From a4de0d50558c29fa6047b8fe0dfe54e9c1abfcf1 Mon Sep 17 00:00:00 2001 From: Sushil Muthuvelkumar <123318620+sushilm20@users.noreply.github.com> Date: Wed, 28 Oct 2026 21:53:50 -0400 Subject: [PATCH] Homepage: say Control Kit is not listed yet, not that it awaits review The listing has not been submitted, so 'waiting for Onshape's review' was untrue (launch audit B4). Also dates the listing screenshots to their 2026-10-27 recapture and marks the stale 'no network implementation' and PR 12 live-gate notes in CLAUDE.md as superseded by the Control Point link. --- CLAUDE.md | 4 ++-- apps/web/src/app/Landing.tsx | 4 ++-- docs/app-store/listing.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 21a75a8..7ed066e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,7 +8,7 @@ `apps/web` is the iframe UI. `apps/worker` owns OAuth, scan/export calls to Onshape, the request ledger, and scheduled ingestion. `packages/shared` owns matching, classification, aggregation, and the Control Point contract. `packages/excel` owns XLSX/CSV export. `fixtures`, `scripts`, and `samples` hold test inputs and generated examples. See README for setup and checks. -The browser calls only the Worker for Onshape data. The Worker keeps access/refresh tokens encrypted in KV; its cross-site iframe cookie is opaque, `HttpOnly`, `Secure`, and `SameSite=None`. Vendor reads use a short Worker memory cache then KV, returning unmatched on a miss without scraping during a scan. Classification, matching, and purchasing rules are shared between app and Worker. External calls have bounded retries/timeouts; user scans are never edge cached. Control Point has no network implementation in v1. +The browser calls only the Worker for Onshape data. The Worker keeps access/refresh tokens encrypted in KV; its cross-site iframe cookie is opaque, `HttpOnly`, `Secure`, and `SameSite=None`. Vendor reads use a short Worker memory cache then KV, returning unmatched on a miss without scraping during a scan. Classification, matching, and purchasing rules are shared between app and Worker. External calls have bounded retries/timeouts; user scans are never edge cached. Control Point is linked over its integration API (see "Control Point link, Worker side"); scans, Excel, and STEP never depend on it. ## Milestones and deviations @@ -188,7 +188,7 @@ PR 12 (owner's script Parts 1–3: AI review layer, Control Point attach bundle) - **Cost controls.** Answers are cached for 30 days at `ai-review:{sha256(request)}` and served before any allowance check, so an unchanged rescan costs no AI call. Each person gets at most 20 uncached reviews a day (`ai-user:{userId}:{date}`), reserved before the provider is asked, with a 2-minute `ai-busy:{userId}` lock against concurrent reviews. KV has no atomic counter, so two requests within its propagation window could both pass; the providers' own quotas are the hard cap. Every call, cached hit, and failure is added to `ai-ledger:YYYY-MM-DD` (provider, lines, tokens). A future bring-your-own-key option would be a separate flagged path to the same endpoint; it is not built. - **Review UI.** Suggestions appear in the existing Review rows ("AI suggests 3D print (78%): reason") with Use AI suggestion / Dismiss and keys `I` / `X`. Accepting saves through the existing flows: a candidate as a confirmed match decision (which may now name a near match, `decisionRecord`), the type as a shared disposition override. So later scans are deterministic and cost nothing. - **Attach bundle** (`packages/shared/src/control-point.ts`, `bundleVersion: 2`, extending the existing payload). Every active, suppressed, and missing-metadata line with pack, price, vendor, SKU, link, stock, disposition, override, and match fields. Scan metadata: assembly and document links (workspace/version only, never a microversion), the revision read, timestamps, the stale flag. Files: the workbook and STEP zip inline as base64 up to 4 MB; larger ones as name, size, and SHA-256 references; missing ones listed in `filesNotIncluded`, never dropped. `cadParts` maps each line to Control Point's `cad_parts` row (`server/cad.ts`: section, quantity, source, unit_cost, status, notes) with the full line under `extra`. `unit_cost` is the priced line total divided by CAD quantity, or 0 when unpriced; it is never a pack price posing as a unit price. Section is guessed from assembly path words, otherwise Other. Deep link: `https://tryctrlpoint.org/cad-parts` (the team comes from the Control Point login). The idempotency key hashes document, element, revision, and content; timestamps, scan ids, and file bytes are left out. -- **Live gate.** Still interface plus the in-memory test adapter. No HTTP adapter, no Sync button, and no attach UI until the owner confirms endpoint, auth, and the file-upload contract in writing. +- **Live gate (superseded 2026-10-26).** This PR stopped at the interface and the in-memory test adapter. The HTTP adapter, link, and Send were built later to the written contract; see "Control Point link, Worker side". - **Open gaps (Part 3).** "24mm × 6mm Round Standoff" and "Control Hub REV-31-1152" are AI-review fixtures; the AI can only point at REV-31-1595, never the discontinued SKU. REV's option-picker families (112 of 390 pages) need REV's storefront API, which is not used without permission: a feed question for REV. The four "[LS]" screws remain under Fasteners, unchanged. - **Constraints.** The Cloudflare Workers free plan applies (10 ms CPU measured in PR 7f). The Worker bundle with the SDK is 198 KiB gzipped. GitHub Actions runs again since the repository went public. No Onshape request was made for this PR. diff --git a/apps/web/src/app/Landing.tsx b/apps/web/src/app/Landing.tsx index 5e377fa..1eb1487 100644 --- a/apps/web/src/app/Landing.tsx +++ b/apps/web/src/app/Landing.tsx @@ -7,7 +7,7 @@ import { Policy, PolicyLinks, policyPages, type PolicyPage } from './Policies'; * screenshots of a scanned FTC robot (HORS), and how to install it. Inside Onshape the panel always has assembly context. */ const appStoreUrl = 'https://cad.onshape.com/appstore'; -// Set to true once Onshape publishes the listing; until then the page says the listing is pending. +// Set to true once Onshape publishes the listing; until then the page says Control Kit is not listed yet. const listed = false; const features: Array<{ icon: ReactNode; title: string; text: string; image: string; alt: string }> = [ @@ -33,7 +33,7 @@ export function Landing() { How to install Onshape App Store - {!listed &&

Control Kit's App Store listing is waiting for Onshape's review. The steps below work once it is listed.

} + {!listed &&

Control Kit is not in the Onshape App Store yet. The steps below work once it is listed.

} Control Kit scanning the HORS robot in Onshape's right panel, beside the 3D assembly diff --git a/docs/app-store/listing.md b/docs/app-store/listing.md index 6a31780..6974c26 100644 --- a/docs/app-store/listing.md +++ b/docs/app-store/listing.md @@ -2,7 +2,7 @@ Everything Control Kit's store entry needs, ready to paste into the Onshape Developer Portal (My account → Developer → OAuth applications → Control Kit → Store entry). The owner signs in and submits; nothing here is sent automatically. -Every screenshot is the live app on the HORS assembly (MR. HORS, HORS 25-26), scanned from Onshape and matched against the production vendor catalogs, rendered with the current interface on 2026-10-26: 119 parts, 61 to buy, 55 to make, none waiting for review, $1,768.05 priced from 50 of 61 buy lines. No numbers are made up. `5-scan.png` is the owner's own capture of Onshape with the panel scanning HORS beside the 3D model. +Every screenshot is the live app on the HORS assembly (MR. HORS, HORS 25-26), scanned from Onshape and matched against the production vendor catalogs, rendered with the current interface (recaptured 2026-10-27, PR #51): 119 parts, 61 to buy, 55 to make, none waiting for review, $1,768.05 priced from 50 of 61 buy lines. No numbers are made up. `5-scan.png` is the owner's own capture of Onshape with the panel scanning HORS beside the 3D model. ## What Onshape asks for