90 Commits

Author	SHA1	Message	Date
renovate-bot	f3ebea3c80	Update Playwright to v1.65.0	2026-11-08 23:26:25 +01:00
renovate-bot	3f07c3e649	Update Node.js to v26 ... Release-Bump: major	2026-11-08 23:26:03 +01:00
lilleman	2de7e4d79c	Answer product-owner round 1: 0 🔴, 1 🟡 (0 misread); a Remove confirms with its own notice, the hint no longer says to remove, the example README names the list	2026-11-08 22:15:54 +01:00
lilleman	4d2e7b59fd	List grants no plugin declares with a Remove, and save a permission change as one Keto transaction	2026-11-08 22:04:52 +01:00
lilleman	05da1d7897	Rename the admin example plugin to auth-admin, and let config/menu.ts hide or rename a profile-menu entry	2026-11-08 21:25:11 +01:00
lilleman	523e8b3724	Answer stability round 1: 1 🔴, 3 🟡 (0 misread); scope the visual selector, check label and cover the gaps	2026-11-08 19:25:57 +01:00
lilleman	a558f8340f	Answer prose round 1: 0 🔴, 0 🟡 (0 misread); apply the nits	2026-11-08 19:25:57 +01:00
lilleman	777c0bd86d	Let a plugin add links to the profile menu, and list the setting conflict kind	2026-11-08 19:17:57 +01:00
renovate-bot	99d5928b1d	Update axllent/mailpit Docker tag to v1.33.1	2026-11-08 04:18:29 +00:00
lilleman	29fac748f9	Compare the repeat view's stylesheets in any order, since WebKit finishes cache hits in no set order	2026-11-03 21:50:13 +01:00
lilleman	00fe8b0dd2	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the admin recovery journey gets an E2E, the Kratos comments no longer claim a mailed link	2026-10-31 13:11:21 +01:00
lilleman	29d496a02e	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the submit test pins manual redirects and the 5xx boundary, recovery gets its E2E, the Referer is sent	2026-10-31 12:59:28 +01:00
lilleman	ead604f49d	Accept a verification or recovery code pasted with whitespace around it	2026-10-31 12:41:11 +01:00
lilleman	3d757d4726	item-34 - Serve every /public/ asset under a content-versioned URL with an immutable Cache-Control	2026-10-31 10:00:03 +01:00
lilleman	85bfadd040	Answer stability round 1: 1 🔴, 4 🟡 (0 misread); allow the stale-save 409 in the e2e console guard, report a partial save when Keto cannot be read again, add the missing group, no-op and plain-login tests	2026-10-31 09:46:17 +01:00
lilleman	f4969d5c1f	Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale	2026-10-31 09:34:05 +01:00
lilleman	943520566e	Answer prose round 1: 0 🔴, 5 🟡 (0 misread); shorten the return-target comment, state why /settings is public, drop the test restatements	2026-10-31 09:10:57 +01:00
lilleman	2a4ed30e93	Redirect an anonymous hit on /settings to sign-in with the page as return_to	2026-10-31 09:04:55 +01:00
lilleman	4e7d897516	Answer prose round 1: 0 🔴, 4 🟡 (0 misread); document the e2e typecheck, tighten comments and changelog	2026-10-31 08:24:18 +01:00
lilleman	cd46c77332	Answer stability round 1: 0 🔴, 2 🟡 (0 misread); e2e tsconfig extends the root, icon removal declined per AGENTS.md	2026-10-31 08:24:18 +01:00
lilleman	520d2c928d	Visual E2E at five viewports, typecheck e2e-tests in the gate, drop unused icons	2026-10-31 08:20:16 +01:00
lilleman	21a00f895a	Answer stability round 1: 0 🔴, 1 🟡 (0 misread); test the drawer opens and a link in it navigates, keep the in-flow sidebar from stretching	2026-10-31 02:04:47 +01:00
lilleman	c12fd2742f	Answer stability round 2: 0 🔴, 2 🟡 (0 misread); make the order check able to fail, measure the page button, brand mark and forced dark	2026-10-31 01:34:42 +01:00
lilleman	a190166421	Answer stability round 1: 1 🔴, 6 🟡 (0 misread); hide the theme switch after its base rule, hide inert nav toggles, test the rendered result	2026-10-31 01:32:26 +01:00
lilleman	1dfc6aac3a	Set Cache-Control on every rendered page, and record the CSRF token's unbinding	2026-10-30 21:28:14 +01:00
renovate-bot	c9e25f2852	Update Node.js to v24.22.2 ... Release-Bump: patch	2026-10-29 04:18:28 +00:00
renovate-bot	785230673b	Update Node.js to v24.22.1 ... Release-Bump: patch	2026-10-22 04:19:07 +00:00
renovate-bot	b09f8b7eb6	Update Node.js to v24.22.0 ... Release-Bump: minor	2026-10-19 04:19:17 +00:00
renovate-bot	946c45663f	Update Playwright to v1.64.1	2026-10-15 04:19:16 +00:00
renovate-bot	ff548a30d2	Update Playwright to v1.64.0	2026-10-13 04:18:09 +00:00
lilleman	58767cb53e	Say what the comment is for, not what the bug was	2026-09-10 16:16:35 +02:00
lilleman	16873662b9	Keep the reader in place when the drawer closes, and stop the CSS promising a header it deleted	2026-09-10 16:16:35 +02:00
lilleman	53ab35bfb8	A page is a document: drop the sticky chrome and the bounded-frame opt-out	2026-09-10 16:16:35 +02:00
lilleman	60aa8a888e	Point the contract doc at a heading that exists, and let the table say which axes it scrolls	2026-09-10 16:16:35 +02:00
lilleman	2f29853121	Make the scroll-lock test able to fail, and name the tell a broken chain actually shows	2026-09-10 16:16:35 +02:00
lilleman	41aa59d05d	One home per fact: cut the copied rationale, and give the seam test room to mean something	2026-09-10 16:16:35 +02:00
lilleman	cb4f8d6e98	Name the table's local after the class it applies, and let a broken chain show itself	2026-09-10 16:16:35 +02:00
lilleman	696da397e7	Split the fill seam where ownership splits: the shell bounds, the page fills	2026-09-10 16:16:35 +02:00
lilleman	7f2c0cc2c2	Name the bounded frame: fill:true on the shell, and the contract minor that ships it	2026-09-10 16:16:35 +02:00
lilleman	b9129fba08	Scroll the document by default; a bounded region is a page's own opt-in	2026-09-10 16:16:35 +02:00
renovate-bot	bebefeafde	Update Node.js to v24.21.0 ... Release-Bump: minor	2026-09-10 04:18:10 +00:00
renovate-bot	ea320f6a28	Update Playwright to v1.63.0	2026-09-05 04:18:23 +00:00
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent	2026-09-02 18:24:56 +02:00
lilleman	6a0d11d9d3	Name exactly one gate on every declaration, and own a shift by identity id	2026-09-02 14:00:04 +02:00
lilleman	bf146c07e7	Bump the contract for the new gate, and close the ways it could read as open	2026-09-02 08:36:16 +02:00
lilleman	c7e6d66750	Scope My shifts at the upstream, and give Route and NavNode one gate declaration	2026-09-02 08:15:08 +02:00
lilleman	8da75b4ca7	Gate a route or nav node on a session, not only a permission	2026-09-02 07:36:08 +02:00
renovate-bot	7bde22713f	Update Node.js to v24.20.0 ... Release-Bump: minor	2026-08-28 04:18:08 +00:00
lilleman	0ad4c6b09c	Say what the browser gives a popover trigger, and pin the part all engines can prove	2026-08-26 09:10:46 +02:00
lilleman	fa7cad1d65	Declare plugin settings in the manifest, resolve them from the environment	2026-08-23 13:17:03 +02:00