65 commits

Author	SHA1	Message	Date
Brad Groux	6ab3feb35f	fix: harden file and input handling (#1234) ... * fix: harden file and input handling * fix: keep URI scheme regex lint-safe	2026-08-24 01:58:21 -05:00
Brad Groux	49e25838e1	ci: reserve release-grade testing for milestones (#1228)	2026-08-24 00:34:36 -05:00
Brad Groux	c9db917422	build: enforce Docker image contract (#1222) ... * build: enforce Docker image contract * fix: run Docker contract on durable storage * build: restore 200 MB image contract * build: complete container runtime contract * chore: refresh reviewed secret fingerprint * fix: unwrap Docker backup response * build: exclude generated Docker context * build: enforce platform image budgets * chore: align Docker docs leak baseline	2026-08-23 23:49:13 -05:00
Brad Groux	97ac04b968	test: isolate tracked ignore guard (#1212)	2026-08-23 20:29:14 -05:00
Brad Groux	2cbfd3b215	fix: stop ignoring tracked storage paths (#1211)	2026-08-23 20:23:07 -05:00
Brad Groux	542d6dd760	build: enforce service filesystem boundary (#1190)	2026-08-23 15:23:14 -05:00
Brad Groux	93e946693d	test: establish critical-path coverage ratchets (#1183) ... * test: add critical-path coverage ratchets * fix: harden coverage ratchet enforcement * fix: fetch coverage comparison history * fix: close coverage policy downgrade paths * fix: verify changed critical statements * fix: ignore non-executable coverage changes * fix: distinguish mixed type-only coverage edits * fix: classify coverage changes by runtime output * fix: enforce runtime-significant whitespace changes * fix: classify multiline coverage changes as hunks * fix: group equal-line coverage rewrites	2026-08-23 13:48:41 -05:00
Brad Groux	b1367aa33c	security: add continuous scanning gates (#1180) ... * ci: add continuous security gates * fix: scope runner context to gitleaks step	2026-08-23 12:06:20 -05:00
Brad Groux	9c533c4345	ci: pin external actions to immutable revisions (#1179)	2026-08-23 11:39:14 -05:00
Brad Groux	e24b75cf3b	fix: make workspace test gate deterministic (#1175)	2026-08-23 10:51:29 -05:00
Brad Groux	528b348c59	ci: reserve full test suites for milestones (#1108)	2026-07-26 00:50:42 -05:00
Brad Groux	9cf0ccb96c	chore: enforce delivery timebox (#1069)	2026-07-25 16:46:49 -05:00
Brad Groux	34e4c8d13b	fix: reject ambiguous focused test wrappers (#1060)	2026-07-25 06:31:50 -05:00
Brad Groux	abf407a8ac	fix: prevent broad verification policy drift (#1049) ... * fix: prevent broad verification policy drift * ci: keep cadence controls out of workspace tests	2026-07-25 04:27:01 -05:00
Brad Groux	3ee290c0dc	fix: prevent focused test suite expansion	2026-07-25 03:33:00 -05:00
Brad Groux	0d5ebb3a7a	fix: guard sustainable delivery cadence (#1042)	2026-07-25 02:08:15 -05:00
Brad Groux	9f03c0bc06	fix: keep release notes full width (#1029)	2026-07-25 00:04:11 -05:00
Brad Groux	450f2df4a2	fix: use intentional release note lists (#1027)	2026-07-24 23:39:54 -05:00
Brad Groux	6e7bb4ffee	fix: keep release notes full width (#1026)	2026-07-24 23:12:47 -05:00
Brad Groux	3fffd5f81d	fix: allow natural release note wrapping (#1023)	2026-07-24 21:48:07 -05:00
Brad Groux	c0c15a4497	fix: prevent broken release note layouts (#1022) ... Closes #1020	2026-07-24 21:08:48 -05:00
Brad Groux	74647256bc	fix: enforce full-width release notes (#1021)	2026-07-24 20:22:12 -05:00
Brad Groux	c3da853006	fix(ci): read full-suite evidence from stdin (#1016)	2026-07-24 18:58:42 -05:00
Brad Groux	508c45fcd3	fix(ci): verify executed full-suite steps (#1015)	2026-07-24 18:47:23 -05:00
Brad Groux	5fc3fbdb5e	perf(ci): suppress cosmetic label runs (#1013)	2026-07-24 18:33:29 -05:00
Brad Groux	3a73662b9c	chore(release): prepare v6.0.2 desktop hotfix (#1011)	2026-07-24 18:01:56 -05:00
Brad Groux	4ed08b32c1	ci: make test scope path-aware	2026-07-24 16:24:54 -05:00
Brad Groux	1bd43f9279	release: Veritas Kanban 6.0.0 (#985) ... * build: prepare 6.0.0 release * docs: link the 6.0.0 release pull request	2026-07-24 11:26:25 -05:00
Brad Groux	0fbd9ee428	feat: add run-scoped tool control plane (#959) ... * feat: add run-scoped tool control plane (#857) * test: align provider capability fixtures	2026-07-24 05:10:20 -05:00
Brad Groux	ce0837a3e6	fix: verify macOS desktop readiness (#929)	2026-07-23 16:37:16 -05:00
Brad Groux	44d1611741	feat: add governed SQLite journal maintenance (#884) ... * feat: add governed SQLite journal maintenance * fix: update permission coverage for SQLite maintenance --------- Co-authored-by: bradgroux <brad@digitalmeld.io>	2026-07-15 20:00:58 -05:00
Brad Groux	e781d30842	fix: externalize Electron runtime in desktop builds (#817) ... Fixes #809	2026-07-12 16:18:42 -05:00
Brad Groux	4d7c29b73a	fix: normalize security artifact paths to lowercase before matching (#807) ... Fixes case-sensitivity regression where prohibited paths like '.VERITAS-KANBAN/security.json' would not be caught on Linux CI, even though they alias protected paths on case-insensitive systems. Changes: - Normalize candidate paths to lowercase in findSecurityArtifactViolations() - Add comprehensive test file (security-artifacts-guard.test.ts) with: * Unit tests for path normalization and matching * Mixed-case variant detection * NUL-delimited Git output handling * Integration tests with isolated temporary Git repositories * Edge cases: spaces, nested paths, untracked files * Diagnostic message validation Security verification: - All security-related tests pass - Auth middleware tests pass - Typecheck passes - Lint budget at 600 (limit) - Guard invocation verified against live repository Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-10 13:01:36 -05:00
Brad Groux	013c2b5383	Fix audit follow-up gates ... Fix audit follow-up gates - remove gray-matter and use local YAML frontmatter handling - upgrade DOMPurify and clear production advisories - make CLI/MCP smoke skip cleanly without VK_API_KEY - reduce initial JS below the Mantine QA budget Closes #753 Closes #754 Closes #755	2026-06-26 14:59:20 -05:00
Brad Groux	881af11685	Fix desktop release blockmap regeneration ... Resolve the Electron Builder 26 blockmap module directly for notarized DMG blockmap regeneration.	2026-06-12 03:38:05 -05:00
Brad Groux	ac0687ac72	Prepare v5.0.1 patch release ... Bump Veritas Kanban to v5.0.1, update release docs, and fix the local macOS packaging smoke check.	2026-06-12 03:19:52 -05:00
dependabot[bot]	31359ebebf	build(deps): bump @eslint/js to 10.0.1 ... * build(deps-dev): bump @eslint/js from 9.38.0 to 10.0.1 Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) from 9.38.0 to 10.0.1. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) --- updated-dependencies: - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Resolve eslint js 10 lint failures --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>	2026-06-09 06:16:16 -05:00
Brad Groux	8b0ec6836b	build(desktop): isolate local release staging ... * build(desktop): isolate local release staging * Require Apple Silicon for local macOS smoke --------- Co-authored-by: bradgroux <brad@digitalmeld.io>	2026-06-09 05:47:35 -05:00
Brad Groux	ccdd55ce0b	ci(desktop): validate notarization credential modes ... * ci(desktop): validate notarization credential modes * Sanitize notarization failure output --------- Co-authored-by: bradgroux <brad@digitalmeld.io>	2026-06-09 05:47:32 -05:00
Brad Groux	d3fed82a61	Resolve app-builder for release finalization (#687)	2026-06-06 09:58:24 -05:00
Brad Groux	cb98addc77	Notarize DMG release assets before upload (#686)	2026-06-06 09:43:17 -05:00
Brad Groux	29630c7e4b	Prepare v5.0.0 release	2026-06-05 18:16:43 -05:00
Brad Groux	7005ea7bdd	Add CLI MCP compatibility smoke ... Add CLI MCP compatibility smoke	2026-06-05 15:28:53 -05:00
Brad Groux	e840c43d07	Move pnpm settings to workspace config (#630)	2026-06-05 08:15:47 -05:00
Brad Groux	4d6fb59a83	Fix desktop artifact CI packaging	2026-06-04 01:52:14 -07:00
Brad Groux	a42988a3e2	Ratcheting lint warning budget	2026-06-04 00:16:42 -07:00
Brad Groux	72715f229f	Add v5 release readiness docs (#546)	2026-06-03 07:49:26 -07:00
Brad Groux	e6c15c036d	Add Mantine QA release gate	2026-06-01 14:17:56 -07:00
Brad Groux	f0dceac22f	Add macOS desktop release pipeline (#473)	2026-05-31 17:48:50 -05:00
Brad Groux	522162ae89	test: add v5 permission coverage manifest gate ... ## Summary - adds a v5 permission coverage manifest with classifications, required permissions, denial reasons, and review justifications across REST, WebSocket, CLI, MCP, workflow, transition hook, command palette, and background job surfaces - adds a Node-based coverage checker that fails when tracked surfaces are missing from the manifest or when REST route prefixes drift from the shared permission map - wires the checker into CI and documents the manifest gate in the security guide Closes #420. ## Verification - `node scripts/check-permission-coverage.mjs` - `./node_modules/.bin/prettier --check package.json .github/workflows/ci.yml scripts/check-permission-coverage.mjs docs/security/permission-coverage.json docs/security.md` - `git diff --check` - `pnpm lint:budget` - `pnpm build` - `pnpm audit --prod --audit-level=high` (passes high gate; 3 existing moderate findings) - GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests	2026-05-31 05:02:26 -05:00