Browser checks on sm-bm-app passed: datetime popover time, discard confirm, and list date formatting. Phase 12.2 UAT is complete.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close the seven code-review findings in disposition and leave the phase pending on browser checks plus the v0.1.1 tag.
Co-authored-by: Cursor <cursoragent@cursor.com>
- 12.2-SECURITY-REVIEW.md maps T-12.2-01 to T-12.2-36 and the supply
chain rows to the controls as built and their passing tests, with the
parent-predicate removal check and the residual risks
- 12.2-VALIDATION.md: per-task map with real task ids, all green,
nyquist_compliant and wave_0_complete set
- deferred-items.md: out-of-scope findings for follow-up
Six sequential plans: framework gaps, notifications/credentials/onboarding, wishlist, CSV, public views, unit tests and gate. Research open questions marked resolved per the plan-count checkpoint.
- sessionKey.ts: one 32-byte base64url key per form mount, sent only in headers
- api/files.ts: FileRoutes over the record and child file routes, XHR upload with progress, 401 refresh and retry
- FileuploadField and FileCaptionModal per UI-SPEC section 3: dropzone, image grid, rows, per-item states, client pre-checks, reorder, protected previews
- FormView provides FORM_SESSION, counts pending changes as dirty and sends X-Session-Key on create and update
- fileupload lang keys in en and pl, admin-spa docs note, deferred smoke test, rebuilt dist
- 12-SECURITY-REVIEW.md maps T-12-01..T-12-34 and T-12-SC to a named test
and 25 removal checks, all seen failing with the protection removed
- 12-VALIDATION.md validated with the final per-task map, nyquist_compliant
- REQUIREMENTS.md: API-01 and API-02 complete
Five sequential plans: foundations (deferred_bindings, attach.Store,
lagoon.Date/TimeOfDay, purge), cabana datepicker and fileupload, relation
child CRUD with deferral, admin SPA, and unit and security tests.
Adds D-22..D-24 from the plan-count checkpoint and the pattern map.
- new note .planning/notes/core-plugins-own-repos.md: shared core plugins live in sm-<name>-plugin repos mounted as submodules
- 01-CONTEXT deferral points to the note; PROJECT constraint and Key Decisions row
- ROADMAP Phase 12 repos and the 12-01 entry, and Phase 12 plans 12-01, 12-02, 12-05 name sm-user-plugin and the submodule commit workflow
