[uniskela]

Release-hardening PR for the v0.6.0 gate (#57, parent #51). Based on audited main 8333dd8.

What changed

Fix

• Deployment and routing audit events (13 actions added in v0.6.0) had no labels, so Dashboard and Settings → Activity showed raw ids such as deployment.unknown. They now have labels that say "accepted by receiver", never "deployed". A typed test fails if a future audit action has no label.

Tests (no product behaviour change)

• tests/integration/release-audit-routing.test.ts: independent end-to-end routing checks through real Git, SQLite and the worker. Covers Unicode, spaces, # and parentheses in paths, an apps/wiki café vs apps/wiki prefix trap, multi-repository failure isolation, fetch exhaustion before routing (fails closed, baseline kept, next push covers it), signing rotation between accept and route, deployment credential rotation and disabling with queued work, automation off/on re-baselining, unknown outcome hold and manual recovery, and cross-workspace ingress.
• Resolves the two open Kody threads: #63 r4325951812 (assert the exact scoped set) and #64 r4332700230 (e2e cleanup no longer masks the original failure).
• Scheduler test: no scan or enqueue when the worker or server auto-fetch is disabled.

Docs

• BACKUP_RESTORE.md rewritten. It still said backups were "planned" and pointed at "PR build(deps): Bump @playwright/test from 1.56.1 to 1.63.0 in the javascript-dependencies group #8". It now has tested WAL-safe procedures, key handling, a failure-mode table, rollback steps, and what restoring an older replay ledger means.
• New public page UPGRADING_0_6.md (manifest slug upgrading-0-6) with the operator acceptance checklist.
• Deployment and Git webhook troubleshooting: pushes that are not routed after their fetch exhausts retries; pattern characters that are rejected even as literals.
• RELEASING.md: the v0.6.0 section said ingress never deploys, which is no longer true. Replaced with the release gate.
• Internal report: docs/internal/releases/v0.6.0-readiness.md (verification matrix, findings, risks, Go/No-Go).

Verification

• pnpm check: 667 passed (656 on main + 11 new), format/lint/types clean.
• Audited SHA: production build; Playwright + axe 43 passed / 13 intentional skips; the server-disabled auto-fetch scenario run separately (passed); standalone production smoke, same-data restart, missing-key refusal (exit 1).
• v0.5.0 → candidate upgrade using a database seeded by the v0.5.0 code: every existing row byte-identical, token decrypts and fetches, pending job runs, upgraded schema equals a fresh one. The pre-upgrade backup restores and runs under v0.5.0. A wrong key is refused at decryption; a missing key refuses to start.
• pnpm audit --prod: clean. db:generate: no drift. actionlint/shellcheck: clean. Gitleaks over main history: no leaks. Container security on main: passed.
• Not run locally: Docker image build (host disk ~450 MB free). CI's Docker job covers it.

Not in scope

• No merge, tag, release, image publication or deployment. Release PR chore(main): release 0.6.0 #41 is untouched.
• Live forge → proxy → receiver acceptance is still an operator task (checklist in UPGRADING_0_6.md).

🤖 Generated with Claude Code

---

Summary

• Adds v0.6.0 upgrade guidance and a disposable-stack acceptance checklist covering backups, Git webhook ingress, fetching, manual and automatic deployments, routing, and restore verification.
• Expands backup and rollback documentation with consistent WAL-aware backup methods, separate secret storage, forward-only migration warnings, and the effects of restoring an older delivery and routing ledger.
• Clarifies Git and deployment webhook behavior, including that HTTP 202 confirms a fetch was queued—not completed—and that a push is not routed if its fetch exhausts retries.
• Adds human-readable audit labels for deployment configuration, validation, requests, outcomes, routing decisions, and skipped stacks. Tests ensure every defined audit action has a label.
• Adds integration coverage for selective deployment routing, including Unicode and spaced paths, repository isolation, failed fetches, signing-secret rotation, queued work after configuration changes, automation holds, and workspace isolation.
• Extends end-to-end coverage for keyboard access to the activity log and adjusts Git webhook test cleanup behavior.

[uniskela]

@kody start-review focus on the release-audit routing tests (fail-closed fetch exhaustion, rotation fences, unknown-outcome hold), audit label wording (acceptance is never health), and accuracy of the backup/rollback and upgrade docs against the implementation.

[uniskela]

@kody -v business-logic

[kody-ai]

Business Rules Validation

Task: 5938266958 — [ADHD] v0.6.0 — release verification and documentation
Task Link: #57

Status: Issues Found
Confidence: high

The task and PR are aligned: the task is a v0.6.0 release-readiness gate for Git sync, webhook security, selective deployment, and dashboard UX; the PR adds release-audit documentation, tests, and operator guidance. The remaining gaps concern release completion evidence and release artifacts, not an unrelated implementation scope.

Findings

MUST_FIX: Live end-to-end operator acceptance is still unverified

Requirement: "Do not close until observable end-to-end acceptance tests pass." (FULL_TASK_CONTEXT, Resume)
Missing in code: The readiness report marks live operator acceptance UNVERIFIED and states the checklist requires the real forge, reverse proxy, TLS chain, and a disposable receiver. The new checklist documents those steps, but there is no evidence in this PR diff that they were performed or passed.
Suggested action: Run the documented acceptance checklist against the real operator environment, record the results on #57, and resolve any failures before closing the task.

MUST_FIX: Release-head checks and review closure remain pending

Requirement: "Checks green and review findings resolved." (AC #8)
Missing in code: The readiness report says workflow runs on release PR #41 show action_required and instructs the operator to approve them and confirm they pass on the release head. It also says manual Sonar status changes are pending. The report documents passing checks on the audited SHA and this PR's changes, but does not establish that the release-head gate is complete.
Suggested action: Approve and verify the required workflow runs on the release head, complete the pending review-status updates, and record that all applicable findings are resolved before treating the release gate as complete.

MUST_FIX: User sign-off before merge or release is not evidenced

Requirement: "User sign-off before merge/release." (AC #11)
Missing in code: The readiness report says nothing was merged or released and makes further operator actions prerequisites to merging release PR #41. No user sign-off is recorded in the diff.
Suggested action: Obtain and record user sign-off after the acceptance checklist and release checks are complete, before merging or releasing.

SUGGESTION: Roadmap and actual release notes are not updated in this diff

Requirement: "Update docs/public/, docs/manifest.json, roadmap and release notes as appropriate." (AC #4)
Missing in code: Public documentation and docs/manifest.json are updated, and docs/public/RELEASING.md is revised. There is no evidence in this PR diff of a roadmap update or an update to the actual v0.6.0 release notes. The readiness report notes that the changelog in release PR #41 has repeated entries and defers consolidation until after publication.
Suggested action: Update the applicable roadmap and release notes, or document why either does not need an update for this release.

Requirements Verified

• AC docs: PR #1 product architecture and implementation plan #1: "Unit, integration, E2E/Playwright and axe coverage; worker recovery and idempotency scenarios." → Implemented in the added routing integration tests and scheduler test; the readiness report records the unit, Playwright/axe, worker recovery, and idempotency verification.
• AC docs: require HTTPS for runtime and secret provider APIs #2: "Security review: signed raw requests, credential redaction, SSRF, replay, webhook URL leakage, secrets in audit/job payloads." → Implemented as a documented security review in docs/internal/releases/v0.6.0-readiness.md, with residual risks recorded; docs/public/SECURITY.md also marks webhook signature tests complete.
• AC feat: build application foundation #3: "Document provider setup, deploy policy, rollback/migrations, failure recovery, and manual controls." → Implemented across docs/public/UPGRADING_0_6.md, BACKUP_RESTORE.md, DEPLOYMENT_WEBHOOKS.md, and GIT_WEBHOOKS.md.
• AC PR #3 — Source workspace: stacks, VS Code-style editor, drafts, docs #5: "Audit open child issues of [ADHD] v0.6.0 — automatic Git sync, deployment routing & dashboard #51 and recent changes." → Implemented in the readiness report's open-issue summary, audit matrix, findings, and dispositions.
• AC feat(release): automated releases, security scanning and GHCR images #6: "Run pnpm check, pnpm build, relevant e2e and container smoke tests." → Implemented as documented verification in the readiness report; it records check, build, E2E, and smoke results, while separately disclosing that a local Docker image build was not run.
• AC build(docker): Bump node from 24-bookworm-slim to 26-bookworm-slim #7: "Document residual risks and agree Go/No-Go." → Residual risks and a CONDITIONAL GO decision are documented in docs/internal/releases/v0.6.0-readiness.md.
• AC docs: publish user documentation to uniskela.com #9: "Provider setup and recovery guides published." → Provider and recovery guidance is present in the public webhook, backup/restore, and upgrade documentation, with the upgrade guide added to the docs manifest.
• AC chore(main): release 0.1.0 #10: "Rollback and migration impact documented." → Implemented in docs/public/BACKUP_RESTORE.md and docs/public/UPGRADING_0_6.md, including forward-only migration and restore-based rollback guidance.

---

Analysis performed by Kodus AI Business Rules Validator

[uniskela]

Dispositions for the Kody business-rules validation on this PR:

Finding	Disposition
MUST_FIX: live end-to-end operator acceptance unverified	Agreed, and intentionally out of scope for this PR. The audit was not authorized to call real forges or deployment receivers. The readiness report marks this UNVERIFIED and the result CONDITIONAL GO. The checklist is in docs/public/UPGRADING_0_6.md. This PR does not close #57, which stays open until the operator records the results.
MUST_FIX: release-head checks and review closure pending	Agreed; operator action. Approving the action_required runs on release PR #41 and changing Sonar issue status need maintainer permissions. Both are listed as preconditions in the report's Go/No-Go section. All checks on this PR's head are maintained CI.
MUST_FIX: user sign-off not evidenced	Agreed; by design. No merge or release happens without explicit user approval. The PR stays open for review.
SUGGESTION: roadmap and release notes	Roadmap fixed in 70ded32: MVP_PLAN.md and AGENTS.md no longer call deployment routing "next". Release notes: Release Please owns CHANGELOG.md and #41. The report recommends consolidating the duplicate entries and adding the upgrade/backup note in the GitHub Release text at publication, instead of hand-editing generated metadata.

[kody-ai]

Code Review Completed, but its comments could not be posted ⚠️

The review produced 1 comment(s), but none could be posted to this pull request (for example, the platform rejected them with a rate limit). This is not a clean review: comment @kody review on this PR to run it again.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	❌

Access your configuration settings here.

​

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud