v0.2.0: audit remediation (senses as meanings, public API, caching, governance, CI gates) - #226
Draft
amanthanvi wants to merge 6 commits into
Draft
amanthanvi wants to merge 6 commits into
amanthanvi wants to merge 6 commits into
Conversation
- Migration 20260910120000_audit_wave1: restore the trigram index, add composite and uniqueness indexes, sense_definitions, sense slugs, source license fields, tag kind/parent/assigned_by, trigger-maintained sense_search, markdown-free entry search document; drop entry_views. - Search runs in one round trip with expansion and alias buckets, totals, spelling suggestions, and meaning-level search. - Auto-tagging is additive with a hit threshold and one definition list. - Role sync revokes allowlist removals; disabled users stay disabled. - Shared apply path for ingest proposals and shared text/JSON helpers. - Seed carries user-facing license statements and a two-sense SOC entry. - Migration drift check with an allowlist for raw-SQL objects.
… registry - Definitions attach to existing senses by similarity; ambiguous cases open a sense flagged needs_label and block auto-publish. - NIST emits one sense per definition with real locators; RFC and MITRE runs resume instead of bailing on an unchanged document. - Content mode comes from source policy; the license gate consults it. - Adapters share an interface, persistence, robots and rate-limit handling, a cheerio-based HTML layer, and package-derived versions. - Relationships from RFC See lines, NICCS related terms, ATT&CK tactics. - Editorial layer synced from content/**/*.yaml; hourly rate-limit bucket cleanup; auto-publish fails closed when unset.
- Public read API v1 with OpenAPI, ETags, CORS, dataset export, citation records, health check, and a revalidation hook. - Data cached with tags and invalidated on publish; no anonymous cookie. - Entry pages: concordance across sources, provenance disclosure, JSON-LD, sense deep links, accessible citation popovers, mobile sense index, contrast fixes, one EntryListItem and TypeBadge. - Admin: zod validation, one role check, attestation editing, needs-label queue, tag assignment provenance, source license fields. - Rate limiter keys on IP behind trusted proxies and covers the search page; CSP gains form-action and reporting; salts required in prod.
- SHA-pinned workflows; format, strict lint, prisma validate, migration drift, coverage thresholds, Playwright with axe, Lighthouse budgets, CodeQL security-extended, cdxgen SBOM, version consistency. - noUncheckedIndexedAccess and type-aware lint rules on. - docker-compose with all local databases, Dockerfiles, Railway health check, issue templates for term proposals and sense disambiguation.
- Versions bumped to 0.2.0; changelog dated; v0.1.5 marked superseded. - Local dev, releasing, backups, runbooks, taxonomy, editorial layer, API, and licensing docs rewritten; prose follows the unslop rules.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Too many files changed for review (370 files, 200 file limit). Bypass the limit by tagging |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
A global gitignore rule named `tags` excluded these files from the earlier commit; force-added so the build has the routes it imports.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the full 54-item audit roadmap (20 minimal, 19 moderate, 10 major, 5 radical) and ships it as v0.2.0.
sense_definitions), a stable slug for#s-<slug>deep links, and a concordance view when sources differ. Ingest matches new definitions to existing senses by trigram similarity and holds ambiguous cases for review instead of publishing them./api/v1/search?scope=senses).assigned_byon every link, additive auto-tagging with a hit threshold, tag kinds and hierarchy, one definition list.content/entries/**/*.yamlsynced by the worker.form-actionand reporting.noUncheckedIndexedAccesson.Verification
Deploy notes
SYNAC_RATE_LIMIT_SALT,SYNAC_REVALIDATE_SECRET, andSYNAC_AUTOPUBLISH_TIER1before deploying. Auto-publish is off when unset.SYNAC_SESSION_HASH_SALTis no longer read..env.examplestill lists it; the file is protected in the author's tooling and needs a manual edit.pnpm --filter @synac/db db:migrate:deploybefore starting the new build; the migration backfills sense slugs and attestations from existing provenance.v0.2.0on the merge commit.v0.1.5was tagged retroactively on 462dd52.