53 Commits

Author	SHA1	Message	Date
lilleman	2b19ed27d2	Answer prose round 1: 1 🔴, 4 🟡 (0 misread); correct the older changelog entries, keep each fact in one home, rewrap the Keto header	2026-11-08 22:15:54 +01:00
lilleman	4d2e7b59fd	List grants no plugin declares with a Remove, and save a permission change as one Keto transaction	2026-11-08 22:04:52 +01:00
lilleman	b8a510a1c5	Answer product-owner round 1: 0 🔴, 2 🟡 (0 misread); say the old copy is refused and nothing redirects /admin/, show a profile-entry override	2026-11-08 21:33:57 +01:00
lilleman	05da1d7897	Rename the admin example plugin to auth-admin, and let config/menu.ts hide or rename a profile-menu entry	2026-11-08 21:25:11 +01:00
lilleman	a558f8340f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); apply the nits	2026-11-08 19:25:57 +01:00
lilleman	777c0bd86d	Let a plugin add links to the profile menu, and list the setting conflict kind	2026-11-08 19:17:57 +01:00
lilleman	b19b43685c	Answer stability round 1: 2 🔴, 3 🟡 (0 misread); refuse a trailing-slash range, full plugin route, merged tests, compose passes TRUSTED_PROXIES	2026-11-08 15:06:19 +01:00
lilleman	a69593eb72	Put the caller, site and route on every request's span and log line	2026-11-08 14:59:55 +01:00
lilleman	9af29ffdb9	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); assetHref in the test fakes, one shared buildContext option set, default pinned, upgrade note and AGENTS.md corrected	2026-11-08 14:41:19 +01:00
lilleman	404f2584ac	Add buildPaginationModel and ctx.assetHref, and bump the plugin contract to 0.5.0	2026-11-08 14:32:05 +01:00
lilleman	4239ee12f0	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); gate test pins each source, builtin-route name, exact CSS wording	2026-11-08 14:18:39 +01:00
lilleman	a3b8632d5c	Answer prose round 1: 0 🔴, 1 🟡 (0 misread); the secrets checklist reads in one pass, and four comments shrink or say granted	2026-11-03 21:46:57 +01:00
lilleman	fefc7cee30	Plan 0.5.0 from the ten highest-scoring items; reserve the plugin id error, translate the duplicate-group refusal, and correct four comments and README passages	2026-11-03 21:43:57 +01:00
lilleman	8ffbb0b70d	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the driver decides what parses so a multi-host DSN still works, and the nine-key test shrinks to four	2026-10-31 13:56:46 +01:00
lilleman	217a36252e	Keep a URL config value out of the boot error that rejects it	2026-10-31 13:48:43 +01:00
lilleman	396ce93a2f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); the redundant comment goes, the changelog entry shrinks to one sentence	2026-10-31 13:43:04 +01:00
lilleman	8f7bc59b38	Keep a secret setting's raw value out of the boot error that rejects it	2026-10-31 13:38:27 +01:00
lilleman	f340933e39	Answer product-owner round 1: 0 🔴, 1 🟡 (0 misread); the notice tells the admin to send the link and the code	2026-10-31 13:11:21 +01:00
lilleman	4cb21d8909	Link the admin's recovery-code notice to the flow the code was minted on	2026-10-31 13:05:06 +01:00
lilleman	053438f968	Answer product-owner round 1: 0 🔴, 2 🟡 (0 misread); the submit sends a same-origin Referer, Kratos' redirect to this host keeps the chosen locale	2026-10-31 12:59:28 +01:00
lilleman	ead604f49d	Accept a verification or recovery code pasted with whitespace around it	2026-10-31 12:41:11 +01:00
lilleman	03544e8d8d	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); the changelog names the engines below :has(), the block comment names what it hides, the test comment goes	2026-10-31 12:25:23 +01:00
lilleman	d0e1de96b8	Show which filter segment or chip is selected and focused without :has()	2026-10-31 12:19:21 +01:00
lilleman	8a93d59988	Answer prose round 1: 0 🔴, 7 🟡 (0 misread); the header opens with what it checks, README says what fails even guarded and how a plugin is checked, the changelog stops claiming a floor change	2026-10-31 12:13:32 +01:00
lilleman	7ff8140e07	Fail the gate on a stylesheet feature the browser floor lacks, unless an @supports guards it	2026-10-31 11:52:17 +01:00
lilleman	b6afdf1ecc	Push auto-release tags as renovate-bot so release.yml fires, and give the Docker Hub page its short description	2026-10-31 11:12:23 +01:00
lilleman	b478cc7735	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); the pageError comment is true, nested-group removal is unambiguous, the trade-off lives only at the guard	2026-10-31 11:02:47 +01:00
lilleman	ad812e17c2	Refuse a group change that would lock the acting admin out, and title a read-only user page View user	2026-10-31 10:47:47 +01:00
lilleman	c38ad74e3a	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); a changed file, not a release, changes the hash; the memo comment, the CHANGELOG scope and smaller comment cuts	2026-10-31 10:16:05 +01:00
lilleman	3d757d4726	item-34 - Serve every /public/ asset under a content-versioned URL with an immutable Cache-Control	2026-10-31 10:00:03 +01:00
lilleman	85bfadd040	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); allow the stale-save 409 in the e2e console guard, report a partial save when Keto cannot be read again, add the missing group, no-op and plain-login tests	2026-10-31 09:46:17 +01:00
lilleman	f4969d5c1f	Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale	2026-10-31 09:34:05 +01:00
lilleman	4e7d897516	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); document the e2e typecheck, tighten comments and changelog	2026-10-31 08:24:18 +01:00
lilleman	520d2c928d	Visual E2E at five viewports, typecheck e2e-tests in the gate, drop unused icons	2026-10-31 08:20:16 +01:00
lilleman	25b24a1057	Answer prose round 1: 1 🔴, 5 🟡 (1 misread); manifest is plugin.ts, rename permission token to permission name, narrow the denylist claim, move the scale into Plugin dependencies, add Safari to the :has() comment	2026-10-31 02:17:30 +01:00
lilleman	1905d2c310	Add a README glossary and intended scale; correct the TOKENS comment	2026-10-31 02:14:39 +01:00
lilleman	6815caa47e	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); drop the false header bullet, match the changelog and test wording	2026-10-31 02:04:47 +01:00
lilleman	2ab482e774	Keep the mobile nav reachable on engines without :has(), and fix the stylesheet header	2026-10-31 01:49:13 +01:00
lilleman	a190166421	Answer stability round 1: 1 🔴, 6 🟡 (0 misread); hide the theme switch after its base rule, hide inert nav toggles, test the rendered result	2026-10-31 01:32:26 +01:00
lilleman	635006b5fc	Show the whole nav tree without :has(), raise text contrast to 4.5:1, drop unused auth rules	2026-10-31 01:24:34 +01:00
lilleman	270d80c8d0	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); state the colour rule in the README and the changelog	2026-10-31 01:07:30 +01:00
lilleman	7e3e8acb28	Give every palette colour a hex value an engine without oklch can read	2026-10-31 01:00:42 +01:00
lilleman	44a777dc3f	Answer stability round 1: 1 🔴, 0 🟡 (0 misread); share no page	2026-10-30 21:32:56 +01:00
lilleman	1dfc6aac3a	Set Cache-Control on every rendered page, and record the CSRF token's unbinding	2026-10-30 21:28:14 +01:00
lilleman	79f26491db	Answer product-owner round 1: 0 🔴, 0 🟡 (0 misread); add a changelog entry	2026-10-30 20:50:33 +01:00
lilleman	16873662b9	Keep the reader in place when the drawer closes, and stop the CSS promising a header it deleted	2026-09-10 16:16:35 +02:00
lilleman	53ab35bfb8	A page is a document: drop the sticky chrome and the bounded-frame opt-out	2026-09-10 16:16:35 +02:00
lilleman	2f29853121	Make the scroll-lock test able to fail, and name the tell a broken chain actually shows	2026-09-10 16:16:35 +02:00
lilleman	41aa59d05d	One home per fact: cut the copied rationale, and give the seam test room to mean something	2026-09-10 16:16:35 +02:00
lilleman	cb4f8d6e98	Name the table's local after the class it applies, and let a broken chain show itself	2026-09-10 16:16:35 +02:00