diff --git a/CHANGELOG.md b/CHANGELOG.md index bc6932c0..c94883e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,29 @@ Open problems and known blockers are tracked separately in ## [2026-09-14] +### Added +- **PR #266** — deliverables: added `deliverables/official-docs/`, an official + documentation registry for the tools and services this project depends on. + `src/official-docs.json` carries the registry and `src/official_docs.py` + (Python) plus `src/official-docs.js` / `src/utils.ts` (JS/TS) read it from + either side of the stack. Every link is verified rather than assumed: + `scripts/verify_links.py` checks the registry against the live URLs and + `tests/test_official_docs.py` / `tests/official-docs.test.mjs` cover the + loaders. The React side (`src/Company.jsx` + `Company.module.css`) renders a + docs bar and an image gallery from the same registry, so the UI cannot drift + from the data; `scripts/export_registry.mjs` and `scripts/render_smoke.mjs` + round out the build-and-check path. +- **PR #265** — deliverables: added `deliverables/fig-best-practices/`, a + quality gate for projects built on the Fig platform. `BEST-PRACTICES.md` is the + policy, `SKILL.yaml` wires it up as a skill, and the checker engine runs it + against a project tree; `ci/quality-gate.yml` is the GitHub Actions entry + point. Six agent briefs (`agents/developer.md`, `reviewer.md`, `security.md`, + `designer.md`, `performance.md`, `deployment.md`) state what each role is + expected to enforce, and `design/design-tokens.json` holds the shared tokens. + Two fixture projects ship with it — `examples/broken-project/` and + `examples/clean-project/` — so the gate is exercised against a known-bad and a + known-good tree rather than only in the happy path. 69 tests. + ### Changed - **PR #269** — rewrote `README.md` so it matches the repository as it stands (+119/−767). The previous content was a pasted CI/CD-and-branch-strategy draft diff --git a/docs/releases/v1.3.0.md b/docs/releases/v1.3.0.md new file mode 100644 index 00000000..6d3cc30d --- /dev/null +++ b/docs/releases/v1.3.0.md @@ -0,0 +1,106 @@ +## Version + +v1.3.0 + +## What's included + +Minor release cut from `main`. Since `v1.2.0` (`a461cf3`, 2026-09-12) — 94 commits, +of which 37 landed as merged PRs. + +**Added — deliverables** +- **PR #266** — `deliverables/official-docs/`: an official documentation registry. + One JSON registry (`src/official-docs.json`) read from both sides of the stack + (`src/official_docs.py`, `src/official-docs.js`, `src/utils.ts`), every link + checked against the live URL by `scripts/verify_links.py` rather than assumed, + and a React docs bar + image gallery (`src/Company.jsx`) rendered from the same + registry so the UI cannot drift from the data. +- **PR #265** — `deliverables/fig-best-practices/`: a quality gate for projects + built on the Fig platform. `BEST-PRACTICES.md` is the policy, six agent briefs + (developer / reviewer / security / designer / performance / deployment) state + who enforces what, `ci/quality-gate.yml` is the Actions entry point, and two + fixture projects — a known-bad and a known-good tree — exercise the gate. + 69 tests. +- **PR #258** — `deliverables/ci/`: the full CI/CD pipeline (orchestrator plus + reusable workflows). +- **PR #238** — skills: `pr-triage-automove`, the automated form of + `organize-misplaced-files`. A root file is moved only when it is not canonical, + no tracked `.py` imports it (AST-parsed), and its name appears in no other + tracked file. Wrapped in an import probe so a poisoned import cannot kill the + run; dry-run by default, `--apply` required. 37 tests. +- **PR #235** — `deliverables/agent-core/`: Dockerfile and Helm chart. +- **PR #240** — skills: `ci-workflow-authoring` plus `lint.py` to check workflows + before they run. 16 tests. +- **PR #241** — Claude endpoint tests: mock responses, timeout, auth and error + handling cases. + +**Changed** +- **PR #267** — hardened JWT secret validation and moved users onto a database. + A signing key shorter than 32 characters, or one of a set of known placeholder + values, is now rejected so a misconfigured deployment fails loudly instead of + signing tokens with a guessable key. Added `app/user_store.py`, a + SQLAlchemy-backed user table that imports legacy JSON users on first init and + keeps the existing shape, so the API surface and per-user skill gating are + unchanged. `DATABASE_URL` selects Postgres, otherwise SQLite. 43 tests. +- **PR #252**, **PR #259**, **PR #248** — agent task skills and merge protection, + cron automation, and the corresponding knowledge notes. +- **PR #236** — rewrote `README.md` to describe the repository as it stands rather + than as it was intended: the real entrypoints, which one `app/Dockerfile` and + `vercel.json` serve, required vs optional configuration, the real test command, + and a `Known state` section recording what is genuinely broken. +- **PR #233** — activated the WhatsApp notification workflow, moved out of + `templates/` (which Actions does not read) into `.github/workflows/`. + +**Fixed** +- **PR #250** — SHA-pinned the workflow actions and repaired the broken workflow + YAML. +- **PR #249** — pointed `knowledge/scripts/diff_policy.py` at `knowledge/` instead + of the missing `vault/`. +- **PR #243** — repaired `auto-compress-manage.yml`, which had failed at + `Set up job` on all 781 runs: five action refs pointed at SHAs that do not exist + upstream. Four skip conditions added alongside the fix. +- **PR #234** — corrected YAML syntax and indentation in `Auto-Index-Sync.yml`. +- **PR #262** — dropped the unused `import sys` from + `knowledge/scripts/diff_policy.py`. +- **PR #230** — `ci.yml` updated. + +**Direct to `main`** — besides the PRs above, 57 commits landed straight on `main`: +new skill docs (`SKILL.md` files), knowledge notes, guideline documents, a +`cron-automation/` directory, and several `Add files via upload`. These were not +reviewed through PRs and are listed here rather than itemised. + +**Dependencies** +- **PR #222** — `requirements.txt` updated. +- **PR #223** — added a root `requirements-dev.txt` for test/lint tooling. +- **PR #204 / #211** — npm dev-deps group bump; esbuild + vite bump in + `deliverables/product-crud/web`. + +## Changelog + +Full sections: [`CHANGELOG.md`](CHANGELOG.md) → `[2026-09-14]`, `[2026-09-13]`, +`[2026-09-12]`. Two merged PRs had no changelog record at the time of this +release — **#265** and **#266** — and are added in this release PR alongside the +notes. + +## Migration / breaking changes + +None. No migration required. The JWT change (**#267**) is stricter than before by +design: a deployment signing tokens with a short or placeholder key will now fail +at startup instead of silently continuing. Set a key of at least 32 characters — +or unset it and let the local fallback generate one. + +## Verification + +- [ ] CI green on `main` — see note below +- [x] Tests pass — 69 (`fig-best-practices`), 43 (`app/`, clean venv), + 37 (`pr-triage-automove`), 16 (`ci-workflow-authoring`) +- [ ] Migration applied (if any) — N/A +- [ ] Tag + GitHub Release created from this section + +**CI note:** every workflow on `main` still fails at *Set up job*, for the +pre-existing org policy reason — all actions must be pinned to a full-length +commit SHA. Repairs have been attempted repeatedly (**#243**, **#250**), and each +attempt was subsequently overwritten or left unreconciled, so the repo remains in +a state where the policy text (`README.md`, `SECURITY.md`) does not match the +workflows that are actually on `main`. This is tracked in `PROBLEMS.md`; it is +not introduced by this release and does not affect the artifacts above, which run +their own tests. It does mean no PR on this repository can show green checks.