Brad Groux
97ac04b968
test: isolate tracked ignore guard ( #1212 )
2026-08-23 20:29:14 -05:00
Brad Groux
2cbfd3b215
fix: stop ignoring tracked storage paths ( #1211 )
2026-08-23 20:23:07 -05:00
Brad Groux
542d6dd760
build: enforce service filesystem boundary ( #1190 )
2026-08-23 15:23:14 -05:00
Brad Groux
93e946693d
test: establish critical-path coverage ratchets ( #1183 )
...
* test: add critical-path coverage ratchets
* fix: harden coverage ratchet enforcement
* fix: fetch coverage comparison history
* fix: close coverage policy downgrade paths
* fix: verify changed critical statements
* fix: ignore non-executable coverage changes
* fix: distinguish mixed type-only coverage edits
* fix: classify coverage changes by runtime output
* fix: enforce runtime-significant whitespace changes
* fix: classify multiline coverage changes as hunks
* fix: group equal-line coverage rewrites
2026-08-23 13:48:41 -05:00
Brad Groux
b1367aa33c
security: add continuous scanning gates ( #1180 )
...
* ci: add continuous security gates
* fix: scope runner context to gitleaks step
2026-08-23 12:06:20 -05:00
Brad Groux
9c533c4345
ci: pin external actions to immutable revisions ( #1179 )
2026-08-23 11:39:14 -05:00
Brad Groux
e24b75cf3b
fix: make workspace test gate deterministic ( #1175 )
2026-08-23 10:51:29 -05:00
Brad Groux
528b348c59
ci: reserve full test suites for milestones ( #1108 )
2026-07-26 00:50:42 -05:00
Brad Groux
9cf0ccb96c
chore: enforce delivery timebox ( #1069 )
2026-07-25 16:46:49 -05:00
Brad Groux
34e4c8d13b
fix: reject ambiguous focused test wrappers ( #1060 )
2026-07-25 06:31:50 -05:00
Brad Groux
abf407a8ac
fix: prevent broad verification policy drift ( #1049 )
...
* fix: prevent broad verification policy drift
* ci: keep cadence controls out of workspace tests
2026-07-25 04:27:01 -05:00
Brad Groux
3ee290c0dc
fix: prevent focused test suite expansion
2026-07-25 03:33:00 -05:00
Brad Groux
0d5ebb3a7a
fix: guard sustainable delivery cadence ( #1042 )
2026-07-25 02:08:15 -05:00
Brad Groux
9f03c0bc06
fix: keep release notes full width ( #1029 )
2026-07-25 00:04:11 -05:00
Brad Groux
450f2df4a2
fix: use intentional release note lists ( #1027 )
2026-07-24 23:39:54 -05:00
Brad Groux
6e7bb4ffee
fix: keep release notes full width ( #1026 )
2026-07-24 23:12:47 -05:00
Brad Groux
3fffd5f81d
fix: allow natural release note wrapping ( #1023 )
CI / Lint & Type Check (push) Waiting to run
CI / Changed Tests (push) Blocked by required conditions
CI / Select Test Scope (push) Waiting to run
CI / Workspace Unit Tests (push) Blocked by required conditions
CI / Build (push) Waiting to run
CI / Security Audit (push) Waiting to run
Desktop Artifacts / Unsigned macOS Artifact (push) Waiting to run
Desktop Artifacts / Unsigned Linux Artifacts (push) Waiting to run
Desktop Artifacts / Unsigned Windows Artifacts (push) Waiting to run
2026-07-24 21:48:07 -05:00
Brad Groux
c0c15a4497
fix: prevent broken release note layouts ( #1022 )
...
Closes #1020
2026-07-24 21:08:48 -05:00
Brad Groux
74647256bc
fix: enforce full-width release notes ( #1021 )
2026-07-24 20:22:12 -05:00
Brad Groux
c3da853006
fix(ci): read full-suite evidence from stdin ( #1016 )
2026-07-24 18:58:42 -05:00
Brad Groux
508c45fcd3
fix(ci): verify executed full-suite steps ( #1015 )
2026-07-24 18:47:23 -05:00
Brad Groux
5fc3fbdb5e
perf(ci): suppress cosmetic label runs ( #1013 )
2026-07-24 18:33:29 -05:00
Brad Groux
3a73662b9c
chore(release): prepare v6.0.2 desktop hotfix ( #1011 )
2026-07-24 18:01:56 -05:00
Brad Groux
4ed08b32c1
ci: make test scope path-aware
2026-07-24 16:24:54 -05:00
Brad Groux
1bd43f9279
release: Veritas Kanban 6.0.0 ( #985 )
...
* build: prepare 6.0.0 release
* docs: link the 6.0.0 release pull request
2026-07-24 11:26:25 -05:00
Brad Groux
0fbd9ee428
feat: add run-scoped tool control plane ( #959 )
...
CI / Lint & Type Check (push) Waiting to run
CI / Changed Tests (push) Waiting to run
CI / Workspace Unit Tests (push) Waiting to run
CI / Build (push) Waiting to run
CI / Security Audit (push) Waiting to run
Desktop Artifacts / Unsigned macOS Artifact (push) Waiting to run
Desktop Artifacts / Unsigned Linux Artifacts (push) Waiting to run
Desktop Artifacts / Unsigned Windows Artifacts (push) Waiting to run
* feat: add run-scoped tool control plane (#857 )
* test: align provider capability fixtures
2026-07-24 05:10:20 -05:00
Brad Groux
ce0837a3e6
fix: verify macOS desktop readiness ( #929 )
2026-07-23 16:37:16 -05:00
Brad Groux
44d1611741
feat: add governed SQLite journal maintenance ( #884 )
...
CI / Lint & Type Check (push) Waiting to run
CI / Workspace Unit Tests (push) Waiting to run
CI / Build (push) Waiting to run
CI / Security Audit (push) Waiting to run
* feat: add governed SQLite journal maintenance
* fix: update permission coverage for SQLite maintenance
---------
Co-authored-by: bradgroux <brad@digitalmeld.io>
2026-07-15 20:00:58 -05:00
Brad Groux
e781d30842
fix: externalize Electron runtime in desktop builds ( #817 )
...
CI / Lint & Type Check (push) Waiting to run
CI / Workspace Unit Tests (push) Waiting to run
CI / Build (push) Waiting to run
CI / Security Audit (push) Waiting to run
Fixes #809
2026-07-12 16:18:42 -05:00
Brad Groux
4d7c29b73a
fix: normalize security artifact paths to lowercase before matching ( #807 )
...
CI / Lint & Type Check (push) Waiting to run
CI / Workspace Unit Tests (push) Waiting to run
CI / Build (push) Waiting to run
CI / Security Audit (push) Waiting to run
Fixes case-sensitivity regression where prohibited paths like
'.VERITAS-KANBAN/security.json' would not be caught on Linux CI,
even though they alias protected paths on case-insensitive systems.
Changes:
- Normalize candidate paths to lowercase in findSecurityArtifactViolations()
- Add comprehensive test file (security-artifacts-guard.test.ts) with:
* Unit tests for path normalization and matching
* Mixed-case variant detection
* NUL-delimited Git output handling
* Integration tests with isolated temporary Git repositories
* Edge cases: spaces, nested paths, untracked files
* Diagnostic message validation
Security verification:
- All security-related tests pass
- Auth middleware tests pass
- Typecheck passes
- Lint budget at 600 (limit)
- Guard invocation verified against live repository
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-07-10 13:01:36 -05:00
Brad Groux
013c2b5383
Fix audit follow-up gates
...
Fix audit follow-up gates
- remove gray-matter and use local YAML frontmatter handling
- upgrade DOMPurify and clear production advisories
- make CLI/MCP smoke skip cleanly without VK_API_KEY
- reduce initial JS below the Mantine QA budget
Closes #753
Closes #754
Closes #755
2026-06-26 14:59:20 -05:00
Brad Groux
881af11685
Fix desktop release blockmap regeneration
...
CI / Lint & Type Check (push) Has been cancelled
CI / Workspace Unit Tests (push) Has been cancelled
CI / Build (push) Has been cancelled
CI / Security Audit (push) Has been cancelled
Resolve the Electron Builder 26 blockmap module directly for notarized DMG blockmap regeneration.
2026-06-12 03:38:05 -05:00
Brad Groux
ac0687ac72
Prepare v5.0.1 patch release
...
Bump Veritas Kanban to v5.0.1, update release docs, and fix the local macOS packaging smoke check.
2026-06-12 03:19:52 -05:00
dependabot[bot]
31359ebebf
build(deps): bump @eslint/js to 10.0.1
...
* build(deps-dev): bump @eslint/js from 9.38.0 to 10.0.1
Bumps [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js ) from 9.38.0 to 10.0.1.
- [Release notes](https://github.com/eslint/eslint/releases )
- [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js )
---
updated-dependencies:
- dependency-name: "@eslint/js"
dependency-version: 10.0.1
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* Resolve eslint js 10 lint failures
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
2026-06-09 06:16:16 -05:00
Brad Groux
8b0ec6836b
build(desktop): isolate local release staging
...
* build(desktop): isolate local release staging
* Require Apple Silicon for local macOS smoke
---------
Co-authored-by: bradgroux <brad@digitalmeld.io>
2026-06-09 05:47:35 -05:00
Brad Groux
ccdd55ce0b
ci(desktop): validate notarization credential modes
...
* ci(desktop): validate notarization credential modes
* Sanitize notarization failure output
---------
Co-authored-by: bradgroux <brad@digitalmeld.io>
2026-06-09 05:47:32 -05:00
Brad Groux
d3fed82a61
Resolve app-builder for release finalization ( #687 )
2026-06-06 09:58:24 -05:00
Brad Groux
cb98addc77
Notarize DMG release assets before upload ( #686 )
2026-06-06 09:43:17 -05:00
Brad Groux
29630c7e4b
Prepare v5.0.0 release
2026-06-05 18:16:43 -05:00
Brad Groux
7005ea7bdd
Add CLI MCP compatibility smoke
...
Add CLI MCP compatibility smoke
2026-06-05 15:28:53 -05:00
Brad Groux
e840c43d07
Move pnpm settings to workspace config ( #630 )
2026-06-05 08:15:47 -05:00
Brad Groux
4d6fb59a83
Fix desktop artifact CI packaging
2026-06-04 01:52:14 -07:00
Brad Groux
a42988a3e2
Ratcheting lint warning budget
2026-06-04 00:16:42 -07:00
Brad Groux
72715f229f
Add v5 release readiness docs ( #546 )
2026-06-03 07:49:26 -07:00
Brad Groux
e6c15c036d
Add Mantine QA release gate
2026-06-01 14:17:56 -07:00
Brad Groux
f0dceac22f
Add macOS desktop release pipeline ( #473 )
2026-05-31 17:48:50 -05:00
Brad Groux
522162ae89
test: add v5 permission coverage manifest gate
...
## Summary
- adds a v5 permission coverage manifest with classifications, required permissions, denial reasons, and review justifications across REST, WebSocket, CLI, MCP, workflow, transition hook, command palette, and background job surfaces
- adds a Node-based coverage checker that fails when tracked surfaces are missing from the manifest or when REST route prefixes drift from the shared permission map
- wires the checker into CI and documents the manifest gate in the security guide
Closes #420 .
## Verification
- `node scripts/check-permission-coverage.mjs`
- `./node_modules/.bin/prettier --check package.json .github/workflows/ci.yml scripts/check-permission-coverage.mjs docs/security/permission-coverage.json docs/security.md`
- `git diff --check`
- `pnpm lint:budget`
- `pnpm build`
- `pnpm audit --prod --audit-level=high` (passes high gate; 3 existing moderate findings)
- GitHub Actions: Build, Lint & Type Check, Security Audit, Workspace Unit Tests
2026-05-31 05:02:26 -05:00
Brad Groux
d3976f1d74
chore: harden audit findings and release QA
...
Add release validation and scheduled QA workflows.
Harden webhook URL handling, API helper edge cases, and runtime version reporting.
Split heavy web bundles, centralize view metadata, and stabilize full-suite tests.
2026-05-16 18:59:40 -05:00
Brad Groux
ef9e88ca1d
feat: add qmd index maintenance
2026-05-04 03:10:16 -05:00
Brad Groux
f0f7d7b03e
feat: add qmd search foundation
2026-05-04 02:35:00 -05:00
