[ADHD] v0.6.0 — automatic Git sync, deployment routing & dashboard #51

Activity

1. uniskela commented on Oct 20, 2026

   

   uniskela

   on Oct 20, 2026

   OwnerAuthor

   More actions

   Done

   • PR feat(sync): schedule background Git fetches and refresh after push #59 remediation at 1848cb5 passed GitHub CI, Docker, CodeQL, Gitleaks, Sonar analysis/quality gate and Kody code review. Post-push race and workspace failure isolation are fixed; due timing uses dedicated persisted timestamps. Controlled Docker integration: 61 passed, preserving drafts/retained commits. Playwright/axe: 33 passed, 9 intentional platform-specific skips. Kody business validation now verifies the implementation and has only two suggestions about locating CI/Docker evidence; that evidence is being linked directly in the internal review record.
   • Independent security-hardening PR fix(security): restrict dependency scripts and image publishing permissions #61 changes install scripts and job-level publishing permissions. Clean install/rebuild, 354 base-branch tests, production build, Docker/public-clone smoke, workflow lint, migration drift and audit passed locally; Playwright/axe 33 passed, 9 intentional skips.
   • All 23 Sonar alerts have individual links, evidence and dispositions in docs/internal/security/2026-10-20-sonar-dispositions.md on fix(security): restrict dependency scripts and image publishing permissions #61. Code fixes: docs: require HTTPS for runtime and secret provider APIs #2/UI/UX plan + UI-1 foundation (tokens, primitives, sidebar shell, UI tests) #4/PR #3 — Source workspace: stacks, VS Code-style editor, drafts, docs #5. Recommended safe: synthetic fixture docs: PR #1 product architecture and implementation plan #1, pinned Playwright setup feat: build application foundation #3, test-only PATH execution feat(release): automated releases, security scanning and GHCR images #6–feat: clearer stacks list with repository cards and parent-folder groups #23. Gitleaks scanned 139 commits, zero leaks; positive/negative allowlist controls behaved as intended.

   Next

   Review latest #59/#61 checks and Kody feedback before any merge decision. Per-repository policy is the immediate follow-up #60; #52 remains open. An authorized Sonar reviewer must apply the individually documented safe/false-positive dispositions because the available integration has no status-mutation operation. Default-branch code-fixed alerts close after merge/reanalysis, not before.

   Resume

   Open #59 and #61 checks and their validation/evidence records. Finish outstanding review items, then #60; preserve planned deployment/webhook/dashboard sequence. No merge, release, image publication or production homelab deployment has been performed or authorized.
2. uniskela commented on Oct 20, 2026

   

   uniskela

   on Oct 20, 2026 – with ChatGPT Codex Connector

   OwnerAuthor

   More actions

   Done: #59 (bc85555) and separate security PR #61 (8266e33) are pushed and ready for review. Both have successful current-head CI, Docker, CodeQL, Gitleaks, Kody and Sonar checks. #61's container security/Trivy check also passed. #59's original three Kody threads are resolved and business validation has no MUST_FIX findings.

   Next: review the two unmerged PRs. #61 fixes alerts #2/#4 (scripts-disabled install plus explicit approved native rebuilds) and #5 (job-level publishing permissions). All 23 alerts have individual evidence/links in the disposition record. The 20 safe recommendations (#1, #3, #6–#23) require manual Sonar issue review because available integration access is read-only; the three fixed default-branch alerts need merge/reanalysis. Per-repository sync policy remains #60.

   Resume: inspect #59's review record and #61's disposition table, then perform manual Sonar review using its exact links. The former Sonar execution failure no longer reproduces; its original cause remains unverified. No PRs merged, images published, releases created or production deployments performed.
3. uniskela commented on Oct 20, 2026

   

   uniskela

   on Oct 20, 2026 – with Cursor

   OwnerAuthor

   More actions

   Drift check: Next still described planning PR #58 as awaiting review and #59 as a draft. Updated it to show #58, #59, #61 and #62 merged (all in pending release PR #41, v0.6.0), with dashboard PR #63 open for #56 and #52 waiting on verification on main.
4. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   OwnerAuthor

   More actions

   Done

   Inbound signed Git webhook slice #53 is implemented in PR #64: #64. It queues source fetching only; deployment routing remains in #55. Local checks passed (478 tests, production build, migration drift, focused webhook security/restart tests, browser/axe and rootless Docker smoke).

   Next

   PR #64 remains open while CI, Kody, SonarCloud and security checks run. Address findings and obtain explicit merge approval. No release, image publication or production deployment performed.

   Resume

   See #53 and the PR evidence for exact results/skips and remaining live provider/proxy acceptance. Parent #51 remains open; this does not complete the deployment-routing/release gate slices.
5. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   OwnerAuthor

   More actions

   Done

   Implementation PR: #64 — branch uniskela/adhd-v0.6.0-signed-git-forge-push-receiver, head ab7bcd4.

   Secure GitHub/Gitea/Forgejo native SHA-256 ingress, encrypted repository signing settings, persistent delivery-ID/body-fingerprint replay protection, atomic existing-sync enqueue/follow-up, Overview UI, provider fixtures, screenshots, operator docs and additive migrations 0007/0008 are complete. No deployment trigger was introduced. Ordinary authentication/CSRF protections remain intact; ingress is throttled before body/database/signature work.

   Final local results: pnpm check 487 passed; production build and migration drift passed; full browser/axe 41 passed, 13 expected skips, exit 0; final rootless/read-only/cap-drop Docker smoke with real clone, same-volume restart and missing-key refusal passed. Frozen hardened install/native rebuild and production audit passed. Earlier wrong-sample and disk-exhaustion attempts are recorded and superseded by successful reruns. Temporary Docker runtime/volume/secret file were removed.

   Latest-head PR CI, Docker, CodeQL, Gitleaks, SonarCloud, workflow lint/title and the separate container-security run all pass. Sonar has zero new security hotspots and three minor Promise-port async advisories with explicit dispositions. Kody business-logic validation reports Compliant; all three inline findings were fixed, individually answered and confirmed addressed by Kody. PR includes screenshots and complete review evidence.

   Next

   GO for review/explicit merge approval. Leave the PR, #53 and parent #51 open pending that approval. No merge, release, image publication or deployment was performed. Before production enablement, the operator must validate live deliveries from the exact GitHub/Gitea/Forgejo versions through their intended HTTPS/reverse-proxy route and take the documented backup.

   Resume

   Start at PR #64 and docs/internal/git-webhooks-review.md. Exact-body repeats are duplicates; unseen old signed bodies have no authenticated freshness. Delivery metadata persists until repository removal; legacy 0007-only rows lack body fingerprints. Coordinate concurrent rotations (last committed secret wins), configure trusted proxy hops and retain polling/manual fetch as fallback. This completes #53 implementation/review work for parent #51; deployment relevance/routing remains #55.
6. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   OwnerAuthor

   More actions

   Done

   Kody follow-up pushed in 0f55119 on PR #64. Address-based webhook limiting now skips unknown clients, the proxy-hop warning explicitly covers forged quota keys after over-declaring hops, and every independently opened SQLite handle in the webhook integration suite closes in finally. All four later findings received individual replies and Kody rechecks; all seven review threads are resolved (zero unresolved).

   Validation: 487 tests plus format/lint/types, production build, targeted production browser/axe 5 passed/1 expected shared mobile skip. Latest-head CI (including full browser tests), Docker, CodeQL, Gitleaks, SonarCloud and the separate container-security scan pass.

   Next

   Kody’s overall code-review check is still running; the individual findings are confirmed addressed. Keep PR #64 and issues #53/#51 open for explicit merge approval. No merge, release, image publication or production deployment.

   Resume

   PR #64 at 0f55119. Only react to new findings if the overall review posts any. Proxy-level connection/time/rate limits are required, especially when no trustworthy client IP is available; configure trusted proxy hops to match the actual topology.
7. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   Last edited by uniskela

   OwnerAuthor

   More actions

   Done

   • Addressed further Kody finding 4332551087 in PR feat(webhooks): receive verified Git push events #64, commit 80d0b61: browser mutation checks authenticated settings and skips before mutation/finally if the sample already has signing configuration. Existing secrets cannot be restored and are now left untouched.
   • Kody individually confirmed the fix: feat(webhooks): receive verified Git push events #64 (comment) . All eight inline threads are resolved; no further findings currently posted.
   • Local pnpm check: 487 passed plus format/lint/types. Production webhook browser/axe: 5 passed, 1 expected mobile skip. A temporary configured-instance browser check proved the skipped test preserves the original secret (subsequent signed push accepted with 202).
   • Final-head 4769a6e full CI, Docker, CodeQL, Gitleaks and SonarCloud pass: https://github.com/uniskela/stack-manager/actions/runs/39537029631 . A comment-only follow-up explains the conditional skip and clears Sonar S1607; the same three documented minor async advisories remain. Production code unchanged; reused local production build and prior dedicated container-security result.

   Next

   • Await Kody overall review: prior-head check remains running; fresh final-head review explicitly requested at feat(webhooks): receive verified Git push events #64 (comment) . No final-head overall Kody result yet; address any additional substantive findings. Live forge/proxy/TLS validation remains operator acceptance. PR remains open; no merge, release, publication or deployment.

   Resume

   • Branch uniskela/adhd-v0.6.0-signed-git-forge-push-receiver, head 4769a6e, PR feat(webhooks): receive verified Git push events #64 . Check overall Kody result and unresolved threads before merge approval. Issues [ADHD] v0.6.0 — signed Git forge push receiver #53 and [ADHD] v0.6.0 — automatic Git sync, deployment routing & dashboard #51 remain open.
8. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   OwnerAuthor

   More actions

   #54 implementation is open for review in #65 (feat/per-stack-deployment-webhooks, HEAD 3f00013). It adds explicit per-stack encrypted Portainer/generic bindings and deliberate manual requests with durable acceptance/rejection/unknown history. Automatic deployment from Git pushes remains disabled; #55 is not implemented.

   Focused security/integration/browser checks and rootless Docker smoke/restart pass; final full checks and remote Kody/Sonar/CI review are in progress. Keep #54 open until merged and verified; no merge/release/deployment performed.
9. uniskela commented on Oct 21, 2026

   

   uniskela

   on Oct 21, 2026

   Last edited by uniskela

   OwnerAuthor

   More actions

   Done: Issue #54 implementation is open in PR #65; automatic Git deployment remains deferred to #55. Latest Kody follow-up 59134a6 preserves definite provider outcomes, distinguishes safe internal pre-send diagnostics, documents nullable HTTP status, handles mock request errors, and clarifies bounded recovery. All five findings have individual replies/dispositions. pnpm check: 551 tests plus format/lint/types pass; production build and 56 focused tests pass. Sonar gate passes with ten documented SQLite Promise-port advisories; recovery-loop advisory removed. Earlier full Playwright/axe: 43 passed / 13 expected skips; rootless smoke/restart evidence and screenshots remain in the PR.

   Next: Wait for final-head maintained CI/Docker/CodeQL and automatic Kody re-review, then human PR review. Before production use, verify a disposable Portainer stack and encrypted backup restore. Inspect receivers before retrying unknown outcomes. Keep #54 open until merged and verified. No merge, release, image publication or production deployment performed.

   Resume: Branch feat/per-stack-deployment-webhooks; PR #65; HEAD 59134a68d080f7f0162be471d421e280ba8aaaa7. Worktree /home/orca/orca/workspaces/stack-manager/issue-54-deployment. Next action: inspect final-head checks and any new review findings; do not merge automatically.
10. uniskela commented on Oct 21, 2026

    

    uniskela

    on Oct 21, 2026

    OwnerAuthor

    More actions

    #55 implementation is active on feat/selective-deployment-routing, based on merged #65. Pure relevance and local Git comparison tests pass; explicit automatic-deployment UI and non-sending preview pass focused desktop/mobile Playwright/axe checks. Durable source delivery → decisions + existing deployment attempts + per-binding checkpoint transactions are implemented; crash/concurrency integration tests and documentation are next. No competing routing PR found. #57 stays open for release verification; no merge/release/production deployment performed.
11. uniskela commented on Oct 21, 2026

    

    uniskela

    on Oct 21, 2026

    Last edited by uniskela

    OwnerAuthor

    More actions

    Done: PR #66 implements selective routing and safety/UI/docs. All four Kody inline findings have individual replies and resolved threads. Runtime correction ca1296c fixed SQLite cleanup and hoisted shared reads; CI, Docker smoke/restart, CodeQL, Gitleaks, dependency audit, migration drift and container security all passed. Kody business validation is Compliant (high confidence). Sonar gate passes with 25 documented advisories. Latest follow-up 4db90e6 retains required source-level atomicity and adds explicit regression assertions that a later enqueue failure leaves routing pending and sends nothing; retry deploys both stacks once. Local pnpm check: 656 tests passed. Prior/fresh runtime-head Playwright/axe: 43 passed, 13 intentional skips. No runtime behavior changed in the follow-up.

    Next: Fresh follow-up CI passed: https://github.com/uniskela/stack-manager/actions/runs/39718570333 (656 tests, build, migration drift, Docker smoke/restart and Playwright/axe: 43 passed, 13 intentional skips). Only automatic Kody re-review remains in progress; no new findings yet. Review that result before human approval. #57 remains open for operator/release verification. No merge, release, image publication or production deployment performed. Local Docker rebuild remains skipped for low disk; CI supplies image/restart evidence. Container scan on unchanged runtime: https://github.com/uniskela/stack-manager/actions/runs/39716820347.

    Resume: Branch feat/selective-deployment-routing; PR #66; HEAD 4db90e6b47389eda4e5f2a9a48f4dfc85ffbc065. Exact next action: inspect the automatic Kody re-review result and any new findings before human approval; all maintained checks are green and all four current threads are resolved. Final operator acceptance in #57 covers a disposable forge-to-receiver flow, exact Portainer/proxy/TLS behavior, unknown-outcome receiver inspection and backup/restore.
12. uniskela commented on Oct 22, 2026

    

    uniskela

    on Oct 22, 2026 – with Cursor

    OwnerAuthor

    More actions

    Drift update: all implementation PRs (#58, #59, #61–#67) are merged, children #52–#56 are closed, and v0.6.0 was published on 2026-10-22 via #41. Focus, Next and Resume now point at the remaining live operator checklist on #57; this stays open until that passes.