77 Commits

Author	SHA1	Message	Date
lilleman	3d757d4726	item-34 - Serve every /public/ asset under a content-versioned URL with an immutable Cache-Control	2026-10-31 10:00:03 +01:00
lilleman	85bfadd040	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); allow the stale-save 409 in the e2e console guard, report a partial save when Keto cannot be read again, add the missing group, no-op and plain-login tests	2026-10-31 09:46:17 +01:00
lilleman	f4969d5c1f	Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale	2026-10-31 09:34:05 +01:00
lilleman	943520566e	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); shorten the return-target comment, state why /settings is public, drop the test restatements	2026-10-31 09:10:57 +01:00
lilleman	2a4ed30e93	Redirect an anonymous hit on /settings to sign-in with the page as return_to	2026-10-31 09:04:55 +01:00
lilleman	4e7d897516	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); document the e2e typecheck, tighten comments and changelog	2026-10-31 08:24:18 +01:00
lilleman	cd46c77332	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); e2e tsconfig extends the root, icon removal declined per AGENTS.md	2026-10-31 08:24:18 +01:00
lilleman	520d2c928d	Visual E2E at five viewports, typecheck e2e-tests in the gate, drop unused icons	2026-10-31 08:20:16 +01:00
lilleman	21a00f895a	Answer stability round 1: 0 🔴, 1 🟡 (0 misread); test the drawer opens and a link in it navigates, keep the in-flow sidebar from stretching	2026-10-31 02:04:47 +01:00
lilleman	c12fd2742f	Answer stability round 2: 0 🔴, 2 🟡 (0 misread); make the order check able to fail, measure the page button, brand mark and forced dark	2026-10-31 01:34:42 +01:00
lilleman	a190166421	Answer stability round 1: 1 🔴, 6 🟡 (0 misread); hide the theme switch after its base rule, hide inert nav toggles, test the rendered result	2026-10-31 01:32:26 +01:00
lilleman	1dfc6aac3a	Set Cache-Control on every rendered page, and record the CSRF token's unbinding	2026-10-30 21:28:14 +01:00
renovate-bot	c9e25f2852	Update Node.js to v24.22.2 ... Release-Bump: patch	2026-10-29 04:18:28 +00:00
renovate-bot	785230673b	Update Node.js to v24.22.1 ... Release-Bump: patch	2026-10-22 04:19:07 +00:00
renovate-bot	b09f8b7eb6	Update Node.js to v24.22.0 ... Release-Bump: minor	2026-10-19 04:19:17 +00:00
renovate-bot	946c45663f	Update Playwright to v1.64.1	2026-10-15 04:19:16 +00:00
renovate-bot	ff548a30d2	Update Playwright to v1.64.0	2026-10-13 04:18:09 +00:00
lilleman	58767cb53e	Say what the comment is for, not what the bug was	2026-09-10 16:16:35 +02:00
lilleman	16873662b9	Keep the reader in place when the drawer closes, and stop the CSS promising a header it deleted	2026-09-10 16:16:35 +02:00
lilleman	53ab35bfb8	A page is a document: drop the sticky chrome and the bounded-frame opt-out	2026-09-10 16:16:35 +02:00
lilleman	60aa8a888e	Point the contract doc at a heading that exists, and let the table say which axes it scrolls	2026-09-10 16:16:35 +02:00
lilleman	2f29853121	Make the scroll-lock test able to fail, and name the tell a broken chain actually shows	2026-09-10 16:16:35 +02:00
lilleman	41aa59d05d	One home per fact: cut the copied rationale, and give the seam test room to mean something	2026-09-10 16:16:35 +02:00
lilleman	cb4f8d6e98	Name the table's local after the class it applies, and let a broken chain show itself	2026-09-10 16:16:35 +02:00
lilleman	696da397e7	Split the fill seam where ownership splits: the shell bounds, the page fills	2026-09-10 16:16:35 +02:00
lilleman	7f2c0cc2c2	Name the bounded frame: fill:true on the shell, and the contract minor that ships it	2026-09-10 16:16:35 +02:00
lilleman	b9129fba08	Scroll the document by default; a bounded region is a page's own opt-in	2026-09-10 16:16:35 +02:00
renovate-bot	bebefeafde	Update Node.js to v24.21.0 ... Release-Bump: minor	2026-09-10 04:18:10 +00:00
renovate-bot	ea320f6a28	Update Playwright to v1.63.0	2026-09-05 04:18:23 +00:00
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent	2026-09-02 18:24:56 +02:00
lilleman	6a0d11d9d3	Name exactly one gate on every declaration, and own a shift by identity id	2026-09-02 14:00:04 +02:00
lilleman	bf146c07e7	Bump the contract for the new gate, and close the ways it could read as open	2026-09-02 08:36:16 +02:00
lilleman	c7e6d66750	Scope My shifts at the upstream, and give Route and NavNode one gate declaration	2026-09-02 08:15:08 +02:00
lilleman	8da75b4ca7	Gate a route or nav node on a session, not only a permission	2026-09-02 07:36:08 +02:00
renovate-bot	7bde22713f	Update Node.js to v24.20.0 ... Release-Bump: minor	2026-08-28 04:18:08 +00:00
lilleman	0ad4c6b09c	Say what the browser gives a popover trigger, and pin the part all engines can prove	2026-08-26 09:10:46 +02:00
lilleman	fa7cad1d65	Declare plugin settings in the manifest, resolve them from the environment	2026-08-23 13:17:03 +02:00
lilleman	4b48bc2416	Scope Release-Bump to the surfaces that ship, and drop the inert package.json versions	2026-08-20 22:43:36 +02:00
lilleman	a005acb93d	Cut non-essential prose from docs and comments, and require the same of every future change ... README loses the competitor comparison, the personas and the repeated philosophy; the five near-identical E2E command blocks become a table plus one command, and the file map a clause per entry. AGENTS.md keeps every decision but drops the narrative around them. todo.md's completed items collapse to their task line — git holds the rest. Comments lose restatement, README duplication and history ("used to", "originally", dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on every change rather than a one-off cleanup. src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README states the command once instead of per suite.	2026-08-05 23:41:12 +02:00
lilleman	1cf34a0d45	Harden the artifact-ownership guards and document the root-owned upgrade trap	2026-08-05 22:40:36 +02:00
lilleman	073ec294e9	Run the E2E runner as the invoking user so its artifacts aren't root-owned	2026-08-05 22:25:17 +02:00
lilleman	38ebe40398	Never fail the boot on operator env; drop unusable ADMIN_PERMISSIONS with a warning	2026-08-05 17:36:04 +02:00
lilleman	edcd9fefc8	Deleting a group revokes the permissions it granted	2026-08-05 15:39:08 +02:00
lilleman	29d654c012	Permissions are a fixed list from plugin code; grant them on Users and Groups	2026-08-05 15:38:21 +02:00
lilleman	27fee5f8a3	Permission names are <resource>:<action>, replacing the catch-all admin permission	2026-08-05 15:37:39 +02:00
lilleman	690d67728b	Watch what a beforeAll logs, and record where each message came from	2026-08-05 11:15:37 +02:00
lilleman	e808f87fbd	Fail an E2E test on anything the browser logs, in all three engines	2026-08-05 11:00:25 +02:00
lilleman	9cf6c05325	Name the chrome's language menu and guard anchor positioning in the fallback	2026-08-05 02:23:50 +02:00
lilleman	cfeee10fa8	Wrap each popover menu and give it a caller-named id	2026-08-05 01:58:11 +02:00
lilleman	5d9bdebf59	Close the popup menus on an outside click, via the popover API	2026-08-05 01:37:58 +02:00