270 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Zayin_Admin	651efa8829	Merge pull request 'feat(shell): collapsible sidebar, account menu, and phone drawer (Stage 1, ADR 0058)' (#104) from feat/dashboard-shell-navigation into main ... Reviewed-on: #104 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 23:05:29 +00:00
ekklesiaandClaude Opus 5.5	cf2f847c8c	test(core): pin the shell's one use of browser storage, not ban it ... CI failed in `identity-verification-boundaries.test.ts`: its guard that a reset token never reaches browser storage was a blanket ban on the word `localStorage` anywhere in the shell. The sidebar preference (ADR 0058) legitimately reads it in the entry point. The guarantee is unchanged: the reset token stays in React state for the life of one form. The guard is now precise: - `localStorage` appears only in `main.tsx`, only to hand it to the sidebar preference; - the shell's only storage write is the sidebar's own key and a validated mode; - the files that ever hold the token (`auth-protocol.ts`, `ResetPasswordForm.tsx`, `HostApp.tsx`) touch no storage API at all; - `sessionStorage` and `document.cookie` stay banned everywhere. A planted `localStorage.setItem("t", token)` in `auth-protocol.ts` fails it. The runtime reset-token test in `auth-recovery.test.tsx` now runs with the production localStorage-backed preference and asserts storage holds nothing but the sidebar key. It passed locally only because Turbo restored `@ekklesia/core:test` from cache: that test reads shell source that Core's task hash does not include. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-14 17:55:07 -05:00
ekklesiaandClaude Opus 5.5	af31724cb4	feat(shell): collapsible sidebar, account menu, and phone drawer ... The Dashboard's shell now follows DESIGN.md §4 (ADR 0058): - A collapsible left sidebar replaces the header-and-column layout. It is icons and labels when expanded and icons only when collapsed; each collapsed item keeps its name, visually hidden, and shows a tooltip on hover and on keyboard focus (WCAG 2.2 §1.4.13). The Overview comes first, then the server's groups and modules. There is no top bar. - The expanded/collapsed choice is remembered in this browser's localStorage, behind a SidebarPreference interface that a synced store can replace later. - An account menu at the bottom of the sidebar follows the WAI-ARIA menu button pattern and offers only Sign out, which now lives there rather than in the header. - On phones (below 48em) the same navigation opens in a modal drawer: the page behind it is inert and focus is trapped inside it. Escape, its close button, and the backdrop close it and return focus to the menu button. Choosing a page closes it and focuses the page. Changing layout keeps the route, the desktop mode, and the mounted module. - Lucide (lucide-react 1.48.0, shell only) is Ekklesia's icon vocabulary. Every module shows one generic icon until manifest v9 lets modules declare their own; there is no per-module icon map. - The identity slot is a neutral placeholder with no inputs, waiting for branding (#101). The tooltip, menu, and drawer stay shell-local until a second consumer needs them (ADR 0039). The deploy smoke now signs out through the account menu, and drives the drawer at phone size in a real browser. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-14 17:49:56 -05:00
Joey	f3b7e19651	Merge pull request 'feat(shell): give every Dashboard page a real URL, with modules at /<module-id> (Stage 1, ADR 0057)' (#103) from feat/dashboard-url-routing into main ... Reviewed-on: #103 Reviewed-by: Joey <[email protected]>	2026-10-14 22:07:20 +00:00
ekklesiaandClaude Opus 5.5	ba60f70835	feat(shell): make module pages first-class top-level routes ... Module pages move from `/modules/<id>` to `/<module-id>` (`/signage`), beside `/settings` and `/account`, so the implementation concept "module" never appears in a user-facing address. ADR 0057 is rewritten to match. - Core reserves the top-level names the platform actually serves today (`account`, `api`, `assets`, `display`, `settings`), and discovery refuses a module that declares one with `MODULE_ID_RESERVED`. That covers startup, `modules:validate`, and package verification. Tests in `apps/api` hold the set to every top-level route the API registers and every page the shell interprets. - The API serves the Dashboard page at `/<module-id>` and below only for modules discovered with a Dashboard UI, enabled or not: a disabled module's bookmark still opens the Dashboard, which says it is unavailable. An arbitrary root path such as `/definitely-not-a-real-module` stays the sanitized 404. - Both reference proxies forward every top-level path shaped like a module id and let the API decide; the split Dashboard hostname still refuses `/api`, `/display`, and `/assets`. Installing a module needs no proxy change. - `/<module-id>/<page>` is already served and forwarded, so a later module sub-page contract needs no routing or deployment change; the shell shows "Page not found" there until it exists. - The deploy smoke checks a module's address before install, while installed, while disabled, after removal, and after reinstall, plus unknown names and the old `/modules/…` form through the real proxy. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-14 08:42:34 -05:00
ekklesiaandClaude Opus 5.5	9afe9376c4	feat(shell): give every Dashboard page a real URL ... The Dashboard had one address. The API served the page only at `/`, both reference proxies forwarded only `/`, and the open module lived in React state, so a refresh went back to the first module, nothing could be bookmarked, and Back left the Dashboard (DESIGN.md §2.7). ADR 0057 makes the address bar the source of truth: - `/` is a host-owned Overview, now the landing page; `/modules/<id>` mounts that module. An id the server's navigation does not list shows "This page isn't available" and loads nothing; any other Dashboard address is a host-owned "Page not found". - `/modules`, `/settings`, and `/account` are reserved whole, from one list (`@ekklesia/shell/dashboard-routes`) that the shell's router and the API's page routes both read. The API serves the same frozen page, ETag, and security headers anywhere inside them; look-alikes and other methods stay the sanitized 404. - A small host-owned history replaces the selected-module state, built in the entry point so it stays the only file touching `window`. Navigation items are real links; modified clicks are left to the browser. Focus moves to the page after an in-place change, and the tab is named after the page. - Sign-in still happens in place with no return value (ADR 0034), so a deep link opens its own page after sign-in. - Both reference Caddyfiles forward the new paths; the deploy smoke now reloads a module's address through the real proxy and requires it to mount again. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-14 08:11:02 -05:00
Zayin_Admin	44430b5d59	Merge pull request 'test(api): let a shutdown's closed connections leave pg_stat_activity' (#100) from fix/flaky-shutdown-connection-check into main ... Reviewed-on: #100 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 04:41:38 +00:00
Zayin_Admin	bef516796e	Merge branch 'main' into fix/flaky-shutdown-connection-check	2026-10-14 04:23:11 +00:00
Zayin_Admin	9bef1d9ef2	Merge pull request 'docs(claude): file an issue for what you find outside the task' (#99) from docs/claude-md-report-findings into main ... Reviewed-on: #99 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 04:23:04 +00:00
ekklesiaandClaude Opus 5.5	f2fc069e66	test(api): let a shutdown's closed connections leave pg_stat_activity ... Four integration tests shut the API down and immediately count the database's rows in pg_stat_activity, expecting zero. PostgreSQL ends a backend asynchronously: pool.end() resolves once the client side has closed, and the server can still list that backend for a moment. On a loaded runner an immediate count saw one, failing migration-smoke on a docs-only PR (Ekklesia CI run #238, module-database.integration.ts:764, "expected 1 to be +0"). Reproduced against postgres:18.4-alpine3.24 limited to 0.05 CPU: after pool.end() resolved, the backend was still listed in 7 of 300 trials, and gone about a millisecond later. The checks now wait up to 3 s for the count to reach zero. A connection that is genuinely left open is still caught: an idle pooled client stays listed for pg-pool's 10 s idle timeout, far past the deadline. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-13 23:13:21 -05:00
ekklesiaandClaude Opus 5.5	0552442c7c	docs(claude): file an issue for what you find outside the task ... Findings that only live in a chat reply get lost. Agents now open a descriptive issue in the repository a problem belongs to (after searching for an existing one), mark it found-by-claude, leave it unassigned, and list what they filed when they report back. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-13 22:58:17 -05:00
Zayin_Admin	63fda0f8d6	Merge pull request 'fix(ci): confine the sweep self-test to its own run' (#96) from fix/ci-sweep-self-test-scope into main ... Reviewed-on: #96 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 03:55:35 +00:00
ekklesiaandClaude Opus 5.5	94fa7a17a8	fix(ci): confine the sweep self-test to its own run ... scripts/test-ci-sweep.sh proves the stale sweep by running `ci-sweep.sh --stale --max-age-seconds 0` on the runner's shared Docker daemon. With a zero threshold that removes every `ekklesia-ci-` stack on the daemon, not just the test's own: any job running at that moment loses its containers, networks, and volumes. It reported "CI sweep checks passed" while doing it. Core's infrastructure-smoke job runs the self-test on every run, and twice tore down Signage's integration stack mid-scenario (Zayin/Signage run 288: its first attempt, and the second one during connectivity-blip). `ci-sweep.sh --stale` now takes `--prefix P`, which narrows the sweep to stacks whose names begin with P and must itself begin with the CI prefix, so it can only narrow a sweep, never widen one. The self-test confines every stale sweep to its own fake run and proves that another run's stack survives even the zero threshold. The workflow's own sweeps are unchanged. Regression: a bystander stack from another run in the self-test, and a Docker-free guard that every stale sweep in the self-test is confined and the workflow's keep the default threshold. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-13 22:46:38 -05:00
Zayin_Admin	437720f228	Merge pull request 'chore(release): prepare 0.2.5' (#95) from chore/release-0.2.5 into main ... Reviewed-on: #95 Reviewed-by: Zayin_Admin <[email protected]> v0.2.5	2026-10-14 03:37:04 +00:00
ekklesiaandClaude Opus 5.5	d3148d45f7	chore(release): prepare 0.2.5 ... Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-13 22:28:08 -05:00
Zayin_Admin	303d455315	Merge pull request 'chore: publish packages to the registry's current Zayin location' (#93) from chore/zayin-package-registry into main ... Reviewed-on: #93 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 03:19:45 +00:00
Zayin_Admin	39f48dc7c9	Merge branch 'main' into chore/zayin-package-registry	2026-10-14 03:09:53 +00:00
Zayin_Admin	9d515cd56f	Merge pull request 'fix(devices): keep an in-use display paired by renewing its credential (ADR 0056)' (#94) from fix/device-credential-renewal into main ... Reviewed-on: #94 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 03:08:17 +00:00
Zayin_Admin	b8a826f8be	Merge branch 'main' into fix/device-credential-renewal	2026-10-14 02:07:43 +00:00
Zayin_Admin	0c9b8f7af9	Merge pull request 'fix(display): Stage 0 display continuity, revocation, and kiosk recovery' (#92) from stage0/display-runtime-continuity into main ... Reviewed-on: #92 Reviewed-by: Zayin_Admin <[email protected]>	2026-10-14 02:06:01 +00:00
ekklesiaandClaude Opus 5.5	5e9433d96b	docs(deploy): describe the in-use credential renewal in the kiosk guide ... ADR 0056 (Zayin/Ekklesia#94) replaces the fixed 180 days from pairing with 180 days from last use, renewed while the screen is in use; the guide no longer tells operators to track pairing dates. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 22:30:17 -05:00
ekklesiaandClaude Opus 5.5	650932a170	fix(devices): keep an in-use display paired, renewing its credential instead of expiring it ... A device credential was accepted for a fixed 180 days from pairing, so every working screen dropped to a pairing code on the anniversary of its pairing, and screens paired together failed together. Measure the 180 days from when the device was last seen instead, and have the display descriptor - which every screen requests on start, on reconnect, and periodically - re-issue the cookie that authenticated it with a fresh lifetime. The value is not rotated, so a renewal lost in transit cannot strand a screen. Revoked, expired, and unknown credentials are never renewed, a person never receives a device cookie, and an abandoned screen still stops being an identity 180 days after it was last seen. No migration: lastSeenAt already slides with use. ADR 0056 supersedes the session-lifetime section of ADR 0036. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 22:27:27 -05:00
ekklesiaandClaude Opus 5.5	2d861c6bf0	chore: publish and document packages at the registry's current Zayin location ... The package registry moved with the repositories to git.zayin.net/api/packages/Zayin/npm/; the old River_of_Glory_Church address now answers 502, so the next manual Publish packages run would have failed. Point the workflow, the release and module-development docs, and the disposable-Gitea publication proof's owner at Zayin. The CI Docker label keys keep their names: they are identifiers the sweep matches on, not hosts. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 22:23:52 -05:00
ekklesiaandClaude Opus 5.5	bae4ff3c6a	test(deploy): re-pair the kiosk after the revoke scenario ... The revoke scenario left the kiosk revoked, so any display check after it - the post-recreation restart check in particular - failed by construction. That is why Signage could never run it. Finish the scenario the way the roadmap states the requirement: a revoked screen shows a fresh code, is paired again, resumes without a reload, and for Signage keeps its existing roster entry rather than appearing as a new screen. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 22:02:35 -05:00
ekklesiaandClaude Opus 5.5	9331a8f7df	fix(display): retry a display that could not start, and re-resolve a running one periodically ... A kiosk that booted before its server, as after a power cut, stopped on 'This display could not be reached' until someone pressed Retry: with the network up, no online event ever came. It now retries on its own, from two seconds doubling to a minute. A running display also re-resolves its descriptor every five minutes in the background, so a module upgraded on the server is picked up without a reload, and the same answer disturbs nothing. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 21:45:37 -05:00
ekklesiaandClaude Opus 5.5	8f90871be0	docs(deploy): document how to set up an unattended display kiosk ... Stage 0 requires that kiosk setup can be reproduced from documentation, and there was none. Cover the address, a single-launcher Chromium command with a persistent profile, a systemd user unit, pairing and the fixed 180-day device credential, what the screen does through each kind of outage, the known offline cold-start limit, and why a second launcher produces duplicate windows. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 21:45:37 -05:00
ekklesiaandClaude Opus 5.5	85b1377fd3	fix(devices): confirm before revoking a display ... Revoke acted on a single click, yet it strands the screen until someone re-pairs it in person. Explain the consequence in the shared in-product Dialog first (DESIGN 21.4), with an obvious Cancel. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 21:31:36 -05:00
ekklesiaandClaude Opus 5.5	4bcdb578e6	fix(display): keep a live display across reconnects, and return a revoked one to pairing ... Every browser 'online' event reset the display host to its loading state and mounted the module again: a fresh viewer session, a fresh stage, and every cached object URL released, on each Wi-Fi blip. And a device revoked while its display was open never noticed; it kept playing cached content and polling 403s until someone reloaded the page. The host now re-resolves its descriptor in the background (ADR 0043) and only replaces the frame when the answer actually changed: a new version or principal remounts, a refusal returns the screen to pairing (ADR 0036), and any other failure keeps the running display. A module request refused with 401/403 prompts the same revalidation, throttled, so revocation is noticed within one heartbeat. The offline indicator waits ten seconds before appearing, so a momentary blip shows nothing, and no longer names the platform on a lobby wall. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 21:31:36 -05:00
ekklesiaandClaude Opus 5.5	06bad2fe36	docs: bring CLAUDE.md in line with the current repositories and product rules ... Core's agent guidance still described modules living in this monorepo and manifest v7, and said nothing about the product rules that now govern every change. Record that first-party modules live in their own Zayin repositories and install as Module Packages, that the parent ROADMAP.md and DESIGN.md are authoritative for product direction, the ownership, branding, token, dark-mode and no-native-dialog rules, that display pairing is transitional until Stage 1, and the branch-per-PR, no-push-to-main, and no-release-tag workflow. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-12 21:31:36 -05:00
The_River	ae976ca229	Merge pull request 'chore(release): prepare 0.2.4' (#91) from chore/release-0.2.4 into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/91 Reviewed-by: The_River <[email protected]> v0.2.4	2026-10-10 17:09:10 +00:00
ekklesia	f9585cc7ec	chore(release): prepare 0.2.4	2026-10-10 11:54:00 -05:00
The_River	6dae29412f	Merge pull request 'test(deploy): exercise external module packages' (#90) from test/external-module-deploy-smoke into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/90 Reviewed-by: The_River <[email protected]>	2026-10-10 16:32:32 +00:00
ekklesia	40ef0ff802	fix(deploy): bound object storage allocation size	2026-10-10 11:07:53 -05:00
ekklesia	a0e9948820	fix(storage): recognize errors across module packages	2026-10-10 10:54:13 -05:00
ekklesia	6e64b3c5f9	test(deploy): allow slower display uploads	2026-10-09 22:37:18 -05:00
ekklesia	fa27603133	test(deploy): exercise external module packages	2026-10-09 22:18:04 -05:00
The_River	9e01679fcb	Merge pull request 'chore(release): prepare 0.2.3' (#89) from chore/release-0.2.3 into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/89 Reviewed-by: The_River <[email protected]> v0.2.3	2026-10-10 00:01:54 +00:00
ekklesia	227c92e35d	chore(release): prepare 0.2.3	2026-10-09 18:38:22 -05:00
The_River	505c9e8c0a	Merge pull request 'Fix native package verification on hardened noexec /tmp' (#88) from fix/verifier-exec-scratch into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/88 Reviewed-by: The_River <[email protected]>	2026-10-09 23:36:11 +00:00
ekklesia	4be046c8d0	fix: support native package verifier scratch	2026-10-09 18:05:04 -05:00
The_River	c5a6cdaf6a	Merge pull request 'chore(release): prepare 0.2.2' (#87) from chore/release-0.2.2 into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/87 Reviewed-by: The_River <[email protected]> v0.2.2	2026-10-09 22:07:46 +00:00
ekklesia	c4fded6ecf	chore(release): prepare 0.2.2	2026-10-09 16:55:18 -05:00
The_River	9ad2d5b564	Merge pull request 'feat: corresponding-source artifacts for native packages that redistribute copyleft code (ADR 0055)' (#86) from feat/corresponding-source into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/86 Reviewed-by: The_River <[email protected]>	2026-10-09 04:34:50 +00:00
ekklesiaandClaude Opus 5.5	98d93cc12d	docs: accept ADR 0052, whose supplement mechanism is fully implemented ... Every decision in ADR 0052 is implemented and tested in @ekklesia/module-pack: - package material first, and a supplement only adds to it; - reviewed, generic supplement data, checked in with the packager; - an exact name, version, and content-digest match, failing closed on any mismatch; - the documented, host-independent digest; - a deterministic, labelled merge; - no licence override, with a consistency check; - no network during packaging; - packageFormat 1. The libvips 1.3.3 and 1.3.4 supplements are curated and shipped. The source-obligation determination it deferred is now decided by ADR 0055. Only the status line and the index entry change; the decision text is untouched. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-08 23:24:16 -05:00
ekklesiaandClaude Opus 5.5	e083c44e05	feat: corresponding-source artifacts for native packages that redistribute copyleft code (ADR 0055) ... Ekklesia may publicly distribute a native Module Package containing LGPL or MPL components only beside a version-specific corresponding-source artifact. The artifact carries the exact source, patches, build definitions, and rebuild and relink instructions for those components. ADR 0055 (Accepted) records the policy: project compliance policy, not legal certification. It decides the item ADR 0052 deferred, and extends ADR 0049's distributable-release gate. Module Package v1, packageFormat 1, and both libvips supplements are unchanged. The mechanism is generic and lives in @ekklesia/module-pack: - Source recipes: reviewed data under corresponding-sources/<package>/<version>/. recipe.json names the exact package (name, version, content digest) and the exact supplement it was prepared with, and lists every component with its role, licence, licence material, and relationship to the binary. Every source file and patch is recorded by origin, size, and SHA-256; documents are hashed too, and every exclusion has a reason. Loading is strict and refuses anything unlisted. - Acquisition (the only network step) fetches each recorded file once into a cache keyed by SHA-256. It uses node:https with exact headers and no decoding, retries transient failures, and stores only bytes that match. - Construction is offline. From a built package it finds the covered native dependencies (by declared licence, or by a supplement component's licence), verifies every byte, and writes four sibling artifacts: the deterministic <package>-corresponding-source.tar.gz and its .sha256; <package>.redistribution.json, linking package, dependencies, supplement, recipe, and source by digest; and <package>.source-notice.txt, the release notice. - The public-distribution gate (verifyRedistribution, `ekklesia-corresponding-source verify`) approves only when the recipe, supplement, canonical archive, manifest, and metadata identify exactly these files. It refuses bundled copyleft code, and approves packages with no covered native code without an artifact. packModule is untouched. First complete proof: @img/[email protected] (sharp 0.35.5), from the reviewed supplement and provenance. - 383 components and 387 source files, about 208 MB: the sharp-libvips v1.3.4 build definitions, the 27 library archives, the five build-time patches, the 353 crates librsvg's resolved Cargo.lock records, and rust-src for nightly-2026-09-27 (rustc 75a75c3e0), which vendors std's dependencies. - BUILDING.md and two helpers point sharp-libvips's unchanged build logic at those files. - Followed in a Rocky Linux 8 container with networking disabled, they rebuilt libvips-cpp.so.8.18.7, byte-identically across two builds. Swapped into a verified, extracted native package, the rebuilt library was the one loaded, and sharp ran. - The native proof's source artifact, native-proof-0.1.0-linux-x64-glibc-corresponding-source.tar.gz, is 207242785 bytes, sha256 cc405492032b04a5391ab84e64f0e5e50f78e571ef7818204782c25a03eb50b7. It is byte-identical from unrelated directories and from a cache acquired fresh from upstream. Tests: - corresponding-source.test.ts runs in CI: synthetic inputs, every negative case, acquisition with retries and refusal, and determinism. - corresponding-source-native.test.ts checks the real recipe everywhere. With a verified cache (`pnpm test:corresponding-source`, which acquires once) it builds the real artifact twice, gates it, fails it closed, and runs sharp from the package. Docs: the module guide's distribution section, the README and architecture notes, and an ADR 0052 cross-reference. No Signage change, version bump, publication, or tag. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-08 23:17:35 -05:00
The_River	4919db6168	Merge pull request 'chore(release): prepare 0.2.1' (#85) from chore/release-0.2.1 into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/85 Reviewed-by: The_River <[email protected]> v0.2.1	2026-10-09 03:00:59 +00:00
ekklesiaandClaude Opus 5.5	6e76293620	chore(release): prepare 0.2.1 ... Every platform workspace package and every public @ekklesia/* package declares 0.2.1, and the deploy README's image build example names it. templates/module and the fixture modules keep their own versions. 0.2.1, a patch: since v0.2.0 (1788d17), main has one change, #84. It adds the reviewed supplement for @img/[email protected] and moves the packager's native proof to sharp 0.35.5. That is new packager data and test-only dependencies. No SDK, manifest, database ABI, packageFormat, or package API changed. The standalone fixture consumes exactly this release: its @ekklesia ranges become ^0.2.1 and its module-pack pin 0.2.1 (docs/development/releases.md, step 1). Module compatibility ranges stay ^0.2.0, as the release guide says a patch version requires. The template, the standalone fixture, the native proof module, and the test fixtures modelling the current platform are therefore unchanged. A module built for 0.2.0 remains compatible with 0.2.1. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-08 21:45:13 -05:00
The_River	3b54a7f023	Merge pull request 'feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5' (#84) from feat/libvips-1.3.4-supplement into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/84 Reviewed-by: The_River <[email protected]>	2026-10-09 02:43:21 +00:00
ekklesiaandClaude Opus 5.5	afaf3a853c	feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5 ... sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp 0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's code changes: supplement selection is already by exact name, version, and content digest. - Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/ - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59; - 190 components and 146 hashed texts; - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method reproduces the 1.3.3 supplement byte for byte. - PROVENANCE.md records: - the 27 upstream archives and five build-time patches, by sha256; - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…); - rustc 75a75c3e…; - every change from 1.3.3. - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still carries it. - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3. - The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed libvips, and each matches only its own. - Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour, detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4. The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64. - Docs: the module guide's note on available supplements. No version bump, no publication, no tag. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-08 21:34:35 -05:00
The_River	1788d17f0a	Merge pull request 'fix: hand npm the release artifact's absolute path, so publishing finds it' (#83) from fix/publish-absolute-artifact-path into main ... Reviewed-on: https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia/pulls/83 Reviewed-by: The_River <[email protected]> v0.2.0	2026-10-08 23:22:00 +00:00