Commit Graph

275 Commits

Author SHA1 Message Date
Jakub Zych
6ce67a5d5b docs(04-01): complete CLI scaffolding plan
Tasks completed: 3/3
- Prove and create the compiling Winter-shaped plugin path
- Generate model, migration, and command slices
- Generate jobs and admin controllers, then enforce model imports

SUMMARY: .planning/phases/04-cli-scaffolding-i18n-and-mail/04-01-SUMMARY.md
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-18 13:42:00 +02:00
Jakub Zych
c87bbc37fb feat(04-01): generate jobs and admin controllers, reject model imports
Scaffold pact.Job and pact.AdminController stubs with Winter YAML
assets, and fail summer build when models imports a sibling package.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-18 13:41:13 +02:00
Jakub Zych
d8c56509f2 feat(04-01): generate model, migration, and command artifacts
Add make:model, make:migration and make:command with plugin-id
inference, duplicate rejection, and a deterministic registry refresh
that leaves handwritten plugin.go untouched.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-18 13:39:03 +02:00
Jakub Zych
1edf9d7e4c feat(04-01): scaffold Winter-shaped plugins with generated registry
Render plugin.go, routes.go, leaf packages and go.mod from embedded
templates, emit empty registry accessors, and define job, admin, lang
and mail capability contracts so a new plugin compiles before artifacts.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-18 13:34:32 +02:00
Jakub Zych
846e6d5b74 docs(04): create phase plan 2026-09-18 13:24:54 +02:00
Jakub Zych
a5c8e0e31b docs(04): map validation to planned tasks 2026-09-18 13:24:01 +02:00
Jakub Zych
f5605fc8d1 docs(04): research phase implementation 2026-09-18 12:43:41 +02:00
Jakub Zych
2fdadd3f12 docs(phase-4): add validation strategy 2026-09-18 12:34:15 +02:00
Jakub Zych
dccfdb3b3a docs(state): record phase 4 context session 2026-09-18 02:14:26 +02:00
Jakub Zych
cb5966a50b docs(04): capture phase context 2026-09-18 02:14:25 +02:00
Jakub Zych
0f767edc9e docs: capture exploration — plugin-layout-winter-directories 2026-09-18 01:59:59 +02:00
Jakub Zych
b2fd726501 docs(phase-03): evolve PROJECT.md after phase completion 2026-09-17 20:51:23 +02:00
Jakub Zych
7fbb259109 docs(phase-03): complete phase execution 2026-09-17 20:51:07 +02:00
Jakub Zych
2d511834ea docs(03): verify first vertical slice goal achievement 2026-09-17 20:50:30 +02:00
Jakub Zych
eebcba5968 docs(03): add code review report 2026-09-17 20:46:43 +02:00
Jakub Zych
88a3dca409 docs(03-04): mark Phase 3 complete in STATE and ROADMAP
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:41:03 +02:00
Jakub Zych
05a91778b3 docs(03-04): complete unit coverage and security gate plan
Tasks completed: 2/2
- Cover framework boundaries with adversarial unit and integration tests
- Prove app isolation, recorded parity and security review in one final gate

SUMMARY: .planning/phases/03-first-vertical-slice-genres-end-to-end/03-04-SUMMARY.md
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:40:35 +02:00
Jakub Zych
13887ee0b1 docs(03-04): record Phase 3 validation and security evidence
Map T-03-01 through T-03-SC to passing tests, record the check-phase3.sh
gate, and mark nyquist_compliant after that gate exited 0.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:39:53 +02:00
Jakub Zych
fda61f0c15 fix(03-04): keep Phase 3 gate on Go and CLI regression
The Phase 2 PHP self-replay currently fails four wishlist album_count
routes that this slice did not change. The Phase 3 script now re-runs
TestParitySynthetic and the CLI record/replay smoke instead of
check-phase2.sh --fresh-php.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:39:45 +02:00
Jakub Zych
c2dfa7b62f test(03-04): add repeatable Phase 3 check script
- Root and app vet/test/race plus focused genres parity and corpus audit
- Refuses missing Docker and runs the Phase 2 --fresh-php regression

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:33:00 +02:00
Jakub Zych
92255a46ed test(03-04): cover framework database, routing and JWT boundaries
- Shared pgx/GORM pool, ICU locale fail, and isolated plugin migrations
- Seven-stage middleware order, missing-guard boot failure, typed 404s
- Adversarial JWT matrix including alg:none, empty secret, and no leak

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:29:46 +02:00
Jakub Zych
f4fecc959f docs(03-03): complete typed params, rollback, and first real parity pass plan
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:24:39 +02:00
Jakub Zych
8e3bf266d8 feat(03-03): add typed path params and per-plugin rollback
Compile regex and enum constraints at route registration so malformed and unknown IDs share a 404, and named rollback errors isolate one plugin's history.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:19:59 +02:00
Jakub Zych
a9c3e7690f docs(03-02): complete tenant-scoped genre counts plan
Tasks completed: 2/2
- Count only albums visible in the active collection
- Match PHP filter, validation, ordering and JSON shape

SUMMARY: .planning/phases/03-first-vertical-slice-genres-end-to-end/03-02-SUMMARY.md
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:14:09 +02:00
Jakub Zych
56be82f3f3 feat(03-02): add allow-listed database-default order helper
- Reject identifiers and directions outside the caller allow-list
- Emit ordinary ORDER BY without COLLATE so ICU pl-PL applies

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:13:03 +02:00
Jakub Zych
20bd8fe8fc docs(03-01): complete boot JWT genre route plan
Tasks completed: 2/2
- Initialize the real app database through plugin migrations
- Serve the seeded genre list behind real cross-plugin JWT middleware

SUMMARY: .planning/phases/03-first-vertical-slice-genres-end-to-end/03-01-SUMMARY.md
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:06:03 +02:00
Jakub Zych
4ee4c4a2fc feat(03-01): add ServeMux groups, JWT verifier, and serve command
Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 20:04:13 +02:00
Jakub Zych
d0d845052b feat(03-01): add shared postgres pool and plugin migrations
Open one pgx stdlib *sql.DB, hand it to GORM, and run per-plugin
gormigrate sets with isolated history tables after an ICU pl-PL check.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 19:55:33 +02:00
Jakub Zych
15a8389e46 docs(03): create phase plan 2026-09-17 18:40:13 +02:00
Jakub Zych
de99bf3caa docs(state): record phase 3 context session 2026-09-17 17:47:08 +02:00
Jakub Zych
81174d0c25 docs(03): capture phase context 2026-09-17 17:47:07 +02:00
Jakub Zych
5f93129524 docs(02): add code review fix report
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:45:35 +02:00
Jakub Zych
f7b81b9dd7 fix(02): resolve symlinks before fixture and vars path checks (WR-07)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:44:23 +02:00
Jakub Zych
0ac9dc45d0 fix(02): scan leftover passwords and redact secrets in diffs (WR-04)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:43:01 +02:00
Jakub Zych
d3d202e0e2 fix(02): reject trailing JSON after the first decoded value (WR-03)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:41:59 +02:00
Jakub Zych
5cb2defe0f fix(02): compare redirect Location headers during replay (WR-02)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:41:39 +02:00
Jakub Zych
7e70afe819 fix(02): write fixtures exclusively and only on successful flush (WR-01)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:41:18 +02:00
Jakub Zych
5994e671b3 fix(02): stop short ids rewriting pagination and IPv4 (CR-01)
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:39:45 +02:00
Jakub Zych
d27897c7e0 docs(02): add code review report 2026-09-17 14:23:53 +02:00
Jakub Zych
0f7ba926ea docs(phase-02): evolve PROJECT.md after phase completion 2026-09-17 14:23:12 +02:00
Jakub Zych
b3e609ea78 docs(phase-02): complete phase execution 2026-09-17 14:23:11 +02:00
Jakub Zych
8fe69ffc6b docs(02-05): mark plan complete in STATE and ROADMAP
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:17:22 +02:00
Jakub Zych
7303467602 docs(02-05): complete contract-security-integration-tests plan
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:15:37 +02:00
Jakub Zych
84a5f007e3 docs(02-05): record measured Phase 2 gate evidence
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:15:13 +02:00
Jakub Zych
066c3d3ab7 fix(02-05): wait for MariaDB with hex-only process credentials
- Avoid urlsafe passwords that start with a dash and break mariadbadmin -p
- Probe readiness with a quoted SQL SELECT against the disposable container

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:12:05 +02:00
Jakub Zych
a296e98d8e feat(02-05): add the repeatable Phase 2 vet, race and PHP gate
- Check root and fonoteka.go with vet, test and race plus TestParitySynthetic
- Audit the 154-route corpus and smoke parity:record/replay against loopback
- Provision a disposable MariaDB, pin PHP to 127.0.0.1:8423, and self-replay seed, routes and clients

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:09:16 +02:00
Jakub Zych
5ed920b7b1 test(02-05): cover proxy, scrub and CLI security boundaries
- Reject non-loopback bind/upstream, cap bodies, isolate concurrent sessions and refuse traversal
- Scrub JWT, inv_ tokens, cookies, client secrets and OAuth codes out of fixtures
- CLI discovery and replay errors exit nonzero without printing secrets

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:06:40 +02:00
Jakub Zych
59b5276cba test(02-05): lock down every response parity class with negative tests
- Record/replay baselines plus mutated fixtures for nil vs [], dates, tri-state bools, envelopes, money and ids
- Header, CSV/image byte, sidecar digest and two-flow continuation cases fail with path diagnostics
- Manifest coverage still reports later flows after a comparison failure

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-17 14:03:55 +02:00
Jakub Zych
6f0168ae1e docs(02-04): mark plan complete in STATE and ROADMAP 2026-09-17 13:59:51 +02:00
Jakub Zych
9a8fcc2c1e docs(02-04): complete honest-go-replay-with-testcontainers plan
Tasks completed: 2/2
- Replay a synthetic write/read flow against Postgres
- Expose the full corpus as honest selectable subtests

SUMMARY: .planning/phases/02-api-parity-harness-bootstrap/02-04-SUMMARY.md
2026-09-17 13:59:04 +02:00