792 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
andodeki	7daf48e14c	fix(site-core): seed loopback cursor from base so resumed pushes advance correctly	2026-09-28 03:14:28 +03:00
andodeki	0480b2d8e8	wip(daily-reports): follow-up local updates for Phase 0 freeze (approvals/procurement screens, programme, pdf recording) site-02-rc1	2026-09-27 17:02:54 +03:00
andodeki	88d46600e1	wip(daily-reports): preserve local site/report/worker, ocr and lite-common updates for Phase 0 freeze	2026-09-27 16:25:50 +03:00
andodeki	74348fb6e1	docs(cad-ui): sync plan status to complete with §0 ledger and honest residuals	2026-09-27 02:40:10 +03:00
nigig-bot	bdf8fc9694	nigig-ocr OCR-T1: real Tesseract engine, honest UI state, correct ingest/export ... - providers/tesseract: system tesseract (TSV → text + normalized word boxes), installed-language detection; default_engine() picks Vision/Tesseract/none - image_prep: decode, validate, apply rotation before recognition - jobs: background OcrJob with progress, cancel, per-item results - ui_state: no fake success toasts; clipboard/export/share report real outcomes - ingest: real decode validation, size caps, shared PDF pages (no duplication) - export: atomic writes, paginated multi-page PDF, refuse non-WinAnsi text - capture: fixed drag anchor; settings: atomic save + applied to new files - drop unused deps; tests: 78 pass incl. 5 real-OCR on a fixture - EXECUTION_PLAN: correct overstated status	2026-09-26 18:35:10 +00:00
Arena Agent	2510dd6c17	docs(nigig-site): update SITE-12 for the de-vendoring in f9c1235 ... The previous row said xitca-web was vendored in this repository (519 files) and attributed the workspace-member blocker to xitca-web/web/Cargo.toml inheriting rust-version and lints from the wrong workspace root. f9c1235 dropped the vendored xitca-web for crates.io `xitca-web = "0.8"`, so both statements were already stale when written. Current, verified state: - nigig-lite/crates/common (package nigig-common) is present; it now also uses crates.io xitca-web. - Adding `nimanyatta` to the workspace still fails `cargo metadata` with exit 101, but the cause is different: "multiple workspace roots found in the same workspace: nimanyatta, nigig-lite/crates/common, nigig-org". Both sub-crates carry their own [workspace] table. The fix is to delete those tables or add both paths to the root exclude list — but nigig-common's table is documented as deliberate ("keeps it independent from any parent workspace"), so this is a decision for the server team rather than a mechanical change. Verified: cargo test -p nigig-site-core = 228 passed / 1 ignored; cargo test -p nimanyatta-protocol = 14 passed; clippy -D warnings clean on both; cargo fmt --check clean; table renders (59 SITE rows, uniform columns). Note on an intermediate false signal: a test run reported 196 passed / 32 failed. All 32 failures were `Os { code: 28, StorageFull }` in repository::tests, caused by a 906 MB build directory I had left in the 993 MB /tmp tmpfs while checking whether the server resolves. After clearing it, the suite is 228/228 again. No code was involved.	2026-09-26 18:20:07 +00:00
Arena Agent	12f59109d7	revert(nigig-site): ce9e12b was wrong — the HTTP wire field is body, not text ... Commits dfffe9e + 13ae501 landed nigig-lite/crates/common (package `nigig-common`) and a vendored xitca-web into this repository, which makes the /sync wire format readable for the first time. Reading it shows ce9e12b was incorrect. There are TWO MessageContent types, deliberately: - nigig_common::MessageContent::Text { body, formatted_body, mentions } — the HTTP/JSON REST DTO. Its own doc-comment: "Serialises externally tagged, e.g. {"Text":{"body":"hi",…}}". This is what SendMessageRequest.content and TimelineEvent::Message.content are. - nimanyatta_protocol::MessageContent::Text { text } — the WebSocket chat protocol, serialized with postcard. nigig-common's manifest says that format "must match nimanyatta/crates/nimanyatta-protocol (the client library)". ce9e12b changed the E2E test's outgoing posts from {"Text":{"body":…}} to {"Text":{"text":…}}, reasoning from the WebSocket type. The original `body` was correct for these HTTP endpoints; my change would have made both requests fail deserialization. Reverted, and the now-unused nimanyatta-protocol dev-dependency is dropped from nigig-site. What ce9e12b got right is kept: the parser had keyed on "type":"message", but TimelineEvent carries no serde tag attribute, so it is externally tagged — {"Message":{…,"sender":…,"content":…}} with sender and content at the variant level. event_text still accepts that envelope (plus the legacy lowercase shape and `text` as last-resort field names). The fixture's cross-check test was rebuilt against nigig_common's real shape instead of the WebSocket type. It is NOT verified by execution: nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this host. The parser was verified instead by extracting event_text/sync_timelines verbatim into a standalone harness over four cases — nigig_common Message with `body` -> Some(("alice","slab done")); Membership -> None; Redaction -> None; legacy lowercase -> Some(("bob","old")). All pass. The harness is scratch, not shipped. EXECUTION_PLAN.md SITE-12 rewritten: the sibling repos are no longer missing, the /sync DTOs are named with their file paths, both MessageContent types are distinguished, and the narrower remaining blockers are stated — nimanyatta still cannot be a workspace member (xitca-web/web/Cargo.toml inherits rust-version and lints from a workspace root, and nested here it resolves to ours, which defines neither), and a full `cargo check --features b_server` has not completed on this host, so no build claim is made. Verified: cargo test -p nimanyatta-protocol = 14; cargo test -p nigig-site-core = 228 / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0.	2026-09-26 17:39:20 +00:00
arena-agent	f9c12359bf	nimanyatta: drop vendored xitca-web, use crates.io sources ... Delete the vendored xitca-web framework checkout at repo root and repoint all consumers at the published crates: - nimanyatta/Cargo.toml: drop path overrides on xitca-web (deps + dev-deps), remove the xitca-client dep (never published on crates.io) from the manifest and the load/b_server features, and remove the [patch.crates-io] section that forced every xitca-* crate onto the vendored checkout. - nigig-lite/crates/common: xitca-web path dep -> version 0.8 from crates.io (vendored snapshot was 0.8.1, identical). - Test suites (shared_test_client, security_suite, enhanced_security, enhanced_security_tests) and kra-etims-sdk: migrate xitca-client HTTP usage to reqwest from crates.io, preserving request semantics (header-override order, error mapping). Verified in a fresh clone on the pinned toolchain (1.97.1): nigig-common checks, security/enhanced suites check, and the session/fast/regression harness binaries build.	2026-09-26 17:16:51 +00:00
andodeki	13ae5017af	nimanyatta: align the WS wire format with nimanyatta-protocol (postcard) ... The remote's protocol-crate commits pinned the client wire format, and the pre-existing chat_load_tester_consistency suite already decoded ServerToClientMsg with postcard — but the reconstructed nigig-common was encoding with serde_json. Switch to_bytes/from_bytes (both message enums) to postcard to match, and rebuild decode_all on postcard::take_from_bytes so a fragmented frame re-buffers and bytes trailing a complete message are preserved instead of dropped. AuthMethod (13 variants) is shape- and order-aligned with the client library. The remaining server/client shape divergences (missing reaction/upload/history variants, LoginSuccess/MessageDeleted/MessageContent field differences) are pre-existing in the original design — the gateway itself destructures MessageContent::Text { body } while the client emits Text { text } — and are now documented with a remediation path in KNOWN_ISSUES ("WS wire parity" section). nigig-common: 21/21 tests green with the postcard round-trips.	2026-09-26 16:31:04 +00:00
andodeki	dfffe9e6e6	nimanyatta: Phase 8 — reconstruct nigig-common, repair load suites, close REST coverage gaps ... Foundation: - Vendor xitca-web (upstream commit 7fa07dae, see xitca-web/VENDORED.md); pin all six xitca crates via [patch.crates-io] in nimanyatta/Cargo.toml - Reconstruct the lost nigig-common crate as nigig-lite/crates/common (21 unit tests, clippy-clean), recovered from the wire contract in crates/nimanyatta-protocol plus the server's own call sites REST API: - Register the four unwired room routes that were documented but never reachable: {room_id}/invite POST, /typing PUT, /read_receipt POST, /redact/{event_id} POST (root cause of the rooms.rs 50% coverage ceiling) - REST read receipts now return 501 Not Implemented (documented) instead of a 500 — receipts are recorded via the WebSocket MarkRead path - README API tables corrected to the real paths/methods; env table expanded (PROXY_TRUSTED_IPS, WS_ALLOWED_ORIGINS, CORS_ALLOWED_ORIGINS, ENABLE_OTEL, token durations) plus proxy-trust and WS-origin explainer sections Security & correctness: - WS_ALLOWED_ORIGINS is now fail-closed in production: an empty list is a configuration error at startup ('*' remains an explicit opt-out) - Fix the OTP attempt counter: the BEGIN/IF SurrealQL block was a parse error, so every wrong OTP failed the query and the fail-closed handler masked it as a first-try 429 OTP_MAX_ATTEMPTS_EXCEEDED. Now a single atomic conditional UPDATE ... WHERE attempts < $max, the handler logs the underlying error before failing closed, and a regression test covers store -> fetch -> increment -> persist - Gateway KNOWN_ISSUES #1/#2/#5 fixed (centralised idempotent cleanup_connection on all close paths; LoggedOut sent before remove_session); #3 verified already enforced via session eviction - DeliveryReceipt receipts now carry by_user: Option<String> per the protocol crate (was Option<UserId> at the call sites) Test suites: - Repair every load-test binary: added mains for the three bins whose bodies were #[tokio::test] functions (test items are cfg(test)-gated and vanish from normal builds), fixed protocol-shape drift in the rest — cargo check --features load --bins is clean - New route coverage tests: invite/join/409-reinvite/404-unknown, typing (member + 403 non-member), redact (happy path/404/403), read_receipt 501, custom-role denial, non-member send 403, pagination edges (limit, direction, invalid from-token), sync filter paths (room filter, timeline_limit, invalid since-token, empty filter semantics) - cargo test --features b_server: 51 passed / 0 failed Docs: - PLAN.md Phase 8 section + post-Phase-8 roadmap (per-site channels, pinned document library, document read receipts, mentions/search/broadcast/ moderation/retention, offline queue — documented as open scope gaps) - KNOWN_ISSUES.md statuses updated with the fixes above	2026-09-26 16:24:41 +00:00
Arena Agent	ce9e12b4b9	fix(nigig-site): send and parse the message shape the server actually uses ... Follow-up to ac40ac9, which fixed only the parse side and overstated the consequence. Three corrections and two further defects. CORRECTION to my own previous claim: ac40ac9's message and the SITE-12 plan row both said that with only `content.Text.body` supported, `live_round_trip` "would still pass". That is false. sync_e2e.rs asserts `timelines.iter().any(|(_, lines)| lines.iter().any(|l| l.contains(&marker)))`, so the run would have FAILED with "app parser must extract the marker" — a misleading diagnosis, but a failure, not a silent green. The fixture bug was real; the consequence I described was not. Defect 1 — the test also SENT the wrong shape. Both message posts in live_round_trip sent {"Text":{"body":...,"formatted_body":null,"mentions":[]}}. nimanyatta/src/routes/rooms.rs binds `req.content` to a `MessageContent`, whose Text variant has a single field named `text`, so those requests would fail at deserialization before anything reached the timeline. Both now send {"Text":{"text":...}}. Defect 2 — the parser keyed on the wrong envelope. `event_text` required `event["type"] == "message"`, but the server constructs `TimelineEvent::Message { event_id, room_id, sender, content, timestamp, edited, reply_to }` (verified at the construction site in routes/rooms.rs), and `sender`/`content` live at the variant level, not under a `type` tag. What is still unknown, and is NOT guessed here: TimelineEvent's serde tagging. It is defined in `nigig_common`, which is absent from this repository, so neither externally- nor internally-tagged can be confirmed. Rather than pick one, event_text now accepts both envelopes plus the legacy lowercase shape, and `body` is kept as a last-resort field name. Membership and Redaction events are still skipped. Verification, stated precisely: - The fixture's own test target cannot be compiled here: nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this 2 vCPU / 1.9 GiB host. The shipped cross-check test remains unverified until CI runs it. - event_text and sync_timelines were instead extracted verbatim from the fixture into a standalone harness and exercised over five cases: externally tagged -> Some(("alice","slab done")); internally tagged -> Some(("bob","poured")); legacy lowercase with `body` -> Some(("carol","old")); Membership -> None; Redaction -> None. All pass. That harness is scratch, not part of the tree. Unchanged and still passing: cargo test -p nimanyatta-protocol = 14; cargo test -p nigig-site-core = 228 / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0; 6/6 workflow python gates.	2026-09-26 16:12:03 +00:00
andodeki	c92e67fbd8	test(nigig-traffic): TRAFFIC-14 enable GUI runtime tests (4/4 green under Xvfb) ... - Remove all ignores in tests/ui.rs; harness failure was the broken pin plus no display. CI runs them via xvfb-run (xvfb, libgl1-mesa-dri). - HUD test: HUD is raw draw_text, not widgets; assert view survives Intro->Driving and capture screenshot instead of invisible selectors. - Docs: release gate ticked, blocker 2 closed, 430px HUD clipping noted. Verified: 121 pass / 0 fail / 0 ignored; clippy 0 owned; fmt; diff --check.	2026-09-26 13:20:51 +00:00
andodeki	5aac7e3920	fix(nigig-traffic): TRAFFIC-01 close P0-01 — coherent Makepad pin, green build/tests ... - Re-pin workspace makepad b580de1 -> a3d8f521 (fork branch nigig-traffic-camera-boom-fix: 5-arg camera_boom_limit callers + EntityLocal particle anchor port). Cargo.lock updated atomically. - Fix Walk literal broken by upstream fields (scenarios.rs). - First executed test run: reword two completion strings that tripped the banned-claim gate (gate unchanged). - Zero Traffic-owned compiler/clippy diagnostics; cargo fmt. - Docs: plan status + release gates, IMPLEMENTATION_STATUS round 3. Verified: check --all-targets clean; test 117 pass / 0 fail / 4 ignored (GUI); clippy 0 owned diagnostics; fmt; diff --check.	2026-09-26 13:06:50 +00:00
Arena Agent	ac40ac923f	fix(nigig-site): read the timeline field the protocol crate actually emits ... Pinning nimanyatta-protocol's JSON shape exposed a live bug in the E2E fixture, and answering "is nigig_common in this repo?" narrowed the SITE-12 gap. The bug: MessageContent::Text serializes as {"Text":{"text":"..."}}. tests/support/nimanyatta_fixture.rs::event_text only looked for content.Text.body — a field that type never emits, and which serde_json::from_str::<MessageContent> actively rejects. Against a real server every message would have been skipped, sync_timelines would return an empty vec, and live_round_trip would still have passed. A silently vacuous interop test is exactly the failure mode SITE-00 exists to prevent. - event_text now tries `text` first and keeps `body` as a fallback. - New test in nimanyatta-protocol pins the serialized shape and asserts the fixture's old guess does not decode. - New cross-check test in the fixture builds its payload from the real MessageContent type, so parser and protocol cannot diverge silently again. What was verified and what was not: - The protocol-crate tests run: 14 passed. - The fixture cross-check test COULD NOT be compiled or run here. nigig-site's test target pulls in makepad-widgets, which is SIGKILLed on this 2 vCPU / 1.9 GiB host. The parser change was instead verified by extracting event_text/sync_timelines verbatim from the fixture into a standalone harness: {"Text":{"text":"slab done"}} -> Some(("alice","slab done")), the legacy {"Text":{"body":...}} shape still falls back, and a non-message event returns None. That harness is not part of the shipped tree; the shipped cross-check test is unverified until CI runs it. Also recorded in EXECUTION_PLAN.md SITE-12: nigig_common is confirmed absent from this repository (no package by that name; RoomEvent/RoomInfo/ JoinedRoomSync/SyncFilter/PaginationDirection defined nowhere here; nigig-core is an email/IMAP crate), and it re-exports nimanyatta-protocol via a `protocol` module — the server writes nigig_common::protocol::{ClientToServerMsg, ServerToClientMsg}. So of the 75 items the server imports from nigig_common, 9 are the crate already pinned here; the remaining 66 are the HTTP DTO layer, ~11 of which /sync needs. Verified: cargo test -p nimanyatta-protocol = 14 passed; cargo test -p nigig-site-core = 228 passed / 1 ignored; clippy -D warnings clean; cargo fmt --check clean; cargo metadata exit 0; all 6 workflow python gates.	2026-09-26 12:37:08 +00:00
andodeki	7421ac616c	docs(cad-core): record cad-ui consumer run in plan	2026-09-26 12:31:07 +00:00
andodeki	3cfcc2cc60	fix(cad-core): CORE-04 remove last runtime fan triangulators; plan status to complete ... - math::triangulate_polygon now ear-clips via polygon::triangulate_indices (index/orientation preserving; rejects degenerate, non-finite, bow-tie) - extrude_polygon_mesh routes through triangulate_profile; new try_extrude_polygon_mesh returns structured errors instead of underflowing on undersized profiles - tests: concave area equality, closed-manifold edge twins, bad corpus - cad.yml gate forbids reintroducing the vertex-zero fan - EXECUTION_PLAN.md: tranche ledger, verification, release gates	2026-09-26 12:05:51 +00:00
Arena Agent	3d91404ab6	build(nimanyatta): make the protocol crate a workspace member and pin its wire format ... First concrete step on SITE-12. Three of the four planned steps turned out to be impossible from this repository, and that is now recorded with evidence rather than assumed. What this commit does: 1. `nimanyatta/crates/nimanyatta-protocol` is a workspace member. It has no path dependencies (only optional serde + postcard), so unlike its parent package it can be compiled and tested here. `cargo metadata` still exits 0. 2. Its 8 pre-existing tests HAD NEVER COMPILED. The crate is `#![no_std]`, so `use super::*` brings in alloc's `String` but not the `ToString` trait, and the test module calls `.to_string()` — 6 E0599 errors. Fixed with one import; 8 tests now run and pass. 3. Added 5 wire-format characterization tests pinning the exact postcard bytes. postcard encodes enum variants as POSITIONAL INDICES, so reordering or inserting a variant silently changes every frame on the wire while the code still compiles and every round-trip test still passes. Verified by mutation: swapping AuthMethod::Password/Token changes the login frame from [0, 0, 5, ...] to [0, 1, 5, ...] and the pinned test fails. 4. Corrected a false doc comment. `sync_protocol.rs` claimed "one canonical encoding is used by app, server, and tests". It is not. Read from source: the server's POST /sync uses Json<SyncRequest>/Json<SyncResponse> whose types come from `nigig_common` (not from nimanyatta-protocol, which is a WebSocket chat protocol the server uses only for `is_guest`), and sync_protocol.rs is a third, separate offline-envelope codec. What could not be done, with evidence: - `nimanyatta` itself cannot be a workspace member: adding it makes `cargo metadata` fail with exit 101 "failed to load manifest for workspace member", because Cargo resolves path dependencies even for features that are not enabled, and ../nigig-lite/crates/common and ../xitca-web/web do not exist. Verified by adding it, observing 101, and removing it. - Neither sibling repo can be vendored or submoduled: `git ls-remote` on gitdab.com/andodeki/nigig-lite and /xitca-web both return HTTP 500, identical to a deliberately fake repo name, while /nigig-org resolves normally. - Repointing xitca-web to crates.io would not unblock the build on its own: `nigig_common` is imported by 38 server files (~40 items) and has no published equivalent. Guessing RoomInfo/RoomEvent field definitions would produce a codec that silently mismatches the real server, which is worse than the current explicit "three incompatible protocols" state. rustfmt was applied to the protocol crate (120 insertions / 29 deletions, all whitespace: it had never been formatted, including a stray indent on ServerToClientMsg::login_success). No semantic change. Verified: cargo test -p nimanyatta-protocol = 13 passed; cargo test -p nigig-site-core = 228 passed / 1 ignored; clippy -D warnings clean on both; cargo fmt --check clean; cargo check -p nigig-site --locked clean; cargo metadata exit 0; all 6 workflow python gates pass.	2026-09-26 11:53:58 +00:00
Arena Agent	99bb979850	feat(nigig-site-core): implement SITE-18/19/26/27/29/30 domain layers ... Six new UI-free modules in nigig-site-core, 53 tests added (175 -> 228): - procurement_flow.rs (SITE-26): requisition -> LPO -> delivery, two-approver gate (three above KES 500,000), budget commitment at approval, Delivered reachable only via verify_delivery with evidence assets, supplier ratings that are None until evidence exists. Integer cents with i128 saturating multiplication; no f64 money anywhere. - meeting_flow.rs (SITE-27): RSVP, per-participant recording consent where a refusal cannot be flipped to a grant, transcript refused until a recording has started, action-item tracker. - dashboards.rs (SITE-29): integer chart series, per-site snapshots, worst- first cross-site comparison, and a client digest built from an explicit field allow-list that fails closed on a smuggled key. - documents.rs (SITE-30): revision states where approval supersedes its predecessor and withdrawal clears `current` in the same operation, so a withdrawn drawing can never be served as current. - notification_rules.rs (SITE-18): delivery modes, midnight-crossing quiet hours in the site zone, safety-critical subjects that cannot be muted and bypass suppression, bodies generated from a closed vocabulary so no PII can enter one. - multi_site.rs (SITE-19): per-site roles, a switcher that refuses unknown or unregistered sites rather than falling back, sessions that authorize only their own site, and an offline queue that drains per site. Two API gaps fixed while wiring these up: - report_pack::Report::canonical_text is now public; it was private, so no caller outside report_pack could produce a valid approval signature. - hse::HseStats now derives Serialize/Deserialize; FR-1.7 embeds it in the published monthly report but it could not be serialized. EXECUTION_PLAN.md: §1a rows for these six tranches updated to their real state, the honest completion statement recomputed (28/33 with tested domain contracts, 4 externally blocked, 1 not started), and §2.1 corrected - it still repeated the false "nimanyatta is only a README stub" claim that §1a was already corrected for. Verified: cargo test -p nigig-site-core = 228 passed / 0 failed / 1 ignored; cargo clippy --all-targets --no-deps -D warnings clean; cargo fmt --check clean; cargo check -p nigig-site clean; all 6 workflow python gates pass. cargo test -p nigig-site remains unrunnable here (SIGKILL compiling makepad-widgets on 2 vCPU / 1.9 GiB). CI workflow work deferred by request.	2026-09-26 11:32:43 +00:00
andodeki	75781d69ce	docs(nigig-site): correct the SITE-12/SITE-08 server and protocol facts ... Two claims in the 2026-09-26 ledger were wrong and are corrected here. Wrong: "no nimanyatta server source in the repository (only a README stub)". That is true only of crates/nimanyatta/, which really is 2 files. The root nimanyatta/ directory holds a substantial server: 31,458 lines across 78 files, with routes/{auth,roles,rooms,sms_auth,sync,tenants,realtime} and a POST /sync handler taking SyncRequest/SyncResponse under an authenticated tenant context. Right, and now stated precisely: it is still not wired to nigig-site and cannot be built from this repository as-is. It is not a workspace member (the root manifest names only crates/nimanyatta), and nimanyatta/Cargo.toml depends on ../nigig-lite/crates/common and ../xitca-web/web, sibling directories that do not exist here (0 files each). Wrong by omission: SITE-08 said the gap was "no server and no second implementation". There are in fact three mutually incompatible protocol definitions -- the server's JSON SyncRequest/SyncResponse, the postcard-based nimanyatta-protocol (1,531 lines), and this crate's sync_protocol.rs SyncEnvelope. Neither site manifest mentions nimanyatta at all, so the exit criterion "app/server/tests use one protocol crate" is unmet rather than merely pending. The E2E fixture also expects Matrix-style joined_rooms/timeline/content.Text.body, which is not the server's shape. Verified 2026-09-26 against origin/feature/daily-reports at 0819e97.	2026-09-26 10:57:10 +00:00
andodeki	0819e97074	feat(nigig-site): compile and test the hardening core; add SITE-20..28 domain ... Thirteen hardening modules (3,079 lines) sat in nigig-site/src/ declared in no mod statement. They had never been compiled or tested: cargo check never saw them, and the plan's "implemented in the worktree and pending verification" status was unverifiable by construction. Extract the UI-free core into crates/apps/nigig-site-core (scope 5's "Rust core crate ... testable; safe"; plan 6's target architecture). nigig-site depends on it and re-exports it, so there is one copy of each module source: the app and the core's unit tests compile the same files. The core has no Makepad dependency, so its contracts run on a memory-limited runner. Compiling that code for the first time found four real defects, all fixed: - Role/Capability lacked Ord, so every BTreeSet of them failed to compile (auth.rs) - CaptureResult::empty never initialised site_id from its site parameter (ocr_policy.rs) - negotiate_version(2, 5) agreed on a protocol the peer never offered, which is the silent downgrade the function exists to prevent (sync_protocol.rs) - an absurd frame size returned Overflow instead of the actionable budget breach (media_bounds.rs) New feature-tranche domain modules, each with unit tests: - organisation.rs SITE-20 invites, per-site roles, the 4.2 matrix as testable data, site registry with geofence, settings - report_pack.rs SITE-21 report numbering, entry status, signatures binding actor/device/timestamp/document hash, lock and versioning, multi-site compilation, monthly packs - site_diary.rs SITE-22 weather with provenance, plant, deliveries, delay log where a weather delay needs supporting rainfall, visitors, manpower by trade - workforce.rs SITE-23 consent-gated registration, tag-only blocklist, attendance with overtime, QR badges, payroll CSV that never emits identity, offboarding tombstones - programme.rs SITE-25 dependencies with cycle detection and rollback, topological order, critical path, frozen baselines with slippage, checklists gating approval, snags, RFIs, variations needing two distinct approvers - hse.rs SITE-28 append-only incidents, closure requires corrective action, toolbox talks, inspections, monthly statistics workflows.rs gains the FR-1.14 Locked state; commands.rs gains a bounded non-empty text validator shared by the new modules. CI: the SITE-02 crypto/repository/store lanes pointed at -p nigig-site, where those suites no longer live; left alone they would have compiled nothing and reported a vacuous green. Repointed at the core, and added core-contracts and core-clippy lanes with a ">=100 tests collected" check so a lane cannot pass vacuously. All six existing Python contract gates still pass. Auto-purge of worker ID data refuses to run until the scope 18 retention question is answered rather than inventing a window. Verified 2026-09-26: cargo test -p nigig-site-core --locked = 175 passed, 0 failed, 1 ignored (needs a live Secret Service session); cargo clippy -p nigig-site-core --all-targets --no-deps -- -D warnings clean; cargo check -p nigig-site clean. cargo test -p nigig-site is still killed by SIGKILL compiling makepad-widgets on a 2 GB host, as recorded in plan 2.1. EXECUTION_PLAN.md gains a per-tranche status ledger (1a) that states plainly which tranches are done, domain-only, externally blocked, or not started, and records that this branch and main diverged at b3a9005 with SITE-03 published only on main.	2026-09-26 10:50:33 +00:00
andodeki	fd8b0632ca	Include nimanyatta as normal tree (not embedded git)	2026-09-26 09:29:36 +03:00
andodeki	cd802a9cab	Initial project: app scope + Makepad skeleton	2026-09-26 09:18:27 +03:00
andodeki	1516aa747b	Initial project: app scope + Makepad skeleton	2026-09-26 09:11:09 +03:00
andodeki	38feca50a1	ci(cad): UI-15 runtime matrix plus CORE/UI truth gates ... UI-15: project_lifecycle (create/open/edit/save/restart/switch/undo with A/B isolation and fail-closed corrupt/future/legacy cases), script_limits (adversarial corpus), bvh_differential (randomized brute-force comparison with tie discipline), export_interop (queue discipline, STL/DXF/GLB semantics, grid termination), runtime_ui (full lifecycle plus desktop/mobile budgets and soak). cad.yml: CORE canonical-module gates, UI session-module gates (switch/rebuild/journal/sandbox/ai/cache/BVH/coords/capture/exports), integration-lane ownership notes; lanes otherwise unchanged.	2026-09-26 05:04:20 +03:00
andodeki	fca70f96f5	fix(cad-ui): UI-07/09/12/13 backend correctness, valid BVH, bounded exports, honest formats ... UI-09: BVH rewritten over a stable primitive-index permutation with explicit child indices, structural validator, and differential tests (the old tree walked prims directly and assumed adjacent children). UI-07: AI worker constructs the selected backend (local fails closed without a loopback/https endpoint instead of sending prompts to Claude); streaming is preview-only (never replaces the editor mid-stream); stale post-cancel events discarded; AI-sized responses checked against the script ceiling before apply. UI-06: script source ceiling enforced before VM creation; output triangle ceiling before cache/export. UI-12: export dispatch bounded (1 active + 2 queued, explicit reject). UI-13: GLB preserves hierarchy/scale/visibility/units; PDF uses real CSG mesh bounds (never fabricated 1x1) and validated grid spacing; SVG fits viewBox to bounds with validated bounded grids. Also: corrected PDF CSG test to real bounds, tightened the disabled-copy test to success markers, FileLock Debug for green lib-test compile. project_repo.rs/capabilities.rs ride along concurrent fmt/test fixes in the same files.	2026-09-26 05:04:09 +03:00
andodeki	22ffa30e8c	feat(cad-ui): UI-03b/04/05/06/07/08/10/11/12/14 session modules ... UI-03b switch transactions (drain jobs, reset all document-owned handles, A/B sentinel isolation). UI-04 two-phase rebuild coordinator (identity/base-revision commits, empty-clears, stale discards). UI-05 universal command journal (per-family round trips, stale refusal, deterministic budget eviction). UI-06 script sandbox budgets (source, instructions, depth, dimensions, native cost; identical for all origins). UI-07 correlated AI (backend-matched factories, preview buffer, stale/cancel rejection, consent summary, log redaction). UI-08 revisioned bounded caches (canonical identity, digest-verified hits, LRU bytes, purge on close). UI-10 one coordinate/work-plane model (right-handed, revision-keyed snap, documented marquee rule). UI-11 capture correlation (bounded resolutions, revision matching, synthetic gradient guard). UI-12 bounded export coordinator (1+2+reject, cancel-is-cancelled, switch-stale, no partial success). UI-14 lifecycle gates (hidden/idle/terminal do no work, generation coalescing, content-free metrics).	2026-09-26 05:03:24 +03:00
andodeki	f7c4d041b7	fix(cad-core): CORE-11/12 exact URL policy, evidence tests, toolchain hygiene ... CORE-11: parsed scheme/host identity replaces string-prefix trust; loopback is exactly localhost/127/8/::1; plaintext http only for loopback; lookalikes, user-info, bad ports, fragments rejected. CORE-12: resource_limits, format_interop (independent parsers), and migration_corpus integration targets. Hygiene for green gates under the pinned toolchain: unused-import cleanup, derivable Default impls, needless-range/manual-contains fixes, type aliases, fixture-literal allows (no numeric changes).	2026-09-26 05:03:10 +03:00
andodeki	846d4c5214	fix(cad-core): CORE-08/09/10 bounded STL/DXF and STEP quarantine ... CORE-08/09: STL/DXF on the canonical path (graph validation, full parent-to-world transforms, inherited visibility, triangle/output budgets, finiteness gates, structured completion metadata, declared units, preserved sanitized layer names, escaped text). CORE-10: STEP quarantined behind non-default experimental-step feature (default builds refuse with a structured error); exact quantized-triple vertex dedup (no hash collisions), honest open/closed shells (never asserts a closed manifold without proof), checked entity numbers, escaped strings, ExperimentalStep naming.	2026-09-26 05:03:09 +03:00
andodeki	1467d871ad	fix(cad-core): CORE-06/07 atomic scene edits and bounded world-mesh stream ... CORE-06: DocumentEdit/ScenePatch transactions against base revisions; failed patches leave byte-identical state, stale bases rejected, undo via inverse patches, refuse/cascade deletion policy. CORE-07: one canonical bounded world-mesh stream (hierarchy, full transforms, inherited visibility, named unit conversion, triangle budgets, chunked cancellation with no partial success).	2026-09-26 05:02:56 +03:00
andodeki	0bce180c8c	fix(cad-core): CORE-04/05 validated polygon pipeline and mesh hardening ... CORE-04: one validated polygon pipeline replaces both fan triangulators (finite coords, closure/dupe/collinear policy, self-intersection rejection, ear clipping with area-equality property tests). CORE-05: mesh validation before use (finite positions, index range, budget), checked subdivision, None-not-NaN centroid/bounds, chunked cancellation checkpoints.	2026-09-26 05:02:55 +03:00
andodeki	0af5d9bc64	fix(cad-core): CORE-01/02/03 structured errors, budgets, checked ids, canonical graph, versioned document ... CORE-01: CadError with kind/entity-path, ValidationPolicy/GeometryBudget hard ceilings enforced before allocation, opaque typed ids with checked supply, explicit remap tables; missing material/layer refs are hard errors, never silent fallbacks. CORE-02: identity transform is translation 0/rotation 0/scale 1 (Default no longer collapses to zero scale); single local/world matrix convention T*Rz*Ry*Rx*S with iterative validation (duplicates, dangling, cycles, depth 1024) and inherited visibility. CORE-03: versioned lossless CadDocument with tagged EntityKind, explicit units, deterministic canonical bytes, future-version quarantine, and explicit legacy migration warnings. Verified in worktree at 64ae8d7: cad-core 319 tests green, clippy/fmt clean.	2026-09-26 05:02:43 +03:00
andodeki	64ae8d75ab	feat(cad-ui): UI-03a project repository with injected roots and atomic saves	2026-09-25 18:57:49 +03:00
andodeki	081121957e	fix(cad-core): UI-02 domain builders record kind_hint (demo goes green)	2026-09-25 17:03:23 +03:00
andodeki	d4ec1edd34	feat(cad-ui): UI-02 single session authority plus truth gate	2026-09-25 15:01:12 +03:00
andodeki	b2937ddc83	feat(cad-ui): UI-01 contain STEP/F12/render2d/RayTrace behind capability matrix	2026-09-25 12:52:26 +03:00
andodeki	a00a7b6790	ci(cad): UI-00 ignored-test inventory plus truth gates and lane split	2026-09-25 12:44:48 +03:00
andodeki	a8167ac36f	ci(cad): CORE-00 CAD-owned workflow plus fail-closed stale scans ... Adds .forgejo/workflows/cad.yml owning cad-core, cad-ui and shared tooling: non-empty source-root gates, exact ignored-test budget (20), empty-fixture proof, locked cargo check/test/clippy/fmt. Guards every stale nigig-build/.../workspace/cad scan and both coverage harnesses to fail closed (exit 1 with move pointer) until BUILD-00 removes/retargets them; an empty grep scan is never green. Verified: sun 14/14 + measure 19/19 standalone (DVec3 shim); coverage harnesses exit 1; stale-guard loop fail=0; git diff --check clean.	2026-09-14 11:25:09 +03:00
andodeki	b3a9005795	feat(pdf): image ink colorants + downsample/pixels + shading/interpreter ports	2026-09-14 09:46:52 +03:00
Arena Agent	75ec2f9f20	fix(nigig-site): harden macOS native evidence	2026-09-14 06:31:57 +00:00
Arena Agent	41259b096a	ci(nigig-site): budget clean native builds honestly	2026-09-13 16:26:31 +00:00
Arena Agent	3c9dc7943a	classify Site schema versions before decoding	2026-09-13 07:22:38 +00:00
Arena Agent	bbce8fb015	harden SITE-02 repository and native vault contracts	2026-09-13 06:51:39 +00:00
Arena Agent	92f1508325	site: verify native vault and production dependency trust	2026-09-12 23:03:56 +00:00
Arena Agent	c568a99948	site: exercise abrupt SITE-02 publication exits	2026-09-12 22:21:22 +00:00
Arena Agent	8c786ae163	site: define blocked SITE-02 key lifecycle review	2026-09-12 22:18:22 +00:00
Arena Agent	6d6f887ba6	site: harden SITE-02 process and scope boundaries	2026-09-12 22:11:59 +00:00
Arena Agent	a7a057f44a	site: gate SITE-02 runtime and security review	2026-09-12 21:54:30 +00:00
Arena Agent	aa10b06d9b	site: prove locked legacy migration contracts	2026-09-12 21:47:35 +00:00
Arena Agent	8dbfae8f72	site: add SITE-02 encrypted repository candidate	2026-09-12 21:44:00 +00:00
Arena Agent	1cb6ad289b	docs(nigig-site): record SITE-00 and SITE-01 publication	2026-09-12 15:50:05 +00:00