39 Commits

Include renames

Author	SHA1	Message	Date
timothyandClaude Opus 5	879208d554	docs(849): re-apply the CLAUDE.md correction the rebase resolution dropped ... The rebase onto #889 resolved a CLAUDE.md hunk in favour of upstream, which kept #845's new clause and discarded #849's — leaving the file asserting that a rejection landing inside a run's own write window is "a separate and still-open route". Both edits belong: they touch one sentence for different reasons. This message also repairs the TRAILER BLOCK for the whole branch, which CI caught and local runs did not. Every commit here ended: refs #849 Decisions-Edit: yes Co-Authored-By: ... Git parses only the LAST paragraph as trailers, so the blank line put `Decisions-Edit: yes` in the second-to-last one and it was never a trailer at all — `git log --format=%(trailers)` showed only the Co-Authored-By pair. `refs #849` without a colon disqualifies that paragraph independently. `decisions_validate.py` arms its rationale-prose exemption from ANY non-merge commit in the range, so one correctly-formed block repairs all nine. Refs: #849 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019T79beF1Ufid3dXju4yqkF	2026-08-30 05:27:30 +02:00
3 people	5d955000f3	fix(845): the verdict writer checks that the gate will honour what it just posted (#889) ... `review-verdict.yml` inherits an existing `review-verdict/h10=success` only from a status whose `.creator.login` is on its `H10_REVIEWERS` allow-list (#742). `post-review-verdict.sh` wrote those verdicts with whatever account owned the credential in the environment and never asked whose it was. Two coupled values, nothing asserting the coupling, and the failure was the silent kind: the status is written, the tool reports success, and the next `pull_request_target` event re-derives it and posts over it. The PR stalls with no visible cause. The writer now READS ITS OWN STATUS BACK, identifies that write by state and description, and refuses — before the verdict comment, so the surviving half-state is the documented `ask` one — unless the recorded creator is allow-listed. Measured after the write rather than probed before it: that tests what Gitea recorded as the author, which is the value the gate reads, and needs no scope beyond the repo access the POST already required. Membership is required for a `success` ONLY, mirroring the gate's own asymmetry: a `failure` is inherited from any attributable account, so requiring it there would refuse a verdict the gate honours and leave an off-list reviewer no supported way to record a rejection. The allow-list is DERIVED from the gate's own literal by the new `scripts/lib/h10-reviewers.sh` — one declaration, not two plus a parity test. It is a parse rather than a shared declaration both sides source because the gate runs against a checkout of the PR's BASE sha: a PR whose base predates such a file would not have it, and a missing `source` under `set -euo pipefail` kills the job, which posts no `review-verdict/h10` at all and blocks every merge including its own repair (#743). `scripts/post-review-verdict.sh` moves BEHAVIOUR-ONLY -> MUTATION in the guard inventory, which the manifest's own note called "the most valuable upgrade on this list". The declared clause lives in the GATE: rewriting `H10_REVIEWERS` while the posting account stays fixed reddens the accept path only if the writer reads the list live AND the comparison gates the outcome. Two defects were caught by probing the live instance rather than re-reading the code. Reading `.state` instead of `.status` per row would have refused EVERY verdict — a repo-wide deadlock, shipped green, because the test shim replayed the POST payload as the read-back body and so agreed with the parser by construction. Then a `(.status // .state)` fallback added as defensiveness recreated #845 exactly: the writer would accept a shape the gate cannot read and report success. Nine independent cold review rounds, all worktree-isolated, one cross-family (GPT-5.6 via Codex). Round 8 caught the most important one: a `set -u` "correction" made mid-branch had inverted a TRUE statement in live merge-gate code, because the probe used a plain `$UNSET` while the validator uses `${#arr[@]}` — different shapes, different behaviour. Withdrawn wholesale; both libraries are byte-identical to `main` again. Verification: full `scripts/tests` suite green (1278 passed, 2 skipped); the declared mutation executes every run and reddens its named proof with the manifest's `expect` string; every clause disarmed individually and confirmed to redden its own named test; live probes against Gitea 1.27.1 for the row shape, the description round-trip, the paging order and the required-check list. Docs: `ci.exemption-provenance` records the coupling as asserted rather than as a tracked residual, plus `docs/ci-cd.md`, `CLAUDE.md`, `docs/guard-inventory.md`, `docs/remote-state-inventory.md`, `ci.script-tests-job` and the `script-tests` population comment in `pr-checks.yml`. Deferred: the refused-verdict residual (a non-inheritable status left standing with no comment) is the `ask` half-state `release.verdict-writes-status-before-comment` designates as safe; a second corrective write is the sticky-sentinel mechanism #849 is separately designing. fixes #845 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-30 02:43:08 +00:00
timothyandtimothy	d68ce42fcb	fix(742): inherit an h10 verdict only from an allow-listed reviewer (#850) ... `review-verdict.yml` decided whether an existing `review-verdict/h10` was worth INHERITING by testing `.creator.login != null` — satisfied by any account's credential, including the `renovate` bot's `RENOVATE_TOKEN`, a `write:repository` PAT that cannot be scoped down the way #697 scoped the registry credential. The test is now membership in `H10_REVIEWERS="timothy"`, a literal in the base-resolved definition. The design that survived 11 cold review rounds: * `read_existing_verdict` carries TWO flags. `ex_human` (attributable AND allow-listed) gates INHERITANCE; `ex_attributable` gates the last-moment re-read, which asks the opposite question and must stay broad. Narrowing both — the first draft — makes the job post its exemption over a mid-run rejection, and the post-write repair does not cover that. * The two calls no longer compute an identical predicate, so "changed" is made explicit: the state/creator/description triple from the first read is snapshotted and compared. * The allow-list governs an inherited `success` ONLY. An existing `failure` inherits on attributability alone, because inheriting a rejection can only withhold an exemption while re-deriving one can turn it green on an exempt PR. A symmetric rule was a measured fail-open. * The post-write raced check stays broad — not because narrowing would let a rejection go green (a real reviewer is on the list by construction), but for the misconfiguration case. Two mechanisms were WITHDRAWN rather than patched a third time, and both withdrawals are recorded in `ci.exemption-provenance` so they are not re-attempted: a `::warning::` annotation that produced three defects in three rounds, and a post-write fix whose generic `pending` would have been re-derived anyway and which had no retry trigger. Verified: the inheritance predicate driven against the LIVE Gitea API on a probe-named context, both allow-list directions; every clause mutation-proven against the shipped file; `scripts/tests` 1012 passed, 2 skipped. Follow-ups filed: #845 (post-review-verdict.sh does not check its own account is allow-listed) and #849 (post-write verification: three routes leaving an exemption `success` over a human `failure`, plus the retarget fence's post-POST gap, plus the prose sweep that lands with the behaviour). fixes #742 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-27 02:52:02 +00:00
timothyandtimothy	469d19852c	fix(788): one declarative H10 verdict vocabulary, derived by both sides (#846) ... The verdict words lived in two hand-written shell copies — the `case` arms of post-review-verdict.sh (write) and the POS_RE/NEG_RE regexes of check-review-verdict.sh (read) — held together by nothing but a comment that had already gone stale. scripts/lib/review-verdict-vocabulary.sh now declares them once and both sides derive; neither script enumerates a verdict word any more. Only the WORD SET moved. The grammar stays in check-review-verdict.sh, where every #629 false-open actually lived. No parity test: #774 shipped one and withdrew it after six rounds, because a regex over shell source is not a shell parser. The proof is behavioural and graded MUTATION — the harness restores the pre-#788 hardcoded POS_RE each run and requires it to redden. Enforcement is a DATA dependency, not a control-flow gate. Review round 1 found a real fail-open in the first commit: `${#arr[@]}` is nounset-safe only for a declared-empty array, and under `set -u` that error inside a function called as `if ! validate` skips BOTH branches — so on the reader (deliberately no `set -e`) an explicit BLOCKED @ head classified `positive`, exit 0. Validation now sets a sentinel on its last line and the derived views refuse without it. Six cold review rounds; rounds 2-6 found no fail-open across differential fuzzing (4788 / 2612 / 7560 payloads, zero divergences from origin/main's grammar), sentinel forgery, environment poisoning, declare -p evasion on bash 5.3 and 3.2, path/symlink resolution and probe TOCTOU. Every malformation fails closed: reader exit 2, writer exit 1 with nothing posted. Also corrected: CLAUDE.md and release.review-verdict-gate both enumerated the vocabulary without LGTM, a word the code has accepted since #629. fixes #788 Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-26 20:58:09 +00:00
timothyandtimothy	35affecd29	docs(755): ersatztv owns the fork code, media-management owns channel operations (#838) ... Co-authored-by: Timothy <timothy@noreply.gitea.tblindustries.be>	2026-08-26 17:29:16 +00:00
timothyandClaude Opus 5	f822e4737c	docs(743): label the second attested claim, close the survivor list, state the rule in CLAUDE.md ... Round 3 returned MERGEABLE with three LOW documentation findings. Batched before posting the verdict, since a new sha voids both the CI run and the verdict. - `ci-cd.md` labelled the unprobed half of the `enable_push` bullet but stated the `block_admin_merge_override` counterfactual flatly one bullet below — the same measured-vs-attested flattening round 2 fixed, one site over. Now labelled, with why it was not probed (verifying it means merging an unreviewed PR). - `release.verdict-status-check` said "what survives is the forgery list above". That record's job is enumerating survivors, so an unqualified "what survives is X" reads as exhaustive — and it omitted the admin residual, which is a SKIP route rather than a forgery one. Added. - `CLAUDE.md` never learned the rule. It is the always-read surface, and it still framed a direct `git push origin main` as a live path while describing a docs-only *push* exemption for a push the server now refuses. My corpus sweep covered `docs/` and missed the file that carries the docs-update rule. Note on what remains unverified rather than closed: neither direction of `block_admin_merge_override` was measured, and whether Gitea treats an ABSENT required context as blocking (versus satisfied) is asserted by our docs but not proven — the combined status on this PR reads `success` with `review-verdict/h10` absent. Both belong to #747's re-verification sweep. Verification: 441/441 script tests; decisions-validate OK. refs #743 Decisions-Edit: yes Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-06 00:35:41 +02:00
timothy	8f6d4f4432	fix(706,707,711): fence the review-verdict write on the timeline retarget count ... Three related defects in the `review-verdict/h10` gate, all surfaced by the cross-family review of PR #705. #706 race 1 — a stale run could overwrite a fresher verdict, permanently. The race was reproduced live rather than reasoned about (Gitea 1.25.4): with every other workflow stripped, probe PR #722 showed run 7520 (`opened`) finishing 20s AFTER run 7521 (`synchronize`) started. `pull_request_target` runs for one PR genuinely overlap, older finishing last. The issue proposed serializing with a non-cancelling concurrency group. That is REFUTED by measurement: with the group active, runs 7528/7529 still overlapped and 7528 ended 36s after 7529 began. A first probe appeared to show the group working — a negative control with no `concurrency:` key at all showed the same cancellations, revealing Gitea auto-cancels superseded `push` runs on its own and the probe had measured that, not the group. The auto-cancel does not extend to `pull_request_target`. The fix leaves the runs unserialized and instead makes an overtaken run decline to write: count `change_target_branch` events on the PR timeline at start and again just before the POST, and post nothing if the count moved. The COUNT is the key because the branch NAME is ABA-vulnerable (`main -> S -> main` reads `main` at both ends — how #698 route 1 forged its exemption). Abstaining is a handoff, not a stall: every retarget fires `edited`, so the event that makes a run abstain has already queued its successor. `updated_at` was rejected as the key precisely because it moves for comments/labels, which queue nothing. #706 race 2 — a human BLOCKED landing in the unclosable window between the pre-POST re-read and the POST was silently turned green. After an exemption `success` the job now re-reads the per-POST history and repairs its own status to `pending` if a human verdict appeared above a high-water mark taken just before the write. The repair is `pending`, never a copy of the human's state. The id comparison is load-bearing: a presence test would fire forever on a base-mismatched verdict and deadlock that PR's exemption. #707 — `pr-changed-files.sh` bound `.base.ref` and `.head.sha` across the enumeration but never `.base.sha`, so an ordinary advance of `main` mid-paging could drop a code path from an offset-paged diff and leave a complete-looking docs-only list. Now bound from the JSON already fetched (no new round trips). #711 — `.codex/` added to PROTECTED. It mirrors `.claude/hooks/` byte for byte, including the merge-consent hook, so the "a PR that can weaken the gate cannot exempt itself" rule had an incomplete path list. Latent today (untracked), live the moment anyone tracks it. Residuals are stated, not implied: a retarget inside the final round-trip, and the repair being itself a read-then-write. Gitea's status API has no compare-and-set, so neither reaches zero; both now fail toward `pending`. Tests: 398 pass in scripts/tests. Each new guard was mutation-checked — the fence's motion comparison, the untrusted-count gate, the repair POST and the id high-water mark were each neutered in turn and the intended test went red while its positive control stayed green. fixes #706 fixes #707 fixes #711 Decisions-Edit: yes	2026-08-03 21:41:16 +02:00
timothyandClaude Opus 5	1eca9b0c11	docs(698): correct the Renovate auto-pass rule in CLAUDE.md ... CLAUDE.md still described the bot exemption as identity-only (auto-passed unless a protected path is touched). Since #698 it also requires EVERY changed path to be a dependency manifest — a bot account does not attribute the code at a head. CLAUDE.md is loaded every session, so a stale rule here is worse than a stale doc. Refs: #698 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-30 21:56:15 +02:00
timothy	b83e965994	docs: make subagent use explicit, and turn "claim an issue" into a check rather than a label ... Two rules that were implied but not enforceable, both demonstrated by ersatztv#649 being implemented TWICE in parallel to completion on the same day. Subagents. The kickoff's HARD CONSTRAINTS already require parallel disjoint slices, mandatory independent review from a cold brief, and a named model/effort per dispatch — none of which is satisfiable without delegation. But nothing said so outright, and a generic client preamble of the form "do not use the Agent tool unless the user requested it" reads as a prohibition. Now stated plainly in both CLAUDE.md (always loaded) and the kickoff (pasted per session), with what to delegate and what to keep inline. Claiming. `in-progress` prevents duplicate PICKUP, not duplicate WORK — the record already said so, but step 3 told you to apply the label and nothing else. It now requires four checks first: an open PR whose body says `fixes #N`, a remote branch naming the number, a claiming comment predating the label (exactly what select-queue.sh's CLAIM? flag raises and deliberately leaves unresolved), and a fresh git fetch. Each fails differently; all four are cheap. Staleness. The second half of the #649 collision was reading origin/main once, at branch time, and not again across hours and four review rounds. A branch on a stale base computes its diff against that base, so `git diff origin/main` shows other sessions' merged work as DELETIONS and pushing it reverts them. Re-fetch before every push, rebase when it moved. process.parallel-session-claim carries the incident, including what worked: the merged implementation was better in one respect and the discarded branch's test coverage was salvageable, so diff the two before discarding yours.	2026-07-27 07:44:25 +02:00
timothy	2d6f78e379	fix(617): make the cross-repo skills real symlinks and reconcile the ersatztv skill ... `.claude/skills/jellyfin/` was a real directory holding a stale fork of the canonical server-management copy, not the symlink CLAUDE.md described. It documented `X-Emby-Token` as *the* auth pattern (v12 only accepts it via `EnableLegacyAuthorization`, slated for removal in v13) and omitted the `DELETE /Items/{id}` data-loss warning that has destroyed files three times. Replaced with a relative symlink, matching the pattern server-management already uses for beets/radarr/sonarr. `.claude/skills/ersatztv/` had diverged in BOTH directions, so a replace in either direction would have lost correct content. Contrary to the issue's framing, server-management's copy was stale only in its `description:` — its body already said "Full REST CRUD is available under /api/v1" and carried ~150 lines the ersatztv copy lacked (backup/deploy, test/prod topology, streaming-mode analysis, VAAPI-vs-QSV, table schema notes, checklists). So that file is the base, reconciled here as the canonical copy: - fixed the dangerous `description:` claiming CRUD requires SQLite scripting - ported ersatztv-only content: the silent root-owned api.key 401 trap, the lying OCI labels, the local-vs-UTC log timestamp trap, the endpoint-index pointer, `settings/ffmpeg` ordering, scoped test-image refresh - added the #616 paging facts (0-based pageNum, per-endpoint pageSize cap, playout/reset takes a CHANNEL id) per the request on #617 - corrected prod auto-update: `auto_update: false`, manual DeployStack only, no 03:00 fallback (contradicted the fork's CLAUDE.md) - corrected the ErsatzTV library ids: Music Videos is 16 and Standup 14, not 8/9 — verified live via GET /api/v1/media-sources - unpinned the stale v26.8.0 image reference (current release is v26.12.0) fixes #617	2026-07-26 00:34:09 +02:00
timothy	628ae46f7f	fix(622): bind H10 merge consent to the reviewed sha via a required commit status ... `pretooluse-merge-consent.sh` proves all three consent conditions at the moment the merge tool is called. With `merge_when_checks_succeed=true`, condition (a) is delegated to Gitea, which then merges whatever head is green at ITS merge time — while (b) Done-when and (c) the head-referencing verdict were proven against the head at SCHEDULING time. Every commit pushed in between merges unreviewed. The gate is not bypassed; it is satisfied against a snapshot that stops being true. Demonstrated as a controlled A/B rather than inferred, with a CI check left pending so Gitea waits as it really does: without a required verdict context: unreviewed commit B MERGED with it: same sequence REFUSED after reviewing B and posting it: merges — blocked, not deadlocked NOTE the anecdote in #622 is wrong and is corrected in the docs rather than repeated: PR #619 does carry `Review-verdict: MERGEABLE @ 02c82b35`, posted six seconds before the merge, explicitly re-reviewing the follow-up commits. #622 was filed off a lagging API read. The hole is real regardless, and structural — nothing FORCED that re-review inside the window Gitea would have merged in. This turns a property that held by diligence into one that holds by construction. The fix is the sha, not a smarter check. A Gitea commit status belongs to exactly one commit, so a status written for a parent cannot be inherited by a child that did not exist yet. `review-verdict/h10` becomes a REQUIRED status check on main: push a new head and the context is simply absent, which Gitea reads as not-passing (verified against 1.25.4: missing AND pending both block, and auto-merge re-checks the current head). It also covers merge paths the hook never sees — Gitea UI, raw API, another agent's session. - scripts/post-review-verdict.sh writes the comment and the status together so they cannot drift, and re-reads head after commenting: if a commit landed mid-flight it writes NO status and exits non-zero rather than retargeting the verdict at a commit nobody read. - .gitea/workflows/review-verdict.yml auto-passes the two exempt classes that would otherwise deadlock — Renovate-authored (platformAutomerge) and docs-only — and marks everything else pending. Exemptions are void when the PR touches .claude/, .gitea/, .husky/, scripts/ or docker/ci/. - The hook refuses to SCHEDULE an auto-merge unless that status is green on head, and no longer claims "CI green" on the mwcs path, where it never read CI. Two silent false negatives in the exemption path, both found by verifying rather than reasoning, both fixed at BOTH call sites (workflow and the hook's pre-existing docs-only carve-out): - The files endpoint caps at 50 rows and IGNORES a larger `limit` — PR #619 has 194 changed files and `?limit=100` returns 50. A single page saw ZERO protected paths there where the full enumeration finds ten. Both now page to exhaustion and withhold the exemption if they cannot complete. - A rename is ONE row whose `filename` is the destination, the source only in `previous_filename`. Verified live: `.gitea/workflows/renovate.yml` -> `docs/innocuous-note.md` presented as docs-only with no protected path visible. Both now read BOTH sides. Limits are documented, not papered over: base changes leave the head sha (and so the verdict) unchanged, and a PR editing the workflow is judged by its own edited copy — so PROTECTED is a guardrail against accident, not a tamper-proof control. fixes #622	2026-07-25 21:51:02 +02:00
timothy	fba5233caf	feat(610): split the decision corpus into one YAML-frontmatter file per record ... 168 records -> docs/decisions/records/<area>/<topic>.md (163 active, 23 dirs) and docs/decisions/archive/<area>/<topic>.md (5 archived). The filename IS the key, so one-active-record-per-key becomes a filesystem property rather than a validator check, and supersession becomes a `git mv`. WHY: the monolith was a concurrency problem before an aesthetic one. A 3,900-line append target made parallel sessions collide -- PR #605 and PR #614 both hit append-vs-append conflicts during routine rebases, and hand-resolving those inside the corpus is exactly the operation the rationale-rewrite guard exists to police. HOW IT IS VERIFIED: a ~170-file diff cannot be meaningfully read, so correctness does not rest on reading it. The parser was taught BOTH formats first, so the body-diff guard parses the old form at the merge-base and the new form at head -- the migration validates itself, no bypass. The proof is a field-level equivalence harness: 168 records before and after, zero lost, zero gained, zero field mismatches, zero rationale bodies differing. Reviewers should scrutinise the harness; it is the actual evidence. What measuring caught that reading would not have: - ~500 lines sit OUTSIDE any record -- decisions.md's lifecycle schema and each topic file's preamble, mostly the only copy. Source files are kept and stripped, never deleted. They also cannot be filed per-area: topic files hold several areas and 4 of 23 areas span several files. - Archive discovery was a non-recursive glob; after the split it found ZERO archived records, surfacing as four bogus "supersedes points to unknown key" errors rather than an obvious failure. - ~32 live docs point into the corpus BY DATE, which the split dangles. Each stripped file now ends with a generated "Records formerly in this file" index, which also rescues the identical breadcrumbs in old issue comments. - decisions.md's "In this file:" list was 97 same-file anchor bullets that the split makes WRONG, not merely stale. Dropped; the generated index replaces them with links that resolve. The equivalence harness now runs against a checked-in FIXTURE, not the live corpus. The earlier version migrated the real tree, which made it a one-shot: the moment the migration landed there was nothing left to move and the tests failed for reasons unrelated to the code. A fixture keeps them testing the SCRIPT rather than the repo's current state. Keys preserved verbatim, warts included: `sched` (12) and `scheduling` (1) remain two directories for one concept. Renaming a key is not a move -- it changes identity, breaks the equivalence proof, and invalidates MemPalace's per-key drawers. Taxonomy normalisation is separate work. refs #610	2026-07-25 19:45:09 +02:00
timothyandClaude Opus 5	e678e6653e	chore(docs): trim derivable content from CLAUDE.md, lazy-load the task-completion protocol ... Session context/config checkup (/doctor) found ~2.5k chars of always-loaded CLAUDE.md text that a session can reconstruct from the codebase, plus a task-specific workflow that only matters when closing an issue. Cut (derivable from the repo): - the `### Project Layout` table (what `ls` shows) - the `dotnet build` / `dotnet run` invocations (standard for the toolchain; the non-obvious `docker build -f docker/Dockerfile` line is kept) - the Language / Media / Functional C# bullets (stated by the csproj and Directory.Packages.props) Migrated to lazy loading: - the 7 mandatory completion steps and the `## Closing record` template move to .claude/skills/closing-an-issue/SKILL.md; only its one-line description stays resident. The `## Done-when` / merge-consent block stays in CLAUDE.md on purpose — it is safety-critical and describes hook behaviour that fires whether or not a skill was loaded. CLAUDE.md 13,306 -> 10,801 chars (~625 est. tokens saved per session). No convention, route, endpoint or decision changes, so no other doc updates are triggered by the docs-update table. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-25 11:22:48 +02:00
timothyandClaude Opus 4.8	962dc2a31a	feat(520): parallel orientation+selection startup; retire #237 as live state; #642 retrieval bullets [decisions-edit] ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 11:48:14 +02:00
timothyandClaude Opus 4.8	f93458c76c	fix(521): whole-branch review — correct Gitea anchors, guard archive+demotion, reciprocal links, stale append-only refs, budget warning [decisions-edit] ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 03:00:15 +02:00
timothy	7248416bd6	docs(release): Komodo stack is jazz-media; no auto-update fallback ... Verified live while promoting v26.11.0. Two corrections: 1. `DeployStack media-servers` targets a DEAD stack. The Komodo stack name changed to `jazz-media` with the move to jazz; the compose PROJECT is still `media-servers` (which is what container labels show, so the labels don't catch this). A `media-servers` stack still exists on bumblebee in state `unhealthy` — the stopped migration leftovers — so the documented command silently deploys the wrong, dead thing. 2. There is no Global Auto Update fallback: `jazz-media` has auto_update=false (poll_for_updates=true only). Promotion is manual, full stop, and the 'don't cut a tag near the 03:00 run' caveat is obsolete. The pre-deploy safety chain is intact and jazz-aware (#635) — verified by reading the deploy's Pre Deploy stage: image-change trigger fired, 286M backup with integrity_check=ok plus off-box PBS, migration smoke PASS against the prod-copy, then only ersatztv recreated.	2026-07-20 23:04:34 +02:00
timothy	d6aec6de76	docs(release): prepare v26.11.0 promotion — correct the deploy host to jazz ... The media transcoders (Jellyfin, ersatztv, ersatztv-test) moved from bumblebee to jazz (192.168.1.29) on 2026-07-20, server-management#633. Our docs still sent the release operator to bumblebee for security-scan.sh and named it as the docker host, which would have scanned the wrong box. Also fixes the inverse error: `jazz` was an EARLIER name for the .99 host, so three pre-migration references meaning today's bumblebee read as jazz. Those are now bumblebee, and a Hosts table + name-reuse warning is added at the top of ci-cd.md so the next session resolves hostnames by IP rather than re-breaking it in either direction. Version table had drifted (stopped at v26.9.0) — adds v26.10.0 + v26.11.0.	2026-07-20 19:18:03 +02:00
timothyandCodex	985eed072c	docs(release): prepare v26.8.0 promotion [decisions-edit] ... refs #335 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:50:39 +02:00
timothyandClaude Opus 4.8	8565f731cd	fix(process): #317 merge-consent gate auto-grants on satisfied path (no double-prompt) ... The H6/H10 merge-consent hook's satisfied path did a bare `exit 0`, which does not auto-approve a PreToolUse tool call — it only declines to block, so control fell through to the normal permission system and the raw MCP prompt still fired. A ready-to-merge PR was therefore confirmed twice (conversationally + a redundant mechanical prompt). Emit permissionDecision "allow" (new `grant` decision) on the satisfied and docs-exempt paths so the derived state IS the consent; deny/ask unchanged (fail-closed); non-merge methods keep the exit-0 passthrough. Docs: CLAUDE.md, kickoff HARD CONSTRAINTS, docs/decisions.md (append-only, pure insert). Verified: 7 pipe tests (satisfied->allow, unticked->deny, stale->deny, red-CI->deny, no-verdict->ask, no-creds->ask, non-merge->passthrough). fixes #317 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:52:26 +02:00
timothyandClaude Opus 4.8	9fd8f40541	chore(process): #303 H10 — review-verdict merge-gate (latest commit must be reviewed) ... Folds condition (c) into pretooluse-merge-consent.sh (H6): a PR merge is allowed only when a `Review-verdict:` comment references the PR's CURRENT head sha — proving the latest commit was reviewed, not a stale earlier diff (mechanizes the ersatztv#242 "re-review the fix commit" lesson). Graceful adoption mirrors H6's Done-when tiering: - positive verdict @ head -> allow - verdict @ older sha (stale) -> deny (#242 failure mode) - head verdict negative -> deny - marker with no sha / none yet -> ask - comments unfetchable -> ask Reuses H6's PR fetch, docs-only exemption, and Gitea-auth-from-env (one hook, no detection drift — per the #303 methodology review). Pipe-tested 12 cases. Docs: decisions.md (new H10 entry + TOC), CLAUDE.md Task Completion Protocol. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:54:05 +02:00
timothyandClaude Opus 4.8	0badff811d	feat(process): #303 H6 merge-consent derived from ## Done-when checklist ... Wave 2 hook H6: derive merge-consent from state instead of memory. An issue's ## Done-when checklist (issue body) becomes the machine-readable source of truth for whether its PR may merge — the structural fix for the queue-drift #303 tracks (status was living in append-only prose). - pretooluse-merge-consent.sh (Claude PreToolUse on mcp__gitea__ pull_request_write): a merge is ALLOWED only when the PR's CI is green AND every ## Done-when box on the linked issue (fixes #N) is ticked; DENY on an unticked box / red CI; ASK (human prompt) when state isn't derivable (no linked issue, no section, no creds, Gitea down). Docs/ process-only PRs exempt. - .husky/pre-push -> prepush-donewhen.sh: fail-open backstop for a direct `git push origin main`; blocks only on a positively-proven unticked box. Gitea auth from env only (ETV_GITEA_BASICAUTH / ETV_GITEA_TOKEN, ETV_GITEA_URL) — nothing committed; without creds the gate degrades to today's manual confirmation, never a silent pass. Non-breaking rollout: until issues adopt ## Done-when the merge hook simply asks. Pipe-tested: non-merge->allow, no-creds->ask, docs-only->allow, checklist parser (unit), linked-issue extraction, and a live end-to-end block path (temp Done-when on #303 -> exit 1 -> restored). Docs: CLAUDE.md Task Completion Protocol + decisions.md entry. Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:29:34 +02:00
timothyandClaude Opus 4.8	408b0deb89	feat(91b): remove legacy Blazor Server UI (#91 phase b) ... The ChicoryTV React SPA (web/, served at /app) now has full parity for every route the Blazor UI served, so the legacy Blazor Server / MudBlazor UI is deleted. This is the milestone-capping removal of #91 phase (b). Deleted: ErsatzTV/Pages/**, Shared/**, ViewModels/** (39 edit VMs), Validators/** (10 edit-VM validators), App.razor, _Imports.razor, Locals/{Shared,Pages}/** (Blazor loc resx; Locals/Resources.* kept), wwwroot/css + wwwroot/lib, libman.json, and the orphaned MultiSelectBaseTests. Startup.cs (surgical, not wholesale): removed AddRazorPages/AuthorizeFolder, AddServerSideBlazor, AddMudServices, AddSortable, AddCourier, the HtmlSanitizer registration, the Blazor-attached OIDC UseAuthentication/UseAuthorization middleware (per the #206 auth-posture sign-off), MapBlazorHub, and MapFallbackToPage("/_Host"). Renamed the branch blazor->legacy; it still co-hosts MapControllers, /docs (Scalar), dev MapOpenApi and the redirect middleware. Replaced the _Host fallback with a catch-all (MapFallback -> 302 /app) that excludes /api|/artwork|/docs|/openapi (genuine 404) per #204. Kept all OIDC/JWT/API-key service wiring (inert unless configured; real auth is #197), ConditionalIptvAuthorizeFilter, ApiKeyAuthorizationFilter. Pruned 9 now-unused packages (all verified zero remaining consumers) from Directory.Packages.props + ErsatzTV.csproj: MudBlazor, Heron.MudCalendar, Blazored.FluentValidation, BlazorSortable, MediatR.Courier.DependencyInjection, Markdig, HtmlSanitizer, Chronic.Core, NaturalSort.Extension. Also removed the now-dead #25 razor-Sonar NoWarn. LegacyUiRedirects: added the 14 /media/sources/* -> /app/libraries/* redirects (SPA screens landed in #202) and lifted the #204-era /media/sources prefix ban. Tests: Release build clean; full solution suite green. Updated Startup source-text tests + added regression coverage that Blazor wiring is gone, the catch-all is wired, and all 14 media-sources routes redirect. Docs: blazor-route-parity.md (phase b COMPLETE), decisions.md (removal entry), CLAUDE.md, contributing.md, README.md all updated in this PR. Rollback: tag blazor-final is cut on pre-merge main as the first merge action. Part of #91. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-11 21:01:04 +02:00
timothyandClaude Opus 4.8	6bdb7dae1c	docs+ci: harden the docs-first rule + add a non-blocking parity-doc reminder ... CLAUDE.md Conventions: turn "read docs before exploring" into a hard rule with red-flag framing (do NOT reverse-engineer conventions from source; applies to subagents too) and a "which doc to update in the same PR" table. Add a lightweight, PR-only, NON-BLOCKING `docs-reminder` CI job that warns when a screen/route change skips docs/blazor-route-parity.md. No dotnet/node in that job (no actions/cache), so it can't hit the VM-127 cache-save issues (server-management#570). Documented in docs/ci-cd.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-08 22:17:25 +02:00
timothyandClaude Fable 5	50ae0a7f3b	docs: onboarding/convention docs part 1 + handoff past #180/#182/#183 (parity endgame) ... Adds docs/README.md (index), api-conventions.md, spa-conventions.md, e2e-local.md + scripts/e2e-local.sh, blazor-route-parity.md (#91 phase-b tracker), domain-model.md, decisions.md. Rule (CLAUDE.md): read these at session start instead of re-recon; update in the same PR that changes a convention/route/decision. Part 2 = #185. Handoff: #180/#141/#158/#161 closed (PRs #181/#182/#183); #145 playback-only; #91 readiness plan posted; next prompt = #185 + quick wins + #155/#151/#152/#153. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-08 00:03:01 +02:00
timothyandClaude Fable 5	a709dccec7	docs: advance ChicoryTV queue past #144/#162 (scheduling parity DONE, PRs #170-#175/#179); next = #145/#141 leftovers ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 21:05:59 +02:00
timothyandClaude Fable 5	e00b7e4d11	docs: advance ChicoryTV queue past parity pass 2 (#142/#143 closed, #141/#145 partial, #157 fixed; PRs #165-#169); next = #144 scheduling slices ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 16:24:18 +02:00
timothyandClaude Fable 5	22fa3ecb08	docs: advance ChicoryTV queue past parity #140/#146/#147 (PRs #150/#154/#156); gaps #151-#153/#155 filed; next prompt = parity #141-#145 ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 12:57:51 +02:00
timothyandClaude Fable 5	1cf4a7a90c	docs: v26.5.0 tagged + deployed to prod (Komodo GitOps pin); deployment section reflects pinned-tag releases ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 11:39:02 +02:00
timothyandClaude Fable 5	21ede49253	docs: advance ChicoryTV issue queue past #91 phase (a) (PR #148); CLAUDE.md reflects SPA-default UI; next prompt = post-cutover housekeeping + parity kickoff ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 11:21:35 +02:00
timothyandClaude Fable 5	16674ba80e	docs: advance ChicoryTV issue queue past #64 (PR #133); next prompt = #63 composite create-channel ... Also: record prod cutover as done in CLAUDE.md (fork :prod live since 2026-06-27) and add standing v26.4.0 release-checkpoint note to the handoff. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 19:45:08 +02:00
timothyandClaude Opus 4.8	969a23909a	docs: add retroactive contributors/style guide (#10) ... docs/contributing.md — a descriptive guide to the established patterns, derived from the existing code: architecture/layering, CQRS handler conventions, LanguageExt functional style, Blazor/MudBlazor UI, EF Core + dual-provider migrations, the FFmpeg pipeline pattern, naming/formatting/analyzers, testing, and build/CI — each with concrete file references — plus the deviation policy (match the established style; diverge only with a concrete, stated reason). Several sections are now CI-enforced (#12 layering, #15 analyzers, #13 migrations, #11 golden tests). CLAUDE.md points to it so it's loaded as project guidance. Survey across the sections done with parallel read-only agents; all file references verified to exist. Refs #10 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 11:45:38 +02:00
timothyandClaude Opus 4.8	307da32f34	ci: EF migration integrity checks for SQLite + MySql (#13) ... New `migrations` job in docker-build.yml runs on every push/PR and, per provider: - `dotnet ef migrations has-pending-model-changes` — fails on model drift (an entity changed without a matching migration). - `dotnet ef database update` against a fresh empty DB — applies all migrations, catching broken/un-orderable ones. SQLite (the prod provider) uses a throwaway file; MySql uses ServerVersion.AutoDetect (connects at config time), so the job runs a `services: mysql:8.4` container (the act_runner uses Docker execution on network downloadswarm, so the service is reachable as `mysql:3306`). Independent gate for now (not a `needs:` of the image build) so the MySql-service dependency can't block image builds until proven stable. Validated both providers locally against real DBs: SQLite 787 migrations -> 139 tables; MySql 8.4 305 migrations -> 137 tables; both model-drift checks clean. Docs: ci-cd.md "Migration integrity" (dual-provider discipline, EF CLI pattern, the non-transactional caveat) + CLAUDE.md convention. Refs #13 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 10:58:41 +02:00
timothyandClaude Opus 4.8	97bf50cb5b	docs(renovate): document live Renovate setup [skip ci] ... Renovate is now live (PR #18/#19): self-hosted weekly Gitea Actions job that opens dependency-update + OSV vuln-fix PRs and a Dependency Dashboard, with patch-level auto-merge scoped to test/dev-only packages. Document it under docs/ci-cd.md → Dependency management, plus a CLAUDE.md conventions pointer. refs server-management#484 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 01:57:11 +02:00
timothyandClaude Opus 4.8	d9cdff8154	docs: record Central Package Management + scheduled vuln scan (#14) [skip ci] ... - ci-cd.md: new "Dependency management" section (CPM, NuGet audit, scheduled dependency-scan.yml); Dockerfile notes now list Directory.Packages.props and why it's required before restore. - CLAUDE.md: dependency convention (edit central Directory.Packages.props, never re-add Version=); correct the test framework note (NUnit, not xUnit). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 01:33:44 +02:00
timothyandClaude Opus 4.8	c7aad4689e	docs: enshrine the fork versioning scheme ... Document upstream's vYY.<release-seq>.<patch> scheme (year, sequential release-in-year, patch) in docs/ci-cd.md + CLAUDE.md so we follow it going forward: <release-seq> is NOT the calendar month (v25.2.0 shipped in June, v26.3.0 in Feb), it's a per-year counter that resets each January. v26.3.1 = our infra-only rebuild of upstream 26.3.0; v26.4.0 reserved for the first release with app changes. Also notes the [skip ci]-on-a-tagged-commit gotcha. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 00:29:13 +02:00
timothyandClaude Opus 4.8	c0c37d8987	docs: point CLAUDE.md deployment at the fork image/pipeline [skip ci] ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 00:15:52 +02:00
timothyandClaude Opus 4.6	aa6d8eae4c	Add Task Completion Protocol to CLAUDE.md ... Replace informal implementer workflow with structured 7-step protocol including mandatory root cause analysis for bug fixes. References /done skill for automated enforcement. Part of adversarial-reviewer #260. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-21 22:29:45 +01:00
timothyandClaude Opus 4.6	f1e97b94a7	Add architecture docs and fork maintenance strategy (#6) ... Document channel architecture, M3U/XMLTV integration with Jellyfin, and fork maintenance strategy for the archived upstream. Also includes CLAUDE.md updates for implementer workflow and project boundaries. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-17 22:42:07 +01:00
timothyandClaude Opus 4.6	5034941a79	Add Claude Code project setup ... - CLAUDE.md with architecture overview and development guide - .mcp.json with docker, ssh, gitea, csharp-lsp, and nuget MCP servers - Skills for ersatztv and jellyfin - .gitignore: exclude .mcp/ (built MCP tools) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-26 23:50:41 +01:00