- cabana: config_reorder.yaml (title, nameFrom, modelClass, parentColumn,
sortColumn, maxDepth, partition) with fail-loud boot checks and the
built-in reorder toolbar button; list schema carries reorder
- GET/POST {controller}/reorder: scoped set (ListExtendQuery plus the
partition) locked FOR UPDATE, 409 reorder_stale on any set difference,
422 for duplicates, foreign parents, cycles and maxDepth, both columns
written without model hooks
- pact.AdminSingleton: GET {controller}/singleton (first or create, form
scope checked), form schema singleton, list/create/bulk/delete 404,
no config_list.yaml needed
- swag, inventories, token classes, CSRF walk, conformance cases, backend
lang reorder.stale and load_failed, reorder and singleton smoke tests, docs
- seaglass (new module): bluemonday v1.0.27 policy ported from Journal
without the Blog Editor rules, byte-stable token comparison,
SanitizeReport, Sanitize, Check, Removals
- cabana: type richeditor (common keys plus size); every create and update
value sanitized before Fill, non-string values are a 422, removals become
meta.notices; settings and relation forms refuse the type
- backend lang richeditor.removed_* and markup_changed (en, pl plurals)
- TestSeaglassSmoke, TestCompanionsRichEditorSmoke, README and docs
tail | grep -q under pipefail refused a long go.log that had records: grep
stopped at the first match and tail died of SIGPIPE. Count the matches
instead. New self-test case: a 20000-line log after an early record.
With SUMMER_HTTP__ACCESS_LOG off the Go log has no http request records,
and the 5xx scan passed on an empty signal. scan_go_log now also refuses
unless the part of go.log written during this --e2e run (after the offset
taken once the stack is up) has an http request record. Self-test cases:
no records, an empty log, records only before the offset.
--e2e reused any running stack, so Playwright and the go.log scan could
exercise a binary built before the commits under review. A running stack
that dev-stack.sh fresh refuses is now stopped and started again (and left
running), and fresh must pass after up --detach. The self-test plants an
app and framework tree: a newer source or a missing stamp must be
refused, docs, planning files and tests ignored.
The self-test feeds a planted token line through dev-stack.sh redact-seed
and refuses when the secret survives; --e2e refuses unless
tmp/dev-stack/seed.out has mode 600.
The prefix was only trimmed. Without a leading slash ServeMux read its first
segment as a host pattern, so every upload silently answered 404, and a CDN
URL panicked in ServeMux and surfaced as a misleading route conflict. With
storage.uploads.serve on, BuildRouter now refuses a prefix that is not an
absolute URL path (scheme, host, query, fragment, whitespace, wildcard
braces, empty, . or .. segments, or a bare /) with an error naming the key.
The route answered with the blob's stored Content-Type, which attach.Store
sniffs from the bytes, so a public text upload starting with <html> was
served as text/html on the application origin; nosniff does not help when
the declared type is already HTML. Every response now carries a sandboxing
Content-Security-Policy, and a successful response whose type is not a
raster image (JPEG, PNG, GIF, WebP, AVIF) gets Content-Disposition:
attachment, on GET and HEAD. Covers stay inline.
Every 5xx became 499 once the request context was cancelled, so a panic or
a real database error on a request the browser had abandoned passed the
phase gate's 5xx scan. Now a 5xx is logged as 499 only when the client had
already gone when the status was written and the handler did not panic;
recoverJSON and recoverBare mark the access log entry. Every record of an
abandoned request carries client_gone=true. The gate self-test plants a
5xx with client_gone=true and must refuse it.
An unmatched request logged its path. A token route reached with another
method (405) or with a trailing slash (404) is answered by ServeMux before
any route handler records the pattern, so the share or invitation token in
the path reached the log. The record now carries method, pattern, status
and duration only.
- --go: vet and test ./... in summercms.go, the fonoteka.go root module and
the fonoteka plugin module, then the named console, plugin and surf tests
through the skip-intolerant detector
- --parity requires the 175/175 TestParityCorpus summary
- --contracts blocks on the phase's Nuxt contract test and reports the
whole suite (missing-catalog.test.mjs fails on HEAD before this phase)
- --guard plants guard-*.conf env files (:8422, unset internal origin,
mismatched origins, plytarium.com, a fake PHP answer, another backend's
marker) and requires a refusal for each, plus a SummerCMS control case
- --e2e brings the stack up when it is down, runs the Go-gate specs through
e2e-verdict, the D-15 specs report-only, and scans go.log for a search
engine failure or a 5xx record
- --self-test plants Playwright reports, Go logs and TAP summaries
- TestUploadsMount: key off registers nothing; on, a public blob is served
with its content type and nosniff, HEAD has no body, private, missing,
partition and encoded traversal paths 404, an unpublished bucket or
database 404s, a custom prefix is honoured
- mountUploads refuses a plugin route at or under the prefix, so
BuildRouter fails instead of only an identical pattern failing at
Assemble (README and storage docs updated)
- TestAccessLog: pattern and status for 200, handler 404 and recovered
panic, path only for unmatched requests, locale-prefixed requests keep
the pattern, integer duration_ms, no query, header or Authorization
value, ResponseController flush still works
- --self-test plants detector cases for every exit code and checks the modes
- --go runs the named console tests with go -C on the fonoteka.go workspace
A client that goes away mid-request cancels the context; a handler then
fails on context.Canceled and writes a 500 nobody receives. The request
log now records it as 499 (client closed request) so a grep for 5xx shows
real server errors only.
- one Info record "http request" per request with method, matched route
pattern, status and duration_ms; path without the query only when no
route matched
- the matched route records its pattern through a request-scoped entry,
so locale prefix rewrites do not hide it
- logs through the published *slog.Logger or slog.Default; off by default
- surf README, logging and configuration docs describe the key
- surf mounts GET {storage.uploads.public_path_prefix}/{path...} on
attach.StaticHandlerPublic when storage.uploads.serve is true
- bucket and database resolved per request; X-Content-Type-Options: nosniff
- surf README, storage and configuration docs describe the key
- mlLocale: type predicates, localeRecord, the ML_LOCALE_CHANGE broadcast
- MLField: locale switch, whole-map emit, broadcast follow, content-locale
- FileCaptionModal: prefill, save via FileRoutes.update, 422 stays, danger toast
- ApiTokensPanel and ApiTokenCreateDialog mounted directly next to the app tests
