dev #5

Merged

xavier merged 10 commits from dev into main 2026-08-15 10:45:58 +02:00

Conversation 0 Commits 10 Files changed 19 +742 -1401

xavier commented 2026-08-15 10:45:51 +02:00

Owner

Copy link

No description provided.

xavier added 10 commits 2026-08-15 10:45:51 +02:00

fix(web): suppress Zod 4.4.3 CSP-violation probe via jitless (v1.1.2 item 1) ... ae73b93520

Set zod's global jitless=true in a first-position side-effect module
(packages/web/src/zod-jitless.ts) fed by a new @s3-vedrfolnir/shared
zod-config subpath. The probe fires at first schema CONSTRUCTION
(shared's module init), not first parse — import order in main.tsx is
the load-bearing seam. Proxy untouched (Node has no CSP); JIT path was
already effectively disabled under the strict CSP, so behavior is
unchanged.

E2E: permanent DOM-event-based CSP-violation guard in
minio-happy-path.spec.ts test 1 (headless Chromium emits no console
message for this violation class — event listener is the only reliable
channel). Verified zero violations on Chromium AND Firefox against the
v1.1.1 image as negative control (1 violation there).

E2E fixture: compose.e2e.dropdown.yaml gains ALLOW_INSECURE_HTTP: 'on'
(latent gap — a clean stack bring-up returned 426 https_required and
broke 3 endpoint-allowlist tests); superseded backlog entry pruned.

docs/plans: v1.1.2 Plan layer appended; item 1 done through
dev/test/review, item 2 repro evidence recorded awaiting architect
decision (D2).

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(arch): ADR #25 addendum — Zod eval-probe suppressed at the library seam (v1.1.2) ... fb1a8defce

Records the v1.1.2 jitless resolution: suppression via global config at
the seam (ADR #32 pattern, no CSP widening), the construction-not-parse
probe mechanics that make import order load-bearing, and the
event-not-console verification posture.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(plans): v1.1.2 — record D2 decision, T1.4 closure, R5 Option-C verification ... aa3ecc5901

D2 decided by the architect (bump REJECTED — 11.21.0 crashes
identically; pnpm 12 RC ineligible). Root cause confirmed composite:
pnpm consumes minimumReleaseAge as unvalidated numeric minutes; our
out-of-spec string '7d' -> NaN -> Invalid Date -> RangeError, and the
7-day gate has been illusory (no package ever age-checked). D2.4
proposes Option C (numeric 10080 + delete all crash-workaround
excludes) — a code change, so a Principal scope-amendment gate (D3)
now precedes any implementation.

T2.2/R5 verified Option C on pnpm 11.20.0 in scratch: frozen path
clean (461 entries age-verified), fresh resolution clean (R1 crash
path; @codemirror/state@6.7.1 resolves; no genuinely-young dep
trips), positive control refuses a ~1d-old version with a
well-formed readable cutoff (the previously-throwing expression),
config hygiene clean. Evidence: /tmp/opencode/item2-r5/.

T1.4 closed: architect's ADR #25 addendum landed as fb1a8de. Item 1
fully closed.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(plans): close v1.1 + v1.1.1 — delete shipped version files ... 48438db626

Tags v1.1 (756bbd5) and v1.1.1 (4019374) are on the forge; per
AGENTS.md the working tree holds only active versions. Git at the tag is
the permanent record.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs: unit-test count wording — 'more than 2500 tests' (AGENTS.md, ARCHITECTURE.md) ... 4d80eb2639

Replaces the stale ~1330 figure (actual: 2176 and growing) with the
Principal's preferred open-ended phrasing.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

fix: fix 3 mermaid diagrams code in architecture 5f513ecd0e

fix(supply-chain): make the 7-day age gate real — numeric minimumReleaseAge (v1.1.2 item 2, Option C) ... 910d598fbf

pnpm 11.20.0/11.21.0 consume minimumReleaseAge as unvalidated
numeric minutes. The out-of-spec string '7d' silently disabled the
age gate entirely (no package was ever age-checked) AND crashed any
fresh resolution with 'Invalid time value' at
detectMinReleaseAgeViolation — the 26 minimumReleaseAgeExclude
entries were crash-symptom suppressors, not age-gate bypasses.

Principal-approved scope amendment (D3, Option C per the architect's
D2.4): minimumReleaseAge: 10080 (numeric minutes = exactly 7d), all
excludes deleted, comment block reframed truthfully (strict gate via
minimumReleaseAgeStrict default-on; load-bearing numeric type;
excludes remain the mechanism for future audited young pins; ref ADR
#36 — architect's imminent follow-up).

Evidence: R5 scratch verification (/tmp/opencode/item2-r5/) — frozen
path clean (461 entries age-verified), fresh resolution clean (R1
crash path), positive control refuses a ~1d-old version with a
well-formed readable cutoff. Tree gate: frozen install clean, lockfile
untouched (sha identical), 2176 unit tests, typecheck, lint, build,
all three check:* gates.

Review rework (T2.5c): stale '7d' literal in ci.yml's install-step
comment rewritten; CONTRIBUTING.md crash-workaround prose (§2 callout
+ §9 subsection) pruned/rewritten to the current truth. Backlog:
raw candidate added to re-evaluate pnpm deploy --legacy (same root
cause, likely unblocked). Pin sites unmoved — pnpm stays 11.20.0.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(arch): ADR #36 — age gate made real (numeric minimumReleaseAge) + AGENTS.md prose correction (v1.1.2 T2.6c) ... 9d3083c263

Closes the architect pass routed in the Wave S landing (781a31b):
ADR #36 records the full Option-C story — pnpm 11's unvalidated
minimumReleaseAge consumed as raw numeric minutes; the out-of-spec
string '7d' that silently disabled the 7-day gate since its
introduction (never age-checked anything) and crashed fresh resolution;
bump rejected (11.21.0 identical bug, pnpm 12 RC); numeric 10080 +
all 26 crash-workaround excludes deleted; strict default-deny posture;
R5 verification evidence; upstream issue pending (T2.7c, link appended
when filed).

AGENTS.md supply-chain prose corrected in the same pass per D2.3
(documented behavior, not intent): numeric type is load-bearing,
hard-fail posture, exclude mechanism for future young pins.

ARCHITECTURE.md: package-manager row now records the deliberate
11.20.0 pin with ADR #36.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(plans): v1.1.2 — T2.6c done, architect ADR #36 pass landed (80dc160) ... 96da927430

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

fix(web): cancel object-ops dialog auto-close on unmount (v1.1.2 item 3) ... b9ee4ad4fc

Root cause of the 'Stop button cancels mid-loop' CI flake: success-path
tests left a live 1.2s setTimeout(onClose) that survived RTL cleanup();
under CI load it fired inside a later test's locate-Stop->click gap,
unmounting the dialog mid-test so the click hit a detached node and
cancelRef never flipped — the loop ran to the 3rd key ('called 2 times,
but got 3'). Fix at the component seam: a file-local useAutoClose hook
(ref-held timer id, cleared before rescheduling + on unmount) replaces
all seven bare timeout sites. No production behavior change (close()
is idempotent; delay and close semantics identical while mounted).

Regression test ('unmount cancels the pending success auto-close', real
timers) fails against the pre-fix component and passes with it. Gate:
2177 unit tests, typecheck, lint, build, all check:* green; 10x file
runs + 3x web suite + 2-CPU concurrent stress all clean. Plans updated
(item 3, Principal-directed scope amendment 2026-08-15; reviewer's two
doc corrections applied); revokeObjectURL 0-ms defers recorded in
backlog.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

xavier merged commit b9ee4ad4fc into main 2026-08-15 10:45:58 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

xavier/s3-vedrfolnir!5

No description provided.