golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,981 Commits 1 Branch 40 Tags
3afe9fa19cdcf28a1b25a5ca280b1dcee9f4e626
Commit Graph

1224 Commits

Author SHA1 Message Date
Jakub Zych
eea04b171e docs(19.7): defer the remaining lane A re-review items 2026-10-23 20:23:17 +02:00
Jakub Zych
f53668a3e8 docs(19.7): add gap-closure re-review report 2026-10-23 19:21:58 +02:00
Jakub Zych
d6a1297a5f docs(phase-19.7): update tracking after gap wave 4 2026-10-23 19:05:56 +02:00
Jakub Zych
883ac5133c docs(19.7-09): complete the gap-closure tests, gate and security review plan 2026-10-23 19:03:06 +02:00
Jakub Zych
e1f489058c docs(19.7-09): deferred items for the gap closure 
B-IN-05 (deferred, the shared confirm primitive), B-IN-06 (no fix
needed), the admin:token:revoke event, the OIDC decision (resolved), the
local go.work retarget, the demo pins, the release order with
PHASE197_RELEASED, the lenient link code parse and one offline-build
flake; the plan 05 test-commit entry is superseded by the release.
 2026-10-23 18:55:37 +02:00
Jakub Zych
a636933299 docs(19.7-09): validation rows for every gap-closure test 
One row per new behaviour of plans 06-09 with its final command; every row
green after the plan 09 gate run; nyquist_compliant stays true.
 2026-10-23 18:54:51 +02:00
Jakub Zych
33faa44e53 docs(19.7-09): security contract with the gap-closure threats and corrected rows 
T-19.7-42..T-19.7-65 join the register, the eight corrected rows carry
their fix commits, the audit trail records the gap closure; threats_open
stays 0 (every high threat is fixed or verified).
 2026-10-23 18:54:06 +02:00
Jakub Zych
946fb2d3ea docs(19.7-09): security review corrected and extended for the gap closure 
Corrects the verdicts the code review disproved (T-19.7-22 first, then
T-19.7-03, -08, -17, -18, -23, -31, -35 and cross-cutting findings 1 and
6), adds the Method step that a high or critical control is verified only
by a test that fails without it, the revert-checks of the three critical
fixes, and the register rows T-19.7-42..T-19.7-65.
 2026-10-23 18:53:31 +02:00
Jakub Zych
05d7e9351a docs(phase-19.7): resume session before 19.7-09, retire handoff 2026-10-23 17:22:05 +02:00
Jakub Zych
bccf06d960 wip: phase 19.7 paused at gap plan 8/9 (before 19.7-09) 2026-10-23 17:14:30 +02:00
Jakub Zych
fdf7efdd5c docs(phase-19.7): update tracking after gap wave 3 2026-10-23 17:13:30 +02:00
Jakub Zych
1e5d9d4f88 docs(19.7-08): complete plugin gap-closure plan (lane C, E-1, E-2) 2026-10-23 17:13:01 +02:00
Jakub Zych
5aeea304d0 docs(phase-19.7): update tracking after gap wave 2 2026-10-23 16:33:11 +02:00
Jakub Zych
d6c7fd5a27 docs(19.7-07): complete lane B gap-closure plan with auth_time and the E-2 seam 2026-10-23 16:32:44 +02:00
Jakub Zych
0ec00f7f69 docs(19.7-07): record the member token scope design decision (E-2, P-30) 2026-10-23 16:15:43 +02:00
Jakub Zych
60a86677f2 docs(phase-19.7): update tracking after gap wave 1 2026-10-23 16:11:17 +02:00
Jakub Zych
6ca9e1706d docs(19.7-06): complete lane A gap-closure plan in pier 2026-10-23 16:10:52 +02:00
Jakub Zych
d18d8f0dc2 docs(19.7): ban and password reset revoke OIDC grants as well as MCP grants (user decision) 2026-10-23 15:46:44 +02:00
Jakub Zych
d763e92650 docs(19.7): gap-closure plans 06-09 for the review findings and the sm-servers-app escalations 2026-10-23 15:44:15 +02:00
Jakub Zych
2527498d03 docs(19.7): gap-closure plan split and release order 2026-10-23 15:03:52 +02:00
Jakub Zych
cee58c0f65 docs(19.7): gap-closure inputs: review findings and two sm-servers-app escalations 2026-10-23 15:02:44 +02:00
Jakub Zych
fef1cbbbbd docs(19.7): add code review report 2026-10-23 14:54:54 +02:00
Jakub Zych
5563df7e68 docs(phase-19.7): update tracking after wave 5 2026-10-23 14:42:11 +02:00
Jakub Zych
d9d2acae88 docs(19.7-05): plan 05 summary; phase gate green, security review done, plugin test commits local 2026-10-23 14:41:38 +02:00
Jakub Zych
4730e37742 docs(19.7-05): security review and contract, deferred items, folded todos closed 
- 19.7-SECURITY-REVIEW.md: T-19.7-01..41 and T-19.7-SC with file, line and
  pinning test; two production fixes (c49983d, 1111828); superuser reach
  accepted as designed with audit and ceiling
- 19.7-SECURITY.md: threats_open 0, accepted risks AR-19.7-01..05
- the frontend permission and account link todos move to todos/done with
  their closing notes
 2026-10-23 14:29:56 +02:00
Jakub Zych
d621ef1b41 docs(19.7-05): validation map filled, Wave 0 complete, Nyquist compliant 2026-10-23 14:24:13 +02:00
Jakub Zych
905111ba72 docs(phase-19.7): update tracking after wave 4 2026-10-23 13:18:15 +02:00
Jakub Zych
81266de77d docs(19.7-04): plan 04 summary; oauthserver v0.1.2 and Journal v0.2.3 released, pinned in the demo 
- SUMMARY with every deviation from the checkpoint report
- deferred items: sm-demo-app push and deploy wait for the user, release
  builds on summercms v0.4.4 lack the cabana subject-event fix, Redis for a
  second instance, the real-client check, the retracted mimetype
 2026-10-23 13:17:36 +02:00
Jakub Zych
9550fe0a9f docs(19.7-04): deferred items from the oauthserver, Journal and demo MCP wiring 2026-10-23 12:56:08 +02:00
Jakub Zych
29ba9a28cb docs: log cabana subject-event fix 2026-10-23 12:44:15 +02:00
Jakub Zych
7c43820afe docs(19.7): cabana subject-event bug resolved 2026-10-23 12:44:09 +02:00
Jakub Zych
5c35f83b9d docs(phase-19.7): update tracking after wave 3 2026-10-23 12:31:00 +02:00
Jakub Zych
607658599f docs(19.7-03): sm-user-plugin v0.1.10 released and pinned in five apps; cabana subject-event bug deferred 
Plan 03 summary: verified account link, Administrators-screen link actions, plugin frontend permissions, user MCP guard and user_me in sm-user-plugin v0.1.10 (requires SummerCMS v0.4.4). deferred-items: cabana fires pact.MCPSubjectChanged as a value inside the transaction while pier listens for a pointer; fix before v0.5.0.
 2026-10-23 12:30:15 +02:00
Jakub Zych
d039350729 docs: record the v0.4.4 and sm-user-plugin v0.1.9 releases 2026-10-23 00:31:56 +02:00
Jakub Zych
e2759d668f docs: user-plugin escalations released in sm-user-plugin v0.1.9, reply ready to send 2026-10-23 00:25:24 +02:00
Jakub Zych
eadd58414d docs(19.7-02): close plan without a release 2026-10-23 00:23:08 +02:00
Jakub Zych
a26ee2b72d docs(quick-261022-x7a): user-plugin golem15.user.password.public_routes switch, login/forgot/reset 404 when false 2026-10-23 00:15:49 +02:00
Jakub Zych
e5dd4579a8 docs: fill item 8 in the external-escalation reply 2026-10-23 00:10:27 +02:00
Jakub Zych
894a3d572f docs(19.7): next v0.4.x release after the quick tasks, v0.5.0 at phase completion 2026-10-23 00:08:10 +02:00
Jakub Zych
d1a15a6f5f docs(19.7): tag v0.5.0 only when phase 19.7 is complete 2026-10-23 00:05:39 +02:00
Jakub Zych
a9e3f2434d docs: tune item 8 password-routes quick after item 7 2026-10-22 23:53:43 +02:00
Jakub Zych
cd90be9de3 docs(quick-261022-wah): user-plugin opt-in token_cookie session cookie and cookie-carried /refresh rotation 2026-10-22 23:51:57 +02:00
Jakub Zych
6a1974c0d2 docs: fill item 7 in the external-escalation reply 2026-10-22 23:45:20 +02:00
Jakub Zych
ec69f547b8 docs: tune item 7 cookie quick after 9-10 2026-10-22 23:14:09 +02:00
Jakub Zych
e9ebf93d36 docs(quick-261022-vfz): user-plugin /login throttle via surf.ClientIP and whole-second tokens_valid_after writers 2026-10-22 23:08:04 +02:00
Jakub Zych
c309a1abe9 docs: tune items 9-10 quick after G4 2026-10-22 22:37:41 +02:00
Jakub Zych
575a110378 docs: fill G4 in the external-escalation reply 2026-10-22 22:36:19 +02:00
Jakub Zych
54ff7bd665 docs(quick-261022-usi): user-plugin jwt blacklist and hooks wired via lagoon.OnDatabase under serve 2026-10-22 22:36:19 +02:00
Jakub Zych
b8bf71c5dd docs: fold G3 leftovers into G4 and login-cookie quicks 2026-10-22 22:00:09 +02:00
Jakub Zych
98a95c9c92 docs(quick-261022-tto): user-plugin session routes accept the session cookies 2026-10-22 21:52:03 +02:00