951322ea8c
backup(jules): snapshot of Jules Phase 2 WIP before addressing reviewer feedback
2026-08-27 19:21:29 -07:00
google-labs-jules[bot]
a613ed2b68
feat: execute Phase 1 architectural hypermedia framework
...
- Bootstraps `src/core/` foundation (`db.ts`, `valkey.ts`, `spire_ffi.ts`, `main.ts`).
- Adds `auth_guards.ts` for payload capping, CSRF check, and rate limiting.
- Adds `content_negotiation.ts` and `sse_adapter.ts` for Datastar transport helpers.
- Adds `error_fragments.tsx` for standardized Datastar error morphs.
- Introduces `scripts/lint_arch.ts` to block imperative DOM usage.
- Updates `deno.json` with src workspace configs and lint commands.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-28 01:20:01 +00:00
b9f4ccd71d
feat(auth): resolve mobile cookie shadowing and synchronize tasks/path.md
...
- Implement iterative session cookie candidate resolution in getAuthenticatedUser
- Eliminate Hono first-match limitation causing mobile login redirect loops
- Use absolute UTC ISO strings for PostgreSQL session expiry queries
- Opportunistically clear host-level cookies upon shadow detection
- Ensure exhaustive server-side session revocation across all cookie candidates on logout
- Add automated regression test for cookie shadowing in server/main.test.ts
- Rename and standardize tasks/path.md with 5-template orchestrator standard
2026-08-24 21:48:33 -07:00
google-labs-jules[bot]
947b38d81a
Investigate mobile login cookie persistence bug
...
- Investigated Chromium Android wildcard domain cookie behavior.
- Researched Hono's `getCookie` first-match parsing behavior.
- Added experimental Deno test scripts in `scratch/` for Hono cookie header parsing and pg timezone concepts.
- Wrote full root-cause analysis and ranked architectural solutions in `scratch/INVESTIGATIVE_REPORT.md`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 00:31:19 +00:00
574c4d66aa
fix(phase3): restore deno.json workspace/tasks and fix recovery/audit typing
2026-08-24 08:56:47 -07:00
google-labs-jules[bot]
97336a95be
feat(server): add RFC 6962 Merkle Tree Audit Ledger
...
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-24 06:19:23 +00:00
google-labs-jules[bot]
182c789e05
feat(auth): implement RFC 9421 HTTP Message Signatures
...
- Added native Deno WebCrypto Ed25519 signature verification middleware for headless edge workloads.
- Integrated dual authentication path to `/api/forward-auth` processing signatures and session cookies.
- Added dual storage Admin Management routes (`/api/admin/hwk`) securely inserting directly to PostgreSQL and pushing to $O(1)$ Valkey verification set.
- Completed all quality gates checks and hermetic mocked tests successfully.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-24 05:36:01 +00:00
e179ecd419
feat(setup): configure GHCR_REG defaulting to ghcr.atyg.org for SPIRE compose
2026-08-22 11:10:22 -07:00
google-labs-jules[bot]
9988df3218
audit: verify 3-tier auth, rbac, and decouple server side effects
...
- Add `app` export and wrap startup logic behind `if (import.meta.main)`
- Extract `hono` middleware into `sdk/hono.ts` for clean separation
- Refactor module imports slightly to support in-memory native mocking (`db`, `valkey`, `spire_ffi`, `ratelimit`, `audit`)
- Implement comprehensive native Deno mock tests in `server/main.test.ts`
- Fix type checking across project files
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-22 00:29:19 +00:00
474cc177ce
chore: adopt dual licensing and import task history & scaffolding
...
- Add LICENSE-MIT and LICENSE-APACHE for dual MIT / Apache-2.0 distribution
- Update root LICENSE pointer, README.md, Deno workspace manifests, and Cargo.toml
- Add deno.lock dependency lockfile
- Format AGENTS.md system guidelines
- Import task lifecycle scaffolding and historical story specifications (extract-auth-yes, setup-ts architecture, modular workspace)
2026-08-21 15:20:36 -07:00
