100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
timothyandOpenAI Codex	1e786c1f22	test(web): harden primary-action ownership regressions ... Refs #247 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 22:36:16 +02:00
timothyandOpenAI Codex	4efb1a1b03	refactor(web): replace primary-action events with context ... Refs #247 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 22:31:31 +02:00
timothyandOpenAI Codex	3876809a83	chore(web): clean up App imports after screen extraction ... Refs #246 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 21:51:42 +02:00
timothyandOpenAI Codex	e9fe12d1fd	refactor(web): extract Guide screen ... Move Guide rendering, timer and clipping helpers, and detailed behavior tests into a screen-owned module while retaining only shell composition coverage in App. Refs #246 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 21:49:56 +02:00
timothyandOpenAI Codex	bceffef856	refactor(web): extract Dashboard screen ... Move Dashboard rendering, health and on-air helpers, and detailed behavior tests into a screen-owned module while retaining only shell composition coverage in App. Refs #246 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-15 21:16:40 +02:00
timothyandOpenAI Codex	b37924545c	chore(ci): retry flaky Libraries screen test ... Retrigger CI after the existing Libraries scan-progress test failed once remotely but passed six consecutive local runs at the same documentation-only PR head. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:51:59 +02:00
timothyandOpenAI Codex	a54a2b6f82	chore(ci): retry runner setup for docs PR ... Retrigger CI after the migration job failed in Setup .NET while cleaning a missing runner-cache file, before any migration command executed. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:46:01 +02:00
timothyandOpenAI Codex	67bfc1ceb1	docs(queue): record cheap-worker launch config ... Record the tested GPT-5.4-Mini low-effort worker command, current spawn-agent limitation, and unsupported legacy model trap so future sessions can route bounded work without rediscovery. Refs #355 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:33:21 +02:00
timothyandOpenAI Codex	1e0eaca35e	docs(queue): start tool-bearing selectors at low effort ... Clarify that enabled web_search makes a cheap worker tool-bearing even when the selector intends to use only Gitea, reserve minimal for tool-free supplied-evidence synthesis, and require hard evidence/output caps. Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 20:03:57 +02:00
timothyandOpenAI Codex	7cbd871ab7	test(spa): close remaining playout gate gaps ... Cover the None action matrix, required add inputs, file-edit blank/trim/payload/refresh/error behavior, and clearing a default deco to null. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 19:22:41 +02:00
timothyandOpenAI Codex	6b41350e0c	test(spa): complete playout kind coverage ... Exercise default-deco persistence and errors plus the complete action, add-dialog, and edit-field kind matrices identified by cold review. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 19:12:56 +02:00
timothyandOpenAI Codex	533abe7cdb	refactor(spa): extract playouts screen ... Move the Playouts UI, route wrapper, helpers, and detailed behavior tests into a colocated screen module while preserving App-level navigation coverage. Refs #245 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 18:54:32 +02:00
timothyandOpenAI Codex	b9305fdee9	fix(spa): preserve remote drafts during save ... Disable and gate remote connection draft inputs while a save owns the current revision. Exercise the real App-owned route transition after a successful save so the regression proves the editor unmounts without a dirty prompt. Refs #344 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-14 00:06:29 +02:00
timothyandOpenAI Codex	3481f98bcc	fix(spa): clear dirty guard before saved navigation ... Fixes #344 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:47:43 +02:00
timothyandOpenAI Codex	e280e9072c	docs(queue): enumerate milestone candidates ... Refs #347 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:31:04 +02:00
timothyandOpenAI Codex	d235b91d15	docs(queue): preserve reviewer comment claims ... Fixes #347 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 23:20:50 +02:00
timothyandOpenAI Codex	b2c093d2d6	docs(e2e): record real media-source validation results ... Refs #333 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 22:51:52 +02:00
timothyandCodex	8da1256ffa	docs(workflow): enforce session-wide cost routing ... Fixes #342 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:43:11 +02:00
timothyandCodex	2609b4ce59	fix: add cross-origin resource policy header ... Fixes #330 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:25:06 +02:00
timothyandCodex	80751a5d74	docs: require low-cost queue selection preflight ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 20:56:23 +02:00
timothyandCodex	985eed072c	docs(release): prepare v26.8.0 promotion [decisions-edit] ... refs #335 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:50:39 +02:00
timothyandCodex	977f9125a5	docs: track #202 real-server integration validation ... refs #202 #333 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:05:04 +02:00
timothyandCodex	954aff21f1	docs: make issue queue handoff client-neutral ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 18:59:40 +02:00
timothyandClaude Opus 4.8	a042623a53	fix(ci): #314 review — reap ZAP container in the cleanup() trap; warn on missing semgrep ... Cold review of PR #331: - Move the ZAP-container reap from an inline post-scan line into cleanup() (the EXIT trap) so a SIGINT/timeout kill mid-scan can't leave it running. - semgrep absent now prints a stderr WARN instead of silently skipping the SAST pass (no false confidence for a release gate). refs #314 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:36:08 +02:00
timothyandClaude Opus 4.8	366d5d316c	feat(ci): #314 — repeatable black-box security scan (authenticated ZAP + semgrep) ... scripts/security-scan.sh: boots a THROWAWAY container from the image under test (fresh config volume; never the deployed prod/test container — the active scan attacks write endpoints), reads its machine key, and runs an authenticated OWASP ZAP api-scan that imports /openapi/v1.json (all 160 /api/v1 ops) and injects X-Api-Key on every request via a replacer rule so it reaches the [RequiresAuthentication] + RequireKeyForReads surface — then a semgrep SAST cross-check. Wrapped in `timeout` because zap-api-scan can hang in post-scan cleanup after the report is already written. docs/ci-cd.md: new 'Security scanning' section (out-of-ecosystem black-box gate, run on the docker host per-release like migration-smoke, not a per-PR CI job) + the Microsoft.OpenApi 2.7.5 pin note in dependency management. refs #314 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:28:13 +02:00
timothyandClaude Opus 4.8	940af13a5f	fix(deps): #314 — pin Microsoft.OpenApi 2.7.5 (GHSA-v5pm-xwqc-g5wc, High) ... Microsoft.AspNetCore.OpenApi 10.0.2 + Scalar.AspNetCore pull Microsoft.OpenApi 2.0.0 transitively — High severity (stack overflow parsing a circular $ref; fixed in 2.7.5). Direct-pin 2.7.5 in CPM + a direct ErsatzTV PackageReference so the override actually resolves (the #8 SQLitePCLRaw transitive-override pattern). Build clean (transformers compile unchanged against 2.7.5), v1.json byte-identical (no OpenAPI-output change), ErsatzTV + ErsatzTV.Tests both vuln-clear, 198 OpenAPI/contract/security tests green. refs #314 #8 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:09:30 +02:00
timothyandClaude Opus 4.8	2e4e07a207	fix(#172): review B1 — sync 404 metadata test + extend create-group trim to Deco/DecoTemplate ... Cold review (PR #325) caught that removing the unreachable 404 from BlockController/TemplateController.CreateGroup left ApiErrorResponseMetadataTests still asserting those ops document 404 -> red Build & test. Removed those two stale assertions. For spec consistency, extended the trim to the two OTHER create-group actions carrying the same unreachable 404 (DecoController, DecoTemplateController -- their Create*GroupHandler only do a duplicate-name AnyAsync -> 422, never a lookup that 404s). Net: all four CreateGroup 404 assertions removed (422 siblings kept), both controllers trimmed, v1.json regenerated (4 unreachable 404 blocks gone total). PlaylistController.CreateGroup already carried no 404. Refs #172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:16:52 +02:00
timothyandClaude Opus 4.8	216130b4d7	fix(#172): API hardening — null-name 500s, duplicate template items, unreachable 404 ... Clears the still-live findings from #172 (verified against main; #2/#4/#7 and the auth/search/Trakt tail were already deliberate-documented or fixed since 2026-07-07). - Null/empty Name → 500 (10 create/replace handlers). Block/Template/DecoTemplate/Deco Create+Replace/Update + UpdateFFmpegProfile did `request.Name.Length > 50` on a client-nullable string → unhandled NullReferenceException → HTTP 500 (no global exception filter). Now `string.IsNullOrWhiteSpace(request.Name) || .Length > 50` → 422; also rejects empty/whitespace names, matching the group-create handlers' NotEmpty behavior. CreatePlaylist coalesces null→"" at the DTO so it was an empty-name persist, not a 500; guarded the same way. - ReplaceTemplateItems overlap validation iterated with an `item == otherItem` record value-equality skip, so two exact-duplicate items were value-equal and bypassed the intersection check (both persisted). Now index-based (i != j) so duplicates register as a self-intersection and are rejected 422. - Trimmed the unreachable 404 ProducesResponseType from POST /api/blocks/groups and POST /api/templates/groups (a create has no parent lookup that can 404); v1.json regenerated. - Regression tests: all 10 name-guard paths + the duplicate-items path (19 cases). - Docs: decisions.md entry + api-conventions.md §3b null-safe-validation bullet. fixes #172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:16:52 +02:00
timothyandClaude Opus 4.8	682dceec8f	fix(api): #286 review — allowlist non-/api routes in the versioning test; base-url-aware deprecation Link ... Cold-fork + Codex review of PR #326: - ApiRouteVersioningTests: iterate IRouteTemplateProvider (covers a template-less [HttpGet] paired with an action-level [Route]) and assert any non-/api route against an explicit KnownNonApiRoutes allowlist instead of silently skipping — an accidental absolute non-/api route (which would also escape ApiAuthorizationFilter's /api-scoped gate) now fails the test. - ApiVersionRewriteMiddleware: root the deprecation Link at Request.PathBase so it stays correct under ETV_BASE_URL (</etv/docs>, not host-root </docs>). refs #286 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:40:58 +02:00
timothyandClaude Opus 4.8	ef2bd65c27	feat(api): #286 — mount the whole /api surface at /api/v1 ... Version every /api route to /api/v1 (251 controller routes + ~24 Location headers + the scanner callback URL + the Startup request-log literal), uniform across the machine API, auth, scanner and scripted-build surfaces. Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth headers and query survive — carrying RFC 8594 Deprecation/Sunset headers, so curl / the future MCP server / bookmarks keep working. An already- versioned path passes through; a future /api/v2 is never forced to v1. Standardize the route convention (leading-slash absolute route per method, no class-[Route] — except the two Scanner/Scripted controllers whose ~all actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests (^/api/v\d+/ over the whole Controllers.Api surface; browser-nav /auth/oidc/login is out of scope). Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945 SPA request literals + the test mocks (regex + positional URL parsers). /api/v1 is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases (owner decision) with removal tracked as a Phase-3 follow-up. Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/ blazor-route-parity/e2e-local/domain-model. fixes #286 refs #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:30:20 +02:00
timothyandClaude Opus 4.8	51b67dea06	fix(#238): review — trakt sub-route no-op + data-driven wiring test ... Cold-review follow-ups (both non-blocking): - Low: the TopBar "Add Trakt List" button was a silent no-op on the /app/trakt-lists/{id} detail sub-route (setAddOpen state isn't rendered by the editor branch, and the screen is keyed by pathname so the state wouldn't survive a navigate). Guard on editingId: route back to the list from the detail view, open the dialog from the list. - Nit: the invariant test only spot-checked 2 screens. Replaced with a data-driven it.each over the 4 URL-navigating create screens (channels, filler, ffmpeg, watermarks) asserting each banner actually navigates — a typo'd route id now fails red. Docs wording corrected to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothyandClaude Opus 4.8	612b11589c	fix(#238): wire TopBar primary-action on create screens, drop dead buttons ... The shell TopBar rendered a primary-action button (Plus icon) for every screen, but only SchedulesScreen subscribed to its ctv:primary-action event — so every other screen's button was dead (a labelled no-op, or a bare "+" for the ~10 routes whose primaryAction was ''). Resolution (issue #238): the Plus-icon button is a "create new item" affordance. Keep + wire it only on the 8 list screens with a single create flow (channels, schedules, multi/rerun collections, trakt lists, filler presets, ffmpeg profiles, watermarks) via a shared usePrimaryAction hook (web/src/primaryAction.ts); drop it (primaryAction: '') everywhere else — where the action isn't a create (Save/Refresh/Play/Validate/Reset/Scan, all of which have correct in-body controls), is ambiguous (collections tabs), a silent no-op (builder, playlists), or misplaced (dashboard, libraries). The TopBar now renders the button only when primaryAction is non-empty. Also relabels the apiKey route's stale post-#295 "Save key"/description. Docs: spa-conventions.md §10 + decisions.md 2026-07-12. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothy	ffece01c32	style: #265 — normalize whitespace in the 11 touched files (format gate #311) ... The fix-as-you-touch format gate requires every .cs this PR touches to fully conform to .editorconfig, including pre-existing whitespace on lines the change didn't edit. dotnet format (whitespace) applied to the 11 touched files; legacy files left untouched (no big-bang reformat). Whitespace/layout only — no behavior change. Refs #265	2026-07-12 23:21:00 +02:00
timothy	50cd29d841	fix(api): #265 review — quote-aware If-Match scanner, RFC OWS trim, de-BOM ... Independent review fix commit (cold fork MERGEABLE-WITH-NITS + Codex BLOCKED, 2 Highs): - Codex H1: a comma (0x2C) is a valid etagc and can appear INSIDE a quoted opaque-tag ("3,5" is ONE tag). The old Split(',') broke it into two malformed tokens → 400. Replaced with a quote-aware position scanner that treats a comma as a separator only outside the quotes; "3,5" is now one valid non-canonical tag → 412. - Codex H2: RFC 7230 OWS is SP/HTAB only. string.Trim() also strips NBSP and other Unicode whitespace, letting " * " masquerade as the "*" force-write escape. Trim only (' ', '\t'); such input is now Malformed → 400. - Fork nit: corrected the canonical-guard comment (interior-whitespace tags are rejected by IsEtagc, not NumberStyles.None). - CI Formatting gate: de-BOM the 8 touched legacy Application .cs (charset=utf-8, #311/#310). - Tests: added comma-in-tag ("3,5", "x,y","3"), empty-element tolerance, NBSP-not-OWS, trailing-junk, lowercase-weak, wildcard-in-list cases. Full ErsatzTV.Tests green (1556). Refs #253 #197	2026-07-12 23:09:36 +02:00
timothyandClaude Opus 4.8	8090e10408	fix(api): #265 — If-Match evaluates per RFC 7232 (valid-but-non-matching → 412, not 400) ... The shared optimistic-concurrency parser (ConcurrencyHeaders.ParseIfMatch) classified any non-canonical/weak/list If-Match value as Malformed → 400. Per RFC 7232 §3.1 a syntactically -valid entity-tag that simply doesn't strong-match must be 412; 400 is only for a genuine grammar violation. - Rewrite ParseIfMatch as a real RFC 7232 entity-tag/list parser: walks the comma-separated 1#entity-tag list, validates each [W/]DQUOTE *etagc DQUOTE member, and collects the strong members whose opaque text is our canonical decimal. Weak / empty / non-canonical / out-of-range tags are valid but contribute no version (→ empty set → 412); genuine grammar violations (unquoted, SP-in-tag, unterminated, garbage) → 400. - Reshape IfMatchCondition.ExpectedVersion : Option<int> → ExpectedVersions : Option<Seq<int>> and VersionedAggregateExtensions.CheckVersion → set membership (any strong match proceeds; empty set always 412). Threads through 10 replace/update commands + handlers + request mappers + 9 controllers. - No wire-contract change (400 + 412 already declared on every PUT; the field is header-derived and internal — no DTO/route/response-type/OpenAPI change). - Tests: ConcurrencyHeadersTests rewritten for the new classification (lists, weak, empty, non-canonical → Version/empty-set; grammar violations → Malformed) + new VersionedAggregateExtensionsTests for CheckVersion membership/empty-set/force-write. - Docs: api-conventions.md §7a rewritten; decisions.md entry appended. Refs #253 #197 fixes #265 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:09:36 +02:00
timothyandClaude Opus 4.8	6537697fe5	test(#319): hash-drift guard prefers the built index.html when present ... Addresses the cold-review LOW: the guard hashed only the committed source web/index.html, so a hypothetical future Vite transform of the inline script would leave the test green while the deployed CSP silently broke the SPA. It now hashes the built wwwroot/app/index.html when it exists (the exact bytes the browser hashes — full coverage on any local build), falling back to the source only in a fresh CI checkout where the built artifact is gitignored/absent. Vite copies the inline script verbatim today, so the two agree. Doc comments + decisions.md synced. Test-and-docs only; no production code change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:41:24 +02:00
timothyandClaude Opus 4.8	873b3e54a5	security(#319): enforcing CSP + Permissions-Policy on the host ... Completes the CSP the #279 baseline-headers middleware deferred. Surfaced by the #314 ZAP baseline (missing CSP/Permissions-Policy WARNs); a #197 exit item. SecurityHeadersMiddleware now also sets Permissions-Policy (deny-all for camera/mic/geolocation/payment/usb) and an enforcing Content-Security-Policy on every response EXCEPT /docs (Scalar) and /openapi — those rely on inline bootstrap scripts/styles a strict policy would break (baseline headers still apply; hardening that admin surface is a #197 follow-up). CSP: default-src 'self'; script-src 'self' + the hash of the SPA's inline theme-bootstrap script (no 'unsafe-inline'/'unsafe-eval'); style-src adds 'unsafe-inline' (React inline styles) + fonts.googleapis.com; font-src adds fonts.gstatic.com; img-src adds data:/blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'. The Google Fonts allowance (the SPA CSS @imports the Geist web font) was caught by live-E2E, which the static recon missed. A guard test hashes the committed web/index.html inline script and fails if it drifts from the middleware constant (the built wwwroot/app is gitignored/absent in CI, and Vite copies the inline script verbatim). Verified: full test pass, live-E2E (SPA renders clean, zero CSP violations), curl (CSP present on /app + /api, absent on /docs + /openapi). Docs: docs/decisions.md entry. fixes #319 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:36:44 +02:00
timothyandClaude Opus 4.8	be9cf5f381	fix(ci): build before GenerateOpenApiDocuments in update-openapi.sh ... The new api-docs gate (#303 H4/H5) runs update-openapi.sh after only `dotnet restore`. The script's `dotnet build -t:GenerateOpenApiDocuments` does not compile the project (OpenApiGenerateDocumentsOnBuild=false), so in a clean tree getdocument fails with 'ErsatzTV.deps.json does not exist' (exit 129). This PR is the first to change the /api surface and thus the first to exercise the gate's regen path, exposing the latent bug. Add a full `dotnet build` before the doc-gen target so the assembly + deps.json exist. Verified: clean-tree regen now succeeds with zero diff. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	105c0ec88a	fix(web): #316 review — playback phase promotion, engine-neutral download test fixtures, 401 signal, AuthSession optional fields ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	ec26e1be5b	fix(api): #316 review — POST-ify graphics-elements refresh, LockedError→409, no-store machine-key ... - GET /api/graphics-elements no longer side-effects; refresh moved to POST /api/graphics-elements/refresh (204), closing a CSRF vector on a GET. - PrepareTroubleshootingPlaybackHandler now returns a typed LockedError from both atomic lock-acquire failures; ApiResults.ToErrorResult maps it to 409 instead of falling through to 422, so a lock lost in the race between the controller's pre-check and the handler's atomic acquire still reports 409. - AuthController.MachineKey sets Cache-Control: no-store + Pragma: no-cache on the 200 response carrying the master API key. - Reworded the stale "subtitleId query parameter" endpoint description now that playback/start takes a JSON body. - Regenerated openapi/v1.json + docs/endpoint-index.md; docs/api-conventions.md updated with the LockedError pattern (§3a) and the ToErrorResult table row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	461c763dc6	docs: #295 PR2 + #301 — decisions entry, api-conventions §9, e2e-local browser flow ... - decisions.md: new entry (SPA cookie-only cutover, boot-gate-not-route, #301 POST-ification rationale, machine-key-read + OIDC-logout residual) + TOC line. - api-conventions §9: #301 resolved (POST-ify) + 'never add a side-effecting GET' standing rule; machine-key endpoint added to the auth surface list; PR2-shipped note. - e2e-local: fix stale 'no key required' claim (fail-closed since #197) + browser setup/login boot-gate flow. (spa-conventions §5e rewrite landed with the SPA-consumers slice.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	a9f1a4f6b5	fix(test): #301 update OpenApiErrorResponseContractTests to POST playback/start route ... Slice A updated OpenApiContractHonestyTests for the troubleshoot GET->POST route change but missed the hardcoded [TestCase] rows in OpenApiErrorResponseContractTests still referencing the removed GET/HEAD /api/troubleshoot/playback.m3u8 409 — the lookup threw KeyNotFound on the regenerated spec. Point them at the new POST /api/troubleshoot/playback/start (404/409/422, all ProblemDetails-documented). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	3c1e694905	fix(web): #295 align MachineKey wire field to server ({ apiKey }, not { key }) ... The server returns MachineKeyResponse(string ApiKey) -> JSON { apiKey }, but the hand-written SPA MachineKey type declared { key } and ApiKeyScreen read result.key, which would be undefined at runtime (blank key + empty copy). Mocked unit tests passed against the wrong shape. Align the type, the screen, and both test mocks to the real { apiKey } contract. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	de9fc7e8cc	feat(web): #295 PR2 SPA consumers — troubleshoot POST/blob downloads + machine-key screen + password change ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	9348a9938a	feat(web): #295 PR2 SPA session-auth foundation (boot gate, CSRF header, login/setup/logout) ... Replace the API-key SPA model with the session-cookie auth from PR1: - client.ts: stop sending X-Api-Key; attach X-Csrf on mutating verbs (POST/PUT/ PATCH/DELETE); add suppressUnauthorizedSignal to skip the global 401 signal on expected wrong-credentials 401s (login / change-password). - api/auth.ts: hand-written wire types (AuthConfig/AuthSession/MachineKey — the auth surface is IgnoreApi, deliberately not in generated types) + endpoint fns (getAuthConfig/getAuthSession/login/setup/logout/changePassword/getMachineKey); keep the notifyUnauthorized/subscribeUnauthorized 401 signal; add clearLegacyStoredApiKey. Legacy get/set/clearStoredApiKey retained ONLY so the still-shipping ApiKeyScreen (machine-key slice) compiles without a cross-slice conflict — the client no longer reads them. - AuthGate.tsx: boot gate wrapping <App/> outside the shell (mints no URL, deep links survive login). checking -> setup | login | ready | error, with a safe default AuthContext so App.test.tsx renders without a provider; config-fetch failure lands on an explicit error+Retry, never a blank screen. - LoginScreen / SetupScreen: shell-less centered cards; inline 401 / 409 handling; SSO button + local-form gating from AuthConfig. - UnauthorizedBanner: rewritten to prompt re-login (passive; consults the unsaved-changes guard before flipping the gate). - UserMenu: TopBar sign-out (guard -> logout -> signOut), mounted next to ConnectMenu. - main.tsx: wrap <AuthGate><App/></AuthGate> inside StrictMode. Tests: client/auth/AuthGate/LoginScreen/SetupScreen/UnauthorizedBanner/UserMenu (723 pass). Lint + build green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	88d82266b6	feat(api): #301 POST-ify side-effecting troubleshoot GETs + GET /api/auth/machine-key ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	9dc48118d1	chore: re-trigger CI (api-docs runner checkout-cache flake on 5c5a90af; identical tree) ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:33:43 +02:00
timothyandClaude Opus 4.8	5c5a90afde	fix(ci): #315 address review nits — drop fragile FAIL_RE, validate --timeout, log image id ... Adversarial review (MERGEABLE-WITH-NITS) findings: - Remove the broad FAIL_RE log-scan (matched benign ErsatzTV startup noise — library scans against absent media mounts, EF connection retries — risking a false-FAIL that blocks a good release). It was also redundant: a failed migration faults the BackgroundService -> default StopHost -> container exit, which the early-exit check already catches reliably (per the reviewer's own analysis). Migration failure is now detected by early container exit + timeout + the post-boot serve probe. - Validate --timeout is a positive integer (was: '--timeout abc' -> 0 -> instant false-FAIL). - Log the resolved image id after (attempted) pull, so a pull-failure that rehearses a stale local :latest is visible to the operator. Re-validated live on bumblebee: :latest vs the 283MB prod-copy -> migrations clean, PASS, image digest logged, no leftover temp dir/container. shellcheck + bash -n clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:23:45 +02:00
timothyandClaude Opus 4.8	4da2b67ab2	feat(ci): #315 migration-on-prod-copy smoke for the release path ... CI's migrations job only proves a migration is well-formed against a fresh, empty DB. It never exercises the migration — or ErsatzTV's startup data steps (DatabaseMigratorService -> DbInitializer + PopulatePathHashes over the real MediaFile table) — against the accumulated prod SQLite, so a migration green on a fresh DB can still fail/corrupt on prod, found only mid-deploy. scripts/migration-smoke.sh rehearses it on a THROWAWAY copy of the latest prod backup: boots the new image against the copy, gates PASS on the "Done applying database migrations" log line (the migrator is a BackgroundService running concurrently with Kestrel, so HTTP readiness alone doesn't prove migrations finished), FAILs on early container exit / migration exception / timeout / not serving afterwards. Always operates on a copy, never the live DB; tears down its container + temp dir (incl. the container's root-owned config files) on exit. Validated live 2026-07-12: :latest vs a copy of the 283MB prod backup -> migrations applied cleanly, app booted+served, temp dir removed. Home split: this repo owns the script + docs; wiring it into the Komodo pre-deploy step is server-management#589 (cross-repo). Docs: docs/ci-cd.md (Migration integrity), docs/decisions.md (new entry, pure insertion). fixes #315 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:18:16 +02:00
timothyandClaude Opus 4.8	90c8348efe	fix(process): #317 docs-only exemption stays passthrough, not silent auto-grant [decisions-edit] ... Adversarial-review nit on the first commit: auto-granting the docs-only exemption silently self-merges process-control PRs (.claude/.gitea/.husky — including the gate hook itself) with no prompt and no review, bypassing human-in-the-loop for exactly the files that control the gate. Restrict auto-grant to the genuinely- satisfied (a+b+c) merge path; the docs/process exemption reverts to bare exit-0 passthrough (one normal prompt). Corrects this PR's own decisions.md entry accordingly ([decisions-edit]: a not-yet-merged draft entry, not history). 8 pipe tests green (adds docs-only -> passthrough). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:58:26 +02:00
timothyandClaude Opus 4.8	8565f731cd	fix(process): #317 merge-consent gate auto-grants on satisfied path (no double-prompt) ... The H6/H10 merge-consent hook's satisfied path did a bare `exit 0`, which does not auto-approve a PreToolUse tool call — it only declines to block, so control fell through to the normal permission system and the raw MCP prompt still fired. A ready-to-merge PR was therefore confirmed twice (conversationally + a redundant mechanical prompt). Emit permissionDecision "allow" (new `grant` decision) on the satisfied and docs-exempt paths so the derived state IS the consent; deny/ask unchanged (fail-closed); non-merge methods keep the exit-0 passthrough. Docs: CLAUDE.md, kickoff HARD CONSTRAINTS, docs/decisions.md (append-only, pure insert). Verified: 7 pipe tests (satisfied->allow, unticked->deny, stale->deny, red-CI->deny, no-verdict->ask, no-creds->ask, non-merge->passthrough). fixes #317 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:52:26 +02:00
timothyandClaude Opus 4.8	f1b2521228	chore(process): #312 H12 — session-end issue-qualification audit ... scripts/issue-qualification-audit.sh: lists OPEN issues missing a `priority:` label (the #237 ranking keys off priority:/gate labels, so an unlabeled issue is invisible to it). "Fully qualified" = has a priority: label; gate-vs-backlog derives from the review label / milestone, and a milestone is NOT required (backlog is unmilestoned). Advisory (exit 1 if any unqualified); fail-open without Gitea creds. Wired into the kickoff session-end protocol + a lore bullet. Tested live (flagged 2) + no-creds no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:21:20 +02:00
timothyandClaude Opus 4.8	19dbfe9a8b	docs(process): #311 — formatting-as-you-touch (§7) + rebase-not-merge lore + decisions entry ... - contributing.md §7: document fix-formatting-as-you-touch (normalize a legacy file you edit, incl. BOM strip; no big-bang), enforced by the pre-commit hook + the new format CI job. - kickoff lore: flip "merge main into PR branch" -> "rebase on origin/main" (H11 enforces it); keep the regenerate-generated-artifacts-on-conflict nugget. - decisions.md: new entry (+ TOC) for both decisions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:17:44 +02:00
timothyandClaude Opus 4.8	3d07c6818d	ci(process): #311 H11 rebase-before-push hook + PR-scoped format-verify CI job ... - H11: .husky/pre-push calls .claude/hooks/prepush-rebase-check.sh, which blocks a push whose branch is behind origin/main (rebase first; do not merge main in — a merge drags in files you didn't touch, e.g. legacy-BOM .cs, tripping the format hook on code that isn't yours). Fail-open; escape ETV_SKIP_REBASE_CHECK=1. - New blocking `format` CI job: dotnet format --verify-no-changes scoped to the PR's changed .cs only (style + charset=utf-8/no-BOM), enforcing fix-as-you-touch without a big-bang reformat of the ~2500 legacy BOM files. .cs-free PRs skip and pass (always reports a status). Closes the "CI never checks charset" gap that let #269 land 17 BOM files (#310). Docs (contributing.md §7 / decisions.md / lore) follow in the next commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:16:00 +02:00
timothyandClaude Opus 4.8	b20ee50b1f	docs(process): #303 follow-ups — Codex-skip rubric + write-path live-E2E requirement ... Two of the four non-hook #303 process follow-ups (the two docs items; the security scan and migration-on-prod-copy smoke are deferred to their own sessions): 1. Codex-skip rubric (kickoff workflow lore): an independent review pass is MANDATORY for diffs touching locks/concurrency, auth/security, API write-path handlers, or migrations, or >~150 changed C# lines; skippable only for a pure-SPA/docs leaf, and a skip must be stated + justified. Makes self-exemption an auditable claim (the correlated-blindspot net). 2. Live-E2E is now a STATED REQUIREMENT for API write-path handler changes: new "When live-E2E is required" section in docs/e2e-local.md + a decisions.md entry, formalizing the #229 lore bullet. The seeding recipe was already in e2e-local.md (added for #220), so the stale "recipe not yet in docs" lore bullet is pruned to a pointer. Docs-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:02:36 +02:00
timothyandClaude Opus 4.8	7a9b30de71	fix(api): #269 review fixes — rebase force-write delta so rotation survives a race (Codex F1/F3) ... Independent Codex review (reconciled by Fable against a MERGEABLE fork verdict) found SaveChangesForcingVersion silently DROPPED a pending Version++ under a concurrent versioned-write race: on DbUpdateConcurrencyException it adopted the DB's current Version verbatim (original = current = dbVersion), so a bumping sibling committed at dbVersion instead of dbVersion+1. Net: an editor holding the concurrent writer's ETag was never invalidated by the sibling's change — the exact lost-update the #253/#269 contract exists to close, lost under the very condition the helper handles. F1 fix (shared helper, corrects all 25 bumpers incl. the pre-existing Add*ToPlaylist / schedule-item writers): rebase the pending delta on top of the stored token — pendingDelta = current - original; original = dbVersion; current = dbVersion + pendingDelta Bumpers (delta 1) advance to dbVersion+1; non-bumpers/deletes (delta 0, e.g. ErasePlayoutHistory) still adopt the stored token unchanged, so RootWriterForceVersionTests is unaffected. Idempotent across the bounded retry loop. F3: the force-race tests now assert Version==3 (rebase), not just membership survival; added the missing Playout force-race+rotate test. Negative-controlled: with the helper fix reverted, both strengthened tests go red. F2 (Medium, deferred → #308): two concurrent same-item Add*ToCollection can both pass the membership check and the loser 500s on the composite-PK violation (DbUpdateException, which the helper doesn't catch). Pre-existing and narrow (no corruption); doc claims softened to name it. Filed #308. Docs: api-conventions §7a + decisions.md prose corrected from "adopt the stored token" to the rebase semantics. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:40:32 +02:00
timothyandClaude Opus 4.8	83f753b211	fix(api): #269 rotate aggregate ETag on Collection/Playout config siblings ... Complete the #253 optimistic-concurrency contract's cross-editor ETag rotation tail. The non-If-Match config siblings mutated editor-visible state without bumping Version, so a concurrent editor of the same root never invalidated. Now the Collection Add*/Remove handlers bump Collection.Version, and UpdateCollection / UpdatePlayout / the three ScheduleFile writers (which already force-wrote past a concurrent bump) now bump too — all via SaveChangesForcingVersion (no If-Match → force write, never 412/500). No-op idempotence (Fable-caught trap): these gate reindex/BuildPlayout fan-out on SaveChanges()>0, so an unconditional bump would fire spurious rebuilds on an idempotent re-add / same-value re-submit. Each now short-circuits a genuine no-op before the bump — Add handlers by an explicit membership check (also fixing a latent duplicate-CollectionItem insert), scalar writers by ChangeTracker.HasChanges(). Corrects #269's framing: the Add*ToCollection family is not repository-mediated (IMediaCollectionRepository is read-only); each handler writes via its own dbContext, so the scanner's separate membership path is unaffected (a background scan does not rotate the editor ETag). Tests: CollectionEtagRotationTests + PlayoutScheduleFileEtagRotationTests (rotation, no-op-without-bump-or-rebuild, force-write-past-concurrent-bump), no-op guard proven non-vacuous by inverting the membership check. Docs: api-conventions §7a + decisions.md. No new status codes / no OpenAPI change (these endpoints take no If-Match, never 412). The #265 RFC-7232 If-Match parser refinement is a separate PR. fixes #269 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:40:32 +02:00
timothyandClaude Opus 4.8	938733c3d0	fix(process): #303 H10 — anchor is_pos to the leading marker (monotonic hardening) ... Final re-review returned SHIP-IT with one contrived, pre-existing residual: a line starting `Review-verdict: BLOCKED …` that ALSO contains a second literal `review-verdict: mergeable` substring later on the same line read as positive. Anchor the is_pos check to line-start so only the line's OWN leading verdict word counts. Safe-by-construction: anchoring a positive matcher can only REDUCE the allow-surface, so it cannot introduce a false-open (the dangerous direction); the 21-case regression confirms no false-deny (all still allow/deny/ask as before) + a new B6 case for this exact vector. No further review round needed — the change is monotonic. shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:14:37 +02:00
timothyandClaude Opus 4.8	ff3df39c43	fix(process): #303 H10 — anchor verdict marker to line-start (close self-reference false-open) [decisions-edit] ... Second adversarial re-review (of the fix commit itself — dogfooding H10) found a remaining false-open: the `review-verdict:` marker was matched anywhere on a line, so a comment merely QUOTING the positive template — an instruction ("please post: Review-verdict: MERGEABLE @ <head>"), a blocking comment explaining how to clear itself, or the gate's OWN suggestion text echoed into a comment — was classified as a real head verdict and self-approved the merge. Fix: anchor the marker to line-start (`^[[:space:]]*review-verdict:`). A real verdict line starts with the marker; quoted/instructional uses have text before it. Also drops the dead `nosha` var (SC2034). Finding 2 (a BLOCKED mis-anchored to an OLDER sha doesn't retract a MERGEABLE@head) is deliberately NOT "fixed": staleness is symmetric — a pre-fix BLOCKED@oldsha must not block forever after the fix changes the sha and earns a fresh MERGEABLE@head. To retract, re-review head and post BLOCKED@head. Documented in decisions.md. Pipe-tested 21 cases (5 new: instructional-quote, self-reference reason-text, line-start-in-multiline, leading-whitespace, blocking-quotes-template), all deny/ask/allow correct. bash -n + shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:11:05 +02:00
timothyandClaude Opus 4.8	f87a2092c4	fix(process): #303 H10 — anchor sha match to the @<sha> field; retraction-wins [decisions-edit] ... Adversarial review found false-opens in the first cut: - `grep -F "$short"` was an unanchored substring test: a MERGEABLE verdict for a DIFFERENT/older commit was accepted whenever the head 7-prefix appeared anywhere on the line (inside a longer sha, or an unrelated commit URL). Now each verdict line's `@ <sha>` token is extracted and matched to head by git short-sha prefix semantics (head begins with token, token >=7 chars). - No retraction semantics: a later `BLOCKED @ head` didn't override an earlier `MERGEABLE @ head`. Now a negative verdict on head wins -> deny. - A 7-digit build number falsely tripped the "references an older commit" deny; the `@`-anchored parse fixes it -> a marker with no @sha now asks, not denies. Also documents the issue-comment scope (gate reads issues/{pr}/comments, not Gitea formal-review bodies). Pipe-tested: 16 cases incl. 4 adversarial false-open reproductions, all now deny/ask. bash -n + shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:01:51 +02:00
timothyandClaude Opus 4.8	9fd8f40541	chore(process): #303 H10 — review-verdict merge-gate (latest commit must be reviewed) ... Folds condition (c) into pretooluse-merge-consent.sh (H6): a PR merge is allowed only when a `Review-verdict:` comment references the PR's CURRENT head sha — proving the latest commit was reviewed, not a stale earlier diff (mechanizes the ersatztv#242 "re-review the fix commit" lesson). Graceful adoption mirrors H6's Done-when tiering: - positive verdict @ head -> allow - verdict @ older sha (stale) -> deny (#242 failure mode) - head verdict negative -> deny - marker with no sha / none yet -> ask - comments unfetchable -> ask Reuses H6's PR fetch, docs-only exemption, and Gitea-auth-from-env (one hook, no detection drift — per the #303 methodology review). Pipe-tested 12 cases. Docs: decisions.md (new H10 entry + TOC), CLAUDE.md Task Completion Protocol. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:54:05 +02:00
timothyandClaude Opus 4.8	9a6c98f629	ci: re-trigger — MySql migration-integrity flake on prior run (no code change) ... Run 553 hit the known EF-migration MySql-apply flake (concurrent-runner contention; MEMORY ci-migration-job-mysql-flake). This PR touches only hooks/docs/yaml — the identical pipeline passed fully green on the parent commit (run 552). Empty commit to get a clean run; Gitea 1.24 has no job-rerun API endpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:26:41 +02:00
timothyandClaude Opus 4.8	6e92a951eb	feat(process): #303 decisions.md consolidation size-floor (read-cost, non-blocking) [decisions-edit] ... Timothy's refinement: the between-releases consolidation floor triggers on the file's READ COST — its line count, i.e. the context an agent burns reading the log — not entry count. The decisions-guard CI job now emits a non-blocking ::warning:: once decisions.md exceeds 1800 lines (the point past which it no longer fits one default 2000-line agent Read). Documented in the decisions.md header, the H9 entry, and ci-cd.md (job description + release-checklist note). Touches committed H9 lines, hence [decisions-edit]. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:23:58 +02:00
timothyandClaude Opus 4.8	59ecafecce	docs(process): #303 fold review nits — H3 case-insensitive, granularity wording, newline note [decisions-edit] ... Adversarial review (PR #305, MERGEABLE) nits: - H3: `grep -iE` so a root `Screenshot.PNG` is caught too (was lowercase-only). - decisions-guard.sh: comment the trailing-newline assumption (dropping the final newline would make git render the next append as a last-line modify -> false-block; self-correcting via [decisions-edit], .editorconfig enforces the newline). - docs: clarify CI is PR-wide (`range`) vs Husky per-commit (`staged`) — shared detection logic, deliberately different granularity; local hook is the stricter gate. Replaces the slightly-overstated "can't drift" wording. Touches the committed H9 decisions.md entry, hence the [decisions-edit] token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:18:30 +02:00
timothyandClaude Opus 4.8	997f96c1f5	docs(process): #303 append-only supersession + consolidation convention [decisions-edit] ... decisions.md header now documents the enforced append-only rule, the `[decisions-edit]` escape, mark-and-keep supersession (banner on the reversed entry + `(superseded)` TOC tag), and consolidation at each release. ci-cd.md documents H3/H9 hooks + the decisions-guard job and adds a "consolidate decisions.md" step to the release checklist. New decisions.md entry records the H9/H3 mechanization. The header edit modifies existing lines, so this commit carries the [decisions-edit] token — the guard working as designed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:13:13 +02:00
timothyandClaude Opus 4.8	56ef1df936	feat(process): #303 H3 root-screenshot guard + H9 decisions.md append-only guard ... H3 (Husky pre-commit): reject a staged root-level *.png — belt-and-suspenders with the .gitignore screenshot rule so `git add -f` still can't land a review artifact. H9 (append-only decisions.md): new shared hook `.claude/hooks/decisions-guard.sh`, wired into Husky commit-msg (staged mode) and a new blocking `decisions-guard` CI job (range mode). Blocks any commit/PR that deletes or modifies an existing line of docs/decisions.md — detected via `git diff --numstat` deleted-count, robust to markdown `-` list markers — unless the message carries the `[decisions-edit]` token. Pure insertions (a normal new entry) always pass. One implementation for local + CI so they can't drift. Fail-open on any tooling trouble. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:13:12 +02:00
timothy	a81f024840	Merge remote-tracking branch 'origin/main' into ci/303-api-docs-blocking	2026-07-12 17:43:29 +02:00
timothy	c34d2bdbf2	Merge remote-tracking branch 'origin/main' into ci/303-api-docs-blocking ... # Conflicts: # docs/decisions.md	2026-07-12 17:34:48 +02:00
timothyandClaude Opus 4.8	0badff811d	feat(process): #303 H6 merge-consent derived from ## Done-when checklist ... Wave 2 hook H6: derive merge-consent from state instead of memory. An issue's ## Done-when checklist (issue body) becomes the machine-readable source of truth for whether its PR may merge — the structural fix for the queue-drift #303 tracks (status was living in append-only prose). - pretooluse-merge-consent.sh (Claude PreToolUse on mcp__gitea__ pull_request_write): a merge is ALLOWED only when the PR's CI is green AND every ## Done-when box on the linked issue (fixes #N) is ticked; DENY on an unticked box / red CI; ASK (human prompt) when state isn't derivable (no linked issue, no section, no creds, Gitea down). Docs/ process-only PRs exempt. - .husky/pre-push -> prepush-donewhen.sh: fail-open backstop for a direct `git push origin main`; blocks only on a positively-proven unticked box. Gitea auth from env only (ETV_GITEA_BASICAUTH / ETV_GITEA_TOKEN, ETV_GITEA_URL) — nothing committed; without creds the gate degrades to today's manual confirmation, never a silent pass. Non-breaking rollout: until issues adopt ## Done-when the merge hook simply asks. Pipe-tested: non-merge->allow, no-creds->ask, docs-only->allow, checklist parser (unit), linked-issue extraction, and a live end-to-end block path (temp Done-when on #303 -> exit 1 -> restored). Docs: CLAUDE.md Task Completion Protocol + decisions.md entry. Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:29:34 +02:00
timothyandClaude Opus 4.8	aa2e13fa51	ci: #303 H4/H5 blocking api-docs gate — fail on stale OpenAPI artifacts ... Adds a blocking `api-docs` CI job: when a PR diff touches the API surface (ErsatzTV/Controllers/Api/** or ErsatzTV.Core/Api/**) it rebuilds the generated artifacts from source — v1.json, v1.d.ts, endpoint-index.md — and fails if any is stale in the diff. Mechanizes the "docs-update in the same PR" rule for the API contract (docs-reminder stays a non-blocking route-parity nudge). Path-gated INSIDE the job (per-step `if:` on a detect output), not via a top-level `if:`, so the check always reports a status on every PR and is safe as a required check: API-free PRs skip the dotnet/node setup + regen and pass trivially. Verified the gate reproduces the committed baseline: a fresh build regenerates v1.json byte-identical to HEAD (incl. all 244 auth security/401 blocks). The only footgun is local — update-openapi.sh runs dotnet-getdocument against the already-built assembly, so a stale bin/ emits a stale spec; api-conventions.md §5 now flags "build first". CI is immune (fresh checkout has no bin/). Docs: api-conventions.md §5 (two-place CI enforcement + stale-assembly note), decisions.md (new entry). Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:18:09 +02:00
timothy	5a12aae66e	Merge remote-tracking branch 'origin/main' into fix/269-force-version-on-root-writers ... # Conflicts: # docs/decisions.md	2026-07-12 17:17:46 +02:00
timothy	171d30c709	Merge remote-tracking branch 'origin/main' into fix/269-force-version-on-root-writers ... # Conflicts: # .gitignore	2026-07-12 17:14:56 +02:00
timothyandClaude Opus 4.8	21b49e6a42	chore(#269): remove accidental web/node_modules symlink from PR ... Fix-commit re-review (cold fork) caught that e383c253 tracked a machine-specific absolute-path symlink `web/node_modules -> /Users/.../web/node_modules` (created for the eslint pre-push hook). It slipped past `.gitignore` because the `web/node_modules/` trailing-slash pattern matches only a directory, not a symlink; a real node_modules dir (a copy) would have been ignored. Untrack it and tighten the ignore to `web/node_modules` (matches symlink or dir) so it can't recur. Also tightens the §7a / decisions.md "they already catch" phrasing (LOW review nit): only BuildPlayoutHandler catches; PlayoutTimeShifter is insulated by running solely on the background worker, never the request path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:09:08 +02:00
timothyandClaude Opus 4.8	48d256f83b	Merge origin/main into feat/295-auth-pr1 ... Brings in the #303 process/rigor hooks + docs. Only conflict-free overlap was docs/decisions.md (main added the ## Index TOC); reconciled by adding the #295 auth entry to the index. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:07:52 +02:00
timothyandClaude Opus 4.8	35e41fdaad	chore(process): #303 H7 worktree-owner guard + complete Wave 1 wiring ... Wave 2 hook H7: never commit/merge inside a sibling worktree another session created (burned us on #289 path-leak + the plumbing-merge workaround). Ownership = a per-session .claude-worktree-owner marker: - posttooluse-worktree-marker.sh stamps a worktree with session_id on `git worktree add` (parses the <path> arg past -b/-B/--reason flags). - pretooluse-worktree-guard.sh denies `git commit`/`git merge` whose effective dir (resolves `git -C <p>` and leading `cd <p> &&`) is a worktree whose marker names a DIFFERENT session. Fail-open: no marker, unparsable, or own session -> allow. Main tree + pre-convention worktrees are never marked, so unaffected. Also completes Wave 1's rollout, which committed pretooluse-bash-guard.sh but left .claude/settings.json and the agent-ram/nav-guard hooks untracked (so nothing was actually wired). Adds the settings.json that registers all five hooks (PreToolUse Bash x2, nav, Agent; PostToolUse Bash) + the .gitignore worktree-marker line, screenshot-scratch rules, and the decisions.md TOC left uncommitted last session. All hooks pipe-tested (7 guard cases + 6 marker cases). Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:01:52 +02:00
timothyandClaude Opus 4.8	e383c253cc	fix(api): #269 review — force-write ErasePlayoutHistory + document boundaries ... Independent adversarial review (cold fork + Codex) of the first cut converged on one real miss and two boundaries to document. - **ErasePlayoutHistoryHandler** (HIGH, both reviewers): modifies Playout ROOT scalars (Seed/Anchor/OnDemandCheckpoint) *without* bumping Version, inside an explicit transaction with no try/catch, so it 500s on a concurrent bump — reachable via POST /api/playouts/{id}/erase-items-and-history. My first sweep filtered on "Version-bumpers + deletes"; the true exposure surface is "any handler leaving a versioned root Modified/Deleted", so this slipped through. Now routes through SaveChangesForcingVersion (+ a non-vacuous through-handler test that exercises the explicit-transaction path). Re-swept with the correct filter: ErasePlayoutItems (AsNoTracking + ExecuteDelete children only) and ResetAllPlayouts (read-only + enqueue) are NOT exposed. - **Background build/time-shift Playout-scalar writers** (BuildPlayout via PlayoutBuilder, PlayoutTimeShifter): token-guarded too, but intentionally left on plain save — they already catch (build-failure, not 500), and force-writing would persist output built from stale config (the concurrent config bump already enqueues a rebuild). Documented as a deliberate boundary, not a gap. - **Item-add index collision** under force-write: documented as an accepted Phase-1 effect (non-corrupting, self-correcting; reload-recompute refinement is a #197 candidate). Also corrects the docs' "every Version bumper" framing to the true filter and the test docstring's over-broad non-vacuity claim. Full ErsatzTV.Tests green (1483). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:59:01 +02:00
timothyandClaude Opus 4.8	98e4767322	chore(process): #303 rigor hooks Wave 1 + decisions.md TOC + screenshot gitignore ... Wave 1 rigor-enforcement hooks (methodology review, #303), fail-open + pipe-tested: - pretooluse-bash-guard.sh — deny golden-baseline regen env var in command position (H1) - pretooluse-nav-guard.sh — deny browser-tab nav to /iptv,.m3u8,/artwork (H2) - pretooluse-agent-ram.sh — RAM-gate Agent/Task spawn, deny <10%% / ask <20%% (H8) - .claude/settings.json wires the three PreToolUse matchers Also: docs/decisions.md gains a 44-entry Index/TOC (additive); .gitignore ignores stray root *.png + .playwright-mcp/ (E2E scratch). Wave 2/3 + follow-ups tracked in #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:53:25 +02:00
timothyandClaude Opus 4.8	e8c3481ea5	fix(api): #295 PR1 — fold in fix-commit re-review (2nd Codex round) ... Fix-commit re-review confirmed the 1st-round fixes resolved and caught a 2nd round: - HIGH — env-seed vs. setup race: an attacker could claim admin in the startup window before LocalAdminSeedService runs, and the seed's insert would then be swallowed (attacker credential persists, defeating env recovery). Fixed structurally: the setup-claim endpoint is CLOSED (409) whenever Auth:LocalAdmin:Password is configured — the env seed owns the credential, so there's no claim to race (also strengthens the setup-claim TOFU posture). Config.setupRequired reflects it. - LOW — a concurrent setup race-loser now returns 409 (not 422); ClaimLocalAdmin's DbUpdateException catch re-checks existence and rethrows genuine/transient DB errors instead of masking them as "already configured". - MEDIUM (accepted, documented) — two simultaneous authenticated password changes are a non-serializable lost-update; accepted for a single-admin system (self-healing via re-login, implausible timing). +3 AuthController tests (env-seed closes setup / setupRequired gating). Full ErsatzTV.Tests green (1506); no generated drift. Docs updated. Refs #295 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:52:23 +02:00
timothyandClaude Opus 4.8	9a9aaf0740	fix(api): #295 PR1 — logout ends the session server-side (E2E-caught) ... Live E2E found that replaying a pre-logout cookie still authenticated (200, not 401): SignOutAsync only clears the CLIENT cookie, but the stateless encrypted cookie ticket stays valid server-side because its security stamp is unchanged — a captured cookie was replayable after logout until ticket expiry. Fix: logout now rotates the local-admin security stamp (RotateLocalAdminSecurityStamp), so every outstanding local session (old stamp) fails OnValidatePrincipal on its next request. For the single admin this is "log out everywhere". Gated on an authenticated local session so an unauthenticated caller can't force-revoke the admin. OIDC sessions (no stamp) are unaffected; SignOutAsync still clears the client cookie for UX. +2 handler tests (rotate-when-configured / no-op-when-unconfigured). Auth suite green (21). Docs: decisions.md note updated. Refs #295 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:46:41 +02:00
timothyandClaude Opus 4.8	6ac5150fd0	fix(api): #295 PR1 — fold in cold-fork + Codex review findings ... Independent review (cold fork = MERGEABLE-WITH-NITS; Codex = BLOCKED, caught concurrency defects the fork missed). All actionable findings folded in: - HIGH (Codex) atomic first-claim-wins: ClaimLocalAdmin now writes the three credential rows in ONE transaction guarded by the unique ConfigElement.Key index (lost race -> DbUpdateException -> 409), so concurrent claims can't produce a mixed-state credential. - HIGH (Codex) consistent login snapshot: VerifyLocalAdminLogin reads hash+stamp in one query and drops rehash-on-verify, so a login racing a password change can't capture a stamp newer than the hash it verified (concurrent change -> old password fails, or the issued cookie carries the pre-change stamp -> revoked next request). - MEDIUM (Codex) env-seed migration race: LocalAdminSeedService is now a RunOnce BackgroundService that awaits SystemStartup.WaitForDatabase (the migrator is a BackgroundService; registration order didn't guarantee the schema) + try/catch. - MEDIUM (fork M1) ForwardedHeaders: reverted the strict-opt-in flip — it would regress /iptv M3U/XMLTV/HLS absolute-URL generation (Request.Scheme) behind a proxy without KnownProxies. Kept #285 behavior; KnownProxies still recommended. - LOW (Codex/fork) require X-CSRF on /api/auth/logout + /password (the [SkipApiAuthorization] surface isn't covered by the filter's CSRF check; closes forced-logout CSRF). - ChangeLocalAdminPassword also writes hash+stamp atomically. Input length caps on username/password. Deferred with a tracked gate: MEDIUM (Codex) side-effecting [RequiresAuthentication] GETs (troubleshoot playback/archive) aren't CSRF-covered -> #301, gates PR2 (latent in PR1: the SPA still uses the machine key). Verify: full ErsatzTV.Tests green (1501); no OpenAPI/generated drift. Docs updated (api-conventions §9, decisions.md). Refs #295 #301 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:40:25 +02:00
timothyandClaude Opus 4.8	d80bf886b2	fix(api): #269 force-write non-If-Match root writers past a concurrent Version bump ... Activating #253's `Version` as an `IsConcurrencyToken` made EF guard every UPDATE *and DELETE* of a versioned root with `WHERE Version=@orig`, so any writer outside the If-Match contract that saves via plain `SaveChangesAsync` throws an unhandled `DbUpdateConcurrencyException`->500 when a replace-all editor bumps the row in its narrow load->save window (ordinary two-tab UI). A completeness sweep (grep every `Version` bumper + every root delete, not just the handlers PR3's close note named) found 17 exposed writers, all now routed through `ConcurrencyExtensions.SaveChangesForcingVersion` (Phase-1 force-write: adopt the stored token and retry; rethrow only on genuine row-deletion): - 9 versioned-root delete handlers (a delete has no ETag to rotate -> force only, no bump) - UpdateProgramScheduleHandler (bumps then saved plainly - the ProgramSchedule case PR3 only suspected; its post-commit query/enqueue also moved to CancellationToken.None per section 7b) - 7 item add/remove bumpers PR2 left on plain save: Add/DeleteProgramScheduleItem + Add{Items,Movie,Show,Season,Episode}ToPlaylist Force-write (not 412) is correct: these endpoints take no If-Match, so an unconditional delete/edit should win. No API contract change (no new response codes) -> no OpenAPI regen. Still deferred to #197 (cross-editor ETag rotation only, not a 500): the non-bumping config siblings + the scanner-shared Add*ToCollection family. Tests: RootWriterForceVersionTests races a bump *through the handler* via a pre-tracked context (non-vacuous - reverting a handler to plain save fails the test, verified) for the Option-delete / Either-delete / bump+update shapes, plus the genuine-conflict rethrow branch and an explicit negative control proving the plain-save path throws. Full ErsatzTV.Tests green (1482). Also strips a pre-existing UTF-8 BOM from the touched handlers to satisfy the .editorconfig `charset=utf-8` rule the pre-commit format hook enforces. Docs: api-conventions section 7a (fan-out completeness) + decisions.md entry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:39:19 +02:00
timothyandClaude Opus 4.8	29c8b1cd83	docs(handoff): prune lore — drop what decisions.md/api-conventions already cover + dead Blazor-parity notes ... The lore had grown into a changelog (~40 verbose bullets). Removed bullets whose substance lives in docs/decisions.md or api-conventions §7a/b/c (#251 post-commit None, #252/#259 reconcile, #253 PR3/PR4 concurrency, addTo layer, DTO nullable facts, disabled={saving}) and dead Blazor-parity process notes (parity verdicts, screen!=parity, unwired-endpoint gaps, #205/#206 docs-staleness). Condensed the survivors. Added a scope banner: this section is standing workflow/orchestration lore only; engineering decisions go in decisions.md, never here (they duplicate and drift). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:32:34 +02:00
timothyandClaude Opus 4.8	aed4b5c056	docs(handoff): fix queue-drift root cause — live Gitea state is the sole source of truth ... Recent session pickups re-did finished work (thought closed issues were still open). Root cause: DONE/OPEN status lived in append-only prose (arc inline markers + each comment's 'Recommended next'), which lags real issue state — worst across parallel sessions narrating each other's merges. Kickoff prompt fixes: - SOURCE OF TRUTH = live Gitea state, never prose; verify OPEN (issue AND milestone) before claiming. - Gate/frontier defined structurally (lowest-numbered open arc item), not hardcoded to an issue number (an earlier pass re-planted the bug by hardcoding '#197 cluster'/'#91b milestone CLOSED'). - Label-based ranking: arc order -> gate(review label/milestone) -> priority. - Pick order across arc-frontier / priority-pickup / audit pools. - Bound the comment read (~6 newest); MCP-down REST fallback; #237 canonical. - New lore bullet capturing the drift root cause + structural cure. Companion edits to tracker #237 body (prune arc status -> 'Done (history)' section) made live; noted in a session comment there. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:22:57 +02:00
timothyandClaude Opus 4.8	0b23d4b6b1	feat(api): #295 PR1 — browser SPA session auth (session-OR-key gate, server-only) ... Implements the ratified #295 design (PR1, server-only, backward compatible). The /api surface now accepts a valid X-Api-Key (machine) OR an authenticated session (browser cookie, local login or OIDC), gated by the evolved ApiAuthorizationFilter (renamed from ApiKeyAuthorizationFilter; same fail-closed EndpointRequiresKey predicate). Machine/key behavior is byte-identical and the SPA keeps working via its stored key — the SPA login flow lands in PR2. - ApiAuthorizationFilter: key-first (CSRF-immune) then session; session-authed mutations require the X-CSRF header (403 otherwise). Attributes renamed [RequiresApiKey]->[RequiresAuthentication], [SkipApiKeyAuthorization]->[SkipApiAuthorization]. - Cookie scheme ctv-session always registered (Lax/SameAsRequest/14d sliding, 401 not redirect for /api); OIDC handler revived when configured (profile scope, userinfo, auth-method claim); UseAuthentication/UseAuthorization/UseRateLimiter revived in the legacy MapWhen branch. - Local admin = single credential in ConfigElement rows (username / PBKDF2 hash via Microsoft.Extensions.Identity.Core / rotating security stamp) — NO DB migration. Password change rotates the stamp; CookieSecurityStampValidator revokes stale local sessions. Env-seed recovery (Auth:LocalAdmin:*) via LocalAdminSeedService. - AuthController /api/auth/{config,session,setup,login,logout,password} + browser-nav GET /auth/oidc/login; excluded from OpenAPI (machine-audience spec). Per-IP rate limit on login/setup/password; dummy-hash verify (no user enumeration). - ForwardedHeaders now strict opt-in: X-Forwarded-* ignored unless KnownProxies/Networks configured (rate-limiter IP + cookie-Secure integrity). Deployment: operators behind a proxy must set ForwardedHeaders:KnownProxies. - Tests: session/CSRF filter cases + 17 Application/Auth handler tests; full ErsatzTV.Tests green (1499). No OpenAPI/generated-artifact drift. - Docs: api-conventions section 9 rewritten; decisions.md entry (supersedes #206 inert-OIDC note). Refs #295 #197 #206 #58 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:14:54 +02:00
timothyandClaude Opus 4.8	4112413ca5	fix(spa): #271 disable all family rows on click (family-global lock parity) ... Cold-review nit fixes on PR #298: - useCollectionsScan.scan() now guards on the whole family being busy (active OR any pending key of that family), not just the exact key — a sibling source of a family with a scan in flight no longer fires a redundant (benign-409) POST. - LibrariesScreen ExternalCollectionsSection disables every row of a family that has a pending or active scan (derives pendingFamilies from pendingKeys), matching Blazor's instant all-rows-disabled behavior instead of waiting a poll RTT. - Rewrite the promote test to actually observe the optimistic-pending window via a deferred POST (was only asserting the promoted end state), and add a test proving a sibling-source click fires no second POST while the family is pending. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 14:34:05 +02:00
timothyandClaude Opus 4.8	6d31758cca	feat(api): #271 collections scan-status REST surface + authoritative SPA reconcile ... Add GET /api/media-sources/collections-scan-status (MediaSourcesController → GetCollectionsScanStatus handler) reporting which media-source families (plex/jellyfin/emby) currently hold their external-collections scan lock, reading IEntityLocker.Are{X}CollectionsLocked(). The lock is family-global (no source id) and boolean (no percent), so the DTO carries just {family} and returns only active families — the counterpart to GET /api/libraries/scan-status. SPA: useCollectionsScan now polls this endpoint and reconciles optimistic pending against the active-family set (seeding on mount so an in-progress scan disables buttons immediately), using the same grace-tick helper as library scans (now generic over the pending key type). Drops COLLECTIONS_PENDING_TIMEOUT_MS — a long deep scan no longer re-enables the button early, and a fast scan no longer wedges it disabled for the full timeout. A row shows Scanning when its family is active or it has an in-grace optimistic pending key. Tests: handler (3), controller route+delegation (2), SPA api fn + hook reconcile (mount-seed / 202-promote / 409-keeps-disabled / 404-error). OpenAPI + TS types regenerated. Docs: api-conventions §3b, blazor-route-parity §5, decisions.md. Unblocks #91b (arc item 4): Libraries.razor's collections-scan affordance now has full authoritative parity. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 14:23:58 +02:00
timothyandClaude Opus 4.8	c40e78d840	fix(api): #197 Bundle C review nits — order-independent operationIds + nullable MediaSources fields ... Refs #287 #288 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 12:08:50 +02:00
timothyandClaude Opus 4.8	a918ccd60c	docs: #197 Bundle C — api-conventions/decisions/rest-api sync ... §2 raw-VM wrapping + universal #nullable enable; §3a/§5/§7a/§9 updated for reset re-key, DayOfWeek string, header-only Version, security-by-construction; 3 decisions.md entries (#287/#288/channel-key); rest-api.md reset route. Refs #287 #288 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 02:38:43 +02:00
timothyandClaude Opus 4.8	70f357f8f9	feat(api): #288 ChannelDetailResponseModel for edit form + SPA repoints + final regen ... Mint ChannelDetailResponseModel (faithful detail DTO exposing the raw editable field set the channel editor reads: raw FFmpegProfileId/WatermarkId/FallbackFillerId ids, the mode enums, logo, playoutCount, id) and route GetById/Create/Update through it, replacing the lean list ChannelResponseModel that resolved the profile to a name and dropped the editable ids (a functional regression for draftFromChannel). The lean ChannelResponseModel stays unchanged for GET /api/channels. webEncodedName dropped (SPA never reads it). Logo is mirrored as a Core ChannelLogoResponseModel since the Application ArtworkContentTypeModel can't be referenced from Core. Repoint the hand-written SPA client aliases now that the VMs are gone from the schema: Channel -> ChannelDetailResponseModel, MediaCollection/SmartCollection -> *ResponseModel, ProgramSchedule -> ProgramScheduleResponseModel. Fix #288 honest-nullability test fallout in search.test.ts (null -> [] for now-non-null id arrays). Include the already-on-disk playouts.ts WithDayNames removal and regenerate v1.json + v1.d.ts + endpoint-index.md (authoritative final regen; the reset endpoint's {channelNumber}->{id} re-key surfaces in the generated docs and the OpenApi error-contract test). Refs #288 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 02:33:39 +02:00
timothy	74170611da	Merge branch 'bundle-c/channel' into bundle-c-197-contract	2026-07-12 02:08:13 +02:00
timothy	9e5087b3cd	Merge branch 'bundle-c/288' into bundle-c-197-contract	2026-07-12 02:08:12 +02:00
timothyandClaude Opus 4.8	5f89bfc1a0	feat(api): #288/#197 wrap ChannelViewModel + re-key playout/reset to {id} ... GetById/Create/Update return ChannelResponseModel via new GetChannelByIdForApi read-side query; POST /api/channels/{id:int}/playout/reset (new GetPlayoutIdByChannelId; by-number kept for HlsSessionWorker broadcast). Refs #288 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 02:08:12 +02:00
timothyandClaude Opus 4.8	171364d0e8	feat(api): #287 OpenAPI contract honesty by construction ... ApiKey security scheme + per-op security/401 via shared EndpointRequiresKey predicate (no drift from enforcement); synthesized stable operationIds; 400 ValidationProblemDetails on binding ops; DayOfWeek as string enum. Refs #287 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 02:08:12 +02:00
timothyandClaude Opus 4.8	fecf16d3d2	feat(api): #288 wrap raw VMs, nullable-honest DTOs, search pageNum ... 24 #nullable enable flips across ErsatzTV.Core/Api; Collection/Schedule/ SmartCollection/Resolution VMs wrapped in ResponseModels (Version now header-only, SPA-verified); pageNum threaded into GET /api/search. Refs #288 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 02:08:12 +02:00
timothyandClaude Opus 4.8	9e2d160884	docs(handoff): #289 lore — runtime-posture guards, FF-onto-feature-branch, ResponseHeadersRead timeout ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 01:28:53 +02:00
timothy	f8fd9084d1	Merge main (CI migration-job retry #294 + #197 tests) into fix/283 ... # Conflicts: # docs/decisions.md	2026-07-12 00:52:20 +02:00
timothyandClaude Opus 4.8	fa2d787ac1	ci: make the MySql migration-apply resilient to concurrent-runner contention ... Root cause (diagnosed from run logs 513/515/516): the EF migration-integrity job's "MySql apply all migrations to a fresh DB" step flakes when two migration jobs land on the SAME runner host at once — each `services: mysql:8.4` container starves the other, so the 787-migration replay either exceeds MySqlConnector's 30s default command timeout ("Command Timeout expired", run 513 on ci-runner) or has its connection dropped mid-replay ("MySqlEndOfStreamException", run 516 on bumblebee-runner). It's pure infra contention: `has-pending-model-changes` (the model check) passes both providers, and the identical tree passes on a quieter host (run 515). Both runners have both passed and failed — not one bad runner. Fix (runner-agnostic, repo-owned workflow only — no runner-host change needed): - Raise `DefaultCommandTimeout` to 300s in the MySql connection string. - Wrap the apply in a 3× retry that resumes from `__EFMigrationsHistory` (EF commits each migration in its own transaction, so an interrupted one rolls back and the retry continues). A real migration failure fails on every attempt, so the retry can't mask a genuine problem. Docs: ci-cd.md migration-integrity section documents the contention + retry. Refs #13 #236 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:42:49 +02:00
timothyandClaude Opus 4.8	db9fc59660	ci: re-trigger CI into idle runner (MySQL apply-all flake under load) ... Run 516's MySQL "apply all migrations to a fresh DB" died with MySqlEndOfStreamException (incomplete response) — the shared MySQL service container under concurrent-run load, same class as run 513's Command Timeout. Model-drift (has-pending-model-changes) passed for BOTH providers, so the diff is model-clean; another branch's run (515) passed the identical job. Contention has cleared; re-triggering. Tree unchanged from b6f12f7e. Refs #283 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:34:20 +02:00
timothyandClaude Opus 4.8	2a6fa2694a	ci: re-trigger CI (MySQL migration-integrity command-timeout flake) ... Run 513's "EF migration integrity" job failed with "The Command Timeout expired" applying all migrations to a fresh MySQL under concurrent-run contention. The tree is unchanged from b6f12f7e (Build & test green there and on the pre-clamp cf834d8b; the change touches no EF/model/migration code). Empty commit to get a clean run. Refs #283 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:28:02 +02:00
timothyandClaude Opus 4.8	ee6be81c22	test(#197): cover ApiKeyProvider unreadable-file rethrow + deleted-during-read race ... Re-review of the fix commit (MERGEABLE-WITH-NITS) noted the headline L3 rethrow branch itself had no test. Add a reader seam (internal ResolveKey Func overload) and two tests: unreadable existing file throws + does not overwrite; a delete race between File.Exists and the read falls back to generate rather than failing boot. Refs #197 #280 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 00:22:26 +02:00