1205 Commits

Author SHA1 Message Date
73af414793 docs: correct the Docker note for go test -short in CLAUDE.md v0.1.22 2026-10-11 14:35:56 +02:00
73074ee257 fix(admin): keep plugin rail and section panel sticky so Settings stays at the viewport bottom 2026-10-11 14:34:24 +02:00
ee6fc7a235 docs(quick-261011-joh): record passing Docker-backed test re-run 2026-10-11 14:31:46 +02:00
290713cce3 docs(quick-261011-joh): sieve generic collection helpers module 2026-10-11 14:28:16 +02:00
a0bf8ece05 feat(sieve): add the remaining collection helpers and docs mentions
- Add TryMap, Filter, Reduce, KeyBy, GroupBy, Uniq, UniqBy, Partition
  and Find, plus the Set type built with SetOf (Has, Add, Slice).
- Add unit tests at 100% statement coverage and a runnable example for
  every function and Set method.
- Complete the module README: contracts, use cases, Pluck rationale,
  standard-library pointers and the full API reference.
- docs/architecture/introduction.md: add a Utilities row for sieve.
- docs/setup/coming-from-wintercms.md: map Laravel collection methods
  to sieve and narrow the not-provided row to the fluent collection
  object.
2026-10-11 14:27:13 +02:00
6933004b87 feat(sieve): add sieve module with Map 2026-10-11 14:22:56 +02:00
b906bdd48b docs(phase-16.3): complete phase execution 2026-10-11 14:08:47 +02:00
5913337cda docs(16.3): verification passed after admin gate fix
Re-verify after d1b043a: SC-6 closed, check-phase16.3.sh --all green, score 6/6.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 14:08:06 +02:00
d1b043a361 test(16.3): retarget panel create test after WR-02 submit gate
Assert submit stays disabled with no scopes; keep the 422 focus path
with a selected scope so check-phase16.3.sh --all stays green.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 14:05:59 +02:00
502fae3e90 docs(16.3): mark WR-01 and WR-02 review findings fixed
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:53:50 +02:00
cb4b0a9c75 fix(16.3): disable Create token until a scope is selected
Client-side canSubmit now matches the 422 rule so Submit stays disabled
with an empty scope set (WR-02).

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:53:32 +02:00
a955d2a3d4 fix(16.3): refresh CSRF coverage golden and blog scaffold layout
Account token POST/DELETE routes made TestPhase10Coverage expect 32 unsafe
routes; token_scopes.go is hand-authored and excluded from the scaffold pin.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:53:31 +02:00
e368ae9c85 docs(16.3): record code review disposition 2026-10-11 13:48:56 +02:00
36b1bce5c5 docs(16.3): add code review report 2026-10-11 13:48:16 +02:00
f4395b57b7 docs(16.3-04): point STATE state_head at SUMMARY commit
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:42:12 +02:00
e565062479 docs(16.3-04): complete unit tests and phase gate plan
Record SUMMARY, advance STATE/ROADMAP to 4/4 plans executed, and
mark Phase 16.3 ready for verify-work after the gate passed.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:42:12 +02:00
463541549f docs(16.3): complete validation map with nyquist_compliant
Fill every 16.3-VALIDATION.md row from plan 04 results, tick Wave 0,
and set nyquist_compliant true after the phase gate passed.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:40:53 +02:00
9b811f6042 test(16.3): phase gate
Add scripts/check-phase16.3.sh with fail-closed go/admin/docs/postgres
stages, detector self-tests and NOT RUN postgres without Docker.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:37:30 +02:00
55999b2984 test(16.3-04): full SPA coverage for API tokens panel and dialog
Pin list states, row anatomy, revoke paths and create-dialog step 1/2
behaviours from the UI-SPEC, including plaintext lifetime backstops.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:36:17 +02:00
78124ab86f test(16.3-04): full Go coverage for tokens, guard, account API and CLI
Pin bouncer Scope serialization, party Activated order, lagoon migration,
compile/overlap/mint/expiry/validation, guard/debounce/resolver,
interactive-only, account token API and CLI on Postgres.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:32:11 +02:00
bdd393c15f docs: rewrite CLAUDE.md for MSD and the current repo layout 2026-10-11 13:28:15 +02:00
91830e506f test(16.3-04): pin deny-by-default contract at every layer
Scope match/Allows tables, route classification for every phase09Routes
entry, SPA plaintext lifetime backstops, and Postgres owner lifecycle.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 13:17:41 +02:00
c385dc79eb docs(16.3-03): complete Journal scopes and v0.1.21 release plan 2026-10-11 13:08:54 +02:00
2030fd881a fix(16.3-03): expect 32 CSRF-gated admin routes after token API
Account token create/revoke added two state-changing mounts; update the
Phase 10 CSRF walk count so the release gate inventory stays green.

Co-authored-by: Cursor <cursoragent@cursor.com>
v0.1.21
2026-10-11 02:20:55 +02:00
60873a3fea docs(16.3-03): ExampleResolveBackend for plugin token auth
- Add compiled ResolveBackend example with acme.blog cover
- Include src= fence in authentication docs (Bearer-only)

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:17:43 +02:00
611f98e33b docs(16.3-02): advance STATE and ROADMAP after plan 02
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:08:18 +02:00
fd07e2637f docs(16.3-02): complete admin SPA API tokens card plan
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:07:48 +02:00
e17207a00d feat(16.3-02): dialog rules smoke tests and My account API tokens docs
Cover scope *, 422 focus, clipboard copy/fallback, close-without-copy
guard, and document the SPA tokens card on My account.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:06:43 +02:00
1c930b6ff7 feat(16.3-02): list states, show-revoked toggle, and revoke via ConfirmDialog
Add skeleton/empty/error coverage, revoked-row handling, ConfirmDialog
overflow wrap for long names, and rebuild boardwalk dist.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:04:54 +02:00
5a6a190e7f feat(16.3-02): tracer — API tokens card on My account with show-once create
Wire ApiTokensPanel after the profile form, add the two-step create dialog,
phrase keys, smoke tracer, and rebuilt boardwalk dist.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 02:02:44 +02:00
3f9d3b4f11 docs: sync todos with g15office and map phases to milestone tasks
Tag the 17 open todos with their g15office task IDs, close 7 todos that
are already done or promoted to Phase 16.3, and record the sync rules
and the phase-to-task map in .planning/G15OFFICE.md.
2026-10-11 02:01:50 +02:00
93a3112fb7 docs(16.3-01): advance STATE and ROADMAP after plan 01
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:56:26 +02:00
3019ab188b docs(16.3-01): complete framework personal API tokens plan
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:56:03 +02:00
e24e03c47d feat(16.3-01): admin:token CLI, party.Activated, READMEs and docs
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:55:07 +02:00
ffdb5d00ca feat(16.3-01): account token API with OpenAPI and phrase keys
- Add list/create/revoke/scopes handlers, validation, and soft revoke
- Regenerate admin OpenAPI and TS types; inventory and conformance cases
- Add server-side api_tokens phrase keys (en/pl)

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:51:11 +02:00
183583e0e9 feat(16.3-01): interactive-only gates, ResolveBackend, last_used stamp
- Refuse g15_ tokens on account/avatar/refresh/logout; gate field-types and markdown
- Publish cookie-less ResolveBackend; debounce last_used_at once per minute
- Reserve account vendor segment; TestTokenGatesSmoke covers the deny path

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:47:52 +02:00
b9273c1da7 feat(16.3-01): tracer — g15_ token scopes through composite backend guard
- Add pact.TokenScope/HasTokenScopes and bouncer.ScopeLimit on Principal
- Append backend_api_tokens migration; Allows evaluates scope before superuser
- Composite guard routes Bearer g15_… to token lookup; smoke tests cover path

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-11 01:46:32 +02:00
4d107f4ccb docs: capture todo - uploads keep the client extension (stored XSS, g15office bemfi2zs) 2026-10-11 01:35:37 +02:00
c53ae6a39b docs(16.3): create phase plan 2026-10-11 01:05:56 +02:00
1821f92bee docs: capture todo - prompt open tabs to reload when a new version is deployed 2026-10-11 01:05:05 +02:00
602e0412f3 docs: add a Role in the framework section to every module README
Each module README now says where the module sits in the dependency
graph, why it is its own module, and lists use cases for application
developers.
2026-10-11 00:58:17 +02:00
87953f68bf docs: capture exploration — wavepath framework asks as phases 19.2 to 19.6 2026-10-11 00:36:09 +02:00
ca1443e9c8 docs: add a name mnemonic to every module README and the root modules table 2026-10-11 00:26:20 +02:00
5e3c552aa1 docs(phase-16.3): add validation strategy 2026-10-11 00:18:10 +02:00
9907fa94cd docs(16.3): research phase domain 2026-10-11 00:17:32 +02:00
941ae80b86 docs(16.3): UI design contract 2026-10-11 00:05:21 +02:00
a04ba35271 docs(16.2): re-verify after gap closure 16.2-07 and UAT; phase complete
16.2-VERIFICATION.md passed 14/14: the five human items are resolved by the
16.2-07 gate log and the UAT re-run on v0.1.20 (16.2-UAT.md 5/5). covered_files
adds 16.2-07 PLAN/SUMMARY and openapi_conformance_test.go; digest recomputed
with verification.fingerprint. Re-verified by hand because msd-core 1.14.0
re-stales a report after gap closure and its verifier ignores passed UAT.
STATE points at 16.3 (phase.complete picked 11, an executed phase that is
only stale).
2026-10-10 23:39:54 +02:00
ed8210132e test(16.2): UAT complete - 5 passed after the 16.2-07 gap closure 2026-10-10 21:49:59 +02:00
e1703c7489 docs(16.2-07): complete gap closure plan; UAT Tests 2 and 3 pass on v0.1.20
Purge token set on UAT, restart at 2026-10-10T17:57:57Z, smoke, token-match
and purge-ok pass. posts-unchanged, translations-unchanged, category-purged
and category-fresh pass after the human re-saves. Debug sessions for
G-16.2-1 and G-16.2-2 resolved.
2026-10-10 21:05:47 +02:00
aba063f723 docs(16.2): route checklist names openapi_conformance_test.go; 16.2-07 rows in the validation map
- PATTERNS: one conformCase per new admin route, enforced by
  TestPhase10ConformanceInventory without Docker (G-16.2-1)
- VALIDATION: 16.2-07-T1 to T6 rows; the Docker-host suites now run in the
  gate's postgres stage instead of the Manual-Only table
v0.1.20
2026-10-10 18:44:34 +02:00