68 Commits

Author	SHA1	Message	Date
lilleman	8e3270d479	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); cut the duplicated specificity line and reflow	2026-11-09 00:14:53 +01:00
lilleman	42644ba0f5	Correct the stale and false comments and docs the comprehension seats flagged	2026-11-09 00:11:47 +01:00
lilleman	0a9c79d08f	Refuse a malformed admin DSN before postgres 4 connects to the host it misreads	2026-11-08 23:26:03 +01:00
lilleman	63c90ea3d6	Answer stability round 1: 0 🔴, 5 🟡 (1 misread); pin the revoke, redirect, 503 and URL-slash paths with tests, and stop calling an undeclared grant dormant	2026-11-08 22:15:54 +01:00
lilleman	e328832374	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); repoint the stale /admin examples and the plugin-api comment, fix the examples row	2026-11-08 21:33:58 +01:00
lilleman	8324a9c59e	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); own-key rename lookup, test the host translator, name both id kinds in the conflict, keep admin unreserved	2026-11-08 21:33:55 +01:00
lilleman	05da1d7897	Rename the admin example plugin to auth-admin, and let config/menu.ts hide or rename a profile-menu entry	2026-11-08 21:25:11 +01:00
lilleman	f8a611992a	Answer stability round 1: 0 🔴, 5 🟡 (0 misread); test the setting and idless-nav rules, fix discovery's header	2026-11-08 20:47:52 +01:00
lilleman	fdef624300	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); drop the conflicts header, make the CI/CD pointer a bare link	2026-11-08 20:47:52 +01:00
lilleman	9b1b201f65	Split conflict detection out of plugin.ts and the CI/CD section out of the README	2026-11-08 20:39:49 +01:00
lilleman	523e8b3724	Answer stability round 1: 1 🔴, 3 🟡 (0 misread); scope the visual selector, check label and cover the gaps	2026-11-08 19:25:57 +01:00
lilleman	a558f8340f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); apply the nits	2026-11-08 19:25:57 +01:00
lilleman	777c0bd86d	Let a plugin add links to the profile menu, and list the setting conflict kind	2026-11-08 19:17:57 +01:00
lilleman	404f2584ac	Add buildPaginationModel and ctx.assetHref, and bump the plugin contract to 0.5.0	2026-11-08 14:32:05 +01:00
lilleman	4239ee12f0	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); gate test pins each source, builtin-route name, exact CSS wording	2026-11-08 14:18:39 +01:00
lilleman	a2493edff2	Move test-only tooling to src/test-tooling, split positive, warn on undeclared gated permissions	2026-11-08 14:09:20 +01:00
lilleman	a3b8632d5c	Answer prose round 1: 0 🔴, 1 🟡 (0 misread); the secrets checklist reads in one pass, and four comments shrink or say granted	2026-11-03 21:46:57 +01:00
lilleman	fefc7cee30	Plan 0.5.0 from the ten highest-scoring items; reserve the plugin id error, translate the duplicate-group refusal, and correct four comments and README passages	2026-11-03 21:43:57 +01:00
lilleman	8ffbb0b70d	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the driver decides what parses so a multi-host DSN still works, and the nine-key test shrinks to four	2026-10-31 13:56:46 +01:00
lilleman	396ce93a2f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); the redundant comment goes, the changelog entry shrinks to one sentence	2026-10-31 13:43:04 +01:00
lilleman	5be561c4ba	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); the tests quote each non-secret value and run one case per type, the config.ts URL leak is filed as item 55	2026-10-31 13:43:04 +01:00
lilleman	8f7bc59b38	Keep a secret setting's raw value out of the boot error that rejects it	2026-10-31 13:38:27 +01:00
lilleman	7f2c0cc2c2	Name the bounded frame: fill:true on the shell, and the contract minor that ships it	2026-09-10 16:16:35 +02:00
lilleman	54956fe627	Release the gate change as 0.3.0, and start a changelog	2026-09-03 17:58:09 +02:00
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent	2026-09-02 18:24:56 +02:00
lilleman	6a0d11d9d3	Name exactly one gate on every declaration, and own a shift by identity id	2026-09-02 14:00:04 +02:00
lilleman	dfb043c3bd	Read one gate everywhere, and check a declaration's gate in one pass	2026-09-02 12:32:51 +02:00
lilleman	bf146c07e7	Bump the contract for the new gate, and close the ways it could read as open	2026-09-02 08:36:16 +02:00
lilleman	c7e6d66750	Scope My shifts at the upstream, and give Route and NavNode one gate declaration	2026-09-02 08:15:08 +02:00
lilleman	8da75b4ca7	Gate a route or nav node on a session, not only a permission	2026-09-02 07:36:08 +02:00
lilleman	c702a347dc	Offer a long filter list as a popover multi-select instead of a wall of chips	2026-08-25 09:10:23 +02:00
lilleman	fa7cad1d65	Declare plugin settings in the manifest, resolve them from the environment	2026-08-23 13:17:03 +02:00
lilleman	cbf55bebae	Give each version mismatch its own remedy, and stop publishing a moving bare-major tag	2026-08-22 12:27:43 +02:00
lilleman	9e0cb26b3e	Refuse a 0.x minor mismatch, and republish the overview from the named release's tree	2026-08-22 12:13:41 +02:00
lilleman	8fd492e544	Scope the sidecar trailer by package so a mixed branch cannot lose it	2026-08-22 12:01:35 +02:00
lilleman	bfcf4ed072	Trim the prose to what is true now	2026-08-22 11:24:16 +02:00
lilleman	a3d9a3df5f	Keep the release at v0.1.0 — nothing consumed the old contract	2026-08-22 11:21:42 +02:00
lilleman	d545445ea8	Release this as v0.2.0, and give the Hub overview its own job, token and template	2026-08-20 23:32:10 +02:00
lilleman	c35ba3fb4e	Make the plugin contract version the release version, and publish the Docker Hub overview from CI	2026-08-20 23:16:11 +02:00
lilleman	e0046e5068	Warn rather than refuse on a storage URL mismatch, and scrub the provisioning DSN before discovery	2026-08-19 01:03:40 +02:00
lilleman	5589472e25	Keep role re-assertion within a non-superuser provisioner's rights, and test the second boot	2026-08-19 00:44:49 +02:00
lilleman	e66a8a3e89	Isolate the storage CI stack, prove least-privilege provisioning, drop the secret before discovery	2026-08-19 00:20:17 +02:00
lilleman	060535c8ab	Confine the Postgres driver to bootstrap, bound plugin connections, and gate the storage DDL	2026-08-19 00:08:35 +02:00
lilleman	c7013be2f0	Give a plugin a Postgres database of its own	2026-08-18 23:12:13 +02:00
lilleman	cb59eee76d	Refuse a node_modules at the plugins/ root, where it outranks the host's	2026-08-18 08:14:21 +02:00
lilleman	82af77356f	Follow symlinked plugin folders, and keep a plugin .npmrc out of the image	2026-08-18 07:49:51 +02:00
lilleman	94dc581593	Fail loud on a null package.json and a stray plugins/package.json	2026-08-17 22:50:29 +02:00
lilleman	453058c67b	Refuse a shadowing barrel copy, and record the packaging contract	2026-08-17 22:34:56 +02:00
lilleman	af974cfa36	Let a plugin carry its own package.json and npm dependencies	2026-08-17 22:23:53 +02:00
lilleman	a005acb93d	Cut non-essential prose from docs and comments, and require the same of every future change ... README loses the competitor comparison, the personas and the repeated philosophy; the five near-identical E2E command blocks become a table plus one command, and the file map a clause per entry. AGENTS.md keeps every decision but drops the narrative around them. todo.md's completed items collapse to their task line — git holds the rest. Comments lose restatement, README duplication and history ("used to", "originally", dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on every change rather than a one-off cleanup. src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README states the command once instead of per suite.	2026-08-05 23:41:12 +02:00