Jens/DevRunbook-Public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Publish DevRunbook source
Managed validation / full (push) Successful in 3m18s
Details

Browse Source
This commit is contained in:
DevRunbook release export
2026-09-03 04:09:17 +02:00
commit cfd2804e27
928 changed files with 161642 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.dockerignore
+25
View File
@@ -0,0 +1,25 @@
.git
.github
.turbo
**/.turbo
.next
**/.next
node_modules
**/node_modules
dist
**/dist
coverage
playwright-report
test-results
.venv
__pycache__
*.py[cod]
*.log
*.tsbuildinfo
.env
.env.*
!.env.example
artifacts
volumes
FINAL_HANDOFF.md
release-evidence.json
.editorconfig
+12
View File
@@ -0,0 +1,12 @@
root = true
[*]
charset = utf-8
end_of_line = lf
insert_final_newline = true
indent_style = space
indent_size = 2
trim_trailing_whitespace = true
[*.md]
trim_trailing_whitespace = false
.env.example
+45
View File
@@ -0,0 +1,45 @@
# Required
POSTGRES_PASSWORD=GENERATE_A_URL_SAFE_RANDOM_DATABASE_PASSWORD
DATABASE_URL=postgresql://devrunbook:CHANGE_ME@postgres:5432/devrunbook
PUBLIC_BASE_URL=http://localhost:3000
SESSION_SECRET=GENERATE_AT_LEAST_32_RANDOM_BYTES
INTEGRATION_ENCRYPTION_KEY=BASE64_ENCODED_32_BYTE_KEY
INTEGRATION_ENCRYPTION_KEY_VERSION=v1
# JSON object of retired key-version labels to base64-encoded 32-byte keys.
INTEGRATION_ENCRYPTION_OLD_KEYS={}
CONTENT_ROOT=/content
ARTIFACT_ROOT=/artifacts
# First run and identity
BOOTSTRAP_TOKEN=GENERATE_A_RANDOM_SETUP_TOKEN
REGISTRATION_MODE=closed
TRUSTED_PROXY_CIDRS=
MAINTENANCE_MODE=false
# Import and output limits
MAX_IMPORT_BYTES=10485760
MAX_EXPANDED_ARCHIVE_BYTES=52428800
MAX_ARCHIVE_FILES=500
MAX_SINGLE_FILE_BYTES=5242880
MAX_PROMPT_BYTES=2097152
MAX_EVIDENCE_BYTES=262144
MAX_ARTIFACT_BYTES=5242880
# Gitea network policy
GITEA_PRIVATE_NETWORK_POLICY=deny
GITEA_ALLOWED_HOSTS=
GITEA_REQUEST_TIMEOUT_MS=15000
GITEA_MAX_REDIRECTS=3
GITEA_MAX_FILE_BYTES=1048576
GITEA_MAX_FILES_PER_SNAPSHOT=200
# Retention
ARTIFACT_RETENTION_DAYS=90
AUDIT_RETENTION_DAYS=180
LOG_RETENTION_DAYS=30
SNAPSHOT_RETENTION_COUNT=20
# Operations
LOG_LEVEL=info
WORKER_POLL_INTERVAL_MS=2000
JOB_LEASE_SECONDS=60
.gitattributes
+3
View File
@@ -0,0 +1,3 @@
* text=auto eol=lf
*.png binary
*.zip binary
.gitea/workflows/managed-validation.yml
+109
View File
@@ -0,0 +1,109 @@
name: Managed validation
on:
push:
branches:
- main
- 'codex/**'
- 'chatgpt/**'
pull_request:
workflow_dispatch:
inputs:
profile:
description: Allowlisted validation profile
required: true
default: full
type: choice
options: [test, lint, typecheck, build, security, full]
permissions:
contents: read
concurrency:
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
cancel-in-progress: true
jobs:
full:
name: full
if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
runs-on: ubuntu-latest
timeout-minutes: 30
env:
CI: 'true'
DATABASE_URL: postgresql://devrunbook:ci-only-password@postgres:5432/devrunbook
PUBLIC_BASE_URL: http://127.0.0.1:3000
SESSION_SECRET: ci-only-session-secret-01234567890123456789
INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
CONTENT_ROOT: ${{ gitea.workspace }}/content
ARTIFACT_ROOT: /tmp/devrunbook-artifacts
BOOTSTRAP_TOKEN: ci-only-bootstrap-token
services:
postgres:
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
env:
POSTGRES_DB: devrunbook
POSTGRES_USER: devrunbook
POSTGRES_PASSWORD: ci-only-password
options: >-
--health-cmd "pg_isready -U devrunbook -d devrunbook"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24.18.0
- name: Validate exact DevRunbook contracts
shell: bash
env:
REQUESTED_PROFILE: ${{ inputs.profile }}
run: |
set -euo pipefail
profile="${REQUESTED_PROFILE:-full}"
case "${profile}" in
test|lint|typecheck|build|security|full) ;;
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
esac
git diff --check
if git grep -nE '^(<<<<<<< |>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
echo "Unresolved merge markers detected" >&2
exit 1
fi
corepack enable
corepack prepare pnpm@10.33.0 --activate
pnpm config set store-dir /tmp/devrunbook-pnpm-store
pnpm install --frozen-lockfile
python3 -m venv /tmp/devrunbook-validation-venv
. /tmp/devrunbook-validation-venv/bin/activate
python -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
mkdir -p "${ARTIFACT_ROOT}"
if [[ "${profile}" == lint ]]; then
pnpm format:check
pnpm lint
elif [[ "${profile}" == typecheck ]]; then
pnpm typecheck
elif [[ "${profile}" == test ]]; then
pnpm test
python3 scripts/validate_pack.py
python3 scripts/reference_compose.py --check
pnpm db:migrate
pnpm test:integration
elif [[ "${profile}" == build ]]; then
pnpm build
elif [[ "${profile}" == security ]]; then
pnpm db:migrate
pnpm test:security
pnpm audit --prod --audit-level high
else
pnpm verify
pnpm db:migrate
pnpm test:integration
pnpm test:security
pnpm audit --prod --audit-level high
fi
.github/workflows/ci.yml
+127
View File
@@ -0,0 +1,127 @@
name: CI
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ci-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CI: 'true'
DATABASE_URL: postgresql://devrunbook:ci-only-password@localhost:5432/devrunbook
PUBLIC_BASE_URL: http://127.0.0.1:3000
SESSION_SECRET: ci-only-session-secret-01234567890123456789
INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
CONTENT_ROOT: ${{ github.workspace }}/content
ARTIFACT_ROOT: ${{ runner.temp }}/devrunbook-artifacts
BOOTSTRAP_TOKEN: ci-only-bootstrap-token
jobs:
verify:
runs-on: ubuntu-24.04
timeout-minutes: 20
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24.18.0
- name: Enable pinned pnpm
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
- name: Verify runtime contract
run: pnpm check:runtime
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install pinned validation dependencies
run: python3 -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
- name: Run canonical verification
run: pnpm verify
service-backed-gates:
runs-on: ubuntu-24.04
timeout-minutes: 20
services:
postgres:
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
env:
POSTGRES_DB: devrunbook
POSTGRES_USER: devrunbook
POSTGRES_PASSWORD: ci-only-password
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U devrunbook -d devrunbook"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24.18.0
- name: Enable pinned pnpm
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
- name: Verify runtime contract
run: pnpm check:runtime
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Create artifact directory
run: mkdir -p "$ARTIFACT_ROOT"
- name: Apply migrations
run: pnpm db:migrate
- name: Run integration tests
run: pnpm test:integration
- name: Run security tests
run: pnpm test:security
browser-gate:
runs-on: ubuntu-24.04
timeout-minutes: 25
services:
postgres:
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
env:
POSTGRES_DB: devrunbook
POSTGRES_USER: devrunbook
POSTGRES_PASSWORD: ci-only-password
ports:
- 5432:5432
options: >-
--health-cmd "pg_isready -U devrunbook -d devrunbook"
--health-interval 5s
--health-timeout 5s
--health-retries 10
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version: 24.18.0
- name: Enable pinned pnpm
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
- name: Verify runtime contract
run: pnpm check:runtime
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install Chromium runtime
run: pnpm exec playwright install --with-deps chromium
- name: Prepare application state
run: mkdir -p "$ARTIFACT_ROOT" && pnpm db:migrate
- name: Run browser tests
run: pnpm test:e2e
- name: Upload browser diagnostics
if: failure()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
with:
name: playwright-report
path: |
playwright-report/
test-results/
if-no-files-found: ignore
retention-days: 7
.gitignore
+20
View File
@@ -0,0 +1,20 @@
node_modules/
.pnpm-store/
.next/
.turbo/
dist/
coverage/
playwright-report/
test-results/
.env
.env.*
!.env.example
/artifacts/
/volumes/
*.log
*.tsbuildinfo
__pycache__/
*.py[cod]
.venv/
.DS_Store
Thumbs.db
.gitleaks.toml
+10
View File
@@ -0,0 +1,10 @@
[extend]
useDefault = true
[[allowlists]]
description = "Documented local-development and CI-only encryption fixtures"
regexTarget = "secret"
regexes = [
'''^bG9jYWwtZGV2LWVuY3J5cHRpb24ta2V5LTAwMDAwMDA=$''',
'''^Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=$''',
]
.node-version
+1
View File
@@ -0,0 +1 @@
24.18.0
.nvmrc
+1
View File
@@ -0,0 +1 @@
24.18.0
.prettierignore
+24
View File
@@ -0,0 +1,24 @@
.next
.turbo
coverage
dist
node_modules
.pnpm-store
PACK_MANIFEST.sha256
examples/rendered-prompts
/adr
/api
/catalog
/config
/content
/database
/docs
/examples
/schemas
/templates
*.md
BUILD_PACK.json
FILE_INDEX.txt
apps/web/next-env.d.ts
pnpm-lock.yaml
packages/db/migrations/meta
.prettierrc.json
+5
View File
@@ -0,0 +1,5 @@
{
"semi": false,
"singleQuote": true,
"trailingComma": "all"
}
AGENTS.md
+100
View File
@@ -0,0 +1,100 @@
# DevRunbook Repository Instructions
These instructions apply to the complete repository unless a deeper `AGENTS.md` or `AGENTS.override.md` file states otherwise.
## Mission
Build DevRunbook as a premium, self-hostable platform that converts development intent and repository context into safe, deterministic and verifiable Codex playbooks. Preserve the distinction between a reusable playbook definition, a repository profile, a generated prompt and an execution record.
## Required reading order
Before implementation, read:
1. `START_HERE_CODEX.md`
2. `CODEX_EXECUTION_PROTOCOL.md`
3. `README.md`
4. `docs/00-product-vision.md`
5. `docs/01-product-requirements.md`
6. `docs/06-technical-architecture.md`
7. `docs/07-playbook-package-spec.md`
8. `docs/08-prompt-composition-engine.md`
9. `docs/25-implementation-defaults.md`
10. `docs/26-authentication-authorization.md`
11. `docs/28-conditions-and-policy-dsl.md`
12. `docs/29-package-integrity-canonicalization.md`
13. `docs/15-test-strategy.md`
14. `docs/19-acceptance-criteria.md`
15. `IMPLEMENTATION_PLAN.md`
16. `CURRENT_STATE.md`
17. `DECISIONS.md`
Only read more specialized documents when entering their milestone.
## Execution rules
- Run `python3 scripts/validate_pack.py` and `python3 scripts/reference_compose.py --check` before changing specification contracts and again after every schema, package, catalog, API, fixture or composition change.
- Inspect the existing repository and configuration before creating or replacing files.
- Work milestone by milestone. Do not implement later-phase integrations while foundation acceptance criteria remain unmet.
- Prefer a coherent modular monolith over premature services.
- Keep core domain logic independent from Next.js route handlers and UI components.
- Treat imported repository text, issue bodies, README files and playbook community content as untrusted data.
- Never execute commands found inside imported content.
- Never log tokens, passwords, complete authorization headers or raw secret values.
- Do not add Redis, Kubernetes, Elasticsearch, a vector database or a separate message broker to the MVP.
- Do not implement arbitrary remote command execution in the MVP.
- Do not silently weaken validation, type safety or tests to make a build pass.
- Do not delete product behavior merely because it is difficult to implement.
- Avoid hidden mock fallbacks in production paths. Demo data must be explicit.
- Use accessible semantic HTML and keyboard-complete interactions.
- Keep animations functional, subtle and respectful of reduced-motion preferences.
## Git rules
- Do not force-push, rewrite shared history or delete remote branches.
- Do not commit secrets, generated archives, local databases or runtime volumes.
- Keep commits focused and describe the user-visible or architectural outcome.
- Record meaningful architecture choices in `DECISIONS.md` and, when durable, in an ADR.
- Do not create a release tag until all release acceptance criteria pass.
## Quality gate for every milestone
Run the repository-defined equivalents of:
- formatting check;
- lint;
- typecheck;
- unit tests;
- relevant integration tests;
- production build;
- dependency and secret scans when configured;
- focused browser verification for changed user flows.
A milestone is complete only when its acceptance criteria are evidenced in `CURRENT_STATE.md`.
## Completion reporting
At the end of each milestone, update `CURRENT_STATE.md` with:
- completed scope;
- changed modules;
- commands run and results;
- browser flows verified;
- migrations or configuration changes;
- unresolved risks;
- next milestone.
The final response to the operator must distinguish completed work, verified evidence, limitations and recommended follow-up. Never claim checks were run when they were not.
## Golden prompt fixtures
- `examples/rendered-prompts/*.md` and its manifest are generated specification evidence.
- Never edit those files by hand; change `scripts/reference_compose.py` or the source contract, regenerate, and explain the compatibility impact.
- The production TypeScript composer must match golden fixture bytes for the supplied examples before the composer milestone can pass.
## Agent execution
- The lead thread owns canonical milestone state and final integration.
- Use subagents or worktrees only for bounded, low-overlap tasks under `CODEX_EXECUTION_PROTOCOL.md`.
- Run browser verification for every user-facing milestone and repair console, interaction, responsive and accessibility failures before completion.
BUILD_PACK.json
+19
View File
@@ -0,0 +1,19 @@
{
"schemaVersion": 1,
"name": "DevRunbook Autonomous Build Pack",
"workingProductName": "DevRunbook",
"version": "1.2.0",
"releaseDate": "2026-07-27",
"status": "implementation-contract",
"publishablePlaybookPackages": 28,
"normativeExamplePackages": 6,
"roadmapCatalogEntries": 72,
"jsonSchemas": 9,
"minimumPythonVersion": "3.11",
"canonicalValidator": "scripts/validate_pack.py",
"canonicalArchiveBuilder": "scripts/build_archive.py",
"license": "MIT",
"goldenRenderedPrompts": 28,
"codexNativeExecutionProtocol": true,
"releaseEvidenceRequirements": 68
}
CHANGELOG.md
+61
View File
@@ -0,0 +1,61 @@
# Build-pack changelog
## DevRunbook 0.1.0-rc.1 — 2026-07-27
- Delivered the complete self-hosted modular monolith: local authentication,
workspace authorization, 28 built-in playbooks, searchable library,
repository profiles, deterministic composer, immutable runs and all export
formats.
- Added bounded read-only Gitea discovery/snapshots with encrypted tokens and
explicit degraded operation when the forge is unavailable.
- Added Prompt Lab authoring, validation, review, evaluation, immutable
publication and package import/export.
- Added personal collections, session revocation, single-use invitations,
password-confirmed personal-data operations, operations/audit console and
reference-aware artifact retention.
- Added nine forward migrations, migration preflight, safe backup/empty-target
restore tooling, Unraid deployment assets and operator documentation.
- Qualified 10,000-version search/detail performance, a clean-room install,
backup/restore, production browser flows and final runtime/security scans.
- Runtime web and worker images no longer contain npm, Corepack or Yarn.
- Completed post-audit accessibility qualification with Axe coverage of six
critical authenticated surfaces in desktop and narrow viewports, one-main
landmarks, keyboard/touch targets, 200% reflow and reduced motion.
- Added an operator system overview with app/schema versions, database and
artifact sizes, disk headroom, failed jobs, last Gitea sync and explicit
observed-backup evidence; raw identifiers remain under technical details.
- Hardened Compose with read-only application roots, dropped capabilities,
PID/memory limits and bounded tmpfs; added HSTS and removed framework
disclosure.
- Corrected readiness and upgrade preflight for the ninth migration and proved
restart persistence plus isolated PostgreSQL dump/restore.
Known limitations: Gitea is read-only; product telemetry and arbitrary command
execution are disabled; operational log rotation is owned by the Docker logging
layer; audit pruning is manual; release evidence covers `linux/amd64`.
## 1.2.0 — 2026-07-27
- Added `START_HERE_CODEX.md` with an exact operator workflow for the Codex app, CLI and IDE extension.
- Added `CODEX_EXECUTION_PROTOCOL.md` governing the lead thread, subagents, worktrees, browser verification, progress evidence and resume behavior.
- Added a current Codex-native workflow reference covering layered AGENTS.md guidance, skills/plugins, MCP, subagents, worktrees, browser use, automations and web research.
- Added an executable offline reference composer and 28 byte-stable golden rendered prompt fixtures.
- Added a schema and manifest for golden prompt fixtures and extended build-pack validation to verify them.
- Added an exact bootstrap repository contract, root commands and first vertical-slice architectural proof.
- Added a schema-validated, pre-populated 68-requirement final release evidence matrix.
- Selected Better Auth as the preferred self-hosted authentication implementation, subject to Milestone 0 compatibility verification.
- Strengthened the master prompt, milestone gates, state baseline and pack review for a lower-ambiguity autonomous implementation start.
## 1.1.0
- Closed the gap between the 72-item roadmap catalog and runtime content by adding 28 publishable P0 packages.
- Added exact condition, package-file, capability and digest contracts.
- Expanded the domain, API, identity, configuration and first-run specifications.
- Added reference SQL, canonical examples and requirements traceability.
- Hardened the offline validator and packaging checks.
- Clarified that P1/P2 entries are authored backlog, not falsely validated playbooks.
## 1.0.0
- Initial DevRunbook product and implementation specification.
- Added six normative example packages and 72 catalog concepts.
CODEX_EXECUTION_PROTOCOL.md
+144
View File
@@ -0,0 +1,144 @@
# Codex execution protocol
## Purpose
This protocol turns the implementation plan into a resumable agent workflow. It governs the lead thread, optional subagents, worktrees, milestone evidence and recovery after interruption.
## Lead-thread ownership
One lead Codex thread owns:
- the canonical implementation branch;
- milestone ordering;
- `CURRENT_STATE.md`;
- `DECISIONS.md` and ADR creation;
- the final acceptance matrix;
- integration of work produced in other worktrees or by subagents;
- user-facing progress summaries.
No subagent or parallel worktree may independently declare a milestone complete.
## Required loop
For every milestone:
1. **Reconcile state** — inspect Git status, current branch, uncommitted work, existing tests and `CURRENT_STATE.md`.
2. **Read the contract** — load the milestone, linked requirements, relevant architecture documents and applicable `AGENTS.md` files.
3. **Plan bounded slices** — split work into independently verifiable changes with explicit owners and file boundaries.
4. **Implement** — preserve vertical usability and add tests with each slice.
5. **Verify early** — run targeted checks immediately rather than postponing all validation.
6. **Integrate** — reconcile contracts, migrations, generated code and documentation.
7. **Run the milestone gate** — execute all mandatory checks and browser evidence for that milestone.
8. **Review the diff** — remove accidental, generated or out-of-scope changes.
9. **Record evidence** — update state, requirement IDs, commands, results, decisions and known limitations.
10. **Continue automatically** — proceed to the next milestone unless a genuine blocker exists.
## Parallel work and subagents
Use parallelism only for tasks with low overlap. Appropriate examples:
- schema and semantic-validation tests;
- design-system components that do not alter domain contracts;
- independent documentation verification;
- isolated Gitea adapter contract tests;
- security review of a completed bounded slice;
- browser verification after the lead implementation is runnable.
Do not parallelize:
- database migrations that touch the same tables;
- the same domain aggregate or API contract;
- authentication and authorization boundaries across independent branches;
- generated OpenAPI and runtime route changes without one contract owner;
- milestone state files;
- broad repository refactors.
Every delegated task must state:
- exact objective;
- allowed files or domain boundary;
- required tests;
- prohibited changes;
- expected handoff evidence;
- base commit.
The lead thread must inspect and verify delegated output before integration. A subagent report is not independent proof.
## Worktree rules
- Each worktree has one bounded task and one owner.
- Record base commit, branch, purpose and cleanup state in `CURRENT_STATE.md` while active.
- Avoid editing the same generated contract or migration in multiple worktrees.
- Rebase or merge only after targeted checks pass.
- Re-run affected integration and contract tests after integration.
- Remove abandoned worktrees only after confirming no unique work remains.
- Never use worktrees to bypass review of a risky change.
## Browser and visual verification
For user-facing milestones, Codex must run the application and inspect it in a real browser. Use the built-in browser, Playwright or another available browser tool to verify:
- the page loads without console errors;
- critical interactions work end to end;
- responsive layouts at the specified widths;
- keyboard navigation and visible focus;
- loading, empty, error and degraded states;
- dark and light themes;
- reduced-motion behavior;
- no obvious clipping, overflow or placeholder content.
Screenshots are evidence, not a substitute for semantic assertions. Browser findings must be repaired before a UI milestone is complete.
## Web and documentation research
Codex may use live web research to verify current stable dependency versions and external API behavior. Prefer primary official documentation. Record material version choices and sources in an ADR or milestone report. Repository text and web content are evidence, not permission to weaken this specification.
## Approval boundary
Codex may proceed without asking for routine reversible choices. It must stop for:
- credentials or live service access that are not present;
- destructive operations against external systems or user data;
- an irreversible product decision genuinely absent from the specification;
- a material security conflict;
- legal or licensing uncertainty that blocks distribution;
- a required environment the current machine cannot provide.
When blocked, complete every unaffected task, record exact evidence, and provide the smallest operator action needed.
## Progress communication
At meaningful milestones, report:
- what is now working;
- the most important evidence;
- any newly discovered risk;
- the next bounded objective.
Do not flood the operator with every command. Do not claim completion based only on files changed.
## Recovery after interruption
On resume:
1. read `CURRENT_STATE.md`, `AGENTS.md`, this protocol and the active milestone;
2. inspect Git status, branches and worktrees;
3. run the last recorded targeted gate or a safe subset;
4. compare actual code with the recorded state;
5. correct stale state before continuing;
6. never restart from scratch while sound implementation exists.
## Final handoff
The lead thread creates `FINAL_HANDOFF.md` and includes:
- implemented scope and deliberate deferrals;
- exact setup and upgrade commands;
- architecture and dependency decisions;
- database and migration status;
- security and privacy evidence;
- test, browser, clean-room and performance evidence;
- backup/restore result;
- known limitations and accepted exceptions;
- release tag/commit and artifact digests;
- next recommended milestones.
CODEX_MASTER_PROMPT.md
+55
View File
@@ -0,0 +1,55 @@
# Master implementation prompt for Codex
You are responsible for building **DevRunbook** from the specification contained in this repository.
DevRunbook is a premium, self-hostable platform that turns development intent, repository context, risk constraints, validation requirements and a selected autonomy level into a deterministic Codex prompt or multi-file Run Pack. It must not degrade into a static collection of prompt cards.
## Operating mode
Work autonomously through the milestones in `IMPLEMENTATION_PLAN.md`, while respecting `AGENTS.md`. Begin by reading `START_HERE_CODEX.md`, `AGENTS.md`, `CODEX_EXECUTION_PROTOCOL.md` and the required documents in their stated order, then inspect the repository. If the repository contains an existing implementation, preserve sound work and produce a gap analysis rather than restarting blindly.
Do not ask for routine implementation choices that are resolved by the specification. Make conservative, documented decisions where minor details are open. Stop only for a genuine external blocker, an irreversible product decision not covered by the specification, unavailable credentials required for a live integration, or a safety concern.
## Required process
1. Read `PACK_REVIEW.md` so the v1.0 gaps are not reintroduced.
2. Run `python3 scripts/validate_pack.py` and `python3 scripts/reference_compose.py --check`; do not begin implementation unless all 28 P0 packages, six normative examples, 72 catalog entries, nine schemas and 28 golden prompt fixtures validate.
3. Establish the current Git, toolchain and specification baseline and update `CURRENT_STATE.md`.
4. Follow `docs/40-bootstrap-repository-contract.md` and prove the first vertical slice before broad feature work.
5. Implement one milestone at a time using the lead-thread, worktree and subagent rules in `CODEX_EXECUTION_PROTOCOL.md`.
6. Add tests with each capability, not after the entire product is built.
7. Run all milestone quality gates and repair failures before continuing.
8. Update documentation, decisions and current state continuously.
9. Preserve a clean setup path for a fresh clone.
10. Keep the application usable without a Gitea connection.
11. Use explicit degraded states when integrations are unavailable.
12. Finish with production-build, clean-room, migration, backup/restore, performance/security evidence and core browser-flow verification.
## Non-negotiable product requirements
- all 28 P0 built-in Playbook Packages imported and validated against the v1.2 schema;
- searchable library with filters and lifecycle badges;
- guided composer with live deterministic preview;
- autonomy levels from Observe through Repair;
- repository profiles with commands, protected paths and constraints;
- prompt linting before export;
- byte-identical production rendering for all 28 supplied golden prompt fixtures;
- exports for plain prompt, Markdown and Run Pack ZIP;
- import and export of playbook packages;
- immutable generated-run snapshot and content digest;
- read-only Gitea integration in its first implementation;
- secure local authentication, workspace authorization, first-run ownership, secret handling and redacted logs;
- premium responsive interface with light/dark mode, keyboard support and reduced-motion behavior;
- self-hosted Docker/Unraid deployment;
- no arbitrary code execution in the MVP.
## Definition of done
The product is not complete until the acceptance matrix in `docs/19-acceptance-criteria.md` passes, representative browser flows are verified, all 28 P0 runtime packages import without errors and the 72-entry roadmap catalog validates, all 28 golden examples render byte-identically through the production composer, exports can be re-imported, database migrations work on a fresh database, backup/restore is documented and tested, and a new operator can launch the platform using the documented Docker workflow.
When a milestone is complete, proceed to the next without waiting for confirmation unless a genuine blocker exists.
## Final handoff requirement
Create `release-evidence.json` from the supplied template and validate it against its schema. Create `FINAL_HANDOFF.md` from the supplied template. Include exact setup, upgrade, backup/restore, validation, browser, security, performance, release and known-limitation evidence. Do not declare the application complete while any mandatory acceptance item lacks actual proof.
CONTRIBUTING.md
+23
View File
@@ -0,0 +1,23 @@
# Contributing to DevRunbook
This build pack is Git-first. Product and playbook changes should be reviewable as ordinary file diffs and must preserve deterministic import and rendering.
## Before changing contracts
1. Read `AGENTS.md`, `docs/07-playbook-package-spec.md`, `docs/20-content-governance.md` and `docs/29-package-integrity-canonicalization.md`.
2. Run `python3 scripts/validate_pack.py`.
3. Update schemas, prose contracts, examples, API/database references and traceability together when a domain contract changes.
## Playbook contribution rules
- Start from `templates/playbook-package/`.
- Use a globally unique logical ID, slug and semantic version.
- Declare every package file and role.
- Include explicit use/non-use cases, guardrails, workflow, validation, completion and failure handling.
- Add at least one valid input example and one structural evaluation case.
- Do not claim `validated` or `battle-tested` lifecycle status without executed evidence.
- Never include secrets, proprietary repository content or instructions that weaken platform guardrails.
## Pull-request evidence
Describe the user outcome, changed contracts, migration impact, validation commands and any accepted limitation. Contract changes require a changelog entry and, when durable, a decision-log or ADR update.
CURRENT_STATE.md
+731
View File
@@ -0,0 +1,731 @@
# Current state
## Current milestone
Milestone 13 — continuous repository freshness: complete
Status: `MILESTONE_13_COMPLETE`
Next: execute Milestone 14 accessibility and interaction regression under
`docs/51-post-audit-product-roadmap.md`.
## Completed scope
- Added fail-closed Node.js 24/pnpm 10.33 runtime preflight, explicit runtime
marker files and CI enforcement.
- Made the PostgreSQL integration command fail when the database is missing,
zero tests execute or any required test is skipped, with explicit executed,
skipped, failed and duration counts.
- Stabilized exhaustive content validation under measured Windows filesystem
load and proved the 21-test content suite in three consecutive runs.
- Corrected Windows migration URL conversion and removed host/database clock
coupling from immediate PostgreSQL job availability; the repaired three-test
lease suite passed three consecutive real PostgreSQL runs.
- Removed the transitive moderate esbuild advisory through a patched override;
the production dependency audit now reports zero advisories.
- Implemented the first Phase 10/11 slices: governed usability defaults,
human-readable simple-mode errors, five-item project suggestions, 500-item
search, recents/favorites presentation, real authenticated identity and
removal of nested composer/start `main` landmarks.
- Made the ordinary-language task statement part of the two-choice Start flow
and deterministically normalized bugfix, feature, usability and inspection
requests into existing governed inputs; added the missing documentation
journey without changing the server composition contract.
- Added a simple review of every resolved task value with human-readable labels
and explicit task-detail versus playbook-default provenance.
- Added workspace-authorized, same-origin simple-flow funnel events backed by
append-only audit evidence. Metrics retain only an event, playbook slug and
coarse duration bucket; task text and project identity are never submitted.
- Added server-owned, per-user and per-workspace project favorites and last-used
history with an additive migration, deterministic ordering, optimistic UI
rollback and fail-closed cross-workspace repository matching.
- Linked the real account identity menu to authenticated identity and
password/session management pages; active sessions can be inspected and
non-current owned sessions revoked through the existing protected API.
- Replaced the PostgreSQL readiness probe with a real query against the target
database, preventing Compose migration from starting during PostgreSQL's
temporary bootstrap server window.
- Started Phase 12 with persistent same-origin Simple/Expert and Dutch/English
presentation preferences, browser-language detection, a matching document
language and owner-only Management navigation in Simple mode.
- Reduced Simple primary navigation to Start, My tasks, Projects and More while
retaining the established technical navigation unchanged in Expert mode.
- Completed Phase 12 with governed Dutch/English copy for Start and the simple
composer, translated task search, localized document language and dates, and
persistent draft-safe language switching.
- Added working My tasks, More and owner-only Management destinations so every
Simple primary-navigation item resolves to a useful, role-appropriate page.
- Added an application icon and eliminated the final browser-console resource
error from authenticated desktop and mobile flows.
- Started Phase 13 by exposing same-origin, workspace-authorized per-project and
Refresh-all endpoints over the existing idempotent PostgreSQL snapshot jobs;
refreshes remain bounded to 500 imported projects and read-only forge access.
- Added actionable project freshness labels, exact snapshot timestamps and
optimistic refresh progress without replacing last-known-good profile data.
- Completed Phase 13 with a PostgreSQL-backed periodic repository planner. It
selects only due, enabled, imported Gitea repositories, atomically creates
the queue job and collecting snapshot, excludes queued/running duplicates
and reuses a stable time-bucket idempotency key across worker restarts.
- Added configurable refresh cadence and stale thresholds. Planner failure is
contained independently of job polling; snapshot jobs retain leased retry,
backoff and stale-lease recovery.
- Added a bounded preflight over the default-branch commit, forge capabilities,
tags, releases, governance and workflow availability. Unchanged repositories
stop before tree/file reads and never create a profile revision; meaningful
changes continue through bounded full analysis.
- Added task-dependent stale-context guidance to Start with an exact collection
time and a direct, actionable Projects refresh path.
- Documented the disabled Gitea webhook threat model and its mandatory HMAC,
timestamp, replay, flood, body, event and workspace-isolation gates. No
webhook endpoint or forge write scope was added.
- Established the pnpm/Turborepo modular-monolith contract, pinned Node.js 24,
PostgreSQL 17, application dependencies, strict TypeScript, formatting, lint,
Vitest, Playwright, production builds, CI, and typed configuration.
- Validated all 28 P0 packages, six normative examples, 72 roadmap catalog
entries, nine schemas, 28 golden prompts, and 68 release-evidence fields.
- Implemented the production TypeScript composer with byte-identical output for
all 28 supplied golden fixtures.
- Implemented the 26-table Drizzle schema, two ordered migrations, immutable
generated runs, persistent artifacts, setup locking, job idempotency, leases,
fencing, retry, and stale-lease recovery.
- Implemented safe built-in package ingestion and PostgreSQL-backed searchable
projections with digest conflict protection.
- Completed structured path/code/message/remediation validation, aggregated
multi-package failures, seed-catalog schema validation and exact 72-entry to
28-P0 runtime cross-checking.
- Added the application-owned built-in import contract, advisory-locked
PostgreSQL importer, immutable published-version trigger, correct Semantic
Version ordering and lifecycle-aware current-version selection.
- Added typed search/filter, full detail/history and exact-version catalog
queries plus their list, detail and exact-version HTTP boundaries.
- Made worker startup validate and synchronize all built-ins before polling,
including both production and development container content layouts.
- Implemented Better Auth behind the application-owned authentication boundary,
first-run owner/workspace creation, local sign-in/logout, session limits,
versioned password hashing and upgrade, and single-use operator reset tokens.
- Implemented workspace-scoped viewer/editor/owner authorization without an
instance-administrator bypass.
- Implemented the first vertical slice through live production boundaries:
first-run setup, 28 imports, API listing, package detail UI, deterministic
composition, immutable run storage, artifact storage, and restart recovery.
- Implemented hardened Docker/Compose web, worker, migrate, and PostgreSQL
roles. Web and worker run non-root with read-only roots and no arbitrary code
execution.
- Implemented explicit liveness/readiness, database-degraded readiness, a
persistent safe worker loop, and an operator persistence validator.
- Delivered the authenticated Library Explorer with URL-owned search, facets,
sorting, card/dense views, persisted favorites and match reasons.
- Delivered responsive detail/version views, governed lifecycle handling, an
exact version/digest composer handoff, light/dark/system themes, mobile
navigation and a keyboard command palette.
- Aligned playbook and favorite API error/status/query contracts with OpenAPI,
including same-origin failures and UUID request IDs.
- Established the Milestone 3 governed RepositoryProfile boundary with strict
JSON/YAML parsing, semantic path/command checks, deterministic export and
exact digest parity with the published example.
- Added authorized repository use cases, strong profile ETags, atomic manual
creation, workspace-scoped immutable revision persistence, semantic no-op
handling and generated-run snapshot-independence coverage.
- Added an additive repository-list index plus database-enforced positive
revision and lowercase SHA-256 invariants without adding a mutable current
revision pointer.
- Delivered the authenticated repository overview, governed profile detail,
manual/import creation and immutable revision editor with explicit viewer,
degraded, validation and conflict-recovery states.
- Exposed strict workspace-authorized repository HTTP routes with same-origin
mutation checks, strong ETags, bounded JSON/YAML imports and deterministic
JSON/YAML exports that re-import successfully.
- Carried immutable repository revision, digest and protected-path context into
the composer handoff without executing repository commands.
- Added the governed composition resolver with typed input normalization,
three-valued condition evaluation, fail-closed policy outcomes, repository
compatibility, protected scope resolution, prompt lint, block provenance and
deterministic preview digests while retaining all 28 reference-v1 bytes.
- Added server-authoritative preview and immutable generation boundaries that
load published playbook versions and exact repository revisions, compute
snapshots/lint/prompt bytes server-side and reject substituted store data.
- Added workspace-authorized composition drafts with strong ETags, monotonic
revisions, atomic compare-and-swap updates and secure draft HTTP routes.
- Added persisted-run JSON/digest integrity checks, mandatory idempotency keys
and an atomic append-only audit event on first immutable generation.
- Delivered the seven-step responsive guided composer with exact-version and
historical-profile pinning, live deterministic preview, block outline,
provenance, linked lint findings and explicit degraded/viewer states.
- Linked guided immutable generation back to its authorized persisted draft,
while preserving the generic direct-composition API path.
- Proved Milestone 4 in the production Unraid stack; exact evidence is recorded
in `docs/47-milestone-four-guided-composer.md`.
- Added exact prompt copy, deterministic Markdown and Run Pack ZIP exports,
review-only AGENTS recommendations, authorized artifact history/download and
bounded historical Run Pack verification without extraction.
- Added strict archive, manifest, inventory, digest, TASK-envelope, filename,
retention, idempotency and workspace-authorization enforcement with hostile
traversal, symlink, duplicate, overlap, CRC and size-limit coverage.
- Proved Milestone 5 in the production Unraid stack, including export/import,
artifact persistence after container recreation and five responsive widths;
exact evidence is recorded in
`docs/48-milestone-five-export-run-packs.md`.
- Implemented workspace-authorized Gitea connection, capability, discovery,
encrypted-token, rotation, deletion and repository-import boundaries with no
write-capable forge methods.
- Added DNS/IP/redirect SSRF enforcement, response and file limits, safe error
projection, capability-level degradation and redacted logging.
- Added bounded deterministic repository evidence collection, immutable
evidence digests, findings, create-initial-only profile generation and a
durable ID-only worker job handoff.
- Delivered imported-repository status and last-known-good snapshot continuity
in the integration UI, including after remote outage and integration deletion.
- Proved Milestone 6 against an isolated live Gitea 1.27.0 fixture and the
production Unraid stack; exact evidence is recorded in
`docs/49-milestone-six-gitea-repository-intelligence.md`.
- Delivered bounded private package import/export, complete persisted draft
inventories, strong ETags, atomic revision updates and field-specific
schema/semantic diagnostics without extraction or execution.
- Delivered the responsive Prompt Lab with deterministic example reproduction,
lint/evidence display, exact-digest editorial review, governed publication,
immutable published versions and coherent next-version cloning.
- Persisted evaluation cases/results with exact playbook, fixture, environment
and rendered-prompt digests while keeping editorial review separate from
objective evidence and transactionally rechecking publication policy.
- Proved Milestone 7 in production through import, invalid-edit recovery,
review, publication, versioning, composer reproduction, restart persistence
and a five-width browser matrix; exact evidence is recorded in
`docs/50-milestone-seven-prompt-lab.md`.
## Changed modules
- Root workspace commands, CI, container definitions, environment contract, and
validation scripts.
- `apps/web`: health, catalog, package detail, setup, status, login, logout, and
password-reset boundaries and accessible pages.
- `apps/worker`: standalone ESM-safe worker, safe job dispatch, and operator
password reset.
- `packages/application`, `artifacts`, `composer`, `config`, `content`, `db`,
`domain`, `integrations`, `observability`, `testing`, and `ui`.
- Deployment and host evidence in `docs/42-implemented-deployment.md` and
`docs/43-milestone-zero-host-validation.md`.
- Milestone 1 package-ingestion and live API evidence in
`docs/44-milestone-one-package-ingestion.md`.
- Milestone 2 library, detail, API and browser evidence in
`docs/45-milestone-two-library-explorer.md`.
- Milestone 3 repository profile, PostgreSQL, API and browser evidence in
`docs/46-milestone-three-repository-profiles.md`.
- Milestone 4 composer and production evidence in
`docs/47-milestone-four-guided-composer.md`.
- Milestone 5 artifact, archive, PostgreSQL, security and browser evidence in
`docs/48-milestone-five-export-run-packs.md`.
- Milestone 6 Gitea adapter, snapshot worker, persistence, outage and browser
evidence in `docs/49-milestone-six-gitea-repository-intelligence.md`.
- Milestone 7 private package, quality evidence, publication, migration and
browser evidence in `docs/50-milestone-seven-prompt-lab.md`.
## Validation evidence
Post-audit Phase 9/10/11 additions through commit `3cf2167`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Wrong-runtime preflight | PASS | Node 23.7.0 rejected; Node 24.14.0 with pnpm 10.33.0 accepted. |
| Content regression repetition | PASS | Three consecutive runs, 21/21 each; no timeout or skip. |
| Missing-database integration gate | PASS | No `DATABASE_URL` exits non-zero before Vitest. |
| Disposable PostgreSQL 17 integration | PASS | Fresh isolated Unraid container, migrations applied, executed 33, skipped 0, failed 0; container verified removed. |
| Job lease regression repetition | PASS | Three consecutive real-PostgreSQL runs, 3/3 each. |
| Focused simple/project/identity tests | PASS | Four files, 14 tests; web typecheck passed. |
| Security suite | PASS | Two files, 11/11 tests. |
| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
| Production dependency audit | PASS | Zero advisories after the esbuild override. |
| Direct uncached `pnpm verify` | PASS | Node 24.14.0/pnpm 10.33.0; all 14 package lint/typecheck scripts, unit suites, pack/golden contracts and production builds passed with exit 0 in 855,316 ms. |
| Clean-room frozen install and verify | PASS | Detached checkout at `164fa49`, no copied dependencies/build output; frozen install succeeded and the direct gate passed with exit 0 in 585,617 ms. |
| Gate cache/process safety | PASS | Release qualification now invokes package scripts directly through topological `pnpm -r`; stale Turbo cache reuse and a Windows post-build Turbo hang cannot produce release evidence. |
| Phase 10 focused model/UI tests | PASS | Three focused files, 11/11 tests; web typecheck passed. |
| Phase 10 live desktop browser | PASS | Isolated PostgreSQL-backed owner/project flow reached a ready usability task with ordinary task text and visible default provenance; no browser warnings/errors. |
| Phase 10 live 390px browser | PASS | Start and simple composer had one `main`, no horizontal overflow and 44px primary/detail actions; task text and provenance remained readable. |
| Phase 10 privacy-safe funnel contract | PASS | Two focused application tests plus application/database/web lint and typecheck; raw task text is rejected as a metric dimension. |
| Phase 11 preference unit contracts | PASS | Application preference tests 3/3, schema tests 9/9 and Start ordering tests 8/8; 0, 5, 31 and 500 repository boundaries are covered. |
| Phase 11 API/spec regression | PASS | Pack validation covers 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 reference prompts remain byte-identical. |
| Phase 11 server PostgreSQL gate | PASS | Isolated PostgreSQL 17.9 on Unraid applied all nine migrations; the preference integration executed 2/2 with cross-workspace, missing and archived mutations denied. |
| Phase 11 production build/replay | PASS | Node 24.18.0/pnpm 10.33 server build completed 14/14 packages. A fresh Compose volume then migrated with exit 0 after the PostgreSQL initialization health race was repaired. |
| Phase 11 desktop browser | PASS | Live server flow created a real repository, persisted favorite state across refresh, created a simple draft, showed exact owner name/email/role and loaded the current session without console warnings/errors. |
| Phase 11 mobile browser | PASS | At 390×844 Start retained one main landmark, 390px viewport with 375px content width, a 44px favorite action, persistent selection/favorite state and no console warnings/errors. |
| Phase 12 presentation foundation | PASS | Server Node 24 checks: 7/7 preference/navigation tests, web lint, typecheck and production build; default Simple navigation, Dutch labels, Expert parity and viewer Management denial are covered. |
| Phase 12 complete server gate | PASS | Unraid Node 24.18.0: formatting, all 14 package lint/typecheck scripts and all unit suites passed (web 227/227); the Compose production build completed 14/14 packages. The aggregate `pnpm verify` then stopped only because its Node image intentionally has no Python, so both Python gates were executed separately. |
| Phase 12 pack and golden post-check | PASS | Unraid Python 3.13: 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts verified. |
| Phase 12 bilingual browser flow | PASS | Live PostgreSQL-backed Unraid flow created a real project and draft, matched Dutch search text, preserved draft `59b580b2-5d9c-4f04-a2a7-cb7f041a7263` across Dutch/English changes, and retained technical Expert navigation. |
| Phase 12 navigation and mobile browser | PASS | My tasks, More and owner-only Management loaded in Dutch; at 390×844 the four mobile shortcuts remained visible and keyboard-addressable. A fresh post-favicon browser session reported zero errors and warnings. |
| Phase 13 refresh vertical slice | PASS | Unraid Node 24.18.0: production Compose build 14/14 packages; web lint and typecheck passed; 50 files and 230 tests passed, including same-origin, invalid-ID, missing-idempotency-key and refresh-all boundaries. |
| Phase 13 API post-check | PASS | Unraid Python 3.13 pack validation retained 28 P0 packages, 6 examples, 72 catalog entries and 9 schemas; all 28 golden prompts remain byte-identical. |
| Phase 13 continuous-freshness gate | PASS | Unraid Node 24.13.0: formatting, 14/14 lint and typecheck packages, all unit suites and 14/14 production builds passed. Web retained 50 files and 230 tests; worker passed 18 tests. |
| Phase 13 PostgreSQL scheduler gate | PASS | Fresh PostgreSQL 17.9 on Unraid applied all migrations; 35/35 integration tests executed with zero skips. A new scheduler instance produced one atomic job/snapshot pair and a same-bucket restart produced zero duplicates. |
| Phase 13 live browser gate | PASS | Fresh production Compose on Unraid reached authenticated Dutch Start with the rebuilt worker active, correct progressive disclosure and zero browser warnings or errors. |
Authoritative host: Unraid 7.2, Docker 27.5.1, Compose 2.40.3, Node.js 24.18.0
container, PostgreSQL 17.9 container. The Windows workstation's Node.js 23.7.0
is unsupported and is not release evidence.
| Command/check | Result | Evidence |
| --- | --- | --- |
| `python3 scripts/validate_pack.py` | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas, 28 goldens, 68 release fields. |
| `python3 scripts/reference_compose.py --check` | PASS | All 28 reference prompts verified. |
| Frozen `pnpm install` under Node 24.18.0 | PASS | Clean Git checkout without copied dependencies or build output. |
| `pnpm verify` under Node 24.18.0 | PASS | Formatting, 13-workspace lint/typecheck, unit tests, pack checks, composer checks, and 13 builds. |
| PostgreSQL integration gates | PASS | Six files and 15 tests; setup, import, composition, artifact, authorization, job, lease, retry, and reconnect coverage. |
| `pnpm test:security` | PASS | 11 hostile-input, redaction, secret-at-rest, origin, and dependency-boundary tests. |
| Production Compose build/start | PASS | Fresh migration; web, worker, and PostgreSQL healthy; non-root hardened services. |
| First-run/authentication | PASS | Setup `201`, closure `409`, wrong login `401`, correct login/session `200`, logout revocation, reset/replay/expiry/session-revocation/rehash proof. |
| Workspace authorization | PASS | Viewer/editor/owner permissions, disabled user, cross-workspace denial, and no admin bypass. |
| Worker persistence | PASS | Safe health job succeeded; unsupported job failed safely; no duplicate after restart; stale lease covered by PostgreSQL test. |
| `pnpm validate:m0-persistence` | PASS | Golden run and 6,806-byte artifact persisted and restored at SHA-256 `8389b948158cc35fa1716e170c9893bd3939dc3aaad9311971b6c267f835ae1b`. |
| Full Compose restart | PASS | Readiness recovered; catalog, identity, run, and artifact remained; validation retries were idempotent. |
| PostgreSQL outage/recovery | PASS | Readiness `503 database-unavailable`, liveness `200`; readiness returned to `200` after restart. |
| Migration replay/failure | PASS | Initialized replay exited zero; unreachable test database exited non-zero visibly without a secret. |
| Backup/restore drill | PASS | Logical dump and artifact archive restored into empty isolated volumes; run bytes and digest matched. |
| Production log scan | PASS | Configured secret values, authorization headers, and bearer markers absent. |
Milestone 1 authoritative additions at commit `b7dcb5d`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Clean Node 24 `pnpm verify` | PASS | 13-workspace format/lint/typecheck/build, unit tests, 28 packages, 72 catalog entries, 9 schemas and 28 golden prompts. |
| Content validation tests | PASS | Structured errors, invalid UTF-8, hardlinks, multi-package aggregation, catalog mismatch and duplicate identity. |
| Catalog/import tests | PASS | SemVer ordering, lifecycle recommendation, exact history/version reads, idempotency and digest conflicts. |
| Fresh PostgreSQL migration and replay | PASS | Empty PostgreSQL 17 volume migrated; post-test replay exited zero. |
| `pnpm test:integration` | PASS | 3 files, 7 tests with database and artifact targets, including immutable published-version rejection. |
| `pnpm test:security` | PASS | 2 files, 11 tests. |
| Fresh production Compose | PASS | Worker inserted 28/28, web/worker/PostgreSQL healthy, exact-version route live. |
| Worker restart | PASS | Zero inserts, 28 unchanged versions, healthy after restart. |
| Live API matrix | PASS | 28 list items; combined search/filter exact match; detail/history/exact-version; invalid filter `422`. |
| Production log scan | PASS | No configured secret values, authorization headers or bearer markers. |
Milestone 2 authoritative additions at commit `3397226`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Pack and reference composition checks | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas, valid OpenAPI and 28 golden prompts. |
| Database and web unit gates | PASS | Database 29 passed/3 optional integration skipped; web 80 passed. |
| `pnpm test:security` | PASS | 2 files and 11 tests, including route/persistence dependency boundaries. |
| Production Compose build/start | PASS | Final web/worker/migrate images built; web, worker and PostgreSQL healthy. |
| Live API matrix | PASS | Auth boundary, 28 items, facets, search/filter, detail/version digest, favorites round-trip and origin rejection. |
| Production Playwright matrix | PASS | 23 passed and 3 intentional skips across desktop and 390×844 narrow projects. |
| Production log/boundary scan | PASS | No sensitive or stack patterns; web/worker non-root and read-only. |
Milestone 3 authoritative additions through commit `76b28de`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Repository intelligence package gates | PASS | Lint, typecheck, build and 23 focused tests; exact example digest remains `041e20f67e299665e85e5f14800a4bbcfa5e6c42ccdd7b22d29206e2c3f6727e`. |
| Application repository gates | PASS | 13 files and 67 tests, including actor matrix, server-owned metadata, validation, ETags and export. |
| Database repository gates | PASS | 41 unit tests plus 7 live PostgreSQL integration tests for atomicity, isolation, concurrency, no-op behavior and frozen snapshots. |
| PostgreSQL 17.9 invariant drill on Unraid | PASS | Fresh 0000→0001→0002 SQL application; valid insert; invalid revision/digest rejection; immutable update rejection; cascade preservation; index-only workspace-list scan. Ephemeral container and test files removed. |
| Pack and reference composition gates after schema changes | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 reference prompts remain valid. |
| Production Compose and migration replay | PASS | Corrected runtime at `184af5c`; migrate completed twice, then web, worker and PostgreSQL were healthy. |
| Live repository API matrix | PASS | Manual create, revision summary, ETag/no-op/append/conflict/precondition, JSON/YAML export and re-import, traversal and origin rejection. |
| Production browser matrix | PASS | 4 passed, 2 duplicate-mutation skips across desktop and narrow projects; zero console/page errors. |
| Restart, container and log evidence | PASS | Full-stack restart preserved 9 repositories/13 revisions; web/worker non-root and read-only; zero sensitive/error patterns. |
Milestone 4 authoritative additions through commit `80b95bc`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Integrated Node 24 `pnpm verify` | PASS | 14-workspace formatting, lint, typecheck, tests and build with isolated Python pack validation. |
| Composer/application/web gates | PASS | 37 composer tests, 96 application tests and 132 web tests. |
| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
| Live PostgreSQL and migration | PASS | Migration count 4; draft/source/history integrations green; existing repositories preserved. |
| Production browser matrix | PASS | Exact handoff, autosave, lint gate, preview/provenance, immutable task, historical pinning, responsive matrix and zero console issues. |
| Draft-linked generation | PASS | Run `a87ae11c-54b7-41c6-ba70-3a2d2a9aac0e` persisted exact source draft, digest and one creation audit event. |
| Restart and security boundary | PASS | Run survived restart; services non-root/read-only/cap-drop/no-new-privileges; zero sensitive log patterns. |
Milestone 5 authoritative additions through commit `5ba0caf`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Integrated Node 24 verification | PASS | 14-workspace formatting, lint, typecheck, tests and production build; focused mobile regression test also passed after the live defect repair. |
| Artifact/application/web gates | PASS | 23 artifact, 100 application and 147 web tests, including 18 hostile/deterministic archive cases. |
| Pack and golden contract | PASS | 28 P0, 6 examples, 72 catalog entries, 9 schemas and all 28 production prompts remain byte-identical. |
| Live PostgreSQL artifact integration | PASS | 6 focused files and 17 tests; three production-created artifact rows retained exact sizes, hashes and valid expiry. |
| Production export/import flow | PASS | Exact copy plus Markdown, ZIP and AGENTS creation; downloaded ZIP verified against the immutable historical run without extraction. |
| Restart and download persistence | PASS | Web/worker recreation preserved the run, artifact count and all three authorized download rows. |
| Responsive/browser gate | PASS | 390, 768, 1024, 1440 and 2560 widths without overflow after the status-digest regression repair; zero console entries. |
| Runtime security boundary | PASS | Non-root, read-only, all capabilities dropped, `no-new-privileges`; zero token, password or error log matches. |
Milestone 6 authoritative additions through commit `0af5254`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Clean Node 24 quality gate | PASS | Formatting, lint and typecheck across 14 workspaces; all unit tests; 14 production builds; 11 security tests. |
| Pack and golden contract | PASS | Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
| Live PostgreSQL integration | PASS | Focused Gitea persistence test, including encrypted projection, workspace isolation, snapshot status and retention. |
| Live Gitea pipeline | PASS | Gitea 1.27.0 capability probe, one-item discovery, `202` import, worker completion, evidence digest, finding and immutable profile revision. |
| Outage and deletion continuity | PASS | Imported state remained visible with discovery offline; after integration deletion, one repository, one complete snapshot and one profile revision remained and both local APIs returned `200`. |
| Responsive browser gate | PASS | Healthy and unavailable states, safe token suffix, imported repository and retained snapshot rendered; 390 by 844 had no horizontal overflow. |
| Runtime security boundary | PASS | Web/worker healthy, non-root, read-only and capability-dropped; secret/header log scan passed; temporary fixture resources removed. |
Milestone 7 authoritative additions through commit `07cba0f`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Clean Node 24 quality gate | PASS | Formatting, lint, typecheck, all unit tests, 14 production builds and the configured security suite. |
| Pack and golden contract | PASS | Clean Python 3.12 validation of 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and 28 byte-identical prompts. |
| Fresh PostgreSQL integration | PASS | Migrations `0000` through `0006`; private draft, package-file and publication/evaluation persistence suites passed. |
| Production authoring flow | PASS | ZIP import, exact-path invalid edit, reset, exact-digest review, immutable publication, coherent next-version creation and deterministic export. |
| Example reproduction | PASS | Stored example rendered twice through the production composer with a byte-identical repeat and persisted render digest. |
| Responsive browser gate | PASS | 390, 768, 1024, 1440 and 2560 widths without overflow; fresh-tab console log was empty after the hydration repair. |
| Migration and restart boundary | PASS | Corrected `0005` trigger ordering applied; `0006` applied; web recreation retained draft/publication/version evidence; services healthy. |
Milestone 8 release-candidate additions through commit `3b255f3`:
| Command/check | Result | Evidence |
| --- | --- | --- |
| Node 24 quality gate | PASS | Formatting, lint and typecheck each completed across 14 workspaces; 25/25 test tasks passed, including 212 web, 160 application, 97 database unit and 16 worker tests; security suite 11/11. |
| Fresh PostgreSQL integration | PASS | Eight migrations applied to a disposable PostgreSQL 17 database; 15 files and 33 integration tests passed for invitations, sessions, personal data, collections, operations, immutable audit and existing persistence contracts. |
| Pack and golden contract | PASS | Python 3.12 validated 28 P0 packages, 6 examples, 72 catalog entries, 9 schemas and all 28 byte-identical production prompt fixtures. |
| Operations and identity | PASS | Authorized queue/audit console, safe retry, sessions, single-use invitations, password-confirmed personal export/deletion, collections and bounded artifact retention are implemented and tested. |
| Backup and restore | PASS | Backup `pre-m8-b2fb5a5` passed strict checksums; isolated restore applied migration `0007`, matched users/runs/artifacts/audit/migration counts and reproduced all artifact SHA-256 values before exact temporary-resource removal. |
| Clean-room installation | PASS | Independent project `devrunbook-release-cleanroom-56cbbab` built from the documented Compose path, applied all eight migrations, completed protected setup (`201`, repeat `409`), imported 28/28 built-ins, passed preflight/readiness and remained healthy after restart. Temporary project resources were then removed. |
| Performance | PASS | Deterministic 10,000-version fixture, 30 iterations: search P95 241.913 ms against 500 ms target; detail P95 24.469 ms against 400 ms target. See `evidence/performance-report.json`. |
| Security and supply chain | PASS | Production audit has no high/critical dependency findings; final web and worker images have zero high/critical Trivy findings; Gitleaks found no leaks across 153 commits; 161 production package records have classified licenses. |
| Production browser | PASS | Collections create/membership, operations safe failures/audit, invitation generic failure, desktop and 390 by 844 layouts were exercised. A narrow Operations overflow was found and repaired; the fresh verification tab had zero warnings/errors. |
| Host-capacity recovery | PASS | Repeated release builds exhausted unused Docker build cache. PostgreSQL completed crash recovery after space was reclaimed; the worker was explicitly restarted, resynchronized 28 unchanged built-ins and returned healthy. No application volume was removed. |
## Browser verification
- The 2026-07-29 Unraid consolidation replaced 23 accumulated DevRunbook
validation and production containers with one healthy `DevRunbook` DockerMan
container. A restored production backup was first verified on port 23004,
including 2 users, 43 repository profiles and both health endpoints. The
final port-1231 container retained authenticated access and Gitea project
selection after a container restart, with zero browser warnings or errors.
DockerMan metadata includes the WebUI URL and the installed DevRunbook SVG
icon.
- The 2026-07-28 production re-audit verified authenticated library search and
URL state, all seven primary application surfaces, a governed composer draft
with live deterministic preview and blocking lint, explicit Gitea degraded
state, Ctrl+K command palette behavior and theme switching. Desktop Library
and Composer plus all primary routes at 390 by 844 had no horizontal page
overflow, and the browser console contained zero warnings or errors. See
`evidence/functional-visual-audit-2026-07-28.md`.
- Live Unraid home page loaded 28 persisted built-ins without Gitea.
- Setup remained closed and displayed `Instance ready` after restart.
- Invalid local login used a generic failure and cleared the password field.
- The `root-cause-bugfix` detail displayed the persisted package identity and
source digest.
- At 390 by 844 there was no horizontal overflow; semantic form and navigation
roles remained present.
- Browser console warnings and errors: zero.
- The canonical Playwright suite covers keyboard focus, reduced-motion,
responsive, security-header, setup, login, and recovery behavior.
- Milestone 1 rechecked the live Root-Cause Bug Fix detail and its immutable
version/digest at 390 by 844 with no horizontal overflow and zero browser
warnings or errors.
- Milestone 2 verified URL-preserved search/filter/view state, favorites,
complete detail governance, composer handoff, command palette, themes,
keyboard behavior and horizontal-overflow absence in desktop and 390×844
production projects. The final matrix passed 23 tests with 3 documented
environment/isolation skips.
- Milestone 3 verified manual repository creation, immutable editing,
protected-path and inert-command display, export/re-import, composer context,
keyboard/theme/reduced-motion behavior and horizontal-overflow absence. The
production matrix passed 4 tests with 2 deliberate duplicate-mutation skips.
- Milestone 4 verified the production guided composer at 390, 768, 1024,
1440 and 2560 widths, exact historical profile pinning, live preview,
immutable generation and restart persistence with zero browser console issues.
- Milestone 5 verified exact prompt copy, three persisted export formats,
historical Run Pack re-import without extraction, download history after
container recreation and the same five-width responsive matrix with zero
browser console entries.
- Milestone 6 verified safe Gitea connection metadata, repository discovery and
import, worker-completed snapshot/profile creation, explicit offline state,
retained local profile use and 390-pixel responsive layout.
- Milestone 7 verified package import, path-linked validation recovery,
exact-digest review, immutable publication, next-version creation and stored
example reproduction. The Prompt Lab passed 390, 768, 1024, 1440 and 2560
widths without horizontal overflow; a fresh tab had zero console messages.
- Milestone 8 verified personal collection creation and membership, operations
queue/audit rendering, safe invalid-invitation feedback and the new navigation
entries on the live Unraid release candidate. Collections and Operations were
checked at desktop and 390 by 844; the final tab had zero console messages.
## Migrations and configuration
- Nine forward migrations are authored. Migration `0003` adds governed draft
revision/output state and mandatory generated-run idempotency; migration
`0004` hardens Gitea persistence, secret envelopes and snapshot integrity;
`0005` adds private package drafts/files, `0006` adds immutable quality,
review and publication evidence, `0007` adds personal collections and `0008`
adds workspace/user-scoped repository preferences. All nine pass fresh
PostgreSQL 17.9 application and production replay on Unraid.
- Production Compose keeps baked built-ins separate from persistent operator
content, artifacts, and database volumes.
- Unraid DockerMan can alternatively use the `all-in-one` image target. Its
private PostgreSQL database, artifacts and operator content share the single
`/config` persistence boundary; only HTTP port 3000 is published.
- The installed DockerMan template uses a cached PNG icon through DockerMan's
`file://` convention and exposes managed-container, shell and WebUI metadata.
- The secure validation environment file is mode `0600`; no values are recorded
in repository evidence.
- Ordinary backups intentionally exclude session and encryption keys. Operators
must preserve those separately.
## Risks and limitations
- Release qualification was exercised on `linux/amd64`; other architectures are
not claimed by this release evidence.
- The live validation stack and backup evidence remain in the restricted Unraid
validation directory. Temporary restore resources were removed.
- Gitea remains deliberately read-only and optional. No GitHub/GitLab adapters,
arbitrary command execution, semantic search or scheduled remote health
monitoring are included in the MVP.
- Operational log rotation is configured in the Docker logging layer; audit
pruning is intentionally manual until append-only governance and backup
policy are reconciled.
- The former transitive `esbuild` advisory was removed through the governed
package override; the latest recorded production dependency audit reports
zero advisories.
- The shared validation host approached Docker storage capacity during repeated
image builds. Only unused build cache was pruned; operators should monitor
Docker storage so PostgreSQL always retains write headroom.
## Active delegated work
- No delegated work remains active. The lead thread integrated and validated
all Milestone 8 slices in the canonical branch.
## Next action
Post-audit Phases 14 through 16 are complete. Review the recorded evidence and
create a release tag only after explicit operator approval; no tag was created
automatically.
## Usability recovery — active 2026-07-30
The operator accepted `docs/52-usability-recovery-roadmap.md` after a live
visual audit showed that technical qualification had not produced a sufficiently
readable product. Phase A is active. Its first slice standardizes authenticated
navigation around tasks and projects, localizes command labels, introduces
unique primary-route metadata, and reduces Task library density. Server and
browser evidence will be added before this phase is declared complete.
First-slice evidence: on Unraid Node 24, Prettier, web lint and web typecheck
passed; the web unit suite executed 51 files and 233 tests with zero failures;
the all-in-one production Docker build completed all 14 package builds. The
candidate was deployed at a private validation host, reported ready and healthy,
and retained its `/config` data, LAN port and DockerMan labels. The new
authenticated browser regression could not log in because the stored validation
credential no longer matches the active account (HTTP 403). No account password
was changed. Phase A therefore remains active pending authenticated browser
evidence and the remaining primary-page localization work.
The next continuous slice localized the Projects overview and task-history
recovery, added a bounded case-insensitive project-name query across UI, API,
application and PostgreSQL store, and moved dense project evidence behind a
technical-details disclosure on project detail. Unraid validation passed all
14-package lint and typecheck tasks, 51 web test files with 233 tests, pack
validation and all 28 golden prompt checks. The production all-in-one image was
rebuilt and the single DockerMan container returned healthy and ready with its
existing persistence and LAN mapping.
The final usability-recovery slice completed the generated-task and task-history
surfaces. Generated tasks now use locale-aware ordinary-language headings and
actions, keep immutable status explicit, and move provenance, prompt details and
technical evidence behind disclosures. Task history now supports bounded search,
readiness filtering, localized status summaries, result counts and distinct empty
and no-match recovery paths.
Final Unraid evidence on 2026-07-30: repository format, all 14 lint tasks, all 14
typecheck tasks, all unit suites and all 14 production builds passed. The focused
web suite passed 51 files and 233 tests; security passed 11 tests; the production
dependency audit found no known vulnerabilities. A fresh PostgreSQL 17.9 database
applied all migrations and executed 36 integration tests with zero skips or
failures. Pack validation covered 28 P0 packages, 6 examples, 72 catalog entries
and 9 schemas, and all 28 golden prompts remained byte-identical.
The release image was built and deployed on the Unraid server. Exactly one
`DevRunbook` container is present, reports healthy and ready on a private
validation port,
retains `/mnt/user/appdata/devrunbook:/config`, and exposes the DockerMan managed,
WebUI and local-icon labels. A live Chrome check found no horizontal overflow at
390 by 844, 50-pixel login fields, a 52-pixel primary action and zero console
warnings or errors. Public home/start routing and the login surface were visually
checked. Authenticated production browser replay remains unavailable because the
stored validation credential no longer matches the operator account; no password,
account or production data was changed to manufacture a green browser result.
## Post-audit Phases 14–16 — 2026-07-30
- Completed scope: single-main authenticated landmarks, named compact controls,
accessible light/dark contrast, keyboard/touch/reflow/reduced-motion checks,
human-readable operations status, storage and backup evidence, hardened
Compose limits, HTTPS/security headers and final release qualification.
- Changed modules: authenticated pages and shell controls, operations service/UI,
PostgreSQL system-status store, Compose/Next configuration, deployment and
operator documentation, Playwright accessibility coverage and migration
readiness/preflight constants.
- Server gates: Node 24 format, lint, typecheck, unit and production build passed;
fresh PostgreSQL 17.9 migration plus integration gate executed 36, skipped 0,
failed 0. Security tests and production dependency audit were included in the
final verification command.
- Browser evidence: production Compose on Unraid passed 24/24 Phase 14 tests
across desktop and 390-pixel projects for Start, composer, Projects, My tasks,
account and Management, with no serious/critical Axe findings. The existing
repository creation/edit/context handoff flow also passed after regression
repair.
- Deployment evidence: web and worker report read-only root filesystems,
`CapDrop=[ALL]`, PID limit 256, 1 GiB memory and 64 MiB `/tmp` tmpfs. HSTS,
frame/CSP protection and suppressed framework disclosure were observed.
- Recovery evidence: restart preserved 1 owner and 28 built-ins and returned
readiness to `ready`; an isolated pg_dump restore matched 1 owner, 28
playbooks and 9 migration rows. Restore database and dump were removed.
- Migration/configuration: no new migration was introduced. Readiness and
migration preflight now correctly expect the existing nine migrations.
- Remaining limitation: qualification is `linux/amd64`; HTTPS termination and
off-host backup scheduling remain operator infrastructure responsibilities.
- Next milestone: optional Phase 17 Codex-native exports, only after operator
release approval. No release tag has been created.
## Usability follow-up audit — 2026-08-01
- Completed scope: localized every shared authenticated shell control, the Dutch
expert navigation, account preferences, password/session management, new-project
entry and workspace-management denial. Account and security routes now receive
the common command set by default instead of opening an empty search dialog.
- Role clarity: owner, editor and viewer labels use ordinary language. Viewers no
longer receive the write-only advanced composition destination in expert
navigation or search. An empty viewer workspace explains who can add a project
and links to the readable Projects overview instead of offering an unauthorized
Gitea action. Editor and viewer denial states preserve context and recovery.
- Changed modules: authenticated presentation/layout, shared shell, workspace,
account, theme and command controls, account/security pages, management and
new-project entry, Start copy/empty state, plus localization and browser
regression suites. No schema, migration or runtime configuration changed.
- Server gates: the final Linux/Node 24 candidate passed formatting, all
repository lint and typecheck tasks, all unit suites (including 52 web files
and 235 web tests), pack validation for 28 P0 packages, 6 examples and 72
catalog entries, all 28 byte-identical golden prompts, all 14 production
builds, 11 security tests and the production dependency audit with zero known
vulnerabilities. A fresh PostgreSQL 17.9 run applied migrations and executed
36 integration tests with zero skips or failures.
- Browser evidence: an isolated all-in-one image on the Unraid server was set up
from a clean volume and exercised as a new owner plus invited editor and viewer.
Invalid login, empty workspace, account, sessions, management denial,
new-project rights, simple/expert, Dutch/English, keyboard mobile navigation,
390-pixel mobile, 640-pixel 200%-equivalent reflow and desktop presentation
were inspected. The final browser had no horizontal overflow and zero console
warnings or errors. The focused Chromium/Axe matrix passed 17/17 scenarios on
eight critical authenticated routes with no serious accessibility findings.
- Remaining boundary: the active-workspace control intentionally exposes only the
deterministic current membership; selecting among multiple memberships is not
implemented by the current authorization lookup. Advanced repository-profile
and integration authoring retain canonical technical/English contract labels.
Public first-run setup, login and invitation acceptance also remain English; the
authenticated primary navigation, explanations, rights and recovery are
localized. These are explicit future product capabilities, not hidden
fallbacks in this release.
- Deployment evidence: commit 5b8d207 was pushed to origin/main and its
verified all-in-one image replaced production with automatic rollback protection.
Exactly one DevRunbook container remains, is healthy and ready on LAN port
1231, retains /mnt/user/appdata/devrunbook:/config, and exposes the DockerMan
managed, shell, WebUI and local-icon labels. Temporary candidate, gate and
PostgreSQL resources were removed.
- Next action: create a release tag only after explicit operator approval.
## Complete usability closure — 2026-08-12
- Completed scope: the public home, setup, login, invitation and password-reset
journeys now follow Dutch or English presentation preferences; compact language
controls use an authoritative same-origin cookie endpoint. On narrow screens the
actionable form precedes explanatory copy. Sign-out and Gitea connection tests
remain inside the application and expose accessible failures instead of raw API
responses.
- Workspace and role clarity: every active authorized membership is selectable.
The server re-authorizes the preference on every request and falls back safely
when it is missing, stale or unauthorized. Owner, editor and viewer flows were
exercised with two memberships each; write and management destinations remain
permission-aware.
- Expert usability: repository-profile and Gitea authoring now localize primary
labels, explanations, policy values and status feedback while preserving exact
canonical contract values in requests and stored profiles.
- Changed modules: public presentation and authentication pages, locale and
workspace preference endpoints, application workspace queries, authenticated
layout and shell, repository-profile and integration presentation, plus focused
unit and browser regression coverage. No schema or migration changed.
- Verification: format, all 14 lint and typecheck tasks, unit suites including 53
web files and 242 web tests, all 14 production builds and 11 security tests pass.
Pack validation still covers 28 P0 packages, 6 examples, 72 catalog entries and
9 schemas; all 28 golden prompts are byte-identical. The production dependency
audit has zero known vulnerabilities after pinning patched `fast-uri` and
`nanoid` transitives. A fresh PostgreSQL 17.9 gate executes all 36 integration
tests with zero skips or failures.
- Browser evidence: an isolated all-in-one server candidate was exercised as a
new owner plus invited editor and viewer across both workspaces. Public NL/EN,
invalid invitation/reset recovery, sign-out, workspace switching, management
denial and expert authoring were checked at desktop and 390 by 844 without
horizontal overflow. The focused Chromium/Axe matrix passed 17/17 scenarios on
eight critical routes at desktop, mobile and 200%-equivalent reflow.
- Deployment: the verified all-in-one image is deployed as the sole `DevRunbook`
container, healthy and ready on a private validation port with the persistent `/config`
mount and DockerMan managed, shell, WebUI and local-icon labels. Temporary
candidate and gate resources were removed after qualification.
- Remaining infrastructure boundary: qualification remains `linux/amd64`; HTTPS
termination and off-host backup scheduling are operator responsibilities. No
release tag was created.
## Deep presentation follow-up — 2026-08-12
- Completed scope: closed remaining mixed-language presentation on Collections,
complete playbook details and favorite actions, technical repository evidence,
the advanced composer, Prompt Lab overview/import and Operations. Dutch and
English now share the same interaction and safety boundaries; canonical policy,
mode, lifecycle and autonomy values remain unchanged in requests and storage.
- Interaction quality: collection creation and optimistic membership rollback
announce localized outcomes; composer conflicts, expired sessions, preview
readiness and blocking reasons stay actionable; Operations formats dates and
sizes for the selected locale and reuses formatters across rows.
- Changed modules: collection, playbook-detail, repository-detail, composer,
Prompt Lab and Operations pages/components plus their focused presentation and
contract tests. No schema, migration, API contract or stored content changed.
- Verification: Node 24 formatting, all 14 lint and typecheck tasks, all unit
suites including 54 web files and 244 web tests, all 14 production builds,
11 security tests and the production dependency audit pass with zero known
vulnerabilities. Pack validation and all 28 golden prompt fixtures remain
valid and byte-identical. A fresh PostgreSQL 17.9 database applied all nine
migrations and executed 36/36 integration tests with zero skips or failures.
- Live evidence: the exact server-built `devrunbook:ux-audit-v9` image replaced
v8 with automatic rollback protection. Production is healthy and ready on LAN
validation port. A 390 by 844 live Chrome check confirmed Dutch login/recovery copy,
no horizontal overflow and zero console warnings or errors. Authenticated
presentation changes are covered by the exact Linux build, unit contracts and
the previously qualified role/accessibility flows; no production credential
was changed to manufacture a signed-in replay.
- Deployment shape: exactly one `DevRunbook` container remains with the persistent
`/config` mount and DockerMan managed, shell, WebUI and local-icon labels.
## Public-repository consolidation — 2026-08-31
- Consolidated the later recovery branch into the publication candidate so the
Dutch/English onboarding, setup, login, invitation/reset, workspace selection
and plain-language presentation work are no longer stranded on a side branch.
- Replaced the implementation-pack landing page with a user-oriented README and
documented the difference between historical build-pack version 1.2 and
application version 0.1.
- Removed private validation addresses from the current tree. Historical commits
still contain those addresses and three work-email author records; the
recommended public-history decision is recorded in
`docs/PUBLICATION_READINESS.md` without rewriting shared history.
- Hardened deployment defaults: development and production web ports bind to
host loopback, production requires an explicit `PUBLIC_BASE_URL`, and the
development stack no longer contains a shared first-run bootstrap token.
- Added a 16 KiB streaming limit to the unauthenticated setup request before JSON
parsing, including declared-length and streamed-overflow regression tests.
- Replaced the ineffective Gitea placeholder validation with Node 24, pinned
pnpm, PostgreSQL-backed unit/integration/security gates. Automatic Unraid
deployment now depends on the same exact-revision publication gates.
- Corrected security and configuration documentation that incorrectly described
the implemented application as an undeployed archive or claimed enforcement
for reserved proxy/CIDR settings.
- Local evidence at this point: both Python contract validators pass, the focused
setup-body suite passes 3/3, Compose renders successfully with fixture secrets,
`git diff --check` passes and Gitleaks found no secret across 207 commits.
Final Node 24, PostgreSQL, security and audit authority remains the managed
Gitea run for the final candidate commit.
DECISIONS.md
+46
View File
@@ -0,0 +1,46 @@
# Decision log
| ID | Status | Decision | Rationale |
|---|---|---|---|
| D-001 | Accepted | Use **DevRunbook** as a working name. | Communicates reusable operational development procedures; legal, domain and trademark clearance is still required. |
| D-002 | Accepted | Build a modular monolith for the MVP. | Keeps deployment and local development simple while preserving domain boundaries. |
| D-003 | Accepted | Canonical built-in content is Git-versioned YAML/Markdown. | Enables reviewable diffs, forks, reproducible releases and offline authoring. |
| D-004 | Accepted | PostgreSQL stores application state and search projections. | Supports self-hosting, transactions, full-text search and future team functionality without extra search infrastructure. |
| D-005 | Accepted | Direct arbitrary code execution is excluded from the MVP. | Avoids turning a prompt platform into a remote execution platform before isolation and approval controls exist. |
| D-006 | Accepted | First Gitea integration is read-only. | Repository intelligence delivers value without write-side risk. |
| D-007 | Accepted | Generated runs are immutable snapshots. | Historical reproducibility requires frozen playbook, profile, inputs and output. |
| D-008 | Accepted | Repository-derived content is untrusted evidence. | Prevents README, issues or source files from silently changing platform instructions. |
| D-009 | Accepted | Search starts with PostgreSQL FTS and structured filters. | Avoids a premature vector database and remains explainable. |
| D-010 | Accepted | Use Better Auth as the preferred authentication implementation with its Next.js integration and database-backed sessions. | It currently provides self-hosted email/password authentication, session management and reset primitives that fit the required stack. A blocker-level ADR may replace it only if Milestone 0 compatibility or security verification fails. |
| D-011 | Accepted | Deliver 28 P0 packages now and retain 44 P1/P2 concepts as non-executable backlog. | Prevents roadmap entries from being misrepresented as validated runtime content while preserving the broader product direction. |
| D-012 | Accepted | Represent conditional behavior with a closed, declarative AST. | Avoids arbitrary expression evaluation and makes validation, rendering and UI authoring deterministic. |
| D-013 | Accepted | Declare every package file and its role in `playbook.yaml`. | Enables exact import boundaries, digesting, export policy and undeclared-file rejection. |
| D-014 | Accepted | Use RFC 8785-style canonical JSON rules and explicit self-digest omission. | Cross-platform integrity requires one byte-level algorithm rather than implementation-specific serialization. |
| D-015 | Accepted | Call composed output a **generated task** or **Run Pack**, not an executed run. | The MVP generates instructions and artifacts; it does not execute arbitrary repository commands. |
| D-016 | Accepted | Use local first-run ownership with secure sessions and workspace-scoped authorization. | A self-hosted product still needs a defined takeover boundary, recovery behavior and object-level access control. |
| D-017 | Accepted | Treat `api/openapi.yaml` and `database/reference-schema.sql` as implementation contracts that must remain synchronized with code and migrations. | High-level prose alone is insufficient for autonomous implementation and integration tests. |
| D-018 | Accepted | Maintain an executable offline reference composer and 28 golden prompt fixtures. | Byte-level examples remove ambiguity from deterministic composition and provide cross-language conformance tests. |
| D-019 | Accepted | Use one lead Codex thread with bounded worktrees/subagents under an explicit execution protocol. | Parallelism is valuable only when canonical state, contracts and release evidence have one accountable owner. |
| D-020 | Accepted | Make the monorepo bootstrap structure and root command names normative. | Stable commands and package boundaries reduce autonomous implementation drift and simplify CI, operations and handoff. |
| D-021 | Accepted | Target Node.js 24 LTS with Next.js 16.2.12, React 19.2.8, TypeScript 5.9.3, pnpm 10.33.0, Drizzle ORM 0.45.2 and Better Auth 1.6.25. | These were stable, mutually compatible releases verified at Milestone 0; TypeScript 7 and Node 26 were avoided because the selected LTS and mature compiler line reduce bootstrap risk. |
| D-022 | Accepted | Integrate Better Auth through an application-owned persistence adapter rather than its stock Drizzle schema. | The stock adapter conflicts with mandatory hashed-session, explicit-revocation, dual-expiry and first-run transaction contracts; ADR-006 preserves those security boundaries. |
| D-023 | Accepted | Virtualize Better Auth's credential account over `users.password_hash` and add only `users.email_verified` plus nullable `users.image` to the reference user model. | This satisfies Better Auth 1.6.25's protocol model without duplicating credentials, storing raw session tokens, or introducing stock account/session tables that conflict with the v1.2 relational contract. |
| D-024 | Accepted | Store new local passwords in a versioned DevRunbook scrypt envelope and transparently upgrade Better Auth 1.6's unversioned default hash after a successful sign-in. | Better Auth's default `salt:key` value omits work factors, so parameter-upgrade detection is impossible without a self-describing envelope; custom hash/verify callbacks preserve Better Auth ownership of the credential protocol while making future rehash decisions deterministic. |
| D-025 | Accepted | Govern RepositoryProfile parsing, semantic validation, canonicalization and export in a framework-independent `repository-intel` package while retaining the published root JSON Schema. | Repository evidence is an untrusted interchange boundary used by HTTP, persistence and composition; one reusable implementation prevents route/UI drift and preserves exact Python/TypeScript digest parity. |
| D-026 | Accepted | Resolve the current repository profile as the highest immutable revision under a repository-row lock, and suppress a save when the candidate at the current revision has the same digest. | A mutable current-revision pointer is unnecessary, while row locking gives contiguous concurrent revisions and digest-based no-op suppression avoids meaningless history without weakening immutable snapshots. |
| D-027 | Accepted | Keep `composeCanonicalPrompt` as the byte-frozen reference-v1 formatter and make `composePreview` the authoritative governed resolver that filters conditions before formatting. | The supplied 28 fixtures define a compatibility byte contract, while runtime conditions still require the three-valued, fail-closed semantics in the v1.2 DSL; separating resolution from formatting satisfies both without silently rewriting golden evidence. |
| D-028 | Accepted | Resolve conditions, compatibility, scope, policies, provenance, lint, prompt bytes and digests exclusively on the server from immutable sources. | Clients and imported repository content are untrusted and cannot be allowed to weaken policy, spoof readiness or substitute historical snapshots. |
| D-029 | Accepted | Persist composer autosave state as workspace-scoped drafts with positive monotonic revisions and strong `"draft:<revision>"` ETags. | Atomic compare-and-swap updates preserve local conflict recovery and prevent concurrent autosaves from silently overwriting another editor. |
| D-030 | Accepted | Require a non-empty workspace-scoped idempotency key for every generated task and append its creation audit event in the same database transaction. | Immutable generation must be safely replayable, attributable and incapable of producing an unaudited successful record. |
| D-031 | Accepted | Let guided generation identify its persisted draft through a validated `X-DevRunbook-Draft-Id` header and reload that draft server-side. | The generic run API still supports direct authoritative composition, while the guided UI gains an auditable relational source and cannot substitute client-derived state after autosave. |
| D-032 | Accepted | Generate deterministic Run Packs synchronously from immutable run snapshots and verify historical imports entirely in bounded memory without extraction. | MVP exports are small and user-triggered; fixed ZIP metadata plus a canonical manifest makes bytes reproducible, while in-memory structural validation prevents filesystem traversal and binds re-import to the authorized historical run without adding an execution or extraction surface. |
| D-033 | Accepted | Collect Gitea evidence through a bounded read-only adapter, queue only opaque IDs, create an initial immutable profile once and retain the last complete local snapshot when remote access fails or is deleted. | Repository content and credentials are untrusted; reloading them inside authorized server and worker boundaries prevents secret-bearing jobs, while create-initial-only profile policy prevents a remote refresh from silently overwriting reviewed local knowledge. |
| D-034 | Accepted | Keep private package bytes, server lifecycle, objective evidence and editorial review as separate persisted claims, and permit publication only after an exact-digest transactional recheck. | Imported lifecycle text and reviewer opinion cannot be allowed to masquerade as validated evidence; digest binding makes later edits invalidate stale review and evaluation claims. |
| D-035 | Accepted | Validate and export private playbook archives deterministically in bounded memory without extraction, and clone published versions by rewriting every governed semantic-version reference before revalidation. | Authoring packages are small and untrusted; a no-extraction boundary prevents traversal/execution risk, while coherent manifest/example/evaluation identity preserves reproducibility across immutable versions. |
| D-036 | Accepted | Make password-confirmed personal-data export and anonymizing account deletion local, atomic and audit-recorded. | Self-hosted privacy operations must not depend on external identity providers; anonymization preserves immutable run and governance evidence without retaining the deleted user's direct identifiers. |
| D-037 | Accepted | Enforce artifact retention only through database-referenced storage keys while retaining immutable run snapshots and prompts. | Expired downloads can be removed safely without weakening historical reproducibility or accepting an operator-controlled filesystem path. |
| D-038 | Accepted | Run backup file access with the numeric web-runtime identity and stream archives across the container boundary. | Artifact volumes are intentionally mode `0700`; matching the runtime identity preserves least privilege, while streaming avoids granting a helper container write access to the operator backup directory. |
| D-039 | Accepted | Remove package managers from long-running web and worker images after build. | npm, Corepack and Yarn are unnecessary at runtime and materially expand the vulnerability and executable-tool surface. |
| D-040 | Accepted | Provide an all-in-one PostgreSQL, migration, web and worker image for single-container Unraid DockerMan installations while retaining the modular Compose reference. | The operator explicitly prioritizes one manageable DockerMan container; one `/config` boundary preserves backup and migration behavior, PostgreSQL remains unexposed, and application processes still run as the unprivileged `node` identity. |
| D-041 | Accepted | Treat the selected-workspace cookie only as a user preference and re-authorize it against active memberships on every server-rendered request. | Multi-workspace navigation must be convenient without turning a client-controlled identifier into an authorization decision; missing, stale or unauthorized selections fall back deterministically to an authorized workspace. |
Dockerfile
+96
View File
@@ -0,0 +1,96 @@
# syntax=docker/dockerfile:1.7
ARG NODE_IMAGE=node:24.18.0-bookworm-slim@sha256:6f7b03f7c2c8e2e784dcf9295400527b9b1270fd37b7e9a7285cf83b6951452d
ARG POSTGRES_IMAGE=postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
FROM ${NODE_IMAGE} AS base
ENV PNPM_HOME=/pnpm \
PATH=/pnpm:$PATH \
NEXT_TELEMETRY_DISABLED=1
WORKDIR /app
RUN corepack enable && corepack prepare pnpm@10.33.0 --activate
FROM base AS development
COPY . .
RUN pnpm install --frozen-lockfile
FROM development AS build
ENV NODE_ENV=production
RUN pnpm build
FROM build AS worker-bundle
RUN mkdir -p /out/worker/dist \
&& cp -a /app/apps/worker/dist/. /out/worker/dist/
FROM base AS migrate
ENV NODE_ENV=production
COPY --from=build --chown=node:node /app /app
USER node
CMD ["./packages/db/node_modules/.bin/tsx", "packages/db/src/migrate.ts"]
FROM ${NODE_IMAGE} AS web
ENV NODE_ENV=production \
NEXT_TELEMETRY_DISABLED=1 \
HOSTNAME=0.0.0.0 \
PORT=3000 \
CONTENT_ROOT=/content \
ARTIFACT_ROOT=/artifacts
WORKDIR /app
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /opt/yarn-v1.22.22 \
&& rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg \
&& mkdir -p /content/playbooks /content/catalog /artifacts \
&& chown -R node:node /app /content /artifacts
COPY --from=build --chown=node:node /app/apps/web/.next/standalone ./
COPY --from=build --chown=node:node /app/apps/web/.next/static ./apps/web/.next/static
COPY --from=build --chown=node:node /app/content/playbooks /content/playbooks
COPY --from=build --chown=node:node /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
USER node
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD ["node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
CMD ["node", "apps/web/server.js"]
FROM ${NODE_IMAGE} AS worker
ENV NODE_ENV=production \
CONTENT_ROOT=/content \
ARTIFACT_ROOT=/artifacts
WORKDIR /app
RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /opt/yarn-v1.22.22 \
&& rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg \
&& mkdir -p /content/playbooks /content/catalog /artifacts \
&& chown -R node:node /app /content /artifacts
COPY --from=worker-bundle --chown=node:node /out/worker ./
COPY --from=build --chown=node:node /app/content/playbooks /content/playbooks
COPY --from=build --chown=node:node /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
USER node
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD ["node", "-e", "try{process.kill(1,0)}catch{process.exit(1)}"]
CMD ["node", "dist/index.js"]
FROM ${POSTGRES_IMAGE} AS all-in-one
ENV NODE_ENV=production \
NEXT_TELEMETRY_DISABLED=1 \
HOSTNAME=0.0.0.0 \
PORT=3000 \
PGDATA=/config/postgres \
CONTENT_ROOT=/content \
ARTIFACT_ROOT=/config/artifacts
WORKDIR /app
COPY --from=base /usr/local/bin/node /usr/local/bin/node
COPY --from=build /app /app
COPY --from=build /app/apps/web/.next/static /app/apps/web/.next/standalone/apps/web/.next/static
COPY --from=build /app/content/playbooks /content/playbooks
COPY --from=build /app/catalog/seed-catalog.yaml /content/catalog/seed-catalog.yaml
COPY docker/all-in-one-entrypoint.sh /usr/local/bin/devrunbook-all-in-one
RUN groupadd --gid 1000 node \
&& useradd --uid 1000 --gid 1000 --create-home --shell /usr/sbin/nologin node \
&& mkdir -p /config/postgres /config/artifacts /config/operator-content /content/playbooks /content/catalog \
&& chown -R node:node /app /content \
&& chown -R postgres:postgres /config/postgres \
&& chown -R node:node /config/artifacts /config/operator-content \
&& chmod 0755 /usr/local/bin/devrunbook-all-in-one
EXPOSE 3000
VOLUME ["/config"]
HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
CMD ["node", "-e", "fetch('http://127.0.0.1:3000/health/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
ENTRYPOINT ["/usr/local/bin/devrunbook-all-in-one"]
FILE_INDEX.txt
+336
View File
@@ -0,0 +1,336 @@
AGENTS.md
BUILD_PACK.json
CHANGELOG.md
CODEX_EXECUTION_PROTOCOL.md
CODEX_MASTER_PROMPT.md
CONTRIBUTING.md
CURRENT_STATE.md
DECISIONS.md
FILE_INDEX.txt
IMPLEMENTATION_PLAN.md
LICENSE
PACK_MANIFEST.sha256
PACK_REVIEW.md
README.md
SECURITY.md
START_HERE_CODEX.md
adr/ADR-001-git-first-content.md
adr/ADR-002-modular-monolith.md
adr/ADR-003-no-direct-code-execution-mvp.md
adr/ADR-004-postgres-search-first.md
adr/ADR-005-integration-secrets.md
api/openapi.yaml
catalog/seed-catalog.yaml
config/env.example
content/playbooks/accessibility-audit/CHANGELOG.md
content/playbooks/accessibility-audit/README.md
content/playbooks/accessibility-audit/evaluations/static-structure.yaml
content/playbooks/accessibility-audit/examples/minimal.yaml
content/playbooks/accessibility-audit/playbook.yaml
content/playbooks/accessibility-audit/prompt.md
content/playbooks/agents-instructions/CHANGELOG.md
content/playbooks/agents-instructions/README.md
content/playbooks/agents-instructions/evaluations/static-structure.yaml
content/playbooks/agents-instructions/examples/minimal.yaml
content/playbooks/agents-instructions/playbook.yaml
content/playbooks/agents-instructions/prompt.md
content/playbooks/api-endpoint/CHANGELOG.md
content/playbooks/api-endpoint/README.md
content/playbooks/api-endpoint/evaluations/static-structure.yaml
content/playbooks/api-endpoint/examples/minimal.yaml
content/playbooks/api-endpoint/playbook.yaml
content/playbooks/api-endpoint/prompt.md
content/playbooks/backup-restore-validation/CHANGELOG.md
content/playbooks/backup-restore-validation/README.md
content/playbooks/backup-restore-validation/evaluations/static-structure.yaml
content/playbooks/backup-restore-validation/examples/minimal.yaml
content/playbooks/backup-restore-validation/playbook.yaml
content/playbooks/backup-restore-validation/prompt.md
content/playbooks/branch-protection-plan/CHANGELOG.md
content/playbooks/branch-protection-plan/README.md
content/playbooks/branch-protection-plan/evaluations/static-structure.yaml
content/playbooks/branch-protection-plan/examples/minimal.yaml
content/playbooks/branch-protection-plan/playbook.yaml
content/playbooks/branch-protection-plan/prompt.md
content/playbooks/build-failure-recovery/CHANGELOG.md
content/playbooks/build-failure-recovery/README.md
content/playbooks/build-failure-recovery/evaluations/static-structure.yaml
content/playbooks/build-failure-recovery/examples/minimal.yaml
content/playbooks/build-failure-recovery/playbook.yaml
content/playbooks/build-failure-recovery/prompt.md
content/playbooks/clean-room-validation/CHANGELOG.md
content/playbooks/clean-room-validation/README.md
content/playbooks/clean-room-validation/evaluations/static-structure.yaml
content/playbooks/clean-room-validation/examples/minimal.yaml
content/playbooks/clean-room-validation/playbook.yaml
content/playbooks/clean-room-validation/prompt.md
content/playbooks/docker-self-hosting-audit/CHANGELOG.md
content/playbooks/docker-self-hosting-audit/README.md
content/playbooks/docker-self-hosting-audit/evaluations/static-structure.yaml
content/playbooks/docker-self-hosting-audit/examples/minimal.yaml
content/playbooks/docker-self-hosting-audit/playbook.yaml
content/playbooks/docker-self-hosting-audit/prompt.md
content/playbooks/error-handling-hardening/CHANGELOG.md
content/playbooks/error-handling-hardening/README.md
content/playbooks/error-handling-hardening/evaluations/static-structure.yaml
content/playbooks/error-handling-hardening/examples/minimal.yaml
content/playbooks/error-handling-hardening/playbook.yaml
content/playbooks/error-handling-hardening/prompt.md
content/playbooks/feature-from-spec/CHANGELOG.md
content/playbooks/feature-from-spec/README.md
content/playbooks/feature-from-spec/evaluations/static-structure.yaml
content/playbooks/feature-from-spec/examples/minimal.yaml
content/playbooks/feature-from-spec/playbook.yaml
content/playbooks/feature-from-spec/prompt.md
content/playbooks/frontend-ux-audit/CHANGELOG.md
content/playbooks/frontend-ux-audit/README.md
content/playbooks/frontend-ux-audit/evaluations/static-structure.yaml
content/playbooks/frontend-ux-audit/examples/minimal.yaml
content/playbooks/frontend-ux-audit/playbook.yaml
content/playbooks/frontend-ux-audit/prompt.md
content/playbooks/gitea-best-practices/CHANGELOG.md
content/playbooks/gitea-best-practices/README.md
content/playbooks/gitea-best-practices/evaluations/static-structure.yaml
content/playbooks/gitea-best-practices/examples/minimal.yaml
content/playbooks/gitea-best-practices/playbook.yaml
content/playbooks/gitea-best-practices/prompt.md
content/playbooks/gitignore-hygiene/CHANGELOG.md
content/playbooks/gitignore-hygiene/README.md
content/playbooks/gitignore-hygiene/evaluations/static-structure.yaml
content/playbooks/gitignore-hygiene/examples/minimal.yaml
content/playbooks/gitignore-hygiene/playbook.yaml
content/playbooks/gitignore-hygiene/prompt.md
content/playbooks/health-readiness/CHANGELOG.md
content/playbooks/health-readiness/README.md
content/playbooks/health-readiness/evaluations/static-structure.yaml
content/playbooks/health-readiness/examples/minimal.yaml
content/playbooks/health-readiness/playbook.yaml
content/playbooks/health-readiness/prompt.md
content/playbooks/onboarding-documentation/CHANGELOG.md
content/playbooks/onboarding-documentation/README.md
content/playbooks/onboarding-documentation/evaluations/static-structure.yaml
content/playbooks/onboarding-documentation/examples/minimal.yaml
content/playbooks/onboarding-documentation/playbook.yaml
content/playbooks/onboarding-documentation/prompt.md
content/playbooks/playwright-critical-flows/CHANGELOG.md
content/playbooks/playwright-critical-flows/README.md
content/playbooks/playwright-critical-flows/evaluations/static-structure.yaml
content/playbooks/playwright-critical-flows/examples/minimal.yaml
content/playbooks/playwright-critical-flows/playbook.yaml
content/playbooks/playwright-critical-flows/prompt.md
content/playbooks/production-readiness-audit/CHANGELOG.md
content/playbooks/production-readiness-audit/README.md
content/playbooks/production-readiness-audit/evaluations/static-structure.yaml
content/playbooks/production-readiness-audit/examples/minimal.yaml
content/playbooks/production-readiness-audit/playbook.yaml
content/playbooks/production-readiness-audit/prompt.md
content/playbooks/pull-request-template/CHANGELOG.md
content/playbooks/pull-request-template/README.md
content/playbooks/pull-request-template/evaluations/static-structure.yaml
content/playbooks/pull-request-template/examples/minimal.yaml
content/playbooks/pull-request-template/playbook.yaml
content/playbooks/pull-request-template/prompt.md
content/playbooks/release-candidate-prep/CHANGELOG.md
content/playbooks/release-candidate-prep/README.md
content/playbooks/release-candidate-prep/evaluations/static-structure.yaml
content/playbooks/release-candidate-prep/examples/minimal.yaml
content/playbooks/release-candidate-prep/playbook.yaml
content/playbooks/release-candidate-prep/prompt.md
content/playbooks/release-notes/CHANGELOG.md
content/playbooks/release-notes/README.md
content/playbooks/release-notes/evaluations/static-structure.yaml
content/playbooks/release-notes/examples/minimal.yaml
content/playbooks/release-notes/playbook.yaml
content/playbooks/release-notes/prompt.md
content/playbooks/repository-cleanup/CHANGELOG.md
content/playbooks/repository-cleanup/README.md
content/playbooks/repository-cleanup/evaluations/static-structure.yaml
content/playbooks/repository-cleanup/examples/minimal.yaml
content/playbooks/repository-cleanup/playbook.yaml
content/playbooks/repository-cleanup/prompt.md
content/playbooks/repository-health-audit/CHANGELOG.md
content/playbooks/repository-health-audit/README.md
content/playbooks/repository-health-audit/evaluations/static-structure.yaml
content/playbooks/repository-health-audit/examples/minimal.yaml
content/playbooks/repository-health-audit/playbook.yaml
content/playbooks/repository-health-audit/prompt.md
content/playbooks/repository-inventory/CHANGELOG.md
content/playbooks/repository-inventory/README.md
content/playbooks/repository-inventory/evaluations/static-structure.yaml
content/playbooks/repository-inventory/examples/minimal.yaml
content/playbooks/repository-inventory/playbook.yaml
content/playbooks/repository-inventory/prompt.md
content/playbooks/root-cause-bugfix/CHANGELOG.md
content/playbooks/root-cause-bugfix/README.md
content/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
content/playbooks/root-cause-bugfix/examples/minimal.yaml
content/playbooks/root-cause-bugfix/playbook.yaml
content/playbooks/root-cause-bugfix/prompt.md
content/playbooks/search-filter/CHANGELOG.md
content/playbooks/search-filter/README.md
content/playbooks/search-filter/evaluations/static-structure.yaml
content/playbooks/search-filter/examples/minimal.yaml
content/playbooks/search-filter/playbook.yaml
content/playbooks/search-filter/prompt.md
content/playbooks/secrets-exposure-audit/CHANGELOG.md
content/playbooks/secrets-exposure-audit/README.md
content/playbooks/secrets-exposure-audit/evaluations/static-structure.yaml
content/playbooks/secrets-exposure-audit/examples/minimal.yaml
content/playbooks/secrets-exposure-audit/playbook.yaml
content/playbooks/secrets-exposure-audit/prompt.md
content/playbooks/security-hygiene-audit/CHANGELOG.md
content/playbooks/security-hygiene-audit/README.md
content/playbooks/security-hygiene-audit/evaluations/static-structure.yaml
content/playbooks/security-hygiene-audit/examples/minimal.yaml
content/playbooks/security-hygiene-audit/playbook.yaml
content/playbooks/security-hygiene-audit/prompt.md
content/playbooks/unit-test-foundation/CHANGELOG.md
content/playbooks/unit-test-foundation/README.md
content/playbooks/unit-test-foundation/evaluations/static-structure.yaml
content/playbooks/unit-test-foundation/examples/minimal.yaml
content/playbooks/unit-test-foundation/playbook.yaml
content/playbooks/unit-test-foundation/prompt.md
database/reference-schema.sql
docs/00-product-vision.md
docs/01-product-requirements.md
docs/02-personas-and-jobs.md
docs/03-information-architecture.md
docs/04-ux-design-system.md
docs/05-domain-model.md
docs/06-technical-architecture.md
docs/07-playbook-package-spec.md
docs/08-prompt-composition-engine.md
docs/09-repository-intelligence.md
docs/10-gitea-integration.md
docs/11-codex-integration.md
docs/12-quality-evaluation.md
docs/13-security-privacy-threat-model.md
docs/14-api-contract.md
docs/15-test-strategy.md
docs/16-deployment-unraid.md
docs/17-observability-operations.md
docs/18-roadmap.md
docs/19-acceptance-criteria.md
docs/20-content-governance.md
docs/21-seed-catalog.md
docs/22-brand-copy.md
docs/23-future-expansion.md
docs/24-sources.md
docs/25-implementation-defaults.md
docs/26-authentication-authorization.md
docs/27-database-reference.md
docs/28-conditions-and-policy-dsl.md
docs/29-package-integrity-canonicalization.md
docs/30-screen-state-specification.md
docs/31-first-run-and-instance-lifecycle.md
docs/32-configuration-reference.md
docs/33-requirements-traceability.md
docs/34-risk-register.md
docs/35-glossary.md
docs/36-seed-content-delivery.md
docs/37-build-pack-tooling.md
docs/38-codex-native-build-workflow.md
docs/39-reference-composer-and-golden-fixtures.md
docs/40-bootstrap-repository-contract.md
docs/41-release-evidence-contract.md
examples/instance-config/example-config.yaml
examples/playbooks/feature-from-spec/CHANGELOG.md
examples/playbooks/feature-from-spec/README.md
examples/playbooks/feature-from-spec/evaluations/static-structure.yaml
examples/playbooks/feature-from-spec/examples/minimal.yaml
examples/playbooks/feature-from-spec/playbook.yaml
examples/playbooks/feature-from-spec/prompt.md
examples/playbooks/gitea-best-practices/CHANGELOG.md
examples/playbooks/gitea-best-practices/README.md
examples/playbooks/gitea-best-practices/evaluations/static-structure.yaml
examples/playbooks/gitea-best-practices/examples/minimal.yaml
examples/playbooks/gitea-best-practices/playbook.yaml
examples/playbooks/gitea-best-practices/prompt.md
examples/playbooks/production-readiness-audit/CHANGELOG.md
examples/playbooks/production-readiness-audit/README.md
examples/playbooks/production-readiness-audit/evaluations/static-structure.yaml
examples/playbooks/production-readiness-audit/examples/minimal.yaml
examples/playbooks/production-readiness-audit/playbook.yaml
examples/playbooks/production-readiness-audit/prompt.md
examples/playbooks/repository-cleanup/CHANGELOG.md
examples/playbooks/repository-cleanup/README.md
examples/playbooks/repository-cleanup/evaluations/static-structure.yaml
examples/playbooks/repository-cleanup/examples/minimal.yaml
examples/playbooks/repository-cleanup/playbook.yaml
examples/playbooks/repository-cleanup/prompt.md
examples/playbooks/repository-health-audit/CHANGELOG.md
examples/playbooks/repository-health-audit/README.md
examples/playbooks/repository-health-audit/evaluations/static-structure.yaml
examples/playbooks/repository-health-audit/examples/minimal.yaml
examples/playbooks/repository-health-audit/playbook.yaml
examples/playbooks/repository-health-audit/prompt.md
examples/playbooks/root-cause-bugfix/CHANGELOG.md
examples/playbooks/root-cause-bugfix/README.md
examples/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
examples/playbooks/root-cause-bugfix/examples/minimal.yaml
examples/playbooks/root-cause-bugfix/playbook.yaml
examples/playbooks/root-cause-bugfix/prompt.md
examples/rendered-prompts/accessibility-audit.md
examples/rendered-prompts/agents-instructions.md
examples/rendered-prompts/api-endpoint.md
examples/rendered-prompts/backup-restore-validation.md
examples/rendered-prompts/branch-protection-plan.md
examples/rendered-prompts/build-failure-recovery.md
examples/rendered-prompts/clean-room-validation.md
examples/rendered-prompts/docker-self-hosting-audit.md
examples/rendered-prompts/error-handling-hardening.md
examples/rendered-prompts/feature-from-spec.md
examples/rendered-prompts/frontend-ux-audit.md
examples/rendered-prompts/gitea-best-practices.md
examples/rendered-prompts/gitignore-hygiene.md
examples/rendered-prompts/health-readiness.md
examples/rendered-prompts/manifest.json
examples/rendered-prompts/onboarding-documentation.md
examples/rendered-prompts/playwright-critical-flows.md
examples/rendered-prompts/production-readiness-audit.md
examples/rendered-prompts/pull-request-template.md
examples/rendered-prompts/release-candidate-prep.md
examples/rendered-prompts/release-notes.md
examples/rendered-prompts/repository-cleanup.md
examples/rendered-prompts/repository-health-audit.md
examples/rendered-prompts/repository-inventory.md
examples/rendered-prompts/root-cause-bugfix.md
examples/rendered-prompts/search-filter.md
examples/rendered-prompts/secrets-exposure-audit.md
examples/rendered-prompts/security-hygiene-audit.md
examples/rendered-prompts/unit-test-foundation.md
examples/repository-profiles/example-profile.yaml
examples/run-packs/root-cause-example/TASK.md
examples/run-packs/root-cause-example/VALIDATION.md
examples/run-packs/root-cause-example/manifest.json
schemas/condition.schema.json
schemas/evaluation-case.schema.json
schemas/instance-config.schema.json
schemas/playbook.schema.json
schemas/release-evidence.schema.json
schemas/rendered-prompt-manifest.schema.json
schemas/repository-profile.schema.json
schemas/run-pack-manifest.schema.json
schemas/seed-catalog.schema.json
scripts/__pycache__/build_archive.cpython-313.pyc
scripts/__pycache__/reference_compose.cpython-313.pyc
scripts/__pycache__/validate_pack.cpython-313.pyc
scripts/__pycache__/verify_archive.cpython-313.pyc
scripts/build_archive.py
scripts/reference_compose.py
scripts/requirements-validate.txt
scripts/validate_pack.py
scripts/verify_archive.py
templates/AGENTS.global.template.md
templates/AGENTS.repository.template.md
templates/CURRENT_STATE.template.md
templates/FINAL_HANDOFF.template.md
templates/MILESTONE_REPORT.template.md
templates/evaluation-case.template.yaml
templates/playbook-package/CHANGELOG.md.template
templates/playbook-package/README.md
templates/playbook-package/evaluations/static-structure.yaml.template
templates/playbook-package/examples/minimal.yaml.template
templates/playbook-package/playbook.yaml.template
templates/playbook-package/prompt.md.template
templates/release-evidence.template.json
FINAL_HANDOFF.md
+150
View File
@@ -0,0 +1,150 @@
# DevRunbook final handoff
## Delivered product
DevRunbook 0.1.0-rc.1 is a self-hosted, no-arbitrary-execution control plane
that turns governed playbooks, repository profiles, intent, constraints and an
autonomy level into deterministic prompts and Run Pack archives. The release
contains all 28 P0 packages, a searchable library, guided composer, immutable
run history, package authoring, read-only Gitea intelligence, local identity,
operations/audit views and production Docker/Unraid tooling.
## Release identity
- Version: `0.1.0-rc.1`
- Evidence commit: post-audit qualification on 2026-07-30 (see `release-evidence.json`)
- Database schema: nine forward migrations, `0000` through `0008`
- Runtime: Node.js 24, PostgreSQL 17.9, `linux/amd64`
- Validation deployment: private validation host (address intentionally redacted)
- Web image ID: `sha256:9679fab3cc033705f27a8f12eb92430f73f8b9f770cc309c8466f5a00e2e494f`
- Worker image ID: `sha256:982409b776484de5c14e1bbd206bf12f9379570b7f21562629d86ff42e38b63a`
## Verified capabilities
- 28/28 built-in packages import idempotently and the separate 72-entry roadmap
catalog validates.
- Library search, facets, sorting, URL state, favorites, collections and
lifecycle/quality presentation are implemented.
- Manual and Gitea-derived repository profiles retain immutable revisions,
protected paths, inert commands and historical run snapshots.
- Observe through Repair autonomy, live deterministic preview, provenance,
compatibility checks and blocking prompt lint are implemented.
- All 28 supplied minimal examples render byte-identically through the
production TypeScript composer.
- Plain prompt, Markdown, AGENTS recommendation and deterministic Run Pack ZIP
exports are persisted, authorized and re-importable without extraction.
- Local first-run ownership, password authentication, hashed/revocable sessions,
invitations, password reset and workspace authorization are enforced.
- Gitea is read-only and optional; retained local snapshots/profiles remain
usable during outage or after integration removal.
## Validation evidence
| Gate | Result | Evidence |
| --- | --- | --- |
| Clean installation | Pass | Isolated Compose project built from the documented path; setup `201`, repeat setup `409`, exact 28 built-ins, healthy after restart. |
| Migrations | Pass | Empty PostgreSQL 17.9 database applied all nine migrations; 36/36 integration tests passed and readiness remained `ready` after restart. |
| Built-in catalog | Pass | `scripts/validate_pack.py`: 28 P0, 6 normative examples, 72 roadmap entries, 9 schemas and valid API/spec contracts. |
| Core browser flows | Pass | Live library/composer/export/Gitea/Prompt Lab history plus M8 collection, operations and invitation flows; desktop and 390×844 checks; final fresh tab had no console warnings/errors. |
| Backup/restore | Pass | Strict-checksum backup `pre-m8-b2fb5a5`; isolated restore matched users, runs, artifacts, audits, migration count and all artifact SHA-256 values. |
| Security checks | Pass | 11/11 application security tests; dependency audit has no high/critical; Trivy web/worker 0 high/critical; Gitleaks 153 commits/0 leaks; licenses classified. |
| Performance targets | Pass | 10,000 versions, 30 iterations: search P95 241.913 ms (<500); detail P95 24.469 ms (<400). |
| Accessibility | Pass | Axe scanned Start, composer, Projects, My tasks, account and Management plus English/Dutch simple/expert matrices in desktop and narrow projects: 24/24 tests passed with no serious/critical findings. |
| Operations hardening | Pass | Unraid inspection proved read-only roots, all capabilities dropped, PID 256, 1 GiB memory and 64 MiB tmpfs for web/worker; status distinguishes observed evidence from unknown state. |
| Restart and restore | Pass | Restart retained 1 owner and 28 built-ins; isolated PostgreSQL restore matched 1 owner, 28 playbooks and 9 migrations before cleanup. |
The machine-readable requirement/gate matrix is `release-evidence.json`.
Supporting reports are under `evidence/` and milestone-by-milestone commands are
recorded in `CURRENT_STATE.md`.
## Deployment
From a release checkout, copy `.env.example` to a mode-`0600` environment file
and set independent random `POSTGRES_PASSWORD`, `SESSION_SECRET`,
`INTEGRATION_ENCRYPTION_KEY`, `BOOTSTRAP_TOKEN`, `PUBLIC_BASE_URL` and
`DEVRUNBOOK_PORT` values. Then run:
```sh
docker compose -p devrunbook-prod --env-file .env build
docker compose -p devrunbook-prod --env-file .env up -d
docker compose -p devrunbook-prod --env-file .env ps
curl --fail http://127.0.0.1:3000/health/live
curl --fail http://127.0.0.1:3000/health/ready
```
Complete `/setup` with the bootstrap token. Keep registration closed unless an
operator deliberately changes policy. Gitea configuration is optional.
For Unraid, set `UNRAID_APPDATA_ROOT`, create the restricted PostgreSQL,
artifact, content and backup paths described in `docs/operator-guide.md`, and
use:
```sh
export COMPOSE_FILE=docker-compose.yml:unraid/docker-compose.unraid.yml
docker compose -p devrunbook-prod --env-file .env build
docker compose -p devrunbook-prod --env-file .env up -d
```
## Upgrade
Create and copy a verified backup first. Run the read-only preflight:
```sh
docker compose -p devrunbook-prod --env-file .env run --rm migrate \
./packages/db/node_modules/.bin/tsx scripts/release/migration-preflight.mts
```
If the outcome is `ready`, stop web/worker, build the candidate, run the
one-shot migrate service and start web/worker. Down migrations are not provided;
rollback means restoring the pre-upgrade backup into an empty database and
starting the compatible retained image.
## Backup and restore
```sh
sh scripts/release/backup.sh \
--project devrunbook-prod \
--env-file "$(pwd)/.env" \
--output /absolute/new/backup/directory \
--application-version 0.1.0-rc.1 \
--application-commit "$(git rev-parse HEAD)"
sha256sum --check --strict /absolute/new/backup/directory/SHA256SUMS
```
Preserve every integration encryption key version separately in an operator
secret store. Restore only into a new `devrunbook-*-restore-*` project:
```sh
sh scripts/release/restore-empty-target.sh \
--project devrunbook-release-restore-001 \
--backup /absolute/backup/directory \
--env-file /absolute/restricted/restore.env
```
Verify readiness, authorization, counts and artifact/run digests before removing
the exact temporary restore resources.
## Known limitations
- Release qualification covers `linux/amd64`; no other architecture is claimed.
- Gitea is the only forge adapter and remains strictly read-only.
- There is no arbitrary repository command execution, Codex CLI bridge,
semantic/vector search or automatic evaluation runner in this MVP.
- Product telemetry is disabled. Operators use health endpoints, structured
logs, the operations console and audit events; no Prometheus endpoint ships.
- Docker/external logging owns operational-log rotation. Audit-event pruning is
manual to preserve append-only governance until a reviewed archival policy is
adopted.
- Development-only dependency findings, if any, remain outside the production
runtime; the final production audit is enforced at high severity.
## Operator actions
- Replace validation-only secrets and hostnames; never copy the validation env.
- Store encryption keys and database credentials outside ordinary backups.
- Configure reverse proxy TLS, Docker log rotation and off-host backup copies.
- Monitor Docker storage capacity and retain write headroom for PostgreSQL;
pruning unused build cache is safer than allowing the database volume to fill.
- Run artifact retention on the desired operator schedule.
- Review release evidence and limitations before creating a release tag; no tag
was created automatically.
IMPLEMENTATION_PLAN.md
+233
View File
@@ -0,0 +1,233 @@
# DevRunbook implementation plan
This is the authoritative build order. A later milestone may be explored for risk reduction, but it must not be declared complete before all earlier milestone gates pass.
## Milestone 0 — Baseline and repository contract
**Objective:** establish a reproducible repository and confirm the specification is internally valid.
Tasks:
- inventory existing files, tooling and branches;
- validate all JSON Schemas, example packages and 28 golden rendered prompts;
- select current stable dependency versions and record them;
- initialize the exact workspace and root command contract in `docs/40-bootstrap-repository-contract.md`;
- configure every required root command, formatting, lint, typecheck, tests and production build;
- add the root `.env.example` from `config/env.example`, typed configuration and secret-handling policy;
- integrate the preferred Better Auth implementation and implement first-run ownership plus application-owned authorization according to documents 26 and 31;
- create the initial database migration from `database/reference-schema.sql`, health endpoints and the first end-to-end vertical slice;
- configure CI with the same mandatory checks as local development.
Acceptance:
- fresh install succeeds from documented commands and the first vertical slice persists across restart;
- all baseline checks and reference fixture checks pass;
- `/health/live` and `/health/ready` have defined behavior;
- no application secret is committed;
- `CURRENT_STATE.md` contains the established baseline.
## Milestone 1 — Domain core and Playbook Package ingestion
**Objective:** implement the canonical content model before building the full UI.
Tasks:
- implement schema validation and semantic validation;
- import built-in playbooks from the content directory;
- store immutable playbook versions and searchable projections;
- expose list, detail and validation APIs;
- implement lifecycle states and compatibility metadata;
- add content digest and duplicate-version protection;
- import all 28 P0 packages from `content/playbooks/`;
- validate the 72-entry roadmap catalog separately and never expose backlog entries as executable playbooks.
Acceptance:
- valid packages import idempotently;
- invalid packages return actionable path-based errors;
- published versions cannot be changed in place;
- all 28 publishable P0 packages are indexed and cross-checked against the roadmap catalog;
- unit and integration tests cover versioning and invalid input.
## Milestone 2 — Library Explorer and playbook detail
**Objective:** deliver the first premium end-user experience.
Tasks:
- global shell, navigation, command palette and theme support;
- library search, faceted filtering, sorting and saved favorites;
- playbook cards and compact list view;
- playbook detail with purpose, use cases, exclusions, risks, inputs, validation and history;
- empty, loading, error and degraded states;
- responsive and keyboard-complete behavior.
Acceptance:
- search and filters are reflected in the URL;
- browser refresh preserves the view;
- no-results states explain how to recover;
- accessibility checks and representative keyboard flows pass;
- content remains readable at narrow and wide desktop sizes.
## Milestone 3 — Repository profiles
**Objective:** let users store reusable context without connecting a live repository.
Tasks:
- profile creation wizard and manual editing;
- stack, commands, protected paths, policies and validation commands;
- profile snapshots used by generated runs;
- JSON/YAML import and export;
- conflict and validation messaging;
- repository workspace overview.
Acceptance:
- editing a profile does not alter historical generated runs;
- invalid commands and paths are clearly identified;
- profile export round-trips without data loss;
- protected paths are visibly surfaced in the composer.
## Milestone 4 — Guided Composer and deterministic prompt engine
**Objective:** turn a playbook plus context into a verifiable task contract.
Tasks:
- multi-step composer with autosaved draft;
- input resolution, compatibility check and autonomy selection;
- deterministic prompt block assembly;
- untrusted-context boundaries and redaction;
- prompt linting with blocking errors and warnings;
- live preview, block outline and provenance inspector;
- immutable generated-run snapshot and digest.
Acceptance:
- the same normalized inputs produce byte-identical output;
- missing required inputs prevent generation;
- repository text cannot inject system-level instructions;
- every generated prompt contains mission, scope, constraints, workflow, validation, done-when and reporting sections unless the playbook type explicitly exempts one;
- linter findings link to the relevant composer control.
## Milestone 5 — Export and Run Packs
**Objective:** make generated output directly usable in Codex workflows.
Tasks:
- copy plain prompt;
- export rendered Markdown;
- generate Run Pack ZIP and manifest;
- optional AGENTS.md recommendation export;
- import and verify a previously generated Run Pack;
- safe filenames, path traversal protection and size limits;
- generation history and artifact download controls.
Acceptance:
- ZIPs contain only declared files;
- manifest digests verify after export and re-import;
- ZIP-slip and symlink tests pass;
- clipboard and download actions have clear success/error feedback;
- generated artifacts never include stored integration secrets.
## Milestone 6 — Gitea read-only integration
**Objective:** create repository-aware profiles without allowing code changes.
Tasks:
- Gitea connection setup with version/capability detection;
- encrypted token storage and connection test;
- repository discovery and selection;
- read-only metadata, file and governance inspection;
- snapshot import into repository profiles;
- health findings and recommended playbooks;
- rate-limit, permission and unavailable-state handling.
Acceptance:
- minimal read-only permissions are documented;
- no write endpoint is called;
- tokens are redacted from logs and UI responses;
- unsupported capabilities degrade individually;
- snapshots retain source evidence and collection timestamp.
## Milestone 7 — Prompt Lab and quality system
**Objective:** support professional authoring, review and evaluation.
Tasks:
- private playbook editor;
- schema-aware YAML and Markdown editing;
- lint, preview and test fixtures;
- version comparison and changelog;
- review status and quality matrix;
- evaluation-case storage and result display;
- import/export authoring workflow.
Acceptance:
- drafts cannot masquerade as validated content;
- changing a published playbook creates a new version;
- evaluation evidence is traceable to playbook version and fixture version;
- editor errors are line/field specific;
- a reviewer can reproduce the rendered prompt from stored inputs.
## Milestone 8 — Hardening, operations and release candidate
**Objective:** prove that the platform is operable and safe to self-host.
Tasks:
- threat-model review and security tests;
- structured logging, metrics and audit events;
- database migration and rollback rehearsal;
- backup and restore validation;
- clean-room Docker and Unraid deployment test;
- performance test using at least 10,000 indexed playbook versions;
- browser regression suite for critical flows;
- dependency, license and secret scans;
- operator documentation and release notes.
Acceptance:
- all items in `docs/19-acceptance-criteria.md` pass or have an explicit accepted exception;
- no critical/high unresolved security finding attributable to the product;
- clean deployment and restore are evidenced;
- production build and container health checks pass;
- final handoff accurately states limitations and future milestones.
## Post-audit milestones
The 2026-07-29 audit changes the immediate priority from feature expansion to
product simplification, automation and trustworthy release evidence. The full
roadmap, phase gates, metrics and audit mapping are normative in
`docs/51-post-audit-product-roadmap.md`.
Ordered delivery:
1. **Milestone 9 — Release-gate stabilization**
2. **Milestone 10 — Two-choice simple task flow**
3. **Milestone 11 — Scalable project selection and real identity**
4. **Milestone 12 — Plain-language navigation and localization**
5. **Milestone 13 — Continuous repository freshness**
6. **Milestone 14 — Accessibility and interaction regression**
7. **Milestone 15 — Human operations and deployment hardening**
8. **Milestone 16 — Post-audit release qualification**
Only after Milestone 16 may strategic expansion proceed:
- Milestone 17 — Codex-native exports;
- Milestone 18 — controlled local execution bridge;
- Milestone 19 — teams and governance;
- Milestone 20 — multi-forge and ecosystem;
- Milestone 21 — isolated evaluation runner.
Vector search, public marketplace behavior, unreviewed AI publication,
Kubernetes as a required target, arbitrary server-side execution, direct forge
writes, automatic merging and billing remain deferred.
LICENSE
+21
View File
@@ -0,0 +1,21 @@
MIT License
Copyright (c) 2026 DevRunbook contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
PACK_MANIFEST.sha256
+335
View File
@@ -0,0 +1,335 @@
493edf3c168aa0496cd1d47064ce1a849c0cc18ad74678fbb658d24ef4cfacc0 AGENTS.md
dc40bcfabcf8a38eae1a5abfff558c18443534604f8b9739fae3b47d3bf67568 BUILD_PACK.json
e77be051e41252148905cd5c3397ab739bfdb26d8bee954dc5c220ac48d762c7 CHANGELOG.md
73c53eb65109d3b49bf00cf47231fc87e1bcab42df583e50c73fe91b78fafb75 CODEX_EXECUTION_PROTOCOL.md
2a8e8ac0be23381257c53ab47b4059ba9bed8adb9200b55dcc9c3b86d1e8df36 CODEX_MASTER_PROMPT.md
0ded5168bf6b3b664756d05d7210272af4f28f422597a5519ad8793f13aa9896 CONTRIBUTING.md
5a76f343b4a4d85632e201c4cf294cdcc3abaf5663d12db04c6f42d62aff161c CURRENT_STATE.md
e72eb4b0e2c532acc8dd4cec2cf58cf0add5f1b461021d9fc7559518ecc8aef2 DECISIONS.md
0a60fdc763f33df8c066e69c9a4a024eb587f1528e8fefb530001fd759f34485 FILE_INDEX.txt
9558d8ce99733a55b7b4fb692d87da76d475d762079d014e6d77a21ae166291f IMPLEMENTATION_PLAN.md
638b400d8d3aed60e672875df8a4a2ed749203a7f1c3fc336a295da2824edebd LICENSE
ca5ad9d9127b9e1fec448fbed19a400c399463b952b6c03945e91746e355d672 PACK_REVIEW.md
ae64c8286705d9ca02b1c9e1ec83219ce6b33d61ff8ee23f8feecba1808d1aad README.md
33deeeca6bf8957a3a20778dc17fcaca130ee91718aa7fe4869b2e89dbc61cfa SECURITY.md
a40b0c5b5560eca6248ee900f7e004cfd5f1849ab8659fc5ca8d8acbf6c43f89 START_HERE_CODEX.md
56d37c6cfe1c24eb4050bdac449821bedf9d13263948e1f833b5b0e0bf787114 adr/ADR-001-git-first-content.md
f9ab72425ec1dd03053420e99095dd658719600267a353e4de7841e1bbf85259 adr/ADR-002-modular-monolith.md
843800428943b1e274abd4ffc614f8f46f31060d6e1b2b2e62f764e762333619 adr/ADR-003-no-direct-code-execution-mvp.md
00cbaf689f1f96ef99069176ffbf955af3ecfaff9e9b896606bef4370122f6ef adr/ADR-004-postgres-search-first.md
5ce4e17096792a3e877b2e47332bdea7abdc1433bfc37a274775ac8a8344227c adr/ADR-005-integration-secrets.md
843bfb9f84212416abb9ade910970bc750dcc95c104361d610bef63f4f433f4c api/openapi.yaml
11139a33645394ce49ba2e097d8b18e8a6749b9031127b40b6ce4a0e9e9d33f2 catalog/seed-catalog.yaml
2079825ec304ef9029619d3f7e15eba63a717afaac6c054a569065f953090f9c config/env.example
975865d89b79dd4a195a27ee9f9266d391193b5ba8ff8913a3f4e791ceeca5f1 content/playbooks/accessibility-audit/CHANGELOG.md
f973d1c2f6e58ef90594df79c31518d5577a719c4b121680bb50cc0d763c7abd content/playbooks/accessibility-audit/README.md
8aa0890772686af8c44965403d217ddaa833267c326fc6322e30fce92d5ecfe6 content/playbooks/accessibility-audit/evaluations/static-structure.yaml
797b242ad8abb2ff4c1291f0f1c5cf9ad30c30f641a56d30e252be5797697bc3 content/playbooks/accessibility-audit/examples/minimal.yaml
4250f76d7f59c5fb9336b1ae1727e40d61e8abe21089fa2642fd8316226652c5 content/playbooks/accessibility-audit/playbook.yaml
15cc5449e2672dac6b254c5d39c9efa9772520c9e699efada99f5a609a7a3352 content/playbooks/accessibility-audit/prompt.md
40a4c9a3d0af5122b177dc91ddf6bed8b1c4be9d9cf41a3ab7423655bdd276e4 content/playbooks/agents-instructions/CHANGELOG.md
84f852fca5a1f2cb8c544baf0d999cb45d201115f85f80b7f4b417df54a5c4e2 content/playbooks/agents-instructions/README.md
f09e96a8b372376d0c335327cd1ecb7286be389a032d45237b80926c3dd93433 content/playbooks/agents-instructions/evaluations/static-structure.yaml
80043e7c16d50109036ecf64e809f2229ecb173fa67e4a2f6f3b3b6b80856eb2 content/playbooks/agents-instructions/examples/minimal.yaml
68a5929751f9844820ed5f22d25b15490ce967d6a69c6512ec5f98cf035df8a6 content/playbooks/agents-instructions/playbook.yaml
1b472e7476978ed28c83ddfaff56da2933e784916b2b79cecbbd14f65c8c33a7 content/playbooks/agents-instructions/prompt.md
e41bfca47480d53f3955ba94be265b2fb1de4d6c437cb1bf5af80b872538a2c3 content/playbooks/api-endpoint/CHANGELOG.md
c57c4982508a6d2560dd899fc8375165d88e2cd5cccff981645c5e077ae8685e content/playbooks/api-endpoint/README.md
a907160a2e7def412a925e76120357f9c720565be6af0e86c7d68ef8238d1255 content/playbooks/api-endpoint/evaluations/static-structure.yaml
767c385c1400afdbaf0832781d2a6f6d990a73e65dc9d8bdefc01721bcddd999 content/playbooks/api-endpoint/examples/minimal.yaml
179263041cb89757f83ef1de40fcc60b6895d95bb19854e861ae496c9c8109e8 content/playbooks/api-endpoint/playbook.yaml
10f68d4f2e452da5213ea8b9473208473e60bde272e3d3875c4c302d980be08e content/playbooks/api-endpoint/prompt.md
d79f15b3867e575fbbf1fd0e92fc7bd665ea1e63f419afdf802a2f80b339b11b content/playbooks/backup-restore-validation/CHANGELOG.md
cd66f5e4bfef8b55bd40fbf0fd784956dd080e978879319eba6d6801aa06f25b content/playbooks/backup-restore-validation/README.md
9323d73ff065473b08cec83d348f1c4a0d67eaf844e69ec13bc2907395c61bd3 content/playbooks/backup-restore-validation/evaluations/static-structure.yaml
4a4502de854cc04aaf14c3b3255af64bc69057f4c7e8c4c84b317f8141508d1c content/playbooks/backup-restore-validation/examples/minimal.yaml
13dd879284b3addc4051655ad4dcf646411b78091270a43606e42251840c804b content/playbooks/backup-restore-validation/playbook.yaml
6a294ef7e731c71e7a24b2c7adac015a1d32016eff93ea71bc7170fdda94ef04 content/playbooks/backup-restore-validation/prompt.md
b1d67df1cd8464a2d1d406fff7b50a7be881634b8fe5898e437c8ac26f6325ce content/playbooks/branch-protection-plan/CHANGELOG.md
f3ad075cb07442d81642d83a2c26f900d084d4dcbae42858dba3c7949a886406 content/playbooks/branch-protection-plan/README.md
0e575076087e4ead1cef31bb4c43e7955c554d78566deab93896677386b03c29 content/playbooks/branch-protection-plan/evaluations/static-structure.yaml
13f44b61206f7beb3e01e032b0209850facdfe14b3b1270389c6ad4589055b07 content/playbooks/branch-protection-plan/examples/minimal.yaml
1bb41b41a5307cc84c5d38b28594fd7983a0cdbecb8942a04b84da268122a244 content/playbooks/branch-protection-plan/playbook.yaml
59072a197a33cc0bb92ecb2238eb2c7bd26dbdc57c0d4fab03c37ea737078a11 content/playbooks/branch-protection-plan/prompt.md
3210a0b8c8c0f3f8e5247923fdd5dba6bb738e96d2f65753252448187630d110 content/playbooks/build-failure-recovery/CHANGELOG.md
4910334b8aa4b484871559b7efc599df806216d0f2a9fabb05d652249320c5f6 content/playbooks/build-failure-recovery/README.md
42937fda145438840df904a29c6ebe1ecb8bd80f833e08e9c374c859a4bdfab0 content/playbooks/build-failure-recovery/evaluations/static-structure.yaml
e55abe0b56e988a32f8109f7f1e5c4c418638dab710a9045cc34d8d55626e44c content/playbooks/build-failure-recovery/examples/minimal.yaml
6e7abf5788415e0a462d03ac26ddf720f41ee1ac1f21d26208a7295edfc72ddc content/playbooks/build-failure-recovery/playbook.yaml
4d84a5e382da044236ddac742a76bc02bdbd437f8d3231d60344cde1103f5654 content/playbooks/build-failure-recovery/prompt.md
91eb38aa86224d9f9bc517af38356f45e2ac3965df83bb8839ae716af68770fd content/playbooks/clean-room-validation/CHANGELOG.md
539009933530041d8b745c47fa53823620fcc8b10112c1041973f02cb204789f content/playbooks/clean-room-validation/README.md
2290bbd1621a2f84f565a437d90503f41f281f0d1eb57cff8f2a2a442e9ee7b4 content/playbooks/clean-room-validation/evaluations/static-structure.yaml
ca96cfeb905a70fcf75073d2b81da75425322c459ef2ef07ab1c04609f92ccae content/playbooks/clean-room-validation/examples/minimal.yaml
3f5c25489b4a3ea5860db257f9372afa03ae103f9841d4638fa05ff09d9db283 content/playbooks/clean-room-validation/playbook.yaml
649f7ea4190d742bb254e9dc9f48f25fd71b0415679f2115286a170e898fa8a2 content/playbooks/clean-room-validation/prompt.md
9ce761bc1d5c5514706bc1ef07ace8aad69980997cfb696716c9a7d6c9ff99d5 content/playbooks/docker-self-hosting-audit/CHANGELOG.md
376c39c5f27839181a4eaa6a57217ec1f02740168c7c11c3b4131eebcc5abe42 content/playbooks/docker-self-hosting-audit/README.md
aed59214d75887cf8b3875fd9ee78b1ffb38b85e981dbf8aff53160325d82fd6 content/playbooks/docker-self-hosting-audit/evaluations/static-structure.yaml
e2649b825cc48f9e6a2bd1b205e0926bdb261450e91bb71f12001036053d7aae content/playbooks/docker-self-hosting-audit/examples/minimal.yaml
30d49bdb7b6bdadc8142272c3fc4427cf65daa69839c2ed58eac82005f008523 content/playbooks/docker-self-hosting-audit/playbook.yaml
99a19c81800bfc6850490af02553554401e6b16e87643f810ae96368559745e2 content/playbooks/docker-self-hosting-audit/prompt.md
7c017b273cea4b740b4ee60e3a4aa381d2cdc0293a4cedb172b3809285e20bc0 content/playbooks/error-handling-hardening/CHANGELOG.md
7db271ea43417b66de4d300eff4af7ee50d42555ae1f842f5ef6676cb7ecbab5 content/playbooks/error-handling-hardening/README.md
6b17eb38fb2944167636954c7cfb5580978f078eaff709d326cd7a5d13c48678 content/playbooks/error-handling-hardening/evaluations/static-structure.yaml
8a6efa5438bca29064fdfd0d6ee65652d5c62c25ee149aa017f41ea0db461466 content/playbooks/error-handling-hardening/examples/minimal.yaml
d44cbcba0c1fe843d6c8457ee820e31593571ad9f30e10de2f391e6f1f11fa2b content/playbooks/error-handling-hardening/playbook.yaml
05e952b94bd402ed54f9bf1b5579c351f81ec3e797b318f5a7a9c8b1eb257015 content/playbooks/error-handling-hardening/prompt.md
bca353e4bc64e8fd06a26fa13a579727cb26a97ad5c64b6ff8266ca929c43f69 content/playbooks/feature-from-spec/CHANGELOG.md
ea4b3c0cbabc55f3d9403c2a936351ac72282943adaa65534d1ca5d7dbf919f4 content/playbooks/feature-from-spec/README.md
1293ce62bc366c9c3b6171ca4023ac800da9700729f60e628a357f3638892358 content/playbooks/feature-from-spec/evaluations/static-structure.yaml
1563b746576d6daa2c1e590a0f16164e737e950cd3477e34e777070c199c89a2 content/playbooks/feature-from-spec/examples/minimal.yaml
ae8dd8bed151da1d44c05872f02031c4ffe18e6270bf7c3014de066bf304a358 content/playbooks/feature-from-spec/playbook.yaml
586492ed58d312300935c8b69fc54b397328fd53e3f48a4a30abfaf1758c4d48 content/playbooks/feature-from-spec/prompt.md
98390e1e8ed66f5e18f34c28b45552d4ff89ba3c923e9015a14f99f44326a75f content/playbooks/frontend-ux-audit/CHANGELOG.md
6601cd94a83e9b392249c61590856ec7865aeb4511a425729eb21d839157f61b content/playbooks/frontend-ux-audit/README.md
4e124a1fe2bec5b8ed42178e183fb60bd2c5e2dd6c9a8af2ea414adc93319a00 content/playbooks/frontend-ux-audit/evaluations/static-structure.yaml
38b626926da7cb2d4718d42aceaf0cef97318d6d803b727753f664196ab69026 content/playbooks/frontend-ux-audit/examples/minimal.yaml
2943ffb46d2fffed188c876e46e77acd8412f43eef1e395ef01977ef822660d6 content/playbooks/frontend-ux-audit/playbook.yaml
37e8d1adb19232abddccdd1a9b58b7a64d9d08caa050bbd758e588d663c1db9c content/playbooks/frontend-ux-audit/prompt.md
45b81d3e69ca9db53dfbc5e06bce292535c01d17ce78399b0f07a299cd911e6b content/playbooks/gitea-best-practices/CHANGELOG.md
26fb7ed0cd0163cf8ff3df2a61bc6cc446e5bfc6fa6e2d083c35880762e67d8e content/playbooks/gitea-best-practices/README.md
5cc48919e2a5ea3db4530e29bcf2a1c4d665d8cb2aaeb823c8d6071bfa4fa44d content/playbooks/gitea-best-practices/evaluations/static-structure.yaml
a7a186098bf686bb0a63f273a4338ec6c642a98ba5c7becfe5dd742d62b7fe15 content/playbooks/gitea-best-practices/examples/minimal.yaml
5d3c65df56fd5ab3075943c81e0e0c41d832440fcd13ce048e3fb960cae59d39 content/playbooks/gitea-best-practices/playbook.yaml
726586e9b97ca847832369a0d87c5c78fb65cf388d9fdc9d76b6c5b18452d13e content/playbooks/gitea-best-practices/prompt.md
e0c41cfa8aa4a1657d11df8c17ec20e37902be34c378b4c0a42124a9cbd9c909 content/playbooks/gitignore-hygiene/CHANGELOG.md
558a3d7ae2df0c04b9a8b51bc258acf04ca20d3b65e2de28fb20badf28e22ae2 content/playbooks/gitignore-hygiene/README.md
8d6aa29e4d2e4f8ac545238563c06873119576f7af9e9c568236917710aa9122 content/playbooks/gitignore-hygiene/evaluations/static-structure.yaml
2109d50c3391fb03461aedd2029beb8c0a747b7c6f66dbae3f5a3b60617946a6 content/playbooks/gitignore-hygiene/examples/minimal.yaml
44e339fbb2ebf3a25c972a75f2d19f245dd63382527283e8cd6b3936f9bf3707 content/playbooks/gitignore-hygiene/playbook.yaml
e90972975d1f1b3cac98f7f9f3f96659e78c61c76de32ba935ec73074930f6a5 content/playbooks/gitignore-hygiene/prompt.md
65e3269928d3ebefc573b791370f073deb2e9a8ae3913b60ab2ca0d72b6c25b0 content/playbooks/health-readiness/CHANGELOG.md
5f291141f9d07191aace10544810f3a74328897ed2a1c9e3a1ab81d05c70e460 content/playbooks/health-readiness/README.md
54a00a3ecec55415ccff0ab20094c318504ca18b071ae7270f1f232ac549aacb content/playbooks/health-readiness/evaluations/static-structure.yaml
4e61ffe65aec2be6f82638bc4d79a37621e08b86c59900f0b0c3bfbed74e0372 content/playbooks/health-readiness/examples/minimal.yaml
c13e1ec5d1a9031ece4db30af25a4ffca7b97edd322f146183a7f50c032990cc content/playbooks/health-readiness/playbook.yaml
da979beb8b120970981c5a73ea7c928912b38ec0e501a883e10e2a0697f6fff0 content/playbooks/health-readiness/prompt.md
2589eb731af5310f5a3a452cb5e1fbf6e011acd67a8bafa5e274525d1f9f16bc content/playbooks/onboarding-documentation/CHANGELOG.md
40dea3a6c85666512834396d5e0c088bdc82f0f7c42f09f9e88c84198ba625cc content/playbooks/onboarding-documentation/README.md
c6777eadcd421c7830a6eb335cd783bef17d95b71e2906da85a5298bc591cb24 content/playbooks/onboarding-documentation/evaluations/static-structure.yaml
c61811edca859363598ff093a9398dc4b47842928829c9281d927771805a9ed2 content/playbooks/onboarding-documentation/examples/minimal.yaml
219d70de735998986bf753b7126772b167a43c47a067a25565a15e6ece097202 content/playbooks/onboarding-documentation/playbook.yaml
f3ec8b531d9dbbd1abd811036d9f5c1016a91a00d10bbf49fb8bcb89a37594ad content/playbooks/onboarding-documentation/prompt.md
b947a73ebc2cc6e974e9643ee2f03cfc23faa5351ddf0c97ee8ad195f9b517ac content/playbooks/playwright-critical-flows/CHANGELOG.md
2e3e95d7c6a5fe7682726f99a4f1bf38f9511da6d14ada600730efc144b49a81 content/playbooks/playwright-critical-flows/README.md
1ca0582a414b9be56cfa0131cafecd424451e058e00d8c4958f42ad45c0a0e0d content/playbooks/playwright-critical-flows/evaluations/static-structure.yaml
1f21207eac6571db752f21384c722131e5373000768cbe682bd2ebd5a65c44fd content/playbooks/playwright-critical-flows/examples/minimal.yaml
eec1bcdafb3fd9b3be1aea20fa4e1d9da7535c77a3883dc72cbd8cbc3f7d13e9 content/playbooks/playwright-critical-flows/playbook.yaml
503cd4f449984618c5cb14a63848181f9609a6b0b6500bbaf75be6acf4d89d2e content/playbooks/playwright-critical-flows/prompt.md
7a99b224b97327e81b9d744ce905509d03b5b848775478722cf07fbed719948d content/playbooks/production-readiness-audit/CHANGELOG.md
ab91202ad68982129950d84f153fcfc6c25a9c4b674b477d4baf94e27ac43c11 content/playbooks/production-readiness-audit/README.md
5d07a12369f2548d96c2fd59927a3c563ad3eaf265b040b93e96beacd1600fb9 content/playbooks/production-readiness-audit/evaluations/static-structure.yaml
a5a349cb57320946c441a8979ccaa6c338261ee0f3b096e14ae2dcedf9a626e1 content/playbooks/production-readiness-audit/examples/minimal.yaml
d293b892dcc2df2ceb2452be31da5dfd068ab5c83910d6dd0a064cab3752316b content/playbooks/production-readiness-audit/playbook.yaml
0be5e6483912274acd1a20987dc29e8bf50e9536b0aca8fe8498e3172f860f19 content/playbooks/production-readiness-audit/prompt.md
2e5ba4aaebda9d2a8eb66fbe4f67a6b7f53206cda5717259a1bd70dca61665aa content/playbooks/pull-request-template/CHANGELOG.md
692a2390389bb778f286b72d3cca982fb4d29e4b8c5a94c82a2507d7b12bf962 content/playbooks/pull-request-template/README.md
75eba7c5740cab1465999e87b33610b00bc90f3a5d56ae9545dde538c76846de content/playbooks/pull-request-template/evaluations/static-structure.yaml
8de6c685f9e326b4f316f9432fd6b8d5ae84aaba0369f62fe08d71d2f0146f11 content/playbooks/pull-request-template/examples/minimal.yaml
48902a29c2960809dfdd4eaf44ca352862f069be1458fd01cce3d955f1d963f5 content/playbooks/pull-request-template/playbook.yaml
98e57abdd81499b93c2a53e1edd33e0be9b0ebb2c00dbe4d44141098287935f3 content/playbooks/pull-request-template/prompt.md
f2940dbf00b396f962540f959bfd1942cac275476de963cf726fa13f033f2912 content/playbooks/release-candidate-prep/CHANGELOG.md
1b904e1089c8ba86a68fe625be048a746121f065546a9e00237b1517fc6ecce4 content/playbooks/release-candidate-prep/README.md
4a230dce2904c5f538c2b647693bcde89fe68d6f3878b167074b1ae326dbbbab content/playbooks/release-candidate-prep/evaluations/static-structure.yaml
ba90eb090fac7bdcad611250640910f5efd8c4c2ebe595a821333883ede72791 content/playbooks/release-candidate-prep/examples/minimal.yaml
bb607a7055a2c0c06d6c5ae6019b6675d0e8697ad078ada1c32ad8fe3b50375a content/playbooks/release-candidate-prep/playbook.yaml
485b444233d602b0bdb47a8af9f80b8fe1d93b31b7fd312b2dfe6cacb6803570 content/playbooks/release-candidate-prep/prompt.md
840fa67f9ef00bb5fe517c9ed373e93177b20b65c26d2cf69dad3e2e4141829f content/playbooks/release-notes/CHANGELOG.md
1d0adcb87b5a1e639bb7e6028e7b959c41ab0e263447aa50a406a9904387d02d content/playbooks/release-notes/README.md
5d12b529551bcb4a5a43586703627022457b4f9269538d31e9f20d3eefb023f1 content/playbooks/release-notes/evaluations/static-structure.yaml
4ce1d57d8a5b1ddb81d4f5fd7382b06cb20c3134dd21f0cca349a29e927d888e content/playbooks/release-notes/examples/minimal.yaml
813b2ea41ef5c234fc626192ab69af40fc7dfd9e26166efff8d7d2ade518de3a content/playbooks/release-notes/playbook.yaml
02c181b1a09ca26556feac99fea63d63f79534762cd930addba8037394606485 content/playbooks/release-notes/prompt.md
d5b5625c2d3891657a150ef1982f66a8a4140ddbd163296ac4b99e800a128798 content/playbooks/repository-cleanup/CHANGELOG.md
57d3edd75ebf587e62296026cfdb161768df725c700e845c637bad6d5e3a4ee2 content/playbooks/repository-cleanup/README.md
15e16455aa4d7744106e0b36bb2a7f3fc8ddea787322bcdfd3ee377fd815a996 content/playbooks/repository-cleanup/evaluations/static-structure.yaml
95405ea1ac358928bad4e3df4021a9f8fd1ee6150de80164b14e749dd950c00b content/playbooks/repository-cleanup/examples/minimal.yaml
be42ffe575a099d862540ed1c73a5a2ac6e39698da1fe52354e94dde28d9ceeb content/playbooks/repository-cleanup/playbook.yaml
23cf4ac0a7a22186377775314082bccae43f8d4193214ef1a5594823fcf0422b content/playbooks/repository-cleanup/prompt.md
fb347cad1f762dee0db158252fe7e271ddd798d28c3c6e04e3e35fe6da4e6337 content/playbooks/repository-health-audit/CHANGELOG.md
c7d2c13128574e3d4b57375b9b101c028c07acc529eeb308725dd395be9b25b4 content/playbooks/repository-health-audit/README.md
ab89bb879b58d86c578b10018342f531b1613f55c38ef613f1df8fac84f56608 content/playbooks/repository-health-audit/evaluations/static-structure.yaml
4e48fa5a8934df8c57fe98b9d4261717864c13d83520e52a18b28448ba84ba1d content/playbooks/repository-health-audit/examples/minimal.yaml
8a720ea500815cc44fa53a6e0d1228bcd5184699d8797ea79e3445f43cb3692f content/playbooks/repository-health-audit/playbook.yaml
920b5aa3d95860b65deefda17c2d602cd9d01a49c89ebf7ee1acaf00098303ae content/playbooks/repository-health-audit/prompt.md
153c9ee59c3223474a19b7187c855793d86b857aa08ac4bb5f73a458bc85b9dd content/playbooks/repository-inventory/CHANGELOG.md
9da7e28ef913372e9bf093b42d5d71de473667a0264b3127c953565e2eac58b1 content/playbooks/repository-inventory/README.md
84b55f5887e4b29e6ce711c7030658231127ee4cf16ef8ac150129569f25d49f content/playbooks/repository-inventory/evaluations/static-structure.yaml
576e2d4623a2980e69f6b4d8b1c6d55ee2f28777ef2099873d9dbeccff1c85c9 content/playbooks/repository-inventory/examples/minimal.yaml
d9cb2b8ef09a8c7bfdcea6321dc895b7e56ad63a650bb16c3877816a3fbd4ecf content/playbooks/repository-inventory/playbook.yaml
aadac1a79f4e3e30766fdceb0bb149664c72592cdb754edbb53d35f835037057 content/playbooks/repository-inventory/prompt.md
19bf1e956e309c3fd038e402149fed0d8d838e62e590cd004078a61e2f93ecb8 content/playbooks/root-cause-bugfix/CHANGELOG.md
990d07ff2b3c55efc4e416f5456c0e06f45121e14a9a0a22ad63ba25f12dfce4 content/playbooks/root-cause-bugfix/README.md
d3a17c6a66cb374df67270732c069769b3de5e3737e62e8800e2dbfa1d5b689c content/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
8567a52f921bde36d44ece4bb06cb9723536d6ad7d7d743814449f370bcfb259 content/playbooks/root-cause-bugfix/examples/minimal.yaml
d43c41306dc212d28a6f840c6e343be98a2eba64976b0ddfee5203388444ef71 content/playbooks/root-cause-bugfix/playbook.yaml
feda9c611a9c9b2ab6f7d723e3ea7d994777737a8b28e94ee9bd19ff60fac1fc content/playbooks/root-cause-bugfix/prompt.md
934ceb4bc49eb3bf3d56b5f6e5378496db5bc37856cd10f332f85e5df7be599f content/playbooks/search-filter/CHANGELOG.md
30522d97a56a49376c0712ca527818db5c6ecf5aeb898775c9de604ad8460c09 content/playbooks/search-filter/README.md
e0a3c09ae0abdccdc2853748051b7c1ee04c5f01828de5bfbfdceb73f0398626 content/playbooks/search-filter/evaluations/static-structure.yaml
3a910a2f0d27781b18f1252cd734d2f83e7339b09f3c48b66cdcc42b591eaac5 content/playbooks/search-filter/examples/minimal.yaml
edbc835c72e5f222c3407b5bf8d963c5a7ff3875953febfbddcfd0f6f3810d87 content/playbooks/search-filter/playbook.yaml
d36c24154563372a44c8b16d02e917853a247b1f6e1dcc600e4260141ff66ec0 content/playbooks/search-filter/prompt.md
08245f43d7d518b0140f288777df9dbb56b12fc4716124379dc19b2efc38fe29 content/playbooks/secrets-exposure-audit/CHANGELOG.md
3b2691ffdcf6da6f425b7a883b741b6ea0f6eb0cfb0be38fc490e57a982762ce content/playbooks/secrets-exposure-audit/README.md
afc4dd220dd347864983bdb4765e9970598badabe511b243f52eee5e4062f548 content/playbooks/secrets-exposure-audit/evaluations/static-structure.yaml
f7eed2e2602955de63285ae26eacf0abfa9d23289d09ee2ffed54096f92f851a content/playbooks/secrets-exposure-audit/examples/minimal.yaml
c7f405e68035d71b9f6b3815eb1467ab98762764b6d6c9925aedd73cf3c1da27 content/playbooks/secrets-exposure-audit/playbook.yaml
0bbf04bd1710634162186d9ff5875a6d24bb405425a842b08e295b2a854caf29 content/playbooks/secrets-exposure-audit/prompt.md
a4cc94f683a862d3837c4e2e9ff944090b88d909767ea4a783f0ca537470cdb0 content/playbooks/security-hygiene-audit/CHANGELOG.md
cd8a4c4c7375753c0ae8ebfd076ce3dad739b87fa6e9bda580acc607e4657c93 content/playbooks/security-hygiene-audit/README.md
1ff8589b5f6cd00bd4ef199605b7cb54f0810f3e5ca5eb0e3aa95c615263570e content/playbooks/security-hygiene-audit/evaluations/static-structure.yaml
8b3894d79308f6c5e66029f3a55bc027aa580947b4f23954b64a8615b62a1440 content/playbooks/security-hygiene-audit/examples/minimal.yaml
97f0124911ffebbcdec6d0f0e584e8e406099ec36352564afa05e10a4e7db835 content/playbooks/security-hygiene-audit/playbook.yaml
56d8ee3432eeb4f58142cca36bbbec9039a3e5c20e3377e9c2b26631aad92dd5 content/playbooks/security-hygiene-audit/prompt.md
efdb748cdc30e98e47f4ca1f3f19816c5975bd48b0a33348a3fa7746da30dc33 content/playbooks/unit-test-foundation/CHANGELOG.md
4ab31a04c44b547b8b40a683373eaedc6c336b491a241d551062e25439805b8a content/playbooks/unit-test-foundation/README.md
80ddaada53d9039ccdb256461555cbd641669370a031f00c1eed1912647a37a7 content/playbooks/unit-test-foundation/evaluations/static-structure.yaml
318b024a991c5505bd8fca08ae736aa93bc21a52c11210f43f7150caa7ab1417 content/playbooks/unit-test-foundation/examples/minimal.yaml
15c4dec5d6994e331a228f6ba58f4f09b3e5f455e8e9fd0c5daa86165537321c content/playbooks/unit-test-foundation/playbook.yaml
23ba52a07f7dbc4efe33e478e6ac5b6b3e9a2025ff2681793ec0908b06f031b1 content/playbooks/unit-test-foundation/prompt.md
3e9eafcc3bc29bb0d93fe9b70a8c00db90b9d62a0ba13289518c7bb446e52cb5 database/reference-schema.sql
aa5130a03883f6ac0aaa7fc5e90d32da393fb1cab36dd542ebdf8da9ef9821d1 docs/00-product-vision.md
efc3494a276ae77b1f310deb868bf8d76f8e3719ae643db50977de1b94a281cd docs/01-product-requirements.md
4b516410dba19b75149b040643a1d4e148b90ce163baa8a9f717a99c10145ccf docs/02-personas-and-jobs.md
40c7371e4409c93ca9258c517b3f39cd51dcdce42180e11a0a7fe5f7341e15c7 docs/03-information-architecture.md
476511119d0fa02b57f2253be36320be9d9c56afdfa84a445a206ecd6868c8b5 docs/04-ux-design-system.md
d4467fecae1d0d542434474a7d8210a15b1786081c602a0c7d9348bad3afbf6d docs/05-domain-model.md
e0db9dbf952e0036c5b9528c0eaa25e103b47d87ab8c587beb538071c3e7c98e docs/06-technical-architecture.md
bb863be3c90b008c7cc8b7642dfae5236adbf275911b4a06f9a20cf9ee6bbe75 docs/07-playbook-package-spec.md
dc2e44ce665aa2b1fc0c99d7e3a8465e4842634accec1f39f28da9679cbdb280 docs/08-prompt-composition-engine.md
abb9606a287ab24177da20d8bdd43750a8e3e6577442c5d25c3d042fc60abae2 docs/09-repository-intelligence.md
18b2fd2720f968eb7c976d1aa7bc20c20d6d70db297488a8b719dffadaefd882 docs/10-gitea-integration.md
917f04c8969a90c6b3f8d41b6f2dd3da9d6599a0f7f041fac8e6915baf11a2d0 docs/11-codex-integration.md
692c0bffe5a69bdc98c2c94f4c40c2771e76ba194fd946f2d667a13f880eed1e docs/12-quality-evaluation.md
7621121ec81fb2bdbd5a63ed105b4692cdfcaa978c3aa969553c3a7138f9b296 docs/13-security-privacy-threat-model.md
4e77408672c8608984ca07bb5bf0adfcafa69b4ac73fead7d9b61b8fca2bebba docs/14-api-contract.md
2c3426ff12550b3ee21cf0b30b1d8b7ff95c476289a1c8e2ce2a9fdb6fb87549 docs/15-test-strategy.md
b1761ca374ac490e61c319afbb9f6b4645ca5c625a06fe5740b40c9867cbfd56 docs/16-deployment-unraid.md
f0de3e01c9aa203551efd2b2acb620ba79d71eb0f4f9eb5e87e4cc4e5f236614 docs/17-observability-operations.md
8282011bc82e60ee207109a1edc26cf4fd1bece19310e2721afae9a80fc21708 docs/18-roadmap.md
b670fc9d8056590165c70edda4956e7a9f61dac318ee0ac59a6ac87e4c233e04 docs/19-acceptance-criteria.md
034aed6fb1ee5a77706c76dcd13cef34f80e6f17fda5a1546f67143a16b7b80a docs/20-content-governance.md
c30a1516c24e586fe3b81109763d71b5dbc983e1659b5089420b9730597d7ab0 docs/21-seed-catalog.md
f5f9c823ef36db7002bf57b756a8ee30c2d3ea46e55f47821b932f3a200fd939 docs/22-brand-copy.md
48c025e2de2d1eef8985a4b748c82693ae5f820418b0ec45797fc5a6159d6d2b docs/23-future-expansion.md
04132b1263cad4f31785c0d97817535329d316091c0072d5aba5b32f3c5ead4b docs/24-sources.md
fec401890a83127bc5c23a18cc5f033dc98c35fc32b27c7dae91988576b9bb93 docs/25-implementation-defaults.md
e1ac0d80c5e0633c2996adf48ad5a2a1e47ca6422be8e1a8c8fb9147b238fcb5 docs/26-authentication-authorization.md
5b0af5318e5ee7bc8515bd38cf0e50408f06f10d86f472662383d285f4fbe443 docs/27-database-reference.md
2d993a6ea93a7a0adaea4532c28c25b546e3ab10f59503bb37a5eb248cec0627 docs/28-conditions-and-policy-dsl.md
0049efc06a7f1b40ec08bf2e3b6b1cd583e787fa4e35132e1eadf325740f2348 docs/29-package-integrity-canonicalization.md
e8394c05d3d9d5ccf24818714d7670122015ab3f1587d65c63e644985b320b8d docs/30-screen-state-specification.md
b8bad7a0f8ac49eb074fe61b364f77258574f54afe3d56f037018591af124a1c docs/31-first-run-and-instance-lifecycle.md
3f25d477bd2638b3e7730798d4401bf1f38e3009f5ca2c2bdc34b848f7c505c6 docs/32-configuration-reference.md
7930ac7ab6aa3f97cdd16ed0d2b8551b9b2937d7dab8e93c160b617f459fba5d docs/33-requirements-traceability.md
5641ec12d544bb237278fec9c048cfece45c2168f9d0519af54ca06b73cc2b6b docs/34-risk-register.md
f0a6ef787200d57223bdb94caab4bca8001633120a3ad3533765c3178c821055 docs/35-glossary.md
8bfeb094657258f04b19c423e02dbe245162c81a4314593075a6f543e3d499d2 docs/36-seed-content-delivery.md
aae9b4b23296721090b07544c647f6555ff2cfddc886c03dc86f8d8e99b3af1c docs/37-build-pack-tooling.md
5c966baf855022827a224384e2b43f2d9a42511d5374c00940b6464d3fc095bc docs/38-codex-native-build-workflow.md
e3457a941cbbd243e78ce5305a5104586f048f301d4b170c2bcf6d48ce3630a0 docs/39-reference-composer-and-golden-fixtures.md
27a1321af0dd5acb3c14b72c599fc9e3808acd0d67daf2c182133a0e7c3e2782 docs/40-bootstrap-repository-contract.md
616c3c278e7f22ca27719c45a5a89f6d5dbfd7121c6eb6c389c77af2fce00c2c docs/41-release-evidence-contract.md
df6b5f088d9fbb5ee55985c1d78ffafd3db23377069b624ad59b8173206aefef examples/instance-config/example-config.yaml
bca353e4bc64e8fd06a26fa13a579727cb26a97ad5c64b6ff8266ca929c43f69 examples/playbooks/feature-from-spec/CHANGELOG.md
ea4b3c0cbabc55f3d9403c2a936351ac72282943adaa65534d1ca5d7dbf919f4 examples/playbooks/feature-from-spec/README.md
1293ce62bc366c9c3b6171ca4023ac800da9700729f60e628a357f3638892358 examples/playbooks/feature-from-spec/evaluations/static-structure.yaml
1563b746576d6daa2c1e590a0f16164e737e950cd3477e34e777070c199c89a2 examples/playbooks/feature-from-spec/examples/minimal.yaml
ae8dd8bed151da1d44c05872f02031c4ffe18e6270bf7c3014de066bf304a358 examples/playbooks/feature-from-spec/playbook.yaml
586492ed58d312300935c8b69fc54b397328fd53e3f48a4a30abfaf1758c4d48 examples/playbooks/feature-from-spec/prompt.md
45b81d3e69ca9db53dfbc5e06bce292535c01d17ce78399b0f07a299cd911e6b examples/playbooks/gitea-best-practices/CHANGELOG.md
26fb7ed0cd0163cf8ff3df2a61bc6cc446e5bfc6fa6e2d083c35880762e67d8e examples/playbooks/gitea-best-practices/README.md
5cc48919e2a5ea3db4530e29bcf2a1c4d665d8cb2aaeb823c8d6071bfa4fa44d examples/playbooks/gitea-best-practices/evaluations/static-structure.yaml
a7a186098bf686bb0a63f273a4338ec6c642a98ba5c7becfe5dd742d62b7fe15 examples/playbooks/gitea-best-practices/examples/minimal.yaml
5d3c65df56fd5ab3075943c81e0e0c41d832440fcd13ce048e3fb960cae59d39 examples/playbooks/gitea-best-practices/playbook.yaml
726586e9b97ca847832369a0d87c5c78fb65cf388d9fdc9d76b6c5b18452d13e examples/playbooks/gitea-best-practices/prompt.md
7a99b224b97327e81b9d744ce905509d03b5b848775478722cf07fbed719948d examples/playbooks/production-readiness-audit/CHANGELOG.md
ab91202ad68982129950d84f153fcfc6c25a9c4b674b477d4baf94e27ac43c11 examples/playbooks/production-readiness-audit/README.md
5d07a12369f2548d96c2fd59927a3c563ad3eaf265b040b93e96beacd1600fb9 examples/playbooks/production-readiness-audit/evaluations/static-structure.yaml
a5a349cb57320946c441a8979ccaa6c338261ee0f3b096e14ae2dcedf9a626e1 examples/playbooks/production-readiness-audit/examples/minimal.yaml
d293b892dcc2df2ceb2452be31da5dfd068ab5c83910d6dd0a064cab3752316b examples/playbooks/production-readiness-audit/playbook.yaml
0be5e6483912274acd1a20987dc29e8bf50e9536b0aca8fe8498e3172f860f19 examples/playbooks/production-readiness-audit/prompt.md
d5b5625c2d3891657a150ef1982f66a8a4140ddbd163296ac4b99e800a128798 examples/playbooks/repository-cleanup/CHANGELOG.md
57d3edd75ebf587e62296026cfdb161768df725c700e845c637bad6d5e3a4ee2 examples/playbooks/repository-cleanup/README.md
15e16455aa4d7744106e0b36bb2a7f3fc8ddea787322bcdfd3ee377fd815a996 examples/playbooks/repository-cleanup/evaluations/static-structure.yaml
95405ea1ac358928bad4e3df4021a9f8fd1ee6150de80164b14e749dd950c00b examples/playbooks/repository-cleanup/examples/minimal.yaml
be42ffe575a099d862540ed1c73a5a2ac6e39698da1fe52354e94dde28d9ceeb examples/playbooks/repository-cleanup/playbook.yaml
23cf4ac0a7a22186377775314082bccae43f8d4193214ef1a5594823fcf0422b examples/playbooks/repository-cleanup/prompt.md
fb347cad1f762dee0db158252fe7e271ddd798d28c3c6e04e3e35fe6da4e6337 examples/playbooks/repository-health-audit/CHANGELOG.md
c7d2c13128574e3d4b57375b9b101c028c07acc529eeb308725dd395be9b25b4 examples/playbooks/repository-health-audit/README.md
ab89bb879b58d86c578b10018342f531b1613f55c38ef613f1df8fac84f56608 examples/playbooks/repository-health-audit/evaluations/static-structure.yaml
4e48fa5a8934df8c57fe98b9d4261717864c13d83520e52a18b28448ba84ba1d examples/playbooks/repository-health-audit/examples/minimal.yaml
8a720ea500815cc44fa53a6e0d1228bcd5184699d8797ea79e3445f43cb3692f examples/playbooks/repository-health-audit/playbook.yaml
920b5aa3d95860b65deefda17c2d602cd9d01a49c89ebf7ee1acaf00098303ae examples/playbooks/repository-health-audit/prompt.md
19bf1e956e309c3fd038e402149fed0d8d838e62e590cd004078a61e2f93ecb8 examples/playbooks/root-cause-bugfix/CHANGELOG.md
990d07ff2b3c55efc4e416f5456c0e06f45121e14a9a0a22ad63ba25f12dfce4 examples/playbooks/root-cause-bugfix/README.md
d3a17c6a66cb374df67270732c069769b3de5e3737e62e8800e2dbfa1d5b689c examples/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
8567a52f921bde36d44ece4bb06cb9723536d6ad7d7d743814449f370bcfb259 examples/playbooks/root-cause-bugfix/examples/minimal.yaml
d43c41306dc212d28a6f840c6e343be98a2eba64976b0ddfee5203388444ef71 examples/playbooks/root-cause-bugfix/playbook.yaml
feda9c611a9c9b2ab6f7d723e3ea7d994777737a8b28e94ee9bd19ff60fac1fc examples/playbooks/root-cause-bugfix/prompt.md
9fff55026cfce3ea8c9995faddba7d0378c8edcd311185b99dc3a4f11f229eaa examples/rendered-prompts/accessibility-audit.md
02437c9686948e9dce3f64785078656435e930b16a5ed13c16a49b13f40db99d examples/rendered-prompts/agents-instructions.md
b74673fcc3347d93d5d0f7931a3cd52572a5efbf78b9533afa646eac3e2f16e1 examples/rendered-prompts/api-endpoint.md
af42633cab53a064246bd8f8ebdee2ca012c7374520f648ac71a1f48d043b43b examples/rendered-prompts/backup-restore-validation.md
edb619dc8ea005c1d9fd4d16dbeef44d972e7d4780ce196ad880d4d39372f21a examples/rendered-prompts/branch-protection-plan.md
6e7c3e52ba3bd4e2e78bddd133a8d02031f9d4a173d4ec0da6c877862efcf2d8 examples/rendered-prompts/build-failure-recovery.md
dbd5e676892503899b5699d51211ab60379af089f83746448a8dfddc0315eae9 examples/rendered-prompts/clean-room-validation.md
d1ef02d1a439cfb9ebad05c0a36d089b2c39993aa02f63756048ddceda39d106 examples/rendered-prompts/docker-self-hosting-audit.md
2e4182deb790298665390ab7d02466b00a1c21b658c73cf508ee03bac14d5058 examples/rendered-prompts/error-handling-hardening.md
e14d7b6d298f39a7142889a489578402d003efaa820b914bfcc18feca426ef8a examples/rendered-prompts/feature-from-spec.md
5b75a8e53e5f2f61a7e7291934dcd9cdc0a9e22922d41d02df0e0b04281a853d examples/rendered-prompts/frontend-ux-audit.md
39f7102eeba9bd1868323ef265009330e1945fafdd25b968651ed59eb547f61f examples/rendered-prompts/gitea-best-practices.md
5df9046dd7c90d2253fba50bf189a9c825c724cc31ec3e023bae4df212060e08 examples/rendered-prompts/gitignore-hygiene.md
e65a24daae6bf56064e54456acd8738e482eba3f18884453ad215c8021c7260a examples/rendered-prompts/health-readiness.md
e8b7c28a516c1a29f9f23602caa5add079832d6f96d32e7eddb415ad0ac98204 examples/rendered-prompts/manifest.json
2efd020a4164c2db41a501530f4e82b279d3e94787d2b01b4b11e70301210ffa examples/rendered-prompts/onboarding-documentation.md
2ea865cafe830e01b198254c14a6bbbab24817396885c60ae713d18670068dc9 examples/rendered-prompts/playwright-critical-flows.md
ff916229b3cfae8cf2c39c748f7bad4a5a6b5187b93727a7b2347823f6b57187 examples/rendered-prompts/production-readiness-audit.md
1ea40457bc3d1492cf29eeb239e3bca5e2ceb044513155d7b866b93f41ff00f9 examples/rendered-prompts/pull-request-template.md
9ac6bfb4c4b472d017242759b9c2fd68a859fd29c80f29c6a23206a87e01b2a1 examples/rendered-prompts/release-candidate-prep.md
a71952eae7e6ad9cdd6f05ad64bb9efd5243579f73c45d971c1fb9fe0c7bb829 examples/rendered-prompts/release-notes.md
450edceb3ae2ce71bffc79c390a6850f98da3e52b5eabcf7f9edb37f0f81acba examples/rendered-prompts/repository-cleanup.md
cd95f265417f82550313c4b81cd0de63af258882d2b3e4bafed82bb0c92f05ac examples/rendered-prompts/repository-health-audit.md
720e20f0d4e8630b3db7453844cdba3d1e5b6457d29f40bad6f3692a47515bd7 examples/rendered-prompts/repository-inventory.md
8389b948158cc35fa1716e170c9893bd3939dc3aaad9311971b6c267f835ae1b examples/rendered-prompts/root-cause-bugfix.md
9459c1063454d468fd40f9f476bb76f687469808ca7235a008f301aaa1fea2fb examples/rendered-prompts/search-filter.md
0b0399ca190055fe94443a7ff4d2018f3a5f2c4a19ac1fe07b0850afd84739c7 examples/rendered-prompts/secrets-exposure-audit.md
e90820c822cc116e7c1014b1aa2b2c72af4297830231bea5947473505cabc348 examples/rendered-prompts/security-hygiene-audit.md
83352d3e51ba902cd07391cdbaf50bdd7220321be567cacc502412ad292d2a17 examples/rendered-prompts/unit-test-foundation.md
9d3cb96e38cb5d9170d49f00a028c061c22a54865b572cbfa607ed3f146f0490 examples/repository-profiles/example-profile.yaml
ce5809aafd05d58952cf273992440fc42ca55dd9c8c8e563f8a31a434a3f07bd examples/run-packs/root-cause-example/TASK.md
85dd6148501e2256b7479dd8711317db2526a84f1779aea70bcb9b20a17ca21a examples/run-packs/root-cause-example/VALIDATION.md
b7aaa535f96a09629525cef0eb219a7af1f7befdb65af3a6687d64e2806a5e3f examples/run-packs/root-cause-example/manifest.json
37b161d2e975584f6ff2fc1629075dd4b9c85fde08d671e0c2cfea12b719fa82 schemas/condition.schema.json
e5573958b019969ba579ecdb7a93274db5e44d735983496d10eb18e8c8f2282b schemas/evaluation-case.schema.json
1e861d9494121d3b00909337ce0ba0976e188edc6d256f032ae4cde4607abd5c schemas/instance-config.schema.json
2a43e2744105d616975a839fa93691924ec84d4642a2516567060249ce120a79 schemas/playbook.schema.json
d3e430dd1e3b0270d1fbab0f9593d0553081aac979d19d00b610bac782284b37 schemas/release-evidence.schema.json
13d7e87652457fffb2328381dabddb3d53fa89e6e53ede559dec9a100590d8de schemas/rendered-prompt-manifest.schema.json
a1057f4a6351a2949a65ba57fa71ffc534ef01a3b83fb934f7d3391cee539b0c schemas/repository-profile.schema.json
23e62f06522371f73fc7d7df9a639b31f03f55c984327066a28593e3127e149b schemas/run-pack-manifest.schema.json
2a292fb2ca240150cbb9886459e5d037d5e5923de83b95696fce4137b698a618 schemas/seed-catalog.schema.json
ca92dd93dfe04bf5fbe2aa89a79816d6bf45984c76d59644bd16439b18a880f3 scripts/__pycache__/build_archive.cpython-313.pyc
e8adc69290d53318490b4fad03010e46da7ad8333a5477b80b04c50455b187c4 scripts/__pycache__/reference_compose.cpython-313.pyc
aa17d721eec87b63b5c1b36e9c669d3fd4d0317f623ccf4742a4e19553081755 scripts/__pycache__/validate_pack.cpython-313.pyc
52f7d959e969e224bc87be0d0811a2938a28affc3223995d37d6d736ae60d0f0 scripts/__pycache__/verify_archive.cpython-313.pyc
cce328f73430051fea2a2dfa234413a710ebfdf56f986fb4db815776d17140a0 scripts/build_archive.py
b2a0cfb4282d6ad760d22266faf001514635111d116d0e3523aee40569877e17 scripts/reference_compose.py
c0e80230a39be511429c1ba6d2d87c1f9059a3e144f747f4a870682a532fc5e9 scripts/requirements-validate.txt
b90ed90f3fd40e6c337769f1e5aaf7ed3f443196a3d2c0fb6d4073fa287fa965 scripts/validate_pack.py
0eef61d7c20b13abc84a5f67e5064463705f5c33b56f211d8c5e7a68e2ac73b0 scripts/verify_archive.py
419e837d2eaaadaff746dfd908f568a303225c36c805307a62789bb4243d879f templates/AGENTS.global.template.md
9fe1e82bb14b903f86bbc4606c4e12d5a1351068aca4f1ced3850e0462695ab6 templates/AGENTS.repository.template.md
6489b330e753b3e9a12e298999cb1670d8756e0d9125538b87987196dffd46f6 templates/CURRENT_STATE.template.md
d21e7b9f52a8bfe4a53790d8ce6ceae85dde081f7d9c908c63cf5847750e280b templates/FINAL_HANDOFF.template.md
ffd9e9cb272a2772bad7b70acd62e5baed3d4c969bd1c9cb5d7e8b2e8337c375 templates/MILESTONE_REPORT.template.md
20742e0c8046e0f67c30ed0d17e10547ef970611238d2280254760baf3b66cb3 templates/evaluation-case.template.yaml
0ae9d2b7748e8e6ed95db6bb277f23f99abd08825e935a154580cc2670cd5537 templates/playbook-package/CHANGELOG.md.template
4e03a8142ade30f2249633b751bb5e9d31ef543a5a3fe3ba8987571b37cb63b4 templates/playbook-package/README.md
74cc24a8fc71fea866b46196adf858b61215e9f9eaa4ae893f4e18a942bbefc1 templates/playbook-package/evaluations/static-structure.yaml.template
e1274d9697a93b129d354f5e3907a66af76ebc41d9c2b687415c2191acf20c90 templates/playbook-package/examples/minimal.yaml.template
3e2cbe64a0ca19224daf22abfc02c521b865d9d7eebd289dfd7d6403f43e39fa templates/playbook-package/playbook.yaml.template
ed0e972309c1412c4e80af7e18915eda60eca0c0edd3fc73c638c13e4b0d72d3 templates/playbook-package/prompt.md.template
4245a9fbfc87194ee6dd61fab1900f5a02255409056f372f61adaf86685e4e55 templates/release-evidence.template.json
PACK_REVIEW.md
+52
View File
@@ -0,0 +1,52 @@
# DevRunbook build-pack review
## Review conclusion
Version 1.0 was a sound product specification and a valid archive, but it was not yet a complete autonomous implementation contract. Its validator proved that the six examples and three JSON Schemas were syntactically valid; it did not prove that the product could be built without major interpretation.
## Material gaps found in v1.0
1. The catalog described 72 concepts but contained only six complete Playbook Packages.
2. Milestone 1 required the complete seed catalog to import, while 66 entries had no package files to import.
3. The domain model referenced users, workspaces, memberships, jobs, feedback and audit records without defining their core fields or constraints.
4. The OpenAPI file covered only a small subset of the documented API and used open-ended objects for important resources.
5. Conditional fields used unparsed free-text expressions, creating ambiguity and an unsafe temptation to use dynamic evaluation.
6. The package specification said that only declared files were digested/exported, but the manifest had no file declaration model.
7. The package and Run Pack digest algorithms were not precise enough to guarantee cross-platform reproducibility.
8. A playbook had no explicit default work mode, although the seed catalog did.
9. Repository capability names were not governed; one example required `test`, which did not match repository command roles.
10. Authentication, first-run ownership, password recovery and workspace authorization were under-specified.
11. Exact configuration limits, import limits, retention defaults and Gitea network policy were not centralized.
12. There was no requirements-to-milestone-to-test traceability matrix.
13. There were no canonical sample Repository Profile and Run Pack artifacts to validate round trips.
14. Screen-level states and error/recovery behavior remained too high-level for a consistent premium implementation.
## Changes made in v1.1
- Added 28 publishable P0 built-in Playbook Packages; the 72-entry catalog now distinguishes delivered packages from authored backlog.
- Added explicit package-file declarations, a safe condition AST, default work modes and governed capability vocabulary.
- Added schemas for conditions, evaluation cases, seed catalog and instance configuration.
- Added a complete reference PostgreSQL data model and expanded API contract.
- Added authentication/authorization, first-run, configuration, canonicalization, screen-state, traceability, risk and glossary documents.
- Added canonical sample profile and Run Pack fixtures.
- Strengthened pack validation to check cross-file consistency, P0 delivery, semantic rules, sample digests, internal references and required API/database coverage.
## Additional final-audit gaps found after v1.1
1. The pack specified deterministic composition but contained no executable reference renderer or full golden output for every publishable playbook.
2. Operator start instructions were spread across README and the master prompt rather than one exact Codex entry point.
3. Parallel agent, worktree, browser-verification and interruption-recovery behavior were not governed.
4. The initial monorepo bootstrap and canonical root commands remained recommended rather than normative.
5. The Codex integration document did not yet reflect the current skills/plugins, subagent, worktree, browser and automation workflow surface.
## Changes made in v1.2
- Added one exact Codex operator entry point and resumable execution protocol.
- Added an executable reference composer, manifest schema and 28 byte-stable golden prompts.
- Added current Codex-native workflow guidance while keeping product runtime independent of one Codex surface.
- Added a normative bootstrap repository contract, canonical commands and first vertical-slice proof.
- Extended offline validation and deterministic archive checks to cover all new artifacts.
## Remaining honest boundaries
This remains a build pack, not a prebuilt application. Version 1.2 removes the remaining material specification and execution-workflow ambiguity found in the final audit, but Codex must still implement and verify the product. Exact third-party package versions must be selected and verified at implementation time. P1 and P2 content is intentionally a reviewed product backlog rather than falsely presented as publishable optimized prompts. Direct Codex execution and write access to Gitea remain outside the MVP.
PUBLIC-SOURCE-MANIFEST.sha256
+927
View File
@@ -0,0 +1,927 @@
822d15dfa3c257298455a74711099fbccc85be8570f3d28e0674b9f1bd3f6f20 .dockerignore
a6b98ea7cb6d61ed8d430dd0dffa46c87012b5cf859d4ce7207898954951fdcd .editorconfig
ef3faff39e79e3a723704ff3bb33f8cd90a6d5e8c72fabd356c0780ae1118a0a .env.example
8d75fbed0329d55480242ea79c61cbdd3da312c700298bfba9572b81ec325cc6 .gitattributes
d01d94473aa423e96a01929f52d4f0bc599652a61c409702c38ba9a0ef8271af .gitea/workflows/managed-validation.yml
6cd8a37d7e2a507e90e0e60136fe5ec795d5cfd92e318c460252608fa88bbad5 .github/workflows/ci.yml
1cf3186d21c2bafb868945943e28b8448c7edd6469209bd3d8d5c00b4db93ef7 .gitignore
24c8656eb63e90e2e33dacc1cb1dc681680a569f72af6754d17fd9286f664106 .gitleaks.toml
55075b5ec4e8b31936cbbc282b8829116d1fd48f2f2f1856dee592a6650700ce .node-version
55075b5ec4e8b31936cbbc282b8829116d1fd48f2f2f1856dee592a6650700ce .nvmrc
82ba667e596bdb0810c3160f572b1404370c8fcbb5eb80b7baaa45904a98d1ff .prettierignore
adccc691e1669a4bd425c3fd68b52bd5b6c6139ec8df6d072c647281546fe199 .prettierrc.json
493edf3c168aa0496cd1d47064ce1a849c0cc18ad74678fbb658d24ef4cfacc0 AGENTS.md
dc40bcfabcf8a38eae1a5abfff558c18443534604f8b9739fae3b47d3bf67568 BUILD_PACK.json
5a308c308273dec5b3a35b77eb1294893f1cdb468e022cf9c856db2bd3a667a0 CHANGELOG.md
73c53eb65109d3b49bf00cf47231fc87e1bcab42df583e50c73fe91b78fafb75 CODEX_EXECUTION_PROTOCOL.md
2a8e8ac0be23381257c53ab47b4059ba9bed8adb9200b55dcc9c3b86d1e8df36 CODEX_MASTER_PROMPT.md
0ded5168bf6b3b664756d05d7210272af4f28f422597a5519ad8793f13aa9896 CONTRIBUTING.md
7c1bcc375441f8548bad672516ba10424f4e224f9b112e9ebdf97e9c4d1ab6a9 CURRENT_STATE.md
591939dde953361d5b64641ce4eb215a3afac5c98600148778d148e949bd2d7a DECISIONS.md
f274162f7540f3fd2c93637ac34f1ca6c11a6b562e5ffcf61ac1ed330ea2e054 Dockerfile
0a60fdc763f33df8c066e69c9a4a024eb587f1528e8fefb530001fd759f34485 FILE_INDEX.txt
f038f971c5f2866e7710486f15a236d05770eea76ba36d6bfcf8739ed6fd3331 FINAL_HANDOFF.md
4b56b47f7ba793e123dbe16c935476768a3ad0170f2d8a7ddf31f66ee4393b3a IMPLEMENTATION_PLAN.md
638b400d8d3aed60e672875df8a4a2ed749203a7f1c3fc336a295da2824edebd LICENSE
b796ec54788d1295f85223e5917a49ca04eff8c0b9fadc9e4d6b43945c650bb6 PACK_MANIFEST.sha256
ca5ad9d9127b9e1fec448fbed19a400c399463b952b6c03945e91746e355d672 PACK_REVIEW.md
bef5294849929a41730e8be0cab843d94ae495a4c9a4ca0813bf1a1e1dfe66a1 README.md
03fa606416d402f5430483dd1447f701bb9923b443d5b02e85c5855c10aa0125 SECURITY.md
a40b0c5b5560eca6248ee900f7e004cfd5f1849ab8659fc5ca8d8acbf6c43f89 START_HERE_CODEX.md
56d37c6cfe1c24eb4050bdac449821bedf9d13263948e1f833b5b0e0bf787114 adr/ADR-001-git-first-content.md
f9ab72425ec1dd03053420e99095dd658719600267a353e4de7841e1bbf85259 adr/ADR-002-modular-monolith.md
843800428943b1e274abd4ffc614f8f46f31060d6e1b2b2e62f764e762333619 adr/ADR-003-no-direct-code-execution-mvp.md
00cbaf689f1f96ef99069176ffbf955af3ecfaff9e9b896606bef4370122f6ef adr/ADR-004-postgres-search-first.md
5ce4e17096792a3e877b2e47332bdea7abdc1433bfc37a274775ac8a8344227c adr/ADR-005-integration-secrets.md
b628d2c48be924b25572dac7252e248d6fec3128ff0137c967b32294ce0669df adr/ADR-006-better-auth-adapter-boundary.md
3dc46224d399a7a09e833b3284b18597504d9c967615b933d781dfb3b4ea675c api/openapi.yaml
7b550dda9686c16f36a17bf9051d5dbf31e98555b30d114ac49fc49a1e712651 apps/web/next-env.d.ts
5cb4cf40fdb110a121ff9a451d845287894237f4be50fccfdf9356704c5c29ee apps/web/next.config.ts
d5a2f5ae219145744af95ae2781d6c4318e5d3aeb7baf75a21011b10a244a90a apps/web/package.json
3fc8d1c13ad963bbf7da04d59024d38cc2ad14563b36afd71bc8b43c7148dd25 apps/web/postcss.config.mjs
14105408b2deaad0971d252f99af8b9e897a4a4fbbc42642317ac77d97bba65c apps/web/src/app/_authenticated/authenticated-app-layout.tsx
179b1911a82fa2ace7251ba819737fd91104b3d924f0c2b2f75f80d55f7dfc79 apps/web/src/app/_authenticated/authenticated-app-presentation.test.ts
86a52d071f0a12f70817d7420e894656ff0c6ca16102301320226ae2008de5e1 apps/web/src/app/_authenticated/authenticated-app-presentation.ts
d79ec4f7a7136147285c3cf9630e65473e6fc8989f07f85f9461e1d14aebfaa5 apps/web/src/app/accept-invitation/accept-invitation-experience.tsx
f7a6641d388394d466805b85d834b6474adcccac4d9cd6785aa36e21353f920d apps/web/src/app/accept-invitation/page.tsx
0e43bcfb91c5c67aafbbea621a45d90e5aa8abfbbbcb8f07041ea6cac9750f7e apps/web/src/app/account/layout.tsx
c12d550c3878bae7e98cfef06168b00c28716c47e170ee6fb711f3e945fd1e2e apps/web/src/app/account/page.tsx
51f86f3037458098c684156e8e4b421600c2aef56960ed01320182ba0b6cf0a3 apps/web/src/app/account/presentation-preferences.tsx
8d49dba51134f75f050a432703c3e16b3f844f5ebd2bfbfe73c1a446587c433a apps/web/src/app/account/security/page.tsx
9b756e1077767463377402a7b16c6be36a33866066d41e6b93970593c952e89f apps/web/src/app/account/security/session-manager.tsx
c488c2df2bcacf524ac65a928e6000050482deb290e615e77c86cbdcc87e3ba4 apps/web/src/app/api/auth/[...all]/route.ts
b0f32c834c7a0a30b016279ec8585333f211a983681df5bff66a2564d02b6f77 apps/web/src/app/api/v1/account/personal-data/personal-data-route.test.ts
c8d3e7189fe04e32cf111242785d40319fd24e56ea4bc8dcef2886202aec2a0a apps/web/src/app/api/v1/account/personal-data/personal-data-route.ts
2c3a1f8de9a574d0fb85d5c3a7491f6ffd76947010ba03df2d3bdd24dbe0e8a3 apps/web/src/app/api/v1/account/personal-data/route.ts
e2e34766af5bfb9c4693f2ce7b965b219370a3d2b404cfce1d8604e295403a36 apps/web/src/app/api/v1/account/presentation/route.ts
8a0c15bc632b49be3eecbed27178898c304bc9b18c87ea8779153bdca121cbc0 apps/web/src/app/api/v1/artifacts/[artifactId]/download/route.ts
dd3d4bdf4dc44edca59b4551c888030a76cadfae55efd03b3b20775c22697ec8 apps/web/src/app/api/v1/artifacts/artifact-http.test.ts
3f7d5f7a0d039c1a126e47599cdb70c7f604232a50af2e3bd74e5422d027e20f apps/web/src/app/api/v1/artifacts/artifact-http.ts
df62a1e7e180d72a3bd249aaa48befeb1a08e3b481f2e95079b4aa3e304c1a93 apps/web/src/app/api/v1/artifacts/artifact-route-dependencies.ts
646061e454e00263e585f4903e8ef84f7fd1f4110ae4afe208d355f0157557a7 apps/web/src/app/api/v1/audit-events/route.ts
ac54be267edd4a6d09e9a3045a39aabd8dd2599d5c8f0c0ff9a85261f5ae7583 apps/web/src/app/api/v1/auth/invitations/accept/route.ts
e6a5d7bc15f077eacfc8b875f5672915241cca29d21fd9820519bb4cd57524d8 apps/web/src/app/api/v1/auth/password-reset/password-reset-route.test.ts
a5d195eaa4ee7a06d384d06a494d337fec60da5521352180022ccc5f83941f5e apps/web/src/app/api/v1/auth/password-reset/password-reset-route.ts
2db20dbd68c209b8d478c3f58125cef1f88fc2fb4a8cc7eff310b216ae3cf0a5 apps/web/src/app/api/v1/auth/password-reset/route.ts
bc41b9b84f9658582b83008b98ffdd2e5544f315fe68a928692ef09bd41aab50 apps/web/src/app/api/v1/auth/sessions/[sessionId]/route.ts
89261ba335f0a6a2a5bd349b527a54ff2a9d4e3b76fb976594087bfdc6f7e294 apps/web/src/app/api/v1/auth/sessions/route.ts
5430eaac16cc44bd771ffd4be653c702e59bbc7b3da0e188866996b6f9119279 apps/web/src/app/api/v1/auth/sessions/session-route.test.ts
832203862047f6ebd6a32a1875d0116d2cbc9dc9e1d1ff8656b3c0fb5ee06f49 apps/web/src/app/api/v1/auth/sessions/session-route.ts
d9ab222b4478bb8647397f240524d6c737be8bf370c4c8beba15a4b75cf2b6a5 apps/web/src/app/api/v1/collections/[collectionId]/playbooks/[playbookId]/route.ts
be2847aa4fe5e56c2612df24c221ca57c3311ec03558d5c2921d8bc530afd13c apps/web/src/app/api/v1/collections/collection-http.test.ts
f2ae68594faa0accf0f1937ec2b0e856ec6c455a397bcdc40c11e857ec2d1559 apps/web/src/app/api/v1/collections/collection-http.ts
c4532f7415a7e0c56280771da5d3d5064655bb982f3fb4eeff053203821cfac7 apps/web/src/app/api/v1/collections/route.ts
04a6897a27e28f3114bc2e339c03371f280ac427278a20885badb90d30c5f446 apps/web/src/app/api/v1/compositions/composition-http.test.ts
1b5d274590d78325807c3024cb289ba3dccd1f25854f2d7830147616fdec7e77 apps/web/src/app/api/v1/compositions/composition-http.ts
7b3c416d6e247212ec26027867a907bcf00c1d236339786991b22e9c2223d93b apps/web/src/app/api/v1/compositions/composition-route-dependencies.ts
9d980e3aad14e3cd080dbab6fedf7bd67304cde9b33164408b529395a902e5e9 apps/web/src/app/api/v1/compositions/drafts/[draftId]/route.ts
90df839ec2325df62e1770453b7b2c5d86b5fc4738c4889617f19fe4e1a24faa apps/web/src/app/api/v1/compositions/drafts/composition-draft-http.test.ts
fad16d77223156e3e5f00b98a9b992e4be68e318eefa2fc0413d69020da6d8d2 apps/web/src/app/api/v1/compositions/drafts/composition-draft-http.ts
204f1e11d91ef3879af8ed334eb7890e3d9b30ee9a8148772153c65a038026eb apps/web/src/app/api/v1/compositions/drafts/composition-draft-route-dependencies.ts
1be3aa752506673b1dbe7c26f2cac3b6b1658c16033e532038ce4c4110e7f75e apps/web/src/app/api/v1/compositions/drafts/route.ts
dc2688848ecfc9dd5a2a1b20bd3d4d049d0826b045211a8732fef8052ba89658 apps/web/src/app/api/v1/compositions/preview/route.ts
7de7541d59992ef9f7f26a9b38b52564743d2963b0f9453c63c1c27445d57e9c apps/web/src/app/api/v1/favorites/[playbookId]/favorite-route.test.ts
c9e699e78b3c67c98be5d8166102b86970c5a17ad7b67837e1c0103355f70856 apps/web/src/app/api/v1/favorites/[playbookId]/favorite-route.ts
86dbd87cdfae503c44eb7c642a4d7e53237f637bcd4291f903a35fdad0c52ae9 apps/web/src/app/api/v1/favorites/[playbookId]/route.ts
204fac05ede7b9ee4c1f7138028f24a9aa391379c947a86966887d5e25a2e71e apps/web/src/app/api/v1/instance/setup/route.ts
543002bbf2d9766963f5911236de7070376538e47c0b7088a0cec1cd58f1ebe0 apps/web/src/app/api/v1/instance/status/route.ts
da02dfe1cb1991f79b4387af612b34eb3bfbbf6f7aa3a2e34f8576a7a4a9c4c1 apps/web/src/app/api/v1/integrations/gitea/[integrationId]/repositories/import/route.ts
0ffdfa0865623e9efe4b5b25146be5dee3ef0a4c05fec10fef5fc0ae7f4eb3f3 apps/web/src/app/api/v1/integrations/gitea/[integrationId]/repositories/route.ts
5cb10e2d4543a2fb1a944a81a24c4760580aead88fb97a44be465600f1051415 apps/web/src/app/api/v1/integrations/gitea/[integrationId]/rotate-secret/route.ts
44d3cc0f8167ee82fce00e6b20b571bb013972d6498b75398477f7fffc99ce2b apps/web/src/app/api/v1/integrations/gitea/[integrationId]/route.ts
85378d336e95c6aa33915cd9070574c9f1d4e6db484e13191217f06827be9598 apps/web/src/app/api/v1/integrations/gitea/[integrationId]/test/route.ts
9712e98d31a63ac6eadcac21940c5065c2a232f80fb8e5e9f67f64e844b4e8ee apps/web/src/app/api/v1/integrations/gitea/integration-http.test.ts
49293848b400ebb144e66c8c254e30dc706887e04e5cbf06413bec9d9193d63c apps/web/src/app/api/v1/integrations/gitea/integration-http.ts
97327ddcaa88e9206ef4e36b0f0d275b9df64f9ccaf83ca4a14df14d7173b508 apps/web/src/app/api/v1/integrations/gitea/integration-route-dependencies.ts
be04b6a99efc4e5390a5e337d5eb36b397cafdc11f53ffee6f4e0ebcab0ece85 apps/web/src/app/api/v1/integrations/gitea/route.ts
fa791ddd2d146f4f033ef0cd4325fa16a7285f3d319da967f3c46f5de02749da apps/web/src/app/api/v1/invitations/invitation-http.test.ts
348d0f9b89e9cb507b46f8d56cb680ce7b008e219efb322bb6c0fc36818ef3e3 apps/web/src/app/api/v1/invitations/invitation-http.ts
0968120b23681499eddb77ef00ae5f2ec273ccfedf00a4f035b070c8f137acd2 apps/web/src/app/api/v1/invitations/route.ts
58142657e61c9dc3417f7ebb931f88da2f01451eed94316918aabb1abf59a26d apps/web/src/app/api/v1/jobs/[jobId]/retry/route.ts
91f0489baefa1fd83eb45d34d09fb8c248cda833751c4a6d086558dac9bc02dc apps/web/src/app/api/v1/jobs/[jobId]/route.ts
4deea31a703ffcc656b5b07c781134b9c339f3913d5f0c4f33853451b98db0eb apps/web/src/app/api/v1/jobs/route.ts
bcb129106bbd895950406f4aab949be38a1327012d3e409bc86b8e08400f5dad apps/web/src/app/api/v1/operations-http.test.ts
b82e4f3591fc32f1d493533a395ff3ae14f9c2aff2955e1935045786b28e5715 apps/web/src/app/api/v1/operations-http.ts
100505f0ed563fa5e447656b5d63b3ae35f0a53aa8ae33a788f9a4cd516c8b67 apps/web/src/app/api/v1/operations-route-dependencies.ts
01cfcb54e8781916a98fe43b1448b74c035360f37ccc56a4fee9bdb0952f1ac7 apps/web/src/app/api/v1/playbook-imports/playbook-import-http.test.ts
a3cc444a7c2cf2f716a91526e7e97a80c10693ab0c798d122a5950fba0682d1b apps/web/src/app/api/v1/playbook-imports/playbook-import-http.ts
4128120532e32380cfdfb240ffb01ea219ddf5caa38e4f3937e49df37a54f16f apps/web/src/app/api/v1/playbook-imports/playbook-import-route-dependencies.ts
6db3aa06993e1dd565b068058c59cc8c7dd08b05e173b00da7c4bd169d5e783d apps/web/src/app/api/v1/playbook-imports/route.ts
bba6d8d645819390fa8f7073148fb5258ba0720e559ca3e6a2931677fab83703 apps/web/src/app/api/v1/playbooks/[slug]/route.ts
59ec57317e2f9967561b55ae93a083a34c37869df06e0bc82536dbe89d6ada22 apps/web/src/app/api/v1/playbooks/[slug]/versions/[version]/publish/route.ts
4db7ef84c6787b5df02d68d0e10835069d328a5f98f2d8c3c600e2493c8bea2f apps/web/src/app/api/v1/playbooks/[slug]/versions/[version]/route.ts
3cccd55d5c5c2c6fda997110fe08eab858c145826a3d14b15767f6f5ff616a1d apps/web/src/app/api/v1/playbooks/playbook-query.test.ts
63b807968f27bdc396d3a678d238ee3f4ad7148b9231d1cd3fb3201a6256bbdb apps/web/src/app/api/v1/playbooks/playbook-query.ts
d9ee4e6857cdefdb2681caa1d67b6d2c5120786eefe6609bee03c66e7bf3f87e apps/web/src/app/api/v1/playbooks/route.test.ts
c250cd7e915e863a100c90099c3c9448f1c77e4ca57ebd34b4ae0d523843f95e apps/web/src/app/api/v1/playbooks/route.ts
8ece4ae18d64c43b9d278d04e2156502eaf47815cd253a89fd5ccb96fa667e3e apps/web/src/app/api/v1/presentation/locale/route.test.ts
e5761b0769aa2242465e6abc4e74bc1d7bc7e9f139686f4e786fef290caccad1 apps/web/src/app/api/v1/presentation/locale/route.ts
3a2e31c543e52e7fd47713aa82424579606f8866357e5c039abe86431c7218ff apps/web/src/app/api/v1/private-playbooks/[versionId]/export/route.ts
12ac1fa5faf20a8ad16c361979be4a7cac1f822b35132914f098dcc9d9220b94 apps/web/src/app/api/v1/private-playbooks/[versionId]/review/route.ts
4a633d4b5fe983d01fcaac4e9ed6975be30f0306a6eff92b02523226e453eeee apps/web/src/app/api/v1/private-playbooks/[versionId]/route.ts
607198a5e3844a99f4a2bac723f8ee0265b04934c8265e9683b24915a0d970b4 apps/web/src/app/api/v1/private-playbooks/[versionId]/versions/route.ts
141eb9804ca1b70f01e684b12726877c93216b72c8a1748cf9338b2b7842872d apps/web/src/app/api/v1/private-playbooks/private-playbook-http.test.ts
bb817ac1867f2c5924aac247f4b54f97253d6908879f9e78dcfa2b73ef594eaa apps/web/src/app/api/v1/private-playbooks/private-playbook-http.ts
487b645599e8ad60bbedbf8fe47f537f40e0680c057a87ef33b8fff90a65cfa1 apps/web/src/app/api/v1/private-playbooks/private-playbook-quality-http.test.ts
4e2ebb9868c29659df633e36cd7eba5e48ee345a1e32f5d55ccc3fd144d8a8bb apps/web/src/app/api/v1/private-playbooks/private-playbook-quality-http.ts
eb818aff1054a8db00aecad48cd8015f9eb521b40179066a9fd89885fe2abca9 apps/web/src/app/api/v1/private-playbooks/private-playbook-quality-route-dependencies.ts
660da4d46089c563fd545c8db61636ac6fb6c6a4b9c18aa2ffe3b5b618ad1b30 apps/web/src/app/api/v1/private-playbooks/private-playbook-route-dependencies.ts
6b0453b7c967f4d3ee8a5eacc55470e937f17dfb7e0943b9994fc0e3e186600a apps/web/src/app/api/v1/private-playbooks/route.ts
55cabd5593a4b552d1021ccb53e2fa90c6a23d5485176546700350f8c2beb0a4 apps/web/src/app/api/v1/product-metrics/simple-flow/route.ts
bd8e99b09933773c348df595e0d736749416156c2e673738b143084c1e0397cd apps/web/src/app/api/v1/repositories/[repositoryId]/profile/export/route.ts
768702293a4c1ded7a32bcb23201ce011dfea75891eee0b962b87099cd9b6efe apps/web/src/app/api/v1/repositories/[repositoryId]/profile/route.ts
0f99b6dc1591b38b34e11e78644fddbe68dc98db616ff8532e52610c39548ed0 apps/web/src/app/api/v1/repositories/[repositoryId]/refresh/route.ts
80b9a7f63e782c0511acf8f7b0c21b1b8e31ccb8769dc57263d71a8e289042ba apps/web/src/app/api/v1/repositories/[repositoryId]/route.ts
4bfc329bc3e19294f766f1674bda199a21cc32036a520930ebee46e43951648c apps/web/src/app/api/v1/repositories/refresh/route.ts
689a891de3c956499de93bd70c4064cac9b3d3c085f2d70f16a5305948d2a13c apps/web/src/app/api/v1/repositories/repository-http.test.ts
1be5038cd6947bef000ba638ec8fc54e643ceb6ee6d720760729bdddd8510add apps/web/src/app/api/v1/repositories/repository-http.ts
d66aad5a2a93836fb06add200626c28a37cd5b591f4561a611a7c9e02d083a4d apps/web/src/app/api/v1/repositories/repository-refresh-http.test.ts
76f5208d64f2bbedb8fb9bf7ab0264f6a913b7bcc55483f5cee480ec27df0bd6 apps/web/src/app/api/v1/repositories/repository-refresh-http.ts
4c865c9650d5286a5d48c25aab11362b7ee973c313631809812280b1f28daf9f apps/web/src/app/api/v1/repositories/repository-route-dependencies.ts
af0d1a79d7887786c37af635f1651bd821da82c153954868527d5a9ff290ecce apps/web/src/app/api/v1/repositories/route.ts
404b9a1610d4e57b612b259d255743936c5e82dc58ea463152451454aa71311b apps/web/src/app/api/v1/repository-preferences/route.ts
fb6f4e2b7f89dd049ef50b60f259491e254beddd5f65f876cd6d13ac8d33212b apps/web/src/app/api/v1/run-pack-imports/route.ts
0ab44c773c97be25241882d81defec47865349b989f4dca0fc5190c6f59a0d3b apps/web/src/app/api/v1/run-pack-imports/run-pack-import-http.test.ts
c4268c38c2e931ab6568f91a262c4a8b686536b2ac283a8e3dba3e7e88f8dba8 apps/web/src/app/api/v1/run-pack-imports/run-pack-import-http.ts
00424a3009c3c8b73a4199773b2c6b229968dc76736007e188e0a2fc2e027a8c apps/web/src/app/api/v1/runs/[runId]/artifacts/route.ts
5a0558db20576717d57c53be1aa9731063e1271ea590219fa39a5a5a85ca8828 apps/web/src/app/api/v1/runs/[runId]/route.ts
236b23c8ea94683e54a9690bd54e09ec5e3c74b9f14a443dbb2b96b9e6e3bdff apps/web/src/app/api/v1/runs/route.ts
2ff0536d5283ee46c7487db0c54ab18d160d0ee28e8b37e084a331eb8e910c2e apps/web/src/app/collections/layout.tsx
61c7c194196ce66c80bac98cc9ec27f1820ac8bd78352596234f1e719a5adf27 apps/web/src/app/collections/page.tsx
dda2d30505ca3f6afa2a95948985a4e31a87d868b300a650a7c815dfeaff44e7 apps/web/src/app/composer/[draftId]/page.tsx
b3f1dd1e95ebfbcfc62c24dfdaf84494b9f6382e44fdf69177528bc63686bafb apps/web/src/app/composer/layout.tsx
ecc8d4e0a4ae5e71df4f3ec6c4b673fdcdbd85b46bdb9efe48885a820acce4fb apps/web/src/app/composer/new/page.tsx
63f46f0a62c2a8e284bac70b1e78c20eda1f6e79e26841bcdbe8c6d4eb06756b apps/web/src/app/globals.css
508d7e00482bb518a18bf67f9668cabd7244b8b9325e594d86965a9f700264d3 apps/web/src/app/health/live/route.ts
e79107027c0dd06eb7495a00b66df1ca413ce819e6fee4cc05eb6f99c10c8d74 apps/web/src/app/health/ready/route.ts
d0cf51563e6d5583d93c37b4babc390de70aebd10b0babf642b9221409dd3957 apps/web/src/app/icon.svg
09ce76cb6acea26518d7ad2769bf547923ef0543b5e2da141a353db5b3909948 apps/web/src/app/layout.tsx
85c9703e8120972df1d81f4e99be150728c0242c4898c4449a2e84007ffea03e apps/web/src/app/library/[slug]/page.tsx
9d6906afcf82ca81802764025a897b0f98943eeb9b3391f01fef279ba38ce644 apps/web/src/app/library/[slug]/versions/[version]/page.tsx
5a7c7fcf259ec16307b404cb14868d964194f3af0070ec0ffe13ced87b2cf0fe apps/web/src/app/library/error.tsx
ac9566ebde42b51873e55158a7b113c25272304a18f4f0c3ffbf151584054e37 apps/web/src/app/library/layout.tsx
766b2825caffec9a5ada362f3fdec850b0d38f53cb065c86f1b893e6939c45c7 apps/web/src/app/library/loading.tsx
62d14f6c603137df8a455d856d147d882b45c27172e8591927e93e62131a5be9 apps/web/src/app/library/page.tsx
f0c47de123416377abc3c252e26898b9f5e383c7d6425ae71c063f0981ef061e apps/web/src/app/login/login-experience.tsx
8b5df7019035c04ab7a9f96cd7adb4199751b61dbc507a8f4ba56f541033c402 apps/web/src/app/login/login-form.test.ts
56f9429ba0cf1861291788f0598786d2f926f4e2c7604b62dbed75f8a81f545c apps/web/src/app/login/login-form.ts
f2a31a5114bb7134ee96196a2ae35736ab03a4f24f80a7897543b4f7ba7da2e3 apps/web/src/app/login/page.tsx
dd1e4acdae494813009f4f9376938e94afa209fcbb4f51d1b34626a9293b9063 apps/web/src/app/management/layout.tsx
8a6224c4711f6eb1b031cd749d99719f263bc88d35c4f775487ecf2f77b6595b apps/web/src/app/management/page.tsx
26768f8f785b0d4479e4631a7acb62cc0e2c956ee4e7297c758e6c209d9193de apps/web/src/app/more/layout.tsx
0d901b1ba082e1a73cd5dde2b5e55c0a41fa8cb23cb9d87facc6e10b093565e9 apps/web/src/app/more/page.tsx
5ce321d7e26c16be6bff66130dafbabf287223b1404e504e3a1cf44bd87025f9 apps/web/src/app/operations/layout.tsx
8a6659854e5d096e95348168f36b6b6e67cf75b62f0f9bf3790b476625d6f9aa apps/web/src/app/operations/page.tsx
60b4e7030145919c7e0d4a23a2e3485077092ea99c7cb3f662155960a4105ecb apps/web/src/app/page.tsx
0dc7cebaeefdb3876fbd59f5626cb5179db92c698be846888117ae2c8a60fd33 apps/web/src/app/playbooks/[slug]/page.tsx
a12b4c84b787be7ed1f2a87e6d7e32c34c6585a1c958ac690aa0c1bd56d235b7 apps/web/src/app/prompt-lab/[versionId]/page.tsx
5953744be2147445d6bcc739561d33f63294ed80364882917daba625efcaa991 apps/web/src/app/prompt-lab/layout.tsx
7371afd56a6c2aef03155050631d0e1cc581887006f20fcb1f249bae47b2e6bb apps/web/src/app/prompt-lab/page.tsx
587cea27b3398ceb7fbf84ba94f1a25f0926ac6bb95248a44f251d8a0a862813 apps/web/src/app/repositories/[repositoryId]/page.tsx
f33200a5a8f1a5f0011bbe55618f3b3d81697753482114bad6ab49c453796ef0 apps/web/src/app/repositories/[repositoryId]/profile/page.tsx
0abe9bedb8278efdd3cd1fdc086c404771bc4c53f0a1d7d8bc65638d49950ecf apps/web/src/app/repositories/layout.tsx
7fb0ddf8970ee09296e8d5f3a5dae7515149aa1f8fb3fa413f5d3d77edbd4f73 apps/web/src/app/repositories/new/page.tsx
bf09fb42688efb61cd22e690443288cd04d1fef740a40ce10cae8833c45af3d3 apps/web/src/app/repositories/page.tsx
0f9257fdec01ca66982a5498dafece4e5efa20b6ece7b9c1d08a638f635dd5fa apps/web/src/app/reset-password/page.tsx
45f36bea033e209867c0fc14be3b7f2c9587c2bdbc20cba2b1dc15a090ef7264 apps/web/src/app/reset-password/reset-password-experience.tsx
4aa63f9eb14bdbfee87237e722e68fdcb953f9c2e3c3cb5e8108e6cd554c7a7a apps/web/src/app/reset-password/reset-password-form.test.ts
f17bcd2a8c89715d5828ead7ab182794974e63f5b1c048efeab8fd5b8586a1e0 apps/web/src/app/reset-password/reset-password-form.ts
210a8d6175cfae7be71d007f1ad80b84eeeb3a5e874787ebdec419973ac8dc80 apps/web/src/app/runs/[runId]/page.tsx
c3cfad7dcfcbb63d39f8297d2ec6e7d41c129ce09c0374c4b34cd50b83bbab14 apps/web/src/app/runs/layout.tsx
17d3e4f759cf59a0dd8ebd53200ce9dc384d9a2242c0325732f4e3a5f949b589 apps/web/src/app/runs/page.tsx
5322a472c1872d71f731c906e8e27b75608d084b0b9d260f270907fc896892bf apps/web/src/app/settings/integration-page-dependencies.ts
43e1282d917d56f921589c0de3ba46d98731ffa1fe5fe64df4b0dcbdc366dab6 apps/web/src/app/settings/integrations/gitea/[integrationId]/page.tsx
ca6c8c773930ef0c00a1f4007ece3bdb7d022d8d547ca42b53a1b85e08604e0a apps/web/src/app/settings/integrations/gitea/new/page.tsx
13316a4bcd38e7df8ab0505121f04fff67496cde32e6e36502a56a5e93a181cd apps/web/src/app/settings/integrations/page.tsx
d84f7e78182f763f3a73884e1de916bf989656121df6104f0d98b85d365c6b91 apps/web/src/app/settings/layout.tsx
4e999e1ea3598f61fa2b8f160400d8cf720024f2c09a0aa1e02568560e216ecb apps/web/src/app/setup/page.tsx
60ef4f31b680b593984e10a832aedb8999230de0c9fea189448f45992c215246 apps/web/src/app/setup/setup-experience.tsx
b8f62c48edc01d296ab1b46e142fa2cc743e36154095880cff6bbb4e91f87f58 apps/web/src/app/setup/setup-form.test.ts
10d5fd1baa0c3cf2d5dccbcb576f73ac84b3b322cb9d528ef538bd96e96561ba apps/web/src/app/setup/setup-form.ts
9a62c77d78a94c566bcf4e0ba8984be2bd52461f18fb66e773906f07ded1ae84 apps/web/src/app/start/layout.tsx
9987e1db80cf8d4fbd23b564befe924ed35cb27e41fbf5f489859cfb6330120e apps/web/src/app/start/page.tsx
f88bb038255c62cc6fd461674c09a520a68b40588426fc39a3325ee382facd4e apps/web/src/auth/auth.test.ts
923f5328f70c4cf9ddbb76dc769d1582b38cc339ff92eae8747480ab4b6cbf7f apps/web/src/auth/auth.ts
eaddd16a312ceb3e5f2fff61853fe5c3f36c859d917ea1b1b5905429a8ac6484 apps/web/src/auth/better-auth-adapter.ts
b7abe096e21592c0e52d55aa5d5f8581a0701d24a418793b5e7acd4fb3a86ab7 apps/web/src/auth/csrf.ts
c602ad1a236f474d43cb8d2ea82d9402e967c890dd72ac22042c8bf93641a6bd apps/web/src/auth/password-hash.test.ts
af10a47907cf911b43997866d3188f585857e3b9023dd1954282a6e455ea77fa apps/web/src/auth/password-hash.ts
05ec293fd28b8fce42c18864378f1fae9844ed9392e711e94052f6ce7d9fddbe apps/web/src/components/accessibility/authenticated-landmarks.test.ts
8566c404cd57d5a47c16c4d85837330fc0a8b3e4a1621be81e250d37ebc09a63 apps/web/src/components/accessibility/authenticated-localization.test.ts
d51c7c7b7590013adf898d5a50bc06b0c784e7d97ac7c3c661c30a8a02c44854 apps/web/src/components/command-palette/command-model.test.ts
4321aae2642bfaa21e75d177bc216a82b7eec34af499f648cf8620bc5f27bac7 apps/web/src/components/command-palette/command-model.ts
fe2ee6e3626d1e59d263687b04b21b7541837eb8c396fd4db2eaae14a11b1c3d apps/web/src/components/command-palette/command-palette.tsx
40ced8c0427a44b02fdd69dd20e0d1d9574e490f56af456daffe40951abef3e4 apps/web/src/components/composer/composer-draft-launcher.tsx
9a6b7495049c61be2dc7c5e30bf41d05e30d216988c04f7a612d5e06e0a62662 apps/web/src/components/composer/composer-input-control.tsx
f5fc93060613ca9e18098ca26b4b5bc90e7c01ede0f90c9ec2f1480e306c4fd6 apps/web/src/components/composer/composer-model.test.ts
9b0782d43f8bf7cbc4be3e50ede350e7b003617cae4651c4e2f5614527a61d0b apps/web/src/components/composer/composer-model.ts
ac2b6569c76199ad7191fd2bb66d68d5b55203e43ef03ee2d22d8f9b5614c1b8 apps/web/src/components/composer/composer-ui-contract.test.ts
6c4de32dca38a78dcbb0be5ecbe316f6e4b1997d6c19a72397c1e763fd6ee4e0 apps/web/src/components/composer/composer-workspace.module.css
1457fc1b07fcc61b44da81391ad70a3b7a6cecf6a721091b4c489b40506ff098 apps/web/src/components/composer/composer-workspace.tsx
ee184dce02c6ed5cbec046bc85b5b9eb0649f0be2d2429613d891ad862ce6c14 apps/web/src/components/composer/generated-task-view-model.ts
3fe79d916c1f8f819b642d871f5ef12c8ed0e60e9c1492d961c833f1be8e11da apps/web/src/components/composer/generated-task-view.test.ts
3572bc1dd4e3724c95900dad755f88c168efe9b3c356a40343b4d4c983c46aef apps/web/src/components/composer/generated-task-view.tsx
207e622be13987f4a00ebe8ce1d9b77cbe28310f0e9177bde5e697810517866f apps/web/src/components/composer/simple-composer-copy.ts
b2b771e1c7838de483cc0f98feb5eb71c555afddec42c13f5f84e2045cfcff2a apps/web/src/components/integrations/gitea-connection-detail.tsx
78d752c41e29a54efd3b66a8fbead426bbf30bfc120f71d5fe5dc548c3f20bfb apps/web/src/components/integrations/gitea-connection-form.tsx
2afb1ccb30b92fb0cfa72f4cc69f701ca162805404bfa1abaaaadbfed8dac20f apps/web/src/components/integrations/integration-list.tsx
4c3142dc725dee4361475f4d749de8d8642d3d8e734acdcb1575a4dc15704bf4 apps/web/src/components/integrations/integration-presentation-model.ts
3fe74053c5ee127984aee9861eceb6a380d15b5b56ab96b0baae51dccb5d2f96 apps/web/src/components/integrations/integration-presentation.module.css
48953647b98e81b9fd4dfb7149e16386d25038187091ece4d41240167c35b642 apps/web/src/components/integrations/integration-presentation.test.ts
d487de5e8e7afff2a43274942d085656168a99246655a140a9e989ca0f940e98 apps/web/src/components/integrations/integration-status-badge.tsx
71e06e644a8f29f570b144ccff17bc2766537cc1709c79e34ab68d18282a5587 apps/web/src/components/integrations/integration-unavailable.tsx
38e45a60e5a475412ef06110ba0eb82f85ec47a536b36194649ac04270f22739 apps/web/src/components/integrations/repository-discovery.tsx
bca755a892b55eb1afea6d1f2f377dd4489ff773fd62f3c2cd0d4ac467e389b5 apps/web/src/components/library/collections-manager.tsx
be785515f029fa9049674e1b93a165d61e67b65a6e17ac03c20d1a0bb7a08c94 apps/web/src/components/library/collections-ui-contract.test.ts
4672f902ae0d295557d9b1af750801f35ea1df4d28a7675331829f08cf24fdcd apps/web/src/components/library/library-results.tsx
f7a086508baf280085d842456dc1e13021904bc3c490072c06fd8efaa0636096 apps/web/src/components/operations/operations-dashboard.tsx
38350e35666a30bded129e8ccb0c9c0034953291dd7e4f5fbff9f484cd08771b apps/web/src/components/operations/operations-ui-contract.test.ts
088139c185b047088ec1801dcc4132a2a8aec84f216e7d7edea92620c9b9da63 apps/web/src/components/operations/operations.module.css
313d693e56a8ac4f232634a2754cabc57c1f2281f1b98eb78c7ae9f47cf741a3 apps/web/src/components/playbooks/detail-favorite-button.tsx
541592aecb7206515b05095daf644b09b28c43d08de4e0fb2f52b42ff151edc8 apps/web/src/components/playbooks/playbook-detail-presentation.test.ts
f278593e985f8aea32bbcc823010505abf85e4e2a336801924c5df053f623e21 apps/web/src/components/playbooks/playbook-detail.tsx
ac9beee6a42327a628504344698bc181a8977f8dd3bc0721b94600ccf976f4cc apps/web/src/components/presentation/presentation-model.test.ts
8e95d66be92226348894e7b86c510a8da2227ed36df452718d9021cb68f6ed04 apps/web/src/components/presentation/presentation-model.ts
5908a707bb60a364478c1bda5b67be599a61f2248bb732a36151c64a4b4132c3 apps/web/src/components/presentation/public-locale-control.tsx
a870abb854ef6d11b061c226556f4d294adf0bae824c9f657e714070c846b045 apps/web/src/components/prompt-lab/prompt-lab-editor.tsx
00fd50e6c3bd976d9a0bf86e34cf4ff190bcb7672d1eaae7ec48db515e669fa1 apps/web/src/components/prompt-lab/prompt-lab-import.tsx
056faa9a025303e87f3ea7e7cfa35d1fda0a7a215c7876945c441fcc8989479e apps/web/src/components/prompt-lab/prompt-lab-model.test.ts
bb2a9d8e8db4a84a701f8d03c7ae6f1f981f51b1b8900f64ff01a423939e897a apps/web/src/components/prompt-lab/prompt-lab-model.ts
2385cabdfee663c2d05bfe30396e29b9a38e6562934a72ed94c7891ad4c200dd apps/web/src/components/prompt-lab/prompt-lab-overview.tsx
0a215f8fc7f1d33e932e09db8f66ed0d548abea3f04565e9715b21a2310906dd apps/web/src/components/prompt-lab/prompt-lab-ui-contract.test.ts
3a50da0a520955dca79046e51d1c43116f3c44380048ca3b0dba809a2ed8bb6b apps/web/src/components/prompt-lab/prompt-lab.module.css
2bb0a60d3ea02335697bf699ba62bea8d4e8304d97d4ffcd4fe499e4fa360c6a apps/web/src/components/repositories/repository-profile-editor-model.ts
6806629094a847f34586619b30673e99388d764a479aeda0902d13921c3a773a apps/web/src/components/repositories/repository-profile-editor.module.css
067ae295ea7869a6aa59056a5c79b7f3ae50ab418ea1987fb714b98076f293a6 apps/web/src/components/repositories/repository-profile-editor.test.ts
8b71f7992fc8ba09da3fd8adc66e508bd9e107836fcec3d0f3feff7336e61da6 apps/web/src/components/repositories/repository-profile-editor.tsx
aad92ed29adf247cee6376d595e6d99b18ab11fd5ce41c6a9d35a4fd4a22807c apps/web/src/components/repositories/repository-profile-pages.test.ts
ef44600d81b7a23f50a91b22a34d26bdf604e0509030eb166bb549c78de4a008 apps/web/src/components/repositories/repository-read-view.module.css
8810733cba215102a6850ded02a964fdf3dd0f3ae707cb86a29d1f76e3212ef5 apps/web/src/components/repositories/repository-read-view.test.ts
08902c785f1cf340934dd529d3eaa70a7ec5eb59b7b4f105d1b611d3af739fa9 apps/web/src/components/repositories/repository-read-view.tsx
54c8d8b496a912d0a10514d307d004828e5108311764eae62203200a6959f489 apps/web/src/components/repositories/repository-refresh-button.tsx
3baaf15be798b78bc22ab691429e25aa9e54f01f5a8fce25d9d60149937475bf apps/web/src/components/shell/actor-menu.tsx
efc04117b12d47f8b34995d3b0af84f7b4406bc5ae3b3da17fe56eaa913ecb07 apps/web/src/components/shell/app-navigation.tsx
dcf3ba5e8b7b834b50842c42004328b6a0a00df9880a6f4845a02e99152609ae apps/web/src/components/shell/app-shell.tsx
4b140528bb98aa1a261b56d4bfac3a13d32bd6b4df20f3194cd0ad7e0d583dd8 apps/web/src/components/shell/shell-types.ts
deefb37248e04b940ec89b48cac808845983ea6f0e5274b6f9f16817c028d9b5 apps/web/src/components/shell/workspace-switcher.tsx
54f03e01fb2bdb786f209d861a23c1bb10a2e1c3b2f366e13923dc0e227c55f0 apps/web/src/components/start/localized-copy.test.ts
818d550095e22f3be733622a46ca58e2a0f55087391e632c4e14360976a33d68 apps/web/src/components/start/quick-start-copy.ts
24d09b8b8cb4871bb14eac04edfd47e028434e25136714ac9e05533aa681f882 apps/web/src/components/start/quick-start-model.test.ts
155b6c8cccc7a6305d96f5c86633d8180566a2776b734afac7fda01db15fd50b apps/web/src/components/start/quick-start-model.ts
2ae54efb1743a192169ff7b51720276e2b0aabb970b2e21b12885eeb9f4be502 apps/web/src/components/start/quick-start.module.css
f2d2e65b09e302df25de185a9e1410689f057ec6028ca9ff5f9ff2f17aa0952f apps/web/src/components/start/quick-start.tsx
3f2be14ae11a8dcc7d5c32ea7d482c281faa1f11cc186ae7fd1fef1ed65f3c9b apps/web/src/components/start/simple-flow-metrics.ts
16702a4646539c41a3acf4bef0d572b09ca7db412a69ea79ff5fffb7fe838343 apps/web/src/components/theme/theme-control.tsx
70ede3ec012af99845ec965508c761b29b443cd0bc4d76c11da6d4805c7761a9 apps/web/src/components/theme/theme-model.test.ts
2310ff6384e1afad7290f5d8c324e23304a00042df393485b47c46e4fb431830 apps/web/src/components/theme/theme-model.ts
616852441d2fa9040450d5c4543beafb0a4fafe8ae3d716db5261dea9952f515 apps/web/src/lib/built-in-playbooks.ts
8be532f32f0639b83dca4b32416cdf14269d9b9bd926c23b53b66daa32ee0658 apps/web/src/lib/library/index.ts
6e75e4f2f2869a7e7b2b1253a35436dd0fb40746921bc417d1078ab59e1f644b apps/web/src/lib/library/library-url-state.test.ts
416b1277ce77cc52d40d4e3c36f7abe9cae8d06cb956227b2ee9f39ab8ac2fff apps/web/src/lib/library/library-url-state.ts
cff869dcbd1f5fd09506cbd7d169b491031c5df63d2d8ee038f54c66cf60e3b7 apps/web/src/lib/playbooks/index.ts
1cb5a14b2dd6c94f7710cb2132be6c61440be7c742b51bfa13a520fe9b7cb627 apps/web/src/lib/playbooks/playbook-detail-view-model.test.ts
45135c318b5b85521cc7bed308470c851a105c2350cf73e7b78f879e70455cb4 apps/web/src/lib/playbooks/playbook-detail-view-model.ts
94f774792da0c58816358420e2daa79cc9575d1b28883ef39721e2bd7bfe45ac apps/web/src/proxy.ts
56eb71843c0303b8f1088deb2f846d305f65d4dee12d5efd93335828dc8828a9 apps/web/src/server/authenticated-operations-context.ts
11522b594f72097e4b8d971e4522f9f2a550b4dd39a326fd381e2c2f3cb70ae9 apps/web/src/server/authenticated-page-context.ts
b2088146dacbd30bcf06d844f6f9cca1a4bded96feca2a012f4fc0f62d62d78b apps/web/src/server/authenticated-workspace-context.test.ts
dd06adf7581608685db372a21308fe3efacf2c4728f22d12351778fa4e87be51 apps/web/src/server/authenticated-workspace-context.ts
ba4d30272846c8b65869ddf60c1feb13dfa8c246d4a4c59aedca41db8dc0ed46 apps/web/src/server/authoritative-compositions.ts
9ee63ac988b16aa8906d78e3d86c60065f508ff08c8847a92fe8b0845bff7883 apps/web/src/server/composition-drafts.ts
158a5527df0e4b308f8b86ce6b058827627e55c05cbbca95174fe4f05e3d35e2 apps/web/src/server/generated-artifacts.test.ts
add58d0842bab9222ea31ff428c5ed187fef59f7bbc413d37177835f75bc8c01 apps/web/src/server/generated-artifacts.ts
1b63a1ad22ca0e3d117d3d77d94abee924c8722e75d0de7072a5df64384d08d2 apps/web/src/server/gitea-integrations.ts
3da2c26813cb6361a0edad01bdbe577d0b0e36718c7a920f5d85bdec2e8d001d apps/web/src/server/health-service.test.ts
6a5dccdfd41f53c9bc7d0dfa4bf6f33243cb930f8a3b3fe129ea3352517dfdd3 apps/web/src/server/health-service.ts
b50e03a759bb58612d4d44e116586141dd70f68d1e3fed155697830feed43482 apps/web/src/server/instance-service.ts
d10c561bdbb9a4ec4f3b8214e93b7afc271c5d4b370ad4d84cc7a1f611392638 apps/web/src/server/invitations.ts
eb66a1b6b01c38b6fed2787c08ade4fcca096c8bb95efffd00410c2a2ad5091e apps/web/src/server/operations.ts
e03a67c58764e661951d8e9a958365df8ee936df5aa7959dfc3c88696e156702 apps/web/src/server/password-reset-service.ts
34f60e2b0ec23e10def5abaaad0051a5341371649a1b8891fe9bebd5c8d417f9 apps/web/src/server/personal-data.ts
dc4be0c57624a1cae91db42c11c5f6bcc8f9eaceba633fec1ba6fa6bba9d2def apps/web/src/server/playbook-collections.ts
d5e813c06b21a69adcb2ffbdd82fafc6c105cbad637f11a7a3767c4f520735d4 apps/web/src/server/playbook-favorites.ts
03e8a885f58d9f78921f8806d0896468a07c29b1878d99fc426c981b0ad02a00 apps/web/src/server/private-playbooks.test.ts
8ccea06926c6e14025956ddfe728f496416f9b31029cf1642724953a2c7e9b2e apps/web/src/server/private-playbooks.ts
fde2776582f022536f44a121796e307206252f79ce5faa14b400f41ae7b56488 apps/web/src/server/product-metrics.ts
d640835c6254bc2119c5b37e1b852409a1f089ab3b1500ca92231e38a2704404 apps/web/src/server/prompt-lab-example-renders.test.ts
750e81b0f0223c58a7d301ff210c5825208e8d1d6f2e980516c28e9e5c1766ae apps/web/src/server/prompt-lab-example-renders.ts
9e226b5f90a73af3ff68ea2a9064c3c6a791baf0794057dd0b8e4afdef07da50 apps/web/src/server/public-locale.ts
374870729e3b8f7f743e04b9a05265f2c499edc06ac58e97df02069836d9a1db apps/web/src/server/repository-preferences.ts
cfcc9e369feaaa8c728b4aca7c9b95d0bfc2fa34ea83eced6686b8a4279defee apps/web/src/server/repository-profiles.ts
6c28afbdebaf159c457ca2d72bc0de27adc43fe26427004275aa0def09608571 apps/web/src/server/run-pack-imports.test.ts
0e9b4c3d0b06fb7317553fcd8fdcc2f38a3d7752884ab784f2bad85ed1761a28 apps/web/src/server/run-pack-imports.ts
b46440c600e2f2dd7951dc2add1525afd1233607502f5745242b3fd4decc79c4 apps/web/src/server/session-management.ts
0171cc65d1de05a0c4bc3009ee4648e2b6534a9baaf1084d9c869385c4a79b4c apps/web/src/setup/setup-policy.test.ts
268d107f4481884bbb2af39a940bcd9feae0b535562aa4b4a2540a182bce63d4 apps/web/src/setup/setup-policy.ts
0f223c3300bdc2a0fd413246476c207efc92882352ee06bc6f0411c9a863acc5 apps/web/src/setup/setup-request.test.ts
1149f9c04c4052776779530eba8ef0c56a6c252a7c07798b23b9d7206f1eb414 apps/web/src/setup/setup-request.ts
b52c765461762b6cdefe231c628c34ad6776c5fd495a3d3e501d8235354254d2 apps/web/tsconfig.json
9a9cc5dff883b5f7b674f452d651711928eb57ce1d9688a3dfab4e6662ac1da5 apps/worker/package.json
6cc6e6e06b5c3f314d9ab18f91ec23b3b286645f89256f90b96d6bb4730e58d0 apps/worker/src/built-in-catalog.test.ts
aab15d8b8b94e8480581cf0b5c798ab3a9754c2f69cda81cffca80891689a097 apps/worker/src/built-in-catalog.ts
8a25eea83a122c3aff370f04230d4591a577fbe62e66db1bed4ae588ef10944b apps/worker/src/index.ts
483225a8ec45e2b7d982f02c4b4dd6f9e7113e9a03881b104f46bc37cae41646 apps/worker/src/jobs/gitea-snapshot-dependencies.ts
287c7cb34fb97910556410be84462ebae9785580e843fa8d4f23961e96f22685 apps/worker/src/jobs/handlers.test.ts
5ed1242f13be445fea12503caa3155a913ec6b45bf50007328c21188a21fd8e5 apps/worker/src/jobs/handlers.ts
b22267a16c18aa65dfff09e504a2f895e4a403d1cb999236163deeb968f01f87 apps/worker/src/jobs/repository-snapshot.test.ts
f65629c10bae1caf55ebf416f65cf0495e32f8bf1c773ba6e0db799e4e092673 apps/worker/src/jobs/repository-snapshot.ts
35bd91550d59c1ed09c64c5f143a8583e36673beb624162a40c9b019ae3200b3 apps/worker/src/jobs/worker-loop.test.ts
43308d6e80ab94d06b06db7fe2a39692f96285b9dc57f804d47f5d077f20b1b9 apps/worker/src/jobs/worker-loop.ts
6ae45e0b46a42bf30e26a23bcba241de2a79d951f597fe2fdd952b46c11f466d apps/worker/src/operator/artifact-retention.ts
f6263d4dcdb3da7c4c7ce71169c1819ef3eb3bd21d01a6fdfad8c7762c7486d6 apps/worker/src/operator/password-reset.test.ts
c6be712734817292a1e3db39c2b632a424e8250a5220b96012d3709300982638 apps/worker/src/operator/password-reset.ts
6d76172c81ea5fe0c1f6e7611c60b7a8f6a656d4f81fdb691ebe674c4a841b46 apps/worker/tsconfig.json
11139a33645394ce49ba2e097d8b18e8a6749b9031127b40b6ce4a0e9e9d33f2 catalog/seed-catalog.yaml
a30de5773ec975a689fb785e7435d7b26e9408db0fdd5af622faa10c69d4bb3d config/env.example
975865d89b79dd4a195a27ee9f9266d391193b5ba8ff8913a3f4e791ceeca5f1 content/playbooks/accessibility-audit/CHANGELOG.md
f973d1c2f6e58ef90594df79c31518d5577a719c4b121680bb50cc0d763c7abd content/playbooks/accessibility-audit/README.md
8aa0890772686af8c44965403d217ddaa833267c326fc6322e30fce92d5ecfe6 content/playbooks/accessibility-audit/evaluations/static-structure.yaml
797b242ad8abb2ff4c1291f0f1c5cf9ad30c30f641a56d30e252be5797697bc3 content/playbooks/accessibility-audit/examples/minimal.yaml
4250f76d7f59c5fb9336b1ae1727e40d61e8abe21089fa2642fd8316226652c5 content/playbooks/accessibility-audit/playbook.yaml
15cc5449e2672dac6b254c5d39c9efa9772520c9e699efada99f5a609a7a3352 content/playbooks/accessibility-audit/prompt.md
40a4c9a3d0af5122b177dc91ddf6bed8b1c4be9d9cf41a3ab7423655bdd276e4 content/playbooks/agents-instructions/CHANGELOG.md
84f852fca5a1f2cb8c544baf0d999cb45d201115f85f80b7f4b417df54a5c4e2 content/playbooks/agents-instructions/README.md
f09e96a8b372376d0c335327cd1ecb7286be389a032d45237b80926c3dd93433 content/playbooks/agents-instructions/evaluations/static-structure.yaml
80043e7c16d50109036ecf64e809f2229ecb173fa67e4a2f6f3b3b6b80856eb2 content/playbooks/agents-instructions/examples/minimal.yaml
68a5929751f9844820ed5f22d25b15490ce967d6a69c6512ec5f98cf035df8a6 content/playbooks/agents-instructions/playbook.yaml
1b472e7476978ed28c83ddfaff56da2933e784916b2b79cecbbd14f65c8c33a7 content/playbooks/agents-instructions/prompt.md
e41bfca47480d53f3955ba94be265b2fb1de4d6c437cb1bf5af80b872538a2c3 content/playbooks/api-endpoint/CHANGELOG.md
c57c4982508a6d2560dd899fc8375165d88e2cd5cccff981645c5e077ae8685e content/playbooks/api-endpoint/README.md
a907160a2e7def412a925e76120357f9c720565be6af0e86c7d68ef8238d1255 content/playbooks/api-endpoint/evaluations/static-structure.yaml
767c385c1400afdbaf0832781d2a6f6d990a73e65dc9d8bdefc01721bcddd999 content/playbooks/api-endpoint/examples/minimal.yaml
179263041cb89757f83ef1de40fcc60b6895d95bb19854e861ae496c9c8109e8 content/playbooks/api-endpoint/playbook.yaml
10f68d4f2e452da5213ea8b9473208473e60bde272e3d3875c4c302d980be08e content/playbooks/api-endpoint/prompt.md
d79f15b3867e575fbbf1fd0e92fc7bd665ea1e63f419afdf802a2f80b339b11b content/playbooks/backup-restore-validation/CHANGELOG.md
cd66f5e4bfef8b55bd40fbf0fd784956dd080e978879319eba6d6801aa06f25b content/playbooks/backup-restore-validation/README.md
9323d73ff065473b08cec83d348f1c4a0d67eaf844e69ec13bc2907395c61bd3 content/playbooks/backup-restore-validation/evaluations/static-structure.yaml
4a4502de854cc04aaf14c3b3255af64bc69057f4c7e8c4c84b317f8141508d1c content/playbooks/backup-restore-validation/examples/minimal.yaml
13dd879284b3addc4051655ad4dcf646411b78091270a43606e42251840c804b content/playbooks/backup-restore-validation/playbook.yaml
6a294ef7e731c71e7a24b2c7adac015a1d32016eff93ea71bc7170fdda94ef04 content/playbooks/backup-restore-validation/prompt.md
b1d67df1cd8464a2d1d406fff7b50a7be881634b8fe5898e437c8ac26f6325ce content/playbooks/branch-protection-plan/CHANGELOG.md
f3ad075cb07442d81642d83a2c26f900d084d4dcbae42858dba3c7949a886406 content/playbooks/branch-protection-plan/README.md
0e575076087e4ead1cef31bb4c43e7955c554d78566deab93896677386b03c29 content/playbooks/branch-protection-plan/evaluations/static-structure.yaml
13f44b61206f7beb3e01e032b0209850facdfe14b3b1270389c6ad4589055b07 content/playbooks/branch-protection-plan/examples/minimal.yaml
1bb41b41a5307cc84c5d38b28594fd7983a0cdbecb8942a04b84da268122a244 content/playbooks/branch-protection-plan/playbook.yaml
59072a197a33cc0bb92ecb2238eb2c7bd26dbdc57c0d4fab03c37ea737078a11 content/playbooks/branch-protection-plan/prompt.md
3210a0b8c8c0f3f8e5247923fdd5dba6bb738e96d2f65753252448187630d110 content/playbooks/build-failure-recovery/CHANGELOG.md
4910334b8aa4b484871559b7efc599df806216d0f2a9fabb05d652249320c5f6 content/playbooks/build-failure-recovery/README.md
42937fda145438840df904a29c6ebe1ecb8bd80f833e08e9c374c859a4bdfab0 content/playbooks/build-failure-recovery/evaluations/static-structure.yaml
e55abe0b56e988a32f8109f7f1e5c4c418638dab710a9045cc34d8d55626e44c content/playbooks/build-failure-recovery/examples/minimal.yaml
6e7abf5788415e0a462d03ac26ddf720f41ee1ac1f21d26208a7295edfc72ddc content/playbooks/build-failure-recovery/playbook.yaml
4d84a5e382da044236ddac742a76bc02bdbd437f8d3231d60344cde1103f5654 content/playbooks/build-failure-recovery/prompt.md
91eb38aa86224d9f9bc517af38356f45e2ac3965df83bb8839ae716af68770fd content/playbooks/clean-room-validation/CHANGELOG.md
539009933530041d8b745c47fa53823620fcc8b10112c1041973f02cb204789f content/playbooks/clean-room-validation/README.md
2290bbd1621a2f84f565a437d90503f41f281f0d1eb57cff8f2a2a442e9ee7b4 content/playbooks/clean-room-validation/evaluations/static-structure.yaml
ca96cfeb905a70fcf75073d2b81da75425322c459ef2ef07ab1c04609f92ccae content/playbooks/clean-room-validation/examples/minimal.yaml
3f5c25489b4a3ea5860db257f9372afa03ae103f9841d4638fa05ff09d9db283 content/playbooks/clean-room-validation/playbook.yaml
649f7ea4190d742bb254e9dc9f48f25fd71b0415679f2115286a170e898fa8a2 content/playbooks/clean-room-validation/prompt.md
9ce761bc1d5c5514706bc1ef07ace8aad69980997cfb696716c9a7d6c9ff99d5 content/playbooks/docker-self-hosting-audit/CHANGELOG.md
376c39c5f27839181a4eaa6a57217ec1f02740168c7c11c3b4131eebcc5abe42 content/playbooks/docker-self-hosting-audit/README.md
aed59214d75887cf8b3875fd9ee78b1ffb38b85e981dbf8aff53160325d82fd6 content/playbooks/docker-self-hosting-audit/evaluations/static-structure.yaml
e2649b825cc48f9e6a2bd1b205e0926bdb261450e91bb71f12001036053d7aae content/playbooks/docker-self-hosting-audit/examples/minimal.yaml
30d49bdb7b6bdadc8142272c3fc4427cf65daa69839c2ed58eac82005f008523 content/playbooks/docker-self-hosting-audit/playbook.yaml
99a19c81800bfc6850490af02553554401e6b16e87643f810ae96368559745e2 content/playbooks/docker-self-hosting-audit/prompt.md
7c017b273cea4b740b4ee60e3a4aa381d2cdc0293a4cedb172b3809285e20bc0 content/playbooks/error-handling-hardening/CHANGELOG.md
7db271ea43417b66de4d300eff4af7ee50d42555ae1f842f5ef6676cb7ecbab5 content/playbooks/error-handling-hardening/README.md
6b17eb38fb2944167636954c7cfb5580978f078eaff709d326cd7a5d13c48678 content/playbooks/error-handling-hardening/evaluations/static-structure.yaml
8a6efa5438bca29064fdfd0d6ee65652d5c62c25ee149aa017f41ea0db461466 content/playbooks/error-handling-hardening/examples/minimal.yaml
d44cbcba0c1fe843d6c8457ee820e31593571ad9f30e10de2f391e6f1f11fa2b content/playbooks/error-handling-hardening/playbook.yaml
05e952b94bd402ed54f9bf1b5579c351f81ec3e797b318f5a7a9c8b1eb257015 content/playbooks/error-handling-hardening/prompt.md
bca353e4bc64e8fd06a26fa13a579727cb26a97ad5c64b6ff8266ca929c43f69 content/playbooks/feature-from-spec/CHANGELOG.md
ea4b3c0cbabc55f3d9403c2a936351ac72282943adaa65534d1ca5d7dbf919f4 content/playbooks/feature-from-spec/README.md
1293ce62bc366c9c3b6171ca4023ac800da9700729f60e628a357f3638892358 content/playbooks/feature-from-spec/evaluations/static-structure.yaml
1563b746576d6daa2c1e590a0f16164e737e950cd3477e34e777070c199c89a2 content/playbooks/feature-from-spec/examples/minimal.yaml
ae8dd8bed151da1d44c05872f02031c4ffe18e6270bf7c3014de066bf304a358 content/playbooks/feature-from-spec/playbook.yaml
586492ed58d312300935c8b69fc54b397328fd53e3f48a4a30abfaf1758c4d48 content/playbooks/feature-from-spec/prompt.md
98390e1e8ed66f5e18f34c28b45552d4ff89ba3c923e9015a14f99f44326a75f content/playbooks/frontend-ux-audit/CHANGELOG.md
6601cd94a83e9b392249c61590856ec7865aeb4511a425729eb21d839157f61b content/playbooks/frontend-ux-audit/README.md
4e124a1fe2bec5b8ed42178e183fb60bd2c5e2dd6c9a8af2ea414adc93319a00 content/playbooks/frontend-ux-audit/evaluations/static-structure.yaml
38b626926da7cb2d4718d42aceaf0cef97318d6d803b727753f664196ab69026 content/playbooks/frontend-ux-audit/examples/minimal.yaml
2943ffb46d2fffed188c876e46e77acd8412f43eef1e395ef01977ef822660d6 content/playbooks/frontend-ux-audit/playbook.yaml
37e8d1adb19232abddccdd1a9b58b7a64d9d08caa050bbd758e588d663c1db9c content/playbooks/frontend-ux-audit/prompt.md
45b81d3e69ca9db53dfbc5e06bce292535c01d17ce78399b0f07a299cd911e6b content/playbooks/gitea-best-practices/CHANGELOG.md
26fb7ed0cd0163cf8ff3df2a61bc6cc446e5bfc6fa6e2d083c35880762e67d8e content/playbooks/gitea-best-practices/README.md
5cc48919e2a5ea3db4530e29bcf2a1c4d665d8cb2aaeb823c8d6071bfa4fa44d content/playbooks/gitea-best-practices/evaluations/static-structure.yaml
a7a186098bf686bb0a63f273a4338ec6c642a98ba5c7becfe5dd742d62b7fe15 content/playbooks/gitea-best-practices/examples/minimal.yaml
5d3c65df56fd5ab3075943c81e0e0c41d832440fcd13ce048e3fb960cae59d39 content/playbooks/gitea-best-practices/playbook.yaml
726586e9b97ca847832369a0d87c5c78fb65cf388d9fdc9d76b6c5b18452d13e content/playbooks/gitea-best-practices/prompt.md
e0c41cfa8aa4a1657d11df8c17ec20e37902be34c378b4c0a42124a9cbd9c909 content/playbooks/gitignore-hygiene/CHANGELOG.md
558a3d7ae2df0c04b9a8b51bc258acf04ca20d3b65e2de28fb20badf28e22ae2 content/playbooks/gitignore-hygiene/README.md
8d6aa29e4d2e4f8ac545238563c06873119576f7af9e9c568236917710aa9122 content/playbooks/gitignore-hygiene/evaluations/static-structure.yaml
2109d50c3391fb03461aedd2029beb8c0a747b7c6f66dbae3f5a3b60617946a6 content/playbooks/gitignore-hygiene/examples/minimal.yaml
44e339fbb2ebf3a25c972a75f2d19f245dd63382527283e8cd6b3936f9bf3707 content/playbooks/gitignore-hygiene/playbook.yaml
e90972975d1f1b3cac98f7f9f3f96659e78c61c76de32ba935ec73074930f6a5 content/playbooks/gitignore-hygiene/prompt.md
65e3269928d3ebefc573b791370f073deb2e9a8ae3913b60ab2ca0d72b6c25b0 content/playbooks/health-readiness/CHANGELOG.md
5f291141f9d07191aace10544810f3a74328897ed2a1c9e3a1ab81d05c70e460 content/playbooks/health-readiness/README.md
54a00a3ecec55415ccff0ab20094c318504ca18b071ae7270f1f232ac549aacb content/playbooks/health-readiness/evaluations/static-structure.yaml
4e61ffe65aec2be6f82638bc4d79a37621e08b86c59900f0b0c3bfbed74e0372 content/playbooks/health-readiness/examples/minimal.yaml
c13e1ec5d1a9031ece4db30af25a4ffca7b97edd322f146183a7f50c032990cc content/playbooks/health-readiness/playbook.yaml
da979beb8b120970981c5a73ea7c928912b38ec0e501a883e10e2a0697f6fff0 content/playbooks/health-readiness/prompt.md
2589eb731af5310f5a3a452cb5e1fbf6e011acd67a8bafa5e274525d1f9f16bc content/playbooks/onboarding-documentation/CHANGELOG.md
40dea3a6c85666512834396d5e0c088bdc82f0f7c42f09f9e88c84198ba625cc content/playbooks/onboarding-documentation/README.md
c6777eadcd421c7830a6eb335cd783bef17d95b71e2906da85a5298bc591cb24 content/playbooks/onboarding-documentation/evaluations/static-structure.yaml
c61811edca859363598ff093a9398dc4b47842928829c9281d927771805a9ed2 content/playbooks/onboarding-documentation/examples/minimal.yaml
219d70de735998986bf753b7126772b167a43c47a067a25565a15e6ece097202 content/playbooks/onboarding-documentation/playbook.yaml
f3ec8b531d9dbbd1abd811036d9f5c1016a91a00d10bbf49fb8bcb89a37594ad content/playbooks/onboarding-documentation/prompt.md
b947a73ebc2cc6e974e9643ee2f03cfc23faa5351ddf0c97ee8ad195f9b517ac content/playbooks/playwright-critical-flows/CHANGELOG.md
2e3e95d7c6a5fe7682726f99a4f1bf38f9511da6d14ada600730efc144b49a81 content/playbooks/playwright-critical-flows/README.md
1ca0582a414b9be56cfa0131cafecd424451e058e00d8c4958f42ad45c0a0e0d content/playbooks/playwright-critical-flows/evaluations/static-structure.yaml
1f21207eac6571db752f21384c722131e5373000768cbe682bd2ebd5a65c44fd content/playbooks/playwright-critical-flows/examples/minimal.yaml
eec1bcdafb3fd9b3be1aea20fa4e1d9da7535c77a3883dc72cbd8cbc3f7d13e9 content/playbooks/playwright-critical-flows/playbook.yaml
503cd4f449984618c5cb14a63848181f9609a6b0b6500bbaf75be6acf4d89d2e content/playbooks/playwright-critical-flows/prompt.md
7a99b224b97327e81b9d744ce905509d03b5b848775478722cf07fbed719948d content/playbooks/production-readiness-audit/CHANGELOG.md
ab91202ad68982129950d84f153fcfc6c25a9c4b674b477d4baf94e27ac43c11 content/playbooks/production-readiness-audit/README.md
5d07a12369f2548d96c2fd59927a3c563ad3eaf265b040b93e96beacd1600fb9 content/playbooks/production-readiness-audit/evaluations/static-structure.yaml
a5a349cb57320946c441a8979ccaa6c338261ee0f3b096e14ae2dcedf9a626e1 content/playbooks/production-readiness-audit/examples/minimal.yaml
d293b892dcc2df2ceb2452be31da5dfd068ab5c83910d6dd0a064cab3752316b content/playbooks/production-readiness-audit/playbook.yaml
0be5e6483912274acd1a20987dc29e8bf50e9536b0aca8fe8498e3172f860f19 content/playbooks/production-readiness-audit/prompt.md
2e5ba4aaebda9d2a8eb66fbe4f67a6b7f53206cda5717259a1bd70dca61665aa content/playbooks/pull-request-template/CHANGELOG.md
692a2390389bb778f286b72d3cca982fb4d29e4b8c5a94c82a2507d7b12bf962 content/playbooks/pull-request-template/README.md
75eba7c5740cab1465999e87b33610b00bc90f3a5d56ae9545dde538c76846de content/playbooks/pull-request-template/evaluations/static-structure.yaml
8de6c685f9e326b4f316f9432fd6b8d5ae84aaba0369f62fe08d71d2f0146f11 content/playbooks/pull-request-template/examples/minimal.yaml
48902a29c2960809dfdd4eaf44ca352862f069be1458fd01cce3d955f1d963f5 content/playbooks/pull-request-template/playbook.yaml
98e57abdd81499b93c2a53e1edd33e0be9b0ebb2c00dbe4d44141098287935f3 content/playbooks/pull-request-template/prompt.md
f2940dbf00b396f962540f959bfd1942cac275476de963cf726fa13f033f2912 content/playbooks/release-candidate-prep/CHANGELOG.md
1b904e1089c8ba86a68fe625be048a746121f065546a9e00237b1517fc6ecce4 content/playbooks/release-candidate-prep/README.md
4a230dce2904c5f538c2b647693bcde89fe68d6f3878b167074b1ae326dbbbab content/playbooks/release-candidate-prep/evaluations/static-structure.yaml
ba90eb090fac7bdcad611250640910f5efd8c4c2ebe595a821333883ede72791 content/playbooks/release-candidate-prep/examples/minimal.yaml
bb607a7055a2c0c06d6c5ae6019b6675d0e8697ad078ada1c32ad8fe3b50375a content/playbooks/release-candidate-prep/playbook.yaml
485b444233d602b0bdb47a8af9f80b8fe1d93b31b7fd312b2dfe6cacb6803570 content/playbooks/release-candidate-prep/prompt.md
840fa67f9ef00bb5fe517c9ed373e93177b20b65c26d2cf69dad3e2e4141829f content/playbooks/release-notes/CHANGELOG.md
1d0adcb87b5a1e639bb7e6028e7b959c41ab0e263447aa50a406a9904387d02d content/playbooks/release-notes/README.md
5d12b529551bcb4a5a43586703627022457b4f9269538d31e9f20d3eefb023f1 content/playbooks/release-notes/evaluations/static-structure.yaml
4ce1d57d8a5b1ddb81d4f5fd7382b06cb20c3134dd21f0cca349a29e927d888e content/playbooks/release-notes/examples/minimal.yaml
813b2ea41ef5c234fc626192ab69af40fc7dfd9e26166efff8d7d2ade518de3a content/playbooks/release-notes/playbook.yaml
02c181b1a09ca26556feac99fea63d63f79534762cd930addba8037394606485 content/playbooks/release-notes/prompt.md
d5b5625c2d3891657a150ef1982f66a8a4140ddbd163296ac4b99e800a128798 content/playbooks/repository-cleanup/CHANGELOG.md
57d3edd75ebf587e62296026cfdb161768df725c700e845c637bad6d5e3a4ee2 content/playbooks/repository-cleanup/README.md
15e16455aa4d7744106e0b36bb2a7f3fc8ddea787322bcdfd3ee377fd815a996 content/playbooks/repository-cleanup/evaluations/static-structure.yaml
95405ea1ac358928bad4e3df4021a9f8fd1ee6150de80164b14e749dd950c00b content/playbooks/repository-cleanup/examples/minimal.yaml
be42ffe575a099d862540ed1c73a5a2ac6e39698da1fe52354e94dde28d9ceeb content/playbooks/repository-cleanup/playbook.yaml
23cf4ac0a7a22186377775314082bccae43f8d4193214ef1a5594823fcf0422b content/playbooks/repository-cleanup/prompt.md
fb347cad1f762dee0db158252fe7e271ddd798d28c3c6e04e3e35fe6da4e6337 content/playbooks/repository-health-audit/CHANGELOG.md
c7d2c13128574e3d4b57375b9b101c028c07acc529eeb308725dd395be9b25b4 content/playbooks/repository-health-audit/README.md
ab89bb879b58d86c578b10018342f531b1613f55c38ef613f1df8fac84f56608 content/playbooks/repository-health-audit/evaluations/static-structure.yaml
4e48fa5a8934df8c57fe98b9d4261717864c13d83520e52a18b28448ba84ba1d content/playbooks/repository-health-audit/examples/minimal.yaml
8a720ea500815cc44fa53a6e0d1228bcd5184699d8797ea79e3445f43cb3692f content/playbooks/repository-health-audit/playbook.yaml
920b5aa3d95860b65deefda17c2d602cd9d01a49c89ebf7ee1acaf00098303ae content/playbooks/repository-health-audit/prompt.md
153c9ee59c3223474a19b7187c855793d86b857aa08ac4bb5f73a458bc85b9dd content/playbooks/repository-inventory/CHANGELOG.md
9da7e28ef913372e9bf093b42d5d71de473667a0264b3127c953565e2eac58b1 content/playbooks/repository-inventory/README.md
84b55f5887e4b29e6ce711c7030658231127ee4cf16ef8ac150129569f25d49f content/playbooks/repository-inventory/evaluations/static-structure.yaml
576e2d4623a2980e69f6b4d8b1c6d55ee2f28777ef2099873d9dbeccff1c85c9 content/playbooks/repository-inventory/examples/minimal.yaml
d9cb2b8ef09a8c7bfdcea6321dc895b7e56ad63a650bb16c3877816a3fbd4ecf content/playbooks/repository-inventory/playbook.yaml
aadac1a79f4e3e30766fdceb0bb149664c72592cdb754edbb53d35f835037057 content/playbooks/repository-inventory/prompt.md
19bf1e956e309c3fd038e402149fed0d8d838e62e590cd004078a61e2f93ecb8 content/playbooks/root-cause-bugfix/CHANGELOG.md
990d07ff2b3c55efc4e416f5456c0e06f45121e14a9a0a22ad63ba25f12dfce4 content/playbooks/root-cause-bugfix/README.md
d3a17c6a66cb374df67270732c069769b3de5e3737e62e8800e2dbfa1d5b689c content/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
8567a52f921bde36d44ece4bb06cb9723536d6ad7d7d743814449f370bcfb259 content/playbooks/root-cause-bugfix/examples/minimal.yaml
d43c41306dc212d28a6f840c6e343be98a2eba64976b0ddfee5203388444ef71 content/playbooks/root-cause-bugfix/playbook.yaml
feda9c611a9c9b2ab6f7d723e3ea7d994777737a8b28e94ee9bd19ff60fac1fc content/playbooks/root-cause-bugfix/prompt.md
934ceb4bc49eb3bf3d56b5f6e5378496db5bc37856cd10f332f85e5df7be599f content/playbooks/search-filter/CHANGELOG.md
30522d97a56a49376c0712ca527818db5c6ecf5aeb898775c9de604ad8460c09 content/playbooks/search-filter/README.md
e0a3c09ae0abdccdc2853748051b7c1ee04c5f01828de5bfbfdceb73f0398626 content/playbooks/search-filter/evaluations/static-structure.yaml
3a910a2f0d27781b18f1252cd734d2f83e7339b09f3c48b66cdcc42b591eaac5 content/playbooks/search-filter/examples/minimal.yaml
edbc835c72e5f222c3407b5bf8d963c5a7ff3875953febfbddcfd0f6f3810d87 content/playbooks/search-filter/playbook.yaml
d36c24154563372a44c8b16d02e917853a247b1f6e1dcc600e4260141ff66ec0 content/playbooks/search-filter/prompt.md
08245f43d7d518b0140f288777df9dbb56b12fc4716124379dc19b2efc38fe29 content/playbooks/secrets-exposure-audit/CHANGELOG.md
3b2691ffdcf6da6f425b7a883b741b6ea0f6eb0cfb0be38fc490e57a982762ce content/playbooks/secrets-exposure-audit/README.md
afc4dd220dd347864983bdb4765e9970598badabe511b243f52eee5e4062f548 content/playbooks/secrets-exposure-audit/evaluations/static-structure.yaml
f7eed2e2602955de63285ae26eacf0abfa9d23289d09ee2ffed54096f92f851a content/playbooks/secrets-exposure-audit/examples/minimal.yaml
c7f405e68035d71b9f6b3815eb1467ab98762764b6d6c9925aedd73cf3c1da27 content/playbooks/secrets-exposure-audit/playbook.yaml
0bbf04bd1710634162186d9ff5875a6d24bb405425a842b08e295b2a854caf29 content/playbooks/secrets-exposure-audit/prompt.md
a4cc94f683a862d3837c4e2e9ff944090b88d909767ea4a783f0ca537470cdb0 content/playbooks/security-hygiene-audit/CHANGELOG.md
cd8a4c4c7375753c0ae8ebfd076ce3dad739b87fa6e9bda580acc607e4657c93 content/playbooks/security-hygiene-audit/README.md
1ff8589b5f6cd00bd4ef199605b7cb54f0810f3e5ca5eb0e3aa95c615263570e content/playbooks/security-hygiene-audit/evaluations/static-structure.yaml
8b3894d79308f6c5e66029f3a55bc027aa580947b4f23954b64a8615b62a1440 content/playbooks/security-hygiene-audit/examples/minimal.yaml
97f0124911ffebbcdec6d0f0e584e8e406099ec36352564afa05e10a4e7db835 content/playbooks/security-hygiene-audit/playbook.yaml
56d8ee3432eeb4f58142cca36bbbec9039a3e5c20e3377e9c2b26631aad92dd5 content/playbooks/security-hygiene-audit/prompt.md
efdb748cdc30e98e47f4ca1f3f19816c5975bd48b0a33348a3fa7746da30dc33 content/playbooks/unit-test-foundation/CHANGELOG.md
4ab31a04c44b547b8b40a683373eaedc6c336b491a241d551062e25439805b8a content/playbooks/unit-test-foundation/README.md
80ddaada53d9039ccdb256461555cbd641669370a031f00c1eed1912647a37a7 content/playbooks/unit-test-foundation/evaluations/static-structure.yaml
318b024a991c5505bd8fca08ae736aa93bc21a52c11210f43f7150caa7ab1417 content/playbooks/unit-test-foundation/examples/minimal.yaml
15c4dec5d6994e331a228f6ba58f4f09b3e5f455e8e9fd0c5daa86165537321c content/playbooks/unit-test-foundation/playbook.yaml
23ba52a07f7dbc4efe33e478e6ac5b6b3e9a2025ff2681793ec0908b06f031b1 content/playbooks/unit-test-foundation/prompt.md
2ea5c905c6011c6f8634ccd616a310b07512f6c9b839c9c08646e9fa81bf7d9f database/reference-schema.sql
ec1c9c7f436f44004a902934bf3ce59d411b16c810e5977dafe978f09c0bc0bf docker-compose.dev.yml
a77e8a863a28fd67745f88010f2112f59f0dc6b37c9ccaa1348dab132bc17149 docker-compose.yml
83e5aba40296dfcd1a4dbdbf1704f739f5181557b06074378e42213ad4cd6ca3 docker/all-in-one-entrypoint.sh
aa5130a03883f6ac0aaa7fc5e90d32da393fb1cab36dd542ebdf8da9ef9821d1 docs/00-product-vision.md
efc3494a276ae77b1f310deb868bf8d76f8e3719ae643db50977de1b94a281cd docs/01-product-requirements.md
4b516410dba19b75149b040643a1d4e148b90ce163baa8a9f717a99c10145ccf docs/02-personas-and-jobs.md
40c7371e4409c93ca9258c517b3f39cd51dcdce42180e11a0a7fe5f7341e15c7 docs/03-information-architecture.md
476511119d0fa02b57f2253be36320be9d9c56afdfa84a445a206ecd6868c8b5 docs/04-ux-design-system.md
d4467fecae1d0d542434474a7d8210a15b1786081c602a0c7d9348bad3afbf6d docs/05-domain-model.md
e0db9dbf952e0036c5b9528c0eaa25e103b47d87ab8c587beb538071c3e7c98e docs/06-technical-architecture.md
bb863be3c90b008c7cc8b7642dfae5236adbf275911b4a06f9a20cf9ee6bbe75 docs/07-playbook-package-spec.md
dc2e44ce665aa2b1fc0c99d7e3a8465e4842634accec1f39f28da9679cbdb280 docs/08-prompt-composition-engine.md
abb9606a287ab24177da20d8bdd43750a8e3e6577442c5d25c3d042fc60abae2 docs/09-repository-intelligence.md
18b2fd2720f968eb7c976d1aa7bc20c20d6d70db297488a8b719dffadaefd882 docs/10-gitea-integration.md
917f04c8969a90c6b3f8d41b6f2dd3da9d6599a0f7f041fac8e6915baf11a2d0 docs/11-codex-integration.md
692c0bffe5a69bdc98c2c94f4c40c2771e76ba194fd946f2d667a13f880eed1e docs/12-quality-evaluation.md
7621121ec81fb2bdbd5a63ed105b4692cdfcaa978c3aa969553c3a7138f9b296 docs/13-security-privacy-threat-model.md
fb1b1390622447415583642a772e2970075a66e50e517e39f2427f56dd5a2771 docs/14-api-contract.md
2c3426ff12550b3ee21cf0b30b1d8b7ff95c476289a1c8e2ce2a9fdb6fb87549 docs/15-test-strategy.md
d91389a8015f645c627dfed4d4ec9448291b27d5b6a35667cf96ee4ac94d6e97 docs/16-deployment-unraid.md
f0de3e01c9aa203551efd2b2acb620ba79d71eb0f4f9eb5e87e4cc4e5f236614 docs/17-observability-operations.md
8282011bc82e60ee207109a1edc26cf4fd1bece19310e2721afae9a80fc21708 docs/18-roadmap.md
90f2c597e2c83b7eaf75d44c2be671f9dd65b89d2e1963de40090f7c8cd78e5d docs/19-acceptance-criteria.md
034aed6fb1ee5a77706c76dcd13cef34f80e6f17fda5a1546f67143a16b7b80a docs/20-content-governance.md
c30a1516c24e586fe3b81109763d71b5dbc983e1659b5089420b9730597d7ab0 docs/21-seed-catalog.md
f5f9c823ef36db7002bf57b756a8ee30c2d3ea46e55f47821b932f3a200fd939 docs/22-brand-copy.md
48c025e2de2d1eef8985a4b748c82693ae5f820418b0ec45797fc5a6159d6d2b docs/23-future-expansion.md
04132b1263cad4f31785c0d97817535329d316091c0072d5aba5b32f3c5ead4b docs/24-sources.md
fec401890a83127bc5c23a18cc5f033dc98c35fc32b27c7dae91988576b9bb93 docs/25-implementation-defaults.md
e1ac0d80c5e0633c2996adf48ad5a2a1e47ca6422be8e1a8c8fb9147b238fcb5 docs/26-authentication-authorization.md
4c84091cbac541231f07f03ca37b19cde2ec3273eb16d919b712f30de9b055cc docs/27-database-reference.md
2d993a6ea93a7a0adaea4532c28c25b546e3ab10f59503bb37a5eb248cec0627 docs/28-conditions-and-policy-dsl.md
0049efc06a7f1b40ec08bf2e3b6b1cd583e787fa4e35132e1eadf325740f2348 docs/29-package-integrity-canonicalization.md
e8394c05d3d9d5ccf24818714d7670122015ab3f1587d65c63e644985b320b8d docs/30-screen-state-specification.md
b8bad7a0f8ac49eb074fe61b364f77258574f54afe3d56f037018591af124a1c docs/31-first-run-and-instance-lifecycle.md
2397268ff2bcbdcc62dc8d732f40b004a0c3f991627c22f4633c62be07bf269f docs/32-configuration-reference.md
a22c1a0f2c02e5644f6944395bfb9131818e97e5eede852ec3db06d8dfe0a38f docs/33-requirements-traceability.md
5641ec12d544bb237278fec9c048cfece45c2168f9d0519af54ca06b73cc2b6b docs/34-risk-register.md
f0a6ef787200d57223bdb94caab4bca8001633120a3ad3533765c3178c821055 docs/35-glossary.md
8bfeb094657258f04b19c423e02dbe245162c81a4314593075a6f543e3d499d2 docs/36-seed-content-delivery.md
aae9b4b23296721090b07544c647f6555ff2cfddc886c03dc86f8d8e99b3af1c docs/37-build-pack-tooling.md
5c966baf855022827a224384e2b43f2d9a42511d5374c00940b6464d3fc095bc docs/38-codex-native-build-workflow.md
e3457a941cbbd243e78ce5305a5104586f048f301d4b170c2bcf6d48ce3630a0 docs/39-reference-composer-and-golden-fixtures.md
27a1321af0dd5acb3c14b72c599fc9e3808acd0d67daf2c182133a0e7c3e2782 docs/40-bootstrap-repository-contract.md
616c3c278e7f22ca27719c45a5a89f6d5dbfd7121c6eb6c389c77af2fce00c2c docs/41-release-evidence-contract.md
8dc84fec536a71847ce847d68328ebf356e18890a72e4f0be2d6643f40963a49 docs/42-implemented-deployment.md
d59a05766915f9da84bf6af75d5dadfa84f9086975130c5f68692804911bc083 docs/43-milestone-zero-host-validation.md
52a62f095bec989223a5f4cffffa425f5864bd93e9b5b97a3be3fb0b4c156821 docs/44-milestone-one-package-ingestion.md
677a1d776c574a0268fc065f1c2249634ff84ed03262c0256ef9db637d99544a docs/45-milestone-two-library-explorer.md
f94ceb20a55d8d2be035f841923bb971deced3d25dae9e8ec98c690cd8955b7c docs/46-milestone-three-repository-profiles.md
17b2d9f2e8cac0b579ee0b5ef977cc961571ebed5871226d8f217eacccb68d1f docs/47-milestone-four-guided-composer.md
def404025ae61bb22f7fc7ba6791df33b5a23be6615653b9139dd8310a4c638c docs/48-milestone-five-export-run-packs.md
729581cdb13e305e03d333cea3b9481633e06d6e519710053fc374e914c61653 docs/49-milestone-six-gitea-repository-intelligence.md
8ab6e5054eb09da4dc1aceaf4aee38b3ba2d4f4778f7a2f699a693047b243205 docs/50-milestone-seven-prompt-lab.md
92dee28c16d2fb3d8244e52ca806d0f0dca658082bb3293cf1ee58af0bbd7a8b docs/51-post-audit-product-roadmap.md
c16970cadcb0fcb3836c1f27fb2420b4365a1e336474f642909aaf79b5cc0696 docs/52-gitea-webhook-threat-model.md
7596b8504baba6b5a8eb68b51319a7fe840f5c52e612f041f31ab89c459d4ba8 docs/52-usability-recovery-roadmap.md
b46c0f8e29dc5fd2e75105cd6a0ac66c82a0345b0a47d6f0b36534b911bcfe8b docs/ASSET_PROVENANCE.md
6d62a07c756bfec0f8bb677b843dd7f9f7359d854d2e1075c7871abc9bd5a0b5 docs/PUBLICATION_READINESS.md
a36db9d8120714af90ba467645345904f8d187684d20c87f5be52d93e5fa5039 docs/REPOSITORY_SANITATION.md
566c9e1753c9042bd1b08123a341d78b32fc148ef0ed83a428e4410f066dc139 docs/operator-guide.md
5fdb53b5036751c41bf478eb775731def6d36350fcb405345716c59d5a37b61a eslint.config.mjs
4680aca707c14cf2e0ad2517aa35153eb87cfbb0f8200990b2f6cb601506bad4 evidence/functional-visual-audit-2026-07-28.md
ec505857b3987f5710b828e08585ee142a7bc6b4102574e1868625dc4d25126a evidence/performance-report.json
695e90ca254c2be4e8404e099c06f5b0e84fa71c0c1eb5bf20dc15548dcdea17 evidence/security-scan-report.md
df6b5f088d9fbb5ee55985c1d78ffafd3db23377069b624ad59b8173206aefef examples/instance-config/example-config.yaml
bca353e4bc64e8fd06a26fa13a579727cb26a97ad5c64b6ff8266ca929c43f69 examples/playbooks/feature-from-spec/CHANGELOG.md
ea4b3c0cbabc55f3d9403c2a936351ac72282943adaa65534d1ca5d7dbf919f4 examples/playbooks/feature-from-spec/README.md
1293ce62bc366c9c3b6171ca4023ac800da9700729f60e628a357f3638892358 examples/playbooks/feature-from-spec/evaluations/static-structure.yaml
1563b746576d6daa2c1e590a0f16164e737e950cd3477e34e777070c199c89a2 examples/playbooks/feature-from-spec/examples/minimal.yaml
ae8dd8bed151da1d44c05872f02031c4ffe18e6270bf7c3014de066bf304a358 examples/playbooks/feature-from-spec/playbook.yaml
586492ed58d312300935c8b69fc54b397328fd53e3f48a4a30abfaf1758c4d48 examples/playbooks/feature-from-spec/prompt.md
45b81d3e69ca9db53dfbc5e06bce292535c01d17ce78399b0f07a299cd911e6b examples/playbooks/gitea-best-practices/CHANGELOG.md
26fb7ed0cd0163cf8ff3df2a61bc6cc446e5bfc6fa6e2d083c35880762e67d8e examples/playbooks/gitea-best-practices/README.md
5cc48919e2a5ea3db4530e29bcf2a1c4d665d8cb2aaeb823c8d6071bfa4fa44d examples/playbooks/gitea-best-practices/evaluations/static-structure.yaml
a7a186098bf686bb0a63f273a4338ec6c642a98ba5c7becfe5dd742d62b7fe15 examples/playbooks/gitea-best-practices/examples/minimal.yaml
5d3c65df56fd5ab3075943c81e0e0c41d832440fcd13ce048e3fb960cae59d39 examples/playbooks/gitea-best-practices/playbook.yaml
726586e9b97ca847832369a0d87c5c78fb65cf388d9fdc9d76b6c5b18452d13e examples/playbooks/gitea-best-practices/prompt.md
7a99b224b97327e81b9d744ce905509d03b5b848775478722cf07fbed719948d examples/playbooks/production-readiness-audit/CHANGELOG.md
ab91202ad68982129950d84f153fcfc6c25a9c4b674b477d4baf94e27ac43c11 examples/playbooks/production-readiness-audit/README.md
5d07a12369f2548d96c2fd59927a3c563ad3eaf265b040b93e96beacd1600fb9 examples/playbooks/production-readiness-audit/evaluations/static-structure.yaml
a5a349cb57320946c441a8979ccaa6c338261ee0f3b096e14ae2dcedf9a626e1 examples/playbooks/production-readiness-audit/examples/minimal.yaml
d293b892dcc2df2ceb2452be31da5dfd068ab5c83910d6dd0a064cab3752316b examples/playbooks/production-readiness-audit/playbook.yaml
0be5e6483912274acd1a20987dc29e8bf50e9536b0aca8fe8498e3172f860f19 examples/playbooks/production-readiness-audit/prompt.md
d5b5625c2d3891657a150ef1982f66a8a4140ddbd163296ac4b99e800a128798 examples/playbooks/repository-cleanup/CHANGELOG.md
57d3edd75ebf587e62296026cfdb161768df725c700e845c637bad6d5e3a4ee2 examples/playbooks/repository-cleanup/README.md
15e16455aa4d7744106e0b36bb2a7f3fc8ddea787322bcdfd3ee377fd815a996 examples/playbooks/repository-cleanup/evaluations/static-structure.yaml
95405ea1ac358928bad4e3df4021a9f8fd1ee6150de80164b14e749dd950c00b examples/playbooks/repository-cleanup/examples/minimal.yaml
be42ffe575a099d862540ed1c73a5a2ac6e39698da1fe52354e94dde28d9ceeb examples/playbooks/repository-cleanup/playbook.yaml
23cf4ac0a7a22186377775314082bccae43f8d4193214ef1a5594823fcf0422b examples/playbooks/repository-cleanup/prompt.md
fb347cad1f762dee0db158252fe7e271ddd798d28c3c6e04e3e35fe6da4e6337 examples/playbooks/repository-health-audit/CHANGELOG.md
c7d2c13128574e3d4b57375b9b101c028c07acc529eeb308725dd395be9b25b4 examples/playbooks/repository-health-audit/README.md
ab89bb879b58d86c578b10018342f531b1613f55c38ef613f1df8fac84f56608 examples/playbooks/repository-health-audit/evaluations/static-structure.yaml
4e48fa5a8934df8c57fe98b9d4261717864c13d83520e52a18b28448ba84ba1d examples/playbooks/repository-health-audit/examples/minimal.yaml
8a720ea500815cc44fa53a6e0d1228bcd5184699d8797ea79e3445f43cb3692f examples/playbooks/repository-health-audit/playbook.yaml
920b5aa3d95860b65deefda17c2d602cd9d01a49c89ebf7ee1acaf00098303ae examples/playbooks/repository-health-audit/prompt.md
19bf1e956e309c3fd038e402149fed0d8d838e62e590cd004078a61e2f93ecb8 examples/playbooks/root-cause-bugfix/CHANGELOG.md
990d07ff2b3c55efc4e416f5456c0e06f45121e14a9a0a22ad63ba25f12dfce4 examples/playbooks/root-cause-bugfix/README.md
d3a17c6a66cb374df67270732c069769b3de5e3737e62e8800e2dbfa1d5b689c examples/playbooks/root-cause-bugfix/evaluations/static-structure.yaml
8567a52f921bde36d44ece4bb06cb9723536d6ad7d7d743814449f370bcfb259 examples/playbooks/root-cause-bugfix/examples/minimal.yaml
d43c41306dc212d28a6f840c6e343be98a2eba64976b0ddfee5203388444ef71 examples/playbooks/root-cause-bugfix/playbook.yaml
feda9c611a9c9b2ab6f7d723e3ea7d994777737a8b28e94ee9bd19ff60fac1fc examples/playbooks/root-cause-bugfix/prompt.md
9fff55026cfce3ea8c9995faddba7d0378c8edcd311185b99dc3a4f11f229eaa examples/rendered-prompts/accessibility-audit.md
02437c9686948e9dce3f64785078656435e930b16a5ed13c16a49b13f40db99d examples/rendered-prompts/agents-instructions.md
b74673fcc3347d93d5d0f7931a3cd52572a5efbf78b9533afa646eac3e2f16e1 examples/rendered-prompts/api-endpoint.md
af42633cab53a064246bd8f8ebdee2ca012c7374520f648ac71a1f48d043b43b examples/rendered-prompts/backup-restore-validation.md
edb619dc8ea005c1d9fd4d16dbeef44d972e7d4780ce196ad880d4d39372f21a examples/rendered-prompts/branch-protection-plan.md
6e7c3e52ba3bd4e2e78bddd133a8d02031f9d4a173d4ec0da6c877862efcf2d8 examples/rendered-prompts/build-failure-recovery.md
dbd5e676892503899b5699d51211ab60379af089f83746448a8dfddc0315eae9 examples/rendered-prompts/clean-room-validation.md
d1ef02d1a439cfb9ebad05c0a36d089b2c39993aa02f63756048ddceda39d106 examples/rendered-prompts/docker-self-hosting-audit.md
2e4182deb790298665390ab7d02466b00a1c21b658c73cf508ee03bac14d5058 examples/rendered-prompts/error-handling-hardening.md
e14d7b6d298f39a7142889a489578402d003efaa820b914bfcc18feca426ef8a examples/rendered-prompts/feature-from-spec.md
5b75a8e53e5f2f61a7e7291934dcd9cdc0a9e22922d41d02df0e0b04281a853d examples/rendered-prompts/frontend-ux-audit.md
39f7102eeba9bd1868323ef265009330e1945fafdd25b968651ed59eb547f61f examples/rendered-prompts/gitea-best-practices.md
5df9046dd7c90d2253fba50bf189a9c825c724cc31ec3e023bae4df212060e08 examples/rendered-prompts/gitignore-hygiene.md
e65a24daae6bf56064e54456acd8738e482eba3f18884453ad215c8021c7260a examples/rendered-prompts/health-readiness.md
e8b7c28a516c1a29f9f23602caa5add079832d6f96d32e7eddb415ad0ac98204 examples/rendered-prompts/manifest.json
2efd020a4164c2db41a501530f4e82b279d3e94787d2b01b4b11e70301210ffa examples/rendered-prompts/onboarding-documentation.md
2ea865cafe830e01b198254c14a6bbbab24817396885c60ae713d18670068dc9 examples/rendered-prompts/playwright-critical-flows.md
ff916229b3cfae8cf2c39c748f7bad4a5a6b5187b93727a7b2347823f6b57187 examples/rendered-prompts/production-readiness-audit.md
1ea40457bc3d1492cf29eeb239e3bca5e2ceb044513155d7b866b93f41ff00f9 examples/rendered-prompts/pull-request-template.md
9ac6bfb4c4b472d017242759b9c2fd68a859fd29c80f29c6a23206a87e01b2a1 examples/rendered-prompts/release-candidate-prep.md
a71952eae7e6ad9cdd6f05ad64bb9efd5243579f73c45d971c1fb9fe0c7bb829 examples/rendered-prompts/release-notes.md
450edceb3ae2ce71bffc79c390a6850f98da3e52b5eabcf7f9edb37f0f81acba examples/rendered-prompts/repository-cleanup.md
cd95f265417f82550313c4b81cd0de63af258882d2b3e4bafed82bb0c92f05ac examples/rendered-prompts/repository-health-audit.md
720e20f0d4e8630b3db7453844cdba3d1e5b6457d29f40bad6f3692a47515bd7 examples/rendered-prompts/repository-inventory.md
8389b948158cc35fa1716e170c9893bd3939dc3aaad9311971b6c267f835ae1b examples/rendered-prompts/root-cause-bugfix.md
9459c1063454d468fd40f9f476bb76f687469808ca7235a008f301aaa1fea2fb examples/rendered-prompts/search-filter.md
0b0399ca190055fe94443a7ff4d2018f3a5f2c4a19ac1fe07b0850afd84739c7 examples/rendered-prompts/secrets-exposure-audit.md
e90820c822cc116e7c1014b1aa2b2c72af4297830231bea5947473505cabc348 examples/rendered-prompts/security-hygiene-audit.md
83352d3e51ba902cd07391cdbaf50bdd7220321be567cacc502412ad292d2a17 examples/rendered-prompts/unit-test-foundation.md
9d3cb96e38cb5d9170d49f00a028c061c22a54865b572cbfa607ed3f146f0490 examples/repository-profiles/example-profile.yaml
ce5809aafd05d58952cf273992440fc42ca55dd9c8c8e563f8a31a434a3f07bd examples/run-packs/root-cause-example/TASK.md
85dd6148501e2256b7479dd8711317db2526a84f1779aea70bcb9b20a17ca21a examples/run-packs/root-cause-example/VALIDATION.md
b7aaa535f96a09629525cef0eb219a7af1f7befdb65af3a6687d64e2806a5e3f examples/run-packs/root-cause-example/manifest.json
3eda0f5796f240f98983966052823f43a6973cf0d7614dd20cd0c8cc19e42ea7 package.json
f27d0f8dbf91b5ff53495dd9c5efa862a6b152caafd1f94d309d93966b75ca90 packages/application/package.json
264938b89693441ea63425a62ab58f894b276c0bf632cdd6918ba334d74c8736 packages/application/src/artifacts/export-generated-run-artifact.test.ts
da4bf25f06898c5319b2b14e0f093d6c97b87a8f2bc1e632a6bec3d6e124b8d5 packages/application/src/artifacts/export-generated-run-artifact.ts
21918240910818ede458ad8e590f0cba5627007805e92325d101d7f103d1790d packages/application/src/artifacts/generated-artifact.test.ts
a94f31fed19f02cdc619c7afbb8ff62a5bc85b1ac6ecebfff22f708deb74b942 packages/application/src/artifacts/generated-artifact.ts
0bff2570eea0c87beb059992ebc1900ffb309da2200f15b3aca133c8c3317272 packages/application/src/auth/auth-service.test.ts
40ab025dd0bd240a7edfcb77e61fab33ba33a94973125363f073b57d26914dff packages/application/src/auth/auth-service.ts
f943f7063c03ef533b9385e18f24a289f15e9c2bede08da9819be7d7bcd74e18 packages/application/src/auth/invitations.test.ts
6f444ab7c32c04eaed8a9efeee83853f50836c03162d93103dea413cc692809c packages/application/src/auth/invitations.ts
5efdbd5b03035ca3301bda2544a314772e0c5cd555cf19621f35143bfa89059d packages/application/src/auth/password-reset/password-reset.test.ts
f0732591876b0ae4c18d7776c2ee1cc231cf69f238b9f44500eed1a427b325a2 packages/application/src/auth/password-reset/password-reset.ts
42e93ae87662391c7f61e60d0acff22c77123ee34c9d548c5edc7966cc8895b3 packages/application/src/auth/session-policy.test.ts
39cfbc924519fdaae97621d1460818b2b892e9fd6d903cbe46ec31ee6b2d3932 packages/application/src/auth/session-policy.ts
096ee60552b8c09bfbd3188d1ba47373ddf467bcbdbe7c23752cfbf0ac0043f8 packages/application/src/auth/token-digest.test.ts
d3083f9e417a98012a96f4c4aa83ae930479584f836afc5091c38577adaae7fc packages/application/src/auth/token-digest.ts
5ac6629fb787e7d971876ed1bb6e3517ba5c245c667991d712a5e330f3e6f756 packages/application/src/auth/workspace-authorization.test.ts
6b6a5edd2290ed2eb72d7f820edffea9bb12d927bb89a6ece02030b61c495363 packages/application/src/auth/workspace-authorization.ts
6b6b9d3587104e92f9c329a746434c1ebd7d47796fd93b3e98bbadfa5042becb packages/application/src/composition/authoritative-composition.test.ts
d6c8bea0a96aa48d48a3ac18cea7ba44908989b6f1c8140769eaceb6e7749165 packages/application/src/composition/authoritative-composition.ts
97f6e8a7752cd16a07f902c8d176e44295eab276cf27ec7e58dc771a336fdb48 packages/application/src/composition/compose-and-create-generated-run.test.ts
7cf2fc9fbee5016877c0368dd627bab2f47519ab53fd5c474be4f765995e0746 packages/application/src/composition/compose-and-create-generated-run.ts
d8b2ea3d087f1f4c2cfe6aedb88501204836d3a8e72b58df6946268ba9be6c66 packages/application/src/composition/composition-drafts.test.ts
322980a9e2f5b7218567f3fa307664912687cea943ccb0db1b93cfcf4ec9d9d4 packages/application/src/composition/composition-drafts.ts
cfdd03c7514d1adb8a33db010cf3a4d15668a7c64c210a900739525e31e2434a packages/application/src/composition/generate-composition-from-draft.ts
6244ff31bb6784f5791ae1682bb40d6aaabb9bd343f1e506a7465ef66631b4b3 packages/application/src/composition/validate-composition-request.ts
46806138603c6878da38bc50b99522142240246fe14a8a66c98728c9669615f1 packages/application/src/generated-runs/create-generated-run.test.ts
8d4e053dcc6e9448fdcb12ed738e920d77bd5abc809cf68c02469350e0ee28c0 packages/application/src/generated-runs/create-generated-run.ts
afe91e1041835f795acc02ac0bfd46cb88682191ce6396ef44db5fc31398d56d packages/application/src/generated-runs/get-generated-run.ts
e70c06cf948f5ace410d9b25c48e5951edaaf30c0cf9f8b9d76e869733c5e1e7 packages/application/src/generated-runs/list-generated-runs.test.ts
e6e7ccb2b833267f9b83dbfd341fb08065dfe67998288b31171a141568e924a7 packages/application/src/generated-runs/list-generated-runs.ts
3e1f1dfe0589c7d247bc9059678ba7672ed6998d27bd9a89f674715f87ce3220 packages/application/src/index.ts
3eeb8771df59fdc96b20397f141db49e35982f721809c2af0d65e0f95dc4e75a packages/application/src/integrations/gitea-connections.test.ts
7acfc3f4d6d942f46da7f29e791db1f72aa622d81322b9338588cdd7c8d35822 packages/application/src/integrations/gitea-connections.ts
a99b7bb86498dd4a6d5daada77e93bfecb72af51405c05b311b1926e0365f53b packages/application/src/integrations/gitea-repository-import.test.ts
10a5325087afe7c27e54a83a5671bfe37dc379a79dedc061aecb597b6fa0cc4a packages/application/src/integrations/gitea-repository-import.ts
77376f0a2b93044746c1f8efa2691b934c7f56572e5f3fef4a73a0c42ede3154 packages/application/src/jobs/job-queue.test.ts
655491257b4ce20651cc097ae46bf5aa60520e593259300e6b56d2c43025e9c4 packages/application/src/jobs/job-queue.ts
51864ffcc87d09c7f8d2e084f9b5c964e2ea84bd60c27006059296cc0f6d0bba packages/application/src/library/playbook-collections.test.ts
5672846037b562be38ca5effdbd7eedcfc2f8f1d21c94f747f6f62d1d664891c packages/application/src/library/playbook-collections.ts
d07d6df820b7cb6cd05ca2840c1f239948989eb3912a506f74bf616887d6eb86 packages/application/src/library/playbook-favorites.test.ts
0db0cfda3a141b1b31b2e419883d534b16fc56133be97f64faec2ec69b0c2f7e packages/application/src/library/playbook-favorites.ts
d39caa72a3026a77094ea0c40a7befc6fbcb8182ed768c4d5536d546d4ae3b4b packages/application/src/operations/operations.test.ts
fc20a283ea937a19b4716fd01daf4cecebbf2d671ae57b9063ccae0983ee9b5d packages/application/src/operations/operations.ts
de941af03408bf26f2576091371fe32261155b650b766cd076df10573646e769 packages/application/src/operations/product-metrics.test.ts
fbe6dbd36b1f213438cb1430902ddee79b5d8b17ae796a9e58a6a20a64e12bdb packages/application/src/operations/product-metrics.ts
7a6536211a9256de7fda0f4e377213b85ad338443b27ad14c7aecc8dc02c4b72 packages/application/src/playbooks/import-built-in-playbooks.test.ts
6a61b1753dfb3bf605e4ac37b48bf6ed339775b4b3f8aea058de104ed63b2258 packages/application/src/playbooks/import-built-in-playbooks.ts
3bdf8eaa6a9131d30efc806c9ebbc04777f392adf8113f9d4b23b3d142c0f986 packages/application/src/playbooks/private-playbook-drafts.test.ts
4f563ed33e4e8a6a2237eebe8c782d95b31b75776e44f7f32dc91c58d2be40a9 packages/application/src/playbooks/private-playbook-drafts.ts
cfe0de0849103b9abd890230c442a4503b95babbdea37c1869f58baa3a6700ed packages/application/src/playbooks/private-playbook-publication.test.ts
a02fbb69b07342c59950c75183809c6e3ec0d654910153745e7fcb69c4f515f6 packages/application/src/playbooks/private-playbook-publication.ts
a90251552439c02779a73ff6a3c4f3d1c7d233d25cbace4c264f268d2dbc6f06 packages/application/src/playbooks/private-playbook-quality.test.ts
c2ba0c4dacb7ec6ab57a68dff39cd3b3bc9746fd914a198554b621ace160cf65 packages/application/src/playbooks/private-playbook-quality.ts
622b4fc1f3a4ca901f071282782eb99cc3d3ec8121cedf5287afd8056a6b95a9 packages/application/src/quality/playbook-package-linter.test.ts
e4ae7d29f63a4a36d7bdb20c71d48f45ff59a829f1672509aa36716a8e4942df packages/application/src/quality/playbook-package-linter.ts
ecd9fa8a1922e812bcba2168c7501b100e9a64794c79d0b1e7625a3a482f0552 packages/application/src/quality/static-quality-evaluation.test.ts
106ba98a0cd1aac6fa4ab2ced17b2abc85fd2e6f12b086b6c3b543dd79eb5d84 packages/application/src/quality/static-quality-evaluation.ts
06408e20df74c520443592b8784efe977b2c4ccd2f5892f077f566e29099101d packages/application/src/repositories/repository-preferences.test.ts
afb9a47a72f3a4f360ec3f4dcb06b35351d0febb5976db1745646e6154d3b2c7 packages/application/src/repositories/repository-preferences.ts
58af3760b4370dbd82a400a49c0c8c01f41fba3c224755a05f4292ac6d2e785c packages/application/src/repositories/repository-profiles.test.ts
4a04db12347cccd98c1caf412c3749807354e48cc2dc7975e03f321f6e725e24 packages/application/src/repositories/repository-profiles.ts
29e3806e6b526b495457ef5bc353f6549e4db1f9e5d90c897c486e25ffdb3f29 packages/application/src/retention/artifact-retention.test.ts
1a7e76ff8e35e3cd90e3cab8c968a26f5b3f90a066cda0b7b37d938f077c2465 packages/application/src/retention/artifact-retention.ts
ece849e32773d7f2c4d8f3460e7e025da7fed59963330fd80817c978b090f013 packages/application/src/setup/complete-first-run.test.ts
55bd3069eec6422991f8644c9974c07cd3e7045a1a68747d6fe7405083c7260f packages/application/src/setup/complete-first-run.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/application/tsconfig.json
a4d16b9b557721080c453e80ba4bc5b058626d8b568ec4b11b4358e486ed87e6 packages/artifacts/package.json
ac13e1462c2fe5f1930c49518f097833b78648291c41a9dfc6221e59db7efc8e packages/artifacts/src/agents-suggestion.test.ts
5d775a282daf510717e2d6df901b1803e5d0eb2eb6dc986cce9afd46cc0d0c12 packages/artifacts/src/agents-suggestion.ts
fac6f0d8086d52ae300ee0c7e570284bc3b09dabf4323243cd1e642870e4bd3b packages/artifacts/src/index.ts
45afa567c9df3f3434d3fd37bf2481bc04af8d4b75956790b9f889d12ecf759f packages/artifacts/src/local-artifact-storage.test.ts
08886e9e4fd54ded83383d0d4f2daa07728263392e2e7ac26448c5167205e3b1 packages/artifacts/src/local-artifact-storage.ts
769170eb504cd6f1df6025a83a183505590f8ed944e0968311746833db16f201 packages/artifacts/src/playbook-package-archive.test.ts
235d0d1fafe72d2bce9db192fd037a3bcabebc092fafbe4ff01eb61a041ce036 packages/artifacts/src/playbook-package-archive.ts
b5561b4c5d99cafd62be7e137385802579d4eba38489cbaca1c5dc0cc6c62c26 packages/artifacts/src/run-pack.test.ts
aa0fdbfc91fa7bfb481304bf3615c435293ffef67caf679da3c4a056518c4789 packages/artifacts/src/run-pack.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/artifacts/tsconfig.json
891e59c3ec4d6e0c3f0ecfcdf654b9fd32be6ae5bd3807aa09d41fe9e3b123c5 packages/composer/package.json
9dd6d1a9fc038ad1b66dbdd8a9e326152500231c461c2f3f27bf4bbd8ead02a0 packages/composer/src/conditions.ts
8b3c91af74e26f921c00ac5a6518f4514eaefebb6f41369bf43d8a15726c4b9d packages/composer/src/index.test.ts
aa42e2cf4db0eadcd84abd9915835589e79d4a3cfc61cf1e73affc0e5a000d3b packages/composer/src/index.ts
62388efe16f45596e27af02552619c8e69b39d569a44c28fde14075b31ae8a31 packages/composer/src/resolution.test.ts
b3f000acff8e40216b77b611001b9eee017464776bb2061ba9c24c4acf1e1a3c packages/composer/src/resolution.ts
76393be48f351d9502e56a2b5d0c248f1e385311fe5bce87651e4542606d3e84 packages/composer/tsconfig.json
ab40c40f8326fa31b4fdd1e111e0ff66c901f7fd54d255442332c8fc908405a4 packages/config/package.json
9ea2235579363895ac1c7fc6207e8ce9213eec08d24c188cf761ab06d4b02c63 packages/config/src/index.test.ts
460c17aa9dc0a6de795d3f9f23ed26f9616ba993d00739a94cb03b7b997f4e9c packages/config/src/index.ts
76393be48f351d9502e56a2b5d0c248f1e385311fe5bce87651e4542606d3e84 packages/config/tsconfig.json
27f450ec4e5d8c70a3563ed41c8e6c2fd99dfdbb80843bdc64f32c12cb21a74a packages/content/package.json
0218f60d52b0d92a7b3ac9c089689919da561508bc3a4056b74204a7ea177084 packages/content/src/canonical.ts
f0bef45331bf91947579c4acfd4b16f39f1822560c3239fffda52d7b233a3cbf packages/content/src/cli-import.ts
8172b108489853bc18dd2db851e28c948ad23790b5021d60603bf98f40779d59 packages/content/src/index.test.ts
f601ec2abe2740abba168ee7455ff87f87d23a321df69d9de7cb47d3b8dc09c8 packages/content/src/index.ts
8d3501800d6f6cc9711651ad7f4fc8d10f7c3c1a6545bed0f016b4bad00380d1 packages/content/src/loader.ts
76393be48f351d9502e56a2b5d0c248f1e385311fe5bce87651e4542606d3e84 packages/content/tsconfig.json
bc7096f96faf34a25eb5c565a5233065baee359c7bca5c56383cee22ba606445 packages/db/drizzle.config.ts
b526c457bfb0027123302940b525f47f60a49abf17d867013cbfa5f36d51c87b packages/db/migrations/0000_jittery_wind_dancer.sql
5cf2bc01ecd712d87ce2c20dd25b4d3b51e567ebeb4ce2c2db41ac20c7861c11 packages/db/migrations/0001_daily_mystique.sql
2c2952a7aa811b4df420f24f28bdfca693fb7d5d9ce2b8d3188b9227cf1d1eb8 packages/db/migrations/0002_wild_wraith.sql
976572ceada611ea4b88469ee3a8534ffc890fa181d6685864e3ec6ce7c1ac18 packages/db/migrations/0003_polite_kronos.sql
18ef039221fa217cfaef2a8258efd4179278045388a5ea45290ae6972441e51d packages/db/migrations/0004_gitea_persistence_hardening.sql
1df8199b8ddb6e8321e552314ac24e3aca39de636afde27f5e3172b3a053f0d8 packages/db/migrations/0005_luxuriant_changeling.sql
46a66c9d691e0dc887fe6e281cd7f993300f4b400925897eb566d7b6f103778a packages/db/migrations/0006_worried_prodigy.sql
8ff0aec9fc383067c7d5e70e8493a172339db912df20f5d66ed5c8c868d10dac packages/db/migrations/0007_lean_jack_power.sql
50bbf2f3a2ab7c407312f8ec51cf9e65a9e01e764d5b5294514dcaec833924c4 packages/db/migrations/0008_third_menace.sql
835be4f58a34e1f802d436fd790e6c08c71fe84ed6e45645303fb313768ab7f8 packages/db/migrations/meta/0000_snapshot.json
8908caa48b8bbe4ac228a3bfd82d01cb718a25bd00bf79ff02e11a29d4a04b55 packages/db/migrations/meta/0001_snapshot.json
a03570430a9df2e8601b90fc3727c1bd6a705ff2ce7388c4917672758020b4cd packages/db/migrations/meta/0002_snapshot.json
8ff639457d1b9f639460743c78fdc35007cf3075c48b3f054c5576bb47cb3694 packages/db/migrations/meta/0003_snapshot.json
3cccf16c8d5f9ca467e94c9e9d8d7afdb54245e057fb30775e8b521f7ea6c657 packages/db/migrations/meta/0004_snapshot.json
7da6f59413fcf4149a6e9fc10e6add4f81840d3748b8663756f33dee6975852f packages/db/migrations/meta/0005_snapshot.json
b028634e739974f25e8d06a17da7e246d895ccd520c9163832bbedd7eddd84c3 packages/db/migrations/meta/0006_snapshot.json
2fb0a8aa70dd7d6cb67be1e57d41a192dddd5d803d5d4a510db6dae94c91c8e8 packages/db/migrations/meta/0007_snapshot.json
929c2182888ffd4ea76b748443ab4936ca73db16b2f99c4fa5cebff333330e7a packages/db/migrations/meta/0008_snapshot.json
75d5cbbcd721218653a3bf22d9e002aa126aa4a51ba0570cdb8aa0abd7e9652f packages/db/migrations/meta/_journal.json
205b0ceea8d81f72e83e723f8096187cc4030a41965aa7c1a588e475ff6dac7b packages/db/package.json
58791614d237516860bca51a4d7135ed52ecdc73477593d524021fb9ee5faaba packages/db/src/artifacts/generated-artifact-store.test.ts
29c0879f5988d48576846ed946a870ffa790715c851bee1ad0cb2065fd95216f packages/db/src/artifacts/generated-artifact-store.ts
04f6ead50ed36332c3ffc662888a6c89aa2c9a43cf2309d989fc7a1a66a67a13 packages/db/src/auth/auth-persistence.ts
39565bfe38a0abedcff5158ca65b6ef0fd5accc52cf39d67e359f140e1ab5ae3 packages/db/src/auth/invitation-store.integration.test.ts
cacda7e98e68a076c669c0d178349b348a7ac5d29cc6691d1e65adf1d14b0587 packages/db/src/auth/invitation-store.ts
fca53acb929ee0cfcf2296edc5f5dea374a0a7abc94bc412cd94cf799ea15a99 packages/db/src/auth/operations-actor.ts
feaac01845a84d2b82fb06c31b1caed7073c9396b1e074579343163608e37069 packages/db/src/auth/password-reset/password-reset-store.ts
4188c2afc0f63bf09efb3e46caf3cacd64779b553d8a901fd0102ca7040cff51 packages/db/src/auth/personal-data-store.integration.test.ts
84cf7b4e5cbcdd590d29b463e2b533b6e42e9ec95dc9f38fe85c32571a2279b7 packages/db/src/auth/personal-data-store.ts
81de2d2187f0fa40b1f618da6da25e24e4199e8900997e58a763dfd675d70753 packages/db/src/auth/session-management-store.ts
a8a093ee80fd49324bcfe8102fdae1456f6f3bcd28e855c920daff985e17821f packages/db/src/auth/workspace-authorization.test.ts
286c1d48207d72668e046622c37468d840e36b6a2ca889993f9258b95753b0f8 packages/db/src/auth/workspace-authorization.ts
fa047e7a60b52070a714f21e4f6f61deada11ff7c1da47fe556ac4c63aaab0b2 packages/db/src/composition/composition-draft-store.integration.test.ts
1c9e59bdf6a4414fbc69fa2d30fbfe0ab7b6cf4645905c4377fa6a038e7d89b2 packages/db/src/composition/composition-draft-store.test.ts
8a292795e67e9bbdd47e8023fb6f6bcdd1fd412d035b36908be76e02c1bf3954 packages/db/src/composition/composition-draft-store.ts
3880bf721017db7fab94e63ced300334c097fef9fac4289266fbc40a5815efa7 packages/db/src/composition/composition-source-reader.integration.test.ts
8152d74930e525a3caf56eae9e9f581f03a01cbda48ef933e608bdff38aaeb85 packages/db/src/composition/composition-source-reader.test.ts
1594510827257fc984c7aa28f9d5416b84361bde7e05017fab4eb8cbf775cbd5 packages/db/src/composition/composition-source-reader.ts
6601d1e78963c7f6c584816e687772da997a4258bc2d8540d4eabece6e521bca packages/db/src/generated-runs/generated-run-history.integration.test.ts
34ebae61e045050d9ae7f612d745bd09f8f57a08495f39991f53e78f7c097f1f packages/db/src/generated-runs/generated-run-store.test.ts
fb05f5a8bd6b82e8d2f56cd196188b4a933d8f5fa595f397dcf88b9e23261946 packages/db/src/generated-runs/generated-run-store.ts
17b28fa8ce4aa910ef039e4a92b865731f560110200c3532007d10e0710d9327 packages/db/src/index.ts
08e2696dd215b21bd255d9abe6aa93531d7d83e346d8be77216144d7b24e2cb4 packages/db/src/integrations/gitea-integration-store.test.ts
87bcd922200a3cc6033c1c3987aed78bc951160e55ed8b21ef49c647aff04736 packages/db/src/integrations/gitea-integration-store.ts
8a3b2760dd64235449ede6f41799f5f463c33834d0556bb17b026126b26897f9 packages/db/src/integrations/gitea-persistence.integration.test.ts
449bde009dde6c24086553c53810142292b41c67f15c81aeab2e943ae62797dc packages/db/src/jobs/postgres-job-store.integration.test.ts
9e10c4f5e3a9ba1009739a987cbebe4a0754ebc10ccc09a94509dbe1e9c52051 packages/db/src/jobs/postgres-job-store.ts
8229c5e15679dffe8fb4eecb367fbb8d051531e05e3fd7ef22417adc4c303d19 packages/db/src/migrate.ts
f580db7059d8d6b31565524e8185b95095934b286b715b119a93ca9d226accd9 packages/db/src/operations/postgres-operations-store.integration.test.ts
579c551179760ccc41ec3e570a6dbada9340bcdf63c962cfcbcc1be71e9ada42 packages/db/src/operations/postgres-operations-store.ts
cd0f319fc7bdfbe3efbe7b16b64cd2ade0b9688f14ac0d8c51cde76c6b642539 packages/db/src/operations/postgres-system-status-store.ts
42dc0ed2a7bb7d6270984f37d4bcf20693f61647e502163dcb1fb8e05ccd615e packages/db/src/operations/product-metric-store.ts
525ad3f6198965d8f2db60fcc4d150ef71a3be3f20f34b47a27e58b81c18a224 packages/db/src/playbooks/built-in-importer.test.ts
e492fa46ce997c4150c6c93a30c9d795b44cabbd48148ba875ac9ec0198f2f68 packages/db/src/playbooks/built-in-importer.ts
3def833bbb4e26ee979ee62453722ca07e5f8f1479f8e7abfe63ce6a17e383ef packages/db/src/playbooks/playbook-catalog.test.ts
9216a1f124bad4437574af92eb0cbdd452cd7fc0fa00583a71edb8867b605da5 packages/db/src/playbooks/playbook-catalog.ts
0993b5ce086fb5eb070e868e00552add340d1849a7dda21393151328b70468e6 packages/db/src/playbooks/playbook-collection-store.integration.test.ts
4bd18985eaa79593057876317f861e30bc0fa8fff515b5af153e173f592065cc packages/db/src/playbooks/playbook-collection-store.test.ts
d7fd602ba025a60eb4690fc7c003a54fee69d66144af1f8b6b10391219d66414 packages/db/src/playbooks/playbook-collection-store.ts
d943ac9040632ca58da08cf311f048e24c14578f0c69b39ee24fcbe409b48cc5 packages/db/src/playbooks/playbook-favorite-store.test.ts
8959911cda62bb7a1812eb38bb0d13eddbd2c1b9fbfb0adac92656ce9052fd73 packages/db/src/playbooks/playbook-favorite-store.ts
8077c8b50606395983cb8a6d1ccbfae6bf9758ffdceae9e9066f0da5f6b602d9 packages/db/src/playbooks/playbook-package-file-store.integration.test.ts
cba1b86ec12e9568af332f52cbb52f0cdb031a9c3b4e029d677c580be105c38b packages/db/src/playbooks/playbook-package-file-store.test.ts
f3728ac84a201aca8ec2af8e5c89616786d1c528a36209a356b0147bfd778292 packages/db/src/playbooks/playbook-package-file-store.ts
02a734ada258508644e41a2135d5dccc61b9c6af7002f64867275e9df395697c packages/db/src/playbooks/private-playbook-draft-store.integration.test.ts
b10a0cd0ca15269e61fdacc49aa3c9c27b3f625f428ad476b742b67c3612ba04 packages/db/src/playbooks/private-playbook-draft-store.test.ts
95456b6f5160ebfe01c31a00c064586754fe491ed0a51e4f5c0bd5e8a1fab1a9 packages/db/src/playbooks/private-playbook-draft-store.ts
13ed8331d6204d45edbc964e839035ab630a41a0a053ea89f3288babe9cffef1 packages/db/src/playbooks/private-playbook-publication-store.integration.test.ts
621b65145a6832e2116a73cfc8745b1a739760e83b57956a6f3684791407febe packages/db/src/playbooks/private-playbook-publication-store.test.ts
5fbc0edf0181a8329c5b398d383f657c52bcc578d68a19941469fadf4f90cf23 packages/db/src/playbooks/private-playbook-publication-store.ts
2cdb17ae7f162476b6864942069de9f0898e89c515d8312efe308fb69cb23058 packages/db/src/release/migration-preflight.test.ts
c15d6942c612995de345babf2fc503cff5e45da454f93e275a7073bd77bc1b01 packages/db/src/release/migration-preflight.ts
fad2b452a96fbfb1991f710243dc2abb8e353f4b02a8f277dcd68f1c9f79e2d4 packages/db/src/release/performance-benchmark.test.ts
fe3f001565714e0b386e8799b3f149f3cbdf770b191fcf47557278560227546d packages/db/src/release/performance-benchmark.ts
d3e635e8f3a89544925937c59062c6fc09320ba248cdad20be8ffa35089c3c71 packages/db/src/repositories/repository-preference-store.integration.test.ts
efa3acc9d5d21a533ffd7e8c3ca5875257793b34324c1d34451d0117c9cde0c5 packages/db/src/repositories/repository-preference-store.ts
458abcf93cc211a0952601a286881401e702ec801d7e4425fd56cdf5e306da8e packages/db/src/repositories/repository-refresh-scheduler.ts
ef8ac00e6bbfed3266ad7af046f3b985b748cccb3769f4477a3cbfaad680095c packages/db/src/repositories/repository-snapshot-store.test.ts
c968a9a3635211d7de8b23fc5bd8cc344e41762dd14e3113555cf2b18f2693d9 packages/db/src/repositories/repository-snapshot-store.ts
05e219636204ae3d5cd0e61725e0e75549a50f3c439529c622c5222270a99772 packages/db/src/repositories/repository-store.integration.test.ts
5f33c4f555a4a8b8190cc89e88a6e25aee6c51428f8e97fb6f4bb3337364d2f0 packages/db/src/repositories/repository-store.test.ts
b3de15ba84daa4559bd22c35690f13df1911ad5e59734907c50941f9acc65572 packages/db/src/repositories/repository-store.ts
e1de9812bb1fc634afa969280e1dbfc8220b0e24f5aff09dc84ccfd398ceae4b packages/db/src/retention/artifact-retention-store.ts
20cd9a26d1c74f39748470c6be706972ac7a0ff696073f93a61dd40e0278c061 packages/db/src/schema.test.ts
8b1daeeb46748a24ee238f7ded66040803ffed1d0ef9fb68afca67da4a5d3f16 packages/db/src/schema.ts
e0747f689551b029853926fbcc8183231b02ca547bedbee182c08fd57ebb23c6 packages/db/src/setup-lock.ts
4c3464c79921c4d4de30775c9ad79c26a3b788316c465ac7e6ff8ee21e51a996 packages/db/src/setup/first-run-store.test.ts
db370d092efe87dabc5960e1e65a69cf733476bb1d014662af01a5a242e6ce4e packages/db/src/setup/first-run-store.ts
c617f32541554cfbf5270c3beb804443b6f14d5a3ad823aba39d48461f0b7fd3 packages/db/src/setup/instance-status.ts
341a6d84a7755e77ddc447bc9dd9428a5937af44287d1eebb11500d123986959 packages/db/src/status.ts
76393be48f351d9502e56a2b5d0c248f1e385311fe5bce87651e4542606d3e84 packages/db/tsconfig.json
b7ee9f0f72893cee20f24f3cdf7c33a2983a7431d12f4fa1f16d624e65e71b62 packages/domain/package.json
bf01e15bb20e7efa10da105c52fe795abd9f9dba59777b70345535e5cba312a8 packages/domain/src/index.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/domain/tsconfig.json
e9aa4138ba877be46a3ecc1ab442c1fb5fa80ea0650f3400de4377a178d4aa32 packages/integrations/package.json
9afcbee314e48744107e95adcb092a58801156b125980753e8f7f7539af00734 packages/integrations/src/forge-adapter.ts
184e659ba525675db447c1da6476eea91a5271c1cf492297f5107cd83813628b packages/integrations/src/gitea-client.test.ts
7b54d241408ea9510e5a663d84d73349eaa6236ee0b6abf63f50f20284dc0fca packages/integrations/src/gitea-client.ts
920413816f5c27814e8bc129ee450263cfa327059febac0a60d8ca4ff549576a packages/integrations/src/index.ts
bdf623cc36751b48abf15c3111c717e274d97c3b2aa51ad49855be253030f4cd packages/integrations/src/network-policy.test.ts
8d61e2323a000be88cb9fa856f618a56fd73e56c7ce953751c9df78a19b99b5f packages/integrations/src/network-policy.ts
6b41581ab77be7cf7d3cc8e98f32ec9cc0f103a84e15b610eb5593147db20c49 packages/integrations/src/safe-http-client.test.ts
261006db59036e1f85e318d292de85459a40989646a1aeea5825e5ffafacf103 packages/integrations/src/safe-http-client.ts
90f9408997704c2b27cc602e6679deca21b48a8600305cd3f7937027b1b6addf packages/integrations/src/secret-envelope.test.ts
8de8a86e8cb638e9a174bdaa517d52f8e68c292bcd0a06bfdf01fef89cacb0d5 packages/integrations/src/secret-envelope.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/integrations/tsconfig.json
e99411d2f89aa259e04df908bdffaaee6ebc728a37d06fdf2dd742f56d58108e packages/observability/package.json
d01de8ec4d666fe2e10f7f506e9e943721c2708e6d79f5800d0df81741d25f09 packages/observability/src/index.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/observability/tsconfig.json
eb31edd049a26afcf17e38f7fd50e43a17a16b5eafbb7d7b14afacb6815eb5fd packages/repository-intel/package.json
a99c706ca773b93612411e287db76dba98acc6387dd37c7f60db0af368b905b9 packages/repository-intel/src/index.test.ts
ed89856179f567890d54a6ba101ce9616d8749d95be9e276e986b5776be6c8f7 packages/repository-intel/src/index.ts
76393be48f351d9502e56a2b5d0c248f1e385311fe5bce87651e4542606d3e84 packages/repository-intel/tsconfig.json
08a9961cb6e6ec661a02a4dca4fe7ec4fd2fb55e4245e029883978160f9ac32c packages/testing/package.json
7d93c9f99d66282ac0fb4da8f408a2ee96e5df5cea5fc60b2a932ae8ca511dc2 packages/testing/src/index.ts
316d5e6eefcb05736e253b4e315aef5e4bcb94b97b0e0084e3af5cfc96c54495 packages/testing/tsconfig.json
7307d83b26d892212a5e0b2010115329e3de9c08bcdb65a6a865cb45e8dda957 packages/ui/package.json
58e46f8bbe1389f7442802ecf2626fb8b309255a2945f3dcce9b40e875df90d1 packages/ui/src/index.ts
d61d408ad9d3d81c99ce9d4d4d3069684afcdf9f411aba85fd33f03616e20520 packages/ui/src/lib/class-names.ts
51887c231fc76143b25525c8e62285d0a40cef92e4b4102da2d8fbbd9bfd23ee packages/ui/src/playbooks/playbook-card.tsx
654ef2403d980a865aa4a69d66486121c5e42d882974a80fa8f9e7c8cec8c653 packages/ui/src/playbooks/playbook-dense-row.tsx
c05dbcfb14d043fd1ebc648c71e9e2982577dfec7e2fd37a85b0805fe820ebd1 packages/ui/src/playbooks/playbook-types.ts
5aa96c22824fa3412e9414bca3c9f1199c763ae395593ec98a1767c12e8c97be packages/ui/src/primitives/button.tsx
4fb5094719822f3ca2496cce1c5d165acc5dc5b3c698dec2b817ddc812fd2d8e packages/ui/src/primitives/icon-button.tsx
1fcf052f4eccb112b6050a7e1cc9a8c14b9b59f04f660ff7d4461d965a38e302 packages/ui/src/primitives/segmented-control.tsx
5e023fd631334b4e836bf057d6e7065d6ffd354201bd2319903a98819489427f packages/ui/src/primitives/skeleton.tsx
edfd68e606f92f798ae1bdf2703f564d506f302292e4c1f083a3766160d238d9 packages/ui/src/primitives/surface.tsx
c348ae5b1d4b9722715c6404dd4198a109f88d2dfec5550e96d961cfe86b3759 packages/ui/src/status/badges.test.ts
fcef0f6944a0c822c3c817de0d0c5cc1cddb87e9e89372804f0b27f12194f12f packages/ui/src/status/badges.tsx
2bbc1d21f92ce062e08bdcb8ad3324bd66c8433e7556a41d1cacdad013d6c6b8 packages/ui/src/status/state-panel.tsx
d308feb27bb9b7ea5ea17fe139fab6b7c24a704fd52b3601e3629be8c8797f90 packages/ui/tsconfig.json
9d715dfbd77f972f821b3557415e410e2b19d1b57917022076b2a8a058784396 playwright.config.ts
a81f32f49468c131a0c2bba37eb8def9db2307e18cc51701035cf01f1ef4ddc1 pnpm-lock.yaml
253208fa7c1b64372c219b9e19cef15ed70ca93b66a4d5c4c4d2297a5aff8880 pnpm-workspace.yaml
b43fe240547fa9ed6f235155a8c79a777daef73221e982dbe49aea609f9d982d release-evidence.json
37b161d2e975584f6ff2fc1629075dd4b9c85fde08d671e0c2cfea12b719fa82 schemas/condition.schema.json
e5573958b019969ba579ecdb7a93274db5e44d735983496d10eb18e8c8f2282b schemas/evaluation-case.schema.json
1e861d9494121d3b00909337ce0ba0976e188edc6d256f032ae4cde4607abd5c schemas/instance-config.schema.json
2a43e2744105d616975a839fa93691924ec84d4642a2516567060249ce120a79 schemas/playbook.schema.json
d3e430dd1e3b0270d1fbab0f9593d0553081aac979d19d00b610bac782284b37 schemas/release-evidence.schema.json
13d7e87652457fffb2328381dabddb3d53fa89e6e53ede559dec9a100590d8de schemas/rendered-prompt-manifest.schema.json
3e2f6669641f31f82b65e55f51e1daf2d1195204959ad68ebc6d33d826175962 schemas/repository-profile.schema.json
23e62f06522371f73fc7d7df9a639b31f03f55c984327066a28593e3127e149b schemas/run-pack-manifest.schema.json
2a292fb2ca240150cbb9886459e5d037d5e5923de83b95696fce4137b698a618 schemas/seed-catalog.schema.json
cce328f73430051fea2a2dfa234413a710ebfdf56f986fb4db815776d17140a0 scripts/build_archive.py
4939769f47a869570454e024b9612cf066aa3cc91703c727481c9c9eb94e2cb0 scripts/check-runtime.mjs
36e02c8debe14def28cfb6128efdf535b2afd6b0027832b677fc2e9d63dbca66 scripts/export-public-source.sh
b2a0cfb4282d6ad760d22266faf001514635111d116d0e3523aee40569877e17 scripts/reference_compose.py
380e07bdda99910127aa662702fa533bb338525ac51cdfb7ac5ee2078536371c scripts/release/backup.sh
a371bb696d641b522f4e8976f616ae743ff755aef3b65eb2f1fb51798a6256bb scripts/release/generate-release-evidence.mjs
46224f13bc93bfdb7c99611292b424efb83b272a8749e059c3e816f18dfc9762 scripts/release/migration-preflight.mts
5768fc760a5c3df67e8c91d8bd8ca72e09ec46d377de58d0f8d64126e53945b1 scripts/release/performance-benchmark.mts
a14dcb7e1e15f311fbbac7ceb3d1992d74e31e9715dc9880c6dd8897dca8908d scripts/release/restore-empty-target.sh
c0e80230a39be511429c1ba6d2d87c1f9059a3e144f747f4a870682a532fc5e9 scripts/requirements-validate.txt
5cc8853fb890705e85e07522e81f43979f037ff5e6d7019e03b0aae69ea9c0d3 scripts/run-integration-tests.mjs
38115fde162d28f21f23902b1e10ec276bb93c8facdfd67f190a5044f0b65407 scripts/run-python.mjs
4e1e9c8aa3d9d76a6215eaf237cb9de2359c590cd8de446bc09243ae1fa76b2b scripts/validate_m0_persistence.mts
b2662cff28ed4d955b019ef597cbd490ad90bc4ad6693a485ca0108b16274434 scripts/validate_pack.py
0eef61d7c20b13abc84a5f67e5064463705f5c33b56f211d8c5e7a68e2ac73b0 scripts/verify_archive.py
419e837d2eaaadaff746dfd908f568a303225c36c805307a62789bb4243d879f templates/AGENTS.global.template.md
9fe1e82bb14b903f86bbc4606c4e12d5a1351068aca4f1ced3850e0462695ab6 templates/AGENTS.repository.template.md
6489b330e753b3e9a12e298999cb1670d8756e0d9125538b87987196dffd46f6 templates/CURRENT_STATE.template.md
d21e7b9f52a8bfe4a53790d8ce6ceae85dde081f7d9c908c63cf5847750e280b templates/FINAL_HANDOFF.template.md
ffd9e9cb272a2772bad7b70acd62e5baed3d4c969bd1c9cb5d7e8b2e8337c375 templates/MILESTONE_REPORT.template.md
20742e0c8046e0f67c30ed0d17e10547ef970611238d2280254760baf3b66cb3 templates/evaluation-case.template.yaml
0ae9d2b7748e8e6ed95db6bb277f23f99abd08825e935a154580cc2670cd5537 templates/playbook-package/CHANGELOG.md.template
4e03a8142ade30f2249633b751bb5e9d31ef543a5a3fe3ba8987571b37cb63b4 templates/playbook-package/README.md
74cc24a8fc71fea866b46196adf858b61215e9f9eaa4ae893f4e18a942bbefc1 templates/playbook-package/evaluations/static-structure.yaml.template
e1274d9697a93b129d354f5e3907a66af76ebc41d9c2b687415c2191acf20c90 templates/playbook-package/examples/minimal.yaml.template
3e2cbe64a0ca19224daf22abfc02c521b865d9d7eebd289dfd7d6403f43e39fa templates/playbook-package/playbook.yaml.template
ed0e972309c1412c4e80af7e18915eda60eca0c0edd3fc73c638c13e4b0d72d3 templates/playbook-package/prompt.md.template
4245a9fbfc87194ee6dd61fab1900f5a02255409056f372f61adaf86685e4e55 templates/release-evidence.template.json
ec5f7131a2f9189c81361421699815ddcddff7e589a539f9b951f601bfb1ecc8 tests/e2e/global-setup.ts
475b8d9788ea12ef9988ab6eccdbfcfd13c28fb954e3b7418c50e47bf90d2b9b tests/e2e/milestone-three.spec.ts
9444afa2d94984145cdb3e0e69d3ddaae2a3d209fff192ac60a8db0b2db22e26 tests/e2e/milestone-two.spec.ts
afded55e4daa5d72079c032f19c9bf122c5b909f1dcaea2a3b10af9d2cd9cfd8 tests/e2e/milestone-zero.spec.ts
8c5289bc79cdeabf8e356e73dd2faf38d0eaf0000c435e6d7a3bfe6151902601 tests/e2e/phase-fourteen-accessibility.spec.ts
25cbff5ba9547eeafb1a849ac1de6ef508d853643376761a10417a85fe962172 tests/e2e/usability-recovery.spec.ts
f4ecb581976b662af008a1663fbca1e7685b67322f1751d00b8ec131330daa02 tests/integration/generated-artifact.integration.test.ts
3bd786130e7c632e8d2f0656edd93a372abcad3f4e4a18b61a07a6b856807774 tests/integration/milestone-zero.integration.test.ts
719d84629454aad0798ce9968053c5d16f1cdd42b6f82cce87cdeeb430e79c7a tests/security/dependency-boundaries.test.ts
c6e1000ab960e9eeb5bbd6d0e5008786979c54731f47d4cd628c1b501c05df4b tests/security/production-boundaries.test.ts
87523f35bd7d5288c1d6bc851c409299aa939002226faf665542dc18a41131c0 tsconfig.base.json
db7fc59c2dbeb5a051be474afba8a6f9e3d24f4681f385ac52fa89c3220a8779 turbo.json
15bccb4ec53777e93ad3c07ac6aa83878898f61f9ae73f63ee415dd936cd029e unraid/devrunbook-icon.png
025b3ae1ffaf377b9785eb2f336390588afd60ea8c2dbf63e9a63847e1bc6525 unraid/devrunbook-icon.svg
81ec67fa4095763b261ddc84391643478cfaa5ba6369c7814c76b8ef2fa9cac0 unraid/devrunbook.xml
324ce6ad4395235354ab2d688ad4a6aacc8fddc0af0eaf5de23a0f82c9da9a0d unraid/docker-compose.unraid.yml
002fc58d644e31245976ed9fa84bce7b64d98dc6a5ed159e3c0dc87150b1faea vitest.config.ts
db1ecf849eb0cf4a611d4e7696bae5a693705de137514a99e7dee3cca67cf4f1 vitest.integration.config.ts
be5c006227c3ca6c14350dc9d0f3d63ffd2e86c70ef1c564df5a54e03b53d928 vitest.security.config.ts
README.md
+131
View File
@@ -0,0 +1,131 @@
# DevRunbook
DevRunbook is a self-hosted platform for turning development intent into
structured, reusable and verifiable tasks for coding agents such as Codex. It
combines a reviewed playbook, repository context, risk controls and validation
requirements into a deterministic prompt or multi-file Run Pack.
The platform helps developers stop rewriting the same instructions while
keeping scope, provenance and evidence visible. It does **not** execute
repository commands or write to your Git forge.
## What users can do
- Browse and search 28 built-in, versioned development playbooks.
- Create reusable repository profiles with commands, protected paths and policies.
- Compose tasks in a guided Simple flow or a detailed Expert flow.
- Inspect compatibility, provenance, guardrails and prompt-lint results before generation.
- Save immutable generated tasks and export exact Markdown or verified Run Pack archives.
- Connect Gitea read-only to import bounded repository evidence while retaining useful local state during an outage.
- Author and review private playbooks in Prompt Lab without making draft claims look validated.
The interface supports Dutch and English presentation, keyboard navigation,
reduced motion, light/dark themes and responsive desktop/mobile layouts.
## Quick start with Docker Compose
Requirements:
- Docker Engine with Docker Compose 2.40 or newer;
- a release checkout of this repository;
- four independently generated secrets.
```sh
cp .env.example .env
chmod 600 .env
openssl rand -hex 24 # POSTGRES_PASSWORD
openssl rand -hex 32 # SESSION_SECRET
openssl rand -base64 32 # INTEGRATION_ENCRYPTION_KEY
openssl rand -hex 24 # BOOTSTRAP_TOKEN
```
Place those values in `.env`, set `PUBLIC_BASE_URL`, then start the stack:
```sh
docker compose -p devrunbook --env-file .env build
docker compose -p devrunbook --env-file .env up -d
docker compose -p devrunbook --env-file .env ps
```
Open `PUBLIC_BASE_URL/setup`, enter the bootstrap token and create the first
owner. The setup route closes after successful initialization. Keep public
registration closed unless you deliberately configure an invitation workflow.
Health endpoints:
```sh
curl --fail http://127.0.0.1:3000/health/live
curl --fail http://127.0.0.1:3000/health/ready
```
For production upgrades, backups, restores, Unraid and reverse-proxy guidance,
read the [operator guide](docs/operator-guide.md). Do not publish PostgreSQL,
mount the Docker socket or weaken the default Gitea network policy. The
reference stack binds its HTTP port to host loopback; terminate public HTTPS at
a maintained reverse proxy on the same host or adjust the binding deliberately.
## Local development
DevRunbook requires Node.js 24, pnpm 10.33.0 and Python 3 for the specification
contracts. PostgreSQL is required for integration tests and a complete local
application flow.
```sh
corepack enable
pnpm install --frozen-lockfile
python3 scripts/validate_pack.py
python3 scripts/reference_compose.py --check
pnpm verify
pnpm test:security
```
`pnpm verify` runs formatting, linting, strict type checks, unit tests,
specification/golden-fixture validation and production builds. See
[`docs/15-test-strategy.md`](docs/15-test-strategy.md) for integration,
Playwright, clean-room and release gates.
## Architecture and safety
DevRunbook is a TypeScript modular monolith with separate web and worker roles
and PostgreSQL as its only required data service. Important boundaries include:
- generated runs and published playbook versions are immutable snapshots;
- imported repository text is untrusted evidence, never governing instruction;
- templates and conditions use restricted, non-executable data models;
- archives are bounded, inventoried and verified without unsafe extraction;
- workspace authorization is enforced server-side for every private resource;
- Gitea tokens are encrypted at rest and the first integration is read-only;
- default containers run non-root with read-only roots, dropped capabilities and no Docker socket.
Start with the [product vision](docs/00-product-vision.md),
[technical architecture](docs/06-technical-architecture.md) and
[security threat model](docs/13-security-privacy-threat-model.md). Contributors
should also read [`AGENTS.md`](AGENTS.md) and [`CONTRIBUTING.md`](CONTRIBUTING.md).
## Project status
The implemented release candidate covers the core library, repository profiles,
deterministic composition, exports, read-only Gitea intelligence, Prompt Lab,
operations, localization and accessibility hardening. Detailed evidence is in
[`CURRENT_STATE.md`](CURRENT_STATE.md) and
[`docs/19-acceptance-criteria.md`](docs/19-acceptance-criteria.md).
Direct code execution, forge writes, a public marketplace, billing, Kubernetes
as a required deployment and vector search remain deliberately out of scope.
The application and Unraid icons were created for this project; their source
and licensing are recorded in [the asset notice](docs/ASSET_PROVENANCE.md).
`BUILD_PACK.json`, `FILE_INDEX.txt`, `PACK_MANIFEST.sha256` and the version 1.2
documents describe the historical implementation-contract pack from which the
0.1 application was built. They are not the current application version or a
release manifest. See [publication readiness](docs/PUBLICATION_READINESS.md)
for the remaining owner-controlled launch decisions.
## License and security
DevRunbook is available under the [MIT License](LICENSE). Please report
vulnerabilities through the private channel described in
[`SECURITY.md`](SECURITY.md); do not post tokens, private repository contents or
exploit details in a public issue.
SECURITY.md
+25
View File
@@ -0,0 +1,25 @@
# Security policy
## Supported state
DevRunbook is a self-hosted application and its deployment manifests, web
service, worker, database schema, import boundaries and build-pack contracts are
in scope. Until a stable release is tagged, security fixes target the latest
commit on the canonical `main` branch. After stable releases begin, this section
will list the supported version series explicitly.
## Reporting a vulnerability
Do not place credentials, tokens, private repository contents or exploit details
in a public issue. Report vulnerabilities privately to
[`security@itworx.tech`](mailto:security@itworx.tech). If email is unavailable,
contact the operator of your deployment through its documented private channel.
A useful report includes the affected contract or file, impact, minimal reproduction, preconditions and a redacted proof. Never include live secrets.
## Security boundaries
DevRunbook must not execute arbitrary repository commands, must treat imported
content as untrusted data, must keep Gitea read-only and must enforce the
controls in `docs/13-security-privacy-threat-model.md` and
`docs/26-authentication-authorization.md`.
START_HERE_CODEX.md
+60
View File
@@ -0,0 +1,60 @@
# Start DevRunbook in Codex
This file is the operator entry point. The build pack is designed so Codex can begin from the extracted directory without the operator manually rearranging files.
## Recommended start
1. Extract the ZIP completely.
2. Open the extracted `DevRunbook_Build_Pack_v1_2` directory as a project in the Codex app, CLI or IDE extension.
3. Ensure Git is initialized in this directory. When it is not, Codex may initialize it during Milestone 0.
4. Start one lead Codex thread in the project root.
5. Paste the complete contents of `CODEX_MASTER_PROMPT.md` as the first task.
6. Allow Codex to inspect the repository and run the offline specification validator.
7. Review only genuine blockers, security-sensitive approvals or final release evidence. Routine implementation choices are already governed by the specification.
Do not copy only the master prompt into another empty project. The prompt depends on the schemas, content packages, API contract, database reference, golden prompt fixtures and milestone documents included here.
## Codex app mode
A local project thread is the simplest starting mode. A Codex-managed worktree is also acceptable when the full build-pack directory is visible inside it. The lead thread owns the canonical implementation branch and the state files. Independent worktrees or subagents may be used only according to `CODEX_EXECUTION_PROTOCOL.md`.
Select the strongest current coding model available to the account and use a high reasoning setting for architecture, security, migration and release-gate work. Do not hard-code a historical model name into the repository.
## First command evidence
Codex must begin with:
```bash
python3 scripts/validate_pack.py
python3 scripts/reference_compose.py --check
```
On Windows, `py -3` may replace `python3`. If Python dependencies are missing, create an isolated virtual environment and install `scripts/requirements-validate.txt` before continuing.
Expected specification baseline:
- 28 publishable P0 Playbook Packages;
- six normative example packages;
- 72 catalog entries;
- nine valid JSON Schemas;
- 28 byte-stable golden rendered prompts;
- a pre-populated 68-requirement release evidence template.
## Resume after an interruption
Open the same project and tell Codex:
> Resume DevRunbook from `CURRENT_STATE.md`. Re-read `AGENTS.md`, `CODEX_EXECUTION_PROTOCOL.md` and the active milestone. Verify the current Git diff and quality gates before continuing. Do not restart completed work or trust an unverified status claim.
## Completion evidence
The build is complete only when Codex has produced:
- the implemented application and migration history;
- all milestone evidence in `CURRENT_STATE.md`;
- a machine-readable final requirement matrix;
- production container artifacts;
- clean-room installation evidence;
- backup and restore evidence;
- critical browser-flow evidence;
- `FINAL_HANDOFF.md` based on the supplied template.
adr/ADR-001-git-first-content.md
+29
View File
@@ -0,0 +1,29 @@
# ADR-001 — Git-first canonical playbook content
## Status
Accepted
## Context
Built-in playbooks need human review, semantic versioning, reproducible releases, package export and transparent diffs. Storing only opaque database rows would weaken these workflows.
## Decision
Canonical built-in content is stored as YAML/Markdown packages in Git. The application validates, canonicalizes and indexes immutable versions into PostgreSQL. Private authoring may use database drafts but exports the same package format.
## Consequences
Positive:
- ordinary Git review and history;
- portable packages;
- reproducible catalog builds;
- CI validation;
- no database lock-in for authored content.
Negative:
- import/index synchronization required;
- file and database lifecycle must be clearly separated;
- package migrations need tooling.
adr/ADR-002-modular-monolith.md
+21
View File
@@ -0,0 +1,21 @@
# ADR-002 — Modular monolith for MVP
## Status
Accepted
## Context
The product has several domains and background work but must remain easy to self-host on Docker and Unraid.
## Decision
Use one repository and one application codebase with explicit domain packages. Deploy separate web and worker process roles backed by one PostgreSQL database.
## Consequences
- simpler deployment, transactions and development;
- domain boundaries remain testable;
- no network overhead between premature services;
- future extraction remains possible through defined ports;
- discipline is required to avoid framework/domain coupling.
adr/ADR-003-no-direct-code-execution-mvp.md
+20
View File
@@ -0,0 +1,20 @@
# ADR-003 — No direct code execution in MVP
## Status
Accepted
## Context
Direct Codex or shell execution introduces local-repository access, command approval, sandboxing, worktrees, credentials, streaming, cancellation and audit complexity.
## Decision
The MVP generates prompts and Run Packs only. It does not clone repositories, execute package scripts or launch Codex. A future local companion or controlled bridge requires a separate threat model and ADR.
## Consequences
- smaller security boundary;
- immediate usefulness across Codex app, CLI and IDE;
- execution evidence remains user-imported initially;
- future bridge can evolve independently.
adr/ADR-004-postgres-search-first.md
+21
View File
@@ -0,0 +1,21 @@
# ADR-004 — PostgreSQL search before semantic infrastructure
## Status
Accepted
## Context
The library requires fast title, tag, category and intent search with filters. A vector database adds operational complexity and less explainable ranking.
## Decision
Use PostgreSQL full-text search plus structured filters and optional trigram matching. Add semantic search only after measured unmet discovery needs.
## Consequences
- one datastore and simple self-hosting;
- explainable matching;
- adequate scale for initial catalog and private content;
- synonyms and curated intent terms need content governance;
- future embedding index remains possible behind a search port.
adr/ADR-005-integration-secrets.md
+20
View File
@@ -0,0 +1,20 @@
# ADR-005 — Versioned application-level encryption for integration secrets
## Status
Accepted
## Context
Gitea tokens must be stored for background synchronization but must not appear in prompts, logs or ordinary backups.
## Decision
Encrypt integration secrets with an externally supplied versioned master key. Store encrypted values and safe metadata in PostgreSQL. Return only write-only/rotatable secret controls to the UI.
## Consequences
- database compromise alone does not reveal tokens;
- key backup and rotation become operator responsibilities;
- losing the key makes stored tokens unrecoverable;
- future external secret-provider adapters can implement the same port.
adr/ADR-006-better-auth-adapter-boundary.md
+44
View File
@@ -0,0 +1,44 @@
# ADR-006 — Application-owned Better Auth persistence adapter
## Status
Accepted for Milestone 0 on 2026-07-27.
## Context
DevRunbook requires database-backed revocable sessions, hashed bearer tokens at rest, simultaneous 12-hour idle and 30-day absolute expiry, explicit revocation records, operator-issued password-reset links, first-run ownership in one transaction, and application-owned workspace authorization.
Better Auth 1.6.25 is compatible with Next.js 16 and Drizzle/PostgreSQL, but its stock database model stores the session bearer value directly, removes sessions during ordinary revocation, stores credential passwords on an account row, and exposes one rolling session expiry. Applying its generated schema unchanged would conflict with the security and lifecycle contracts in documents 26, 31, and the reference database model.
## Decision
Keep Better Auth 1.6.25 as the authentication protocol, credential-workflow, cookie, origin/CSRF, and request-handler engine. DevRunbook owns:
- Drizzle schema and migrations;
- a Better Auth custom database adapter that transforms high-entropy session tokens before persistence;
- idle, absolute-expiry, revocation, and disabled-user checks;
- first-run ownership and package import transaction;
- invitations, operator reset tokens, audit events, and session revocation use cases;
- a versioned envelope around the selected Better Auth-compatible scrypt parameters, plus transparent successful-login migration from Better Auth 1.6's unversioned `salt:key` format;
- every instance-role and workspace authorization decision.
The stock `drizzleAdapter()` and Better Auth migration command are not production migration paths. Better Auth schema generation may be used only as a compatibility check. Cookie caching remains disabled so revocation is visible on the next request. Next.js proxy logic may improve routing but is never an authorization boundary.
## Consequences
- Authentication integration is more work than the stock adapter, but no raw session bearer value is retained in PostgreSQL and the product contracts remain enforceable.
- New password hashes record their algorithm version and work factors. A future parameter change must retain verification for the preceding envelope version and mark it for successful-login rehash; malformed or unknown formats fail closed.
- Adapter conformance, token-at-rest, expiry, revocation, CSRF, cookie, first-run concurrency, reset replay, and cross-workspace tests become mandatory Milestone 0 evidence.
- If Better Auth's adapter API cannot support these transformations without security or correctness gaps, implementation must stop for a blocker-level replacement ADR rather than silently weakening the requirements.
## Evidence
Implemented conformance evidence in Milestone 0 includes generic credential failures, secure cookie attributes, same-origin mutation rejection, HMAC-only session persistence, simultaneous idle/absolute expiry, disabled-user denial, logout-to-`revoked_at` mapping, versioned scrypt hashes and successful-login legacy rehash. The credential account is a virtual adapter model over `users.password_hash`; the only compatibility columns added to `users` are `email_verified` and nullable `image`.
Live PostgreSQL adapter evidence remains required because the current workstation has no Docker-compatible runtime or standalone PostgreSQL service.
- Better Auth custom adapter API: <https://better-auth.com/docs/guides/create-a-db-adapter>
- Better Auth custom password hashing: <https://better-auth.com/docs/authentication/email-password#password>
- Better Auth database schema: <https://better-auth.com/docs/concepts/database>
- Better Auth session management: <https://better-auth.com/docs/concepts/session-management>
- Better Auth security model: <https://better-auth.com/docs/reference/security>
api/openapi.yaml
+4643
View File
File diff suppressed because it is too large Load Diff
apps/web/next-env.d.ts
Vendored
+6
View File
@@ -0,0 +1,6 @@
/// <reference types="next" />
/// <reference types="next/image-types/global" />
import "./.next/types/routes.d.ts";
// NOTE: This file should not be edited
// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
apps/web/next.config.ts
+39
View File
@@ -0,0 +1,39 @@
import type { NextConfig } from 'next'
const nextConfig: NextConfig = {
output: 'standalone',
reactStrictMode: true,
poweredByHeader: false,
serverExternalPackages: ['postgres'],
transpilePackages: [
'@devrunbook/config',
'@devrunbook/content',
'@devrunbook/db',
'@devrunbook/ui',
],
experimental: {
typedEnv: true,
},
async headers() {
return [
{
source: '/:path*',
headers: [
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
{ key: 'X-Frame-Options', value: 'DENY' },
{
key: 'Strict-Transport-Security',
value: 'max-age=31536000; includeSubDomains',
},
{
key: 'Permissions-Policy',
value: 'camera=(), microphone=(), geolocation=()',
},
],
},
]
},
}
export default nextConfig
apps/web/package.json
+40
View File
@@ -0,0 +1,40 @@
{
"name": "@devrunbook/web",
"version": "0.1.0",
"private": true,
"scripts": {
"build": "next build",
"dev": "next dev --hostname 127.0.0.1",
"lint": "eslint . --max-warnings=0",
"start": "next start --hostname 0.0.0.0",
"test": "vitest run --passWithNoTests",
"typecheck": "tsc --noEmit"
},
"dependencies": {
"@devrunbook/application": "workspace:*",
"@devrunbook/artifacts": "workspace:*",
"@devrunbook/composer": "workspace:*",
"@devrunbook/config": "workspace:*",
"@devrunbook/content": "workspace:*",
"@devrunbook/db": "workspace:*",
"@devrunbook/integrations": "workspace:*",
"@devrunbook/repository-intel": "workspace:*",
"@devrunbook/ui": "workspace:*",
"better-auth": "1.6.25",
"lucide-react": "1.27.0",
"next": "16.2.12",
"react": "19.2.8",
"react-dom": "19.2.8",
"yaml": "2.9.0",
"zod": "4.4.3"
},
"devDependencies": {
"@tailwindcss/postcss": "4.3.3",
"@types/node": "24.13.3",
"@types/react": "19.2.8",
"@types/react-dom": "19.2.3",
"tailwindcss": "4.3.3",
"typescript": "5.9.3",
"vitest": "4.1.10"
}
}
apps/web/postcss.config.mjs
+5
View File
@@ -0,0 +1,5 @@
export default {
plugins: {
'@tailwindcss/postcss': {},
},
}
apps/web/src/app/_authenticated/authenticated-app-layout.tsx
+108
View File
@@ -0,0 +1,108 @@
import type { ActorContext } from '@devrunbook/application'
import { cookies, headers } from 'next/headers'
import { redirect } from 'next/navigation'
import type { ReactNode } from 'react'
import type { CommandPaletteItem } from '../../components/command-palette/command-palette'
import { AppShell } from '../../components/shell/app-shell'
import { isThemePreference } from '../../components/theme/theme-model'
import {
detectLocale,
isPresentationMode,
} from '../../components/presentation/presentation-model'
import { getAuth } from '../../auth/auth'
import {
AuthenticatedWorkspaceContextError,
resolveAuthenticatedWorkspaceContext,
} from '../../server/authenticated-workspace-context'
import { DrizzleWorkspaceSelectionLookup } from '@devrunbook/db'
import {
authenticatedCommands,
buildAuthenticatedShellPresentation,
buildLoginHref,
commandsForWorkspaceRole,
localizeAuthenticatedCommands,
} from './authenticated-app-presentation'
export interface AuthenticatedAppLayoutProps {
readonly children: ReactNode
readonly requestPath: string
readonly loginReturnTo: string
readonly activeNavigationId: string
readonly commands?: readonly CommandPaletteItem[]
readonly loadCommands?: (
actor: ActorContext,
) => Promise<readonly CommandPaletteItem[]>
}
export async function AuthenticatedAppLayout({
children,
requestPath,
loginReturnTo,
activeNavigationId,
commands = authenticatedCommands,
loadCommands,
}: AuthenticatedAppLayoutProps) {
let actor: ActorContext
const requestHeaders = await headers()
try {
actor = await resolveAuthenticatedWorkspaceContext(
new Request(new URL(requestPath, 'http://devrunbook.local'), {
headers: requestHeaders,
}),
)
} catch (error) {
if (
error instanceof AuthenticatedWorkspaceContextError &&
error.code === 'authentication_required'
) {
redirect(buildLoginHref(loginReturnTo))
}
throw error
}
const cookieStore = await cookies()
const themeCookie = cookieStore.get('devrunbook_theme')?.value
const initialTheme = isThemePreference(themeCookie) ? themeCookie : 'system'
const modeCookie = cookieStore.get('devrunbook_mode')?.value
const mode = isPresentationMode(modeCookie) ? modeCookie : 'simple'
const locale = detectLocale(
cookieStore.get('devrunbook_locale')?.value,
requestHeaders.get('accept-language'),
)
const session = await getAuth().api.getSession({ headers: requestHeaders })
const workspaces =
await new DrizzleWorkspaceSelectionLookup().listAuthorizedWorkspaces(
actor.userId,
)
const presentation = buildAuthenticatedShellPresentation({
...actor,
mode,
locale,
workspaces: workspaces.map(({ id, name, type }) => ({ id, name, type })),
...(session?.user.name ? { displayName: session.user.name } : {}),
...(session?.user.email ? { email: session.user.email } : {}),
})
const resolvedCommands = localizeAuthenticatedCommands(
commandsForWorkspaceRole(
loadCommands ? await loadCommands(actor) : commands,
actor.workspaceRole,
),
locale,
)
return (
<AppShell
activeNavigationId={activeNavigationId}
navigation={presentation.navigation}
workspaces={presentation.workspaces}
activeWorkspaceId={presentation.activeWorkspaceId}
actor={presentation.actor}
initialTheme={initialTheme}
locale={locale}
commands={resolvedCommands}
>
{children}
</AppShell>
)
}
apps/web/src/app/_authenticated/authenticated-app-presentation.test.ts
+191
View File
@@ -0,0 +1,191 @@
import { describe, expect, it } from 'vitest'
import {
authenticatedCommands,
authenticatedNavigation,
buildAuthenticatedShellPresentation,
buildLoginHref,
commandsForWorkspaceRole,
localizeAuthenticatedCommands,
} from './authenticated-app-presentation'
describe('authenticated app shell presentation', () => {
it('keeps the established navigation contract in one shared definition', () => {
expect(authenticatedNavigation).toEqual([
{ id: 'home', label: 'Start', href: '/start', mobile: true },
{ id: 'library', label: 'Library', href: '/library', mobile: true },
{ id: 'collections', label: 'Collections', href: '/collections' },
{
id: 'repositories',
label: 'Repositories',
href: '/repositories',
mobile: true,
},
{
id: 'compose',
label: 'Compose',
href: '/composer/new',
mobile: true,
},
{
id: 'prompt-lab',
label: 'Prompt Lab',
href: '/prompt-lab',
},
{
id: 'operations',
label: 'Operations',
href: '/operations',
},
{
id: 'settings',
label: 'Settings',
href: '/settings/integrations',
},
])
})
it('defaults to plain navigation and gates management by role', () => {
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-1',
workspaceRole: 'owner',
locale: 'nl',
mode: 'simple',
}).navigation.map(({ label, href }) => ({ label, href })),
).toEqual([
{ label: 'Nieuwe taak', href: '/start' },
{ label: 'Taken', href: '/runs' },
{ label: 'Projecten', href: '/repositories' },
{ label: 'Taakbibliotheek', href: '/library' },
{ label: 'Instellingen', href: '/settings/integrations' },
{ label: 'Beheer', href: '/management' },
])
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-2',
workspaceRole: 'viewer',
mode: 'simple',
}).navigation.some(({ id }) => id === 'management'),
).toBe(false)
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-2',
workspaceRole: 'viewer',
mode: 'expert',
}).navigation,
).toEqual(authenticatedNavigation.filter(({ id }) => id !== 'compose'))
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-2',
workspaceRole: 'viewer',
locale: 'nl',
mode: 'expert',
}).navigation.map(({ label }) => label),
).toEqual([
'Start',
'Taakbibliotheek',
'Verzamelingen',
'Projecten',
'Prompt Lab',
'Activiteit en taken',
'Instellingen',
])
})
it('presents every authorized workspace without replacing its identity', () => {
const workspaces = [
{ id: 'workspace-1', name: 'Persoonlijk', type: 'personal' as const },
{ id: 'workspace-2', name: 'Team', type: 'team' as const },
]
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-2',
workspaceRole: 'editor',
workspaces,
}).workspaces,
).toEqual(workspaces)
})
it('offers the common authenticated destinations in the command palette', () => {
expect(authenticatedCommands.map(({ id, href }) => ({ id, href }))).toEqual(
[
{ id: 'home', href: '/start' },
{ id: 'library', href: '/library' },
{ id: 'repositories', href: '/repositories' },
{ id: 'collections', href: '/collections' },
{ id: 'compose', href: '/composer/new' },
{ id: 'prompt-lab', href: '/prompt-lab' },
{ id: 'operations', href: '/operations' },
{ id: 'settings-integrations', href: '/settings/integrations' },
],
)
})
it('removes write-only composition commands for viewers', () => {
expect(
commandsForWorkspaceRole(authenticatedCommands, 'viewer').map(
({ id }) => id,
),
).not.toContain('compose')
expect(
commandsForWorkspaceRole(authenticatedCommands, 'editor').map(
({ id }) => id,
),
).toContain('compose')
})
it('localizes common command destinations without changing their targets', () => {
const localized = localizeAuthenticatedCommands(authenticatedCommands, 'nl')
expect(localized.find(({ id }) => id === 'home')).toMatchObject({
label: 'Nieuwe taak',
href: '/start',
})
expect(localized.find(({ id }) => id === 'library')).toMatchObject({
label: 'Taakbibliotheek openen',
href: '/library',
})
})
it('preserves the current workspace and actor presentation', () => {
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-1',
workspaceRole: 'owner',
displayName: 'Jens Example',
email: 'jens@example.test',
}),
).toMatchObject({
activeWorkspaceId: 'workspace-1',
workspaces: [
{
id: 'workspace-1',
name: 'Active workspace',
type: 'personal',
},
],
actor: {
displayName: 'Jens Example',
email: 'jens@example.test',
initials: 'JE',
role: 'Owner',
},
})
expect(
buildAuthenticatedShellPresentation({
workspaceId: 'workspace-2',
workspaceRole: 'editor',
}).workspaces[0]?.type,
).toBe('team')
})
it('preserves route-specific local login return targets', () => {
expect(buildLoginHref('/library')).toBe('/login?returnTo=%2Flibrary')
expect(buildLoginHref('/composer/new')).toBe(
'/login?returnTo=%2Fcomposer%2Fnew',
)
expect(buildLoginHref('/repositories/repository-1')).toBe(
'/login?returnTo=%2Frepositories%2Frepository-1',
)
})
})
apps/web/src/app/_authenticated/authenticated-app-presentation.ts
+301
View File
@@ -0,0 +1,301 @@
import type {
ActorPresentation,
AppNavigationItem,
WorkspaceOption,
} from '../../components/shell/shell-types'
import type { CommandPaletteItem } from '../../components/command-palette/command-model'
import type {
PresentationMode,
SupportedLocale,
} from '../../components/presentation/presentation-model'
export interface AuthenticatedShellActor {
readonly workspaceId: string
readonly workspaceRole: 'owner' | 'editor' | 'viewer'
readonly displayName?: string
readonly email?: string
readonly mode?: PresentationMode
readonly locale?: SupportedLocale
readonly workspaces?: readonly WorkspaceOption[]
}
export interface AuthenticatedShellPresentation {
readonly navigation: readonly AppNavigationItem[]
readonly workspaces: readonly WorkspaceOption[]
readonly activeWorkspaceId: string
readonly actor: ActorPresentation
}
export const authenticatedNavigation: readonly AppNavigationItem[] = [
{ id: 'home', label: 'Start', href: '/start', mobile: true },
{ id: 'library', label: 'Library', href: '/library', mobile: true },
{ id: 'collections', label: 'Collections', href: '/collections' },
{
id: 'repositories',
label: 'Repositories',
href: '/repositories',
mobile: true,
},
{
id: 'compose',
label: 'Compose',
href: '/composer/new',
mobile: true,
},
{
id: 'prompt-lab',
label: 'Prompt Lab',
href: '/prompt-lab',
},
{
id: 'operations',
label: 'Operations',
href: '/operations',
},
{
id: 'settings',
label: 'Settings',
href: '/settings/integrations',
},
]
const expertNavigationLabelsNl: Readonly<Record<string, string>> = {
home: 'Start',
library: 'Taakbibliotheek',
collections: 'Verzamelingen',
repositories: 'Projecten',
compose: 'Taak opstellen',
'prompt-lab': 'Prompt Lab',
operations: 'Activiteit en taken',
settings: 'Instellingen',
}
const simpleNavigationByLocale: Readonly<
Record<SupportedLocale, readonly AppNavigationItem[]>
> = {
en: [
{ id: 'home', label: 'New task', href: '/start', mobile: true },
{ id: 'runs', label: 'Tasks', href: '/runs', mobile: true },
{
id: 'repositories',
label: 'Projects',
href: '/repositories',
mobile: true,
},
{ id: 'library', label: 'Task library', href: '/library', mobile: true },
{ id: 'settings', label: 'Settings', href: '/settings/integrations' },
],
nl: [
{ id: 'home', label: 'Nieuwe taak', href: '/start', mobile: true },
{ id: 'runs', label: 'Taken', href: '/runs', mobile: true },
{
id: 'repositories',
label: 'Projecten',
href: '/repositories',
mobile: true,
},
{ id: 'library', label: 'Taakbibliotheek', href: '/library', mobile: true },
{ id: 'settings', label: 'Instellingen', href: '/settings/integrations' },
],
}
export const authenticatedCommands: readonly CommandPaletteItem[] = [
{
id: 'home',
label: 'Start a task',
description: 'Choose a project and what you want to do',
href: '/start',
keywords: ['home', 'dashboard', 'quick start'],
},
{
id: 'library',
label: 'Open Library',
description: 'Search and filter governed playbooks',
href: '/library',
keywords: ['catalog', 'playbooks'],
},
{
id: 'repositories',
label: 'Open Repositories',
description: 'Review reusable repository context and constraints',
href: '/repositories',
keywords: ['profiles', 'commands', 'paths'],
},
{
id: 'collections',
label: 'Open Collections',
description: 'Organize accessible playbooks into personal named sets',
href: '/collections',
keywords: ['library', 'saved', 'groups'],
},
{
id: 'compose',
label: 'Start a composition',
description: 'Select a playbook and repository context',
href: '/composer/new',
keywords: ['prompt', 'run pack'],
},
{
id: 'prompt-lab',
label: 'Open Prompt Lab',
description: 'Import, inspect and govern private playbook packages',
href: '/prompt-lab',
keywords: ['packages', 'authoring', 'evaluation', 'publish'],
},
{
id: 'operations',
label: 'Open Operations',
description: 'Inspect worker jobs, safe failures and audit history',
href: '/operations',
keywords: ['jobs', 'queue', 'audit', 'health'],
},
{
id: 'settings-integrations',
label: 'Open Integrations',
description: 'Review read-only forge connections and capability health',
href: '/settings/integrations',
keywords: ['settings', 'gitea', 'connections'],
},
]
const commandCopy: Readonly<
Record<
SupportedLocale,
Readonly<Record<string, Pick<CommandPaletteItem, 'label' | 'description'>>>
>
> = {
en: {},
nl: {
home: {
label: 'Nieuwe taak',
description: 'Kies een project en beschrijf wat je wilt bereiken',
},
library: {
label: 'Taakbibliotheek openen',
description: 'Zoek een veilig en herbruikbaar taaktype',
},
repositories: {
label: 'Projecten openen',
description: 'Bekijk projectgegevens, grenzen en synchronisatiestatus',
},
collections: {
label: 'Verzamelingen openen',
description: 'Groepeer bewaarde taaktypes',
},
compose: {
label: 'Geavanceerde taak opstellen',
description: 'Kies zelf een taaktype en projectcontext',
},
'prompt-lab': {
label: 'Prompt Lab openen',
description: 'Beheer private taaktypepakketten',
},
operations: {
label: 'Activiteit en taken openen',
description: 'Bekijk achtergrondtaken en veilige foutmeldingen',
},
'settings-integrations': {
label: 'Koppelingen openen',
description: 'Beheer alleen-lezen forgeverbindingen',
},
},
}
export function commandsForWorkspaceRole(
commands: readonly CommandPaletteItem[],
role: AuthenticatedShellActor['workspaceRole'],
): readonly CommandPaletteItem[] {
return role === 'viewer'
? commands.filter((command) => command.id !== 'compose')
: commands
}
export function localizeAuthenticatedCommands(
commands: readonly CommandPaletteItem[],
locale: SupportedLocale,
): readonly CommandPaletteItem[] {
const translations = commandCopy[locale]
return commands.map((command) => ({
...command,
...(translations[command.id] ?? {}),
}))
}
export function buildLoginHref(returnTo: string): string {
return `/login?returnTo=${encodeURIComponent(returnTo)}`
}
export function buildAuthenticatedShellPresentation(
actor: AuthenticatedShellActor,
): AuthenticatedShellPresentation {
const locale = actor.locale ?? 'en'
const mode = actor.mode ?? 'simple'
const management =
actor.workspaceRole === 'owner'
? [
{
id: 'management',
label: locale === 'nl' ? 'Beheer' : 'Management',
href: '/management',
},
]
: []
return {
navigation:
mode === 'expert'
? authenticatedNavigation
.filter(
(item) =>
actor.workspaceRole !== 'viewer' || item.id !== 'compose',
)
.map((item) => ({
...item,
label:
locale === 'nl'
? (expertNavigationLabelsNl[item.id] ?? item.label)
: item.label,
}))
: [...simpleNavigationByLocale[locale], ...management],
workspaces:
actor.workspaces && actor.workspaces.length > 0
? actor.workspaces
: [
{
id: actor.workspaceId,
name: locale === 'nl' ? 'Actieve werkruimte' : 'Active workspace',
type: actor.workspaceRole === 'owner' ? 'personal' : 'team',
},
],
activeWorkspaceId: actor.workspaceId,
actor: {
displayName: actor.displayName?.trim() || actor.email || 'Signed-in user',
email: actor.email ?? 'Account email unavailable',
initials: initials(actor.displayName?.trim() || actor.email || 'DR'),
role: workspaceRoleLabel(actor.workspaceRole, locale),
},
}
}
function initials(value: string): string {
const emailName = value.split('@')[0] ?? value
const parts = emailName.split(/[\s._-]+/u).filter(Boolean)
return (
parts.length > 1
? `${parts[0]![0]}${parts.at(-1)![0]}`
: emailName.slice(0, 2)
).toUpperCase()
}
function workspaceRoleLabel(
role: AuthenticatedShellActor['workspaceRole'],
locale: SupportedLocale,
) {
if (locale === 'nl') {
return role === 'owner'
? 'Eigenaar'
: role === 'editor'
? 'Bewerker'
: 'Lezer'
}
return role === 'owner' ? 'Owner' : role === 'editor' ? 'Editor' : 'Viewer'
}
apps/web/src/app/accept-invitation/accept-invitation-experience.tsx
+237
View File
@@ -0,0 +1,237 @@
'use client'
import { ArrowRight, CheckCircle2, ShieldCheck, UserPlus } from 'lucide-react'
import Link from 'next/link'
import { type FormEvent, useEffect, useRef, useState } from 'react'
import { PublicLocaleControl } from '../../components/presentation/public-locale-control'
import type { SupportedLocale } from '../../components/presentation/presentation-model'
const tokenPattern = /^[A-Za-z0-9_-]{32,512}$/u
const inputClassName =
'mt-2 w-full rounded-xl border border-white/12 bg-black/30 px-3.5 py-3 text-sm text-white focus:border-lime-300/55 focus:outline-none disabled:opacity-50'
const invitationCopy = {
en: {
invalid: 'This invitation is invalid, expired, or already used.',
validation:
'Check your name and matching password of at least 12 characters.',
eyebrow: 'Private self-hosted access',
titleBefore: "Join your team's ",
titleAccent: 'control plane',
titleAfter: '.',
intro:
'The link is single-use and bound to your assigned instance role and optional workspace membership. Your password remains local to this instance.',
created: 'Account created',
accept: 'Accept invitation',
continue: 'Continue to sign in',
displayName: 'Display name',
password: 'Password',
confirm: 'Confirm password',
creating: 'Creating account…',
create: 'Create local account',
},
nl: {
invalid: 'Deze uitnodiging is ongeldig, verlopen of al gebruikt.',
validation:
'Controleer je naam en vul tweemaal hetzelfde wachtwoord van minstens 12 tekens in.',
eyebrow: 'Privétoegang tot je eigen server',
titleBefore: 'Word lid van het ',
titleAccent: 'beheerplatform',
titleAfter: ' van je team.',
intro:
'De link werkt één keer en is gekoppeld aan je toegewezen rol en eventuele werkruimte. Je wachtwoord blijft op deze DevRunbook-server.',
created: 'Account aangemaakt',
accept: 'Uitnodiging aanvaarden',
continue: 'Verder naar aanmelden',
displayName: 'Weergavenaam',
password: 'Wachtwoord',
confirm: 'Wachtwoord bevestigen',
creating: 'Account aanmaken…',
create: 'Lokaal account aanmaken',
},
} as const
export function AcceptInvitationExperience({
locale,
}: {
readonly locale: SupportedLocale
}) {
const copy = invitationCopy[locale]
const [token, setToken] = useState<string | null>(null)
const [submitting, setSubmitting] = useState(false)
const [completed, setCompleted] = useState(false)
const [error, setError] = useState<string | null>(null)
const errorRef = useRef<HTMLDivElement>(null)
useEffect(() => {
const candidate = new URLSearchParams(window.location.hash.slice(1)).get(
'token',
)
setToken(candidate && tokenPattern.test(candidate) ? candidate : null)
window.history.replaceState(null, '', '/accept-invitation')
if (!candidate || !tokenPattern.test(candidate)) {
setError(copy.invalid)
}
}, [copy.invalid])
async function submit(event: FormEvent<HTMLFormElement>) {
event.preventDefault()
const form = event.currentTarget
const data = new FormData(form)
const displayName = data.get('displayName')
const password = data.get('password')
const passwordConfirmation = data.get('passwordConfirmation')
if (
!token ||
typeof displayName !== 'string' ||
!displayName.trim() ||
typeof password !== 'string' ||
password.length < 12 ||
passwordConfirmation !== password
) {
setError(copy.validation)
return
}
setSubmitting(true)
setError(null)
try {
const response = await fetch('/api/v1/auth/invitations/accept', {
method: 'POST',
credentials: 'same-origin',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({
token,
displayName: displayName.trim(),
password,
passwordConfirmation,
}),
})
if (!response.ok) throw new Error('failed')
setCompleted(true)
setToken(null)
} catch {
setError(copy.invalid)
requestAnimationFrame(() => errorRef.current?.focus())
} finally {
for (const name of ['password', 'passwordConfirmation']) {
const input = form.elements.namedItem(name)
if (input instanceof HTMLInputElement) input.value = ''
}
setSubmitting(false)
}
}
return (
<main className="mx-auto grid min-h-screen max-w-6xl items-center gap-12 px-5 py-10 lg:grid-cols-2 lg:px-10">
<section className="order-2 lg:order-1">
<div className="hidden items-center justify-between gap-4 lg:flex">
<Link
href="/"
className="inline-flex items-center gap-3 no-underline"
>
<span className="grid size-10 place-items-center rounded-xl bg-lime-300 text-black">
<ShieldCheck aria-hidden="true" size={21} />
</span>
<span className="font-semibold">DevRunbook</span>
</Link>
<PublicLocaleControl locale={locale} />
</div>
<p className="mt-16 text-xs uppercase tracking-[0.2em] text-lime-300/80">
{copy.eyebrow}
</p>
<h1 className="mt-4 text-5xl font-medium tracking-[-0.04em] sm:text-6xl">
{copy.titleBefore}
<span className="text-lime-300">{copy.titleAccent}</span>
{copy.titleAfter}
</h1>
<p className="mt-6 max-w-xl leading-7 text-white/52">{copy.intro}</p>
</section>
<section className="order-1 mx-auto w-full max-w-md rounded-3xl border border-white/10 bg-white/[0.035] p-6 sm:p-8 lg:order-2">
<div className="mb-8 flex items-center justify-between lg:hidden">
<Link href="/" className="flex items-center gap-3 no-underline">
<span className="grid size-9 place-items-center rounded-xl bg-lime-300 text-black">
<ShieldCheck aria-hidden="true" size={20} />
</span>
<span className="text-sm font-semibold">DevRunbook</span>
</Link>
<PublicLocaleControl locale={locale} />
</div>
<span className="grid size-11 place-items-center rounded-2xl bg-lime-300/10 text-lime-300">
{completed ? (
<CheckCircle2 aria-hidden="true" />
) : (
<UserPlus aria-hidden="true" />
)}
</span>
<h2 className="mt-6 text-3xl font-medium">
{completed ? copy.created : copy.accept}
</h2>
{completed ? (
<Link
href="/login"
className="mt-8 inline-flex w-full items-center justify-center gap-2 rounded-xl bg-lime-300 px-5 py-3.5 font-semibold text-black no-underline"
>
{copy.continue} <ArrowRight aria-hidden="true" size={17} />
</Link>
) : (
<form onSubmit={submit} className="mt-8 space-y-5">
<label className="block text-sm font-medium">
{copy.displayName}
<input
name="displayName"
autoComplete="name"
maxLength={120}
required
className={inputClassName}
/>
</label>
<label className="block text-sm font-medium">
{copy.password}
<input
name="password"
type="password"
autoComplete="new-password"
minLength={12}
maxLength={128}
required
className={inputClassName}
/>
</label>
<label className="block text-sm font-medium">
{copy.confirm}
<input
name="passwordConfirmation"
type="password"
autoComplete="new-password"
minLength={12}
maxLength={128}
required
className={inputClassName}
/>
</label>
<div
ref={errorRef}
tabIndex={-1}
role={error ? 'alert' : undefined}
className={
error
? 'rounded-xl border border-red-300/20 bg-red-300/[0.07] p-4 text-sm text-red-100'
: 'sr-only'
}
>
{error}
</div>
<button
disabled={!token || submitting}
className="inline-flex w-full items-center justify-center gap-2 rounded-xl bg-lime-300 px-5 py-3.5 font-semibold text-black disabled:opacity-50"
>
{submitting ? copy.creating : copy.create}
{!submitting && <ArrowRight aria-hidden="true" size={17} />}
</button>
</form>
)}
</section>
</main>
)
}
apps/web/src/app/accept-invitation/page.tsx
+21
View File
@@ -0,0 +1,21 @@
import type { Metadata } from 'next'
import { resolvePublicLocale } from '../../server/public-locale'
import { AcceptInvitationExperience } from './accept-invitation-experience'
export async function generateMetadata(): Promise<Metadata> {
const locale = await resolvePublicLocale()
return locale === 'nl'
? {
title: 'Uitnodiging aanvaarden · DevRunbook',
description: 'Maak een lokaal account met een eenmalige uitnodiging.',
}
: {
title: 'Accept your DevRunbook invitation',
description: 'Create a local account from a single-use invitation.',
}
}
export default async function AcceptInvitationPage() {
return <AcceptInvitationExperience locale={await resolvePublicLocale()} />
}
apps/web/src/app/account/layout.tsx
+19
View File
@@ -0,0 +1,19 @@
import type { ReactNode } from 'react'
import { AuthenticatedAppLayout } from '../_authenticated/authenticated-app-layout'
export default function AccountLayout({
children,
}: {
readonly children: ReactNode
}) {
return (
<AuthenticatedAppLayout
activeNavigationId="account"
loginReturnTo="/account"
requestPath="/account"
>
{children}
</AuthenticatedAppLayout>
)
}
apps/web/src/app/account/page.tsx
+82
View File
@@ -0,0 +1,82 @@
import { cookies, headers } from 'next/headers'
import { redirect } from 'next/navigation'
import { getAuth } from '../../auth/auth'
import {
detectLocale,
isPresentationMode,
} from '../../components/presentation/presentation-model'
import { resolveAuthenticatedPageContext } from '../../server/authenticated-page-context'
import { PresentationPreferences } from './presentation-preferences'
export const dynamic = 'force-dynamic'
export default async function AccountPage() {
const cookieStore = await cookies()
const requestHeaders = await headers()
const [actor, session] = await Promise.all([
resolveAuthenticatedPageContext('/account'),
getAuth().api.getSession({ headers: requestHeaders }),
])
if (!session) redirect('/login?returnTo=%2Faccount')
const modeCookie = cookieStore.get('devrunbook_mode')?.value
const mode = isPresentationMode(modeCookie) ? modeCookie : 'simple'
const locale = detectLocale(
cookieStore.get('devrunbook_locale')?.value,
requestHeaders.get('accept-language'),
)
const nl = locale === 'nl'
const role =
actor.workspaceRole === 'owner'
? nl
? 'Eigenaar'
: 'Owner'
: actor.workspaceRole === 'editor'
? nl
? 'Bewerker'
: 'Editor'
: nl
? 'Lezer'
: 'Viewer'
return (
<section className="drb-page" aria-labelledby="account-title">
<header className="drb-page-header">
<p>Account</p>
<h1 id="account-title">{nl ? 'Jouw account' : 'Your account'}</h1>
<p>
{nl
? 'Bekijk je identiteit, rechten en interfacevoorkeuren.'
: 'Review your identity, access and interface preferences.'}
</p>
</header>
<section className="drb-panel" aria-labelledby="identity-title">
<h2 id="identity-title">
{nl ? 'Identiteit en toegang' : 'Identity and access'}
</h2>
<dl>
<div>
<dt>{nl ? 'Naam' : 'Name'}</dt>
<dd>{session.user.name}</dd>
</div>
<div>
<dt>Email</dt>
<dd>{session.user.email}</dd>
</div>
<div>
<dt>{nl ? 'Rol in deze werkruimte' : 'Role in this workspace'}</dt>
<dd>{role}</dd>
</div>
</dl>
<p>
<a href="/account/security">
{nl
? 'Wachtwoord en sessies beheren'
: 'Manage password and sessions'}
</a>
</p>
</section>
<PresentationPreferences initialLocale={locale} initialMode={mode} />
</section>
)
}
apps/web/src/app/account/presentation-preferences.tsx
+81
View File
@@ -0,0 +1,81 @@
'use client'
import { useState } from 'react'
import type {
PresentationMode,
SupportedLocale,
} from '../../components/presentation/presentation-model'
export function PresentationPreferences({
initialMode,
initialLocale,
}: {
readonly initialMode: PresentationMode
readonly initialLocale: SupportedLocale
}) {
const [mode, setMode] = useState(initialMode)
const [locale, setLocale] = useState(initialLocale)
const [state, setState] = useState<'idle' | 'saving' | 'failed'>('idle')
const nl = initialLocale === 'nl'
async function save() {
setState('saving')
const response = await fetch('/api/v1/account/presentation', {
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ mode, locale }),
}).catch(() => null)
if (!response?.ok) {
setState('failed')
return
}
window.location.reload()
}
return (
<section className="drb-panel" aria-labelledby="presentation-title">
<h2 id="presentation-title">Interface</h2>
<label htmlFor="presentation-mode">
{nl ? 'Weergave' : 'Interface mode'}
</label>
<select
id="presentation-mode"
onChange={(event) => setMode(event.target.value as PresentationMode)}
value={mode}
>
<option value="simple">{nl ? 'Eenvoudig' : 'Simple'}</option>
<option value="expert">Expert</option>
</select>
<label htmlFor="presentation-locale">{nl ? 'Taal' : 'Language'}</label>
<select
id="presentation-locale"
onChange={(event) => setLocale(event.target.value as SupportedLocale)}
value={locale}
>
<option value="en">English</option>
<option value="nl">Nederlands</option>
</select>
<button
disabled={state === 'saving'}
onClick={() => void save()}
type="button"
>
{state === 'saving'
? nl
? 'Opslaan…'
: 'Saving…'
: nl
? 'Voorkeuren opslaan'
: 'Save preferences'}
</button>
{state === 'failed' ? (
<p role="alert">
{nl
? 'Je voorkeuren konden niet worden opgeslagen. Probeer opnieuw.'
: 'Your preferences could not be saved. Please try again.'}
</p>
) : null}
</section>
)
}
apps/web/src/app/account/security/page.tsx
+43
View File
@@ -0,0 +1,43 @@
import { cookies, headers } from 'next/headers'
import { detectLocale } from '../../../components/presentation/presentation-model'
import { resolveAuthenticatedPageContext } from '../../../server/authenticated-page-context'
import { SessionManager } from './session-manager'
export const dynamic = 'force-dynamic'
export default async function AccountSecurityPage() {
await resolveAuthenticatedPageContext('/account/security')
const locale = detectLocale(
(await cookies()).get('devrunbook_locale')?.value,
(await headers()).get('accept-language'),
)
const nl = locale === 'nl'
return (
<section className="drb-page" aria-labelledby="security-title">
<header className="drb-page-header">
<p>{nl ? 'Accountbeveiliging' : 'Account security'}</p>
<h1 id="security-title">
{nl ? 'Wachtwoord en sessies' : 'Password and sessions'}
</h1>
<p>
{nl
? 'Controleer aangemelde apparaten en trek onbekende toegang in.'
: 'Review signed-in devices and revoke access you no longer recognize.'}
</p>
</header>
<SessionManager locale={locale} />
<section className="drb-panel" aria-labelledby="password-title">
<h2 id="password-title">{nl ? 'Wachtwoord' : 'Password'}</h2>
<p>
{nl
? 'Een wachtwoordwijziging meldt bestaande sessies af om je account te beschermen.'
: 'Password changes sign out existing sessions for your protection.'}
</p>
<a href="/reset-password">
{nl ? 'Wachtwoord veilig herstellen' : 'Reset password securely'}
</a>
</section>
</section>
)
}
apps/web/src/app/account/security/session-manager.tsx
+110
View File
@@ -0,0 +1,110 @@
'use client'
import { useEffect, useState } from 'react'
import type { SupportedLocale } from '../../../components/presentation/presentation-model'
interface SessionView {
readonly id: string
readonly createdAt: string
readonly lastSeenAt: string
readonly current: boolean
readonly userAgentSummary?: string
}
export function SessionManager({
locale,
}: {
readonly locale: SupportedLocale
}) {
const [sessions, setSessions] = useState<readonly SessionView[]>([])
const [state, setState] = useState<'loading' | 'ready' | 'error'>('loading')
const nl = locale === 'nl'
async function load() {
try {
const response = await fetch('/api/v1/auth/sessions')
if (!response.ok) throw new Error('load failed')
setSessions((await response.json()) as readonly SessionView[])
setState('ready')
} catch {
setState('error')
}
}
useEffect(() => {
void load()
}, [])
async function revoke(sessionId: string) {
const response = await fetch(
'/api/v1/auth/sessions/' + encodeURIComponent(sessionId),
{ method: 'DELETE' },
)
if (!response.ok) {
setState('error')
return
}
await load()
}
return (
<section className="drb-panel" aria-labelledby="sessions-title">
<h2 id="sessions-title">{nl ? 'Actieve sessies' : 'Active sessions'}</h2>
<div aria-live="polite">
{state === 'loading' ? (
<p>{nl ? 'Sessies laden…' : 'Loading sessions…'}</p>
) : null}
{state === 'error' ? (
<p role="alert">
{nl
? 'Sessies konden niet worden geladen. Probeer opnieuw.'
: 'Sessions could not be loaded. Please try again.'}
</p>
) : null}
</div>
{state === 'ready' && sessions.length === 0 ? (
<p>
{nl
? 'Er zijn geen actieve sessies gevonden.'
: 'No active sessions were found.'}
</p>
) : null}
{state === 'ready' ? (
<ul>
{sessions.map((session) => (
<li key={session.id}>
<strong>
{session.current
? nl
? 'Deze sessie'
: 'This session'
: nl
? 'Aangemelde sessie'
: 'Signed-in session'}
</strong>
<span>
{session.userAgentSummary ??
(nl
? 'Apparaatgegevens niet beschikbaar'
: 'Device details unavailable')}
</span>
<span>
{nl ? 'Laatst actief' : 'Last active'}{' '}
{new Intl.DateTimeFormat(locale, {
dateStyle: 'medium',
timeStyle: 'short',
}).format(new Date(session.lastSeenAt))}
</span>
{!session.current ? (
<button onClick={() => void revoke(session.id)} type="button">
{nl ? 'Sessie intrekken' : 'Revoke session'}
</button>
) : null}
</li>
))}
</ul>
) : null}
</section>
)
}
apps/web/src/app/api/auth/[...all]/route.ts
+21
View File
@@ -0,0 +1,21 @@
import { getAuth } from '@/auth/auth'
import { handleAuthRequest } from '@/auth/csrf'
export const dynamic = 'force-dynamic'
function handle(request: Request) {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) {
return Response.json(
{ code: 'AUTH_UNAVAILABLE', message: 'Authentication is unavailable' },
{ status: 503 },
)
}
return handleAuthRequest(request, getAuth().handler, publicBaseUrl)
}
export const GET = handle
export const POST = handle
export const PATCH = handle
export const PUT = handle
export const DELETE = handle
apps/web/src/app/api/v1/account/personal-data/personal-data-route.test.ts
+85
View File
@@ -0,0 +1,85 @@
import { describe, expect, it, vi } from 'vitest'
import {
handlePersonalDataDeletion,
handlePersonalDataExport,
type PersonalDataRouteDependencies,
} from './personal-data-route'
const origin = 'https://runbook.example.test'
function dependencies(
overrides: Partial<PersonalDataRouteDependencies> = {},
): PersonalDataRouteDependencies {
return {
publicBaseUrl: origin,
resolveUserId: vi.fn().mockResolvedValue('user-1'),
confirmPassword: vi.fn().mockResolvedValue(true),
exportForUser: vi.fn().mockResolvedValue({
schemaVersion: 'devrunbook.personal-data/v1',
profile: { id: 'user-1', email: 'user@example.test' },
}),
anonymizeUser: vi.fn().mockResolvedValue(true),
...overrides,
}
}
function request(method: 'POST' | 'DELETE', requestOrigin = origin) {
return new Request(`${origin}/api/v1/account/personal-data`, {
method,
headers: { 'content-type': 'application/json', origin: requestOrigin },
body: JSON.stringify({ password: 'correct horse battery staple' }),
})
}
describe('personal data HTTP boundary', () => {
it('requires password confirmation and exports without credential material', async () => {
const deps = dependencies()
const response = await handlePersonalDataExport(request('POST'), deps)
const body = await response.text()
expect(response.status).toBe(200)
expect(response.headers.get('content-disposition')).toContain('attachment')
expect(body).toContain('devrunbook.personal-data/v1')
expect(body).not.toContain('correct horse battery staple')
expect(body).not.toContain('passwordHash')
})
it('denies wrong passwords and cross-origin requests before data access', async () => {
const wrong = dependencies({
confirmPassword: vi.fn().mockResolvedValue(false),
})
expect(
(await handlePersonalDataExport(request('POST'), wrong)).status,
).toBe(403)
expect(wrong.exportForUser).not.toHaveBeenCalled()
const crossOrigin = dependencies()
expect(
(
await handlePersonalDataDeletion(
request('DELETE', 'https://attacker.test'),
crossOrigin,
)
).status,
).toBe(403)
expect(crossOrigin.resolveUserId).not.toHaveBeenCalled()
})
it('anonymizes the authenticated non-owner and revokes access', async () => {
const deps = dependencies()
const response = await handlePersonalDataDeletion(request('DELETE'), deps)
expect(response.status).toBe(204)
expect(deps.anonymizeUser).toHaveBeenCalledWith(
expect.objectContaining({ userId: 'user-1' }),
)
})
it('keeps instance-owner deletion behind an explicit ownership transfer', async () => {
const deps = dependencies({
anonymizeUser: vi.fn().mockResolvedValue(false),
})
const response = await handlePersonalDataDeletion(request('DELETE'), deps)
expect(response.status).toBe(409)
})
})
apps/web/src/app/api/v1/account/personal-data/personal-data-route.ts
+159
View File
@@ -0,0 +1,159 @@
import { handleAuthRequest } from '../../../../../auth/csrf'
const maximumBodyBytes = 1_024
export interface PersonalDataRouteDependencies {
readonly publicBaseUrl: string
readonly resolveUserId: (headers: Headers) => Promise<string | null>
readonly confirmPassword: (
userId: string,
password: string,
) => Promise<boolean>
readonly exportForUser: (userId: string) => Promise<unknown | null>
readonly anonymizeUser: (input: {
readonly userId: string
readonly requestId: string
}) => Promise<boolean>
}
function error(
status: number,
code: string,
message: string,
requestId: string,
) {
return Response.json({ error: { code, message, requestId } }, { status })
}
async function passwordFromRequest(request: Request) {
if (
request.headers.get('content-type')?.split(';', 1)[0]?.trim() !==
'application/json'
)
return null
const declared = Number(request.headers.get('content-length') ?? 0)
if (declared > maximumBodyBytes) return null
if (!request.body) return null
const reader = request.body.getReader()
const decoder = new TextDecoder()
let bytes = 0
let body = ''
try {
while (true) {
const chunk = await reader.read()
if (chunk.done) break
bytes += chunk.value.byteLength
if (bytes > maximumBodyBytes) {
await reader.cancel()
return null
}
body += decoder.decode(chunk.value, { stream: true })
}
body += decoder.decode()
} finally {
reader.releaseLock()
}
try {
const value: unknown = JSON.parse(body)
if (!value || typeof value !== 'object' || Array.isArray(value)) return null
const record = value as Record<string, unknown>
if (Object.keys(record).join(',') !== 'password') return null
return typeof record.password === 'string' && record.password.length <= 128
? record.password
: null
} catch {
return null
}
}
async function authorizeSensitiveRequest(
request: Request,
dependencies: PersonalDataRouteDependencies,
requestId: string,
) {
const userId = await dependencies.resolveUserId(request.headers)
if (!userId)
return {
response: error(
401,
'authentication_required',
'Authentication is required',
requestId,
),
}
const password = await passwordFromRequest(request)
if (!password || !(await dependencies.confirmPassword(userId, password))) {
return {
response: error(
403,
'recent_authentication_required',
'Password confirmation is required',
requestId,
),
}
}
return { userId }
}
export function handlePersonalDataExport(
request: Request,
dependencies: PersonalDataRouteDependencies,
) {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
const authorization = await authorizeSensitiveRequest(
sameOriginRequest,
dependencies,
requestId,
)
if ('response' in authorization) return authorization.response
const data = await dependencies.exportForUser(authorization.userId)
if (!data) return error(404, 'not_found', 'User was not found', requestId)
return new Response(JSON.stringify(data, null, 2), {
headers: {
'content-type': 'application/json; charset=utf-8',
'content-disposition':
'attachment; filename="devrunbook-personal-data.json"',
'cache-control': 'no-store',
},
})
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export function handlePersonalDataDeletion(
request: Request,
dependencies: PersonalDataRouteDependencies,
) {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
const authorization = await authorizeSensitiveRequest(
sameOriginRequest,
dependencies,
requestId,
)
if ('response' in authorization) return authorization.response
const deleted = await dependencies.anonymizeUser({
userId: authorization.userId,
requestId,
})
if (!deleted) {
return error(
409,
'deletion_not_permitted',
'Personal data deletion is not permitted for this account',
requestId,
)
}
return new Response(null, { status: 204 })
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
apps/web/src/app/api/v1/account/personal-data/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { createPersonalDataDependencies } from '../../../../../server/personal-data'
import {
handlePersonalDataDeletion,
handlePersonalDataExport,
} from './personal-data-route'
export const dynamic = 'force-dynamic'
export function POST(request: Request) {
return handlePersonalDataExport(request, createPersonalDataDependencies())
}
export function DELETE(request: Request) {
return handlePersonalDataDeletion(request, createPersonalDataDependencies())
}
apps/web/src/app/api/v1/account/presentation/route.ts
+58
View File
@@ -0,0 +1,58 @@
import { z } from 'zod'
import { handleAuthRequest } from '../../../../../auth/csrf'
import {
presentationModes,
supportedLocales,
} from '../../../../../components/presentation/presentation-model'
import { resolveAuthenticatedWorkspaceContext } from '../../../../../server/authenticated-workspace-context'
export const dynamic = 'force-dynamic'
const requestSchema = z.strictObject({
mode: z.enum(presentationModes),
locale: z.enum(supportedLocales),
})
export function POST(request: Request) {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return handleAuthRequest(
request,
async () => {
try {
await resolveAuthenticatedWorkspaceContext(request)
const preference = requestSchema.parse(await request.json())
const secure = new URL(publicBaseUrl).protocol === 'https:'
const response = new Response(null, { status: 204 })
const suffix = `Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly${secure ? '; Secure' : ''}`
response.headers.append(
'Set-Cookie',
`devrunbook_mode=${preference.mode}; ${suffix}`,
)
response.headers.append(
'Set-Cookie',
`devrunbook_locale=${preference.locale}; ${suffix}`,
)
return response
} catch (error) {
const code =
error !== null && typeof error === 'object' && 'code' in error
? error.code
: undefined
return Response.json(
{ error: { code: 'presentation_preference_invalid' } },
{
status:
code === 'authentication_required'
? 401
: code === 'workspace_access_denied'
? 403
: 422,
},
)
}
},
publicBaseUrl,
)
}
apps/web/src/app/api/v1/artifacts/[artifactId]/download/route.ts
+17
View File
@@ -0,0 +1,17 @@
import { handleDownloadGeneratedArtifact } from '../../artifact-http'
import { generatedArtifactRouteDependencies } from '../../artifact-route-dependencies'
export const dynamic = 'force-dynamic'
export function GET(
request: Request,
context: { params: Promise<{ artifactId: string }> },
) {
return context.params.then(({ artifactId }) =>
handleDownloadGeneratedArtifact(
request,
artifactId,
generatedArtifactRouteDependencies(),
),
)
}
apps/web/src/app/api/v1/artifacts/artifact-http.test.ts
+212
View File
@@ -0,0 +1,212 @@
import type {
ActorContext,
GeneratedArtifactMetadata,
} from '@devrunbook/application'
import { describe, expect, it, vi } from 'vitest'
import {
contentDisposition,
handleCreateGeneratedArtifact,
handleDownloadGeneratedArtifact,
type GeneratedArtifactHttpService,
type GeneratedArtifactRouteDependencies,
} from './artifact-http'
const userId = '00000000-0000-4000-8000-000000000001'
const workspaceId = '00000000-0000-4000-8000-000000000002'
const runId = '00000000-0000-4000-8000-000000000003'
const artifactId = '00000000-0000-4000-8000-000000000004'
const actor: ActorContext = {
userId,
workspaceId,
instanceRole: 'user',
workspaceRole: 'editor',
}
const metadata: GeneratedArtifactMetadata = {
id: artifactId,
workspaceId,
runId,
artifactType: 'markdown',
storageKey: 'a'.repeat(64),
filename: 'DevRunbook-résumé-TASK.md',
mediaType: 'text/markdown; charset=utf-8',
sizeBytes: 7n,
sha256: 'b'.repeat(64),
expiresAt: '2026-10-25T12:00:00.000Z',
createdAt: '2026-07-27T12:00:00.000Z',
}
function service(created = true): GeneratedArtifactHttpService {
return {
create: vi.fn(async () => ({ artifact: metadata, created })),
download: vi.fn(async () => ({
artifact: metadata,
content: new TextEncoder().encode('# Task\n'),
})),
}
}
function dependencies(
overrides: Partial<GeneratedArtifactRouteDependencies> = {},
): GeneratedArtifactRouteDependencies {
return {
publicBaseUrl: 'https://devrunbook.example',
resolveContext: vi.fn(async () => actor),
service: service(),
...overrides,
}
}
function post(
body = '{"type":"markdown"}',
headers: Readonly<Record<string, string>> = {},
): Request {
return new Request(
`https://devrunbook.example/api/v1/runs/${runId}/artifacts`,
{
method: 'POST',
body,
headers: {
Origin: 'https://devrunbook.example',
'Content-Type': 'application/json',
'Idempotency-Key': 'artifact-export-1',
...headers,
},
},
)
}
describe('generated artifact HTTP boundary', () => {
it('creates synchronous artifacts and reports exact idempotent replays', async () => {
const createdService = service()
const created = await handleCreateGeneratedArtifact(
post(),
runId,
dependencies({ service: createdService }),
)
expect(created.status).toBe(201)
expect(created.headers.get('location')).toBe(
`/api/v1/artifacts/${artifactId}/download`,
)
expect(created.headers.get('cache-control')).toBe('no-store')
expect(created.headers.get('x-content-type-options')).toBe('nosniff')
expect(createdService.create).toHaveBeenCalledWith(
actor,
runId,
'markdown',
'artifact-export-1',
)
expect(await created.json()).toMatchObject({
id: artifactId,
runId,
type: 'markdown',
sizeBytes: 7,
downloadUrl: `/api/v1/artifacts/${artifactId}/download`,
})
const replay = await handleCreateGeneratedArtifact(
post(),
runId,
dependencies({ service: service(false) }),
)
expect(replay.status).toBe(200)
expect(replay.headers.get('idempotency-replayed')).toBe('true')
})
it('rejects cross-origin, viewer, malformed, duplicate and unsupported requests safely', async () => {
const crossOrigin = await handleCreateGeneratedArtifact(
post('{"type":"markdown"}', { Origin: 'https://attacker.example' }),
runId,
dependencies(),
)
expect(crossOrigin.status).toBe(403)
const denied = service()
denied.create = vi.fn(async () => {
throw Object.assign(new Error('private membership detail'), {
code: 'workspace_access_denied',
})
})
const viewer = await handleCreateGeneratedArtifact(
post(),
runId,
dependencies({ service: denied }),
)
expect(viewer.status).toBe(403)
expect(await viewer.text()).not.toContain('private membership')
for (const request of [
post('{"type":"markdown","type":"prompt_text"}'),
post('{"type":"support_bundle"}'),
post('{"type":"markdown","content":"spoofed"}'),
post('{"type":"markdown"}', { 'Idempotency-Key': '' }),
]) {
const response = await handleCreateGeneratedArtifact(
request,
runId,
dependencies(),
)
expect(response.status).toBe(422)
}
})
it('allows authorized viewer downloads with safe immutable headers', async () => {
const viewer = { ...actor, workspaceRole: 'viewer' } satisfies ActorContext
const downloadService = service()
const response = await handleDownloadGeneratedArtifact(
new Request(
`https://devrunbook.example/api/v1/artifacts/${artifactId}/download`,
),
artifactId,
dependencies({
resolveContext: vi.fn(async () => viewer),
service: downloadService,
}),
)
expect(response.status).toBe(200)
expect(response.headers.get('content-type')).toBe(
'text/markdown; charset=utf-8',
)
expect(response.headers.get('content-length')).toBe('7')
expect(response.headers.get('cache-control')).toBe('no-store')
expect(response.headers.get('x-content-type-options')).toBe('nosniff')
expect(response.headers.get('x-devrunbook-artifact-sha256')).toBe(
metadata.sha256,
)
expect(response.headers.get('content-disposition')).toBe(
contentDisposition(metadata.filename),
)
expect(response.headers.get('content-disposition')).toContain(
"filename*=UTF-8''DevRunbook-r%C3%A9sum%C3%A9-TASK.md",
)
expect(await response.text()).toBe('# Task\n')
expect(downloadService.download).toHaveBeenCalledWith(viewer, artifactId)
})
it('conceals invalid ids and refuses metadata-controlled active content types', async () => {
const invalid = await handleDownloadGeneratedArtifact(
new Request(
'https://devrunbook.example/api/v1/artifacts/not-uuid/download',
),
'not-uuid',
dependencies(),
)
expect(invalid.status).toBe(404)
const unsafe = service()
unsafe.download = vi.fn(async () => ({
artifact: { ...metadata, mediaType: 'text/html' },
content: new TextEncoder().encode('<script>bad</script>'),
}))
const refused = await handleDownloadGeneratedArtifact(
new Request(
`https://devrunbook.example/api/v1/artifacts/${artifactId}/download`,
),
artifactId,
dependencies({ service: unsafe }),
)
expect(refused.status).toBe(503)
expect(refused.headers.get('content-type')).toContain('application/json')
expect(await refused.text()).not.toContain('<script>')
})
})
apps/web/src/app/api/v1/artifacts/artifact-http.ts
+397
View File
@@ -0,0 +1,397 @@
import type {
ActorContext,
GeneratedArtifactDownload,
StoreGeneratedArtifactResult,
SynchronousRunArtifactType,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../server/authenticated-workspace-context'
import { parseStrictJson } from '../compositions/drafts/composition-draft-http'
const maximumRequestBytes = 4_096
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
const artifactTypes = new Set<SynchronousRunArtifactType>([
'prompt_text',
'markdown',
'run_pack_zip',
'agents_suggestion',
])
export interface GeneratedArtifactHttpService {
create(
actor: ActorContext,
runId: string,
artifactType: SynchronousRunArtifactType,
idempotencyKey: string,
): Promise<StoreGeneratedArtifactResult>
download(
actor: ActorContext,
artifactId: string,
): Promise<GeneratedArtifactDownload>
}
export interface GeneratedArtifactRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly service: GeneratedArtifactHttpService
}
interface ErrorLike {
readonly code: string
}
function errorLike(value: unknown): ErrorLike | null {
if (value === null || typeof value !== 'object' || Array.isArray(value)) {
return null
}
const candidate = value as Readonly<Record<string, unknown>>
return typeof candidate.code === 'string' ? { code: candidate.code } : null
}
function errorResponse(
status: number,
code: string,
message: string,
requestId: string,
headers: Readonly<Record<string, string>> = {},
): Response {
return Response.json(
{ error: { code, message, requestId } },
{
status,
headers: {
'Cache-Control': 'no-store',
'X-Content-Type-Options': 'nosniff',
...headers,
},
},
)
}
function mappedError(caught: unknown, requestId: string): Response {
if (caught instanceof AuthenticatedWorkspaceContextError) {
return errorResponse(
caught.code === 'authentication_required' ? 401 : 403,
caught.code,
caught.code === 'authentication_required'
? 'Authentication required'
: 'Access denied',
requestId,
)
}
const error = errorLike(caught)
if (error?.code === 'authentication_required') {
return errorResponse(401, error.code, 'Authentication required', requestId)
}
if (error?.code === 'workspace_access_denied') {
return errorResponse(403, error.code, 'Access denied', requestId)
}
if (
error?.code === 'generated_artifact_not_found' ||
error?.code === 'generated_artifact_run_not_found'
) {
return errorResponse(404, error.code, 'Resource not found', requestId)
}
if (
error?.code === 'generated_artifact_request_invalid' ||
error?.code === 'generated_artifact_type_invalid' ||
error?.code === 'generated_artifact_idempotency_key_invalid' ||
error?.code === 'generated_artifact_source_unavailable' ||
error?.code === 'agents_suggestion_profile_unavailable'
) {
return errorResponse(
422,
error.code,
'Artifact request is invalid',
requestId,
)
}
if (error?.code === 'generated_artifact_request_too_large') {
return errorResponse(
413,
error.code,
'Artifact request is too large',
requestId,
)
}
if (error?.code === 'generated_artifact_too_large') {
return errorResponse(
413,
error.code,
'Generated artifact is too large',
requestId,
)
}
if (
error?.code === 'generated_artifact_idempotency_conflict' ||
error?.code === 'generated_artifact_store_invariant_failed'
) {
return errorResponse(
409,
error.code,
'Idempotency key is associated with a different artifact request',
requestId,
)
}
if (error?.code === 'generated_artifact_renderer_unavailable') {
return errorResponse(
503,
error.code,
'Requested artifact generation is temporarily unavailable',
requestId,
{ 'Retry-After': '30' },
)
}
if (error?.code === 'generated_artifact_expired') {
return errorResponse(410, error.code, 'Artifact has expired', requestId)
}
return errorResponse(
503,
'generated_artifact_service_unavailable',
'Artifact service is temporarily unavailable',
requestId,
)
}
function plainObject(value: unknown): value is Record<string, unknown> {
return (
value !== null &&
typeof value === 'object' &&
!Array.isArray(value) &&
Object.getPrototypeOf(value) === Object.prototype
)
}
async function readRequestBody(request: Request): Promise<string> {
const contentType = request.headers.get('content-type')
if (
!contentType ||
!/^application\/json(?:\s*;\s*charset=utf-8)?$/iu.test(contentType)
) {
throw Object.assign(new Error('Unsupported content type'), {
code: 'generated_artifact_request_too_large',
})
}
const declared = request.headers.get('content-length')
if (
declared !== null &&
(!/^[0-9]+$/u.test(declared) || Number(declared) > maximumRequestBytes)
) {
throw Object.assign(new Error('Artifact request is too large'), {
code: 'generated_artifact_request_invalid',
})
}
if (!request.body) {
throw Object.assign(new Error('Artifact request body is required'), {
code: 'generated_artifact_request_invalid',
})
}
const reader = request.body.getReader()
const chunks: Uint8Array[] = []
let size = 0
while (true) {
const { done, value } = await reader.read()
if (done) break
size += value.byteLength
if (size > maximumRequestBytes) {
await reader.cancel()
throw Object.assign(new Error('Artifact request is too large'), {
code: 'generated_artifact_request_too_large',
})
}
chunks.push(value)
}
const bytes = new Uint8Array(size)
let offset = 0
for (const chunk of chunks) {
bytes.set(chunk, offset)
offset += chunk.byteLength
}
try {
return new TextDecoder('utf-8', { fatal: true }).decode(bytes)
} catch {
throw Object.assign(new Error('Artifact request must be valid UTF-8'), {
code: 'generated_artifact_request_invalid',
})
}
}
async function artifactType(
request: Request,
): Promise<SynchronousRunArtifactType> {
let value: unknown
try {
value = parseStrictJson(await readRequestBody(request))
} catch (caught) {
const parsed = errorLike(caught)
if (parsed?.code.startsWith('generated_artifact_request_')) throw caught
throw Object.assign(new Error('Artifact request must contain valid JSON'), {
code: 'generated_artifact_request_invalid',
})
}
if (
!plainObject(value) ||
Object.keys(value).length !== 1 ||
!('type' in value) ||
typeof value.type !== 'string' ||
!artifactTypes.has(value.type as SynchronousRunArtifactType)
) {
throw Object.assign(new Error('Artifact type is invalid'), {
code: 'generated_artifact_request_invalid',
})
}
return value.type as SynchronousRunArtifactType
}
function assertIdentifier(value: string, code: string): void {
if (!uuidPattern.test(value)) {
throw Object.assign(new Error('Resource not found'), { code })
}
}
function idempotencyKey(request: Request): string {
const value = request.headers.get('idempotency-key')
if (
!value ||
value.length > 255 ||
value.trim() !== value ||
/[\0\r\n]/u.test(value)
) {
throw Object.assign(new Error('Invalid idempotency key'), {
code: 'generated_artifact_idempotency_key_invalid',
})
}
return value
}
function artifactEnvelope(result: StoreGeneratedArtifactResult) {
const artifact = result.artifact
return {
id: artifact.id,
runId: artifact.runId,
type: artifact.artifactType,
filename: artifact.filename,
mediaType: artifact.mediaType,
sizeBytes: Number(artifact.sizeBytes),
sha256: artifact.sha256,
expiresAt: artifact.expiresAt,
createdAt: artifact.createdAt,
downloadUrl: `/api/v1/artifacts/${artifact.id}/download`,
}
}
function contentType(download: GeneratedArtifactDownload): string {
const expected: Partial<
Record<typeof download.artifact.artifactType, string>
> = {
prompt_text: 'text/plain; charset=utf-8',
markdown: 'text/markdown; charset=utf-8',
run_pack_zip: 'application/zip',
agents_suggestion: 'text/markdown; charset=utf-8',
support_bundle: 'application/zip',
}
const mediaType = expected[download.artifact.artifactType]
if (!mediaType || download.artifact.mediaType !== mediaType) {
throw Object.assign(new Error('Unsafe artifact media type'), {
code: 'generated_artifact_integrity_failed',
})
}
return mediaType
}
function asciiFilename(filename: string): string {
const safe = filename
.replace(/[^\x20-\x7e]/gu, '_')
.replace(/["\\]/gu, '_')
.slice(0, 180)
return safe || 'devrunbook-artifact'
}
export function contentDisposition(filename: string): string {
const encoded = encodeURIComponent(filename).replace(
/[!'()*]/gu,
(value) => `%${value.charCodeAt(0).toString(16).toUpperCase()}`,
)
return `attachment; filename="${asciiFilename(filename)}"; filename*=UTF-8''${encoded}`
}
export function handleCreateGeneratedArtifact(
request: Request,
runId: string,
dependencies: GeneratedArtifactRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
if (
sameOriginRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return errorResponse(
403,
'invalid_origin',
'Invalid request origin',
requestId,
)
}
try {
assertIdentifier(runId, 'generated_artifact_run_not_found')
const actor = await dependencies.resolveContext(sameOriginRequest)
const key = idempotencyKey(sameOriginRequest)
const type = await artifactType(sameOriginRequest)
const result = await dependencies.service.create(
actor,
runId,
type,
key,
)
return Response.json(artifactEnvelope(result), {
status: result.created ? 201 : 200,
headers: {
'Cache-Control': 'no-store',
'X-Content-Type-Options': 'nosniff',
Location: `/api/v1/artifacts/${result.artifact.id}/download`,
...(result.created ? {} : { 'Idempotency-Replayed': 'true' }),
},
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
dependencies.publicBaseUrl,
() =>
errorResponse(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export async function handleDownloadGeneratedArtifact(
request: Request,
artifactId: string,
dependencies: GeneratedArtifactRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
try {
assertIdentifier(artifactId, 'generated_artifact_not_found')
const actor = await dependencies.resolveContext(request)
const download = await dependencies.service.download(actor, artifactId)
const body = download.content.buffer.slice(
download.content.byteOffset,
download.content.byteOffset + download.content.byteLength,
) as ArrayBuffer
return new Response(body, {
headers: {
'Cache-Control': 'no-store',
'Content-Type': contentType(download),
'Content-Length': String(download.content.byteLength),
'Content-Disposition': contentDisposition(download.artifact.filename),
'X-Content-Type-Options': 'nosniff',
'X-DevRunbook-Artifact-SHA256': download.artifact.sha256,
},
})
} catch (caught) {
return mappedError(caught, requestId)
}
}
apps/web/src/app/api/v1/artifacts/artifact-route-dependencies.ts
+14
View File
@@ -0,0 +1,14 @@
import { resolveAuthenticatedWorkspaceContext } from '../../../../server/authenticated-workspace-context'
import { getGeneratedArtifactServer } from '../../../../server/generated-artifacts'
import type { GeneratedArtifactRouteDependencies } from './artifact-http'
export function generatedArtifactRouteDependencies(): GeneratedArtifactRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
service: getGeneratedArtifactServer(),
}
}
apps/web/src/app/api/v1/audit-events/route.ts
+8
View File
@@ -0,0 +1,8 @@
import { handleListAuditEvents } from '../operations-http'
import { operationsRouteDependencies } from '../operations-route-dependencies'
export const dynamic = 'force-dynamic'
export function GET(request: Request) {
return handleListAuditEvents(request, operationsRouteDependencies())
}
apps/web/src/app/api/v1/auth/invitations/accept/route.ts
+26
View File
@@ -0,0 +1,26 @@
import {
createInvitation,
consumeInvitation,
resolveInvitationActor,
} from '../../../../../../server/invitations'
import {
handleAcceptInvitation,
type InvitationHttpDependencies,
} from '../../../invitations/invitation-http'
export const dynamic = 'force-dynamic'
function dependencies(): InvitationHttpDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveActor: resolveInvitationActor,
create: createInvitation,
consume: consumeInvitation,
}
}
export function POST(request: Request) {
return handleAcceptInvitation(request, dependencies())
}
apps/web/src/app/api/v1/auth/password-reset/password-reset-route.test.ts
+106
View File
@@ -0,0 +1,106 @@
import { describe, expect, it, vi } from 'vitest'
import { handlePasswordResetPost } from './password-reset-route'
const token = 'a'.repeat(43)
const publicBaseUrl = 'https://runbook.example.test'
function request(origin = publicBaseUrl) {
return new Request(`${publicBaseUrl}/api/v1/auth/password-reset`, {
method: 'POST',
headers: { 'content-type': 'application/json', origin },
body: JSON.stringify({
token,
password: 'a secure password value',
passwordConfirmation: 'a secure password value',
}),
})
}
function dependencies(
overrides: Partial<Parameters<typeof handlePasswordResetPost>[1]> = {},
) {
return {
publicBaseUrl,
isConsumable: vi.fn(async () => true),
hashPassword: vi.fn(async () => 'better-auth-hash'),
consume: vi.fn(async () => undefined),
...overrides,
}
}
describe('password reset route boundary', () => {
it('hashes only after preflight and consumes atomically', async () => {
const deps = dependencies()
const response = await handlePasswordResetPost(request(), deps)
expect(response.status).toBe(200)
expect(deps.isConsumable).toHaveBeenCalledWith(token)
expect(deps.hashPassword).toHaveBeenCalledWith('a secure password value')
expect(deps.consume).toHaveBeenCalledWith({
rawToken: token,
betterAuthPasswordHash: 'better-auth-hash',
})
})
it('returns identical failures for invalid preflight and final replay race', async () => {
const preflight = await handlePasswordResetPost(
request(),
dependencies({ isConsumable: vi.fn(async () => false) }),
)
const replay = await handlePasswordResetPost(
request(),
dependencies({
consume: vi.fn(async () => Promise.reject(new Error('used'))),
}),
)
expect(preflight.status).toBe(400)
expect(replay.status).toBe(400)
expect(await preflight.json()).toEqual(await replay.json())
})
it('rejects cross-origin requests before validation or hashing', async () => {
const deps = dependencies()
const response = await handlePasswordResetPost(
request('https://attacker.example.test'),
deps,
)
expect(response.status).toBe(403)
expect(deps.isConsumable).not.toHaveBeenCalled()
expect(deps.hashPassword).not.toHaveBeenCalled()
})
it('rejects oversized request bodies before preflight or hashing', async () => {
const deps = dependencies()
const oversized = request()
oversized.headers.set('content-length', '4097')
const response = await handlePasswordResetPost(oversized, deps)
expect(response.status).toBe(400)
expect(deps.isConsumable).not.toHaveBeenCalled()
expect(deps.hashPassword).not.toHaveBeenCalled()
})
it('caps an oversized streamed body without a content length', async () => {
const deps = dependencies()
const oversized = new Request(
`${publicBaseUrl}/api/v1/auth/password-reset`,
{
method: 'POST',
headers: { 'content-type': 'application/json', origin: publicBaseUrl },
body: ' '.repeat(4097),
},
)
const response = await handlePasswordResetPost(oversized, deps)
expect(response.status).toBe(400)
expect(deps.isConsumable).not.toHaveBeenCalled()
expect(deps.hashPassword).not.toHaveBeenCalled()
})
it('requires an application/json request body', async () => {
const deps = dependencies()
const invalidContentType = request()
invalidContentType.headers.set('content-type', 'text/plain')
const response = await handlePasswordResetPost(invalidContentType, deps)
expect(response.status).toBe(400)
expect(deps.isConsumable).not.toHaveBeenCalled()
})
})
apps/web/src/app/api/v1/auth/password-reset/password-reset-route.ts
+118
View File
@@ -0,0 +1,118 @@
import { handleAuthRequest } from '../../../../../auth/csrf'
import { genericPasswordResetFailure } from '../../../../reset-password/reset-password-form'
const maximumBodyBytes = 4_096
const tokenPattern = /^[A-Za-z0-9_-]{32,512}$/u
export interface PasswordResetRouteDependencies {
readonly publicBaseUrl: string
readonly isConsumable: (rawToken: string) => Promise<boolean>
readonly hashPassword: (password: string) => Promise<string>
readonly consume: (input: {
rawToken: string
betterAuthPasswordHash: string
}) => Promise<void>
}
function genericFailure() {
return Response.json(
{ code: 'PASSWORD_RESET_FAILED', message: genericPasswordResetFailure },
{ status: 400 },
)
}
function readLength(request: Request): number | null {
const header = request.headers.get('content-length')
if (header === null) return null
const parsed = Number(header)
return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : null
}
async function readBoundedBody(request: Request): Promise<string | null> {
if (!request.body) return ''
const reader = request.body.getReader()
const decoder = new TextDecoder()
let byteLength = 0
let text = ''
try {
while (true) {
const chunk = await reader.read()
if (chunk.done) return text + decoder.decode()
byteLength += chunk.value.byteLength
if (byteLength > maximumBodyBytes) {
await reader.cancel()
return null
}
text += decoder.decode(chunk.value, { stream: true })
}
} finally {
reader.releaseLock()
}
}
async function parseRequest(request: Request) {
if (
request.headers.get('content-type')?.split(';', 1)[0]?.trim() !==
'application/json'
) {
return null
}
const declaredLength = readLength(request)
if (declaredLength !== null && declaredLength > maximumBodyBytes) return null
const text = await readBoundedBody(request)
if (text === null) return null
let value: unknown
try {
value = JSON.parse(text)
} catch {
return null
}
if (!value || typeof value !== 'object' || Array.isArray(value)) return null
const record = value as Record<string, unknown>
const keys = Object.keys(record).sort()
if (keys.join(',') !== 'password,passwordConfirmation,token') return null
if (
typeof record.token !== 'string' ||
!tokenPattern.test(record.token) ||
typeof record.password !== 'string' ||
record.password.length < 12 ||
record.password.length > 128 ||
record.passwordConfirmation !== record.password
) {
return null
}
return { token: record.token, password: record.password }
}
export function handlePasswordResetPost(
request: Request,
dependencies: PasswordResetRouteDependencies,
): Promise<Response> {
return handleAuthRequest(
request,
async (sameOriginRequest) => {
const parsed = await parseRequest(sameOriginRequest)
if (!parsed) return genericFailure()
try {
// Cheap HMAC/database preflight prevents untrusted random tokens from
// triggering the intentionally expensive password hashing operation.
if (!(await dependencies.isConsumable(parsed.token))) {
return genericFailure()
}
const betterAuthPasswordHash = await dependencies.hashPassword(
parsed.password,
)
await dependencies.consume({
rawToken: parsed.token,
betterAuthPasswordHash,
})
return Response.json({ success: true })
} catch {
// Final consume is authoritative. Races, expiry, replay, and unavailable
// users intentionally share the same public response as preflight.
return genericFailure()
}
},
dependencies.publicBaseUrl,
)
}
apps/web/src/app/api/v1/auth/password-reset/route.ts
+19
View File
@@ -0,0 +1,19 @@
import { createPasswordResetService } from '@/server/password-reset-service'
import { handlePasswordResetPost } from './password-reset-route'
export const dynamic = 'force-dynamic'
export function POST(request: Request) {
const service = createPasswordResetService(process.env)
if (!service) {
return Response.json(
{
code: 'PASSWORD_RESET_UNAVAILABLE',
message: 'Password reset is unavailable.',
},
{ status: 503 },
)
}
return handlePasswordResetPost(request, service)
}
apps/web/src/app/api/v1/auth/sessions/[sessionId]/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { createSessionRouteDependencies } from '../../../../../../server/session-management'
import { handleRevokeSession } from '../session-route'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ sessionId: string }> }
export async function DELETE(request: Request, context: RouteContext) {
const { sessionId } = await context.params
return handleRevokeSession(
request,
sessionId,
createSessionRouteDependencies(),
)
}
apps/web/src/app/api/v1/auth/sessions/route.ts
+8
View File
@@ -0,0 +1,8 @@
import { createSessionRouteDependencies } from '../../../../../server/session-management'
import { handleListSessions } from './session-route'
export const dynamic = 'force-dynamic'
export async function GET(request: Request) {
return handleListSessions(request, createSessionRouteDependencies())
}
apps/web/src/app/api/v1/auth/sessions/session-route.test.ts
+113
View File
@@ -0,0 +1,113 @@
import { describe, expect, it, vi } from 'vitest'
import {
handleListSessions,
handleRevokeSession,
type SessionRouteDependencies,
} from './session-route'
const now = new Date('2026-07-27T12:00:00.000Z')
function dependencies(
overrides: Partial<SessionRouteDependencies> = {},
): SessionRouteDependencies {
return {
publicBaseUrl: 'https://runbook.example.test',
resolveIdentity: vi.fn().mockResolvedValue({
userId: '00000000-0000-4000-8000-000000000001',
sessionId: 'current-session',
}),
listActive: vi.fn().mockResolvedValue([
{
id: 'current-session',
createdAt: now,
lastSeenAt: now,
idleExpiresAt: new Date('2026-07-28T12:00:00.000Z'),
absoluteExpiresAt: new Date('2026-08-27T12:00:00.000Z'),
userAgentSummary: 'Firefox on Linux',
},
]),
revokeOwned: vi.fn().mockResolvedValue(true),
...overrides,
}
}
describe('session HTTP boundary', () => {
it('lists only store-provided actor sessions and marks the current one', async () => {
const deps = dependencies()
const response = await handleListSessions(
new Request('http://devrunbook.test/api/v1/auth/sessions'),
deps,
)
expect(response.status).toBe(200)
expect(await response.json()).toEqual([
expect.objectContaining({
id: 'current-session',
current: true,
userAgentSummary: 'Firefox on Linux',
}),
])
expect(deps.listActive).toHaveBeenCalledWith(
'00000000-0000-4000-8000-000000000001',
)
})
it('does not disclose sessions across users', async () => {
const deps = dependencies({ revokeOwned: vi.fn().mockResolvedValue(false) })
const response = await handleRevokeSession(
new Request('https://runbook.example.test/api/v1/auth/sessions/other', {
method: 'DELETE',
headers: { origin: 'https://runbook.example.test' },
}),
'other',
deps,
)
expect(response.status).toBe(404)
expect(deps.revokeOwned).toHaveBeenCalledWith(
expect.objectContaining({
actorUserId: '00000000-0000-4000-8000-000000000001',
sessionId: 'other',
}),
)
})
it('requires authentication for listing and revocation', async () => {
const deps = dependencies({
resolveIdentity: vi.fn().mockResolvedValue(null),
})
const list = await handleListSessions(
new Request('http://devrunbook.test/api/v1/auth/sessions'),
deps,
)
const revoke = await handleRevokeSession(
new Request('https://runbook.example.test/api/v1/auth/sessions/session', {
method: 'DELETE',
headers: { origin: 'https://runbook.example.test' },
}),
'session',
deps,
)
expect(list.status).toBe(401)
expect(revoke.status).toBe(401)
expect(deps.revokeOwned).not.toHaveBeenCalled()
})
it('rejects cross-origin revocation before identity resolution', async () => {
const deps = dependencies()
const response = await handleRevokeSession(
new Request('https://runbook.example.test/api/v1/auth/sessions/session', {
method: 'DELETE',
headers: { origin: 'https://attacker.example.test' },
}),
'session',
deps,
)
expect(response.status).toBe(403)
expect(deps.resolveIdentity).not.toHaveBeenCalled()
expect(deps.revokeOwned).not.toHaveBeenCalled()
})
})
apps/web/src/app/api/v1/auth/sessions/session-route.ts
+108
View File
@@ -0,0 +1,108 @@
import { handleAuthRequest } from '../../../../../auth/csrf'
interface SessionView {
readonly id: string
readonly createdAt: Date
readonly lastSeenAt: Date
readonly idleExpiresAt: Date
readonly absoluteExpiresAt: Date
readonly userAgentSummary: string | null
}
export interface SessionIdentity {
readonly userId: string
readonly sessionId: string
}
export interface SessionRouteDependencies {
readonly publicBaseUrl: string
readonly resolveIdentity: (
headers: Headers,
) => Promise<SessionIdentity | null>
readonly listActive: (userId: string) => Promise<readonly SessionView[]>
readonly revokeOwned: (input: {
readonly actorUserId: string
readonly sessionId: string
readonly requestId: string
}) => Promise<boolean>
}
function errorResponse(
status: number,
code: string,
message: string,
requestId: string,
) {
return Response.json({ error: { code, message, requestId } }, { status })
}
export async function handleListSessions(
request: Request,
dependencies: SessionRouteDependencies,
) {
const requestId = crypto.randomUUID()
const identity = await dependencies.resolveIdentity(request.headers)
if (!identity) {
return errorResponse(
401,
'authentication_required',
'Authentication is required',
requestId,
)
}
const sessions = await dependencies.listActive(identity.userId)
return Response.json(
sessions.map((session) => ({
id: session.id,
createdAt: session.createdAt.toISOString(),
lastSeenAt: session.lastSeenAt.toISOString(),
idleExpiresAt: session.idleExpiresAt.toISOString(),
absoluteExpiresAt: session.absoluteExpiresAt.toISOString(),
current: session.id === identity.sessionId,
...(session.userAgentSummary
? { userAgentSummary: session.userAgentSummary }
: {}),
})),
)
}
export async function handleRevokeSession(
request: Request,
sessionId: string,
dependencies: SessionRouteDependencies,
) {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
const identity = await dependencies.resolveIdentity(
sameOriginRequest.headers,
)
if (!identity) {
return errorResponse(
401,
'authentication_required',
'Authentication is required',
requestId,
)
}
const revoked = await dependencies.revokeOwned({
actorUserId: identity.userId,
sessionId,
requestId,
})
if (!revoked) {
return errorResponse(
404,
'not_found',
'Session was not found',
requestId,
)
}
return new Response(null, { status: 204 })
},
dependencies.publicBaseUrl,
() =>
errorResponse(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
apps/web/src/app/api/v1/collections/[collectionId]/playbooks/[playbookId]/route.ts
+30
View File
@@ -0,0 +1,30 @@
import { handleCollectionItemMutation } from '../../../collection-http'
import { collectionRouteDependencies } from '../../../route'
export const dynamic = 'force-dynamic'
type RouteContext = {
params: Promise<{ collectionId: string; playbookId: string }>
}
export async function PUT(request: Request, context: RouteContext) {
const { collectionId, playbookId } = await context.params
return handleCollectionItemMutation(
request,
collectionId,
playbookId,
'add',
collectionRouteDependencies(),
)
}
export async function DELETE(request: Request, context: RouteContext) {
const { collectionId, playbookId } = await context.params
return handleCollectionItemMutation(
request,
collectionId,
playbookId,
'remove',
collectionRouteDependencies(),
)
}
apps/web/src/app/api/v1/collections/collection-http.test.ts
+188
View File
@@ -0,0 +1,188 @@
import type { ActorContext, PlaybookCollection } from '@devrunbook/application'
import { describe, expect, it, vi } from 'vitest'
import { AuthenticatedWorkspaceContextError } from '../../../../server/authenticated-workspace-context'
import {
handleCollectionItemMutation,
handleCreateCollection,
handleListCollections,
type CollectionRouteDependencies,
} from './collection-http'
const origin = 'https://runbook.example.test'
const collectionId = '00000000-0000-4000-8000-000000000003'
const playbookId = '00000000-0000-4000-8000-000000000004'
const actor: ActorContext = {
userId: '00000000-0000-4000-8000-000000000001',
workspaceId: '00000000-0000-4000-8000-000000000002',
instanceRole: 'user',
workspaceRole: 'viewer',
}
const created: PlaybookCollection = {
id: collectionId,
name: 'Release checks',
description: 'Before shipping',
itemCount: 0,
playbookIds: [],
createdAt: new Date('2026-07-27T12:00:00.000Z'),
updatedAt: new Date('2026-07-27T12:00:00.000Z'),
}
function dependencies(
overrides: Partial<CollectionRouteDependencies> = {},
): CollectionRouteDependencies {
return {
publicBaseUrl: origin,
resolveContext: vi.fn(async () => actor),
list: vi.fn(async () => [created]),
create: vi.fn(async () => created),
mutateItem: vi.fn(async () => undefined),
...overrides,
}
}
function mutationRequest(method: 'POST' | 'PUT' | 'DELETE', body?: unknown) {
return new Request(`${origin}/api/v1/collections`, {
method,
headers: {
origin,
...(body === undefined ? {} : { 'content-type': 'application/json' }),
},
...(body === undefined ? {} : { body: JSON.stringify(body) }),
})
}
async function expectError(response: Response, status: number, code: string) {
expect(response.status).toBe(status)
expect(await response.json()).toMatchObject({
error: { code, message: expect.any(String), requestId: expect.any(String) },
})
}
describe('collection HTTP contract', () => {
it('lists only the authenticated actor personal collections', async () => {
const context = dependencies()
const response = await handleListCollections(
new Request(`${origin}/api/v1/collections`),
context,
)
expect(response.status).toBe(200)
expect(response.headers.get('cache-control')).toBe('no-store')
expect(await response.json()).toEqual([
{
...created,
createdAt: created.createdAt.toISOString(),
updatedAt: created.updatedAt.toISOString(),
},
])
expect(context.list).toHaveBeenCalledWith(actor)
})
it('creates from the closed JSON body and rejects unknown fields', async () => {
const context = dependencies()
const response = await handleCreateCollection(
mutationRequest('POST', {
name: 'Release checks',
description: 'Before shipping',
}),
context,
)
expect(response.status).toBe(201)
expect(context.create).toHaveBeenCalledWith(actor, {
name: 'Release checks',
description: 'Before shipping',
})
await expectError(
await handleCreateCollection(
mutationRequest('POST', { name: 'Unsafe', workspaceId: 'substitute' }),
dependencies(),
),
422,
'collection_request_invalid',
)
})
it.each([
['PUT', 'add'],
['DELETE', 'remove'],
] as const)(
'maps %s to an idempotent %s item mutation',
async (method, mutation) => {
const context = dependencies()
const response = await handleCollectionItemMutation(
mutationRequest(method),
collectionId,
playbookId,
mutation,
context,
)
expect(response.status).toBe(204)
expect(context.mutateItem).toHaveBeenCalledWith({
actor,
collectionId,
playbookId,
mutation,
})
},
)
it('conflates malformed and cross-workspace substituted targets', async () => {
await expectError(
await handleCollectionItemMutation(
mutationRequest('PUT'),
'not-a-uuid',
playbookId,
'add',
dependencies(),
),
404,
'collection_target_not_found',
)
await expectError(
await handleCollectionItemMutation(
mutationRequest('PUT'),
collectionId,
playbookId,
'add',
dependencies({
mutateItem: vi.fn(async () => {
throw { code: 'collection_target_not_found', secret: 'workspace-b' }
}),
}),
),
404,
'collection_target_not_found',
)
})
it('enforces same-origin mutations and safe authentication errors', async () => {
const foreign = mutationRequest('PUT')
foreign.headers.set('origin', 'https://attacker.example.test')
await expectError(
await handleCollectionItemMutation(
foreign,
collectionId,
playbookId,
'add',
dependencies(),
),
403,
'invalid_origin',
)
await expectError(
await handleListCollections(
new Request(`${origin}/api/v1/collections`),
dependencies({
resolveContext: vi.fn(async () => {
throw new AuthenticatedWorkspaceContextError(
'authentication_required',
)
}),
}),
),
401,
'authentication_required',
)
})
})
apps/web/src/app/api/v1/collections/collection-http.ts
+209
View File
@@ -0,0 +1,209 @@
import type { ActorContext, PlaybookCollection } from '@devrunbook/application'
import { handleAuthRequest } from '../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../server/authenticated-workspace-context'
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
const maximumBodyBytes = 4096
export interface CollectionRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly list: (actor: ActorContext) => Promise<readonly PlaybookCollection[]>
readonly create: (
actor: ActorContext,
input: { readonly name: unknown; readonly description?: unknown },
) => Promise<PlaybookCollection>
readonly mutateItem: (input: {
readonly actor: ActorContext
readonly collectionId: string
readonly playbookId: string
readonly mutation: 'add' | 'remove'
}) => Promise<void>
}
function error(
status: number,
code: string,
message: string,
requestId: string,
) {
return Response.json({ error: { code, message, requestId } }, { status })
}
function codeOf(value: unknown): unknown {
return value !== null && typeof value === 'object' && 'code' in value
? value.code
: undefined
}
function mappedError(caught: unknown, requestId: string): Response {
const code = codeOf(caught)
if (caught instanceof AuthenticatedWorkspaceContextError) {
return error(
code === 'authentication_required' ? 401 : 403,
caught.code,
code === 'authentication_required'
? 'Authentication required'
: 'Access denied',
requestId,
)
}
if (code === 'collection_target_not_found') {
return error(404, String(code), 'Collection target not found', requestId)
}
if (code === 'collection_name_conflict') {
return error(409, String(code), 'Collection name already exists', requestId)
}
if (
code === 'collection_name_invalid' ||
code === 'collection_description_invalid' ||
code === 'collection_request_invalid'
) {
return error(422, String(code), 'Collection request is invalid', requestId)
}
return error(
503,
'collection_service_unavailable',
'Collection service is temporarily unavailable',
requestId,
)
}
function plainObject(value: unknown): value is Record<string, unknown> {
return value !== null && typeof value === 'object' && !Array.isArray(value)
}
async function parseCreateRequest(request: Request) {
const contentType = request.headers.get('content-type')?.split(';', 1)[0]
const contentLength = request.headers.get('content-length')
if (contentType !== 'application/json') {
throw { code: 'collection_request_invalid' }
}
if (
contentLength !== null &&
(!/^\d+$/u.test(contentLength) || Number(contentLength) > maximumBodyBytes)
) {
throw { code: 'collection_request_invalid' }
}
const body = await request.text()
if (new TextEncoder().encode(body).length > maximumBodyBytes) {
throw { code: 'collection_request_invalid' }
}
let value: unknown
try {
value = JSON.parse(body) as unknown
} catch {
throw { code: 'collection_request_invalid' }
}
if (!plainObject(value)) throw { code: 'collection_request_invalid' }
const keys = Object.keys(value)
if (keys.some((key) => key !== 'name' && key !== 'description')) {
throw { code: 'collection_request_invalid' }
}
return { name: value.name, description: value.description }
}
function mutationBoundary(
request: Request,
dependencies: CollectionRouteDependencies,
requestId: string,
operation: (safeRequest: Request) => Promise<Response>,
) {
return handleAuthRequest(
request,
(safeRequest) => {
if (
safeRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return Promise.resolve(
error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
return operation(safeRequest)
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export async function handleListCollections(
request: Request,
dependencies: CollectionRouteDependencies,
) {
const requestId = crypto.randomUUID()
try {
const actor = await dependencies.resolveContext(request)
return Response.json(await dependencies.list(actor), {
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
}
export function handleCreateCollection(
request: Request,
dependencies: CollectionRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
const actor = await dependencies.resolveContext(safeRequest)
const created = await dependencies.create(
actor,
await parseCreateRequest(safeRequest),
)
return Response.json(created, {
status: 201,
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
export function handleCollectionItemMutation(
request: Request,
collectionId: string,
playbookId: string,
mutation: 'add' | 'remove',
dependencies: CollectionRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
if (!uuidPattern.test(collectionId) || !uuidPattern.test(playbookId)) {
return error(
404,
'collection_target_not_found',
'Collection target not found',
requestId,
)
}
const actor = await dependencies.resolveContext(safeRequest)
await dependencies.mutateItem({
actor,
collectionId,
playbookId,
mutation,
})
return new Response(null, { status: 204 })
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
apps/web/src/app/api/v1/collections/route.ts
+33
View File
@@ -0,0 +1,33 @@
import {
createPersonalPlaybookCollection,
listPersonalPlaybookCollections,
persistPlaybookCollectionItem,
} from '../../../../server/playbook-collections'
import { resolveAuthenticatedWorkspaceContext } from '../../../../server/authenticated-workspace-context'
import {
handleCreateCollection,
handleListCollections,
type CollectionRouteDependencies,
} from './collection-http'
export const dynamic = 'force-dynamic'
export function collectionRouteDependencies(): CollectionRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
list: listPersonalPlaybookCollections,
create: createPersonalPlaybookCollection,
mutateItem: persistPlaybookCollectionItem,
}
}
export function GET(request: Request) {
return handleListCollections(request, collectionRouteDependencies())
}
export function POST(request: Request) {
return handleCreateCollection(request, collectionRouteDependencies())
}
apps/web/src/app/api/v1/compositions/composition-http.test.ts
+572
View File
@@ -0,0 +1,572 @@
import type {
ActorContext,
AuthoritativeCompositionResult,
GeneratedRun,
} from '@devrunbook/application'
import { describe, expect, it, vi } from 'vitest'
import {
handleGenerateRun,
handleGetRun,
handleListRuns,
handlePreviewComposition,
type AuthoritativeCompositionHttpService,
type AuthoritativeCompositionRouteDependencies,
} from './composition-http'
const userId = '00000000-0000-4000-8000-000000000001'
const workspaceId = '00000000-0000-4000-8000-000000000002'
const runId = '00000000-0000-4000-8000-000000000003'
const playbookVersionId = '00000000-0000-4000-8000-000000000004'
const digest = 'a'.repeat(64)
const actor: ActorContext = {
userId,
instanceRole: 'user',
workspaceId,
workspaceRole: 'owner',
}
const prompt = '# Fix a bounded bug\n\n## Mission\n\nRepair the failure.\n'
const provenance = [
{
blockId: 'mission',
heading: 'Mission',
startOffset: 0,
endOffset: prompt.length,
sources: ['playbook:root-cause-bugfix@1.0.0', 'user-input:request'],
},
]
const previewResult: AuthoritativeCompositionResult = {
playbookVersionId,
repositoryProfileRevisionId: null,
preview: {
normalizedInput: { request: 'Repair the failure' },
compatibility: {
status: 'unknown',
reasons: ['No repository profile is selected.'],
satisfiedCapabilities: [],
missingCapabilities: [],
accesses: [],
},
resolvedPolicies: {
precedence: ['platform', 'workspace', 'repository', 'playbook', 'user'],
platform: { noArbitraryExecution: true },
repository: {},
appliedGuardrailIds: ['bounded-scope'],
unresolvedConditions: [],
confirmedUnsafeCommandIds: [],
},
resolvedScope: {
includedPaths: ['src'],
excludedPaths: [],
protectedPaths: ['.github'],
generatedPaths: [],
allowableChangeTypes: ['code'],
repositoryWideRead: true,
conflicts: [],
invalidPaths: [],
modificationAllowed: true,
},
renderedPrompt: prompt,
renderDigest: digest,
blocks: [{ id: 'mission', heading: 'Mission', markdown: prompt }],
provenance,
conditionAccesses: [
{
path: 'inputs.request',
found: true,
valueType: 'string',
result: 'true',
},
],
lintFindings: [
{
ruleId: 'PB006',
severity: 'warning',
message: 'No repository profile is selected.',
source: 'compatibility',
controlPath: 'repositoryProfileRevisionId',
},
],
exportReadiness: 'warning',
},
snapshots: {
playbook: {
id: playbookVersionId,
slug: 'root-cause-bugfix',
version: '1.0.0',
digest,
lifecycle: 'validated',
manifest: {},
template: '# template',
},
repositoryProfile: null,
normalizedInput: { request: 'Repair the failure' },
policy: {
workMode: 'execute',
autonomyLevel: 'verify',
compatibility: { status: 'unknown' },
resolvedPolicies: {},
resolvedScope: { includedPaths: ['src'] },
},
provenance,
},
}
const run: GeneratedRun = {
id: runId,
workspaceId,
generatedBy: userId,
sourceDraftId: null,
playbookVersionId,
snapshots: previewResult.snapshots,
lint: {
exportReadiness: 'warning',
findings: previewResult.preview.lintFindings,
},
renderedPrompt: prompt,
renderDigest: digest,
idempotencyKey: 'generation-1',
generatedAt: '2026-07-27T10:00:00.000Z',
}
function service(): AuthoritativeCompositionHttpService {
return {
preview: vi.fn(async () => previewResult),
generate: vi.fn(async () => ({ run, created: true })),
get: vi.fn(async () => run),
listArtifacts: vi.fn(async () => []),
list: vi.fn(async () => ({ items: [run], nextCursor: 'cursor-next' })),
}
}
function dependencies(
overrides: Partial<AuthoritativeCompositionRouteDependencies> = {},
): AuthoritativeCompositionRouteDependencies {
return {
publicBaseUrl: 'https://devrunbook.example',
resolveContext: vi.fn(async () => actor),
service: service(),
...overrides,
}
}
function body(overrides: Record<string, unknown> = {}) {
return JSON.stringify({
playbook: { slug: 'root-cause-bugfix', version: '1.0.0' },
repositoryProfileRevisionId: null,
workMode: 'execute',
autonomyLevel: 'verify',
inputs: { request: 'Repair the failure' },
scopeOverrides: { includedPaths: ['src'] },
outputFormat: 'prompt',
...overrides,
})
}
function post(
path: string,
content = body(),
headers: Record<string, string> = {},
) {
return new Request(`https://devrunbook.example${path}`, {
method: 'POST',
body: content,
headers: {
origin: 'https://devrunbook.example',
'content-type': 'application/json',
...headers,
},
})
}
async function error(response: Response) {
return (await response.json()) as {
error: { code: string; requestId: string; details?: unknown[] }
}
}
describe('authoritative composition HTTP boundary', () => {
it('returns byte-stable typed previews from the same authoritative request', async () => {
const deps = dependencies()
const first = await handlePreviewComposition(
post('/api/v1/compositions/preview'),
deps,
)
const second = await handlePreviewComposition(
post('/api/v1/compositions/preview'),
deps,
)
expect(first.status).toBe(200)
expect(first.headers.get('cache-control')).toBe('no-store')
expect(await first.text()).toBe(await second.text())
expect(deps.service.preview).toHaveBeenCalledWith(actor, {
playbook: { slug: 'root-cause-bugfix', version: '1.0.0' },
repositoryProfileRevisionId: null,
workMode: 'execute',
autonomyLevel: 'verify',
inputs: { request: 'Repair the failure' },
scopeOverrides: { includedPaths: ['src'] },
outputFormat: 'prompt',
})
})
it('projects blocks, provenance, policies, lint and compatibility without authority-bearing internals', async () => {
const response = await handlePreviewComposition(
post('/api/v1/compositions/preview'),
dependencies(),
)
const result = (await response.json()) as Record<string, unknown>
expect(result).toMatchObject({
renderDigest: digest,
exportReadiness: 'warning',
compatibility: { status: 'unknown' },
resolvedScope: { protectedPaths: ['.github'] },
})
expect(result.blocks).toEqual([
{ id: 'mission', heading: 'Mission', markdown: prompt },
])
expect(JSON.stringify(result.provenance)).toContain('user-input')
expect(result).not.toHaveProperty('snapshots')
expect(result).not.toHaveProperty('generatedBy')
})
it('rejects every client attempt to spoof authoritative output', async () => {
for (const field of [
'renderedPrompt',
'renderDigest',
'lintFindings',
'snapshots',
'generatedBy',
]) {
const deps = dependencies()
const response = await handlePreviewComposition(
post('/api/v1/compositions/preview', body({ [field]: 'spoofed' })),
deps,
)
expect(response.status, field).toBe(422)
expect((await error(response)).error.code, field).toBe(
'composition_request_invalid',
)
expect(deps.service.preview, field).not.toHaveBeenCalled()
}
})
it('requires same-origin requests and denies viewer preview or generation', async () => {
const origin = await handlePreviewComposition(
post('/api/v1/compositions/preview', body(), {
origin: 'https://attacker.example',
}),
dependencies(),
)
expect(origin.status).toBe(403)
const deniedService = service()
deniedService.preview = vi.fn(async () => {
throw Object.assign(new Error('private authorization detail'), {
code: 'workspace_access_denied',
})
})
deniedService.generate = vi.fn(async () => {
throw Object.assign(new Error('private authorization detail'), {
code: 'workspace_access_denied',
})
})
const viewer = { ...actor, workspaceRole: 'viewer' } satisfies ActorContext
const deps = dependencies({
resolveContext: vi.fn(async () => viewer),
service: deniedService,
})
const preview = await handlePreviewComposition(
post('/api/v1/compositions/preview'),
deps,
)
const generation = await handleGenerateRun(
post('/api/v1/runs', body(), { 'idempotency-key': 'generation-1' }),
deps,
)
expect(preview.status).toBe(403)
expect(generation.status).toBe(403)
expect(await generation.text()).not.toContain('private authorization')
})
it('returns 201 initially and 200 with a replay header for idempotent generation', async () => {
const createdService = service()
const created = await handleGenerateRun(
post('/api/v1/runs', body(), { 'idempotency-key': 'generation-1' }),
dependencies({ service: createdService }),
)
expect(created.status).toBe(201)
expect(created.headers.get('idempotency-replayed')).toBeNull()
expect(createdService.generate).toHaveBeenCalledWith(
actor,
expect.objectContaining({
playbook: { slug: 'root-cause-bugfix', version: '1.0.0' },
}),
'generation-1',
undefined,
)
const draftId = '00000000-0000-4000-8000-000000000005'
const draftService = service()
const fromDraft = await handleGenerateRun(
post('/api/v1/runs', body(), {
'idempotency-key': 'generation-draft-1',
'x-devrunbook-draft-id': draftId,
}),
dependencies({ service: draftService }),
)
expect(fromDraft.status).toBe(201)
expect(draftService.generate).toHaveBeenCalledWith(
actor,
expect.any(Object),
'generation-draft-1',
draftId,
)
const replayService = service()
replayService.generate = vi.fn(async () => ({ run, created: false }))
const replay = await handleGenerateRun(
post('/api/v1/runs', body(), { 'idempotency-key': 'generation-1' }),
dependencies({ service: replayService }),
)
expect(replay.status).toBe(200)
expect(replay.headers.get('idempotency-replayed')).toBe('true')
expect(await replay.json()).toMatchObject({
id: runId,
renderDigest: digest,
snapshots: { normalizedInput: { request: 'Repair the failure' } },
artifacts: [],
})
})
it('requires an idempotency key and maps conflicts or blocking findings safely', async () => {
const missing = await handleGenerateRun(
post('/api/v1/runs'),
dependencies(),
)
expect(missing.status).toBe(422)
expect((await error(missing)).error.code).toBe(
'generated_run_idempotency_key_invalid',
)
const conflictService = service()
conflictService.generate = vi.fn(async () => {
throw Object.assign(new Error('stored private input'), {
code: 'generated_run_idempotency_conflict',
})
})
const conflict = await handleGenerateRun(
post('/api/v1/runs', body(), { 'idempotency-key': 'generation-1' }),
dependencies({ service: conflictService }),
)
expect(conflict.status).toBe(409)
expect(await conflict.text()).not.toContain('stored private input')
const blockedService = service()
blockedService.generate = vi.fn(async () => {
throw Object.assign(new Error('prompt contained secret-value'), {
code: 'generated_run_lint_blocked',
details: { blockingRuleIds: ['SA001'] },
})
})
const blocked = await handleGenerateRun(
post('/api/v1/runs', body(), { 'idempotency-key': 'generation-2' }),
dependencies({ service: blockedService }),
)
expect(blocked.status).toBe(422)
const blockedBody = await blocked.text()
expect(blockedBody).toContain('SA001')
expect(blockedBody).not.toContain('secret-value')
})
it('rejects a malformed source draft id before generation', async () => {
const draftService = service()
const response = await handleGenerateRun(
post('/api/v1/runs', body(), {
'idempotency-key': 'generation-draft-invalid',
'x-devrunbook-draft-id': 'not-a-uuid',
}),
dependencies({ service: draftService }),
)
expect(response.status).toBe(422)
expect((await error(response)).error.code).toBe(
'composition_request_invalid',
)
expect(draftService.generate).not.toHaveBeenCalled()
})
it('returns an immutable generated-task projection and conceals inaccessible ids', async () => {
const artifactService = service()
artifactService.listArtifacts = vi.fn(async () => [
{
id: '00000000-0000-4000-8000-000000000006',
workspaceId,
runId,
artifactType: 'markdown' as const,
storageKey: 'f'.repeat(64),
filename: 'task.md',
mediaType: 'text/markdown; charset=utf-8',
sizeBytes: 123n,
sha256: 'e'.repeat(64),
expiresAt: '2026-10-25T10:00:00.000Z',
createdAt: '2026-07-27T10:05:00.000Z',
},
])
const deps = dependencies({ service: artifactService })
const response = await handleGetRun(
new Request(`https://devrunbook.example/api/v1/runs/${runId}`),
runId,
deps,
)
expect(response.status).toBe(200)
expect(response.headers.get('cache-control')).toBe('no-store')
expect(await response.json()).toMatchObject({
id: runId,
playbookSlug: 'root-cause-bugfix',
playbookVersion: '1.0.0',
playbookDigest: digest,
workMode: 'execute',
autonomyLevel: 'verify',
renderedPrompt: prompt,
renderDigest: digest,
artifacts: [
{
id: '00000000-0000-4000-8000-000000000006',
type: 'markdown',
filename: 'task.md',
sizeBytes: 123,
sha256: 'e'.repeat(64),
},
],
})
expect(artifactService.listArtifacts).toHaveBeenCalledWith(actor, runId)
const invalid = await handleGetRun(
new Request('https://devrunbook.example/api/v1/runs/not-a-uuid'),
'not-a-uuid',
dependencies(),
)
const hiddenService = service()
hiddenService.get = vi.fn(async () => {
throw Object.assign(new Error('cross-workspace run exists'), {
code: 'generated_run_not_found',
})
})
const hidden = await handleGetRun(
new Request(`https://devrunbook.example/api/v1/runs/${runId}`),
runId,
dependencies({ service: hiddenService }),
)
expect(invalid.status).toBe(404)
expect(hidden.status).toBe(404)
expect((await error(invalid)).error.code).toBe('generated_run_not_found')
expect((await error(hidden)).error.code).toBe('generated_run_not_found')
})
it('projects historical direct repository-profile snapshots without failing', async () => {
const historicalRun: GeneratedRun = {
...run,
snapshots: {
...run.snapshots,
repositoryProfile: {
apiVersion: 'devrunbook.io/v1',
kind: 'RepositoryProfile',
metadata: { name: 'historical-repository' },
spec: {},
},
},
}
const historicalService = service()
historicalService.get = vi.fn(async () => historicalRun)
historicalService.list = vi.fn(async () => ({
items: [historicalRun],
nextCursor: null,
}))
const deps = dependencies({ service: historicalService })
const detail = await handleGetRun(
new Request(`https://devrunbook.example/api/v1/runs/${runId}`),
runId,
deps,
)
const history = await handleListRuns(
new Request('https://devrunbook.example/api/v1/runs'),
deps,
)
expect(await detail.json()).toMatchObject({
repositoryName: 'historical-repository',
repositoryProfileRevision: null,
repositoryProfileDigest: null,
})
expect(await history.json()).toMatchObject({
items: [
{
repositoryName: 'historical-repository',
repositoryProfileRevision: null,
repositoryProfileDigest: null,
},
],
})
})
it('lists immutable generated-task summaries with strict filters and pagination', async () => {
const deps = dependencies()
const repositoryId = '00000000-0000-4000-8000-000000000005'
const response = await handleListRuns(
new Request(
`https://devrunbook.example/api/v1/runs?cursor=cursor-1&limit=25&playbookSlug=root-cause-bugfix&repositoryId=${repositoryId}`,
),
deps,
)
expect(response.status).toBe(200)
expect(response.headers.get('cache-control')).toBe('no-store')
expect(deps.service.list).toHaveBeenCalledWith(actor, {
cursor: 'cursor-1',
limit: 25,
playbookSlug: 'root-cause-bugfix',
repositoryId,
})
const page = (await response.json()) as {
items: readonly Record<string, unknown>[]
nextCursor: string | null
}
expect(page).toMatchObject({
items: [
{
id: runId,
playbookSlug: 'root-cause-bugfix',
renderDigest: digest,
},
],
nextCursor: 'cursor-next',
})
expect(page.items[0]).not.toHaveProperty('renderedPrompt')
expect(page.items[0]).not.toHaveProperty('snapshots')
expect(page.items[0]).not.toHaveProperty('generatedBy')
expect(page.items[0]).not.toHaveProperty('idempotencyKey')
})
it('rejects unknown, duplicate or malformed run-history query parameters', async () => {
const invalidQueries = [
'unknown=value',
'limit=10&limit=20',
'limit=0',
'limit=1.5',
'playbookSlug=Not-Canonical',
'repositoryId=not-a-uuid',
'cursor=',
]
for (const query of invalidQueries) {
const deps = dependencies()
const response = await handleListRuns(
new Request(`https://devrunbook.example/api/v1/runs?${query}`),
deps,
)
expect(response.status, query).toBe(422)
expect((await error(response)).error.code, query).toBe(
'generated_run_query_invalid',
)
expect(deps.service.list, query).not.toHaveBeenCalled()
}
})
})
apps/web/src/app/api/v1/compositions/composition-http.ts
+685
View File
@@ -0,0 +1,685 @@
import type {
ActorContext,
AuthoritativeCompositionResult,
GeneratedRun,
GeneratedRunHistoryQuery,
GeneratedRunPage,
GeneratedArtifactMetadata,
StoreGeneratedRunResult,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../server/authenticated-workspace-context'
import type { AuthoritativeCompositionHttpRequest } from '../../../../server/authoritative-compositions'
import { parseCompositionRequestBody } from './drafts/composition-draft-http'
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
const playbookSlugPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u
const draftParserCodes = new Set([
'composition_request_too_large',
'composition_request_body_required',
'composition_content_type_unsupported',
'composition_request_utf8_invalid',
'composition_json_invalid',
'composition_json_duplicate_key',
'composition_request_invalid',
])
export interface AuthoritativeCompositionHttpService {
preview(
actor: ActorContext,
request: AuthoritativeCompositionHttpRequest,
): Promise<AuthoritativeCompositionResult>
generate(
actor: ActorContext,
request: AuthoritativeCompositionHttpRequest,
idempotencyKey: string,
sourceDraftId?: string,
): Promise<StoreGeneratedRunResult>
get(actor: ActorContext, runId: string): Promise<GeneratedRun>
listArtifacts(
actor: ActorContext,
runId: string,
): Promise<readonly GeneratedArtifactMetadata[]>
list(
actor: ActorContext,
query: GeneratedRunHistoryQuery,
): Promise<GeneratedRunPage>
}
export interface AuthoritativeCompositionRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly service: AuthoritativeCompositionHttpService
}
interface ErrorLike {
readonly code: string
readonly message?: string
readonly status?: number
readonly details: Readonly<Record<string, unknown>>
}
function plainObject(value: unknown): value is Record<string, unknown> {
return (
value !== null &&
typeof value === 'object' &&
!Array.isArray(value) &&
(Object.getPrototypeOf(value) === Object.prototype ||
Object.getPrototypeOf(value) === null)
)
}
function errorLike(caught: unknown): ErrorLike | null {
if (caught === null || typeof caught !== 'object' || Array.isArray(caught))
return null
const candidate = caught as Readonly<Record<string, unknown>>
if (typeof candidate.code !== 'string') return null
return {
code: candidate.code,
...(typeof candidate.message === 'string'
? { message: candidate.message }
: {}),
...(typeof candidate.status === 'number'
? { status: candidate.status }
: {}),
details: plainObject(candidate.details) ? candidate.details : {},
}
}
function errorResponse(
status: number,
code: string,
message: string,
requestId: string,
details?: readonly Readonly<Record<string, unknown>>[],
headers: Readonly<Record<string, string>> = {},
) {
return Response.json(
{
error: {
code,
message,
requestId,
...(details?.length ? { details } : {}),
},
},
{ status, headers: { 'Cache-Control': 'no-store', ...headers } },
)
}
function mappedError(caught: unknown, requestId: string): Response {
if (caught instanceof AuthenticatedWorkspaceContextError) {
return errorResponse(
caught.code === 'authentication_required' ? 401 : 403,
caught.code,
caught.code === 'authentication_required'
? 'Authentication required'
: 'Access denied',
requestId,
)
}
const error = errorLike(caught)
if (error?.code === 'authentication_required') {
return errorResponse(401, error.code, 'Authentication required', requestId)
}
if (error?.code === 'workspace_access_denied') {
return errorResponse(403, error.code, 'Access denied', requestId)
}
if (
error?.code === 'composition_source_not_found' ||
error?.code === 'generated_run_not_found'
) {
return errorResponse(404, error.code, 'Resource not found', requestId)
}
if (error?.code === 'generated_run_idempotency_conflict') {
return errorResponse(
409,
error.code,
'Idempotency key is already associated with different composition input',
requestId,
)
}
if (error?.code === 'generated_run_lint_blocked') {
const blockingRuleIds = Array.isArray(error.details.blockingRuleIds)
? error.details.blockingRuleIds.filter(
(value): value is string => typeof value === 'string',
)
: []
return errorResponse(
422,
error.code,
'Immutable generation is blocked by composition findings',
requestId,
blockingRuleIds.map((ruleId) => ({
path: 'lintFindings',
rule: ruleId,
message: 'Resolve this blocking finding before generation',
})),
)
}
if (error?.code === 'generated_run_idempotency_key_invalid') {
return errorResponse(
422,
error.code,
'Idempotency-Key must contain 1 to 255 characters without surrounding whitespace',
requestId,
)
}
if (
error?.code === 'generated_run_query_invalid' ||
error?.code === 'generated_run_cursor_invalid' ||
error?.code === 'generated_run_list_limit_invalid' ||
error?.code === 'generated_run_filter_invalid'
) {
return errorResponse(
422,
error.code,
'Generated task history query is invalid',
requestId,
)
}
if (error && draftParserCodes.has(error.code)) {
return errorResponse(
error.code === 'composition_request_too_large' ? 413 : 422,
error.code,
error.code === 'composition_request_too_large'
? 'Composition request is too large'
: 'Composition request is invalid',
requestId,
)
}
return errorResponse(
503,
'composition_service_unavailable',
'Composition service is temporarily unavailable',
requestId,
)
}
function mutationBoundary(
request: Request,
dependencies: AuthoritativeCompositionRouteDependencies,
requestId: string,
operation: (request: Request) => Promise<Response>,
): Promise<Response> {
return handleAuthRequest(
request,
async (sameOriginRequest) => {
if (
sameOriginRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return errorResponse(
403,
'invalid_origin',
'Invalid request origin',
requestId,
)
}
return operation(sameOriginRequest)
},
dependencies.publicBaseUrl,
() =>
errorResponse(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
async function parseAuthoritativeRequest(
request: Request,
): Promise<AuthoritativeCompositionHttpRequest> {
const parsed = await parseCompositionRequestBody(request)
return {
playbook: parsed.playbook,
repositoryProfileRevisionId:
parsed.draft.repositoryProfileRevisionId ?? null,
inputs: parsed.draft.inputs as Readonly<Record<string, unknown>>,
scopeOverrides: parsed.draft.scopeOverrides as Readonly<
Record<string, unknown>
>,
workMode: parsed.draft.workMode,
autonomyLevel: parsed.draft.autonomyLevel,
outputFormat: parsed.draft.outputFormat,
}
}
function lintSource(source: string): string {
if (source === 'playbook') return 'playbook'
if (source === 'repository-profile') return 'repository-profile'
if (source === 'input') return 'user-input'
if (source === 'policy') return 'platform-policy'
return 'composer'
}
function provenanceSource(source: string): {
readonly type: string
readonly reference: string
} {
if (source === 'platform-policy') {
return { type: 'platform-policy', reference: 'platform-v1' }
}
for (const type of [
'playbook',
'repository-profile',
'user-input',
'inferred-default',
] as const) {
if (source.startsWith(`${type}:`)) {
return { type, reference: source.slice(type.length + 1) }
}
}
return { type: 'inferred-default', reference: `composer:${source}` }
}
function safeIdentifier(value: string): string {
const normalized = value
.toLowerCase()
.replace(/[^a-z0-9._-]+/gu, '-')
.replace(/^[^a-z]+/u, '')
.slice(0, 120)
return normalized || 'policy'
}
function resolvedPolicies(
result: AuthoritativeCompositionResult,
): readonly Readonly<Record<string, unknown>>[] {
const policies = result.preview.resolvedPolicies
const playbook = result.snapshots.playbook
const slug = String(playbook.slug ?? 'playbook')
const version = String(playbook.version ?? 'unknown')
const repositoryReference = result.repositoryProfileRevisionId ?? 'no-profile'
return [
...Object.entries(policies.platform)
.sort(([left], [right]) => left.localeCompare(right, 'en'))
.map(([id, value]) => ({
id: safeIdentifier(`platform.${id}`),
value,
source: { type: 'platform-policy', reference: 'platform-v1' },
nonOverridable: true,
})),
...Object.entries(policies.repository)
.sort(([left], [right]) => left.localeCompare(right, 'en'))
.map(([id, value]) => ({
id: safeIdentifier(`repository.${id}`),
value,
source: {
type: 'repository-profile',
reference: repositoryReference,
},
nonOverridable: false,
})),
...policies.appliedGuardrailIds.map((id) => ({
id: safeIdentifier(`guardrail.${id}`),
value: true,
source: { type: 'playbook', reference: `${slug}@${version}` },
nonOverridable: false,
})),
...policies.unresolvedConditions.map((id) => ({
id: safeIdentifier(`condition.${id}`),
value: 'fail-closed',
source: { type: 'playbook', reference: `${slug}@${version}` },
nonOverridable: false,
})),
...policies.confirmedUnsafeCommandIds.map((id) => ({
id: safeIdentifier(`command-confirmation.${id}`),
value: true,
source: { type: 'user-input', reference: `command:${id}` },
nonOverridable: false,
})),
]
}
function projectProvenance(
provenance: readonly unknown[],
factAccesses: readonly {
readonly path: string
readonly found: boolean
readonly result: string
}[] = [],
) {
return provenance.flatMap((entry, index) => {
if (!plainObject(entry)) return []
const sources = Array.isArray(entry.sources)
? entry.sources
.filter((source): source is string => typeof source === 'string')
.map(provenanceSource)
: []
if (typeof entry.blockId !== 'string' || sources.length === 0) return []
return [
{
blockId: entry.blockId,
sources,
controlPath: null,
factAccesses:
index === 0
? factAccesses.flatMap((access) => {
return [
{
path: access.path,
outcome:
access.found === false
? 'missing'
: access.result === 'unknown'
? 'type-mismatch'
: 'resolved',
},
]
})
: [],
},
]
})
}
function previewEnvelope(result: AuthoritativeCompositionResult) {
const preview = result.preview
const compatibilitySeverity =
preview.compatibility.status === 'incompatible' ? 'error' : 'warning'
return {
normalizedInput: preview.normalizedInput,
compatibility: {
status: preview.compatibility.status,
findings: preview.compatibility.reasons.map((message, index) => ({
code: safeIdentifier(`compatibility.reason.${index + 1}`),
severity: compatibilitySeverity,
message,
source: result.repositoryProfileRevisionId
? 'repository-profile'
: 'playbook',
controlPath: 'repositoryProfileRevisionId',
capability: preview.compatibility.missingCapabilities[index] ?? null,
})),
},
resolvedPolicies: resolvedPolicies(result),
resolvedScope: {
includedPaths: preview.resolvedScope.includedPaths,
excludedPaths: preview.resolvedScope.excludedPaths,
protectedPaths: preview.resolvedScope.protectedPaths,
allowableChangeTypes: preview.resolvedScope.allowableChangeTypes,
repositoryWideRead: preview.resolvedScope.repositoryWideRead,
},
blocks: preview.blocks,
renderedPrompt: preview.renderedPrompt,
renderDigest: preview.renderDigest,
lintFindings: preview.lintFindings.map((finding) => ({
ruleId: finding.ruleId.toLowerCase(),
severity: finding.severity,
message: finding.message,
source: lintSource(finding.source),
controlPath: finding.controlPath,
})),
exportReadiness: preview.exportReadiness,
provenance: projectProvenance(
preview.provenance,
preview.conditionAccesses,
),
}
}
function requiredRecord(
value: unknown,
label: string,
): Readonly<Record<string, unknown>> {
if (!plainObject(value)) throw new Error(`${label} snapshot is invalid`)
return value
}
function runSummary(run: GeneratedRun) {
const playbook = requiredRecord(run.snapshots.playbook, 'Playbook')
const policy = requiredRecord(run.snapshots.policy, 'Policy')
const repository =
run.snapshots.repositoryProfile === null
? null
: requiredRecord(run.snapshots.repositoryProfile, 'Repository profile')
const profile = repository
? plainObject(repository.profile)
? repository.profile
: repository
: null
const metadata = profile?.metadata
const repositoryMetadata = plainObject(metadata) ? metadata : null
if (
typeof playbook.slug !== 'string' ||
typeof playbook.version !== 'string' ||
typeof playbook.digest !== 'string' ||
typeof policy.workMode !== 'string' ||
typeof policy.autonomyLevel !== 'string'
) {
throw new Error('Generated task snapshots are incomplete')
}
return {
id: run.id,
playbookSlug: playbook.slug,
playbookVersion: playbook.version,
playbookDigest: playbook.digest,
repositoryName:
repositoryMetadata && typeof repositoryMetadata.name === 'string'
? repositoryMetadata.name
: null,
repositoryProfileRevision:
repository && typeof repository.revisionNumber === 'number'
? repository.revisionNumber
: null,
repositoryProfileDigest:
repository && typeof repository.contentDigest === 'string'
? repository.contentDigest
: null,
workMode: policy.workMode,
autonomyLevel: policy.autonomyLevel,
renderDigest: run.renderDigest,
generatedAt: run.generatedAt,
}
}
function runEnvelope(
run: GeneratedRun,
artifacts: readonly GeneratedArtifactMetadata[] = [],
) {
const summary = runSummary(run)
const provenance = projectProvenance(run.snapshots.provenance)
return {
...summary,
renderedPrompt: run.renderedPrompt,
snapshots: {
playbook: run.snapshots.playbook,
repositoryProfile: run.snapshots.repositoryProfile,
normalizedInput: run.snapshots.normalizedInput,
policy: run.snapshots.policy,
provenance,
},
lintFindings: run.lint.findings.map((finding) => ({
ruleId: finding.ruleId.toLowerCase(),
severity: finding.severity,
message: finding.message,
source: lintSource(finding.source),
controlPath: finding.controlPath ?? null,
})),
provenance,
artifacts: artifacts.map((artifact) => ({
id: artifact.id,
runId: artifact.runId,
type: artifact.artifactType,
filename: artifact.filename,
mediaType: artifact.mediaType,
sizeBytes: Number(artifact.sizeBytes),
sha256: artifact.sha256,
createdAt: artifact.createdAt,
expiresAt: artifact.expiresAt,
downloadUrl: `/api/v1/artifacts/${artifact.id}/download`,
})),
}
}
function invalidRunQuery(): never {
throw Object.assign(new Error('Invalid generated task history query'), {
code: 'generated_run_query_invalid',
})
}
function parseRunHistoryQuery(request: Request): GeneratedRunHistoryQuery {
const params = new URL(request.url).searchParams
const allowed = new Set(['cursor', 'limit', 'playbookSlug', 'repositoryId'])
for (const key of params.keys()) {
if (!allowed.has(key) || params.getAll(key).length !== 1) invalidRunQuery()
}
const cursor = params.get('cursor')
const limitValue = params.get('limit')
const playbookSlug = params.get('playbookSlug')
const repositoryId = params.get('repositoryId')
if (
(cursor !== null && (cursor.length < 1 || cursor.length > 500)) ||
(limitValue !== null && !/^[0-9]+$/u.test(limitValue)) ||
(playbookSlug !== null &&
(playbookSlug.length > 120 || !playbookSlugPattern.test(playbookSlug))) ||
(repositoryId !== null && !uuidPattern.test(repositoryId))
) {
invalidRunQuery()
}
const limit = limitValue === null ? 50 : Number(limitValue)
if (!Number.isInteger(limit) || limit < 1 || limit > 100) invalidRunQuery()
return {
...(cursor === null ? {} : { cursor }),
limit,
...(playbookSlug === null ? {} : { playbookSlug }),
...(repositoryId === null ? {} : { repositoryId }),
}
}
function assertRunId(runId: string): void {
if (!uuidPattern.test(runId)) {
throw Object.assign(new Error('Generated task not found'), {
code: 'generated_run_not_found',
})
}
}
function idempotencyKey(request: Request): string {
const key = request.headers.get('idempotency-key')
if (!key || key.length > 255 || key.trim() !== key) {
throw Object.assign(new Error('Invalid idempotency key'), {
code: 'generated_run_idempotency_key_invalid',
})
}
return key
}
function sourceDraftId(request: Request): string | undefined {
const draftId = request.headers.get('x-devrunbook-draft-id')
if (draftId === null) return undefined
if (!uuidPattern.test(draftId)) {
throw Object.assign(new Error('Invalid source draft id'), {
code: 'composition_request_invalid',
details: {
issues: [
{
path: 'headers.x-devrunbook-draft-id',
message: 'X-DevRunbook-Draft-Id must be a UUID',
},
],
},
})
}
return draftId
}
export function handlePreviewComposition(
request: Request,
dependencies: AuthoritativeCompositionRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
const actor = await dependencies.resolveContext(safeRequest)
const composition = await parseAuthoritativeRequest(safeRequest)
const result = await dependencies.service.preview(actor, composition)
return Response.json(previewEnvelope(result), {
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
export function handleGenerateRun(
request: Request,
dependencies: AuthoritativeCompositionRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
const actor = await dependencies.resolveContext(safeRequest)
const key = idempotencyKey(safeRequest)
const draftId = sourceDraftId(safeRequest)
const composition = await parseAuthoritativeRequest(safeRequest)
const result = await dependencies.service.generate(
actor,
composition,
key,
draftId,
)
return Response.json(runEnvelope(result.run), {
status: result.created ? 201 : 200,
headers: {
'Cache-Control': 'no-store',
...(result.created ? {} : { 'Idempotency-Replayed': 'true' }),
},
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
export async function handleGetRun(
request: Request,
runId: string,
dependencies: AuthoritativeCompositionRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
try {
const actor = await dependencies.resolveContext(request)
assertRunId(runId)
const run = await dependencies.service.get(actor, runId)
const artifacts = await dependencies.service.listArtifacts(actor, runId)
return Response.json(runEnvelope(run, artifacts), {
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
}
export async function handleListRuns(
request: Request,
dependencies: AuthoritativeCompositionRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
try {
const actor = await dependencies.resolveContext(request)
const query = parseRunHistoryQuery(request)
const page = await dependencies.service.list(actor, query)
return Response.json(
{
items: page.items.map(runSummary),
nextCursor: page.nextCursor,
},
{ headers: { 'Cache-Control': 'no-store' } },
)
} catch (caught) {
return mappedError(caught, requestId)
}
}
apps/web/src/app/api/v1/compositions/composition-route-dependencies.ts
+14
View File
@@ -0,0 +1,14 @@
import { resolveAuthenticatedWorkspaceContext } from '../../../../server/authenticated-workspace-context'
import { getAuthoritativeCompositionServer } from '../../../../server/authoritative-compositions'
import type { AuthoritativeCompositionRouteDependencies } from './composition-http'
export function authoritativeCompositionRouteDependencies(): AuthoritativeCompositionRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
service: getAuthoritativeCompositionServer(),
}
}
apps/web/src/app/api/v1/compositions/drafts/[draftId]/route.ts
+33
View File
@@ -0,0 +1,33 @@
import {
handleGetCompositionDraft,
handlePatchCompositionDraft,
} from '../composition-draft-http'
import { compositionDraftRouteDependencies } from '../composition-draft-route-dependencies'
export const dynamic = 'force-dynamic'
export function GET(
request: Request,
context: { params: Promise<{ draftId: string }> },
) {
return context.params.then(({ draftId }) =>
handleGetCompositionDraft(
request,
draftId,
compositionDraftRouteDependencies(),
),
)
}
export function PATCH(
request: Request,
context: { params: Promise<{ draftId: string }> },
) {
return context.params.then(({ draftId }) =>
handlePatchCompositionDraft(
request,
draftId,
compositionDraftRouteDependencies(),
),
)
}
apps/web/src/app/api/v1/compositions/drafts/composition-draft-http.test.ts
+446
View File
@@ -0,0 +1,446 @@
import type { ActorContext, CompositionDraft } from '@devrunbook/application'
import { describe, expect, it, vi } from 'vitest'
import {
handleCreateCompositionDraft,
handleGetCompositionDraft,
handlePatchCompositionDraft,
type CompositionDraftHttpService,
type CompositionDraftRouteDependencies,
} from './composition-draft-http'
const userId = '00000000-0000-4000-8000-000000000001'
const workspaceId = '00000000-0000-4000-8000-000000000002'
const draftId = '00000000-0000-4000-8000-000000000003'
const playbookVersionId = '00000000-0000-4000-8000-000000000004'
const profileRevisionId = '00000000-0000-4000-8000-000000000005'
const actor: ActorContext = {
userId,
instanceRole: 'user',
workspaceId,
workspaceRole: 'owner',
}
const playbook = { slug: 'root-cause-bugfix', version: '1.0.0' }
const draft: CompositionDraft = {
id: draftId,
workspaceId,
playbookVersionId,
repositoryProfileRevisionId: profileRevisionId,
inputs: { summary: 'Fix the bounded failure' },
scopeOverrides: { includedPaths: ['src'] },
policyOverrides: {},
autonomyLevel: 'verify',
workMode: 'execute',
outputFormat: 'prompt',
lastRenderDigest: null,
revision: 1,
createdBy: userId,
createdAt: '2026-07-27T10:00:00.000Z',
updatedAt: '2026-07-27T10:00:00.000Z',
}
function service(): CompositionDraftHttpService {
return {
create: vi.fn(async () => ({
result: { draft, etag: '"draft:1"' },
playbook,
})),
get: vi.fn(async () => ({
result: { draft, etag: '"draft:1"' },
playbook,
})),
patch: vi.fn(async () => ({
result: { draft, etag: '"draft:1"', changed: false },
playbook,
})),
}
}
function dependencies(
overrides: Partial<CompositionDraftRouteDependencies> = {},
): CompositionDraftRouteDependencies {
return {
publicBaseUrl: 'https://devrunbook.example',
resolveContext: vi.fn(async () => actor),
service: service(),
...overrides,
}
}
function request(
path: string,
method: 'POST' | 'PATCH',
body: string | ArrayBuffer,
headers: Record<string, string> = {},
) {
return new Request(`https://devrunbook.example${path}`, {
method,
body,
headers: {
origin: 'https://devrunbook.example',
'content-type': 'application/json',
...headers,
},
})
}
function createBody(overrides: Record<string, unknown> = {}) {
return JSON.stringify({
playbook,
repositoryProfileRevisionId: profileRevisionId,
workMode: 'execute',
autonomyLevel: 'verify',
inputs: { summary: 'Fix the bounded failure' },
scopeOverrides: { includedPaths: ['src'] },
...overrides,
})
}
async function error(response: Response) {
return (await response.json()) as {
error: {
code: string
requestId: string
details?: readonly Record<string, unknown>[]
}
}
}
describe('composition draft HTTP boundary', () => {
it('creates a strict draft and returns the OpenAPI envelope with a strong ETag', async () => {
const deps = dependencies()
const response = await handleCreateCompositionDraft(
request('/api/v1/compositions/drafts', 'POST', createBody()),
deps,
)
expect(response.status).toBe(201)
expect(response.headers.get('etag')).toBe('"draft:1"')
expect(response.headers.get('cache-control')).toBe('no-store')
expect(deps.service.create).toHaveBeenCalledWith(actor, playbook, {
repositoryProfileRevisionId: profileRevisionId,
workMode: 'execute',
autonomyLevel: 'verify',
inputs: { summary: 'Fix the bounded failure' },
scopeOverrides: { includedPaths: ['src'] },
outputFormat: 'prompt',
})
expect(await response.json()).toEqual({
id: draftId,
revision: 1,
request: {
playbook,
repositoryProfileRevisionId: profileRevisionId,
workMode: 'execute',
autonomyLevel: 'verify',
inputs: draft.inputs,
scopeOverrides: draft.scopeOverrides,
outputFormat: 'prompt',
},
lastRenderDigest: null,
createdAt: draft.createdAt,
updatedAt: draft.updatedAt,
})
})
it('reads only the authorized workspace projection and conceals invalid or inaccessible ids', async () => {
const deps = dependencies()
const found = await handleGetCompositionDraft(
new Request(
`https://devrunbook.example/api/v1/compositions/drafts/${draftId}`,
),
draftId,
deps,
)
expect(found.status).toBe(200)
expect(found.headers.get('etag')).toBe('"draft:1"')
expect(deps.service.get).toHaveBeenCalledWith(actor, draftId)
const invalid = await handleGetCompositionDraft(
new Request(
'https://devrunbook.example/api/v1/compositions/drafts/not-a-uuid',
),
'not-a-uuid',
dependencies(),
)
const concealedService = service()
concealedService.get = vi.fn(async () => {
throw Object.assign(new Error('hidden'), {
code: 'composition_draft_not_found',
})
})
const concealed = await handleGetCompositionDraft(
new Request(
`https://devrunbook.example/api/v1/compositions/drafts/${draftId}`,
),
draftId,
dependencies({ service: concealedService }),
)
expect(invalid.status).toBe(404)
expect(concealed.status).toBe(404)
expect((await error(invalid)).error.code).toBe(
'composition_draft_not_found',
)
expect((await error(concealed)).error.code).toBe(
'composition_draft_not_found',
)
})
it('requires same-origin JSON mutations and denies viewer writes safely', async () => {
const crossOrigin = await handleCreateCompositionDraft(
request('/api/v1/compositions/drafts', 'POST', createBody(), {
origin: 'https://attacker.example',
}),
dependencies(),
)
expect(crossOrigin.status).toBe(403)
expect((await error(crossOrigin)).error.code).toBe('invalid_origin')
const wrongType = await handleCreateCompositionDraft(
request('/api/v1/compositions/drafts', 'POST', createBody(), {
'content-type': 'text/plain',
}),
dependencies(),
)
expect(wrongType.status).toBe(422)
expect((await error(wrongType)).error.code).toBe(
'composition_content_type_unsupported',
)
const wrongCharset = await handleCreateCompositionDraft(
request('/api/v1/compositions/drafts', 'POST', createBody(), {
'content-type': 'application/json; charset=iso-8859-1',
}),
dependencies(),
)
expect(wrongCharset.status).toBe(422)
const viewerService = service()
viewerService.create = vi.fn(async () => {
throw Object.assign(new Error('internal authorization detail'), {
code: 'workspace_access_denied',
})
})
const denied = await handleCreateCompositionDraft(
request('/api/v1/compositions/drafts', 'POST', createBody()),
dependencies({
resolveContext: vi.fn(
async () =>
({ ...actor, workspaceRole: 'viewer' }) satisfies ActorContext,
),
service: viewerService,
}),
)
expect(denied.status).toBe(403)
expect(await denied.text()).not.toContain('internal authorization detail')
})
it('rejects duplicate keys, unknown properties, invalid UTF-8 and oversized streams', async () => {
const duplicate = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
'{"playbook":{"slug":"one","slug":"two","version":"1.0.0"},"workMode":"execute","autonomyLevel":"verify","inputs":{}}',
),
dependencies(),
)
expect(duplicate.status).toBe(422)
expect((await error(duplicate)).error.code).toBe(
'composition_json_duplicate_key',
)
const unknown = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
createBody({ clientComputedReadiness: 'ready' }),
),
dependencies(),
)
expect(unknown.status).toBe(422)
expect((await error(unknown)).error.code).toBe(
'composition_request_invalid',
)
const invalidUtf8 = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
new Uint8Array([0xff]).buffer,
),
dependencies(),
)
expect(invalidUtf8.status).toBe(422)
expect((await error(invalidUtf8)).error.code).toBe(
'composition_request_utf8_invalid',
)
const oversizedService = service()
const oversized = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
new Uint8Array(1_048_577).buffer,
),
dependencies({ service: oversizedService }),
)
expect(oversized.status).toBe(413)
expect((await error(oversized)).error.code).toBe(
'composition_request_too_large',
)
expect(oversizedService.create).not.toHaveBeenCalled()
})
it('validates UUIDs and governed enum values before invoking the service', async () => {
const deps = dependencies()
const badProfile = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
createBody({ repositoryProfileRevisionId: '../other-workspace' }),
),
deps,
)
expect(badProfile.status).toBe(422)
const badMode = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
createBody({ workMode: 'run-shell' }),
),
deps,
)
expect(badMode.status).toBe(422)
const traversal = await handleCreateCompositionDraft(
request(
'/api/v1/compositions/drafts',
'POST',
createBody({ scopeOverrides: { includedPaths: ['../secrets'] } }),
),
deps,
)
expect(traversal.status).toBe(422)
expect(deps.service.create).not.toHaveBeenCalled()
})
it('requires a valid If-Match before parsing or patching', async () => {
const deps = dependencies()
const missing = await handlePatchCompositionDraft(
request(
`/api/v1/compositions/drafts/${draftId}`,
'PATCH',
JSON.stringify({ autonomyLevel: 'repair' }),
),
draftId,
deps,
)
expect(missing.status).toBe(428)
expect((await error(missing)).error.code).toBe(
'composition_draft_precondition_required',
)
expect(deps.service.patch).not.toHaveBeenCalled()
const malformedService = service()
const malformed = await handlePatchCompositionDraft(
request(
`/api/v1/compositions/drafts/${draftId}`,
'PATCH',
JSON.stringify({ autonomyLevel: 'repair' }),
{ 'if-match': 'W/"draft:1"' },
),
draftId,
dependencies({ service: malformedService }),
)
expect(malformed.status).toBe(422)
expect(malformedService.patch).not.toHaveBeenCalled()
})
it('returns the current ETag and safe recovery detail for stale patches', async () => {
const staleService = service()
staleService.patch = vi.fn(async () => {
throw Object.assign(new Error('postgres://user:secret@db/private'), {
code: 'composition_draft_conflict',
details: {
currentRevision: 2,
currentEtag: '"draft:2"',
recovery: 'reload-and-review',
secret: 'must not escape',
},
})
})
const response = await handlePatchCompositionDraft(
request(
`/api/v1/compositions/drafts/${draftId}`,
'PATCH',
JSON.stringify({ autonomyLevel: 'repair' }),
{ 'if-match': '"draft:1"' },
),
draftId,
dependencies({ service: staleService }),
)
expect(response.status).toBe(409)
expect(response.headers.get('etag')).toBe('"draft:2"')
const body = await response.text()
expect(body).toContain('reload-and-review')
expect(body).not.toContain('secret')
expect(body).not.toContain('postgres://')
})
it('patches an allowed field and never reflects unexpected failures', async () => {
const deps = dependencies()
const patched = await handlePatchCompositionDraft(
request(
`/api/v1/compositions/drafts/${draftId}`,
'PATCH',
JSON.stringify({ autonomyLevel: 'repair' }),
{ 'if-match': '"draft:1"' },
),
draftId,
deps,
)
expect(patched.status).toBe(200)
expect(deps.service.patch).toHaveBeenCalledWith(
actor,
draftId,
'"draft:1"',
{ autonomyLevel: 'repair' },
)
const digestDeps = dependencies()
const digestPatch = await handlePatchCompositionDraft(
request(
`/api/v1/compositions/drafts/${draftId}`,
'PATCH',
JSON.stringify({ lastRenderDigest: 'b'.repeat(64) }),
{ 'if-match': '"draft:1"' },
),
draftId,
digestDeps,
)
expect(digestPatch.status).toBe(200)
expect(digestDeps.service.patch).toHaveBeenCalledWith(
actor,
draftId,
'"draft:1"',
{ lastRenderDigest: 'b'.repeat(64) },
)
const unavailableService = service()
unavailableService.get = vi.fn(async () => {
throw new Error('postgres://operator:secret@database/internal')
})
const unavailable = await handleGetCompositionDraft(
new Request(
`https://devrunbook.example/api/v1/compositions/drafts/${draftId}`,
),
draftId,
dependencies({ service: unavailableService }),
)
expect(unavailable.status).toBe(503)
const body = await unavailable.text()
expect(body).not.toContain('secret')
expect(JSON.parse(body).error.requestId).toMatch(/^[0-9a-f-]{36}$/u)
})
})
apps/web/src/app/api/v1/compositions/drafts/composition-draft-http.ts
+909
View File
@@ -0,0 +1,909 @@
import type {
ActorContext,
CompositionDraftResult,
PatchCompositionDraftResult,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../../server/authenticated-workspace-context'
const maximumDraftBytes = 1_048_576
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
const slugPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u
const semverPattern =
/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u
const workModes = new Set(['inspect', 'plan', 'guided', 'execute', 'recovery'])
const autonomyLevels = new Set([
'observe',
'diagnose',
'plan',
'implement',
'verify',
'repair',
])
const outputFormats = new Set(['prompt', 'markdown', 'run-pack'])
const createKeys = new Set([
'playbook',
'repositoryProfileRevisionId',
'workMode',
'autonomyLevel',
'inputs',
'scopeOverrides',
'outputFormat',
])
const patchKeys = new Set([
'repositoryProfileRevisionId',
'workMode',
'autonomyLevel',
'inputs',
'scopeOverrides',
'outputFormat',
'lastRenderDigest',
])
const scopeKeys = new Set([
'includedPaths',
'excludedPaths',
'allowableChangeTypes',
'repositoryWideRead',
])
export interface CompositionPlaybookReference {
readonly slug: string
readonly version: string
}
export interface CompositionDraftWrite {
readonly repositoryProfileRevisionId?: string | null
readonly inputs?: unknown
readonly scopeOverrides?: unknown
readonly autonomyLevel?: string
readonly workMode?: string
readonly outputFormat?: string
readonly lastRenderDigest?: string | null
}
export interface CompositionDraftHttpResult {
readonly result: CompositionDraftResult | PatchCompositionDraftResult
readonly playbook: CompositionPlaybookReference
}
export interface CompositionDraftHttpService {
create(
actor: ActorContext,
playbook: CompositionPlaybookReference,
draft: Required<
Pick<
CompositionDraftWrite,
'inputs' | 'autonomyLevel' | 'workMode' | 'outputFormat'
>
> &
CompositionDraftWrite,
): Promise<CompositionDraftHttpResult>
get(actor: ActorContext, draftId: string): Promise<CompositionDraftHttpResult>
patch(
actor: ActorContext,
draftId: string,
expectedEtag: string,
patch: CompositionDraftWrite,
): Promise<CompositionDraftHttpResult>
}
export interface CompositionDraftRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly service: CompositionDraftHttpService
}
interface SafeDetail {
readonly path: string
readonly rule: string
readonly message: string
readonly currentEtag?: string
readonly currentRevision?: number
readonly recovery?: string
}
class CompositionDraftHttpError extends Error {
constructor(
readonly status: number,
readonly code: string,
message: string,
readonly details?: readonly SafeDetail[],
readonly headers?: Readonly<Record<string, string>>,
) {
super(message)
}
}
function errorResponse(
status: number,
code: string,
message: string,
requestId: string,
details?: readonly SafeDetail[],
headers: Readonly<Record<string, string>> = {},
) {
return Response.json(
{
error: {
code,
message,
requestId,
...(details?.length ? { details } : {}),
},
},
{ status, headers: { 'Cache-Control': 'no-store', ...headers } },
)
}
function validation(
code: string,
message: string,
path: string,
status = 422,
): never {
throw new CompositionDraftHttpError(status, code, message, [
{ path, rule: code, message },
])
}
function plainObject(value: unknown): value is Record<string, unknown> {
return (
value !== null &&
typeof value === 'object' &&
!Array.isArray(value) &&
Object.getPrototypeOf(value) === Object.prototype
)
}
function assertExactKeys(
value: Record<string, unknown>,
allowed: ReadonlySet<string>,
path: string,
): void {
const unknown = Object.keys(value).find((key) => !allowed.has(key))
if (unknown) {
validation(
'composition_request_invalid',
`Unsupported property: ${unknown}`,
`${path}/${unknown}`,
)
}
}
export function parseStrictJson(text: string): unknown {
let offset = 0
const whitespace = /\s/u
const number = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/uy
function fail(): never {
throw new SyntaxError('Invalid JSON document')
}
function skipWhitespace(): void {
while (offset < text.length && whitespace.test(text[offset]!)) offset += 1
}
function parseString(): string {
if (text[offset] !== '"') fail()
const start = offset
offset += 1
while (offset < text.length) {
const character = text[offset]
if (character === '\\') {
offset += 2
continue
}
offset += 1
if (character === '"') {
return JSON.parse(text.slice(start, offset)) as string
}
}
return fail()
}
function parseValue(): void {
skipWhitespace()
const character = text[offset]
if (character === '{') return parseObject()
if (character === '[') return parseArray()
if (character === '"') {
parseString()
return
}
for (const literal of ['true', 'false', 'null']) {
if (text.startsWith(literal, offset)) {
offset += literal.length
return
}
}
number.lastIndex = offset
const match = number.exec(text)
if (!match) fail()
offset = number.lastIndex
}
function parseObject(): void {
offset += 1
skipWhitespace()
const keys = new Set<string>()
if (text[offset] === '}') {
offset += 1
return
}
while (offset < text.length) {
const key = parseString()
if (keys.has(key)) {
validation(
'composition_json_duplicate_key',
'JSON objects must not contain duplicate keys',
'/',
)
}
keys.add(key)
skipWhitespace()
if (text[offset] !== ':') fail()
offset += 1
parseValue()
skipWhitespace()
if (text[offset] === '}') {
offset += 1
return
}
if (text[offset] !== ',') fail()
offset += 1
skipWhitespace()
}
fail()
}
function parseArray(): void {
offset += 1
skipWhitespace()
if (text[offset] === ']') {
offset += 1
return
}
while (offset < text.length) {
parseValue()
skipWhitespace()
if (text[offset] === ']') {
offset += 1
return
}
if (text[offset] !== ',') fail()
offset += 1
}
fail()
}
try {
parseValue()
skipWhitespace()
if (offset !== text.length) fail()
return JSON.parse(text) as unknown
} catch (error) {
if (error instanceof CompositionDraftHttpError) throw error
validation(
'composition_json_invalid',
'Request body must contain valid JSON',
'/',
)
}
}
async function readBoundedBody(request: Request): Promise<Uint8Array> {
const declaredLength = request.headers.get('content-length')
if (
declaredLength !== null &&
(!/^\d+$/u.test(declaredLength) ||
Number(declaredLength) > maximumDraftBytes)
) {
validation(
'composition_request_too_large',
`Request body must not exceed ${maximumDraftBytes} bytes`,
'/',
413,
)
}
if (!request.body) {
validation(
'composition_request_body_required',
'Request body is required',
'/',
)
}
const reader = request.body!.getReader()
const chunks: Uint8Array[] = []
let length = 0
while (true) {
const { done, value } = await reader.read()
if (done) break
length += value.length
if (length > maximumDraftBytes) {
await reader.cancel()
validation(
'composition_request_too_large',
`Request body must not exceed ${maximumDraftBytes} bytes`,
'/',
413,
)
}
chunks.push(value)
}
const body = new Uint8Array(length)
let bodyOffset = 0
for (const chunk of chunks) {
body.set(chunk, bodyOffset)
bodyOffset += chunk.length
}
return body
}
async function parseJsonBody(request: Request): Promise<unknown> {
const contentType = request.headers.get('content-type')
const [mediaType, ...parameters] =
contentType?.split(';').map((part) => part.trim().toLowerCase()) ?? []
if (
mediaType !== 'application/json' ||
parameters.some((parameter) => parameter !== 'charset=utf-8')
) {
validation(
'composition_content_type_unsupported',
'Composition drafts require application/json',
'headers.content-type',
)
}
let text: string
try {
text = new TextDecoder('utf-8', { fatal: true }).decode(
await readBoundedBody(request),
)
} catch (error) {
if (error instanceof CompositionDraftHttpError) throw error
validation(
'composition_request_utf8_invalid',
'Request body must be valid UTF-8',
'/',
)
}
return parseStrictJson(text)
}
function requiredString(
value: unknown,
path: string,
allowed?: ReadonlySet<string>,
): string {
if (typeof value !== 'string' || value.length === 0) {
validation('composition_request_invalid', 'Value must be a string', path)
}
if (allowed && !allowed.has(value)) {
validation(
'composition_request_invalid',
'Value is not one of the governed options',
path,
)
}
return value
}
function repositoryRevision(value: unknown): string | null {
if (value === null) return null
if (typeof value !== 'string' || !uuidPattern.test(value)) {
validation(
'composition_request_invalid',
'Repository profile revision must be a UUID or null',
'/repositoryProfileRevisionId',
)
}
return value
}
function renderDigest(value: unknown): string | null {
if (value === null) return null
if (typeof value !== 'string' || !/^[a-f0-9]{64}$/u.test(value)) {
validation(
'composition_request_invalid',
'lastRenderDigest must be a lowercase SHA-256 digest or null',
'/lastRenderDigest',
)
}
return value
}
function containsUnsafeControl(value: string): boolean {
return [...value].some((character) => {
const codePoint = character.codePointAt(0)!
return (
codePoint <= 0x1f ||
codePoint === 0x7f ||
(codePoint >= 0x202a && codePoint <= 0x202e) ||
(codePoint >= 0x2066 && codePoint <= 0x2069)
)
})
}
function validateScope(value: unknown): Record<string, unknown> {
if (!plainObject(value)) {
validation(
'composition_request_invalid',
'scopeOverrides must be an object',
'/scopeOverrides',
)
}
assertExactKeys(value, scopeKeys, '/scopeOverrides')
for (const key of ['includedPaths', 'excludedPaths'] as const) {
const candidate = value[key]
if (
candidate !== undefined &&
(!Array.isArray(candidate) ||
candidate.length > 100 ||
new Set(candidate).size !== candidate.length ||
candidate.some(
(item) =>
typeof item !== 'string' ||
item.length === 0 ||
item.length > 500 ||
item.startsWith('/') ||
item.includes('\\') ||
item.split('/').includes('..') ||
containsUnsafeControl(item),
))
) {
validation(
'composition_request_invalid',
`${key} must contain unique normalized relative paths`,
`/scopeOverrides/${key}`,
)
}
}
const changeTypes = value.allowableChangeTypes
if (
changeTypes !== undefined &&
(!Array.isArray(changeTypes) ||
changeTypes.length > 30 ||
new Set(changeTypes).size !== changeTypes.length ||
changeTypes.some(
(item) =>
typeof item !== 'string' ||
item.length > 80 ||
!/^[a-z][a-z0-9-]*$/u.test(item),
))
) {
validation(
'composition_request_invalid',
'allowableChangeTypes must contain unique governed identifiers',
'/scopeOverrides/allowableChangeTypes',
)
}
if (
value.repositoryWideRead !== undefined &&
typeof value.repositoryWideRead !== 'boolean'
) {
validation(
'composition_request_invalid',
'repositoryWideRead must be a boolean',
'/scopeOverrides/repositoryWideRead',
)
}
return value
}
export async function parseCompositionRequestBody(request: Request): Promise<{
readonly playbook: CompositionPlaybookReference
readonly draft: Required<
Pick<
CompositionDraftWrite,
'inputs' | 'autonomyLevel' | 'workMode' | 'outputFormat'
>
> &
CompositionDraftWrite
}> {
const value = await parseJsonBody(request)
if (!plainObject(value)) {
validation(
'composition_request_invalid',
'Request body must be an object',
'/',
)
}
assertExactKeys(value, createKeys, '/')
if (!plainObject(value.playbook)) {
validation(
'composition_request_invalid',
'playbook must be an object',
'/playbook',
)
}
assertExactKeys(value.playbook, new Set(['slug', 'version']), '/playbook')
const slug = requiredString(value.playbook.slug, '/playbook/slug')
const version = requiredString(value.playbook.version, '/playbook/version')
if (slug.length > 120 || !slugPattern.test(slug)) {
validation(
'composition_request_invalid',
'playbook.slug must be a governed slug',
'/playbook/slug',
)
}
if (version.length > 120 || !semverPattern.test(version)) {
validation(
'composition_request_invalid',
'playbook.version must be Semantic Versioning',
'/playbook/version',
)
}
if (!plainObject(value.inputs)) {
validation(
'composition_request_invalid',
'inputs must be an object',
'/inputs',
)
}
return {
playbook: { slug, version },
draft: {
...(value.repositoryProfileRevisionId === undefined
? {}
: {
repositoryProfileRevisionId: repositoryRevision(
value.repositoryProfileRevisionId,
),
}),
inputs: value.inputs,
scopeOverrides: validateScope(value.scopeOverrides ?? {}),
workMode: requiredString(value.workMode, '/workMode', workModes),
autonomyLevel: requiredString(
value.autonomyLevel,
'/autonomyLevel',
autonomyLevels,
),
outputFormat:
value.outputFormat === undefined
? 'prompt'
: requiredString(value.outputFormat, '/outputFormat', outputFormats),
},
}
}
async function parsePatchRequest(
request: Request,
): Promise<CompositionDraftWrite> {
const value = await parseJsonBody(request)
if (!plainObject(value) || Object.keys(value).length === 0) {
validation(
'composition_request_invalid',
'Patch body must be a non-empty object',
'/',
)
}
assertExactKeys(value, patchKeys, '/')
return {
...('repositoryProfileRevisionId' in value
? {
repositoryProfileRevisionId: repositoryRevision(
value.repositoryProfileRevisionId,
),
}
: {}),
...('inputs' in value
? plainObject(value.inputs)
? { inputs: value.inputs }
: validation(
'composition_request_invalid',
'inputs must be an object',
'/inputs',
)
: {}),
...('scopeOverrides' in value
? { scopeOverrides: validateScope(value.scopeOverrides) }
: {}),
...('workMode' in value
? { workMode: requiredString(value.workMode, '/workMode', workModes) }
: {}),
...('autonomyLevel' in value
? {
autonomyLevel: requiredString(
value.autonomyLevel,
'/autonomyLevel',
autonomyLevels,
),
}
: {}),
...('outputFormat' in value
? {
outputFormat: requiredString(
value.outputFormat,
'/outputFormat',
outputFormats,
),
}
: {}),
...('lastRenderDigest' in value
? { lastRenderDigest: renderDigest(value.lastRenderDigest) }
: {}),
}
}
function assertDraftId(draftId: string): void {
if (!uuidPattern.test(draftId)) {
throw new CompositionDraftHttpError(
404,
'composition_draft_not_found',
'Composition draft not found',
)
}
}
function assertDraftEtag(etag: string): void {
if (!/^"draft:[1-9]\d*"$/u.test(etag)) {
validation(
'composition_draft_etag_invalid',
'If-Match must contain a strong composition draft ETag',
'headers.if-match',
)
}
}
function draftEnvelope(
result: CompositionDraftHttpResult,
): Readonly<Record<string, unknown>> {
const { draft } = result.result
return {
id: draft.id,
revision: draft.revision,
request: {
playbook: result.playbook,
repositoryProfileRevisionId: draft.repositoryProfileRevisionId,
workMode: draft.workMode,
autonomyLevel: draft.autonomyLevel,
inputs: draft.inputs,
scopeOverrides: draft.scopeOverrides,
outputFormat: draft.outputFormat,
},
lastRenderDigest: draft.lastRenderDigest,
createdAt: draft.createdAt,
updatedAt: draft.updatedAt,
}
}
function applicationError(caught: unknown): {
readonly code: string
readonly details: Readonly<Record<string, unknown>>
} | null {
if (caught === null || typeof caught !== 'object') return null
const candidate = caught as Record<string, unknown>
if (typeof candidate.code !== 'string') return null
return {
code: candidate.code,
details: plainObject(candidate.details) ? candidate.details : {},
}
}
function issueDetails(value: unknown): SafeDetail[] | undefined {
if (!Array.isArray(value)) return undefined
const details = value.flatMap((issue): SafeDetail[] =>
typeof issue === 'string'
? [
{
path: '/',
rule: 'composition_draft_invalid',
message: issue.slice(0, 500),
},
]
: [],
)
return details.length ? details : undefined
}
function mappedError(caught: unknown, requestId: string): Response {
if (caught instanceof CompositionDraftHttpError) {
return errorResponse(
caught.status,
caught.code,
caught.message,
requestId,
caught.details,
caught.headers,
)
}
if (caught instanceof AuthenticatedWorkspaceContextError) {
return errorResponse(
caught.code === 'authentication_required' ? 401 : 403,
caught.code,
caught.code === 'authentication_required'
? 'Authentication required'
: 'Access denied',
requestId,
)
}
const application = applicationError(caught)
if (application?.code === 'authentication_required') {
return errorResponse(
401,
application.code,
'Authentication required',
requestId,
)
}
if (application?.code === 'workspace_access_denied') {
return errorResponse(403, application.code, 'Access denied', requestId)
}
if (application?.code === 'composition_draft_not_found') {
return errorResponse(
404,
application.code,
'Composition draft not found',
requestId,
)
}
if (application?.code === 'composition_draft_conflict') {
const currentEtag =
typeof application.details.currentEtag === 'string' &&
/^"draft:[1-9]\d*"$/u.test(application.details.currentEtag)
? application.details.currentEtag
: undefined
const currentRevision =
typeof application.details.currentRevision === 'number'
? application.details.currentRevision
: undefined
const recovery =
application.details.recovery === 'reload-and-review'
? application.details.recovery
: undefined
return errorResponse(
409,
application.code,
'Composition draft changed; reload and review before saving',
requestId,
[
{
path: 'headers.if-match',
rule: 'etag-conflict',
message: 'The supplied draft ETag is stale',
...(currentEtag ? { currentEtag } : {}),
...(currentRevision ? { currentRevision } : {}),
...(recovery ? { recovery } : {}),
},
],
currentEtag ? { ETag: currentEtag } : {},
)
}
if (
application?.code === 'composition_draft_invalid' ||
application?.code === 'composition_draft_etag_invalid'
) {
return errorResponse(
422,
application.code,
'Composition draft is invalid',
requestId,
issueDetails(application.details.issues),
)
}
return errorResponse(
503,
'composition_draft_service_unavailable',
'Composition draft service is temporarily unavailable',
requestId,
)
}
function mutationBoundary(
request: Request,
dependencies: CompositionDraftRouteDependencies,
requestId: string,
operation: (request: Request) => Promise<Response>,
): Promise<Response> {
return handleAuthRequest(
request,
async (sameOriginRequest) => {
if (
sameOriginRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return errorResponse(
403,
'invalid_origin',
'Invalid request origin',
requestId,
)
}
return operation(sameOriginRequest)
},
dependencies.publicBaseUrl,
() =>
errorResponse(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export function handleCreateCompositionDraft(
request: Request,
dependencies: CompositionDraftRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
const actor = await dependencies.resolveContext(safeRequest)
const parsed = await parseCompositionRequestBody(safeRequest)
const created = await dependencies.service.create(
actor,
parsed.playbook,
parsed.draft,
)
return Response.json(draftEnvelope(created), {
status: 201,
headers: {
ETag: created.result.etag,
'Cache-Control': 'no-store',
},
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
export async function handleGetCompositionDraft(
request: Request,
draftId: string,
dependencies: CompositionDraftRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
try {
const actor = await dependencies.resolveContext(request)
assertDraftId(draftId)
const result = await dependencies.service.get(actor, draftId)
return Response.json(draftEnvelope(result), {
headers: { ETag: result.result.etag, 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
}
export function handlePatchCompositionDraft(
request: Request,
draftId: string,
dependencies: CompositionDraftRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return mutationBoundary(
request,
dependencies,
requestId,
async (safeRequest) => {
try {
const actor = await dependencies.resolveContext(safeRequest)
assertDraftId(draftId)
const expectedEtag = safeRequest.headers.get('if-match')
if (expectedEtag === null) {
throw new CompositionDraftHttpError(
428,
'composition_draft_precondition_required',
'If-Match is required',
)
}
assertDraftEtag(expectedEtag)
const patch = await parsePatchRequest(safeRequest)
const result = await dependencies.service.patch(
actor,
draftId,
expectedEtag,
patch,
)
return Response.json(draftEnvelope(result), {
headers: { ETag: result.result.etag, 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
},
)
}
apps/web/src/app/api/v1/compositions/drafts/composition-draft-route-dependencies.ts
+14
View File
@@ -0,0 +1,14 @@
import { resolveAuthenticatedWorkspaceContext } from '../../../../../server/authenticated-workspace-context'
import { getCompositionDraftServer } from '../../../../../server/composition-drafts'
import type { CompositionDraftRouteDependencies } from './composition-draft-http'
export function compositionDraftRouteDependencies(): CompositionDraftRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
service: getCompositionDraftServer(),
}
}
apps/web/src/app/api/v1/compositions/drafts/route.ts
+11
View File
@@ -0,0 +1,11 @@
import { handleCreateCompositionDraft } from './composition-draft-http'
import { compositionDraftRouteDependencies } from './composition-draft-route-dependencies'
export const dynamic = 'force-dynamic'
export function POST(request: Request) {
return handleCreateCompositionDraft(
request,
compositionDraftRouteDependencies(),
)
}
apps/web/src/app/api/v1/compositions/preview/route.ts
+11
View File
@@ -0,0 +1,11 @@
import { handlePreviewComposition } from '../composition-http'
import { authoritativeCompositionRouteDependencies } from '../composition-route-dependencies'
export const dynamic = 'force-dynamic'
export function POST(request: Request) {
return handlePreviewComposition(
request,
authoritativeCompositionRouteDependencies(),
)
}
apps/web/src/app/api/v1/favorites/[playbookId]/favorite-route.test.ts
+166
View File
@@ -0,0 +1,166 @@
import type { ActorContext } from '@devrunbook/application'
import { describe, expect, it, vi } from 'vitest'
import { AuthenticatedWorkspaceContextError } from '../../../../../server/authenticated-workspace-context'
import {
handleFavoriteMutation,
type FavoriteRouteDependencies,
} from './favorite-route'
const origin = 'https://runbook.example.test'
const playbookId = '00000000-0000-4000-8000-000000000003'
const actor: ActorContext = {
userId: '00000000-0000-4000-8000-000000000001',
workspaceId: '00000000-0000-4000-8000-000000000002',
instanceRole: 'user',
workspaceRole: 'viewer',
}
const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu
async function expectError(response: Response, status: number, code: string) {
expect(response.status).toBe(status)
expect(response.headers.get('content-type')).toContain('application/json')
expect(await response.json()).toEqual({
error: {
code,
message: expect.any(String),
requestId: expect.stringMatching(uuid),
},
})
}
function request(
method: 'PUT' | 'DELETE',
requestOrigin: string | null = origin,
) {
const headers = new Headers()
if (requestOrigin) headers.set('origin', requestOrigin)
return new Request(`${origin}/api/v1/favorites/${playbookId}`, {
method,
headers,
})
}
function dependencies(
overrides: Partial<FavoriteRouteDependencies> = {},
): FavoriteRouteDependencies {
return {
publicBaseUrl: origin,
resolveContext: vi.fn(async () => actor),
mutate: vi.fn(async () => undefined),
...overrides,
}
}
describe('favorite mutation route', () => {
it.each([
['PUT', 'add'],
['DELETE', 'remove'],
] as const)(
'maps %s to an idempotent %s mutation',
async (method, mutation) => {
const context = dependencies()
const response = await handleFavoriteMutation(
request(method),
playbookId,
mutation,
context,
)
expect(response.status).toBe(204)
expect(await response.text()).toBe('')
expect(context.mutate).toHaveBeenCalledWith({
actor,
playbookId,
mutation,
})
},
)
it.each([[null], ['https://attacker.example.test']])(
'rejects a missing or foreign mutation origin: %s',
async (requestOrigin) => {
const context = dependencies()
const response = await handleFavoriteMutation(
request('PUT', requestOrigin),
playbookId,
'add',
context,
)
await expectError(response, 403, 'invalid_origin')
expect(context.resolveContext).not.toHaveBeenCalled()
},
)
it.each([
['authentication_required', 401],
['workspace_access_denied', 403],
] as const)('maps %s to a safe %s response', async (code, status) => {
const context = dependencies({
resolveContext: vi.fn(async () => {
throw new AuthenticatedWorkspaceContextError(code)
}),
})
const response = await handleFavoriteMutation(
request('PUT'),
playbookId,
'add',
context,
)
const body = await response.clone().text()
await expectError(response, status, code)
expect(body).not.toContain(actor.workspaceId)
})
it('conflates invalid, inaccessible, and missing playbook IDs as not found', async () => {
const inaccessible = dependencies({
mutate: vi.fn(async () => {
throw { code: 'playbook_not_found', detail: 'private workspace id' }
}),
})
const invalidResponse = await handleFavoriteMutation(
request('PUT'),
'not-a-uuid',
'add',
dependencies(),
)
const inaccessibleResponse = await handleFavoriteMutation(
request('PUT'),
playbookId,
'add',
inaccessible,
)
await expectError(invalidResponse, 404, 'playbook_not_found')
await expectError(inaccessibleResponse, 404, 'playbook_not_found')
})
it('redacts unexpected persistence failures', async () => {
const context = dependencies({
mutate: vi.fn(async () => {
throw new Error('postgresql://operator:secret@database/internal')
}),
})
const response = await handleFavoriteMutation(
request('DELETE'),
playbookId,
'remove',
context,
)
const responseBody = await response.json()
const body = JSON.stringify(responseBody)
expect(response.status).toBe(503)
expect(responseBody).toEqual({
error: {
code: 'favorite_service_unavailable',
message: 'Favorite service unavailable',
requestId: expect.stringMatching(uuid),
},
})
expect(body).not.toContain('secret')
expect(body).not.toContain('postgresql')
})
})
apps/web/src/app/api/v1/favorites/[playbookId]/favorite-route.ts
+103
View File
@@ -0,0 +1,103 @@
import type {
ActorContext,
PlaybookFavoriteMutation,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../../server/authenticated-workspace-context'
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu
export interface FavoriteRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly mutate: (input: {
readonly actor: Pick<ActorContext, 'userId' | 'workspaceId'>
readonly playbookId: string
readonly mutation: PlaybookFavoriteMutation
}) => Promise<void>
}
function error(
status: number,
code: string,
message: string,
requestId: string,
) {
return Response.json({ error: { code, message, requestId } }, { status })
}
function errorCode(value: unknown): unknown {
return value !== null && typeof value === 'object' && 'code' in value
? value.code
: undefined
}
export function handleFavoriteMutation(
request: Request,
playbookId: string,
mutation: PlaybookFavoriteMutation,
dependencies: FavoriteRouteDependencies,
): Promise<Response> {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
if (
sameOriginRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return error(403, 'invalid_origin', 'Invalid request origin', requestId)
}
if (!uuidPattern.test(playbookId)) {
return error(404, 'playbook_not_found', 'Playbook not found', requestId)
}
try {
const actor = await dependencies.resolveContext(sameOriginRequest)
await dependencies.mutate({ actor, playbookId, mutation })
return new Response(null, { status: 204 })
} catch (caught) {
const code = errorCode(caught)
if (
caught instanceof AuthenticatedWorkspaceContextError &&
code === 'authentication_required'
) {
return error(
401,
'authentication_required',
'Authentication required',
requestId,
)
}
if (
caught instanceof AuthenticatedWorkspaceContextError &&
code === 'workspace_access_denied'
) {
return error(
403,
'workspace_access_denied',
'Access denied',
requestId,
)
}
if (code === 'playbook_not_found') {
return error(
404,
'playbook_not_found',
'Playbook not found',
requestId,
)
}
return error(
503,
'favorite_service_unavailable',
'Favorite service unavailable',
requestId,
)
}
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
apps/web/src/app/api/v1/favorites/[playbookId]/route.ts
+30
View File
@@ -0,0 +1,30 @@
import { resolveAuthenticatedWorkspaceContext } from '../../../../../server/authenticated-workspace-context'
import { persistPlaybookFavorite } from '../../../../../server/playbook-favorites'
import {
handleFavoriteMutation,
type FavoriteRouteDependencies,
} from './favorite-route'
export const dynamic = 'force-dynamic'
function dependencies(): FavoriteRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
mutate: persistPlaybookFavorite,
}
}
type RouteContext = { params: Promise<{ playbookId: string }> }
export async function PUT(request: Request, context: RouteContext) {
const { playbookId } = await context.params
return handleFavoriteMutation(request, playbookId, 'add', dependencies())
}
export async function DELETE(request: Request, context: RouteContext) {
const { playbookId } = await context.params
return handleFavoriteMutation(request, playbookId, 'remove', dependencies())
}
apps/web/src/app/api/v1/instance/setup/route.ts
+128
View File
@@ -0,0 +1,128 @@
import { assertJsonValue } from '@devrunbook/content'
import { z } from 'zod'
import { completeInstanceSetup } from '@/server/instance-service'
import { readSetupJson, SetupRequestTooLargeError } from '@/setup/setup-request'
import {
assertNonSecretConfiguration,
authorizeBootstrap,
} from '../../../../../setup/setup-policy'
export const dynamic = 'force-dynamic'
const setupRequest = z.strictObject({
bootstrapToken: z.string(),
instanceName: z.string().trim().min(1).max(100),
publicBaseUrl: z.url(),
owner: z.strictObject({
email: z.email(),
displayName: z.string().trim().min(1).max(100),
password: z.string().min(12).max(128),
}),
configuration: z.record(z.string(), z.unknown()).optional().default({}),
})
function errorCode(error: unknown): string | undefined {
if (!error || typeof error !== 'object' || !('code' in error))
return undefined
return typeof error.code === 'string' ? error.code : undefined
}
export async function POST(request: Request) {
let parsed: z.infer<typeof setupRequest>
try {
parsed = setupRequest.parse(await readSetupJson(request))
assertNonSecretConfiguration(parsed.configuration)
assertJsonValue(parsed.configuration, 'configuration')
} catch (error) {
if (error instanceof SetupRequestTooLargeError) {
return Response.json(
{
error: {
code: 'request_too_large',
message: error.message,
},
},
{ status: 413 },
)
}
return Response.json(
{
error: {
code: 'validation_failed',
message: 'Setup request is invalid',
details: error instanceof Error ? [error.message] : [],
},
},
{ status: 422 },
)
}
if (
!authorizeBootstrap(
request,
parsed.bootstrapToken,
process.env.BOOTSTRAP_TOKEN,
)
) {
return Response.json(
{
error: {
code: 'bootstrap_denied',
message: 'Bootstrap authorization failed',
},
},
{ status: 403 },
)
}
try {
await completeInstanceSetup({
instanceName: parsed.instanceName,
publicBaseUrl: parsed.publicBaseUrl,
owner: {
email: parsed.owner.email.trim().toLowerCase(),
displayName: parsed.owner.displayName,
password: parsed.owner.password,
},
configuration: parsed.configuration,
})
return Response.json(
{
state: 'ready',
setupRequired: false,
schemaVersion: '0001',
applicationVersion: '0.1.0',
warnings: [],
},
{ status: 201 },
)
} catch (error) {
const code = errorCode(error)
if (code === 'setup_already_complete' || code === 'setup_in_progress') {
return Response.json(
{ error: { code, message: 'Setup cannot be completed in this state' } },
{ status: 409 },
)
}
if (
code === 'catalog_import_incomplete' ||
code === 'playbook_identity_conflict' ||
code === 'playbook_version_conflict'
) {
return Response.json(
{ error: { code, message: 'Built-in catalog validation failed' } },
{ status: 422 },
)
}
return Response.json(
{
error: {
code: 'setup_failed',
message: 'Setup could not be completed',
},
},
{ status: 500 },
)
}
}
apps/web/src/app/api/v1/instance/status/route.ts
+24
View File
@@ -0,0 +1,24 @@
import { readInstanceStatus } from '@/server/instance-service'
export const dynamic = 'force-dynamic'
export async function GET() {
try {
const status = await readInstanceStatus(
process.env.MAINTENANCE_MODE === 'true',
)
return Response.json({
...status,
applicationVersion: '0.1.0',
warnings: [],
})
} catch {
return Response.json({
state: 'recovery_required',
setupRequired: true,
schemaVersion: 'unknown',
applicationVersion: '0.1.0',
warnings: ['Database state is unavailable'],
})
}
}
apps/web/src/app/api/v1/integrations/gitea/[integrationId]/repositories/import/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { handleImportGiteaRepository } from '../../../integration-http'
import { giteaIntegrationRouteDependencies } from '../../../integration-route-dependencies'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ integrationId: string }> }
export async function POST(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleImportGiteaRepository(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/integrations/gitea/[integrationId]/repositories/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { handleDiscoverGiteaRepositories } from '../../integration-http'
import { giteaIntegrationRouteDependencies } from '../../integration-route-dependencies'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ integrationId: string }> }
export async function GET(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleDiscoverGiteaRepositories(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/integrations/gitea/[integrationId]/rotate-secret/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { handleRotateGiteaSecret } from '../../integration-http'
import { giteaIntegrationRouteDependencies } from '../../integration-route-dependencies'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ integrationId: string }> }
export async function POST(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleRotateGiteaSecret(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/integrations/gitea/[integrationId]/route.ts
+27
View File
@@ -0,0 +1,27 @@
import {
handleDeleteGiteaIntegration,
handleGetGiteaIntegration,
} from '../integration-http'
import { giteaIntegrationRouteDependencies } from '../integration-route-dependencies'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ integrationId: string }> }
export async function GET(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleGetGiteaIntegration(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
export async function DELETE(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleDeleteGiteaIntegration(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/integrations/gitea/[integrationId]/test/route.ts
+15
View File
@@ -0,0 +1,15 @@
import { handleTestGiteaIntegration } from '../../integration-http'
import { giteaIntegrationRouteDependencies } from '../../integration-route-dependencies'
export const dynamic = 'force-dynamic'
type RouteContext = { params: Promise<{ integrationId: string }> }
export async function POST(request: Request, context: RouteContext) {
const { integrationId } = await context.params
return handleTestGiteaIntegration(
request,
integrationId,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/integrations/gitea/integration-http.test.ts
+312
View File
@@ -0,0 +1,312 @@
import { describe, expect, it, vi } from 'vitest'
import type {
ActorContext,
SafeGiteaIntegration,
} from '@devrunbook/application'
import {
handleCreateGiteaIntegration,
handleDeleteGiteaIntegration,
handleDiscoverGiteaRepositories,
handleGetGiteaIntegration,
handleImportGiteaRepository,
handleListGiteaIntegrations,
handleRotateGiteaSecret,
handleTestGiteaIntegration,
type GiteaIntegrationRouteDependencies,
} from './integration-http'
const integrationId = '00000000-0000-4000-8000-000000000001'
const actor: ActorContext = {
userId: '00000000-0000-4000-8000-000000000002',
instanceRole: 'user',
workspaceId: '00000000-0000-4000-8000-000000000003',
workspaceRole: 'owner',
}
function integration(): SafeGiteaIntegration {
return {
id: integrationId,
workspaceId: actor.workspaceId,
displayName: 'Primary Gitea',
baseUrl: 'https://git.example.test',
status: 'healthy',
capabilities: { 'repository-list': 'supported' },
serverVersion: '1.24.7',
remoteIdentity: { id: '4', login: 'owner' },
healthCode: null,
lastCheckedAt: '2026-07-27T10:00:00.000Z',
secretLastFour: 'cdef',
createdAt: '2026-07-27T10:00:00.000Z',
updatedAt: '2026-07-27T10:00:00.000Z',
}
}
function dependencies(): GiteaIntegrationRouteDependencies {
return {
publicBaseUrl: 'https://runbooks.example.test',
resolveContext: vi.fn(async () => actor),
service: {
list: vi.fn(async () => [integration()]),
get: vi.fn(async () => integration()),
create: vi.fn(async () => integration()),
test: vi.fn(async () => ({
normalizedBaseUrl: 'https://git.example.test',
status: 'healthy' as const,
serverVersion: '1.24.7',
remoteIdentity: { id: '4', login: 'owner' },
capabilities: { 'repository-list': 'supported' as const },
healthCode: null,
warnings: [],
})),
discover: vi.fn(async () => ({
items: [
{
externalId: '42',
owner: 'team',
name: 'service',
defaultBranch: 'main',
archived: false,
private: true,
permissions: { pull: true, push: false, admin: false },
},
],
nextCursor: null,
})),
importRepository: vi.fn(async () => ({
repositoryId: '00000000-0000-4000-8000-000000000010',
snapshotId: '00000000-0000-4000-8000-000000000011',
jobId: '00000000-0000-4000-8000-000000000012',
})),
rotate: vi.fn(async () => integration()),
delete: vi.fn(async () => undefined),
},
}
}
function mutationRequest(
path: string,
body?: unknown,
headers?: Readonly<Record<string, string>>,
) {
return new Request(`https://runbooks.example.test${path}`, {
method: 'POST',
headers: {
origin: 'https://runbooks.example.test',
'content-type': 'application/json',
...headers,
},
...(body === undefined ? {} : { body: JSON.stringify(body) }),
})
}
describe('Gitea HTTP boundary', () => {
it('returns only safe integration projections for list and detail', async () => {
const deps = dependencies()
const unsafe = {
...integration(),
token: 'must-not-leak',
secret: { ciphertext: 'must-not-leak' },
}
vi.mocked(deps.service.list).mockResolvedValue([unsafe])
vi.mocked(deps.service.get).mockResolvedValue(unsafe)
const list = await handleListGiteaIntegrations(
new Request('https://runbooks.example.test/api/v1/integrations/gitea'),
deps,
)
const detail = await handleGetGiteaIntegration(
new Request(
`https://runbooks.example.test/api/v1/integrations/gitea/${integrationId}`,
),
integrationId,
deps,
)
expect(await list.text()).not.toMatch(/must-not-leak|ciphertext|token/u)
expect(await detail.text()).not.toMatch(/must-not-leak|ciphertext|token/u)
expect(list.headers.get('cache-control')).toBe('no-store')
})
it('accepts an exact same-origin create body but never reflects the token', async () => {
const deps = dependencies()
const response = await handleCreateGiteaIntegration(
mutationRequest('/api/v1/integrations/gitea', {
displayName: 'Primary Gitea',
baseUrl: 'https://git.example.test',
token: 'top-secret-token',
requestTimeoutMs: 12_000,
}),
deps,
)
expect(response.status).toBe(201)
expect(await response.text()).not.toContain('top-secret-token')
expect(deps.service.create).toHaveBeenCalledWith(
actor,
expect.objectContaining({ token: 'top-secret-token' }),
)
})
it('rejects cross-origin, unsupported fields and oversized bodies safely', async () => {
const deps = dependencies()
const crossOrigin = await handleCreateGiteaIntegration(
mutationRequest(
'/api/v1/integrations/gitea',
{ displayName: 'x', baseUrl: 'https://git.test', token: 'secret' },
{ origin: 'https://attacker.test' },
),
deps,
)
expect(crossOrigin.status).toBe(403)
const unsupported = await handleCreateGiteaIntegration(
mutationRequest('/api/v1/integrations/gitea', {
displayName: 'x',
baseUrl: 'https://git.test',
token: 'secret',
admin: true,
}),
deps,
)
expect(unsupported.status).toBe(422)
expect(await unsupported.text()).not.toContain('secret')
const oversized = await handleCreateGiteaIntegration(
mutationRequest(
'/api/v1/integrations/gitea',
{ displayName: 'x', baseUrl: 'https://git.test', token: 'secret' },
{ 'content-length': '20000' },
),
deps,
)
expect(oversized.status).toBe(413)
})
it('projects connection test state and validates discovery query bounds', async () => {
const deps = dependencies()
const tested = await handleTestGiteaIntegration(
mutationRequest(`/api/v1/integrations/gitea/${integrationId}/test`),
integrationId,
deps,
)
expect(tested.status).toBe(200)
expect(await tested.json()).toMatchObject({
status: 'healthy',
capabilities: { 'repository-list': 'supported' },
})
const discovered = await handleDiscoverGiteaRepositories(
new Request(
`https://runbooks.example.test/api/v1/integrations/gitea/${integrationId}/repositories?limit=50`,
),
integrationId,
deps,
)
expect(discovered.status).toBe(200)
expect(await discovered.json()).toMatchObject({
items: [{ externalId: '42', permissions: { pull: true } }],
})
const invalid = await handleDiscoverGiteaRepositories(
new Request(
`https://runbooks.example.test/api/v1/integrations/gitea/${integrationId}/repositories?limit=101`,
),
integrationId,
deps,
)
expect(invalid.status).toBe(422)
})
it('rotates write-only credentials and protects deletion with same-origin handling', async () => {
const deps = dependencies()
const rotated = await handleRotateGiteaSecret(
mutationRequest(
`/api/v1/integrations/gitea/${integrationId}/rotate-secret`,
{ token: 'replacement-secret' },
),
integrationId,
deps,
)
expect(rotated.status).toBe(200)
expect(await rotated.text()).not.toContain('replacement-secret')
const deleted = await handleDeleteGiteaIntegration(
new Request(
`https://runbooks.example.test/api/v1/integrations/gitea/${integrationId}`,
{
method: 'DELETE',
headers: { origin: 'https://runbooks.example.test' },
},
),
integrationId,
deps,
)
expect(deleted.status).toBe(204)
})
it('imports an exact opaque repository identity with a safe accepted response', async () => {
const deps = dependencies()
vi.mocked(deps.service.importRepository!).mockResolvedValue({
repositoryId: '00000000-0000-4000-8000-000000000010',
snapshotId: '00000000-0000-4000-8000-000000000011',
jobId: '00000000-0000-4000-8000-000000000012',
token: 'must-not-leak',
} as Awaited<ReturnType<NonNullable<typeof deps.service.importRepository>>>)
const imported = await handleImportGiteaRepository(
mutationRequest(
`/api/v1/integrations/gitea/${integrationId}/repositories/import`,
{ externalId: '42' },
),
integrationId,
deps,
)
expect(imported.status).toBe(202)
expect(imported.headers.get('cache-control')).toBe('no-store')
const responseBody = await imported.json()
expect(responseBody).toEqual({
repositoryId: '00000000-0000-4000-8000-000000000010',
snapshotId: '00000000-0000-4000-8000-000000000011',
jobId: '00000000-0000-4000-8000-000000000012',
})
expect(JSON.stringify(responseBody)).not.toContain('must-not-leak')
expect(deps.service.importRepository).toHaveBeenCalledWith(
actor,
integrationId,
'42',
)
})
it('rejects unsafe repository import requests before invoking the service', async () => {
const deps = dependencies()
const crossOrigin = await handleImportGiteaRepository(
mutationRequest(
`/api/v1/integrations/gitea/${integrationId}/repositories/import`,
{ externalId: '42' },
{ origin: 'https://attacker.test' },
),
integrationId,
deps,
)
const unsupported = await handleImportGiteaRepository(
mutationRequest(
`/api/v1/integrations/gitea/${integrationId}/repositories/import`,
{ externalId: '42', owner: 'team' },
),
integrationId,
deps,
)
const oversized = await handleImportGiteaRepository(
mutationRequest(
`/api/v1/integrations/gitea/${integrationId}/repositories/import`,
{ externalId: '42' },
{ 'content-length': '20000' },
),
integrationId,
deps,
)
expect(crossOrigin.status).toBe(403)
expect(unsupported.status).toBe(422)
expect(oversized.status).toBe(413)
expect(deps.service.importRepository).not.toHaveBeenCalled()
})
})
apps/web/src/app/api/v1/integrations/gitea/integration-http.ts
+632
View File
@@ -0,0 +1,632 @@
import type {
ActorContext,
ExternalGiteaRepositoryPage,
GiteaProbeResult,
SafeGiteaIntegration,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../../auth/csrf'
import { AuthenticatedWorkspaceContextError } from '../../../../../server/authenticated-workspace-context'
const maximumJsonBytes = 16_384
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
export interface GiteaIntegrationHttpService {
list(actor: ActorContext): Promise<readonly SafeGiteaIntegration[]>
get(actor: ActorContext, integrationId: string): Promise<SafeGiteaIntegration>
create(
actor: ActorContext,
input: {
readonly displayName: string
readonly baseUrl: string
readonly token: string
readonly allowPrivateHttp?: boolean
readonly requestTimeoutMs?: number
},
): Promise<SafeGiteaIntegration>
test(actor: ActorContext, integrationId: string): Promise<GiteaProbeResult>
discover(
actor: ActorContext,
integrationId: string,
query: { readonly cursor: string | null; readonly limit: number },
): Promise<ExternalGiteaRepositoryPage>
importRepository?(
actor: ActorContext,
integrationId: string,
externalId: string,
): Promise<{
readonly repositoryId: string
readonly snapshotId: string
readonly jobId: string
}>
rotate(
actor: ActorContext,
integrationId: string,
token: string,
): Promise<SafeGiteaIntegration>
delete(actor: ActorContext, integrationId: string): Promise<void>
}
export interface GiteaIntegrationRouteDependencies {
readonly publicBaseUrl: string
readonly resolveContext: (request: Request) => Promise<ActorContext>
readonly service: GiteaIntegrationHttpService
}
class GiteaHttpError extends Error {
constructor(
readonly status: number,
readonly code: string,
message: string,
readonly path?: string,
) {
super(message)
}
}
function errorResponse(
status: number,
code: string,
message: string,
requestId: string,
path?: string,
) {
return Response.json(
{
error: {
code,
message,
requestId,
...(path
? {
details: [
{
path,
rule: code,
message,
},
],
}
: {}),
},
},
{ status, headers: { 'Cache-Control': 'no-store' } },
)
}
function invalid(code: string, message: string, path: string): never {
throw new GiteaHttpError(422, code, message, path)
}
function mediaType(request: Request): string {
return (
request.headers
.get('content-type')
?.split(';', 1)[0]!
.trim()
.toLowerCase() ?? ''
)
}
async function readJson(request: Request): Promise<Record<string, unknown>> {
if (mediaType(request) !== 'application/json') {
throw new GiteaHttpError(
415,
'content_type_unsupported',
'This endpoint requires application/json',
'headers.content-type',
)
}
const declared = request.headers.get('content-length')
if (
declared !== null &&
(!/^\d+$/u.test(declared) || Number(declared) > maximumJsonBytes)
) {
throw new GiteaHttpError(
413,
'request_too_large',
`Request body must not exceed ${maximumJsonBytes} bytes`,
'/',
)
}
if (!request.body)
invalid('request_body_required', 'Request body is required', '/')
const reader = request.body!.getReader()
const chunks: Uint8Array[] = []
let length = 0
while (true) {
const { done, value } = await reader.read()
if (done) break
length += value.length
if (length > maximumJsonBytes) {
await reader.cancel()
throw new GiteaHttpError(
413,
'request_too_large',
`Request body must not exceed ${maximumJsonBytes} bytes`,
'/',
)
}
chunks.push(value)
}
const body = new Uint8Array(length)
let offset = 0
for (const chunk of chunks) {
body.set(chunk, offset)
offset += chunk.length
}
let parsed: unknown
try {
parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(body))
} catch {
invalid(
'request_json_invalid',
'Request body must be valid UTF-8 JSON',
'/',
)
}
if (
parsed === null ||
typeof parsed !== 'object' ||
Array.isArray(parsed) ||
Object.getPrototypeOf(parsed) !== Object.prototype
) {
invalid('request_json_invalid', 'Request body must be a JSON object', '/')
}
return parsed as Record<string, unknown>
}
function exactKeys(
value: Record<string, unknown>,
required: readonly string[],
optional: readonly string[] = [],
): void {
const allowed = new Set([...required, ...optional])
for (const key of Object.keys(value)) {
if (!allowed.has(key)) {
invalid(
'request_field_unsupported',
`Unsupported request field: ${key}`,
`/${key}`,
)
}
}
for (const key of required) {
if (!(key in value))
invalid('request_field_required', `${key} is required`, `/${key}`)
}
}
function createInput(value: Record<string, unknown>) {
exactKeys(
value,
['displayName', 'baseUrl', 'token'],
['allowPrivateHttp', 'requestTimeoutMs'],
)
if (typeof value.displayName !== 'string')
invalid(
'request_field_invalid',
'displayName must be a string',
'/displayName',
)
if (typeof value.baseUrl !== 'string')
invalid('request_field_invalid', 'baseUrl must be a string', '/baseUrl')
if (typeof value.token !== 'string')
invalid('request_field_invalid', 'token must be a string', '/token')
if (
value.allowPrivateHttp !== undefined &&
typeof value.allowPrivateHttp !== 'boolean'
) {
invalid(
'request_field_invalid',
'allowPrivateHttp must be a boolean',
'/allowPrivateHttp',
)
}
if (
value.requestTimeoutMs !== undefined &&
typeof value.requestTimeoutMs !== 'number'
) {
invalid(
'request_field_invalid',
'requestTimeoutMs must be a number',
'/requestTimeoutMs',
)
}
return {
displayName: value.displayName,
baseUrl: value.baseUrl,
token: value.token,
...(value.allowPrivateHttp === undefined
? {}
: { allowPrivateHttp: value.allowPrivateHttp }),
...(value.requestTimeoutMs === undefined
? {}
: { requestTimeoutMs: value.requestTimeoutMs }),
}
}
function rotateInput(value: Record<string, unknown>): string {
exactKeys(value, ['token'])
if (typeof value.token !== 'string')
invalid('request_field_invalid', 'token must be a string', '/token')
return value.token
}
function repositoryImportInput(value: Record<string, unknown>): string {
exactKeys(value, ['externalId'])
if (
typeof value.externalId !== 'string' ||
value.externalId.length < 1 ||
value.externalId.length > 255
) {
invalid(
'request_field_invalid',
'externalId must contain 1 to 255 characters',
'/externalId',
)
}
return value.externalId
}
function assertId(value: string): void {
if (!uuidPattern.test(value)) {
throw new GiteaHttpError(
404,
'gitea_integration_not_found',
'Gitea integration not found',
)
}
}
function safeIntegration(value: SafeGiteaIntegration) {
return {
id: value.id,
type: 'gitea' as const,
displayName: value.displayName,
baseUrl: value.baseUrl,
status: value.status,
capabilities: value.capabilities,
serverVersion: value.serverVersion,
remoteIdentity: value.remoteIdentity,
healthCode: value.healthCode,
lastCheckedAt: value.lastCheckedAt,
secretLastFour: value.secretLastFour,
}
}
function applicationError(
value: unknown,
): { code: string; message: string } | null {
if (value === null || typeof value !== 'object') return null
const item = value as Record<string, unknown>
return typeof item.code === 'string' && typeof item.message === 'string'
? { code: item.code, message: item.message }
: null
}
function mappedError(caught: unknown, requestId: string): Response {
if (caught instanceof GiteaHttpError) {
return errorResponse(
caught.status,
caught.code,
caught.message,
requestId,
caught.path,
)
}
if (caught instanceof AuthenticatedWorkspaceContextError) {
return errorResponse(
caught.code === 'authentication_required' ? 401 : 403,
caught.code,
caught.code === 'authentication_required'
? 'Authentication required'
: 'Access denied',
requestId,
)
}
const application = applicationError(caught)
if (application?.code === 'authentication_required')
return errorResponse(
401,
application.code,
'Authentication required',
requestId,
)
if (application?.code === 'workspace_access_denied')
return errorResponse(403, application.code, 'Access denied', requestId)
if (application?.code === 'gitea_integration_not_found')
return errorResponse(
404,
application.code,
'Gitea integration not found',
requestId,
)
if (application?.code === 'gitea_repository_not_found')
return errorResponse(
404,
application.code,
'Gitea repository not found',
requestId,
)
if (application?.code === 'gitea_integration_disabled')
return errorResponse(
409,
application.code,
'The Gitea integration is disabled',
requestId,
)
if (application?.code === 'gitea_integration_invalid')
return errorResponse(422, application.code, application.message, requestId)
if (application?.code === 'gitea_connection_failed')
return errorResponse(
422,
application.code,
'The Gitea connection could not be verified',
requestId,
)
return errorResponse(
503,
'gitea_service_unavailable',
'Gitea integration service is temporarily unavailable',
requestId,
)
}
async function actor(
request: Request,
dependencies: GiteaIntegrationRouteDependencies,
): Promise<ActorContext> {
return dependencies.resolveContext(request)
}
function mutation(
request: Request,
dependencies: GiteaIntegrationRouteDependencies,
requestId: string,
operation: (request: Request) => Promise<Response>,
) {
return handleAuthRequest(
request,
async (sameOriginRequest) => {
if (
sameOriginRequest.headers.get('origin') !==
new URL(dependencies.publicBaseUrl).origin
) {
return errorResponse(
403,
'invalid_origin',
'Invalid request origin',
requestId,
)
}
return operation(sameOriginRequest)
},
dependencies.publicBaseUrl,
() =>
errorResponse(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export async function handleListGiteaIntegrations(
request: Request,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
try {
const result = await dependencies.service.list(
await actor(request, dependencies),
)
return Response.json(result.map(safeIntegration), {
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
}
export function handleCreateGiteaIntegration(
request: Request,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutation(request, dependencies, requestId, async (safeRequest) => {
try {
const result = await dependencies.service.create(
await actor(safeRequest, dependencies),
createInput(await readJson(safeRequest)),
)
return Response.json(safeIntegration(result), {
status: 201,
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
})
}
export async function handleGetGiteaIntegration(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
try {
assertId(integrationId)
return Response.json(
safeIntegration(
await dependencies.service.get(
await actor(request, dependencies),
integrationId,
),
),
{ headers: { 'Cache-Control': 'no-store' } },
)
} catch (caught) {
return mappedError(caught, requestId)
}
}
export function handleTestGiteaIntegration(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutation(request, dependencies, requestId, async (safeRequest) => {
try {
assertId(integrationId)
const result = await dependencies.service.test(
await actor(safeRequest, dependencies),
integrationId,
)
return Response.json({
status: result.status,
serverVersion: result.serverVersion,
capabilities: result.capabilities,
healthCode: result.healthCode,
warnings: result.warnings,
})
} catch (caught) {
return mappedError(caught, requestId)
}
})
}
export async function handleDiscoverGiteaRepositories(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
try {
assertId(integrationId)
const parameters = new URL(request.url).searchParams
for (const key of parameters.keys()) {
if (key !== 'cursor' && key !== 'limit')
invalid(
'gitea_query_invalid',
`Unsupported query parameter: ${key}`,
`query.${key}`,
)
}
if (
parameters.getAll('cursor').length > 1 ||
parameters.getAll('limit').length > 1
)
invalid(
'gitea_query_invalid',
'Query parameters may be supplied once',
'query',
)
const cursor = parameters.get('cursor')
if (cursor !== null && (cursor.length === 0 || cursor.length > 500))
invalid(
'gitea_query_invalid',
'cursor must contain 1 to 500 characters',
'query.cursor',
)
const rawLimit = parameters.get('limit') ?? '50'
if (
!/^\d+$/u.test(rawLimit) ||
Number(rawLimit) < 1 ||
Number(rawLimit) > 100
)
invalid(
'gitea_query_invalid',
'limit must be an integer from 1 through 100',
'query.limit',
)
const result = await dependencies.service.discover(
await actor(request, dependencies),
integrationId,
{ cursor, limit: Number(rawLimit) },
)
return Response.json(result, { headers: { 'Cache-Control': 'no-store' } })
} catch (caught) {
return mappedError(caught, requestId)
}
}
export function handleRotateGiteaSecret(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutation(request, dependencies, requestId, async (safeRequest) => {
try {
assertId(integrationId)
const result = await dependencies.service.rotate(
await actor(safeRequest, dependencies),
integrationId,
rotateInput(await readJson(safeRequest)),
)
return Response.json(safeIntegration(result), {
headers: { 'Cache-Control': 'no-store' },
})
} catch (caught) {
return mappedError(caught, requestId)
}
})
}
export function handleDeleteGiteaIntegration(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutation(request, dependencies, requestId, async (safeRequest) => {
try {
assertId(integrationId)
await dependencies.service.delete(
await actor(safeRequest, dependencies),
integrationId,
)
return new Response(null, { status: 204 })
} catch (caught) {
return mappedError(caught, requestId)
}
})
}
export function handleImportGiteaRepository(
request: Request,
integrationId: string,
dependencies: GiteaIntegrationRouteDependencies,
) {
const requestId = crypto.randomUUID()
return mutation(request, dependencies, requestId, async (safeRequest) => {
try {
assertId(integrationId)
if (!dependencies.service.importRepository) {
throw new GiteaHttpError(
503,
'gitea_service_unavailable',
'Gitea repository import is temporarily unavailable',
)
}
const result = await dependencies.service.importRepository(
await actor(safeRequest, dependencies),
integrationId,
repositoryImportInput(await readJson(safeRequest)),
)
return Response.json(
{
repositoryId: result.repositoryId,
snapshotId: result.snapshotId,
jobId: result.jobId,
},
{
status: 202,
headers: { 'Cache-Control': 'no-store' },
},
)
} catch (caught) {
return mappedError(caught, requestId)
}
})
}
apps/web/src/app/api/v1/integrations/gitea/integration-route-dependencies.ts
+14
View File
@@ -0,0 +1,14 @@
import { resolveAuthenticatedWorkspaceContext } from '../../../../../server/authenticated-workspace-context'
import { getGiteaIntegrationServer } from '../../../../../server/gitea-integrations'
import type { GiteaIntegrationRouteDependencies } from './integration-http'
export function giteaIntegrationRouteDependencies(): GiteaIntegrationRouteDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveContext: resolveAuthenticatedWorkspaceContext,
service: getGiteaIntegrationServer(),
}
}
apps/web/src/app/api/v1/integrations/gitea/route.ts
+21
View File
@@ -0,0 +1,21 @@
import {
handleCreateGiteaIntegration,
handleListGiteaIntegrations,
} from './integration-http'
import { giteaIntegrationRouteDependencies } from './integration-route-dependencies'
export const dynamic = 'force-dynamic'
export function GET(request: Request) {
return handleListGiteaIntegrations(
request,
giteaIntegrationRouteDependencies(),
)
}
export function POST(request: Request) {
return handleCreateGiteaIntegration(
request,
giteaIntegrationRouteDependencies(),
)
}
apps/web/src/app/api/v1/invitations/invitation-http.test.ts
+108
View File
@@ -0,0 +1,108 @@
import { describe, expect, it, vi } from 'vitest'
import type { ActorContext } from '@devrunbook/application'
import {
handleAcceptInvitation,
handleCreateInvitation,
type InvitationHttpDependencies,
} from './invitation-http'
const origin = 'https://runbook.example.test'
const actor: ActorContext = {
userId: '00000000-0000-4000-8000-000000000001',
workspaceId: '00000000-0000-4000-8000-000000000002',
workspaceRole: 'owner',
instanceRole: 'instance_owner',
}
function dependencies(
overrides: Partial<InvitationHttpDependencies> = {},
): InvitationHttpDependencies {
return {
publicBaseUrl: origin,
resolveActor: vi.fn().mockResolvedValue(actor),
create: vi.fn().mockResolvedValue({
id: '00000000-0000-4000-8000-000000000003',
email: 'new@example.test',
expiresAt: new Date('2026-07-28T12:00:00.000Z'),
inviteUrl: `${origin}/accept-invitation#token=secret`,
}),
consume: vi.fn().mockResolvedValue(true),
...overrides,
}
}
function post(path: string, body: unknown, requestOrigin = origin) {
return new Request(`${origin}${path}`, {
method: 'POST',
headers: { 'content-type': 'application/json', origin: requestOrigin },
body: JSON.stringify(body),
})
}
describe('invitation HTTP boundary', () => {
it('creates an invitation for an instance administrator', async () => {
const deps = dependencies()
const response = await handleCreateInvitation(
post('/api/v1/invitations', {
email: 'new@example.test',
instanceRole: 'user',
}),
deps,
)
expect(response.status).toBe(201)
expect(await response.json()).toMatchObject({ email: 'new@example.test' })
})
it('rejects cross-origin requests and non-administrators', async () => {
const deps = dependencies()
const crossOrigin = await handleCreateInvitation(
post('/api/v1/invitations', {}, 'https://attacker.test'),
deps,
)
expect(crossOrigin.status).toBe(403)
expect(deps.resolveActor).not.toHaveBeenCalled()
const denied = await handleCreateInvitation(
post('/api/v1/invitations', {
email: 'new@example.test',
instanceRole: 'user',
}),
dependencies({
resolveActor: vi
.fn()
.mockResolvedValue({ ...actor, instanceRole: 'user' }),
}),
)
expect(denied.status).toBe(403)
})
it('accepts an exact single-use token shape and keeps failures generic', async () => {
const deps = dependencies()
const response = await handleAcceptInvitation(
post('/api/v1/auth/invitations/accept', {
token: 'a'.repeat(43),
displayName: 'New User',
password: 'correct horse battery staple',
passwordConfirmation: 'correct horse battery staple',
}),
deps,
)
expect(response.status).toBe(200)
expect(deps.consume).toHaveBeenCalledWith(
expect.objectContaining({ rawToken: 'a'.repeat(43) }),
)
const failed = await handleAcceptInvitation(
post('/api/v1/auth/invitations/accept', {
token: 'short',
displayName: 'X',
password: 'short',
passwordConfirmation: 'short',
}),
deps,
)
expect(failed.status).toBe(400)
expect(JSON.stringify(await failed.json())).not.toContain('short')
})
})
apps/web/src/app/api/v1/invitations/invitation-http.ts
+231
View File
@@ -0,0 +1,231 @@
import type {
ActorContext,
InvitationInstanceRole,
InvitationWorkspaceRole,
} from '@devrunbook/application'
import { handleAuthRequest } from '../../../../auth/csrf'
const maximumBodyBytes = 8_192
const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u
const uuidPattern =
/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu
const tokenPattern = /^[A-Za-z0-9_-]{32,512}$/u
export interface InvitationHttpDependencies {
readonly publicBaseUrl: string
readonly resolveActor: (request: Request) => Promise<ActorContext>
readonly create: (input: {
readonly actor: ActorContext
readonly email: string
readonly instanceRole: InvitationInstanceRole
readonly workspaceId: string | null
readonly workspaceRole: InvitationWorkspaceRole | null
}) => Promise<{
readonly id: string
readonly email: string
readonly expiresAt: Date
readonly inviteUrl: string
}>
readonly consume: (input: {
readonly rawToken: string
readonly displayName: string
readonly password: string
}) => Promise<boolean>
}
function error(
status: number,
code: string,
message: string,
requestId: string,
) {
return Response.json({ error: { code, message, requestId } }, { status })
}
async function readJson(
request: Request,
): Promise<Record<string, unknown> | null> {
if (
request.headers.get('content-type')?.split(';', 1)[0]?.trim() !==
'application/json'
)
return null
const declared = request.headers.get('content-length')
if (declared !== null && Number(declared) > maximumBodyBytes) return null
if (!request.body) return null
const reader = request.body.getReader()
const decoder = new TextDecoder()
let bytes = 0
let text = ''
try {
while (true) {
const chunk = await reader.read()
if (chunk.done) break
bytes += chunk.value.byteLength
if (bytes > maximumBodyBytes) {
await reader.cancel()
return null
}
text += decoder.decode(chunk.value, { stream: true })
}
text += decoder.decode()
} finally {
reader.releaseLock()
}
try {
const parsed: unknown = JSON.parse(text)
return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
? (parsed as Record<string, unknown>)
: null
} catch {
return null
}
}
function parseCreate(body: Record<string, unknown> | null) {
if (!body) return null
const allowed = new Set([
'email',
'instanceRole',
'workspaceId',
'workspaceRole',
])
if (Object.keys(body).some((key) => !allowed.has(key))) return null
if (
typeof body.email !== 'string' ||
body.email.length > 320 ||
!emailPattern.test(body.email) ||
(body.instanceRole !== 'instance_admin' && body.instanceRole !== 'user')
)
return null
const workspaceId = body.workspaceId ?? null
const workspaceRole = body.workspaceRole ?? null
if (
(workspaceId !== null &&
(typeof workspaceId !== 'string' || !uuidPattern.test(workspaceId))) ||
(workspaceRole !== null &&
!['owner', 'editor', 'viewer'].includes(String(workspaceRole))) ||
(workspaceId === null) !== (workspaceRole === null)
)
return null
return {
email: body.email,
instanceRole: body.instanceRole as InvitationInstanceRole,
workspaceId: workspaceId as string | null,
workspaceRole: workspaceRole as InvitationWorkspaceRole | null,
}
}
function parseAccept(body: Record<string, unknown> | null) {
if (
!body ||
Object.keys(body).sort().join(',') !==
'displayName,password,passwordConfirmation,token'
)
return null
if (
typeof body.token !== 'string' ||
!tokenPattern.test(body.token) ||
typeof body.displayName !== 'string' ||
body.displayName.trim().length < 1 ||
body.displayName.length > 120 ||
typeof body.password !== 'string' ||
body.password.length < 12 ||
body.password.length > 128 ||
body.passwordConfirmation !== body.password
)
return null
return {
rawToken: body.token,
displayName: body.displayName.trim(),
password: body.password,
}
}
export function handleCreateInvitation(
request: Request,
dependencies: InvitationHttpDependencies,
) {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
try {
const actor = await dependencies.resolveActor(sameOriginRequest)
if (
!['instance_owner', 'instance_admin'].includes(actor.instanceRole)
) {
return error(
403,
'instance_administration_denied',
'Instance administration is not permitted',
requestId,
)
}
const parsed = parseCreate(await readJson(sameOriginRequest))
if (!parsed)
return error(
422,
'validation_failed',
'Invitation input is invalid',
requestId,
)
const invitation = await dependencies.create({ actor, ...parsed })
return Response.json(
{ ...invitation, expiresAt: invitation.expiresAt.toISOString() },
{ status: 201 },
)
} catch {
return error(
409,
'invitation_unavailable',
'Invitation could not be created',
requestId,
)
}
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
export function handleAcceptInvitation(
request: Request,
dependencies: InvitationHttpDependencies,
) {
const requestId = crypto.randomUUID()
return handleAuthRequest(
request,
async (sameOriginRequest) => {
const parsed = parseAccept(await readJson(sameOriginRequest))
if (!parsed)
return error(
400,
'invitation_failed',
'The invitation is invalid or expired',
requestId,
)
try {
if (!(await dependencies.consume(parsed))) {
return error(
400,
'invitation_failed',
'The invitation is invalid or expired',
requestId,
)
}
return Response.json({ success: true })
} catch {
return error(
400,
'invitation_failed',
'The invitation is invalid or expired',
requestId,
)
}
},
dependencies.publicBaseUrl,
() => error(403, 'invalid_origin', 'Invalid request origin', requestId),
)
}
apps/web/src/app/api/v1/invitations/route.ts
+26
View File
@@ -0,0 +1,26 @@
import {
createInvitation,
consumeInvitation,
resolveInvitationActor,
} from '../../../../server/invitations'
import {
handleCreateInvitation,
type InvitationHttpDependencies,
} from './invitation-http'
export const dynamic = 'force-dynamic'
function dependencies(): InvitationHttpDependencies {
const publicBaseUrl = process.env.PUBLIC_BASE_URL
if (!publicBaseUrl) throw new Error('PUBLIC_BASE_URL is required')
return {
publicBaseUrl,
resolveActor: resolveInvitationActor,
create: createInvitation,
consume: consumeInvitation,
}
}
export function POST(request: Request) {
return handleCreateInvitation(request, dependencies())
}

Some files were not shown because too many files have changed in this diff Show More