v0.2.0: senses as meanings, provenance, public API, and quality gates on the Convex stack - #227
Merged
Merged
Conversation
- Compile groups near-duplicate definitions across sources into one sense (Dice similarity: attach at 0.8, flag 0.5 to 0.8 as needsLabel) and keeps the other sources' wording as attestations; overrides gain labelSenses, disambiguationNotes, groupSenses, splitSenses. - Sources declare contentMode and a public license statement; citations carry them plus the document hash, citation text, and locator. - Tag assignment provenance (editorial or model, with score) reaches Convex. - Search: typed prefix scan, full text from two characters, tag-filtered candidates, expansion and alias bucket, totals, clean snippets, and a meaning-level index with search.senses. - View tracking removed; service key compared by digest; rate-limit keys validated; entry batches sized under the exec-argument limit. - Summary omitted when it duplicates the first sense; sense summaries for all entry types; label fallback to the citing source.
…awling - NIST emits a sense per term-def-text-N with the per-definition source as its label and locator; aliases keep only expansions and initialisms and other cross-references become SEE_ALSO. - RFC 4949: See and Compare lines become SEE_ALSO and CONTRAST; the glossary stops at the end of section 4 (zone-of-control had swallowed sections 5-7). - Shared classifier; robots.txt and per-host pacing; conditional requests with etag and lastModified recorded on bundle documents; fetch seam for tests instead of module mocking.
… API - Sense TOC anchors fixed (they were double-prefixed and dead), rail from two senses, chip row under 1280px, per-sense copy link, cite, and report. - Attestations with word-level comparison; content mode, citation text, locator, and license statement on every source; CONTRAST relations. - Accessible relation previews and palette (inert background, live region, Tab restored); contrast, focus ring, and target-size fixes; metadata, canonicals, and DefinedTerm JSON-LD; tag 404s; search totals and meaning-level scope; page rate limiting. - Cached Convex reads with a revalidate endpoint, health check, no anonymous cookie, IP-first rate limiting with a required production salt, CSP form-action and reporting, public read API with OpenAPI, ETags, CORS, citation records, and a paged dataset export. - One BrowsePage for terms and acronyms; dead primitives, legacy aliases, loading skeletons, and duplicate helpers removed.
…ouse - ci.yml runs format, strict lint, convex lint and typecheck, and the tagging check; quality.yml runs Playwright with axe and Lighthouse budgets against an anonymous Convex deployment; CodeQL security-extended; cdxgen SBOM; SHA-pinned actions; grouped Dependabot. - ingest.yml passes its input through env and splits write permissions to the PR job; Deploy calls the revalidate endpoint after sync. - noUncheckedIndexedAccess and type-aware lint on; pnpm overrides moved to pnpm-workspace.yaml (pnpm 10 ignored the package.json field). - .github/CODEOWNERS reflects the current boundary; issue templates capture sense, wording origin, and license; version check script.
- Runbooks, governance, triage, contributing, releasing, backups, and the architecture overview describe the Convex and GitOps system; SPEC infra sections marked superseded; PRODUCT.md corrected. - New docs for sense grouping and editorial labels, the public API, and content modes in the licensing policy; versions bumped to 0.2.0.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CI's test step and Vercel's web-only build could not find the package because its entry pointed at an unbuilt dist directory.
…ects it The project builds from apps/web; a root vercel.json doubled the output path to apps/web/apps/web/.next and failed after a successful build.
…vice key The backend serves /version before the first push commits, so env set hit an optimistic-concurrency 503.
The first deploy after this branch merges validates every existing production document against the new schema. Fields added since the last generation (content mode, document hash, tag provenance, sense attestations, match terms) are now optional so that validation passes; the sync always writes them and the public queries fall back to defaults until the next generation replaces the rows. Also ignore the local .vercel link directory in the format check.
CodeQL flagged the two-step escaper as incomplete sanitization because the second replace does not handle backslashes on its own. A single character class that includes the backslash produces the same output and is recognizably complete.
Owner
Author
|
@greptileai review |
Owner
Author
|
@CodeRabbit review |
|
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…bots, and OWASP mode - compile: a reviewed groupSenses primary stays a leader instead of being attached to an earlier near-duplicate, which orphaned its members. - compile: bundle senses from a source that declares SUMMARIZED or PARAPHRASED are rejected; adapters can only copy source wording. - OWASP declares QUOTED, the mode its adapter performs. The share-alike rule in the licensing policy is corrected: quoting keeps the text under its own license, while summaries and paraphrases are derived works. - openapi: search results are a oneOf of the entry and sense shapes. - ingest workflow: intent-to-add content/ so a new source's first bundle reaches the pull request job. - csp-report: the body is read with a byte cap instead of buffered first. - crawler: an unreachable robots.txt (server error, timeout) halts the host per RFC 9309; a 404 or an HTML page still means no rules.
Owner
Author
|
@greptileai review |
…ane on Linux - compileContent exposes the ungrouped classification view; prepare, local review, and the emitter hash it instead of the grouped dataset, so their corpus and entry hashes match the ones the content check verifies. They diverged once sense grouping landed. - The emitter accepts a reviewed removal for an entry that left the corpus when its current hash is the documented all-zero sentinel. - codex-cli passes HOME through so codex finds its login on Linux and macOS, and a child that exits before reading its prompt reports the exit instead of crashing on EPIPE.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the audit roadmap to the Convex and GitOps content architecture and ships it as v0.2.0. The earlier draft PR #226 targets the March Postgres codebase and stays as a reference only.
needsLabelwarning incontent:check; editors resolve them with the newlabelSenses,disambiguationNotes,groupSenses, andsplitSensesoverride fields. Every sense has a heading (label, expansion, or the citing source) and the lede no longer duplicates the first sense. 25 entries currently need labels.DefinedTermSeton entry and tag pages. A citation record endpoint returns the sense's sources with hashes.?scope=senses) on a definition search index, sense counts for terms as well as acronyms.content/generatedis unchanged here.POST /api/v1/internal/revalidate), no anonymous cookie and no view tracking, metadata and canonicals on every route,/tags/[slug]404s, accessible relation previews and palette (inert background, live region, Tab restored), contrast and target-size fixes, a public read API with OpenAPI, ETags, CORS, and a paged dataset export, health check,form-actionand CSP reporting, IP-first rate limiting behind trusted proxies with a required production salt, oneBrowsePagefor terms and acronyms, dead primitives and legacy aliases removed.ci.ymlmatchespnpm gate(format, strict lint, convex lint and typecheck, tagging check);noUncheckedIndexedAccessand type-aware lint on; SHA-pinned actions; the ingest workflow no longer interpolates input into shell; a quality workflow runs Playwright with axe and Lighthouse budgets against an anonymous Convex deployment; CodeQL security-extended; grouped Dependabot;.github/CODEOWNERSno longer shadows the current boundary; issue templates capture sense, wording origin, and license; runbooks and governance describe the Convex system; SPEC infra sections marked superseded;pnpm.overridesmoved topnpm-workspace.yaml(pnpm 10 ignored them, so the frozen install was already failing on main).Verification
Deploy notes
SYNAC_RATE_LIMIT_SALTandSYNAC_REVALIDATE_SECRET(Vercel) andSYNAC_REVALIDATE_SECRET(repo secret for the Deploy workflow) before merging.SYNAC_SESSION_HASH_SALTis no longer read.entryViewsdropped); the Deploy workflow'sconvex deployplus sync handles it, and the deploy fails if the revalidate call fails..env.examplestill listsSYNAC_SESSION_HASH_SALT; it is protected in the author's tooling and needs a manual edit.v0.2.0on the merge commit.