass - **Sync via MCP Tool** → Not possible due to schema omissions → **FAIL** --- ## 6. Conclusion The changes to the **database schema** (Prisma) and **Elysia.js API routes** are fully correct, verified, and work as expected. They block invalid types and properly store/retrieve image fields. However, there is a **critical schema-level regression/omission in the MCP tools definitions** where `rootImage`, `columnImage`, and `hoverImage` are completely missing from the schemas. This must be corrected so that MCP tools are fully operational for AI agents.