Changeset 0.28.2.2 (#185)
This commit is contained in:
@@ -24,13 +24,14 @@ v0.9.x–v0.27.5 Foundation → Extensions → Surfaces → Auth ✅
|
||||
│
|
||||
v0.28.0 Platform Polish
|
||||
├─ v0.28.1 Surfaces ICD audit ✅
|
||||
├─ v0.28.2 ICD audit round 2
|
||||
├─ v0.28.3 Security tier (red team)
|
||||
├─ v0.28.4 Infrastructure
|
||||
├─ v0.28.2 ICD audit — all domains
|
||||
├─ v0.28.3 FE decomp + SDK prep
|
||||
├─ v0.28.4 Security tier (red team)
|
||||
├─ v0.28.5 Infrastructure
|
||||
│ (virtual scroll, KB auto-inject,
|
||||
│ Helm chart, provider model prefs,
|
||||
│ git credentials UI)
|
||||
└─ v0.28.5 Frontend SDK
|
||||
└─ v0.28.6 Frontend SDK
|
||||
│
|
||||
v0.29.0 Starlark Sandbox
|
||||
(eval loop, permissions, admin UI)
|
||||
@@ -57,7 +58,7 @@ v0.9.x–v0.27.5 Foundation → Extensions → Surfaces → Auth ✅
|
||||
|
||||
## v0.28.0 — Platform Polish
|
||||
|
||||
Audit arc, frontend SDK, and infrastructure improvements.
|
||||
Audit arc, frontend decomposition, security, and infrastructure improvements.
|
||||
|
||||
### v0.28.1 — Surfaces ICD Audit ✅
|
||||
- [x] ICD `surfaces.md` corrected (6 discrepancies: field name, archive format, response shape)
|
||||
@@ -66,15 +67,19 @@ Audit arc, frontend SDK, and infrastructure improvements.
|
||||
- [x] 22 handler-level tests + 14 store-level tests (PG + SQLite)
|
||||
- [x] CI timeout 8m → 12m for PG integration tests
|
||||
|
||||
### v0.28.2 — ICD Audit: Notifications + Profile + Knowledge + Notes + Providers
|
||||
Known ICD report failures to investigate (likely envelope shape mismatches):
|
||||
- [ ] `GET /settings` — `missing key "settings"` (profile)
|
||||
- [x] `GET /notifications/preferences` — `missing key "preferences"` (envelope fix)
|
||||
- [ ] `GET /workspaces` — `missing key "data"`
|
||||
- [ ] `GET /git-credentials` — `missing key "data"`
|
||||
- [ ] Notes, providers — passed clean but need full trace (route → handler → store → tests)
|
||||
- [ ] WebSocket event contract audit: document `message.created`, `workflow.advanced`,
|
||||
`presence.changed`, `typing`, `workflow.assigned` event shapes in ICD
|
||||
### v0.28.2 — ICD Audit: All Domains
|
||||
Full audit of every ICD document against code. Goal: ICD becomes the single
|
||||
source of truth. After this version, the workflow is ICD-first — update the
|
||||
contract before changing code.
|
||||
|
||||
**Methodology:** Read ICD → grep all source → trace route → handler → store
|
||||
(PG + SQLite) → tests → enforce `{"data": [...]}` envelope convention → fix
|
||||
ICD → fix code → fix runner → CI green. Final pass picks up straggling
|
||||
failures across all domains.
|
||||
|
||||
**Completed audits:**
|
||||
|
||||
*Notifications (cs0):*
|
||||
- [x] Notifications ICD audit: object shape, query params, response envelopes, WS events
|
||||
- [x] Notification type enum sync: remove aspirational types, add implemented types
|
||||
(`kb.ready`, `kb.error`, `grant.changed`, `task.budget_exceeded`)
|
||||
@@ -82,9 +87,9 @@ Known ICD report failures to investigate (likely envelope shape mismatches):
|
||||
- [x] Implement `user.mentioned` persisted notification (was WS-only)
|
||||
- [x] Implement `workflow.claimed` persisted notification (was WS-only)
|
||||
- [x] Remove dead `NotifTypeProjectInvite` constant
|
||||
- [ ] Notification handler + store tests (PG + SQLite)
|
||||
- [x] `GET /notifications/preferences` — envelope fix (`missing key "preferences"`)
|
||||
|
||||
**Knowledge ICD audit (cs1–cs4):**
|
||||
*Knowledge (cs1–cs4):*
|
||||
- [x] `knowledge.md` corrected: KB object shape (6 field mismatches), search envelope
|
||||
(`data` not `results`), search result fields, status progression (`extracting`
|
||||
step), file type support (text-only, not binary), auth annotations
|
||||
@@ -103,7 +108,54 @@ Known ICD report failures to investigate (likely envelope shape mismatches):
|
||||
`stores.Teams.IsTeamAdmin`; remove `database` import (cs4)
|
||||
- [x] Team-scoped KB creation test: member denied, team admin succeeds (cs4)
|
||||
|
||||
### v0.28.3 — Security Tier (ICD Runner Red Team)
|
||||
*Profile (cs5):*
|
||||
- [x] `profile.md` corrected: avatar API (was `multipart/form-data`, actually JSON
|
||||
base64), response shapes for all 7 endpoints, auth annotations, field table
|
||||
- [x] P0 fix: `GET /settings` returns bare object → wrapped in `{"settings": {...}}`
|
||||
- [x] `profileResponse` shape: add `last_login_at` field + dialect-safe time scan
|
||||
(`database.ST()` / `database.SNT()`), COALESCE guard on settings column
|
||||
- [x] Integration test harness: register all 7 profile/settings routes (was only
|
||||
`GET /profile`), remove stale `/avatar` route aliases
|
||||
- [x] New `profile_test.go`: GET profile shape, PUT profile (display_name, email,
|
||||
duplicate email 409), GET/PUT settings envelope, password change (success,
|
||||
wrong current 401, too short 400), avatar delete
|
||||
|
||||
*Workspaces (cs6):*
|
||||
- [x] `workspaces.md` corrected: workspace object shape (added `indexing_enabled`,
|
||||
`git_*` fields, `total_bytes` not `storage_bytes`, `owner_type` full enum),
|
||||
file entry shape (`is_directory`/`size_bytes` not `is_dir`/`size`), git status
|
||||
full shape, git log envelope (`{"data": [...]}`), git commit request (`paths`
|
||||
not `files`), archive format query param, auth annotations, all response shapes
|
||||
- [x] P0 fix: `GET /workspaces` returns bare array → `{"data": [...]}`
|
||||
- [x] P0 fix: `GET /git-credentials` returns bare array → `{"data": [...]}`
|
||||
- [x] Fix: `GET .../git/log` returns bare array → `{"data": [...]}` + nil slice guard
|
||||
- [x] New `workspace_test.go`: List empty envelope, list with data + shape, root_path
|
||||
not exposed, user isolation, GET by ID shape, not found 404, forbidden 403,
|
||||
git-credentials empty envelope, auth required (11 tests)
|
||||
|
||||
**Remaining audits:**
|
||||
|
||||
| Priority | ICD | Known failures | Notes |
|
||||
|----------|-----|----------------|-------|
|
||||
| 1 | `projects.md` | 0 | Passed clean, needs full trace |
|
||||
| 2 | `websocket.md` | — | Document event shapes only (not testable in runner) |
|
||||
|
||||
- [ ] Notification handler + store tests (PG + SQLite)
|
||||
- [ ] WebSocket event contract audit: document `message.created`, `workflow.advanced`,
|
||||
`presence.changed`, `typing`, `workflow.assigned` event shapes in ICD
|
||||
- [ ] Final straggler pass: run full ICD runner, fix any remaining failures
|
||||
|
||||
### v0.28.3 — Frontend Decomposition + ICD Audit SDK Prep
|
||||
Frontend JS decomposition and ICD runner hardening. Prepares the codebase
|
||||
for the SDK layer by untangling the current 15-file global soup.
|
||||
|
||||
- [ ] JS dependency audit: map every `window.*` global, cross-file call, init order
|
||||
- [ ] Extract shared primitives: toast, confirm, theme, API client into importable modules
|
||||
- [ ] ICD runner gains test tiers: `crud`, `envelope`, `security`, `sdk`
|
||||
- [ ] Runner coverage target: 100% of ICD-documented endpoints have at least one test
|
||||
- [ ] Document JS module graph and init sequence
|
||||
|
||||
### v0.28.4 — Security Tier (ICD Runner Red Team)
|
||||
New `security` tier in ICD test runner. Multi-user fixtures already exist.
|
||||
|
||||
**Auth boundary:**
|
||||
@@ -132,7 +184,7 @@ New `security` tier in ICD test runner. Multi-user fixtures already exist.
|
||||
- [ ] Visitor → escalate to authenticated user via crafted headers
|
||||
- [ ] Cross-visitor isolation: visitor A's cookie cannot read visitor B's messages
|
||||
|
||||
### v0.28.4 — Infrastructure
|
||||
### v0.28.5 — Infrastructure
|
||||
- [ ] Virtual scroll for long conversations (prerequisite for heavy task output channels)
|
||||
- [ ] KB auto-injection: top-K chunk prepend, context budget aware, per-channel toggle
|
||||
- [ ] Helm chart (replaces raw k8s manifests, `helm install switchboard ./chart`)
|
||||
@@ -146,7 +198,7 @@ New `security` tier in ICD test runner. Multi-user fixtures already exist.
|
||||
(`POST /admin/notifications/broadcast`), fan-out to all active users via
|
||||
`NotifyMany`, admin UI for composing announcements
|
||||
|
||||
### v0.28.5 — Frontend SDK
|
||||
### v0.28.6 — Frontend SDK
|
||||
`switchboard-sdk.js` — composition layer over existing globals. Surface
|
||||
authors consume a single coherent API instead of hunting through 15 JS files.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user