11 commits

Author	SHA1	Message	Date
Arena Agent	2510dd6c17	docs(nigig-site): update SITE-12 for the de-vendoring in f9c1235 ... The previous row said xitca-web was vendored in this repository (519 files) and attributed the workspace-member blocker to xitca-web/web/Cargo.toml inheriting rust-version and lints from the wrong workspace root. f9c1235 dropped the vendored xitca-web for crates.io `xitca-web = "0.8"`, so both statements were already stale when written. Current, verified state: - nigig-lite/crates/common (package nigig-common) is present; it now also uses crates.io xitca-web. - Adding `nimanyatta` to the workspace still fails `cargo metadata` with exit 101, but the cause is different: "multiple workspace roots found in the same workspace: nimanyatta, nigig-lite/crates/common, nigig-org". Both sub-crates carry their own [workspace] table. The fix is to delete those tables or add both paths to the root exclude list — but nigig-common's table is documented as deliberate ("keeps it independent from any parent workspace"), so this is a decision for the server team rather than a mechanical change. Verified: cargo test -p nigig-site-core = 228 passed / 1 ignored; cargo test -p nimanyatta-protocol = 14 passed; clippy -D warnings clean on both; cargo fmt --check clean; table renders (59 SITE rows, uniform columns). Note on an intermediate false signal: a test run reported 196 passed / 32 failed. All 32 failures were `Os { code: 28, StorageFull }` in repository::tests, caused by a 906 MB build directory I had left in the 993 MB /tmp tmpfs while checking whether the server resolves. After clearing it, the suite is 228/228 again. No code was involved.	2026-09-26 18:20:07 +00:00
Arena Agent	12f59109d7	revert(nigig-site): ce9e12b was wrong — the HTTP wire field is body, not text ... Commits dfffe9e + 13ae501 landed nigig-lite/crates/common (package `nigig-common`) and a vendored xitca-web into this repository, which makes the /sync wire format readable for the first time. Reading it shows ce9e12b was incorrect. There are TWO MessageContent types, deliberately: - nigig_common::MessageContent::Text { body, formatted_body, mentions } — the HTTP/JSON REST DTO. Its own doc-comment: "Serialises externally tagged, e.g. {"Text":{"body":"hi",…}}". This is what SendMessageRequest.content and TimelineEvent::Message.content are. - nimanyatta_protocol::MessageContent::Text { text } — the WebSocket chat protocol, serialized with postcard. nigig-common's manifest says that format "must match nimanyatta/crates/nimanyatta-protocol (the client library)". ce9e12b changed the E2E test's outgoing posts from {"Text":{"body":…}} to {"Text":{"text":…}}, reasoning from the WebSocket type. The original `body` was correct for these HTTP endpoints; my change would have made both requests fail deserialization. Reverted, and the now-unused nimanyatta-protocol dev-dependency is dropped from nigig-site. What ce9e12b got right is kept: the parser had keyed on "type":"message", but TimelineEvent carries no serde tag attribute, so it is externally tagged — {"Message":{…,"sender":…,"content":…}} with sender and content at the variant level. event_text still accepts that envelope (plus the legacy lowercase shape and `text` as last-resort field names). The fixture's cross-check test was rebuilt against nigig_common's real shape instead of the WebSocket type. It is NOT verified by execution: nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this host. The parser was verified instead by extracting event_text/sync_timelines verbatim into a standalone harness over four cases — nigig_common Message with `body` -> Some(("alice","slab done")); Membership -> None; Redaction -> None; legacy lowercase -> Some(("bob","old")). All pass. The harness is scratch, not shipped. EXECUTION_PLAN.md SITE-12 rewritten: the sibling repos are no longer missing, the /sync DTOs are named with their file paths, both MessageContent types are distinguished, and the narrower remaining blockers are stated — nimanyatta still cannot be a workspace member (xitca-web/web/Cargo.toml inherits rust-version and lints from a workspace root, and nested here it resolves to ours, which defines neither), and a full `cargo check --features b_server` has not completed on this host, so no build claim is made. Verified: cargo test -p nimanyatta-protocol = 14; cargo test -p nigig-site-core = 228 / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0.	2026-09-26 17:39:20 +00:00
Arena Agent	ce9e12b4b9	fix(nigig-site): send and parse the message shape the server actually uses ... Follow-up to ac40ac9, which fixed only the parse side and overstated the consequence. Three corrections and two further defects. CORRECTION to my own previous claim: ac40ac9's message and the SITE-12 plan row both said that with only `content.Text.body` supported, `live_round_trip` "would still pass". That is false. sync_e2e.rs asserts `timelines.iter().any(|(_, lines)| lines.iter().any(|l| l.contains(&marker)))`, so the run would have FAILED with "app parser must extract the marker" — a misleading diagnosis, but a failure, not a silent green. The fixture bug was real; the consequence I described was not. Defect 1 — the test also SENT the wrong shape. Both message posts in live_round_trip sent {"Text":{"body":...,"formatted_body":null,"mentions":[]}}. nimanyatta/src/routes/rooms.rs binds `req.content` to a `MessageContent`, whose Text variant has a single field named `text`, so those requests would fail at deserialization before anything reached the timeline. Both now send {"Text":{"text":...}}. Defect 2 — the parser keyed on the wrong envelope. `event_text` required `event["type"] == "message"`, but the server constructs `TimelineEvent::Message { event_id, room_id, sender, content, timestamp, edited, reply_to }` (verified at the construction site in routes/rooms.rs), and `sender`/`content` live at the variant level, not under a `type` tag. What is still unknown, and is NOT guessed here: TimelineEvent's serde tagging. It is defined in `nigig_common`, which is absent from this repository, so neither externally- nor internally-tagged can be confirmed. Rather than pick one, event_text now accepts both envelopes plus the legacy lowercase shape, and `body` is kept as a last-resort field name. Membership and Redaction events are still skipped. Verification, stated precisely: - The fixture's own test target cannot be compiled here: nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this 2 vCPU / 1.9 GiB host. The shipped cross-check test remains unverified until CI runs it. - event_text and sync_timelines were instead extracted verbatim from the fixture into a standalone harness and exercised over five cases: externally tagged -> Some(("alice","slab done")); internally tagged -> Some(("bob","poured")); legacy lowercase with `body` -> Some(("carol","old")); Membership -> None; Redaction -> None. All pass. That harness is scratch, not part of the tree. Unchanged and still passing: cargo test -p nimanyatta-protocol = 14; cargo test -p nigig-site-core = 228 / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0; 6/6 workflow python gates.	2026-09-26 16:12:03 +00:00
Arena Agent	ac40ac923f	fix(nigig-site): read the timeline field the protocol crate actually emits ... Pinning nimanyatta-protocol's JSON shape exposed a live bug in the E2E fixture, and answering "is nigig_common in this repo?" narrowed the SITE-12 gap. The bug: MessageContent::Text serializes as {"Text":{"text":"..."}}. tests/support/nimanyatta_fixture.rs::event_text only looked for content.Text.body — a field that type never emits, and which serde_json::from_str::<MessageContent> actively rejects. Against a real server every message would have been skipped, sync_timelines would return an empty vec, and live_round_trip would still have passed. A silently vacuous interop test is exactly the failure mode SITE-00 exists to prevent. - event_text now tries `text` first and keeps `body` as a fallback. - New test in nimanyatta-protocol pins the serialized shape and asserts the fixture's old guess does not decode. - New cross-check test in the fixture builds its payload from the real MessageContent type, so parser and protocol cannot diverge silently again. What was verified and what was not: - The protocol-crate tests run: 14 passed. - The fixture cross-check test COULD NOT be compiled or run here. nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this 2 vCPU / 1.9 GiB host. The parser change was instead verified by extracting event_text/sync_timelines verbatim from the fixture into a standalone harness: {"Text":{"text":"slab done"}} -> Some(("alice","slab done")), the legacy {"Text":{"body":...}} shape still falls back, and a non-message event returns None. That harness is not part of the shipped tree; the shipped cross-check test is unverified until CI runs it. Also recorded in EXECUTION_PLAN.md SITE-12: nigig_common is confirmed absent from this repository (no package by that name; RoomEvent/RoomInfo/ JoinedRoomSync/SyncFilter/PaginationDirection defined nowhere here; nigig-core is an email/IMAP crate), and it re-exports nimanyatta-protocol via a `protocol` module — the server writes nigig_common::protocol::{ClientToServerMsg, ServerToClientMsg}. So of the 75 items the server imports from nigig_common, 9 are the crate already pinned here; the remaining 66 are the HTTP DTO layer, ~11 of which /sync needs. Verified: cargo test -p nimanyatta-protocol = 14 passed; cargo test -p nigig-site-core = 228 passed / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0; all 6 workflow python gates.	2026-09-26 12:37:08 +00:00
Arena Agent	3d91404ab6	build(nimanyatta): make the protocol crate a workspace member and pin its wire format ... First concrete step on SITE-12. Three of the four planned steps turned out to be impossible from this repository, and that is now recorded with evidence rather than assumed. What this commit does: 1. `nimanyatta/crates/nimanyatta-protocol` is a workspace member. It has no path dependencies (only optional serde + postcard), so unlike its parent package it can be compiled and tested here. `cargo metadata` still exits 0. 2. Its 8 pre-existing tests HAD NEVER COMPILED. The crate is `#![no_std]`, so `use super::*` brings in alloc's `String` but not the `ToString` trait, and the test module calls `.to_string()` — 6 E0599 errors. Fixed with one import; 8 tests now run and pass. 3. Added 5 wire-format characterization tests pinning the exact postcard bytes. postcard encodes enum variants as POSITIONAL INDICES, so reordering or inserting a variant silently changes every frame on the wire while the code still compiles and every round-trip test still passes. Verified by mutation: swapping AuthMethod::Password/Token changes the login frame from [0, 0, 5, ...] to [0, 1, 5, ...] and the pinned test fails. 4. Corrected a false doc comment. `sync_protocol.rs` claimed "one canonical encoding is used by app, server, and tests". It is not. Read from source: the server's POST /sync uses Json<SyncRequest>/Json<SyncResponse> whose types come from `nigig_common` (not from nimanyatta-protocol, which is a WebSocket chat protocol the server uses only for `is_guest`), and sync_protocol.rs is a third, separate offline-envelope codec. What could not be done, with evidence: - `nimanyatta` itself cannot be a workspace member: adding it makes `cargo metadata` fail with exit 101 "failed to load manifest for workspace member", because Cargo resolves path dependencies even for features that are not enabled, and ../nigig-lite/crates/common and ../xitca-web/web do not exist. Verified by adding it, observing 101, and removing it. - Neither sibling repo can be vendored or submoduled: `git ls-remote` on gitdab.com/andodeki/nigig-lite and /xitca-web both return HTTP 500, identical to a deliberately fake repo name, while /nigig-org resolves normally. - Repointing xitca-web to crates.io would not unblock the build on its own: `nigig_common` is imported by 38 server files (~40 items) and has no published equivalent. Guessing RoomInfo/RoomEvent field definitions would produce a codec that silently mismatches the real server, which is worse than the current explicit "three incompatible protocols" state. rustfmt was applied to the protocol crate (120 insertions / 29 deletions, all whitespace: it had never been formatted, including a stray indent on ServerToClientMsg::login_success). No semantic change. Verified: cargo test -p nimanyatta-protocol = 13 passed; cargo test -p nigig-site-core = 228 passed / 1 ignored; clippy -D warnings clean on both; cargo fmt --check clean; cargo check -p nigig-site --locked clean; cargo metadata exit 0; all 6 workflow python gates pass.	2026-09-26 11:53:58 +00:00
Arena Agent	99bb979850	feat(nigig-site-core): implement SITE-18/19/26/27/29/30 domain layers ... Six new UI-free modules in nigig-site-core, 53 tests added (175 -> 228): - procurement_flow.rs (SITE-26): requisition -> LPO -> delivery, two-approver gate (three above KES 500,000), budget commitment at approval, Delivered reachable only via verify_delivery with evidence assets, supplier ratings that are None until evidence exists. Integer cents with i128 saturating multiplication; no f64 money anywhere. - meeting_flow.rs (SITE-27): RSVP, per-participant recording consent where a refusal cannot be flipped to a grant, transcript refused until a recording has started, action-item tracker. - dashboards.rs (SITE-29): integer chart series, per-site snapshots, worst- first cross-site comparison, and a client digest built from an explicit field allow-list that fails closed on a smuggled key. - documents.rs (SITE-30): revision states where approval supersedes its predecessor and withdrawal clears `current` in the same operation, so a withdrawn drawing can never be served as current. - notification_rules.rs (SITE-18): delivery modes, midnight-crossing quiet hours in the site zone, safety-critical subjects that cannot be muted and bypass suppression, bodies generated from a closed vocabulary so no PII can enter one. - multi_site.rs (SITE-19): per-site roles, a switcher that refuses unknown or unregistered sites rather than falling back, sessions that authorize only their own site, and an offline queue that drains per site. Two API gaps fixed while wiring these up: - report_pack::Report::canonical_text is now public; it was private, so no caller outside report_pack could produce a valid approval signature. - hse::HseStats now derives Serialize/Deserialize; FR-1.7 embeds it in the published monthly report but it could not be serialized. EXECUTION_PLAN.md: §1a rows for these six tranches updated to their real state, the honest completion statement recomputed (28/33 with tested domain contracts, 4 externally blocked, 1 not started), and §2.1 corrected - it still repeated the false "nimanyatta is only a README stub" claim that §1a was already corrected for. Verified: cargo test -p nigig-site-core = 228 passed / 0 failed / 1 ignored; cargo clippy --all-targets --no-deps -D warnings clean; cargo fmt --check clean; cargo check -p nigig-site clean; all 6 workflow python gates pass. cargo test -p nigig-site remains unrunnable here (SIGKILL compiling makepad-widgets on 2 vCPU / 1.9 GiB). CI workflow work deferred by request.	2026-09-26 11:32:43 +00:00
andodeki	75781d69ce	docs(nigig-site): correct the SITE-12/SITE-08 server and protocol facts ... Two claims in the 2026-09-26 ledger were wrong and are corrected here. Wrong: "no nimanyatta server source in the repository (only a README stub)". That is true only of crates/nimanyatta/, which really is 2 files. The root nimanyatta/ directory holds a substantial server: 31,458 lines across 78 files, with routes/{auth,roles,rooms,sms_auth,sync,tenants,realtime} and a POST /sync handler taking SyncRequest/SyncResponse under an authenticated tenant context. Right, and now stated precisely: it is still not wired to nigig-site and cannot be built from this repository as-is. It is not a workspace member (the root manifest names only crates/nimanyatta), and nimanyatta/Cargo.toml depends on ../nigig-lite/crates/common and ../xitca-web/web, sibling directories that do not exist here (0 files each). Wrong by omission: SITE-08 said the gap was "no server and no second implementation". There are in fact three mutually incompatible protocol definitions -- the server's JSON SyncRequest/SyncResponse, the postcard-based nimanyatta-protocol (1,531 lines), and this crate's sync_protocol.rs SyncEnvelope. Neither site manifest mentions nimanyatta at all, so the exit criterion "app/server/tests use one protocol crate" is unmet rather than merely pending. The E2E fixture also expects Matrix-style joined_rooms/timeline/content.Text.body, which is not the server's shape. Verified 2026-09-26 against origin/feature/daily-reports at 0819e97.	2026-09-26 10:57:10 +00:00
andodeki	0819e97074	feat(nigig-site): compile and test the hardening core; add SITE-20..28 domain ... Thirteen hardening modules (3,079 lines) sat in nigig-site/src/ declared in no mod statement. They had never been compiled or tested: cargo check never saw them, and the plan's "implemented in the worktree and pending verification" status was unverifiable by construction. Extract the UI-free core into crates/apps/nigig-site-core (scope 5's "Rust core crate ... testable; safe"; plan 6's target architecture). nigig-site depends on it and re-exports it, so there is one copy of each module source: the app and the core's unit tests compile the same files. The core has no Makepad dependency, so its contracts run on a memory-limited runner. Compiling that code for the first time found four real defects, all fixed: - Role/Capability lacked Ord, so every BTreeSet of them failed to compile (auth.rs) - CaptureResult::empty never initialised site_id from its site parameter (ocr_policy.rs) - negotiate_version(2, 5) agreed on a protocol the peer never offered, which is the silent downgrade the function exists to prevent (sync_protocol.rs) - an absurd frame size returned Overflow instead of the actionable budget breach (media_bounds.rs) New feature-tranche domain modules, each with unit tests: - organisation.rs SITE-20 invites, per-site roles, the 4.2 matrix as testable data, site registry with geofence, settings - report_pack.rs SITE-21 report numbering, entry status, signatures binding actor/device/timestamp/document hash, lock and versioning, multi-site compilation, monthly packs - site_diary.rs SITE-22 weather with provenance, plant, deliveries, delay log where a weather delay needs supporting rainfall, visitors, manpower by trade - workforce.rs SITE-23 consent-gated registration, tag-only blocklist, attendance with overtime, QR badges, payroll CSV that never emits identity, offboarding tombstones - programme.rs SITE-25 dependencies with cycle detection and rollback, topological order, critical path, frozen baselines with slippage, checklists gating approval, snags, RFIs, variations needing two distinct approvers - hse.rs SITE-28 append-only incidents, closure requires corrective action, toolbox talks, inspections, monthly statistics workflows.rs gains the FR-1.14 Locked state; commands.rs gains a bounded non-empty text validator shared by the new modules. CI: the SITE-02 crypto/repository/store lanes pointed at -p nigig-site, where those suites no longer live; left alone they would have compiled nothing and reported a vacuous green. Repointed at the core, and added core-contracts and core-clippy lanes with a ">=100 tests collected" check so a lane cannot pass vacuously. All six existing Python contract gates still pass. Auto-purge of worker ID data refuses to run until the scope 18 retention question is answered rather than inventing a window. Verified 2026-09-26: cargo test -p nigig-site-core --locked = 175 passed, 0 failed, 1 ignored (needs a live Secret Service session); cargo clippy -p nigig-site-core --all-targets --no-deps -- -D warnings clean; cargo check -p nigig-site clean. cargo test -p nigig-site is still killed by SIGKILL compiling makepad-widgets on a 2 GB host, as recorded in plan 2.1. EXECUTION_PLAN.md gains a per-tranche status ledger (1a) that states plainly which tranches are done, domain-only, externally blocked, or not started, and records that this branch and main diverged at b3a9005 with SITE-03 published only on main.	2026-09-26 10:50:33 +00:00
andodeki	1516aa747b	Initial project: app scope + Makepad skeleton	2026-09-26 09:11:09 +03:00
Arena Agent	1cb6ad289b	docs(nigig-site): record SITE-00 and SITE-01 publication	2026-09-12 15:50:05 +00:00
Arena Agent	16a98334f1	docs(nigig-site): add security remediation execution plan	2026-09-12 07:59:51 +00:00