Commit Graph

2123 Commits

Author SHA1 Message Date
Jakub Zych
a95a014b52 fix(build): scaffold plugins under plugins/<vendor>/<name> (quick-261028-pq8)
- make:plugin writes plugins/<vendor>/<name> with module
  <app>/plugins/<vendor>/<name>; the package name stays <name>
- make:* and the models-leaf check look in summer.yaml, then
  plugins/<vendor>/<name>, then the older plugins/<name>
- summer new puts its starter plugin at plugins/golem15/<name>
- refuse a vendor directory that is a legacy plugin module and a second
  copy of a plugin that already sits in plugins/<name>
- help text and docs, with an upgrading note: moving is optional
2026-10-28 18:55:46 +01:00
Jakub Zych
a941ab2394 fix(build): order scaffolded migrations after every existing one (quick-261028-pq8)
- nextMigrationFile starts at one second past the newest updates/ timestamp
  when that is not earlier than now, so registry order is creation order
- frozen-clock unit test and a registry-order check in the scaffold test
- docs: drop the same-second caveat and the manual order check
2026-10-28 18:49:17 +01:00
Jakub Zych
017e0e9a6a docs(20): create phase plan 2026-10-28 18:39:49 +01:00
Jakub Zych
2bef465ecd docs: capture todo - make:plugin drops the vendor namespace 2026-10-28 18:24:53 +01:00
Jakub Zych
d788d12785 docs(phase-20): add pattern map 2026-10-28 17:55:35 +01:00
Jakub Zych
341a3a51a1 docs(phase-20): record plan-time decisions D-20..D-23 2026-10-28 17:52:58 +01:00
Jakub Zych
b5a20996c1 docs(phase-20): add research and validation strategy 2026-10-28 17:50:49 +01:00
Jakub Zych
1488276bd2 docs(20): capture phase context 2026-10-28 17:25:56 +01:00
3cc42f5079 docs(phase-32.1): record the MCP OAuth decision 2026-10-28 17:05:36 +01:00
1468344460 docs(phase-32.1): complete phase execution 2026-10-28 17:05:19 +01:00
040187deb9 docs(32.1): record code review disposition 2026-10-28 17:03:08 +01:00
bba6539883 docs(32.1-05): complete the unit tests and release plan
- Record the tag-and-publish decision, changelog notes, and roadmap check
- Leave the release decision file unchanged
2026-10-28 16:44:14 +01:00
9094bf9ad9 test(32.1-05): prove MCP call context, both guards, and PRM scopes
- A bare context and a plain request carry no MCP call
- Frontend and backend tool calls record the guard that owns the tool
- PRM uses an advertised scope list and falls back to PRMScopes
v0.5.2
2026-10-28 16:09:30 +01:00
06a144e19f docs(32.1-04): complete vue-oauth-layer /connect plan 2026-10-28 16:00:25 +01:00
23238ccd47 docs(32.1-03): complete MCP consent and backfill plan 2026-10-28 15:44:26 +01:00
3f52b1ab49 docs(32.1-02): complete OAuth implied scopes plan 2026-10-28 15:06:32 +01:00
415a09333b docs(32.1-01): complete MCP scope list and call context plan
- Record the plan summary
- Mark 32.1-01 executed on the roadmap
2026-10-28 14:42:59 +01:00
876f0f09f2 docs(32.1-01): document the MCP scope list and call context
- READMEs and service pages name the new pact and wristband identifiers
- an empty MCP scope list resolves to the five fixed names; OIDC discovery is unchanged
2026-10-28 14:36:50 +01:00
9e29d6ff9b feat(32.1-01): expose offline access on the pending consent view
- PendingRequestView.OfflineAccess is the pending row's flag
- IssueCode's signature is unchanged
2026-10-28 14:33:11 +01:00
63d05e8acb feat(32.1-01): publish one MCP scope list and call context
- pact gains MemberTokenScopeCatalog, MCPAdvertisedScopes and MCPCall
- an empty MCP ScopesSupported resolves to the five fixed names including backend
- pier copies advertised scopes and sets MCPCall beside WithDispatch
2026-10-28 14:32:31 +01:00
2cea3127cc docs(33): roadmap plan list after revision 2026-10-28 14:25:11 +01:00
8416f10849 docs(33): revise phase plan after checker 2026-10-28 14:23:02 +01:00
200c664a4b docs(32.1): create phase plan 2026-10-28 14:19:09 +01:00
41d145dde1 docs(phase-19.6): add security threat verification 2026-10-28 14:03:50 +01:00
f5931d5698 docs(phase-19): add security threat verification 2026-10-28 14:01:30 +01:00
3938ebbddd docs(phase-16.2): add security threat verification 2026-10-28 13:59:44 +01:00
1173f35f80 docs(33): record D-70, SC-3, H1 scope and research defaults; resolve open questions 2026-10-28 13:56:00 +01:00
88fbfb7b39 docs(33): create phase plan
Fourteen plans in nine waves for SEO output, audit and content, with the
pattern map and the IndexNow coverage matrix.

Claude-Session: https://claude.ai/code/session_013jPFwWHBUFJPX91w5Qa4Vs
2026-10-28 13:48:06 +01:00
0db030598e docs(phase-32.1): add validation strategy 2026-10-28 13:38:02 +01:00
bd23a82f22 docs(todos): close FAQ port, site-cache purge, sitemap XSLT; drop sitemap port 2026-10-28 13:19:06 +01:00
a7df0caaa3 docs(32.1): add read/write implied scopes and vue-oauth-layer to context 2026-10-28 13:06:34 +01:00
14979e7009 docs(32.1): capture phase context 2026-10-28 13:02:54 +01:00
df2a0753c7 docs(33): record plan list, release cadence and WebP decision 2026-10-28 12:49:20 +01:00
2cc3c1728b docs(33): UI design contract 2026-10-28 12:38:04 +01:00
69d5a24fa8 docs(33): record per-site options for post title, new-tab links and journal breadcrumbs 2026-10-28 12:35:11 +01:00
2ac8663fe7 docs(33): make Journal's H1 conversion a per-site setting 2026-10-28 11:53:45 +01:00
126c0866fc docs(33): research and validation strategy for SEO output, audit and content 2026-10-28 11:39:03 +01:00
b8aa5d881c docs(quick-261028-fsq): sm-user-plugin MCPDispatch credential carries the personal token id 2026-10-28 11:31:35 +01:00
7c4dbb1252 docs(33): write out phase 33 context from the phase 32 SEO discussion 2026-10-27 20:10:32 +01:00
adf5cccc4a test(32): verification report and human verification items as UAT 2026-10-27 16:12:00 +01:00
6472f2861e docs(32): reconcile review disposition with the fix report 2026-10-27 15:47:24 +01:00
9fe489084c docs(32): record code review disposition 2026-10-27 15:47:24 +01:00
175e469587 docs(32): add code review fix report 2026-10-27 15:47:00 +01:00
0e187cfb6a fix(32): WR-07 close the relation and partial routes of hidden owner fields
Hide removed an owner field from the schema, show and save, but a hidden
relation-manager field's relation routes (panel, link, unlink, child CRUD,
deferred commit) and a hidden partial field's partial stayed reachable.
dropHiddenFields now drops the relation and the partial path too; a partial
the list or preview header or another field still uses keeps rendering.
2026-10-27 15:39:32 +01:00
1583651783 fix(32): WR-02 report the request locale's primary tag on record events
Admin saves copied the raw context locale into RecordSaved.Locale, which
could be a whole Accept-Language header, while reorder reported a
normalised code. Saves, child writes and reorder now report the primary tag
of the request locale. The pact doc says what Locale is and that per-locale
work keys on RecordChange.Locale, since an admin save writes the row in the
default content locale.
2026-10-27 15:32:11 +01:00
468af06c86 fix(32): WR-01 fire record events for hasMany link, unlink and deferred children
hasMany link and unlink rewrote a child's foreign key (and ClearOnChange
columns) without a RecordSaved, the deferred commit attached session-created
children silently, and unlinking a session-created child deleted it without
the RecordDeleted that should follow its RecordSaved{Created}. These paths
now fire the child's events after the commit; the CRUD service carries the
registry so the deferred commit names the child's controller.
2026-10-27 15:30:07 +01:00
d660cd05fa fix(32): CR-04 take widget actions dispatched from connectedCallback
WidgetField assigned its element after append(), so an action the element
dispatched from connectedCallback (inside append) found no target and was
dropped without a result or an error state; widgets that load on connect
never started. The element is now the action target before it is connected.
Rebuilt the embedded admin dist.
2026-10-27 15:25:24 +01:00
5471b66b8f fix(32): CR-02 gate field type uploads on extension visibility
The plugin field-type upload route resolved a form extension's field without
checking the extension's Permissions and Visible, so an administrator who
cannot see the extension could still run its Upload. The route now answers
404 for them, like the extension's widget actions and partials.
2026-10-27 15:22:21 +01:00
676ca539aa fix(32): CR-01 check required extension fields on the lifted value
A required: true field in a form extension became a rule on the owner's
model, where its value never exists, so every save of the host form failed,
also for administrators who cannot see the extension. mergedRules now skips
extension fields; liftExtensionValues checks required on the submitted value
for visible extensions only (create: must be sent and not blank; update:
only when sent).
2026-10-27 15:20:33 +01:00
2b7174d406 docs(32): number review findings and record their disposition 2026-10-27 14:31:55 +01:00