Repository navigation

stage 1.1: config, logging, database, and the HTTP skeleton - #2

Merged

deckyfx merged 32 commits into

mainfrom

stage-1

Aug 24, 2026

Commits on Aug 22, 2026
- feat(stage-1): foundation — config, logging, database, HTTP skeleton
  
  Hendro8899
  and
  claude
  committed
  395c77b
- feat(stage-1): embedded migrations and a verifying migration manager
  
  Hendro8899
  and
  claude
  committed
  9942ff2
- fix(stage-1): CLI review — two leaks, a silent default, and a false success
  
  Hendro8899
  and
  claude
  committed
  5080bf9
- refactor(stage-1): SQLite for development, Postgres deferred
  
  Hendro8899
  and
  claude
  committed
  fc29b8a
- fix(stage-1): CLI review — generalise redaction, guard the migrate entry point
  
  Hendro8899
  and
  claude
  committed
  425d491
Commits on Aug 23, 2026
- fix(stage-1): two review passes — correlation id was two different ids
  
  Hendro8899
  and
  claude
  committed
  9b81f93
- fix(stage-1): protect the log line as a surface, not one field at a time
  
  Hendro8899
  and
  claude
  committed
  825ca3b
- feat(stage-1): §1.3 tenancy — stores, API keys, and the tenant boundary
  
  Hendro8899
  and
  claude
  committed
  fad9000
- feat(stage-1): §1.4 events and durable delivery
  
  Hendro8899
  and
  claude
  committed
  14683da
- feat(stage-1): devices, consent, and the claim flow
  
  Hendro8899
  and
  claude
  committed
  96f0363
- feat(stage-1): §1.2 engine contract, conformance suite, fake engine, registry
  
  Hendro8899
  and
  claude
  committed
  a9fe6c0
- feat(stage-1): gowa adapter — polled reconciler, verified against live gowa
  
  Hendro8899
  and
  claude
  committed
  335764f
- fix(stage-1): sixteen review findings, and finish §1.3
  
  Hendro8899
  and
  claude
  committed
  45e6e45
- fix(stage-1): CLI review — 28 findings, three of them real holes
  
  Hendro8899
  and
  claude
  committed
  ef8b44f
- fix(stage-1): the transactions were not transactional, and three more
  
  Hendro8899
  and
  claude
  committed
  228c66c
- feat(stage-1): §1.5 messaging — sending, idempotency, and the engine bridge
  
  Hendro8899
  and
  claude
  committed
  1d3da38
- fix(stage-1): fifteen findings — two critical, both in code I wrote confidently
  
  Hendro8899
  and
  claude
  committed
  4cd58fa
- fix(stage-1): the duplicate-OTP bug reappeared one line further down
  
  Hendro8899
  and
  claude
  committed
  5bad426
- feat(stage-1): §1.6 rule engine — matching, safety, and loop protection
  
  Hendro8899
  and
  claude
  committed
  e9d68cb
- feat(stage-1): finish §1.6 — rule storage, HTTP surface, and the dry run
  
  Hendro8899
  and
  claude
  committed
  eb5154f
- fix(stage-1): twenty-five CLI findings — a QR leak among them
  
  Hendro8899
  and
  claude
  committed
  e7093f0
- fix(stage-1): the bot batch I had missed — an empty match list matched everything
  
  Hendro8899
  and
  claude
  committed
  5f5d424
- test(stage-1): execute the exit criteria, and fix what they caught
  
  Hendro8899
  and
  claude
  committed
  829f257
- test: align the older claim test with the documented 202
  
  Hendro8899
  and
  claude
  committed
  de627ec
- fix(stage-1): ten findings — reading rules needed no scope at all
  
  Hendro8899
  and
  claude
  committed
  6a67f3f
- fix(stage-1): audit every mutation for tenant scope, not one file at a time
  
  Hendro8899
  and
  claude
  committed
  ecca1c2
- fix(stage-1): the sweep missed reads, and a read was the critical one
  
  Hendro8899
  and
  claude
  committed
  0118662
- fix(stage-1): a safety check that refuses ordinary patterns gets switched off
  
  Hendro8899
  and
  claude
  committed
  981d636
- fix(stage-1): nesting was a one-character way past the pattern check
  
  Hendro8899
  and
  claude
  committed
  d477452
- docs: the design still described a Redis dependency we do not have
  
  Hendro8899
  and
  claude
  committed
  eea3f96
- fix(stage-1): two scanners handled escapes, two did not
  
  Hendro8899
  and
  claude
  committed
  4be1aa1
Commits on Aug 24, 2026
- docs: record the two deferred security gaps in todo.txt
  
  Hendro8899
  and
  claude
  committed
  2291b7e

Navigation Menu

Repository navigation

stage 1.1: config, logging, database, and the HTTP skeleton - #2

stage 1.1: config, logging, database, and the HTTP skeleton#2
deckyfx merged 32 commits into
mainfrom
stage-1

Commits on Aug 22, 2026

feat(stage-1): foundation — config, logging, database, HTTP skeleton

feat(stage-1): embedded migrations and a verifying migration manager

fix(stage-1): CLI review — two leaks, a silent default, and a false success

refactor(stage-1): SQLite for development, Postgres deferred

fix(stage-1): CLI review — generalise redaction, guard the migrate entry point

Commits on Aug 23, 2026

fix(stage-1): two review passes — correlation id was two different ids

fix(stage-1): protect the log line as a surface, not one field at a time

feat(stage-1): §1.3 tenancy — stores, API keys, and the tenant boundary

feat(stage-1): §1.4 events and durable delivery

feat(stage-1): devices, consent, and the claim flow

feat(stage-1): §1.2 engine contract, conformance suite, fake engine, registry

feat(stage-1): gowa adapter — polled reconciler, verified against live gowa

fix(stage-1): sixteen review findings, and finish §1.3

fix(stage-1): CLI review — 28 findings, three of them real holes

fix(stage-1): the transactions were not transactional, and three more

feat(stage-1): §1.5 messaging — sending, idempotency, and the engine bridge

fix(stage-1): fifteen findings — two critical, both in code I wrote confidently

fix(stage-1): the duplicate-OTP bug reappeared one line further down

feat(stage-1): §1.6 rule engine — matching, safety, and loop protection

feat(stage-1): finish §1.6 — rule storage, HTTP surface, and the dry run

fix(stage-1): twenty-five CLI findings — a QR leak among them

fix(stage-1): the bot batch I had missed — an empty match list matched everything

test(stage-1): execute the exit criteria, and fix what they caught

test: align the older claim test with the documented 202

fix(stage-1): ten findings — reading rules needed no scope at all

fix(stage-1): audit every mutation for tenant scope, not one file at a time

fix(stage-1): the sweep missed reads, and a read was the critical one

fix(stage-1): a safety check that refuses ordinary patterns gets switched off

fix(stage-1): nesting was a one-character way past the pattern check

docs: the design still described a Redis dependency we do not have

fix(stage-1): two scanners handled escapes, two did not

Commits on Aug 24, 2026

docs: record the two deferred security gaps in todo.txt