[tang-vu]

Ready for independent review (2026-09-15). Candidate 172e764e93d932cafb2172560a8a767b71c02d73 has a successful GitHub check rollup and no base-branch conflict at this review snapshot. This supersedes earlier draft-status wording only. All validation gaps, migration requirements, live gates and independent human review requirements below remain in force; this is not a merge-ready approval.

Add an optional HedgeDoc 1.12.0 workspace with managed local accounts, private Markdown notes by default and persistent PostgreSQL 17 storage. Both exact upstream images are pinned by multi-architecture digest.

Why this matters

ODS users can write and share working notes on their own host. The lifecycle is installation .env secrets ? catalog installation ? private PostgreSQL initialization ? upstream interactive account creation ? authenticated note creation and deliberate permission changes for collaboration. Public registration and anonymous edits are disabled. Uploads are disabled because upstream static uploads are not protected by private-note permissions; remote avatar lookup is disabled. Arbitrary Markdown can still reference external resources.

The published port defaults to loopback 7824. The default browser authority follows a custom port; an explicit public authority and HTTPS URL setting support a separately configured TLS/WebSocket proxy. Database credentials use individual fields, avoiding URL delimiter corruption. The README documents account creation, first-login steps, protected remote access, stable secrets, cold backups and matching image/database rollback.

Overlap check

Searched open and closed upstream PRs for HedgeDoc and collaborative markdown, the production-file index for extensions/library/services/hedgedoc, and tracked configuration/manifests for port 7824. No existing recipe covers this application. Memos #4887 provides personal notes and a workflow API; HedgeDoc's distinct scope is collaborative Markdown with per-note permissions. Shared generated catalog and library README additions must be combined by regeneration.

Validation

• 2 tests passed in 230 seconds using the exact installed Compose recipe and images on Linux amd64. Missing required secrets fail configuration; a database password containing URL delimiters works; default/custom browser ports resolve correctly; the database has no published port.
• Real upstream account CLI creates two accounts. HTTP checks prove public registration is unavailable, anonymous note creation/read redirects to login, the owner can create/download exact Unicode Markdown, another authenticated account receives 403 for that private note, and uploads are disabled. Recreating both application and PostgreSQL preserves both accounts and the note.
• Earlier fixture expectations assumed 403 for anonymous access and a root redirect after login. The actual upstream behavior is a login redirect with remembered /new destination. Assertions were corrected to the exact behavior, then the complete test passed. No application authorization was loosened to pass tests.
• Catalog generation/discovery, all 36 library manifests, scoped pre-commit and git diff --check pass. A path-filtered workflow repeats the Docker boundary test. make gate retains the baseline root/WSL no-sudo fixture failure; the complete local gate is not claimed green. Fixture containers and network were removed.
• The first GitHub run passed every HTTP/account/recreation assertion, then failed when the non-root runner tried to read PostgreSQL's protected data directory directly. The fixture now checks the database version as the PostgreSQL container user, preserving its directory permissions. The replacement run is being monitored.

Awaiting independent review. The HTTP/account/storage boundary is verified; simultaneous browser/WebSocket editing, reverse-proxy TLS and native ARM/macOS/Windows activation remain unverified. No user database or existing service was modified. Rollback of an upgrade requires the matching image pins and a complete cold data backup. Upstream configuration and release: https://docs.hedgedoc.org/configuration/ and https://github.com/hedgedoc/hedgedoc/releases/tag/1.12.0.

Canonical catalog regeneration also restores metadata for the already tracked, disabled-by-default pixel-inference manifest. This does not add or enable that service; the integration catalog retains one entry.

Final candidate 172e764e93d932cafb2172560a8a767b71c02d73: 33 successful CI checks, 4 conditionally skipped; no pending or failed checks.

Batch integration receipt

This is one of 30 independently branched public-beta PRs. The published synthetic integration head is 61f4c6fccc81bea697f4941683fefb5089ba77f4, built from baseline d49ad4bbc760be319de7f4c9b9a93b1f18fe3922 in this reproducible order:

#4946 → #4948 → #4951 → #4954 → #4972 → #4960 → #4961 → #4957 → #4964 → #4967 → #4968 → #4971 → #4975 → #4976 → #4984 → #4982 → #4990 → #4988 → #4989 → #4997 → #5003 → #5006 → #5007 → #5009 → #5012 → #5011 → #5013 → #5014 → #5020 → #5021

Reconciliation preserved all 146 files owned by a single PR byte-for-byte against their exact candidate heads. The eight shared paths preserve both CLI STT/TTS commands and help, every added Makefile test, both environment schema additions and all Extensions UI behavior. LanguageTool and Kroki both remain headless API entries. Canonical regeneration yields 76 catalog entries and 47 library manifests; all README rows are retained. Shared-file changes need these additive resolutions when merged independently.

Combined validation: 2,852 API tests passed / 1 skipped; 1,082 UI tests passed; 47 manifests passed; all 12 added Makefile commands passed; 12 catalog boundary tests passed / 12 opt-in runtime tests skipped in this combined run. Individual exact-image results remain documented above. UI lint/build, scoped secret hooks, diff checks, four platform smoke tests and installer simulation passed. Compose plans for NVIDIA/AMD/Apple each contain 20 services and no duplicate published bindings across the core plus 12 new recipes; this is static plan evidence, not simultaneous startup or GPU inference.

The first unrestricted UI run timed out in two tests under concurrent load; the complete rerun used --maxWorkers=2 with unchanged assertions and timeouts and passed. ESLint reports zero errors and 603 warnings, including the existing JSX usage-detection pattern. Full local make gate still fails the no-sudo Docker baseline covered by #3158. BATS records 416 passed / 5 failed on this root/WSL host (platform detection, root preflight and a 15 GiB versus 20 GiB free-space expectation). Neither full local gate nor BATS is described as green.

This integration receipt supplements each PR's own regression and does not waive its independent review, live hardware/browser/upgrade gates or rollback requirements. The PRs remain drafts; none was merged upstream.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.