Jakob WennbergandClaude Opus 4.8
bc61862e76
* feat(agent): telemetry completeness + durability, CI gates, commit_method provenance Quick wins from the "Building AI systems that ship" audit: - mcp.tool_called gains errorMessage (message_sv, truncated 500 chars) on all failure exits; new mcp.skill_loaded event on every gnubok_load_skill (all tiers) so atom usage is finally measurable - event_log: (event_type, created_at) index; cleanup cron keeps mcp.*/agent.* telemetry 180 days (delivery events stay 30) - CI: lint ratchet (npm run check:lint — 60 legacy errors baselined, fails only on NEW errors) and a pg-real coverage gate (migrations touching trigger/RPC/RLS/DEFERRABLE require a *.pg.test.ts change; escape hatch: -- pg-test: covered-by/skip) - journal_entries.commit_method CHECK widened with 'api_key'/'agent'; the MCP approve path records 'api_key' truthfully instead of 'user_accept' (agent_first_vision §8 P0-1). 'agent' is reserved — ALL MCP traffic (incl. claude.ai OAuth, whose access_token is a minted API key) authenticates as api_key today Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(import): derive opening balances from prior-year #UB when SIE lacks #IB (#675) SIE files exported without #IB 0 rows (only #UB -1) previously imported with zero opening balances. getEffectiveOpeningBalances() now derives IB from prior-year UB for balance-sheet accounts when explicit #IB is absent, surfaces the derivation as an info issue in the import preview, and excludes share-capital vouchers from opening-balance detection. Detection regexes are shared between parser and importer so the two checks cannot drift. 507 lib/import tests pass. (Authored in a parallel session in this checkout; included per request.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(review): address PR #677 bot findings — RoPA entry, execFileSync, gate scope note Triage of the compliance-swarm + Greptile findings: Applied: - .compliance/ropa.yaml: new mcp.telemetry processing activity declaring the 180-day mcp.*/agent.* retention, lawful basis, data categories, and the no-args/no-results minimisation (ISO A.8.10, GDPR Art.5(1)(c) — the retention split is now formally documented, referenced from the cron) - check-pg-test-coverage.mjs: execFileSync with argv array — no shell, so a hostile base-ref can't inject (ASVS V13.2.1); verified an injection attempt exits 2 without executing - check-pg-test-coverage.mjs: documented the PR-level (not per-migration) scope of the gate so reviewers know to check coverage per migration when a PR carries several risky migrations (Greptile P2) Acknowledged, no change: - errorMessage PII risk: messages are domain-mapped strings; event_log already persists far richer delivery payloads under the same RLS; now declared in ropa.yaml - cron error envelope: errorResponse maps to the canonical safe envelope and the endpoint is CRON_SECRET-gated - two-pass delete "partial state": TTL deletes are idempotent — the next daily run sweeps whatever a failed pass left behind - skill_loaded actorLabel/sessionId: mirrors the pre-existing mcp.tool_called payload; sessionId is the join key the analytics exist for Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
48 lines
2.1 KiB
YAML
48 lines
2.1 KiB
YAML
name: Core Build (no extensions)
|
|
|
|
on: [pull_request]
|
|
|
|
jobs:
|
|
core-only:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
- run: npm ci
|
|
- name: Verify skill bodies are in sync with the seed migration
|
|
# Fails if a .claude/skills/**/SKILL.md changed without regenerating the
|
|
# seed migration (npm run skills:generate). Keeps prod skill content from
|
|
# silently drifting out of sync. No DB needed — reads files + manifest.
|
|
run: npm run skills:check
|
|
- name: Reset extensions config
|
|
run: echo '{"extensions":[]}' > extensions.config.json
|
|
- run: npm run setup:extensions
|
|
- name: Lint ratchet (no new ESLint errors)
|
|
# `npm run lint` was never wired into CI, so ~60 legacy errors
|
|
# accumulated. This ratchet (sibling of check:guards) fails only when
|
|
# a PR ADDS an error beyond scripts/checks/eslint-baseline.json; the
|
|
# baseline ratchets down as legacy errors get fixed.
|
|
run: npm run check:lint
|
|
- run: npm run build
|
|
- run: npm test
|
|
- name: Antipattern ratchet (no new MFA-bypassing routes / naive öre-rounding)
|
|
# Fails only if a PR ADDS a route that hand-rolls supabase.auth.getUser()
|
|
# instead of the MFA-enforcing guard, or a new Math.round(x*100)/100.
|
|
# Baseline lives in scripts/checks/antipatterns-baseline.json and ratchets
|
|
# down as the A1 (route auth) and D1 (rounding) migrations land.
|
|
run: npm run check:guards
|
|
- name: Check no core imports from extensions
|
|
run: |
|
|
VIOLATIONS=$(grep -r "from '@/extensions/" lib/ app/api/ components/ --include="*.ts" --include="*.tsx" \
|
|
| grep -v "app/api/extensions/" \
|
|
| grep -v "components/extensions/" \
|
|
| grep -v "lib/extensions/_generated/" \
|
|
| grep -v "lib/extensions/loader.ts" || true)
|
|
if [ -n "$VIOLATIONS" ]; then
|
|
echo "ERROR: Core code imports from @/extensions/:"
|
|
echo "$VIOLATIONS"
|
|
exit 1
|
|
fi
|