mirror of
https://github.com/BradGroux/veritas-kanban.git
synced 2026-08-28 02:44:59 +00:00
chore: release v6.1.2
* chore: prepare v6.1.2 release * chore: refresh reviewed gitleaks fingerprints * docs: record release gate corrections * docs: record v6.1.2 release evidence
This commit is contained in:
Brad Groux
GitHub
parent
3851fea93e
commit
dfae7911cc
37 changed files with 490 additions and 180 deletions
|
|
@ -6,13 +6,13 @@ docs/API-REFERENCE.md:generic-api-key:991
|
|||
docs/API-WORKFLOWS.md:generic-api-key:1460
|
||||
|
||||
# Operator documentation uses placeholders in curl authentication examples.
|
||||
docs/DEPLOYMENT.md:curl-auth-header:923
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:229
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:257
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:260
|
||||
docs/DEPLOYMENT.md:curl-auth-header:926
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:230
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:258
|
||||
docs/TROUBLESHOOTING.md:curl-auth-header:261
|
||||
docs/features/prd-driven-development.md:curl-auth-header:95
|
||||
docs/features/prd-driven-development.md:curl-auth-header:775
|
||||
docs/guides/SELF_HOST.md:curl-auth-header:738
|
||||
docs/guides/SELF_HOST.md:curl-auth-header:742
|
||||
docs/security.md:curl-auth-header:51
|
||||
docs/security.md:curl-auth-header:58
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
> Harness-specific supplements (for example `CLAUDE.md`) extend, never duplicate or contradict,
|
||||
> these rules. See `docs/AGENTS-TEMPLATE.md` for the managed-run and external-agent protocols.
|
||||
>
|
||||
> **Version:** 6.1.1
|
||||
> **Version:** 6.1.2
|
||||
> **Freshness policy:** update within two working days of any toolchain or architecture change.
|
||||
> Stale fields (package manager, Node version, provider list, test commands) are caught by
|
||||
> `pnpm check:pnpm-settings` and the smoke-test CI job.
|
||||
|
|
|
|||
87
CHANGELOG.md
87
CHANGELOG.md
|
|
@ -7,6 +7,90 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
|||
|
||||
## [Unreleased]
|
||||
|
||||
## [6.1.2] - 2026-08-24
|
||||
|
||||
Veritas Kanban 6.1.2 completes the repository-wide reliability, security,
|
||||
storage, provider-runtime, CI, container, and supportability audit tracked in
|
||||
#1174. It is a backward-compatible patch release for 6.1.1.
|
||||
|
||||
### Added
|
||||
|
||||
- Added deterministic, milestone-scoped CI selection so ordinary pull requests
|
||||
keep test, coverage, E2E, desktop artifact, load, and Docker-contract jobs
|
||||
dormant while `ci:full`, scheduled, and manual release milestones run the
|
||||
complete gates (#1172, #1227, #1228).
|
||||
- Added risk-weighted critical-path coverage baselines and ratchets for provider
|
||||
dispatch, attempt lifecycle, authentication, storage, web API/session, CLI,
|
||||
MCP, and desktop trust boundaries (#1169, #1183).
|
||||
- Added continuous CodeQL, dependency, and secret-scanning policy enforcement,
|
||||
immutable GitHub Actions references, and repository guards that prevent those
|
||||
controls from silently regressing (#1167, #1168, #1179, #1180).
|
||||
- Triaged the initial CodeQL baseline, fixed validated request, logging,
|
||||
persisted-key, file-handling, and sandbox-read findings, and documented the
|
||||
evidence-backed disposition of non-exploitable alerts (#1231, #1232-#1235).
|
||||
- Added a production Docker runtime size contract with architecture-specific
|
||||
ceilings, non-root runtime checks, health/auth/SQLite/static-web smoke
|
||||
coverage, and a reduced build context (#1166, #1222).
|
||||
|
||||
### Changed
|
||||
|
||||
- Centralized `DATA_DIR` and `VERITAS_DATA_DIR` resolution, legacy-location
|
||||
discovery, migration, backup, integrity, and Docker-mounted runtime behavior
|
||||
behind the canonical path contract (#1162, #1184).
|
||||
- Restored the service/storage boundary across activity, progress, status
|
||||
history, scheduled deliverables, workflows, broadcasts, conflicts,
|
||||
delegation, ceremony, error analyses, permissions, lifecycle configuration,
|
||||
scheduler, reflection, chat, task, telemetry, and managed-content persistence.
|
||||
File and SQLite implementations retain their existing compatibility,
|
||||
containment, locking, and atomic-write contracts (#1163, #1190-#1220).
|
||||
- Decomposed the provider control path into explicit launch compilation, Codex
|
||||
event interpretation, runtime resolution, completion, attempt mutation, and
|
||||
adapter-registry contracts. Executable providers remain explicit and unknown
|
||||
or mismatched profiles continue to fail closed without an OpenClaw fallback
|
||||
(#1164, #1223-#1230).
|
||||
- Routed frontend JSON, blob, and stream operations through credential-aware API
|
||||
helpers, preserving cross-origin cookie authentication, base paths, and
|
||||
server error envelopes (#1165, #1218).
|
||||
- Removed four verified unused direct dependencies, regenerated the workspace
|
||||
dependency graph with pnpm 11.1.1, and reduced the server lint-warning budget
|
||||
from 600 to 458 without broad suppressions (#1170, #1173, #1217, #1221).
|
||||
- Replaced loader-fragile Vite/Vitest path handling with native ESM-compatible
|
||||
configuration and made root workspace test discovery deterministic (#1171,
|
||||
#1172, #1175, #1177, #1178, #1181).
|
||||
|
||||
### Fixed
|
||||
|
||||
- Eliminated split runtime-state locations and service-layer persistence leaks
|
||||
that could send live data, backups, health checks, or migrations to different
|
||||
roots under custom data-directory configurations (#1162, #1163).
|
||||
- Hardened request rate limits, structured logging, persisted dynamic keys,
|
||||
bounded file reads and writes, and sandbox metadata reads identified by the
|
||||
initial CodeQL baseline (#1231, #1232-#1235).
|
||||
- Integrated coordinated validation hardening for a privately reported input
|
||||
boundary. Technical details remain under the repository security-advisory
|
||||
process until supported artifacts are available and disclosure is approved
|
||||
(#1236).
|
||||
- Corrected recovery-key alphabet generation and WebSocket upgrade header
|
||||
forwarding defects exposed by the final release validation (#1238, #1239).
|
||||
- Serialized complete same-task update and lifecycle operations before their
|
||||
first read, preserving archive/restore invocation order under contention
|
||||
(#1240, #1241).
|
||||
- Rejected digit-prefixed unsafe URI payloads in sanitized HTML while
|
||||
preserving safe relative links (#1242, #1243).
|
||||
|
||||
### Compatibility and operations
|
||||
|
||||
- The public REST API remains `v1`. Package, CLI, MCP, desktop, provider-profile,
|
||||
and configuration contracts remain backward compatible with 6.1.1.
|
||||
- SQLite migrations remain at 30 through 33; upgrading from 6.1.1 does not run a
|
||||
new schema migration. Runtime path normalization may move legacy files into
|
||||
the configured canonical data directory. Keep a complete stopped-writer
|
||||
backup until the upgraded runtime is accepted.
|
||||
- Rollback is restore-first: stop every writer, reinstall the prior signed
|
||||
application only when its data contracts remain compatible, and otherwise
|
||||
restore the complete pre-upgrade workspace. Never copy an older database over
|
||||
a running instance.
|
||||
|
||||
## [6.1.1] - 2026-08-22
|
||||
|
||||
Veritas Kanban 6.1.1 restores reliable Task Detail scrolling after the Mantine
|
||||
|
|
@ -2463,7 +2547,8 @@ Veritas Kanban is an AI-native project management board built for developers and
|
|||
|
||||
_Built by [Digital Meld](https://digitalmeld.io) — AI-driven enterprise automation._
|
||||
|
||||
[unreleased]: https://github.com/BradGroux/veritas-kanban/compare/v6.1.1...HEAD
|
||||
[unreleased]: https://github.com/BradGroux/veritas-kanban/compare/v6.1.2...HEAD
|
||||
[6.1.2]: https://github.com/BradGroux/veritas-kanban/compare/v6.1.1...v6.1.2
|
||||
[6.1.1]: https://github.com/BradGroux/veritas-kanban/compare/v6.1.0...v6.1.1
|
||||
[6.1.0]: https://github.com/BradGroux/veritas-kanban/compare/v6.0.2...v6.1.0
|
||||
[6.0.2]: https://github.com/BradGroux/veritas-kanban/compare/v6.0.1...v6.0.2
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
> Claude-specific lessons and common mistakes caught by previous Claude runs. Do not duplicate
|
||||
> `AGENTS.md` content here.
|
||||
>
|
||||
> **Last updated:** 2026-08-22 (v6.1.1 release freshness)
|
||||
> **Last updated:** 2026-08-24 (v6.1.2 release freshness)
|
||||
> **Freshness check:** Update after mistakes; review monthly.
|
||||
|
||||
---
|
||||
|
|
|
|||
16
README.md
16
README.md
|
|
@ -10,7 +10,7 @@ Start with a visual Kanban board. Add CLI, MCP, OpenClaw, Squad Chat webhooks, w
|
|||
|
||||
[](https://github.com/BradGroux/veritas-kanban/actions/workflows/ci.yml)
|
||||
[](LICENSE)
|
||||
[](CHANGELOG.md)
|
||||
[](CHANGELOG.md)
|
||||
[](https://www.typescriptlang.org/)
|
||||
[](CONTRIBUTING.md)
|
||||
|
||||
|
|
@ -211,9 +211,13 @@ Not just cards on a board. Tasks have dependency graphs with cycle detection, cr
|
|||
|
||||
Isolated worktrees per task — no branch switching, no conflicts. Built-in code review with unified diff viewer and inline comments. Approval workflows (approve, request changes, reject). Visual merge conflict resolution. Create GitHub PRs directly from the task detail panel. Bidirectional GitHub Issues sync with label mapping.
|
||||
|
||||
### 📁 Zero Infrastructure
|
||||
### 📁 Local-First Storage
|
||||
|
||||
Tasks are markdown files. Settings are JSON. Workflows are YAML. No database, no Redis, and no Docker required for local use. Clone, `pnpm install`, `pnpm dev` — done. Everything is `grep`-friendly, version-controllable, and human-readable. Back up your entire board with `git push`.
|
||||
File storage remains the zero-infrastructure default: tasks are Markdown,
|
||||
settings are JSON, and workflows are YAML. SQLite is available for governed
|
||||
multi-user and higher-integrity deployments; Redis and Docker are not required
|
||||
for local use. Clone, `pnpm install`, and `pnpm dev` to start. Back up the
|
||||
complete configured storage root, not only the Git-tracked board files.
|
||||
|
||||
### 🔌 Optional Integration Surfaces
|
||||
|
||||
|
|
@ -324,7 +328,7 @@ Tasks are markdown files. Settings are JSON. Workflows are YAML. No database, no
|
|||
- **Activity page** — Status history with clickable task navigation, color-coded badges, and daily summary
|
||||
- **Daily standup summary** — Generate standup reports via API or CLI (`vk summary standup`)
|
||||
- **Task Templates** — Create reusable templates with defaults, subtasks, and multi-task blueprints
|
||||
- **Documentation freshness** — Steward workflow with freshness headers and automated staleness detection
|
||||
- **Documentation freshness** — Registry-backed review dates, thresholds, scores, and staleness alerts
|
||||
- **Cost prediction** — Multi-factor cost estimation for tasks
|
||||
|
||||
#### Dashboard
|
||||
|
|
@ -379,8 +383,8 @@ Tasks are markdown files. Settings are JSON. Workflows are YAML. No database, no
|
|||
| **Storage** | Markdown files with YAML frontmatter | yaml + local frontmatter helper |
|
||||
| **Git** | simple-git, worktree management | — |
|
||||
| **Testing** | Playwright (E2E), Vitest (unit) | Playwright 1.61, Vitest 4.1 |
|
||||
| **Runtime** | Node.js | 22+ |
|
||||
| **Package Manager** | pnpm | 11.1.1+ |
|
||||
| **Runtime** | Node.js | 22.22.1+ |
|
||||
| **Package Manager** | pnpm | 11.1.1 (pinned) |
|
||||
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/cli",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"description": "CLI for Veritas Kanban task management",
|
||||
"type": "module",
|
||||
"bin": {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/desktop",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"private": true,
|
||||
"homepage": "https://github.com/BradGroux/veritas-kanban",
|
||||
"description": "Veritas Kanban native desktop shell",
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ The Agent Registry is a service discovery and liveness tracking system for AI ag
|
|||
| **Persistence** | File-backed JSON survives server restarts |
|
||||
| **Dashboard** | Live agent cards in the board sidebar |
|
||||
|
||||
**Storage:** `.veritas-kanban/agent-registry.json`
|
||||
**Storage:** `<storage-root>/.veritas-kanban/agent-registry.json`
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -406,13 +406,14 @@ The panel reads from the registry API and updates every 30 seconds (plus WebSock
|
|||
| ------------------------- | ------------------ | -------------------------------------------- |
|
||||
| `HEARTBEAT_TIMEOUT_MS` | 300,000 (5 min) | Time before marking agent offline |
|
||||
| `STALE_CHECK_INTERVAL_MS` | 60,000 (1 min) | How often the server checks for stale agents |
|
||||
| `VERITAS_DATA_DIR` | `.veritas-kanban/` | Directory for registry JSON file |
|
||||
| `VERITAS_DATA_DIR` | Project root | Storage root used when `DATA_DIR` is unset |
|
||||
|
||||
---
|
||||
|
||||
## File Format
|
||||
|
||||
The registry is stored as JSON at `.veritas-kanban/agent-registry.json`:
|
||||
The registry is stored as JSON at
|
||||
`<storage-root>/.veritas-kanban/agent-registry.json`:
|
||||
|
||||
```json
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Veritas Kanban — API Reference
|
||||
|
||||
**Version**: 6.1.1
|
||||
**Last Updated**: 2026-07-25
|
||||
**Version**: 6.1.2
|
||||
**Last Updated**: 2026-08-24
|
||||
**Base URL**: `http://localhost:3001/api`
|
||||
**Canonical prefix**: `/api/v1` (alias: `/api`)
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ Companion docs:
|
|||
|
||||
- [SOP: OpenAI Codex Integration](SOP-codex-integration.md)
|
||||
- [Codex Workflow Examples](EXAMPLES-codex-workflows.md)
|
||||
- [SOP: Cross-Model Code Review](SOP-cross-model-code-review.md)
|
||||
- [Optional Independent Code Review](SOP-cross-model-code-review.md)
|
||||
- [AGENTS.md Template](AGENTS-TEMPLATE.md)
|
||||
|
||||
## Product Goal
|
||||
|
|
|
|||
|
|
@ -69,10 +69,13 @@ Data is persisted in a Docker named volume (`kanban-data`), so it survives conta
|
|||
|
||||
The multi-stage Dockerfile enforces architecture-specific production image budgets:
|
||||
|
||||
| Architecture | Maximum compressed image size | Measured release candidate |
|
||||
| ------------ | ----------------------------- | -------------------------- |
|
||||
| `arm64` | 200,000,000 bytes | 195,910,880 bytes |
|
||||
| `amd64` | 600,000,000 bytes | 571,590,173 bytes |
|
||||
| Architecture | Maximum compressed image size | 6.1.2 implementation baseline |
|
||||
| ------------ | ----------------------------- | ----------------------------- |
|
||||
| `arm64` | 200,000,000 bytes | 195,910,880 bytes |
|
||||
| `amd64` | 600,000,000 bytes | 571,590,173 bytes |
|
||||
|
||||
The final release candidate is remeasured at the release milestone; these
|
||||
implementation baselines are not substituted for final artifact evidence.
|
||||
|
||||
| Stage | Purpose |
|
||||
| -------------- | ------------------------------------------------------------------------ |
|
||||
|
|
@ -251,10 +254,10 @@ If you need to debug inside a container, use `docker exec` to inspect — don't
|
|||
|
||||
### Prerequisites
|
||||
|
||||
| Requirement | Version |
|
||||
| ----------- | ------- |
|
||||
| Node.js | 22.0.0+ |
|
||||
| pnpm | 11.1.1+ |
|
||||
| Requirement | Version |
|
||||
| ----------- | --------------- |
|
||||
| Node.js | 22.22.1+ |
|
||||
| pnpm | 11.1.1 (pinned) |
|
||||
|
||||
Install pnpm if not present:
|
||||
|
||||
|
|
|
|||
|
|
@ -44,7 +44,13 @@ When completing a task that changes user-facing behavior:
|
|||
|
||||
### Freshness Indicators
|
||||
|
||||
Each doc should include a freshness header:
|
||||
The Settings → Doc Freshness registry is the authoritative freshness source.
|
||||
Each tracked record stores its path, last review date, reviewer, maximum age,
|
||||
tags, and notes. The service computes scores and alerts from those records; it
|
||||
does not scan or rewrite Markdown headers.
|
||||
|
||||
A maintained living document may also include this optional human-readable
|
||||
marker when repository reviewers find it useful:
|
||||
|
||||
```markdown
|
||||
<!-- doc-freshness: 2026-03-25 | v4.0.0 | @veritas -->
|
||||
|
|
@ -52,12 +58,16 @@ Each doc should include a freshness header:
|
|||
|
||||
Format: `date | version | last-updater`
|
||||
|
||||
When a doc is older than the current version, it may need review.
|
||||
The optional marker is not required for release notes, historical evidence,
|
||||
generated references, or every file under `docs/`. When a tracked document is
|
||||
older than its configured maximum age or its maintained version, review it and
|
||||
update the authoritative registry record.
|
||||
|
||||
### Last Sweep
|
||||
|
||||
| Date | Scope | Agent |
|
||||
| ---------- | ------------------------------------------------------------------- | ------- |
|
||||
| 2026-08-24 | v6.1.2 audit, storage, provider, CI, security, release, and SOP docs | Release |
|
||||
| 2026-08-22 | v6.1.1 maintenance, dependency, release, upgrade, and evidence docs | Release |
|
||||
| 2026-07-26 | v6.1.0 roadmap, harness, governance, knowledge, and release docs | Release |
|
||||
| 2026-07-24 | v6.0.2 desktop recovery, version support, release, and evidence | Release |
|
||||
|
|
@ -73,7 +83,7 @@ When a doc is older than the current version, it may need review.
|
|||
### Phase 1: Manual (Current)
|
||||
|
||||
- Doc update checklist in PR template
|
||||
- Freshness headers in docs
|
||||
- Doc Freshness registry records, with optional source markers where useful
|
||||
- Agent instructions include "update docs" step
|
||||
|
||||
### Phase 2: Hook-Based
|
||||
|
|
@ -112,7 +122,8 @@ project template, and harness-specific files only supplement the canonical
|
|||
rules. Key rules:
|
||||
|
||||
1. **Always update docs alongside code** — no code-only PRs for user-facing changes
|
||||
2. **Use freshness headers** — every doc starts with `<!-- doc-freshness: ... -->`
|
||||
2. **Track maintained living docs** — use the Doc Freshness registry; optional
|
||||
source headers are a reviewer aid, not the system of record
|
||||
3. **JSDoc is documentation** — route handlers and services must have JSDoc
|
||||
4. **Examples must work** — if you change an API, update the examples
|
||||
5. **CHANGELOG is mandatory** — every release gets an entry
|
||||
|
|
|
|||
|
|
@ -54,11 +54,11 @@ Steal these end-to-end flows when building your own automations. Each example sh
|
|||
|
||||
## 4. Security Audit (RF-002 style)
|
||||
|
||||
**Goal:** Run cross-model audit on repo.
|
||||
**Goal:** Run a focused security audit on the repository.
|
||||
|
||||
1. Task -> `type=security`, `project=veritas-kanban`.
|
||||
2. Subtasks: scope, run Codex audit, run Claude review, compile findings, create issues.
|
||||
3. Agents spawn using research prompt template, save results to `refactoring/rf-002/*`.
|
||||
2. Subtasks: scope, inspect trust boundaries, validate findings, compile evidence, create issues.
|
||||
3. Use the security-review prompt and save durable results to the task's declared artifact path.
|
||||
4. Deliverables: Markdown report, HTML deck, GitHub issues.
|
||||
|
||||
---
|
||||
|
|
@ -88,7 +88,7 @@ For any workflow:
|
|||
2. **Prompt** stored in registry.
|
||||
3. **API/CLI** calls scripted (vk begin/done, time tracking, status updates).
|
||||
4. **Artifacts** saved to predictable paths and mirrored to Brain/engram if needed.
|
||||
5. **Cross-model review** if code/critical.
|
||||
5. **Focused review** when the task or configured governance policy requires it.
|
||||
6. **Lessons learned** field updated for systemic knowledge.
|
||||
|
||||
Use these recipes as seeds for your own automation playbooks.
|
||||
|
|
|
|||
|
|
@ -47,9 +47,10 @@ Use these recipes as starting points for v4.3 OpenAI Codex workflows in Veritas
|
|||
|
||||
---
|
||||
|
||||
## 2. Codex Review Of A Claude-authored PR
|
||||
## 2. Optional Independent Review With Codex
|
||||
|
||||
**Goal:** Use Codex as the opposite-model reviewer for a Claude-authored branch.
|
||||
**Goal:** Use Codex as an independent reviewer when a task or governance policy
|
||||
explicitly requires one. This is not a default delivery step.
|
||||
|
||||
1. Keep the original implementation task `in-progress`.
|
||||
2. Trigger a Codex review action:
|
||||
|
|
@ -152,7 +153,7 @@ steps:
|
|||
agent: reviewer
|
||||
depends_on: [implement]
|
||||
input: |
|
||||
Review Codex's implementation using docs/SOP-cross-model-code-review.md.
|
||||
Run the configured independent review using docs/SOP-cross-model-code-review.md.
|
||||
```
|
||||
|
||||
Expected behavior:
|
||||
|
|
|
|||
|
|
@ -634,11 +634,11 @@ Reusable resources mountable across projects with full CRUD API and Settings tab
|
|||
Automated staleness detection for project documentation with real-time tracking and alerting. Added in v3.2.
|
||||
|
||||
- **Freshness tracking** — Track document staleness with freshness scores, alerts, and optional auto-review task creation
|
||||
- **Freshness headers** — YAML frontmatter with `fresh-days`, `owner`, `last-verified` fields
|
||||
- **Tracked metadata** — Registry records store review dates, owners, paths, thresholds, and tags without rewriting source documents
|
||||
- **Steward workflow** — Assigned doc owners responsible for periodic review
|
||||
- **Staleness API** — Query which docs need review based on freshness thresholds at `/api/doc-freshness`
|
||||
- **Configurable thresholds** — Set staleness thresholds via Settings → Doc Freshness
|
||||
- **3-phase automation** — Manual → scheduled checks → CI integration
|
||||
- **3-phase automation** — Manual registry review → scheduled checks → CI integration
|
||||
- **Inspired by** @mvoutov's BoardKit Orchestrator ("stale docs = hallucinating AI")
|
||||
|
||||
---
|
||||
|
|
@ -2343,13 +2343,13 @@ TRUST_PROXY=true
|
|||
|
||||
## Storage & Architecture
|
||||
|
||||
Abstract storage layer that decouples business logic from the filesystem.
|
||||
Deep storage modules decouple business logic from filesystem and SQLite details.
|
||||
|
||||
- **Repository pattern** — 5 repository interfaces abstract data access: `ActivityRepository`, `TemplateRepository`, `StatusHistoryRepository`, `ManagedListRepository`, `TelemetryRepository`
|
||||
- **StorageProvider** — Central provider extended with all repository implementations; services depend on interfaces, not filesystem calls
|
||||
- **`fs-helpers.ts`** — Centralized filesystem access module; the only file in the codebase that imports `fs` directly
|
||||
- **Service migration** — All 10 services migrated off direct `fs` imports to use the repository interfaces
|
||||
- **Extensibility** — Repository interfaces enable future storage backends (database, cloud storage) without changing service logic
|
||||
- **Repository contracts** — Persisted activity, progress, status history, deliverables, workflows, broadcasts, conflicts, delegation, ceremony, error analysis, permissions, lifecycle configuration, schedules, reflection, chat, tasks, telemetry, and managed content use explicit interfaces.
|
||||
- **File and SQLite parity** — Both backends preserve validated schemas, containment, locking, atomic mutation, pagination, and migration behavior appropriate to each domain.
|
||||
- **Service boundary gate** — Production services cannot introduce direct filesystem imports; authoritative reads and writes flow through the storage layer.
|
||||
- **Canonical runtime paths** — `DATA_DIR` and `VERITAS_DATA_DIR`, legacy discovery, backup, integrity, migration, health, and Docker mounts resolve through the same path contract.
|
||||
- **Extensibility** — Business services depend on domain operations instead of storage layout, allowing backend changes without duplicating product rules.
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -2371,7 +2371,8 @@ Production-ready deployment and development tooling.
|
|||
|
||||
- **GitHub Actions** — CI pipeline on push to `main` and pull requests
|
||||
- **Concurrency control** — In-progress runs cancelled when new commits push
|
||||
- **Pipeline jobs** — Lint and warning budget, type check, workspace unit tests, production build, and security audit
|
||||
- **Fast pull-request jobs** — Source-policy selection, lint and warning budget, typecheck, production build, dependency audit, CodeQL, and gitleaks
|
||||
- **Milestone jobs** — Workspace tests, critical-path coverage, Playwright, desktop artifacts, load checks, and Docker contracts run for `ci:full`, scheduled, or manual milestones
|
||||
- **Scheduled QA** — Weekly and manually triggered Playwright and k6 gates run outside the fast PR path
|
||||
- **Release validation** — `pnpm validate:release` checks root/shared/server/web/CLI/MCP/desktop versions, the release-major document set, built artifacts, and optional GitHub tag/release state
|
||||
- **pnpm caching** — Dependency cache for faster CI runs
|
||||
|
|
@ -2397,12 +2398,14 @@ Production-ready deployment and development tooling.
|
|||
|
||||
## Testing
|
||||
|
||||
Multi-layer testing strategy.
|
||||
Multi-layer, milestone-scoped verification strategy. Exact release counts live
|
||||
in `docs/V6-RC-EVIDENCE-PACKET.md`; historical counts are not treated as current
|
||||
proof.
|
||||
|
||||
### Unit Tests (Vitest)
|
||||
|
||||
- **119 test files** · **1,699 tests passing** across server and frontend
|
||||
- **Server (105 files, 1,570 tests):**
|
||||
- **Workspace coverage** — Server, web, CLI, MCP, shared contracts, and desktop packages are included in the canonical release gate.
|
||||
- **Server coverage includes:**
|
||||
- All middleware (auth, rate limiting, request ID, API versioning, cache control, validation, response envelope, request timeout)
|
||||
- Core services (task, template, telemetry, notification, activity, sprint, diff, conflict, summary, status history, digest, attachment, text extraction, migration, managed list, broadcast, automation, blocking, failure alert, metrics, settings, JWT rotation, MIME validation, preview, trace, circuit breaker)
|
||||
- Route handlers (tasks, task archive, task comments, task subtasks, task time, auth, agent status, automation, config, notifications, templates, health, misc routes)
|
||||
|
|
@ -2411,7 +2414,7 @@ Multi-layer testing strategy.
|
|||
- Prometheus metrics (counters, gauges, histograms, registry, collector middleware)
|
||||
- Environment variable validation
|
||||
- Circuit breaker transitions (18 tests covering open/half-open/closed states — added in v3.3.2)
|
||||
- **Frontend (14 files, 129 tests):**
|
||||
- **Frontend coverage includes:**
|
||||
- API client helpers and task operations
|
||||
- Custom hooks: useWebSocket, useKeyboard (keyboard shortcuts)
|
||||
- Components: KanbanBoard, TaskCard, ErrorBoundary, AgentStatusIndicator, WebSocketIndicator
|
||||
|
|
@ -2420,9 +2423,8 @@ Multi-layer testing strategy.
|
|||
|
||||
### End-to-End Tests (Playwright)
|
||||
|
||||
- **7 spec files** covering critical user flows
|
||||
- **19/19 tests passing**
|
||||
- **Test suites:**
|
||||
- **Chromium and WebKit projects** cover critical user flows at declared QA and release milestones.
|
||||
- **Test suites include:**
|
||||
- Health check
|
||||
- Settings management
|
||||
- Task creation
|
||||
|
|
|
|||
|
|
@ -30,9 +30,9 @@ A working board is not the same as agent-ready or external wake/delivery-ready.
|
|||
|
||||
| What | Command | Notes |
|
||||
| ----------------- | ------------------ | ----------------------------------------------------------------------- |
|
||||
| Node.js | `node -v` | Requires **22+**. Install via Volta/nvm if older. |
|
||||
| pnpm | `pnpm -v` | Requires **11.1.1+**. Prefer `corepack prepare pnpm@11.1.1 --activate`. |
|
||||
| Git | `git --version` | Any current version works. |
|
||||
| Node.js | `node -v` | Requires **22.22.1+**. Install via Volta/nvm if older. |
|
||||
| pnpm | `pnpm -v` | Use the repository-pinned **11.1.1** release. |
|
||||
| Git | `git --version` | Requires **2.38+**. |
|
||||
| (Optional) Docker | `docker --version` | Needed only if you prefer containers. |
|
||||
|
||||
That's it. No database, no extra services.
|
||||
|
|
|
|||
|
|
@ -29,6 +29,11 @@ Every project should maintain these files:
|
|||
| `prompt-registry/*.md` | Workflow prompts | When prompts drift or improve |
|
||||
| `README.md` | Project overview, quick start | After major releases |
|
||||
|
||||
Register maintained living documents in Settings → Doc Freshness. The registry
|
||||
record, not an optional Markdown comment, is authoritative for the last review,
|
||||
reviewer, maximum age, score, and alerts. Historical evidence and release notes
|
||||
do not need synthetic freshness headers.
|
||||
|
||||
### Optional Model-Specific Files
|
||||
|
||||
- `GPT.md` — GPT-specific notes (if behavior differs from Claude)
|
||||
|
|
@ -45,7 +50,9 @@ Update docs **within the same session** when:
|
|||
|
||||
1. **A bug was caused by missing context** — Add durable shared context to
|
||||
`AGENTS.md`, or a harness-specific supplement when it truly differs
|
||||
2. **Cross-model review catches a pattern** — Document the pattern
|
||||
2. **Focused review catches a pattern** — Document the pattern regardless of
|
||||
whether the reviewer is a maintainer, an independent agent, or a configured
|
||||
governance gate
|
||||
3. **A workaround is discovered** — Add it to Troubleshooting or the nearest
|
||||
applicable instruction file
|
||||
4. **API behavior changes** — Update relevant docs
|
||||
|
|
@ -86,7 +93,8 @@ Run this monthly or after major releases:
|
|||
|
||||
- [ ] Prompts reference current API endpoints
|
||||
- [ ] No prompts for removed features
|
||||
- [ ] Cross-model review prompt matches current checklist
|
||||
- [ ] Optional review prompts match the current checklist and are not described
|
||||
as default delivery gates
|
||||
|
||||
### README.md
|
||||
|
||||
|
|
|
|||
|
|
@ -188,7 +188,7 @@ Example frontmatter:
|
|||
id: cross-model-review
|
||||
name: Cross Model Review
|
||||
category: evaluation
|
||||
description: Opposite-model review checklist
|
||||
description: Optional independent review checklist
|
||||
---
|
||||
|
||||
# Cross Model Review
|
||||
|
|
|
|||
|
|
@ -134,13 +134,17 @@ Publish shared resources as a package:
|
|||
|
||||
## What to Share
|
||||
|
||||
### Always Share
|
||||
### Common Shared Resources
|
||||
|
||||
- Cross-model review prompt (consistency is critical)
|
||||
- Security review checklist
|
||||
- Definition of Done template
|
||||
- Sprint planning prompt
|
||||
|
||||
### Share Only When Configured
|
||||
|
||||
- Optional independent-review prompt when the consuming workspace explicitly
|
||||
enables that workflow
|
||||
|
||||
### Share Carefully
|
||||
|
||||
- Agent personality (AGENTS.md) — may need project-specific tweaks
|
||||
|
|
@ -236,7 +240,7 @@ Fixture contracts live in
|
|||
```markdown
|
||||
## Instructions
|
||||
|
||||
Follow the standard code review process.
|
||||
Follow the configured independent review process.
|
||||
See prompt: `prompt-registry/cross-model-review.md`
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -107,7 +107,7 @@ Example: 6 tasks × 4 subtasks × 0.5d = 12 agent-days. With 3 agents @ 4 days f
|
|||
| US-1602: Task Workflow SOP | docs | high | Defines lifecycle. |
|
||||
| US-1603: Sprint Planning SOP | docs | medium | This document. |
|
||||
| US-1604: Multi-Agent Orchestration | docs | medium | PM + workers. |
|
||||
| US-1605: Cross-Model Review | docs | medium | Opposite model gate. |
|
||||
| US-1605: Review Policy | docs | medium | Optional review criteria. |
|
||||
| US-1606: Best Practices | docs | medium | Patterns + anti-patterns. |
|
||||
|
||||
Clone this pattern for your own projects; rename sprint `US-YYYY` and fill tasks accordingly.
|
||||
|
|
|
|||
|
|
@ -141,22 +141,23 @@ pnpm install
|
|||
pnpm build
|
||||
```
|
||||
|
||||
If errors persist, check your Node.js version — **Node 22+** is required:
|
||||
If errors persist, check your Node.js version. **Node 22.22.1+** is required:
|
||||
|
||||
```bash
|
||||
node -v # Should be v22.x or higher
|
||||
node -v # Must be v22.22.1 or higher
|
||||
```
|
||||
|
||||
### `pnpm` not found
|
||||
|
||||
Veritas Kanban uses pnpm workspaces. Install it first:
|
||||
Veritas Kanban uses pnpm workspaces. Activate the repository-pinned version:
|
||||
|
||||
```bash
|
||||
npm install -g pnpm
|
||||
# or
|
||||
corepack enable && corepack prepare pnpm@latest --activate
|
||||
corepack enable
|
||||
corepack prepare pnpm@11.1.1 --activate
|
||||
```
|
||||
|
||||
Do not install this workspace with npm, Yarn, or Bun.
|
||||
|
||||
### Port already in use
|
||||
|
||||
```bash
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
# Veritas Kanban v6 Compatibility And Release Policy
|
||||
|
||||
This policy defines supported v6.1.1 combinations, harness evidence, release
|
||||
This policy defines supported v6.1.2 combinations, harness evidence, release
|
||||
channels, and rollback limits. The machine-readable harness record at
|
||||
`GET /api/config/harness-compatibility` is authoritative for exact capability
|
||||
digests, fixture revisions, and the current host's live state.
|
||||
|
||||
Documentation freshness: 2026-08-22 for Veritas Kanban 6.1.1.
|
||||
Documentation freshness: 2026-08-24 for Veritas Kanban 6.1.2.
|
||||
|
||||
## Harness Support Tiers
|
||||
|
||||
|
|
@ -25,7 +25,7 @@ are incompatible with v6.
|
|||
|
||||
| Component | Supported v6 combination | Detection/evidence | Fail-closed boundary |
|
||||
| -------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Server, web, shared, CLI, MCP, desktop | All release packages are exactly 6.1.1. | Package manifests, `/api/health.version`, `vk --version`, MCP metadata, desktop bundle/update metadata. | Mixed release packages are unsupported for publication. |
|
||||
| Server, web, shared, CLI, MCP, desktop | All release packages are exactly 6.1.2. | Package manifests, `/api/health.version`, `vk --version`, MCP metadata, desktop bundle/update metadata. | Mixed release packages are unsupported for publication. |
|
||||
| Public API | REST API remains `v1` at `/api/v1`, with `/api` compatibility aliases where documented. | `X-API-Version`, OpenAPI/reference docs, CLI/MCP smoke. | Unknown API versions or incompatible auth fail before mutation. |
|
||||
| Buzz Agent | Buzz v0.4.24 commit `710ed9fff57878a1d69f809b80a6ee0416c53fc4`; `buzz-agent 0.1.0`; ACP v1. | Exact initialize identity, capability digest, probe revision, composed Buzz fixtures. | Unknown build, `buzz-acp`, resume, HTTP/SSE MCP, or capability drift blocks. |
|
||||
| Buzz relay integration | Buzz v0.4.24; NIP-11, NIP-29, NIP-42; optional NIP-43 membership. | Pinned relay compatibility evidence, signed query/event fixtures, mapping state. | Host/TLS drift, unsafe URL, bad signature, identity mismatch, replay, or disabled mapping blocks. |
|
||||
|
|
@ -37,7 +37,7 @@ are incompatible with v6.
|
|||
| GitHub Copilot CLI | v1.0.74 public-preview ACP; tag commit `2b809c84e87dbcc88f897cb4f3fb97c43b77af95`. | Version and ACP initialize handshake; authentication remains provider-managed. | Version drift, broad allow, remote/plugin/config injection, or unsupported controls blocks. |
|
||||
| Hermes Agent | v2026.7.7.2 one-shot process adapter. | `hermes --version` and allowlisted boot authentication. | Resume/follow-up remains unsupported. |
|
||||
| OpenClaw | v2026.6.11 gateway adapter. | Gateway health, runtime manifest, explicit operator tool policy. | Missing `sessions_spawn`/`sessions_send`, unknown evidence, or unsupported task controls blocks. |
|
||||
| macOS desktop | macOS arm64 signed/notarized app with bundled 6.1.1 server/web. | Bundle version, signature, Gatekeeper, stapling, `/api/health.version`, update metadata. | Mixed bundle/runtime, failed readiness, signature, or metadata checks blocks stable publication. |
|
||||
| macOS desktop | macOS arm64 signed/notarized app with bundled 6.1.2 server/web. | Bundle version, signature, Gatekeeper, stapling, `/api/health.version`, update metadata. | Mixed bundle/runtime, failed readiness, signature, or metadata checks blocks stable publication. |
|
||||
| Linux/Windows desktop | Unsigned preview artifacts only. | Cross-platform packaging workflows. | Not a supported stable install or update channel. |
|
||||
| Desktop SQLite/profile | Existing v5.2.5 workspace upgraded in place after a complete backup. | Data/profile counts, integrity check, startup normalization, board/runtime smoke. | Competing writers, unsafe filesystem, failed migration, or missing recovery evidence blocks acceptance. |
|
||||
|
||||
|
|
|
|||
|
|
@ -1,13 +1,39 @@
|
|||
# Veritas Kanban v6 GA Checklist
|
||||
|
||||
This checklist contains the active stable-release gate for Veritas Kanban
|
||||
6.1.1 and retains the completed 6.1.0 and 6.0.2 evidence below. Command results, platform
|
||||
6.1.2 and retains the completed 6.1.1, 6.1.0, and 6.0.2 evidence below. Command results, platform
|
||||
details, workflow links, limitations, and artifact hashes belong in
|
||||
[v6 Release Candidate Evidence Packet](V6-RC-EVIDENCE-PACKET.md).
|
||||
|
||||
Documentation freshness: 2026-08-22 for Veritas Kanban 6.1.1.
|
||||
Documentation freshness: 2026-08-24 for Veritas Kanban 6.1.2.
|
||||
|
||||
## 6.1.1 Release Gate
|
||||
## 6.1.2 Release Gate
|
||||
|
||||
- [x] Audit issues #1162, #1163, and #1165-#1173 are closed through merged,
|
||||
evidence-linked pull requests; #1164 implementation is merged and awaits
|
||||
the single final regression milestone before closure.
|
||||
- [x] Root, shared, server, web, CLI, MCP, and desktop manifests are 6.1.2.
|
||||
- [x] README, canonical instructions, API reference, compatibility policy,
|
||||
upgrade guide, release notes, canonical GitHub body, freshness record, and
|
||||
changelog are synchronized for 6.1.2.
|
||||
- [x] Runtime paths, storage repositories, provider adapters and lifecycle,
|
||||
credential-aware frontend requests, immutable actions, continuous
|
||||
scanning, critical coverage, dependency cleanup, lint ratchets, and the
|
||||
production Docker contract are represented in release documentation.
|
||||
- [x] Independent and cross-model review remain optional; they are not part of
|
||||
the default delivery or release gate.
|
||||
- [x] The coordinated private security fix is integrated into the candidate and
|
||||
remains private until supported artifacts exist and disclosure is approved.
|
||||
- [ ] One clean final candidate passes the complete Node-floor and current-Node
|
||||
verification matrix with exact counts, skips, retries, image size, and
|
||||
limitations recorded in the evidence packet.
|
||||
- [ ] The release PR merges and its exact merge is published as annotated
|
||||
`v6.1.2` with a live body matching `docs/releases/v6.1.2.md`.
|
||||
- [ ] Signed/notarized macOS assets, updater metadata, installed-app readiness,
|
||||
the live Homebrew cask, and the private advisory disposition are verified.
|
||||
- [ ] Release tracker #1174 closes only after every publication readback passes.
|
||||
|
||||
## Historical 6.1.1 Completed Release Gate
|
||||
|
||||
- [x] Issue #1153 and pull requests #1148, #1149, #1150, #1154, and #1155
|
||||
received an evidence-backed maintainer disposition.
|
||||
|
|
@ -58,36 +84,53 @@ Documentation freshness: 2026-08-22 for Veritas Kanban 6.1.1.
|
|||
Apply `ci:full` to the release pull request and keep it applied through the
|
||||
final candidate synchronization. That single milestone runs the complete
|
||||
workspace suite, critical-path coverage, unsigned desktop artifacts, and
|
||||
Docker image contract. Run the following commands once from the clean 6.1.1
|
||||
release candidate:
|
||||
Docker image contract. Run the following commands once from the clean 6.1.2
|
||||
release candidate at the supported Node floor and current supported Node:
|
||||
|
||||
```bash
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm check:pnpm-settings
|
||||
pnpm check:security-artifacts
|
||||
pnpm check:delivery-cadence
|
||||
pnpm test:ci-scope
|
||||
pnpm audit --prod --audit-level=high
|
||||
pnpm audit:all
|
||||
pnpm check:gitleaks
|
||||
pnpm lint
|
||||
pnpm lint:budget
|
||||
pnpm lint:report
|
||||
pnpm qa:mantine
|
||||
pnpm typecheck
|
||||
pnpm build
|
||||
pnpm test
|
||||
pnpm test:unit
|
||||
pnpm test:e2e
|
||||
pnpm smoke:cli-mcp
|
||||
pnpm test:buzz:compatibility
|
||||
pnpm desktop:test
|
||||
pnpm desktop:build
|
||||
pnpm desktop:check:electron-artifacts
|
||||
pnpm desktop:test:readiness
|
||||
pnpm desktop:dev:fresh
|
||||
pnpm desktop:smoke:mac:local
|
||||
pnpm desktop:package:mac:unsigned
|
||||
pnpm validate:release -- --version 6.1.1
|
||||
pnpm validate:release -- --version 6.1.1 --docker-build
|
||||
pnpm test:release-format
|
||||
pnpm validate:release -- --version 6.1.2 --skip-build-output
|
||||
pnpm validate:release -- --version 6.1.2 --docker-build
|
||||
```
|
||||
|
||||
Mount and inspect the unsigned DMG and ZIP, exercise the visible native
|
||||
single-instance/reopen/clean-close/quit lifecycle with an isolated profile, and
|
||||
run the production image as its non-root user against an isolated volume.
|
||||
Record health, auth, SQLite, static-web, canonical-path, backup, integrity,
|
||||
image-size, and clean-shutdown evidence. The same candidate must pass these
|
||||
gates at Node 22.22.1 and the current supported Node runtime.
|
||||
|
||||
## Distribution And Post-Publication
|
||||
|
||||
All 6.1.1 publication gates are complete. The live GitHub body matches
|
||||
`docs/releases/v6.1.1.md`; the post-publication release validator passes; and
|
||||
the Homebrew cask uses the independently verified published ZIP checksum.
|
||||
The 6.1.2 publication gate is pending the final candidate, release merge, tag,
|
||||
signed/notarized artifacts, independent launch verification, post-publication
|
||||
validator, live Homebrew cask, and approved advisory disposition. Completed
|
||||
6.1.1 evidence remains recorded below and in the evidence packet.
|
||||
|
||||
## Historical 6.0.2 Source And Scope
|
||||
|
||||
|
|
|
|||
|
|
@ -1,15 +1,89 @@
|
|||
# Veritas Kanban v6 Release Candidate Evidence Packet
|
||||
|
||||
This packet records the completed Veritas Kanban 6.1.1 maintenance release and
|
||||
retains historical evidence for the completed 6.1.0 release, the quarantined 6.0.0 prerelease, the 6.0.1
|
||||
This packet records the active Veritas Kanban 6.1.2 audit release candidate and
|
||||
retains historical evidence for the completed 6.1.1 and 6.1.0 releases, the quarantined 6.0.0 prerelease, the 6.0.1
|
||||
stabilization release, and the 6.0.2 desktop recovery hotfix. It separates
|
||||
merged implementation, deterministic conformance, local runtime proof, signed
|
||||
publication, and Homebrew availability.
|
||||
|
||||
Veritas Kanban 6.1.1 is the supported stable v6 release. Do not use 6.0.0 for
|
||||
installation or upgrade validation.
|
||||
Veritas Kanban 6.1.1 remains the supported stable v6 release until 6.1.2 is
|
||||
published and verified. Do not use 6.0.0 for installation or upgrade validation.
|
||||
|
||||
Documentation freshness: 2026-08-22 for the completed Veritas Kanban 6.1.1 release.
|
||||
Documentation freshness: 2026-08-24 for the Veritas Kanban 6.1.2 candidate.
|
||||
|
||||
## 6.1.2 Audit Release Candidate
|
||||
|
||||
| Field | Value |
|
||||
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Release version | 6.1.2 |
|
||||
| Source branch | `release/6.1.2-audit` |
|
||||
| Source baseline | `3851fea93ecfe5119e4092739662443d29059ac7`, `main` after release-gate fix PR #1243 |
|
||||
| Validated candidate | `2a21178df97a00395cfc6c43774a57496a5c1f6a`, the frozen release PR head before this evidence-only update |
|
||||
| Included issues | Audit tracker [#1174](https://github.com/BradGroux/veritas-kanban/issues/1174), findings #1162-#1173, and CodeQL baseline #1231 |
|
||||
| Public implementation | #1162, #1163, and #1165-#1173 are closed through merged work; #1164 implementation is merged and remains open only for final regression evidence; coordinated remediation and release-gate fixes are merged through #1236, #1239, #1241, and #1243 |
|
||||
| Private security blocker | Remediation is integrated into the candidate. Release verification and disclosure disposition remain pending, and no exploit-relevant detail is included here |
|
||||
| Publication state | Not published. The final matrix is complete on the frozen candidate; merge, tag, GitHub release, signed desktop workflow, Homebrew cask, and advisory disposition remain pending |
|
||||
|
||||
### 6.1.2 issue and pull request traceability
|
||||
|
||||
| Phase | Issue | Merged evidence |
|
||||
| -------------------- | --------------------------------------------------------------- | -------------------------- |
|
||||
| Verification | #1172 deterministic and milestone-scoped test gates | #1175, #1177, #1181, #1228 |
|
||||
| Verification | #1171 native-loader Vite/Vitest configuration | #1178 |
|
||||
| Supply chain | #1167 immutable actions | #1179 |
|
||||
| Security gates | #1168 continuous scanning | #1180 |
|
||||
| Coverage | #1169 critical-path baselines and ratchets | #1183 |
|
||||
| Runtime paths | #1162 canonical `DATA_DIR` behavior | #1184 |
|
||||
| Persistence | #1163 storage boundary restoration | #1190-#1220 |
|
||||
| Provider runtime | #1164 lifecycle and provider decomposition | #1223-#1230 |
|
||||
| Frontend API | #1165 credential-aware requests | #1218 |
|
||||
| Dependencies | #1170 unused direct dependencies | #1217 |
|
||||
| Container | #1166 production runtime and size contract | #1222 |
|
||||
| Type safety | #1173 lint-debt ratchet | #1221 |
|
||||
| CodeQL baseline | #1231 initial alert triage, remediation, and disposition | #1232-#1235 |
|
||||
| Coordinated security | Private release blocker integrated without premature disclosure | #1236 |
|
||||
| Release validation | Recovery-key alphabet and WebSocket header forwarding | #1238, #1239 |
|
||||
| Release validation | Same-task lifecycle invocation ordering | #1240, #1241 |
|
||||
| Release validation | Sanitized URI prefix validation | #1242, #1243 |
|
||||
|
||||
The initial CodeQL baseline contained 195 open alerts. All were reviewed: 67
|
||||
were closed through source remediation and 128 received specific,
|
||||
evidence-backed dispositions. The post-merge default-branch Security Gates run
|
||||
[`32700390853`](https://github.com/BradGroux/veritas-kanban/actions/runs/32700390853)
|
||||
completed successfully at `1cdcd6ec60e3f48b6017146b2583fa82f7061c68`
|
||||
with zero open alerts.
|
||||
|
||||
The 2026-08-24 pre-release GitHub security readback confirms Dependabot
|
||||
vulnerability alerts and security updates are enabled, secret scanning and
|
||||
push protection are enabled, and open Dependabot, secret-scanning, and
|
||||
default-branch CodeQL alert counts are all zero. Every external workflow action
|
||||
reference is pinned to a full commit SHA. These drift-prone settings are
|
||||
rechecked against the final release merge before publication.
|
||||
|
||||
Final-milestone preflight on 2026-08-24 found local Node 26.7.0, pnpm 11.1.1,
|
||||
Git 2.55.0, and an available Docker 29.2.1 server. The Node 22 floor remains
|
||||
the `ci:full` runner gate; no separate local Node 22 installation is present.
|
||||
The required macOS signing secret names and the complete App Store Connect
|
||||
notarization secret-name set are configured, without reading their values. No
|
||||
Veritas Kanban app or Homebrew cask is currently installed on the validation
|
||||
host, so the post-publication installation will not replace an active install.
|
||||
|
||||
### 6.1.2 verification matrix
|
||||
|
||||
The final matrix ran once on the fully integrated candidate. The checked-in
|
||||
evidence update is documentation-only and does not alter the validated runtime.
|
||||
|
||||
| Gate | Environment | Candidate result |
|
||||
| ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| Frozen install, package-manager, security-artifact, delivery-cadence, and CI-scope policy | Local Node 26.7.0 and CI Node 22; pnpm 11.1.1 | Pass. Frozen install completed; package-manager, 1,864-file security-artifact, 18/18 delivery-cadence, and 18/18 CI-scope gates passed |
|
||||
| Typecheck, lint, 458-warning budget, lint report, production/full audit, and gitleaks | Local Node 26.7.0 and CI Node 22 | Pass. Typecheck and lint completed with zero errors and the exact 458-warning budget; production and full audits found no known vulnerabilities; gitleaks passed |
|
||||
| Workspace and orchestration units | Local clean worktree and [CI run 32732019845](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019845) | Pass. Local workspace packages reported 4,289 passed and 24 skipped, plus 3/3 root orchestration tests. CI independently reported server 3,376 passed/5 skipped, web 780 passed, CLI 62 passed, MCP 71 passed/19 skipped, and dual-storage parity 4/4 |
|
||||
| Critical-path coverage ratchets | CI Node 22 on frozen candidate | Pass. All seven boundaries passed: server dispatch 65.2% lines, auth 59.05%, storage 50.45%, web 55.25%, CLI 52.07%, MCP 52.39%, and desktop 66.24%; [coverage artifact](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019845/artifacts/9521857932) SHA-256 `395ae4aef57b8dcb24eabe2ad2ac628f8bbe51564195b7525e5c2be57613a096` |
|
||||
| Playwright Chromium and WebKit | [Scheduled QA run 32732019821](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019821) | Pass. 37/37 cases passed in 3.6 minutes with zero retries; k6 completed 7/7 checks, 5 requests, zero request failures, and one uninterrupted smoke iteration |
|
||||
| Build, Mantine QA, CLI/MCP smoke | Local clean worktree and CI Node 22 | Pass. Build and Mantine QA passed; initial JS/CSS were 242.3/53.7 KiB gzip. CLI/MCP compatibility had zero failures or warnings; two live read/write checks were explicitly skipped because the isolated profile had no `VK_API_KEY` |
|
||||
| Desktop tests, build, readiness, native lifecycle, and unsigned package | macOS arm64 isolated profile and [artifact run 32732019898](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019898) | Pass. Desktop 67/67, Electron artifacts 4/4, readiness 7/7, package smoke, visible setup/readiness, single-instance, close/reopen, and clean quit all passed. Mounted DMG and ZIP report 6.1.2 arm64. DMG: 265,821,857 bytes, SHA-256 `562aa08c1d93653227aa0deee7cc0020f42bfe4ead9e404005fbe67a87822d7a`; ZIP: 270,676,980 bytes, SHA-256 `e1dc99f95e1c3396cda78c5e38582cdc7554baf2757aa57cfee411ba6a94de60`. CI macOS/Linux/Windows unsigned artifacts all passed |
|
||||
| Production Docker build, image-size contract, and runtime smoke | amd64 [Docker contract run 32732019831](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019831) | Pass. Image size 571,628,184 bytes, below 600,000,000; non-root user, version, mounted paths, SQLite, backup, auth, static web, health, bcrypt, and clean shutdown passed |
|
||||
| Release-format and release validators | Version 6.1.2 | Pass with one classified host limitation. Canonical release format passed 3/3 and every source/build-output check passed. The local Docker-enabled wrapper reached image assembly before Docker Desktop returned an `overlayfs` containerd metadata I/O error on a full host filesystem; the clean CI Docker build and complete runtime contract passed on the same frozen source. Live GitHub/tag/body validation remains a post-publication gate |
|
||||
|
||||
## 6.1.1 Maintenance Release Candidate
|
||||
|
||||
|
|
@ -318,6 +392,14 @@ test.
|
|||
No private data, credential value, raw provider conversation, or unrestricted
|
||||
runtime profile is retained in this packet.
|
||||
|
||||
## 6.1.2 Publication Evidence
|
||||
|
||||
Publication has not started. This section will record the release PR merge SHA,
|
||||
annotated tag object and peeled commit, GitHub release URL and exact body
|
||||
readback, Desktop Release workflow, signed/notarized artifact names, sizes,
|
||||
SHA-256 values, blockmaps, updater metadata, Gatekeeper/stapling/launch proof,
|
||||
Homebrew PR and merge SHA, live cask validation, and approved advisory state.
|
||||
|
||||
## 6.1.1 Publication Evidence
|
||||
|
||||
Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.
|
||||
|
|
|
|||
|
|
@ -1,46 +1,50 @@
|
|||
# Veritas Kanban 6.1.1 Release Notes
|
||||
# Veritas Kanban 6.1.2 Release Notes
|
||||
|
||||
Veritas Kanban 6.1.1 is a focused maintenance release for the agentic-control platform delivered in 6.1.0. It restores reliable Task Detail drawer scrolling after the Mantine tabs migration, adds browser-level regression coverage, updates the supported dependency set, and refreshes transitive security floors.
|
||||
Veritas Kanban 6.1.2 completes the reliability, security, persistence, provider-runtime, CI, container, and supportability audit tracked by [#1174](https://github.com/BradGroux/veritas-kanban/issues/1174). It is a backward-compatible patch release for 6.1.1.
|
||||
|
||||
> Veritas Kanban 6.0.0 remains a quarantined prerelease. Version 6.1.1 supersedes 6.1.0 as the supported stable v6 release after signed assets and updater metadata are published.
|
||||
> Veritas Kanban 6.0.0 remains a quarantined prerelease. Version 6.1.2 becomes the supported stable v6 release only after the annotated tag, signed assets, updater metadata, and Homebrew cask are published and verified.
|
||||
|
||||
## 6.1.1 Maintenance Changes
|
||||
## Audit Outcomes And Traceability
|
||||
|
||||
Long Task Detail content is height-constrained and scrollable again. The regression gate verifies the shared overlay's flex-column layout, real overflow, and wheel-driven scroll movement in Chromium. Nested task-card controls no longer activate the card, preserving touch status selection in WebKit after the Mantine 9.5 update. File-backed workflow operations now await storage-directory readiness, preventing immediate startup requests from racing directory creation. The dependency maintenance pass updates supported minor and patch versions, adopts Chalk 6, and refreshes transitive override floors so production and full dependency audits report no known vulnerabilities.
|
||||
| Issue | Operational outcome | Pull requests |
|
||||
| --- | --- | --- |
|
||||
| [#1162](https://github.com/BradGroux/veritas-kanban/issues/1162) | Canonical runtime data paths, legacy discovery, and migration compatibility | #1184 |
|
||||
| [#1163](https://github.com/BradGroux/veritas-kanban/issues/1163) | Service persistence restored behind explicit file and SQLite repositories | #1190-#1220 |
|
||||
| [#1164](https://github.com/BradGroux/veritas-kanban/issues/1164) | Provider launch, runtime, event, completion, mutation, and adapter contracts decomposed | #1223-#1230 |
|
||||
| [#1165](https://github.com/BradGroux/veritas-kanban/issues/1165) | Credential-aware JSON, blob, stream, and download API helpers | #1218 |
|
||||
| [#1166](https://github.com/BradGroux/veritas-kanban/issues/1166) | Measured non-root production Docker runtime and size contract | #1222 |
|
||||
| [#1167](https://github.com/BradGroux/veritas-kanban/issues/1167) | Immutable external GitHub Actions | #1179 |
|
||||
| [#1168](https://github.com/BradGroux/veritas-kanban/issues/1168) | Continuous CodeQL, dependency, and secret scanning | #1180 |
|
||||
| [#1169](https://github.com/BradGroux/veritas-kanban/issues/1169) | Risk-weighted critical-path coverage baselines and ratchets | #1183 |
|
||||
| [#1170](https://github.com/BradGroux/veritas-kanban/issues/1170) | Four unused direct dependencies removed | #1217 |
|
||||
| [#1171](https://github.com/BradGroux/veritas-kanban/issues/1171) | Native-loader-compatible Vite and Vitest configuration | #1178 |
|
||||
| [#1172](https://github.com/BradGroux/veritas-kanban/issues/1172) | Deterministic, milestone-scoped workspace and browser gates | #1175, #1177, #1181, #1228 |
|
||||
| [#1173](https://github.com/BradGroux/veritas-kanban/issues/1173) | Server lint-warning budget reduced from 600 to 458 | #1221 |
|
||||
| [#1231](https://github.com/BradGroux/veritas-kanban/issues/1231) | Initial CodeQL baseline triaged, remediated, and dispositioned | #1232-#1235 |
|
||||
|
||||
jsdom 30 remains deferred in Dependabot because it exceeds the documented Node.js patch floor and breaks the current changed-test suite; jsdom 29 patch updates remain enabled. Version 6.1.1 does not change the storage schema, public REST API, provider contracts, configuration, or migration requirements from 6.1.0.
|
||||
## Persistence And Runtime Paths
|
||||
|
||||
## Harness Support On Equal Footing
|
||||
`DATA_DIR` and `VERITAS_DATA_DIR` now resolve through one canonical path contract. Live services, health, backup, integrity, migrations, and the production container use the same root. Legacy locations remain discoverable and migrate through explicit compatibility paths rather than creating split authoritative state.
|
||||
|
||||
Every supported harness is now discovered, diagnosed, dispatched, observed, and completed through the same `harness-support-profile/v1`, `provider-runtime-manifest/v1`, immutable launch-manifest, approval, tool, credential, sandbox, phase-authority, and completion contracts. Settings, API diagnostics, telemetry, `vk doctor --json`, and dispatch consume the same redacted readiness evidence.
|
||||
Service-layer filesystem access has been moved into deep repository modules across activity, progress, status history, scheduled deliverables, workflows, broadcasts, conflicts, delegation, ceremony, error analyses, permissions, lifecycle configuration, scheduler, reflection, chat, tasks, telemetry, and managed content. File and SQLite backends preserve their containment, locking, atomic-write, and parity contracts.
|
||||
|
||||
Equal footing does not claim identical native capabilities. Veritas probes the exact installed build and transport, persists capability evidence, and blocks unsupported lifecycle, tool, approval, sandbox, network, phase, or completion behavior before attempt creation. Provider upgrades invalidate prior conformance evidence until the new build passes its deterministic fixtures.
|
||||
## Provider Runtime And Frontend API
|
||||
|
||||
Buzz Agent and Grok Build use ACP transports with exact initialize and capability evidence. Codex CLI, SDK, and app-server retain their distinct supervised lifecycles. Claude Code uses a strict bare-mode stream, GitHub Copilot CLI remains bounded to its public-preview ACP contract, Hermes retains one-shot execution, and OpenClaw retains explicit gateway policy. Buzz relay communication remains independent from execution authority: Buzz transports signed messages while Veritas owns tasks, attempts, tools, approvals, and completion.
|
||||
Provider work now flows through cohesive launch-compiler, runtime-resolution, event-interpreter, completion, attempt-lifecycle, and adapter-registry boundaries. Explicitly executable providers retain their supported behavior. Provider-less, unknown, or profile/adapter-mismatched records still fail before attempt creation and never route through an implicit OpenClaw fallback.
|
||||
|
||||
Repository-facing instructions are documented in [AGENTS.md](../AGENTS.md) and the reusable [agent template](AGENTS-TEMPLATE.md). Harness installation, authentication, capability limits, and remediation are documented in [Agent Providers](AGENT-PROVIDERS.md), with exact evidence in the [Harness Compatibility Matrix](HARNESS-COMPATIBILITY.md).
|
||||
Frontend JSON, blob, stream, log, and download operations now share credential-aware API boundaries. Cross-origin `VITE_API_URL` cookie authentication, configured base paths, and server error envelopes remain consistent across supported workflows.
|
||||
|
||||
## Governed Execution And Recovery
|
||||
## Verification, Security, Dependencies, And Container
|
||||
|
||||
Run-scoped egress enforcement resolves and pins allowed destinations, routes governed traffic through the gateway, applies protocol, host, port, HTTP method, and normalized path rules, and records redacted decision evidence. Required enforcement fails closed when a process can bypass or cannot prove the gateway.
|
||||
Ordinary pull requests now run source-policy, lint, typecheck, build, dependency-audit, secret-scanning, and CodeQL checks without repeatedly executing workspace tests, coverage, E2E, desktop packaging, load, or Docker contracts. Those expensive gates run at explicit `ci:full`, scheduled, manual, integration, security, and release milestones.
|
||||
|
||||
Durable admission control now applies capacity, aggregate budgets, fairness, cancellation, queue leases, and circuit breaking to direct tasks, workflows, retries, fallbacks, continuations, provider handoffs, and child agents through one execution-tree contract. Agent-dependency health feeds load shedding so an unhealthy tree cannot continue amplifying provider, host, or workspace pressure.
|
||||
The complete final release matrix is recorded in [v6 Release Candidate Evidence Packet](V6-RC-EVIDENCE-PACKET.md). Historical test counts are not reused as 6.1.2 evidence.
|
||||
|
||||
Append-only admission snapshots now complete each serialized write before syncing, preventing short filesystem writes from truncating durable reservation evidence. Knowledge-collection routes also share the exact server permission prefix, keeping client discovery and server enforcement in fail-closed parity.
|
||||
The production Docker closure excludes unrelated workspace dependencies, runs as a non-root user, and has architecture-specific size ceilings. The implementation baseline measured 195,910,880 bytes on arm64 against a 200,000,000-byte ceiling and 571,590,173 bytes on amd64 against a 600,000,000-byte ceiling; the release candidate is remeasured before publication.
|
||||
|
||||
Durable goals survive turns, restarts, and provider continuations without inventing completion. Memory extraction is reviewed and attributable. Background commands and monitors are supervisor-owned, repetitive or stalled runs receive bounded recovery, and oversized output spills into governed artifacts instead of exhausting the active context.
|
||||
Four verified unused direct dependencies were removed. The server lint-warning budget dropped from 600 to 458 without weakening rules or adding broad suppressions. A coordinated private remediation is integrated through #1236; technical details stay in the advisory workflow pending supported artifacts and explicit disclosure approval. Final milestone validation also corrected recovery-key alphabet generation, WebSocket upgrade header forwarding, same-task lifecycle ordering, and sanitized URI prefix handling through #1239, #1241, and #1243.
|
||||
|
||||
## Knowledge Collections And Integrity
|
||||
|
||||
Workspace knowledge collections support classified immutable sources, cited and versioned derived pages, reviewed ingestion dry runs, atomic apply and reversal, scoped keyword and QMD search, query promotion, and cited work-product export. File and SQLite backends preserve the same workspace, digest, attribution, idempotency, contradiction, graph, activity, and redaction contracts.
|
||||
|
||||
Deterministic integrity linting finds structural graph errors, invalid schemas and metadata, provenance gaps, source-hash drift, invalid citation locations, freshness violations, orphan pages, missing canonical terms, unanswered research questions, contradictions, near-duplicates, supersession candidates, and evidence gaps. Material claims have attributable, evidence-linked, reversible lifecycle controls, so disputed or superseded statements remain visible and reviewable rather than being silently overwritten.
|
||||
|
||||
## Workspace Checkpoints And Rewind
|
||||
|
||||
Turn-boundary checkpoints capture run-owned Git, index, file, exclusion, ownership, conversation, and attributable provider-diff state. Rewind is preview-first, digest-bound, conflict-aware, and limited to explicit selected paths. The control route can quiesce an exact active Codex app-server turn and fork an earlier approved turn into a new provider thread.
|
||||
|
||||
Ambiguous attribution, unsupported providers, stale runtime evidence, external edits, and unresolved ownership conflicts fail closed. Failed storage transactions preserve descendant state and do not mutate paths outside the approved preview.
|
||||
The initial 195-alert CodeQL baseline was reviewed alert by alert: 67 findings were fixed and 128 non-exploitable alerts received evidence-backed dispositions. Validated request, logging, persisted-key, file-handling, and sandbox-read findings were fixed in #1232-#1235. Alerts that were limited to test fixtures or were already contained by explicit authentication, path, descriptor, ownership, or atomic-write controls received documented dispositions rather than speculative code churn. The post-merge default-branch analysis reports zero open alerts.
|
||||
|
||||
## Install Or Upgrade
|
||||
|
||||
|
|
@ -57,31 +61,30 @@ For a first installation:
|
|||
brew install --cask bradgroux/tap/veritas-kanban
|
||||
```
|
||||
|
||||
Manual installation uses the signed and notarized macOS arm64 DMG or ZIP from the [v6.1.1 release](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.1). Back up the complete stopped-writer workspace before upgrading and keep the backup until the new runtime is accepted.
|
||||
Manual installation uses the signed and notarized macOS arm64 DMG or ZIP from the [v6.1.2 release](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.2) after publication. Back up the complete stopped-writer workspace before upgrading and keep the backup until the new runtime is accepted.
|
||||
|
||||
## Breaking Changes And Migration Warnings
|
||||
|
||||
Veritas Kanban 6.1.1 retains SQLite migrations 30 to 33 from 6.1.0. No new migration runs when upgrading from 6.1.0. Rollback to an older schema still requires restoring the stopped-writer pre-upgrade backup; do not open migrated data with an older binary.
|
||||
There is no public REST API version change, configuration breaking change, or new SQLite schema migration in 6.1.2. Migrations remain at 30 through 33. Runtime-path normalization can move legacy files into the configured canonical data directory; verify the selected data root, health, integrity, and backup evidence before resuming writers or automation.
|
||||
|
||||
The public REST API remains mounted at `v1`. Provider-less or adapter/profile-mismatched records do not fall through to OpenClaw. Unknown or changed provider builds lose certification until current probes and deterministic fixtures pass. Claude Code does not launch with `--dangerously-skip-permissions`. Credential-bound MCP servers remain available only through the mediated run-scoped bridge.
|
||||
Rollback is restore-first. Stop every writer. Reinstall 6.1.1 only when the current data contracts remain compatible; otherwise restore the complete pre-upgrade stopped-writer workspace. Never copy an older database over a live instance.
|
||||
|
||||
## Known Limitations
|
||||
|
||||
Buzz Agent sessions remain in-memory and do not support session load/resume. Buzz files, reactions, forums, direct messages, and destructive edit/delete projection are not bridged. GitHub Copilot CLI ACP remains public preview. Grok Build's stable artifact still self-reports alpha and cannot be fully traced to the current public source tree. Claude Code's complete CLI implementation is not public, so certification is bound to exact release behavior and checked-in fixtures.
|
||||
Buzz Agent sessions remain in-memory and do not support session load/resume. Buzz files, reactions, forums, direct messages, and destructive edit/delete projection are not bridged. GitHub Copilot CLI ACP remains public preview. Grok Build's stable artifact still self-reports alpha and cannot be fully traced to the current public source tree. Claude Code's complete CLI implementation is not public, so certification remains bound to exact release behavior and checked-in fixtures.
|
||||
|
||||
Deterministic compatibility does not prove provider authentication, subscription availability, quota, or live inference. Linux and Windows desktop artifacts remain unsigned previews; signed and notarized macOS arm64 is the supported stable desktop distribution.
|
||||
|
||||
## Release Artifacts
|
||||
|
||||
The supported stable desktop release publishes signed and notarized `Veritas-Kanban-6.1.1-mac-arm64.dmg` and `Veritas-Kanban-6.1.1-mac-arm64.zip`, blockmaps, SHA-256 sidecars, and `latest-mac.yml` updater metadata from the annotated `v6.1.1` tag. Publication is complete only after GitHub assets, signature, Gatekeeper, stapling, updater, downloaded-app launch, and Homebrew installation have been verified.
|
||||
The supported stable desktop release publishes signed and notarized `Veritas-Kanban-6.1.2-mac-arm64.dmg` and `Veritas-Kanban-6.1.2-mac-arm64.zip`, blockmaps, SHA-256 sidecars, and `latest-mac.yml` updater metadata from the annotated `v6.1.2` tag. Exact sizes, hashes, signing, notarization, stapling, Gatekeeper, launch, updater, workflow, release, and Homebrew evidence are recorded after publication in [v6 Release Candidate Evidence Packet](V6-RC-EVIDENCE-PACKET.md).
|
||||
|
||||
## Documentation And Evidence
|
||||
|
||||
- [Agent guide and reusable template](AGENTS-TEMPLATE.md)
|
||||
- [Agent provider setup and operations](AGENT-PROVIDERS.md)
|
||||
- [Harness compatibility matrix](HARNESS-COMPATIBILITY.md)
|
||||
- [Buzz integration guide](BUZZ-INTEGRATION.md)
|
||||
- [v6 runtime architecture](architecture/V6-AGENT-RUNTIME-CONTROL-PLANE.md)
|
||||
- [v6 compatibility and release policy](V6-COMPATIBILITY-AND-RELEASE-POLICY.md)
|
||||
- [v6 upgrade and administration guide](V6-UPGRADE-INSTALL-ADMIN-GUIDE.md)
|
||||
- [v6 release candidate evidence](V6-RC-EVIDENCE-PACKET.md)
|
||||
- [Changelog](../CHANGELOG.md)
|
||||
|
|
|
|||
|
|
@ -1,15 +1,15 @@
|
|||
# Veritas Kanban v6 Upgrade, Install, Remote, And Admin Guide
|
||||
|
||||
This is the release-facing operator guide for Veritas Kanban 6.1.1. The
|
||||
This is the release-facing operator guide for Veritas Kanban 6.1.2. The
|
||||
detailed provider commands live in [Agent Providers](AGENT-PROVIDERS.md), the
|
||||
machine-readable support contract is summarized in
|
||||
[Harness Compatibility](HARNESS-COMPATIBILITY.md), and Buzz relay setup lives
|
||||
in [Buzz Integration](BUZZ-INTEGRATION.md).
|
||||
|
||||
Documentation freshness: 2026-08-22 for Veritas Kanban 6.1.1.
|
||||
Documentation freshness: 2026-08-24 for Veritas Kanban 6.1.2.
|
||||
|
||||
Do not install 6.0.0. It is retained as a quarantined prerelease. Version 6.1.1
|
||||
is the current supported stable v6 build and supersedes 6.1.0.
|
||||
Do not install 6.0.0. It is retained as a quarantined prerelease. Version 6.1.2
|
||||
supersedes 6.1.1 after the signed release and Homebrew cask are published.
|
||||
|
||||
## Fresh Mac Desktop Install
|
||||
|
||||
|
|
@ -21,8 +21,8 @@ brew install --cask veritas-kanban
|
|||
```
|
||||
|
||||
Manual installation uses
|
||||
`Veritas-Kanban-6.1.1-mac-arm64.zip` from the
|
||||
[v6.1.1 GitHub release](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.1).
|
||||
`Veritas-Kanban-6.1.2-mac-arm64.zip` from the
|
||||
[v6.1.2 GitHub release](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.2).
|
||||
Move `Veritas Kanban.app` into `/Applications`, launch it normally, and verify
|
||||
Settings -> Maintenance before enabling an agent or external integration.
|
||||
|
||||
|
|
@ -30,7 +30,7 @@ For a new board:
|
|||
|
||||
1. Choose Board Only unless agent execution is required immediately.
|
||||
2. Create the local admin password and retain the recovery key securely.
|
||||
3. Confirm `/api/health` reports version 6.1.1.
|
||||
3. Confirm `/api/health` reports version 6.1.2.
|
||||
4. Create a governed backup before adding external credentials or relay
|
||||
mappings.
|
||||
|
||||
|
|
@ -58,14 +58,14 @@ equivalent v5.2.5 self-hosted workspace.
|
|||
preferred port are stopped before copying data.
|
||||
5. Preserve the complete workspace, not only the SQLite file. Keep the backup
|
||||
through release acceptance.
|
||||
6. Install v6.1.1 without replacing the workspace.
|
||||
6. Install v6.1.2 without replacing the workspace.
|
||||
7. Launch with the same profile. If setup appears for a populated database,
|
||||
choose **Use Existing Data**. Do not rerun file migration or restore over the
|
||||
populated database.
|
||||
8. Wait for the exact-version readiness gate:
|
||||
|
||||
```bash
|
||||
EXPECTED_VERSION=6.1.1
|
||||
EXPECTED_VERSION=6.1.2
|
||||
pnpm desktop:wait:ready -- --expected-version "$EXPECTED_VERSION"
|
||||
```
|
||||
|
||||
|
|
@ -82,8 +82,10 @@ The public API remains `v1`. v6 adds provider, approval, lifecycle, tool,
|
|||
credential, compatibility, Buzz, and conformance records without requiring a
|
||||
new API mount.
|
||||
|
||||
Veritas Kanban 6.1.1 retains the SQLite workspace migrations 30 to 33 from
|
||||
6.1.0. Keep the stopped-writer
|
||||
Veritas Kanban 6.1.2 retains the SQLite workspace migrations 30 to 33 from
|
||||
6.1.0. No new schema migration runs when upgrading from 6.1.1. Runtime-path
|
||||
normalization can move legacy files into the configured canonical data root.
|
||||
Keep the stopped-writer
|
||||
backup until collection, task, workflow, provider, and board data have been
|
||||
accepted. Rollback to an older schema requires restoring that backup; do not
|
||||
open migrated data with an older binary.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Veritas Kanban v6 Agent Runtime Control Plane
|
||||
|
||||
This document defines the supported v6.1.1 architecture for executable agent
|
||||
This document defines the supported v6.1.2 architecture for executable agent
|
||||
harnesses and Buzz integration. It is the version-level composition of the
|
||||
individual contract documents for
|
||||
[ACP](ACP-PROVIDER-V1.md),
|
||||
|
|
@ -9,7 +9,7 @@ individual contract documents for
|
|||
[tool control](TOOL-CONTROL-PLANE-V1.md), and
|
||||
[runtime hooks](RUNTIME-HOOK-V1.md).
|
||||
|
||||
Documentation freshness: 2026-08-22 for Veritas Kanban 6.1.1.
|
||||
Documentation freshness: 2026-08-24 for Veritas Kanban 6.1.2.
|
||||
|
||||
## Authority Model
|
||||
|
||||
|
|
@ -43,6 +43,12 @@ owns signed delivery, not Veritas task or completion state.
|
|||
Provider profiles select an adapter. No unknown executable, provider-less
|
||||
record, or unsupported profile can route through an implicit fallback.
|
||||
|
||||
The server resolves these contracts through a provider adapter registry. The
|
||||
registry owns the task-envelope renderer, runtime probe, event mapper, start
|
||||
dispatch, and stop semantics for each exact executable provider. Attempt state
|
||||
transitions remain centralized in the lifecycle coordinator, while terminal
|
||||
completion and recovery consume the same persisted provider evidence.
|
||||
|
||||
## Run Lifecycle
|
||||
|
||||
```text
|
||||
|
|
|
|||
|
|
@ -32,15 +32,15 @@ This guide walks you through every self-hosting scenario — from running locall
|
|||
|
||||
| Requirement | Version | Install |
|
||||
| ----------- | ------- | ------------------------------------------------------------ |
|
||||
| Node.js | 22.0.0+ | https://nodejs.org or `nvm install 22` |
|
||||
| pnpm | 11.1.1+ | `corepack enable && corepack prepare pnpm@11.1.1 --activate` |
|
||||
| Git | any | https://git-scm.com |
|
||||
| Node.js | 22.22.1+ | https://nodejs.org or `nvm install 22` |
|
||||
| pnpm | 11.1.1 | `corepack enable && corepack prepare pnpm@11.1.1 --activate` |
|
||||
| Git | 2.38+ | https://git-scm.com |
|
||||
|
||||
Verify:
|
||||
|
||||
```bash
|
||||
node --version # v22.x.x
|
||||
pnpm --version # 11.x.x
|
||||
node --version # v22.22.1 or newer
|
||||
pnpm --version # 11.1.1
|
||||
```
|
||||
|
||||
---
|
||||
|
|
@ -468,6 +468,10 @@ The `DATA_DIR=/app/data` volume holds all persistent data:
|
|||
└── logs/ # Application logs
|
||||
```
|
||||
|
||||
This tree is illustrative, not exhaustive. Veritas also stores workflows,
|
||||
runtime evidence, telemetry, provider records, and other governed domains under
|
||||
the same canonical root. Back up the entire stopped-writer volume.
|
||||
|
||||
**Without a named volume, data is lost on every `docker compose down`.** Always use a volume or bind mount.
|
||||
|
||||
For `VERITAS_STORAGE=sqlite`, persistence is not enough: the authoritative
|
||||
|
|
@ -614,8 +618,8 @@ Set `PROMETHEUS_METRICS_TOKEN` on the Veritas server to the same secret, or use
|
|||
|
||||
| Variable | Default | Description |
|
||||
| -------------------------- | -------------------- | ------------------------------------------------------- |
|
||||
| `VERITAS_DATA_DIR` | `.veritas-kanban` | Config, logs, internal state (relative to project root) |
|
||||
| `DATA_DIR` | `/app/data` (Docker) | Mapped data dir inside Docker container |
|
||||
| `VERITAS_DATA_DIR` | Project root | Storage root used when `DATA_DIR` is unset |
|
||||
| `DATA_DIR` | `/app/data` (Docker) | Preferred storage root; takes precedence |
|
||||
| `TELEMETRY_RETENTION_DAYS` | `30` | Days to keep telemetry event files |
|
||||
| `TELEMETRY_COMPRESS_DAYS` | `7` | Days after which telemetry files are gzip-compressed |
|
||||
|
||||
|
|
|
|||
|
|
@ -103,7 +103,7 @@ Don't use it when:
|
|||
|
||||
### Prerequisites
|
||||
|
||||
- Node.js ≥ 22
|
||||
- Node.js ≥ 22.22.1
|
||||
- The Veritas Kanban server running (`pnpm dev` or production)
|
||||
- pnpm (for building from source)
|
||||
- No OpenClaw requirement unless OpenClaw is the MCP client or agent runner you choose
|
||||
|
|
@ -844,10 +844,10 @@ Configure telemetry retention in `server/.env`:
|
|||
|
||||
| Component | Version | Notes |
|
||||
| ------------------ | ------------ | --------------------------- |
|
||||
| MCP server package | `6.1.1` | Matches VK server version |
|
||||
| MCP server package | `6.1.2` | Matches VK server version |
|
||||
| MCP SDK | `1.29.0` | `@modelcontextprotocol/sdk` |
|
||||
| MCP protocol | `2025-11-25` | Latest stable spec |
|
||||
| Node.js | `≥ 22` | Matches the repo runtime |
|
||||
| Node.js | `≥ 22.22.1` | Matches the repo runtime |
|
||||
| TypeScript | `6.0+` | Build dependency only |
|
||||
|
||||
**Breaking change policy:**
|
||||
|
|
@ -888,4 +888,4 @@ The `findTask` utility matches the last N characters of a task ID (minimum 6). I
|
|||
|
||||
---
|
||||
|
||||
_Last updated: 2026-08-22 · VK v6.1.1 · 42 tools / 9 categories_
|
||||
_Last updated: 2026-08-24 · VK v6.1.2 · 42 tools / 9 categories_
|
||||
|
|
|
|||
61
docs/releases/v6.1.2.md
Normal file
61
docs/releases/v6.1.2.md
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
Veritas Kanban 6.1.2 completes the repository-wide reliability, security, storage, provider-runtime, CI, container, and supportability audit. It is a backward-compatible patch release for 6.1.1 with no public API or SQLite schema-version change.
|
||||
|
||||
## What changed
|
||||
|
||||
- **One runtime data root.** Paths, migration, backup, integrity, health, and Docker mounts use the canonical `DATA_DIR` contract.
|
||||
- **Storage boundary restored.** File and SQLite repositories own containment, locking, atomicity, and compatibility behavior.
|
||||
- **Explicit provider adapters.** Launch, probes, events, completion, mutation, and stop behavior fail closed without implicit fallback.
|
||||
- **One authenticated API client.** JSON, blob, stream, and download operations preserve credentials, base paths, and error envelopes.
|
||||
- **Milestone-scoped tests.** Ordinary pull requests stay fast; complete test and artifact gates run at declared integration and release milestones.
|
||||
- **Continuous supply-chain controls.** CodeQL, dependency alerts, secret scanning, immutable actions, and policy guards remain active.
|
||||
- **Resolved CodeQL baseline.** Reviewed all 195 initial alerts: fixed 67, dispositioned 128, and left zero open on the default branch.
|
||||
- **Measured production container.** The non-root runtime closure verifies health, auth, SQLite, static web, data paths, and size ceilings.
|
||||
- **Lower maintenance debt.** Four unused dependencies were removed and the server warning budget fell from 600 to 458.
|
||||
- **Coordinated security hardening.** The private remediation is integrated; disclosure remains gated on supported artifacts and approval.
|
||||
- **Release-gate corrections.** Runtime boundary behavior now matches its checked-in contracts.
|
||||
|
||||
## Issue and pull request traceability
|
||||
|
||||
| Audit issue | Outcome | Pull requests |
|
||||
| --- | --- | --- |
|
||||
| #1162 | Canonical runtime data paths and legacy compatibility | #1184 |
|
||||
| #1163 | Service/storage boundary restored across persisted domains | #1190-#1220 |
|
||||
| #1164 | Provider and attempt lifecycle decomposition | #1223-#1230 |
|
||||
| #1165 | Credential-aware frontend API migration | #1218 |
|
||||
| #1166 | Production Docker size and runtime contract | #1222 |
|
||||
| #1167 | Immutable GitHub Actions | #1179 |
|
||||
| #1168 | Continuous security scanning | #1180 |
|
||||
| #1169 | Critical-path coverage baselines and ratchets | #1183 |
|
||||
| #1170 | Unused dependency removal | #1217 |
|
||||
| #1171 | Native-loader-compatible Vite and Vitest configuration | #1178 |
|
||||
| #1172 | Deterministic, milestone-scoped test gates | #1175, #1177, #1181, #1228 |
|
||||
| #1173 | Server type-safety lint-debt ratchet | #1221 |
|
||||
| #1231 | Initial CodeQL alert baseline resolved | #1232-#1235 |
|
||||
| #1238 | Recovery-key alphabet and WebSocket header forwarding | #1239 |
|
||||
| #1240 | Same-task lifecycle invocation ordering | #1241 |
|
||||
| #1242 | Sanitized URI prefix validation | #1243 |
|
||||
|
||||
## Install or upgrade
|
||||
|
||||
Back up the complete stopped-writer workspace before upgrading and retain the backup until the new runtime is accepted.
|
||||
|
||||
```bash
|
||||
brew update
|
||||
brew upgrade --cask bradgroux/tap/veritas-kanban
|
||||
```
|
||||
|
||||
For a first installation:
|
||||
|
||||
```bash
|
||||
brew install --cask bradgroux/tap/veritas-kanban
|
||||
```
|
||||
|
||||
The Assets section provides signed and notarized macOS arm64 DMG and ZIP packages after the release workflow completes. Linux and Windows packages remain unsigned verification previews.
|
||||
|
||||
## Compatibility, migration, and rollback
|
||||
|
||||
The public REST API remains `v1`, and SQLite schema migrations remain at 30 through 33. Upgrading from 6.1.1 does not run a new schema migration. Runtime path normalization can migrate legacy files into the configured canonical data directory; operators should verify the data root, health, backup, and integrity evidence before resuming automation.
|
||||
|
||||
Rollback is restore-first. Stop every writer, reinstall 6.1.1 only when its data contracts remain compatible, and otherwise restore the complete stopped-writer pre-upgrade workspace. Never copy an older database over a running instance.
|
||||
|
||||
See the [full release notes](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-RELEASE-NOTES.md), [upgrade guide](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-UPGRADE-INSTALL-ADMIN-GUIDE.md), [compatibility policy](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/docs/V6-COMPATIBILITY-AND-RELEASE-POLICY.md), and [changelog](https://github.com/BradGroux/veritas-kanban/blob/v6.1.2/CHANGELOG.md).
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# Lint Warning Debt
|
||||
|
||||
Review date: 2026-06-04
|
||||
Review date: 2026-08-24
|
||||
|
||||
The repository still allows lint warnings, but warning debt is now managed with a
|
||||
ratchetable budget and a repeatable package/rule report.
|
||||
|
|
@ -30,24 +30,15 @@ pnpm lint:report
|
|||
|
||||
## Current Budget
|
||||
|
||||
Current warning budget: 600.
|
||||
Current warning budget: 458.
|
||||
|
||||
Baseline after the production unused-value cleanup:
|
||||
The 6.1.2 audit reduced the repository ceiling from 600 to 458 by narrowing
|
||||
production server boundaries, replacing unsafe assertions, and removing unused
|
||||
values without relaxing rules or adding broad suppressions. Use
|
||||
`pnpm lint:report` for the current package and rule distribution; do not copy a
|
||||
historical distribution into release evidence.
|
||||
|
||||
| Package | Warnings |
|
||||
| ------- | -------- |
|
||||
| server | 536 |
|
||||
| web | 37 |
|
||||
| mcp | 25 |
|
||||
| shared | 2 |
|
||||
|
||||
Current warning classes:
|
||||
|
||||
| Rule | Warnings |
|
||||
| ------------------------------------------ | -------- |
|
||||
| `@typescript-eslint/no-explicit-any` | 342 |
|
||||
| `@typescript-eslint/no-non-null-assertion` | 227 |
|
||||
| `@typescript-eslint/no-unused-vars` | 31 |
|
||||
The final 6.1.2 release matrix records the freshly measured total and report.
|
||||
|
||||
## Cleanup Order
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Scheduled QA Gates
|
||||
|
||||
Review date: 2026-06-04
|
||||
Review date: 2026-08-24
|
||||
|
||||
The scheduled QA workflow runs heavier browser and load-test coverage outside
|
||||
the fast pull-request path. Ordinary pull requests stay limited to lint,
|
||||
|
|
@ -14,12 +14,10 @@ job-level `env` used the `runner.temp` context. GitHub does not expose the
|
|||
error instead of producing logs. The workflow now writes `VERITAS_DATA_DIR`
|
||||
from `$RUNNER_TEMP` during job setup.
|
||||
|
||||
Playwright and `pnpm qa:mantine` remain scheduled/manual gates while #568 and
|
||||
#569 are open. Adding them to PR CI before those gates are stable would create
|
||||
red PR checks with known non-PR-specific failures. Once both gates pass on
|
||||
`main`, either add a small PR smoke job for `pnpm qa:mantine` and
|
||||
`pnpm test:e2e -- e2e/mantine-qa-gate.spec.ts`, or record the release decision
|
||||
to keep them scheduled-only here.
|
||||
Playwright, Mantine QA, coverage, desktop artifacts, load profiles, and Docker
|
||||
contracts are deliberate milestone gates. Apply `ci:full` to an integration or
|
||||
release candidate, or use the documented scheduled/manual dispatch. Do not add
|
||||
them to every ordinary pull request merely to duplicate the final milestone.
|
||||
|
||||
## Workflow
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/mcp",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"description": "MCP server for Veritas Kanban",
|
||||
"type": "module",
|
||||
"main": "./dist/index.js",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "veritas-kanban",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"private": true,
|
||||
"description": "Local-first task management and AI agent orchestration platform",
|
||||
"author": "Brad Groux <brad@digitalmeld.io>",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/server",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"main": "./dist/index.js",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/shared",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"main": "./dist/index.js",
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"name": "@veritas-kanban/web",
|
||||
"version": "6.1.1",
|
||||
"version": "6.1.2",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"scripts": {
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue