265 Commits

Author	SHA1	Message	Date
lilleman	f8a611992a	Answer stability round 1: 0 🔴, 5 🟡 (0 misread); test the setting and idless-nav rules, fix discovery's header	2026-11-08 20:47:52 +01:00
lilleman	fdef624300	Answer prose round 1: 0 🔴, 3 🟡 (0 misread); drop the conflicts header, make the CI/CD pointer a bare link	2026-11-08 20:47:52 +01:00
lilleman	9b1b201f65	Split conflict detection out of plugin.ts and the CI/CD section out of the README	2026-11-08 20:39:49 +01:00
lilleman	9ded502be3	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); test the guards the split rewrote	2026-11-08 20:33:19 +01:00
lilleman	ea6c32a7db	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); comments match the stages, item 59's detail reads plainly	2026-11-08 20:16:41 +01:00
lilleman	c4eb9dde1f	Answer security round 1: 0 🔴, 0 🟡 (0 misread); route on the method and path read before the hooks	2026-11-08 19:57:54 +01:00
lilleman	b4579131a2	Split handleRequest into named stages, so the stage order is written once	2026-11-08 19:55:26 +01:00
lilleman	77e3d46769	Rename ShellUser.menu to profileLinks, so menu keeps one meaning in the shell	2026-11-08 19:35:14 +01:00
lilleman	523e8b3724	Answer stability round 1: 1 🔴, 3 🟡 (0 misread); scope the visual selector, check label and cover the gaps	2026-11-08 19:25:57 +01:00
lilleman	a558f8340f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); apply the nits	2026-11-08 19:25:57 +01:00
lilleman	777c0bd86d	Let a plugin add links to the profile menu, and list the setting conflict kind	2026-11-08 19:17:57 +01:00
lilleman	c3ca92713e	Point the request-wrapper comments at request-tracking.ts	2026-11-08 15:10:53 +01:00
lilleman	b19b43685c	Answer stability round 1: 2 🔴, 3 🟡 (0 misread); refuse a trailing-slash range, full plugin route, merged tests, compose passes TRUSTED_PROXIES	2026-11-08 15:06:19 +01:00
lilleman	a69593eb72	Put the caller, site and route on every request's span and log line	2026-11-08 14:59:55 +01:00
lilleman	9af29ffdb9	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); assetHref in the test fakes, one shared buildContext option set, default pinned, upgrade note and AGENTS.md corrected	2026-11-08 14:41:19 +01:00
lilleman	404f2584ac	Add buildPaginationModel and ctx.assetHref, and bump the plugin contract to 0.5.0	2026-11-08 14:32:05 +01:00
lilleman	4239ee12f0	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); gate test pins each source, builtin-route name, exact CSS wording	2026-11-08 14:18:39 +01:00
lilleman	a2493edff2	Move test-only tooling to src/test-tooling, split positive, warn on undeclared gated permissions	2026-11-08 14:09:20 +01:00
lilleman	5aa62e2742	Record reading cost for item 51's chunk	2026-11-08 14:09:20 +01:00
lilleman	a3b8632d5c	Answer prose round 1: 0 🔴, 1 🟡 (0 misread); the secrets checklist reads in one pass, and four comments shrink or say granted	2026-11-03 21:46:57 +01:00
lilleman	fefc7cee30	Plan 0.5.0 from the ten highest-scoring items; reserve the plugin id error, translate the duplicate-group refusal, and correct four comments and README passages	2026-11-03 21:43:57 +01:00
lilleman	8ffbb0b70d	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the driver decides what parses so a multi-host DSN still works, and the nine-key test shrinks to four	2026-10-31 13:56:46 +01:00
lilleman	217a36252e	Keep a URL config value out of the boot error that rejects it	2026-10-31 13:48:43 +01:00
lilleman	396ce93a2f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); the redundant comment goes, the changelog entry shrinks to one sentence	2026-10-31 13:43:04 +01:00
lilleman	5be561c4ba	Answer stability round 1: 0 🔴, 3 🟡 (0 misread); the tests quote each non-secret value and run one case per type, the config.ts URL leak is filed as item 55	2026-10-31 13:43:04 +01:00
lilleman	8f7bc59b38	Keep a secret setting's raw value out of the boot error that rejects it	2026-10-31 13:38:27 +01:00
lilleman	3592a30f98	Answer prose round 1: 0 🔴, 2 🟡 (0 misread); the view header calls the link a URL, the always-present code loses its guard, the test comment goes	2026-10-31 13:11:21 +01:00
lilleman	00fe8b0dd2	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the admin recovery journey gets an E2E, the Kratos comments no longer claim a mailed link	2026-10-31 13:11:21 +01:00
lilleman	4cb21d8909	Link the admin's recovery-code notice to the flow the code was minted on	2026-10-31 13:05:06 +01:00
lilleman	ccb4d32d39	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); comments say what the forms post where, restating test comments go	2026-10-31 12:59:28 +01:00
lilleman	053438f968	Answer product-owner round 1: 0 🔴, 2 🟡 (0 misread); the submit sends a same-origin Referer, Kratos' redirect to this host keeps the chosen locale	2026-10-31 12:59:28 +01:00
lilleman	29d496a02e	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the submit test pins manual redirects and the 5xx boundary, recovery gets its E2E, the Referer is sent	2026-10-31 12:59:28 +01:00
lilleman	03d7be61b3	Keep the code-flow submit within the function limits and list its routes	2026-10-31 12:43:16 +01:00
lilleman	ead604f49d	Accept a verification or recovery code pasted with whitespace around it	2026-10-31 12:41:11 +01:00
lilleman	2170ca728b	Answer stability round 1: 0 🔴, 1 🟡 (0 misread); the order test requires both base rules, a chip's dot goes where the native box shows	2026-10-31 12:25:23 +01:00
lilleman	d0e1de96b8	Show which filter segment or chip is selected and focused without :has()	2026-10-31 12:19:21 +01:00
lilleman	5a204facdb	Answer stability round 1: 0 🔴, 7 🟡 (0 misread); range and or media syntax fail, an or operand guards nothing, the anchoring guard splits from position-try-fallbacks, the casts go, the filters and at-rules are tested	2026-10-31 12:13:32 +01:00
lilleman	7ff8140e07	Fail the gate on a stylesheet feature the browser floor lacks, unless an @supports guards it	2026-10-31 11:52:17 +01:00
lilleman	35f71d435b	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); tests pin all three user-page modes and the refusal page's group, the guard checks membership before the per-permission walk, logs the action and what was lost	2026-10-31 11:02:47 +01:00
lilleman	ad812e17c2	Refuse a group change that would lock the acting admin out, and title a read-only user page View user	2026-10-31 10:47:47 +01:00
lilleman	c1abc67a92	Answer prose round 1: 0 🔴, 2 🟡 (0 misread); the harness and plugins-test comments and the README clause are gone, the admin pointers name the full path	2026-10-31 10:37:15 +01:00
lilleman	71b12a6c0a	Split src/http/app.test.ts into one file per concern, and reset the reading-cost trend	2026-10-31 10:35:08 +01:00
lilleman	65e2340e49	Answer stability round 1: 0 🔴, 4 🟡 (0 misread); the serve path streams its hash and answers an unreadable file 500 with a log, cached deployments skip the per-href stat, tests for the pre-context error page and the size half of the memo	2026-10-31 10:25:19 +01:00
lilleman	c38ad74e3a	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); a changed file, not a release, changes the hash; the memo comment, the CHANGELOG scope and smaller comment cuts	2026-10-31 10:16:05 +01:00
lilleman	3d757d4726	item-34 - Serve every /public/ asset under a content-versioned URL with an immutable Cache-Control	2026-10-31 10:00:03 +01:00
lilleman	85bfadd040	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); allow the stale-save 409 in the e2e console guard, report a partial save when Keto cannot be read again, add the missing group, no-op and plain-login tests	2026-10-31 09:46:17 +01:00
lilleman	f4969d5c1f	Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale	2026-10-31 09:34:05 +01:00
lilleman	943520566e	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); shorten the return-target comment, state why /settings is public, drop the test restatements	2026-10-31 09:10:57 +01:00
lilleman	8d1e8be6fc	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); pin the 503 on a non-401 failure and the language-only return target	2026-10-31 09:10:57 +01:00
lilleman	2a4ed30e93	Redirect an anonymous hit on /settings to sign-in with the page as return_to	2026-10-31 09:04:55 +01:00