305 Commits

Include renames

Author	SHA1	Message	Date
timothyandOpenAI Codex	b2c093d2d6	docs(e2e): record real media-source validation results ... Refs #333 Co-Authored-By: OpenAI Codex <codex@openai.com>	2026-07-13 22:51:52 +02:00
timothyandCodex	8da1256ffa	docs(workflow): enforce session-wide cost routing ... Fixes #342 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:43:11 +02:00
timothyandCodex	2609b4ce59	fix: add cross-origin resource policy header ... Fixes #330 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 21:25:06 +02:00
timothyandCodex	80751a5d74	docs: require low-cost queue selection preflight ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 20:56:23 +02:00
timothyandCodex	985eed072c	docs(release): prepare v26.8.0 promotion [decisions-edit] ... refs #335 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:50:39 +02:00
timothyandCodex	977f9125a5	docs: track #202 real-server integration validation ... refs #202 #333 Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 19:05:04 +02:00
timothyandCodex	954aff21f1	docs: make issue queue handoff client-neutral ... Co-Authored-By: Codex <noreply@openai.com>	2026-07-13 18:59:40 +02:00
timothyandClaude Opus 4.8	366d5d316c	feat(ci): #314 — repeatable black-box security scan (authenticated ZAP + semgrep) ... scripts/security-scan.sh: boots a THROWAWAY container from the image under test (fresh config volume; never the deployed prod/test container — the active scan attacks write endpoints), reads its machine key, and runs an authenticated OWASP ZAP api-scan that imports /openapi/v1.json (all 160 /api/v1 ops) and injects X-Api-Key on every request via a replacer rule so it reaches the [RequiresAuthentication] + RequireKeyForReads surface — then a semgrep SAST cross-check. Wrapped in `timeout` because zap-api-scan can hang in post-scan cleanup after the report is already written. docs/ci-cd.md: new 'Security scanning' section (out-of-ecosystem black-box gate, run on the docker host per-release like migration-smoke, not a per-PR CI job) + the Microsoft.OpenApi 2.7.5 pin note in dependency management. refs #314 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 08:28:13 +02:00
timothyandClaude Opus 4.8	216130b4d7	fix(#172): API hardening — null-name 500s, duplicate template items, unreachable 404 ... Clears the still-live findings from #172 (verified against main; #2/#4/#7 and the auth/search/Trakt tail were already deliberate-documented or fixed since 2026-07-07). - Null/empty Name → 500 (10 create/replace handlers). Block/Template/DecoTemplate/Deco Create+Replace/Update + UpdateFFmpegProfile did `request.Name.Length > 50` on a client-nullable string → unhandled NullReferenceException → HTTP 500 (no global exception filter). Now `string.IsNullOrWhiteSpace(request.Name) || .Length > 50` → 422; also rejects empty/whitespace names, matching the group-create handlers' NotEmpty behavior. CreatePlaylist coalesces null→"" at the DTO so it was an empty-name persist, not a 500; guarded the same way. - ReplaceTemplateItems overlap validation iterated with an `item == otherItem` record value-equality skip, so two exact-duplicate items were value-equal and bypassed the intersection check (both persisted). Now index-based (i != j) so duplicates register as a self-intersection and are rejected 422. - Trimmed the unreachable 404 ProducesResponseType from POST /api/blocks/groups and POST /api/templates/groups (a create has no parent lookup that can 404); v1.json regenerated. - Regression tests: all 10 name-guard paths + the duplicate-items path (19 cases). - Docs: decisions.md entry + api-conventions.md §3b null-safe-validation bullet. fixes #172 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 01:16:52 +02:00
timothyandClaude Opus 4.8	ef2bd65c27	feat(api): #286 — mount the whole /api surface at /api/v1 ... Version every /api route to /api/v1 (251 controller routes + ~24 Location headers + the scanner callback URL + the Startup request-log literal), uniform across the machine API, auth, scanner and scripted-build surfaces. Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth headers and query survive — carrying RFC 8594 Deprecation/Sunset headers, so curl / the future MCP server / bookmarks keep working. An already- versioned path passes through; a future /api/v2 is never forced to v1. Standardize the route convention (leading-slash absolute route per method, no class-[Route] — except the two Scanner/Scripted controllers whose ~all actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests (^/api/v\d+/ over the whole Controllers.Api surface; browser-nav /auth/oidc/login is out of scope). Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945 SPA request literals + the test mocks (regex + positional URL parsers). /api/v1 is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases (owner decision) with removal tracked as a Phase-3 follow-up. Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/ blazor-route-parity/e2e-local/domain-model. fixes #286 refs #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-13 00:30:20 +02:00
timothyandClaude Opus 4.8	51b67dea06	fix(#238): review — trakt sub-route no-op + data-driven wiring test ... Cold-review follow-ups (both non-blocking): - Low: the TopBar "Add Trakt List" button was a silent no-op on the /app/trakt-lists/{id} detail sub-route (setAddOpen state isn't rendered by the editor branch, and the screen is keyed by pathname so the state wouldn't survive a navigate). Guard on editingId: route back to the list from the detail view, open the dialog from the list. - Nit: the invariant test only spot-checked 2 screens. Replaced with a data-driven it.each over the 4 URL-navigating create screens (channels, filler, ffmpeg, watermarks) asserting each banner actually navigates — a typo'd route id now fails red. Docs wording corrected to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothyandClaude Opus 4.8	612b11589c	fix(#238): wire TopBar primary-action on create screens, drop dead buttons ... The shell TopBar rendered a primary-action button (Plus icon) for every screen, but only SchedulesScreen subscribed to its ctv:primary-action event — so every other screen's button was dead (a labelled no-op, or a bare "+" for the ~10 routes whose primaryAction was ''). Resolution (issue #238): the Plus-icon button is a "create new item" affordance. Keep + wire it only on the 8 list screens with a single create flow (channels, schedules, multi/rerun collections, trakt lists, filler presets, ffmpeg profiles, watermarks) via a shared usePrimaryAction hook (web/src/primaryAction.ts); drop it (primaryAction: '') everywhere else — where the action isn't a create (Save/Refresh/Play/Validate/Reset/Scan, all of which have correct in-body controls), is ambiguous (collections tabs), a silent no-op (builder, playlists), or misplaced (dashboard, libraries). The TopBar now renders the button only when primaryAction is non-empty. Also relabels the apiKey route's stale post-#295 "Save key"/description. Docs: spa-conventions.md §10 + decisions.md 2026-07-12. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:35:59 +02:00
timothyandClaude Opus 4.8	8090e10408	fix(api): #265 — If-Match evaluates per RFC 7232 (valid-but-non-matching → 412, not 400) ... The shared optimistic-concurrency parser (ConcurrencyHeaders.ParseIfMatch) classified any non-canonical/weak/list If-Match value as Malformed → 400. Per RFC 7232 §3.1 a syntactically -valid entity-tag that simply doesn't strong-match must be 412; 400 is only for a genuine grammar violation. - Rewrite ParseIfMatch as a real RFC 7232 entity-tag/list parser: walks the comma-separated 1#entity-tag list, validates each [W/]DQUOTE *etagc DQUOTE member, and collects the strong members whose opaque text is our canonical decimal. Weak / empty / non-canonical / out-of-range tags are valid but contribute no version (→ empty set → 412); genuine grammar violations (unquoted, SP-in-tag, unterminated, garbage) → 400. - Reshape IfMatchCondition.ExpectedVersion : Option<int> → ExpectedVersions : Option<Seq<int>> and VersionedAggregateExtensions.CheckVersion → set membership (any strong match proceeds; empty set always 412). Threads through 10 replace/update commands + handlers + request mappers + 9 controllers. - No wire-contract change (400 + 412 already declared on every PUT; the field is header-derived and internal — no DTO/route/response-type/OpenAPI change). - Tests: ConcurrencyHeadersTests rewritten for the new classification (lists, weak, empty, non-canonical → Version/empty-set; grammar violations → Malformed) + new VersionedAggregateExtensionsTests for CheckVersion membership/empty-set/force-write. - Docs: api-conventions.md §7a rewritten; decisions.md entry appended. Refs #253 #197 fixes #265 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 23:09:36 +02:00
timothyandClaude Opus 4.8	6537697fe5	test(#319): hash-drift guard prefers the built index.html when present ... Addresses the cold-review LOW: the guard hashed only the committed source web/index.html, so a hypothetical future Vite transform of the inline script would leave the test green while the deployed CSP silently broke the SPA. It now hashes the built wwwroot/app/index.html when it exists (the exact bytes the browser hashes — full coverage on any local build), falling back to the source only in a fresh CI checkout where the built artifact is gitignored/absent. Vite copies the inline script verbatim today, so the two agree. Doc comments + decisions.md synced. Test-and-docs only; no production code change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:41:24 +02:00
timothyandClaude Opus 4.8	873b3e54a5	security(#319): enforcing CSP + Permissions-Policy on the host ... Completes the CSP the #279 baseline-headers middleware deferred. Surfaced by the #314 ZAP baseline (missing CSP/Permissions-Policy WARNs); a #197 exit item. SecurityHeadersMiddleware now also sets Permissions-Policy (deny-all for camera/mic/geolocation/payment/usb) and an enforcing Content-Security-Policy on every response EXCEPT /docs (Scalar) and /openapi — those rely on inline bootstrap scripts/styles a strict policy would break (baseline headers still apply; hardening that admin surface is a #197 follow-up). CSP: default-src 'self'; script-src 'self' + the hash of the SPA's inline theme-bootstrap script (no 'unsafe-inline'/'unsafe-eval'); style-src adds 'unsafe-inline' (React inline styles) + fonts.googleapis.com; font-src adds fonts.gstatic.com; img-src adds data:/blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'. The Google Fonts allowance (the SPA CSS @imports the Geist web font) was caught by live-E2E, which the static recon missed. A guard test hashes the committed web/index.html inline script and fails if it drifts from the middleware constant (the built wwwroot/app is gitignored/absent in CI, and Vite copies the inline script verbatim). Verified: full test pass, live-E2E (SPA renders clean, zero CSP violations), curl (CSP present on /app + /api, absent on /docs + /openapi). Docs: docs/decisions.md entry. fixes #319 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 22:36:44 +02:00
timothyandClaude Opus 4.8	ec26e1be5b	fix(api): #316 review — POST-ify graphics-elements refresh, LockedError→409, no-store machine-key ... - GET /api/graphics-elements no longer side-effects; refresh moved to POST /api/graphics-elements/refresh (204), closing a CSRF vector on a GET. - PrepareTroubleshootingPlaybackHandler now returns a typed LockedError from both atomic lock-acquire failures; ApiResults.ToErrorResult maps it to 409 instead of falling through to 422, so a lock lost in the race between the controller's pre-check and the handler's atomic acquire still reports 409. - AuthController.MachineKey sets Cache-Control: no-store + Pragma: no-cache on the 200 response carrying the master API key. - Reworded the stale "subtitleId query parameter" endpoint description now that playback/start takes a JSON body. - Regenerated openapi/v1.json + docs/endpoint-index.md; docs/api-conventions.md updated with the LockedError pattern (§3a) and the ToErrorResult table row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	461c763dc6	docs: #295 PR2 + #301 — decisions entry, api-conventions §9, e2e-local browser flow ... - decisions.md: new entry (SPA cookie-only cutover, boot-gate-not-route, #301 POST-ification rationale, machine-key-read + OIDC-logout residual) + TOC line. - api-conventions §9: #301 resolved (POST-ify) + 'never add a side-effecting GET' standing rule; machine-key endpoint added to the auth surface list; PR2-shipped note. - e2e-local: fix stale 'no key required' claim (fail-closed since #197) + browser setup/login boot-gate flow. (spa-conventions §5e rewrite landed with the SPA-consumers slice.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:42 +02:00
timothyandClaude Opus 4.8	de9fc7e8cc	feat(web): #295 PR2 SPA consumers — troubleshoot POST/blob downloads + machine-key screen + password change ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	88d82266b6	feat(api): #301 POST-ify side-effecting troubleshoot GETs + GET /api/auth/machine-key ... Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:50:24 +02:00
timothyandClaude Opus 4.8	4da2b67ab2	feat(ci): #315 migration-on-prod-copy smoke for the release path ... CI's migrations job only proves a migration is well-formed against a fresh, empty DB. It never exercises the migration — or ErsatzTV's startup data steps (DatabaseMigratorService -> DbInitializer + PopulatePathHashes over the real MediaFile table) — against the accumulated prod SQLite, so a migration green on a fresh DB can still fail/corrupt on prod, found only mid-deploy. scripts/migration-smoke.sh rehearses it on a THROWAWAY copy of the latest prod backup: boots the new image against the copy, gates PASS on the "Done applying database migrations" log line (the migrator is a BackgroundService running concurrently with Kestrel, so HTTP readiness alone doesn't prove migrations finished), FAILs on early container exit / migration exception / timeout / not serving afterwards. Always operates on a copy, never the live DB; tears down its container + temp dir (incl. the container's root-owned config files) on exit. Validated live 2026-07-12: :latest vs a copy of the 283MB prod backup -> migrations applied cleanly, app booted+served, temp dir removed. Home split: this repo owns the script + docs; wiring it into the Komodo pre-deploy step is server-management#589 (cross-repo). Docs: docs/ci-cd.md (Migration integrity), docs/decisions.md (new entry, pure insertion). fixes #315 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 21:18:16 +02:00
timothyandClaude Opus 4.8	90c8348efe	fix(process): #317 docs-only exemption stays passthrough, not silent auto-grant [decisions-edit] ... Adversarial-review nit on the first commit: auto-granting the docs-only exemption silently self-merges process-control PRs (.claude/.gitea/.husky — including the gate hook itself) with no prompt and no review, bypassing human-in-the-loop for exactly the files that control the gate. Restrict auto-grant to the genuinely- satisfied (a+b+c) merge path; the docs/process exemption reverts to bare exit-0 passthrough (one normal prompt). Corrects this PR's own decisions.md entry accordingly ([decisions-edit]: a not-yet-merged draft entry, not history). 8 pipe tests green (adds docs-only -> passthrough). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:58:26 +02:00
timothyandClaude Opus 4.8	8565f731cd	fix(process): #317 merge-consent gate auto-grants on satisfied path (no double-prompt) ... The H6/H10 merge-consent hook's satisfied path did a bare `exit 0`, which does not auto-approve a PreToolUse tool call — it only declines to block, so control fell through to the normal permission system and the raw MCP prompt still fired. A ready-to-merge PR was therefore confirmed twice (conversationally + a redundant mechanical prompt). Emit permissionDecision "allow" (new `grant` decision) on the satisfied and docs-exempt paths so the derived state IS the consent; deny/ask unchanged (fail-closed); non-merge methods keep the exit-0 passthrough. Docs: CLAUDE.md, kickoff HARD CONSTRAINTS, docs/decisions.md (append-only, pure insert). Verified: 7 pipe tests (satisfied->allow, unticked->deny, stale->deny, red-CI->deny, no-verdict->ask, no-creds->ask, non-merge->passthrough). fixes #317 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:52:26 +02:00
timothyandClaude Opus 4.8	f1b2521228	chore(process): #312 H12 — session-end issue-qualification audit ... scripts/issue-qualification-audit.sh: lists OPEN issues missing a `priority:` label (the #237 ranking keys off priority:/gate labels, so an unlabeled issue is invisible to it). "Fully qualified" = has a priority: label; gate-vs-backlog derives from the review label / milestone, and a milestone is NOT required (backlog is unmilestoned). Advisory (exit 1 if any unqualified); fail-open without Gitea creds. Wired into the kickoff session-end protocol + a lore bullet. Tested live (flagged 2) + no-creds no-op. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:21:20 +02:00
timothyandClaude Opus 4.8	19dbfe9a8b	docs(process): #311 — formatting-as-you-touch (§7) + rebase-not-merge lore + decisions entry ... - contributing.md §7: document fix-formatting-as-you-touch (normalize a legacy file you edit, incl. BOM strip; no big-bang), enforced by the pre-commit hook + the new format CI job. - kickoff lore: flip "merge main into PR branch" -> "rebase on origin/main" (H11 enforces it); keep the regenerate-generated-artifacts-on-conflict nugget. - decisions.md: new entry (+ TOC) for both decisions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:17:44 +02:00
timothyandClaude Opus 4.8	b20ee50b1f	docs(process): #303 follow-ups — Codex-skip rubric + write-path live-E2E requirement ... Two of the four non-hook #303 process follow-ups (the two docs items; the security scan and migration-on-prod-copy smoke are deferred to their own sessions): 1. Codex-skip rubric (kickoff workflow lore): an independent review pass is MANDATORY for diffs touching locks/concurrency, auth/security, API write-path handlers, or migrations, or >~150 changed C# lines; skippable only for a pure-SPA/docs leaf, and a skip must be stated + justified. Makes self-exemption an auditable claim (the correlated-blindspot net). 2. Live-E2E is now a STATED REQUIREMENT for API write-path handler changes: new "When live-E2E is required" section in docs/e2e-local.md + a decisions.md entry, formalizing the #229 lore bullet. The seeding recipe was already in e2e-local.md (added for #220), so the stale "recipe not yet in docs" lore bullet is pruned to a pointer. Docs-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 20:02:36 +02:00
timothyandClaude Opus 4.8	7a9b30de71	fix(api): #269 review fixes — rebase force-write delta so rotation survives a race (Codex F1/F3) ... Independent Codex review (reconciled by Fable against a MERGEABLE fork verdict) found SaveChangesForcingVersion silently DROPPED a pending Version++ under a concurrent versioned-write race: on DbUpdateConcurrencyException it adopted the DB's current Version verbatim (original = current = dbVersion), so a bumping sibling committed at dbVersion instead of dbVersion+1. Net: an editor holding the concurrent writer's ETag was never invalidated by the sibling's change — the exact lost-update the #253/#269 contract exists to close, lost under the very condition the helper handles. F1 fix (shared helper, corrects all 25 bumpers incl. the pre-existing Add*ToPlaylist / schedule-item writers): rebase the pending delta on top of the stored token — pendingDelta = current - original; original = dbVersion; current = dbVersion + pendingDelta Bumpers (delta 1) advance to dbVersion+1; non-bumpers/deletes (delta 0, e.g. ErasePlayoutHistory) still adopt the stored token unchanged, so RootWriterForceVersionTests is unaffected. Idempotent across the bounded retry loop. F3: the force-race tests now assert Version==3 (rebase), not just membership survival; added the missing Playout force-race+rotate test. Negative-controlled: with the helper fix reverted, both strengthened tests go red. F2 (Medium, deferred → #308): two concurrent same-item Add*ToCollection can both pass the membership check and the loser 500s on the composite-PK violation (DbUpdateException, which the helper doesn't catch). Pre-existing and narrow (no corruption); doc claims softened to name it. Filed #308. Docs: api-conventions §7a + decisions.md prose corrected from "adopt the stored token" to the rebase semantics. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:40:32 +02:00
timothyandClaude Opus 4.8	83f753b211	fix(api): #269 rotate aggregate ETag on Collection/Playout config siblings ... Complete the #253 optimistic-concurrency contract's cross-editor ETag rotation tail. The non-If-Match config siblings mutated editor-visible state without bumping Version, so a concurrent editor of the same root never invalidated. Now the Collection Add*/Remove handlers bump Collection.Version, and UpdateCollection / UpdatePlayout / the three ScheduleFile writers (which already force-wrote past a concurrent bump) now bump too — all via SaveChangesForcingVersion (no If-Match → force write, never 412/500). No-op idempotence (Fable-caught trap): these gate reindex/BuildPlayout fan-out on SaveChanges()>0, so an unconditional bump would fire spurious rebuilds on an idempotent re-add / same-value re-submit. Each now short-circuits a genuine no-op before the bump — Add handlers by an explicit membership check (also fixing a latent duplicate-CollectionItem insert), scalar writers by ChangeTracker.HasChanges(). Corrects #269's framing: the Add*ToCollection family is not repository-mediated (IMediaCollectionRepository is read-only); each handler writes via its own dbContext, so the scanner's separate membership path is unaffected (a background scan does not rotate the editor ETag). Tests: CollectionEtagRotationTests + PlayoutScheduleFileEtagRotationTests (rotation, no-op-without-bump-or-rebuild, force-write-past-concurrent-bump), no-op guard proven non-vacuous by inverting the membership check. Docs: api-conventions §7a + decisions.md. No new status codes / no OpenAPI change (these endpoints take no If-Match, never 412). The #265 RFC-7232 If-Match parser refinement is a separate PR. fixes #269 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:40:32 +02:00
timothyandClaude Opus 4.8	ff3df39c43	fix(process): #303 H10 — anchor verdict marker to line-start (close self-reference false-open) [decisions-edit] ... Second adversarial re-review (of the fix commit itself — dogfooding H10) found a remaining false-open: the `review-verdict:` marker was matched anywhere on a line, so a comment merely QUOTING the positive template — an instruction ("please post: Review-verdict: MERGEABLE @ <head>"), a blocking comment explaining how to clear itself, or the gate's OWN suggestion text echoed into a comment — was classified as a real head verdict and self-approved the merge. Fix: anchor the marker to line-start (`^[[:space:]]*review-verdict:`). A real verdict line starts with the marker; quoted/instructional uses have text before it. Also drops the dead `nosha` var (SC2034). Finding 2 (a BLOCKED mis-anchored to an OLDER sha doesn't retract a MERGEABLE@head) is deliberately NOT "fixed": staleness is symmetric — a pre-fix BLOCKED@oldsha must not block forever after the fix changes the sha and earns a fresh MERGEABLE@head. To retract, re-review head and post BLOCKED@head. Documented in decisions.md. Pipe-tested 21 cases (5 new: instructional-quote, self-reference reason-text, line-start-in-multiline, leading-whitespace, blocking-quotes-template), all deny/ask/allow correct. bash -n + shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:11:05 +02:00
timothyandClaude Opus 4.8	f87a2092c4	fix(process): #303 H10 — anchor sha match to the @<sha> field; retraction-wins [decisions-edit] ... Adversarial review found false-opens in the first cut: - `grep -F "$short"` was an unanchored substring test: a MERGEABLE verdict for a DIFFERENT/older commit was accepted whenever the head 7-prefix appeared anywhere on the line (inside a longer sha, or an unrelated commit URL). Now each verdict line's `@ <sha>` token is extracted and matched to head by git short-sha prefix semantics (head begins with token, token >=7 chars). - No retraction semantics: a later `BLOCKED @ head` didn't override an earlier `MERGEABLE @ head`. Now a negative verdict on head wins -> deny. - A 7-digit build number falsely tripped the "references an older commit" deny; the `@`-anchored parse fixes it -> a marker with no @sha now asks, not denies. Also documents the issue-comment scope (gate reads issues/{pr}/comments, not Gitea formal-review bodies). Pipe-tested: 16 cases incl. 4 adversarial false-open reproductions, all now deny/ask. bash -n + shellcheck clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 19:01:51 +02:00
timothyandClaude Opus 4.8	9fd8f40541	chore(process): #303 H10 — review-verdict merge-gate (latest commit must be reviewed) ... Folds condition (c) into pretooluse-merge-consent.sh (H6): a PR merge is allowed only when a `Review-verdict:` comment references the PR's CURRENT head sha — proving the latest commit was reviewed, not a stale earlier diff (mechanizes the ersatztv#242 "re-review the fix commit" lesson). Graceful adoption mirrors H6's Done-when tiering: - positive verdict @ head -> allow - verdict @ older sha (stale) -> deny (#242 failure mode) - head verdict negative -> deny - marker with no sha / none yet -> ask - comments unfetchable -> ask Reuses H6's PR fetch, docs-only exemption, and Gitea-auth-from-env (one hook, no detection drift — per the #303 methodology review). Pipe-tested 12 cases. Docs: decisions.md (new H10 entry + TOC), CLAUDE.md Task Completion Protocol. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:54:05 +02:00
timothyandClaude Opus 4.8	6e92a951eb	feat(process): #303 decisions.md consolidation size-floor (read-cost, non-blocking) [decisions-edit] ... Timothy's refinement: the between-releases consolidation floor triggers on the file's READ COST — its line count, i.e. the context an agent burns reading the log — not entry count. The decisions-guard CI job now emits a non-blocking ::warning:: once decisions.md exceeds 1800 lines (the point past which it no longer fits one default 2000-line agent Read). Documented in the decisions.md header, the H9 entry, and ci-cd.md (job description + release-checklist note). Touches committed H9 lines, hence [decisions-edit]. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:23:58 +02:00
timothyandClaude Opus 4.8	59ecafecce	docs(process): #303 fold review nits — H3 case-insensitive, granularity wording, newline note [decisions-edit] ... Adversarial review (PR #305, MERGEABLE) nits: - H3: `grep -iE` so a root `Screenshot.PNG` is caught too (was lowercase-only). - decisions-guard.sh: comment the trailing-newline assumption (dropping the final newline would make git render the next append as a last-line modify -> false-block; self-correcting via [decisions-edit], .editorconfig enforces the newline). - docs: clarify CI is PR-wide (`range`) vs Husky per-commit (`staged`) — shared detection logic, deliberately different granularity; local hook is the stricter gate. Replaces the slightly-overstated "can't drift" wording. Touches the committed H9 decisions.md entry, hence the [decisions-edit] token. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:18:30 +02:00
timothyandClaude Opus 4.8	997f96c1f5	docs(process): #303 append-only supersession + consolidation convention [decisions-edit] ... decisions.md header now documents the enforced append-only rule, the `[decisions-edit]` escape, mark-and-keep supersession (banner on the reversed entry + `(superseded)` TOC tag), and consolidation at each release. ci-cd.md documents H3/H9 hooks + the decisions-guard job and adds a "consolidate decisions.md" step to the release checklist. New decisions.md entry records the H9/H3 mechanization. The header edit modifies existing lines, so this commit carries the [decisions-edit] token — the guard working as designed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 18:13:13 +02:00
timothy	a81f024840	Merge remote-tracking branch 'origin/main' into ci/303-api-docs-blocking	2026-07-12 17:43:29 +02:00
timothy	08d633c687	Merge pull request 'fix(api): #269 force-write non-If-Match root writers past a concurrent Version bump' (#302) from fix/269-force-version-on-root-writers into main	2026-07-12 15:43:09 +00:00
timothy	c34d2bdbf2	Merge remote-tracking branch 'origin/main' into ci/303-api-docs-blocking ... # Conflicts: # docs/decisions.md	2026-07-12 17:34:48 +02:00
timothyandClaude Opus 4.8	0badff811d	feat(process): #303 H6 merge-consent derived from ## Done-when checklist ... Wave 2 hook H6: derive merge-consent from state instead of memory. An issue's ## Done-when checklist (issue body) becomes the machine-readable source of truth for whether its PR may merge — the structural fix for the queue-drift #303 tracks (status was living in append-only prose). - pretooluse-merge-consent.sh (Claude PreToolUse on mcp__gitea__ pull_request_write): a merge is ALLOWED only when the PR's CI is green AND every ## Done-when box on the linked issue (fixes #N) is ticked; DENY on an unticked box / red CI; ASK (human prompt) when state isn't derivable (no linked issue, no section, no creds, Gitea down). Docs/ process-only PRs exempt. - .husky/pre-push -> prepush-donewhen.sh: fail-open backstop for a direct `git push origin main`; blocks only on a positively-proven unticked box. Gitea auth from env only (ETV_GITEA_BASICAUTH / ETV_GITEA_TOKEN, ETV_GITEA_URL) — nothing committed; without creds the gate degrades to today's manual confirmation, never a silent pass. Non-breaking rollout: until issues adopt ## Done-when the merge hook simply asks. Pipe-tested: non-merge->allow, no-creds->ask, docs-only->allow, checklist parser (unit), linked-issue extraction, and a live end-to-end block path (temp Done-when on #303 -> exit 1 -> restored). Docs: CLAUDE.md Task Completion Protocol + decisions.md entry. Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:29:34 +02:00
timothyandClaude Opus 4.8	aa2e13fa51	ci: #303 H4/H5 blocking api-docs gate — fail on stale OpenAPI artifacts ... Adds a blocking `api-docs` CI job: when a PR diff touches the API surface (ErsatzTV/Controllers/Api/** or ErsatzTV.Core/Api/**) it rebuilds the generated artifacts from source — v1.json, v1.d.ts, endpoint-index.md — and fails if any is stale in the diff. Mechanizes the "docs-update in the same PR" rule for the API contract (docs-reminder stays a non-blocking route-parity nudge). Path-gated INSIDE the job (per-step `if:` on a detect output), not via a top-level `if:`, so the check always reports a status on every PR and is safe as a required check: API-free PRs skip the dotnet/node setup + regen and pass trivially. Verified the gate reproduces the committed baseline: a fresh build regenerates v1.json byte-identical to HEAD (incl. all 244 auth security/401 blocks). The only footgun is local — update-openapi.sh runs dotnet-getdocument against the already-built assembly, so a stale bin/ emits a stale spec; api-conventions.md §5 now flags "build first". CI is immune (fresh checkout has no bin/). Docs: api-conventions.md §5 (two-place CI enforcement + stale-assembly note), decisions.md (new entry). Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:18:09 +02:00
timothy	5a12aae66e	Merge remote-tracking branch 'origin/main' into fix/269-force-version-on-root-writers ... # Conflicts: # docs/decisions.md	2026-07-12 17:17:46 +02:00
timothy	171d30c709	Merge remote-tracking branch 'origin/main' into fix/269-force-version-on-root-writers ... # Conflicts: # .gitignore	2026-07-12 17:14:56 +02:00
timothyandClaude Opus 4.8	21b49e6a42	chore(#269): remove accidental web/node_modules symlink from PR ... Fix-commit re-review (cold fork) caught that e383c253 tracked a machine-specific absolute-path symlink `web/node_modules -> /Users/.../web/node_modules` (created for the eslint pre-push hook). It slipped past `.gitignore` because the `web/node_modules/` trailing-slash pattern matches only a directory, not a symlink; a real node_modules dir (a copy) would have been ignored. Untrack it and tighten the ignore to `web/node_modules` (matches symlink or dir) so it can't recur. Also tightens the §7a / decisions.md "they already catch" phrasing (LOW review nit): only BuildPlayoutHandler catches; PlayoutTimeShifter is insulated by running solely on the background worker, never the request path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:09:08 +02:00
timothyandClaude Opus 4.8	48d256f83b	Merge origin/main into feat/295-auth-pr1 ... Brings in the #303 process/rigor hooks + docs. Only conflict-free overlap was docs/decisions.md (main added the ## Index TOC); reconciled by adding the #295 auth entry to the index. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:07:52 +02:00
timothyandClaude Opus 4.8	35e41fdaad	chore(process): #303 H7 worktree-owner guard + complete Wave 1 wiring ... Wave 2 hook H7: never commit/merge inside a sibling worktree another session created (burned us on #289 path-leak + the plumbing-merge workaround). Ownership = a per-session .claude-worktree-owner marker: - posttooluse-worktree-marker.sh stamps a worktree with session_id on `git worktree add` (parses the <path> arg past -b/-B/--reason flags). - pretooluse-worktree-guard.sh denies `git commit`/`git merge` whose effective dir (resolves `git -C <p>` and leading `cd <p> &&`) is a worktree whose marker names a DIFFERENT session. Fail-open: no marker, unparsable, or own session -> allow. Main tree + pre-convention worktrees are never marked, so unaffected. Also completes Wave 1's rollout, which committed pretooluse-bash-guard.sh but left .claude/settings.json and the agent-ram/nav-guard hooks untracked (so nothing was actually wired). Adds the settings.json that registers all five hooks (PreToolUse Bash x2, nav, Agent; PostToolUse Bash) + the .gitignore worktree-marker line, screenshot-scratch rules, and the decisions.md TOC left uncommitted last session. All hooks pipe-tested (7 guard cases + 6 marker cases). Refs #303. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 17:01:52 +02:00
timothyandClaude Opus 4.8	e383c253cc	fix(api): #269 review — force-write ErasePlayoutHistory + document boundaries ... Independent adversarial review (cold fork + Codex) of the first cut converged on one real miss and two boundaries to document. - **ErasePlayoutHistoryHandler** (HIGH, both reviewers): modifies Playout ROOT scalars (Seed/Anchor/OnDemandCheckpoint) *without* bumping Version, inside an explicit transaction with no try/catch, so it 500s on a concurrent bump — reachable via POST /api/playouts/{id}/erase-items-and-history. My first sweep filtered on "Version-bumpers + deletes"; the true exposure surface is "any handler leaving a versioned root Modified/Deleted", so this slipped through. Now routes through SaveChangesForcingVersion (+ a non-vacuous through-handler test that exercises the explicit-transaction path). Re-swept with the correct filter: ErasePlayoutItems (AsNoTracking + ExecuteDelete children only) and ResetAllPlayouts (read-only + enqueue) are NOT exposed. - **Background build/time-shift Playout-scalar writers** (BuildPlayout via PlayoutBuilder, PlayoutTimeShifter): token-guarded too, but intentionally left on plain save — they already catch (build-failure, not 500), and force-writing would persist output built from stale config (the concurrent config bump already enqueues a rebuild). Documented as a deliberate boundary, not a gap. - **Item-add index collision** under force-write: documented as an accepted Phase-1 effect (non-corrupting, self-correcting; reload-recompute refinement is a #197 candidate). Also corrects the docs' "every Version bumper" framing to the true filter and the test docstring's over-broad non-vacuity claim. Full ErsatzTV.Tests green (1483). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:59:01 +02:00
timothyandClaude Opus 4.8	e8c3481ea5	fix(api): #295 PR1 — fold in fix-commit re-review (2nd Codex round) ... Fix-commit re-review confirmed the 1st-round fixes resolved and caught a 2nd round: - HIGH — env-seed vs. setup race: an attacker could claim admin in the startup window before LocalAdminSeedService runs, and the seed's insert would then be swallowed (attacker credential persists, defeating env recovery). Fixed structurally: the setup-claim endpoint is CLOSED (409) whenever Auth:LocalAdmin:Password is configured — the env seed owns the credential, so there's no claim to race (also strengthens the setup-claim TOFU posture). Config.setupRequired reflects it. - LOW — a concurrent setup race-loser now returns 409 (not 422); ClaimLocalAdmin's DbUpdateException catch re-checks existence and rethrows genuine/transient DB errors instead of masking them as "already configured". - MEDIUM (accepted, documented) — two simultaneous authenticated password changes are a non-serializable lost-update; accepted for a single-admin system (self-healing via re-login, implausible timing). +3 AuthController tests (env-seed closes setup / setupRequired gating). Full ErsatzTV.Tests green (1506); no generated drift. Docs updated. Refs #295 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:52:23 +02:00
timothyandClaude Opus 4.8	9a9aaf0740	fix(api): #295 PR1 — logout ends the session server-side (E2E-caught) ... Live E2E found that replaying a pre-logout cookie still authenticated (200, not 401): SignOutAsync only clears the CLIENT cookie, but the stateless encrypted cookie ticket stays valid server-side because its security stamp is unchanged — a captured cookie was replayable after logout until ticket expiry. Fix: logout now rotates the local-admin security stamp (RotateLocalAdminSecurityStamp), so every outstanding local session (old stamp) fails OnValidatePrincipal on its next request. For the single admin this is "log out everywhere". Gated on an authenticated local session so an unauthenticated caller can't force-revoke the admin. OIDC sessions (no stamp) are unaffected; SignOutAsync still clears the client cookie for UX. +2 handler tests (rotate-when-configured / no-op-when-unconfigured). Auth suite green (21). Docs: decisions.md note updated. Refs #295 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:46:41 +02:00
timothyandClaude Opus 4.8	6ac5150fd0	fix(api): #295 PR1 — fold in cold-fork + Codex review findings ... Independent review (cold fork = MERGEABLE-WITH-NITS; Codex = BLOCKED, caught concurrency defects the fork missed). All actionable findings folded in: - HIGH (Codex) atomic first-claim-wins: ClaimLocalAdmin now writes the three credential rows in ONE transaction guarded by the unique ConfigElement.Key index (lost race -> DbUpdateException -> 409), so concurrent claims can't produce a mixed-state credential. - HIGH (Codex) consistent login snapshot: VerifyLocalAdminLogin reads hash+stamp in one query and drops rehash-on-verify, so a login racing a password change can't capture a stamp newer than the hash it verified (concurrent change -> old password fails, or the issued cookie carries the pre-change stamp -> revoked next request). - MEDIUM (Codex) env-seed migration race: LocalAdminSeedService is now a RunOnce BackgroundService that awaits SystemStartup.WaitForDatabase (the migrator is a BackgroundService; registration order didn't guarantee the schema) + try/catch. - MEDIUM (fork M1) ForwardedHeaders: reverted the strict-opt-in flip — it would regress /iptv M3U/XMLTV/HLS absolute-URL generation (Request.Scheme) behind a proxy without KnownProxies. Kept #285 behavior; KnownProxies still recommended. - LOW (Codex/fork) require X-CSRF on /api/auth/logout + /password (the [SkipApiAuthorization] surface isn't covered by the filter's CSRF check; closes forced-logout CSRF). - ChangeLocalAdminPassword also writes hash+stamp atomically. Input length caps on username/password. Deferred with a tracked gate: MEDIUM (Codex) side-effecting [RequiresAuthentication] GETs (troubleshoot playback/archive) aren't CSRF-covered -> #301, gates PR2 (latent in PR1: the SPA still uses the machine key). Verify: full ErsatzTV.Tests green (1501); no OpenAPI/generated drift. Docs updated (api-conventions §9, decisions.md). Refs #295 #301 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:40:25 +02:00
timothyandClaude Opus 4.8	d80bf886b2	fix(api): #269 force-write non-If-Match root writers past a concurrent Version bump ... Activating #253's `Version` as an `IsConcurrencyToken` made EF guard every UPDATE *and DELETE* of a versioned root with `WHERE Version=@orig`, so any writer outside the If-Match contract that saves via plain `SaveChangesAsync` throws an unhandled `DbUpdateConcurrencyException`->500 when a replace-all editor bumps the row in its narrow load->save window (ordinary two-tab UI). A completeness sweep (grep every `Version` bumper + every root delete, not just the handlers PR3's close note named) found 17 exposed writers, all now routed through `ConcurrencyExtensions.SaveChangesForcingVersion` (Phase-1 force-write: adopt the stored token and retry; rethrow only on genuine row-deletion): - 9 versioned-root delete handlers (a delete has no ETag to rotate -> force only, no bump) - UpdateProgramScheduleHandler (bumps then saved plainly - the ProgramSchedule case PR3 only suspected; its post-commit query/enqueue also moved to CancellationToken.None per section 7b) - 7 item add/remove bumpers PR2 left on plain save: Add/DeleteProgramScheduleItem + Add{Items,Movie,Show,Season,Episode}ToPlaylist Force-write (not 412) is correct: these endpoints take no If-Match, so an unconditional delete/edit should win. No API contract change (no new response codes) -> no OpenAPI regen. Still deferred to #197 (cross-editor ETag rotation only, not a 500): the non-bumping config siblings + the scanner-shared Add*ToCollection family. Tests: RootWriterForceVersionTests races a bump *through the handler* via a pre-tracked context (non-vacuous - reverting a handler to plain save fails the test, verified) for the Option-delete / Either-delete / bump+update shapes, plus the genuine-conflict rethrow branch and an explicit negative control proving the plain-save path throws. Full ErsatzTV.Tests green (1482). Also strips a pre-existing UTF-8 BOM from the touched handlers to satisfy the .editorconfig `charset=utf-8` rule the pre-commit format hook enforces. Docs: api-conventions section 7a (fan-out completeness) + decisions.md entry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:39:19 +02:00
timothyandClaude Opus 4.8	29c8b1cd83	docs(handoff): prune lore — drop what decisions.md/api-conventions already cover + dead Blazor-parity notes ... The lore had grown into a changelog (~40 verbose bullets). Removed bullets whose substance lives in docs/decisions.md or api-conventions §7a/b/c (#251 post-commit None, #252/#259 reconcile, #253 PR3/PR4 concurrency, addTo layer, DTO nullable facts, disabled={saving}) and dead Blazor-parity process notes (parity verdicts, screen!=parity, unwired-endpoint gaps, #205/#206 docs-staleness). Condensed the survivors. Added a scope banner: this section is standing workflow/orchestration lore only; engineering decisions go in decisions.md, never here (they duplicate and drift). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:32:34 +02:00
timothyandClaude Opus 4.8	aed4b5c056	docs(handoff): fix queue-drift root cause — live Gitea state is the sole source of truth ... Recent session pickups re-did finished work (thought closed issues were still open). Root cause: DONE/OPEN status lived in append-only prose (arc inline markers + each comment's 'Recommended next'), which lags real issue state — worst across parallel sessions narrating each other's merges. Kickoff prompt fixes: - SOURCE OF TRUTH = live Gitea state, never prose; verify OPEN (issue AND milestone) before claiming. - Gate/frontier defined structurally (lowest-numbered open arc item), not hardcoded to an issue number (an earlier pass re-planted the bug by hardcoding '#197 cluster'/'#91b milestone CLOSED'). - Label-based ranking: arc order -> gate(review label/milestone) -> priority. - Pick order across arc-frontier / priority-pickup / audit pools. - Bound the comment read (~6 newest); MCP-down REST fallback; #237 canonical. - New lore bullet capturing the drift root cause + structural cure. Companion edits to tracker #237 body (prune arc status -> 'Done (history)' section) made live; noted in a session comment there. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 16:22:57 +02:00