docs: post-round2 sweep — 8 PROD-00 PRs merged (2026-04-16)#892
docs: post-round2 sweep — 8 PROD-00 PRs merged (2026-04-16)#892Chris0Jeky wants to merge 5 commits intomainfrom
Conversation
Self-review (post-merge docs sweep)Verified the claims in this PR against the actual merged PR diffs and round-2 review comments. Spot-checks:
No cross-PR inconsistencies discovered. All 8 round-2 adversarial-review fixes are cited with consistent framing across STATUS, MASTERPLAN, and TESTING_GUIDE. Docs-only PR — Docs Governance CI lane passed; remaining backend/frontend CI lanes run as part of the standard required gate and should pass unchanged since no code was touched. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6574a79232
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ## Security | ||
|
|
||
| Found a vulnerability? Please follow the disclosure process in [SECURITY.md](SECURITY.md). We aim to acknowledge reports within 48 hours. |
There was a problem hiding this comment.
The new Security callout links to SECURITY.md, but that file is not present in this revision (rg --files has no SECURITY.md). This leaves users with a dead-end exactly where they are told to report vulnerabilities, so the documented disclosure path is effectively unavailable until the file is added.
Useful? React with 👍 / 👎.
|
|
||
| ### PROD-00 Production-Readiness Wave (2026-04-16, delivered) | ||
|
|
||
| Tracker: `#881` (PROD-00). Delivered via eight parallel PRs on 2026-04-16 with two rounds of adversarial review each: |
There was a problem hiding this comment.
This section marks all eight PROD-00 items as delivered, but the referenced deliverables are not in the tree at this commit (for example CONTRIBUTING.md, docs/platform/CONFIGURATION_REFERENCE.md, backend/tests/Taskdeck.Api.Tests/ResponseCompressionApiTests.cs, and migration 20260416161303_AddPerfIndexes are absent). Since this guide drives execution order and prioritization, marking these issues done early can cause remaining work to be skipped.
Useful? React with 👍 / 👎.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the project's documentation—including README.md, STATUS.md, and TESTING_GUIDE.md—to reflect the delivery of the PROD-00 production-readiness hardening wave. The changes document new security policies, contributor guidelines, performance optimizations like response compression and DB indexing, and container hardening measures. Feedback identifies discrepancies where the documentation describes the registration of response compression middleware and the installation of frontend error handlers that are not actually implemented in the provided source files.
| - **SEC-28 SECURITY.md vulnerability disclosure policy** (`#853`/`#884`): repo-root `SECURITY.md` with responsible-disclosure contact (GitHub private vulnerability reporting + fallback email), 48h acknowledgement target, supported-versions scope (`main` guaranteed; latest pre-1.0 tag best-effort), in-scope/out-of-scope breakdown, and safe-harbor language; README cross-link; round-2 enabled the private vulnerability reporting feature and reconciled supported-versions prose with the table | ||
| - **DOC-06 CONTRIBUTING.md onramp** (`#873`/`#885`): repo-root `CONTRIBUTING.md` covering prerequisites, cross-platform local setup (Windows/macOS/Linux), Windows-specific notes (`check-git-env.sh`, Cygwin-git pitfall, PowerShell chaining, stale `index.lock`), default URLs, test commands (backend xUnit, frontend typecheck/build/vitest/lint, Playwright E2E), commit conventions, and PR process; README cross-link; AGENTS.md remains the authoritative contributor protocol | ||
| - **DOC-07 CONFIGURATION_REFERENCE appsettings schema** (`#874`/`#887`): `docs/platform/CONFIGURATION_REFERENCE.md` documents every configuration section in `backend/src/Taskdeck.Api/appsettings.json` and every typed `*Settings.cs` binding (JWT, GitHub OAuth, OIDC, MFA, LLM provider/tool-calling/quota/kill-switch/abuse-detection, Workers, Outbound webhook security, CORS, Forwarded headers, Rate limiting, Cache, SignalR backplane, Security headers, Observability/Sentry/Telemetry/Analytics, Connection strings, Export/import, First run, Development sandbox, Logging, MCP server) with key/type/default/description/required flags and environment-variable override conventions; cross-linked from `CLAUDE.md` Key Docs and `docs/platform/README.md`; `deploy/.env.example` aligned | ||
| - **PERF-09 response compression** (`#845`/`#886`): `AddTaskdeckResponseCompression()` registers Brotli + Gzip providers with `EnableForHttps = true`; `UseResponseCompression()` wired in `PipelineConfiguration` after forwarded headers and before CORS/static/routing so controllers, SPA assets, and `index.html` fallback all emit compressed bodies when the client opts in via `Accept-Encoding`; compressible MIME set extended to include `application/problem+json`; 3 integration tests in `ResponseCompressionApiTests` (gzip encoding, brotli encoding, no-compression baseline); **round-2 correction**: BREACH threat-model analysis caught that JWTs are in fact returned in `/api/auth/login` and `/api/auth/register` response bodies (contradicting the inline comment assuming JWTs only appeared in `Authorization` headers); compression level downgraded from `CompressionLevel.Optimal` to `CompressionLevel.Fastest` to reduce BREACH/CRIME oracle surface while preserving bandwidth wins |
There was a problem hiding this comment.
The documentation mentions that UseResponseCompression() is wired in PipelineConfiguration after forwarded headers. However, the backend/src/Taskdeck.Api/Extensions/PipelineConfiguration.cs file in the current branch does not include this middleware. This discrepancy should be resolved to maintain documentation accuracy.
| **Three-layer error coverage pattern for future contributors**: Taskdeck now relies on three complementary error-handling layers: | ||
| 1. **Outer `ErrorBoundary` in `App.vue`** wraps `<RouterView />` as a backstop for any crash that escapes nested boundaries | ||
| 2. **Inner `ErrorBoundary` in `AppShell.vue`** wraps the inner `<router-view />` so a crashed workspace view does not take down the shell chrome (nav, topbar, command palette remain usable) | ||
| 3. **`main.ts` installs `app.config.errorHandler`** plus `window` listeners for `error` and `unhandledrejection` so async rejections (which `onErrorCaptured` does not see) and top-level unhandled errors still reach the Sentry passthrough |
There was a problem hiding this comment.
The documentation mentions that main.ts installs app.config.errorHandler and window listeners for error and unhandledrejection. As noted in the STATUS.md review, these implementations are missing from the frontend/taskdeck-web/src/main.ts file in this branch.
Adds a delivery section for PRs #884-#891 covering SEC-28 SECURITY.md, DOC-06 CONTRIBUTING.md, DOC-07 CONFIGURATION_REFERENCE.md, PERF-09 response compression (with BREACH-aware level downgrade), PERF-10 composite DB indexes, OPS-29 container hardening (non-root end-to-end, IPv6/IPv4 healthcheck fix, setpriv entrypoint), FE-14 error boundary (null-throw sentinel fix), and FE-15 HTTP retry with backoff (skipRetry opt-out). Updates backend/frontend snapshots to reflect the new hardening surfaces.
Adds a delivery entry for the 8 PROD-00 PRs merged on 2026-04-16 (#884 SEC-28, #885 DOC-06, #887 DOC-07, #886 PERF-09, #888 PERF-10, #889 OPS-29, #890 FE-15, #891 FE-14) with round-2 adversarial review findings: BREACH JWT-in-body correction (compression level Optimal -> Fastest), IPv6/IPv4 healthcheck fix, null-throw sentinel fix, skipRetry opt-out for baseline tests, setpriv entrypoint for upgrade-safe volume ownership. Also bumps the Last Updated date.
…layer error coverage Adds a PROD-00 Production-Readiness Round-2 Wave section covering: - ResponseCompressionApiTests (#886, +3 tests) - migration-only context for composite DB indexes (#888) - container hardening verification (no unit tests, docker inspect path) - HTTP retry with backoff tests + skipRetry opt-out pattern for future test authors (#890) - ErrorBoundary + errorReporting tests + three-layer error coverage pattern documenting outer/inner/window layers (#891) Updates Current Verified Totals to reflect the new test deltas.
…inks - CLAUDE.md Key Docs gains entries for CONFIGURATION_REFERENCE.md (PR #887), CONTRIBUTING.md (PR #885), and SECURITY.md (PR #884) so the post-merge reality is reflected in the agent onboarding surface. - README.md Contributing section cross-links to CONTRIBUTING.md and adds a Security section pointing at SECURITY.md, guarding against a rebase dropping either link.
Chris0Jeky
force-pushed
the
docs/post-round2-sweep-2026-04-16
branch
from
6574a79 to
c8a52bf
Compare
|
Closing as superseded by PR #925, which is a more recent docs sweep covering PRs #914–#924 and updates all the same files (STATUS.md, IMPLEMENTATION_MASTERPLAN.md, ISSUE_EXECUTION_GUIDE.md, TESTING_GUIDE.md, CLAUDE.md). The content from PRs #884–#891 that this sweep would have documented has already been absorbed into the current docs through subsequent sweeps. |
1 participant
Summary
Documentation sweep assuming PRs #884–#891 are merged. Updates the live documentation set (STATUS, MASTERPLAN, TESTING_GUIDE, wave index, CLAUDE.md, README.md) to reflect the following 8 PROD-00 deliveries:
/api/auth/login+/api/auth/registerresponse bodies, so compression level was downgradedOptimal→Fastestto reduce BREACH/CRIME oracle surface)20260416161303_AddPerfIndexes; documented AC deviations (polymorphicAuditLog.EntityIdinstead of aspirationalBoardId;IX_LlmRequests_UserId_Statuspre-existing)hasCrashedboolean) and three-layer outer/inner/window error coverage patternskipRetryopt-out pattern for test baselines andparseRetryAfter('-5')letter-guard fix::1while nginx bound IPv4),setpriventrypoint for upgrade-safe volume ownershipChanges
Five focused commits:
docs(status): document 2026-04-16 PROD-00 round-2 hardening wave— new wave section + backend/frontend implementation-snapshot updates (compression, indexes, error boundary, retry, container hardening)docs(masterplan): add entry 135 for PROD-00 round-2 hardening wave— delivery history entry with PR↔issue cross-linksdocs(testing): document PROD-00 wave tests, skipRetry pattern, three-layer error coverage— ResponseCompressionApiTests, retry tests, ErrorBoundary/errorReporting tests,skipRetryopt-out pattern for future test authors, three-layer error coverage patterndocs(wave-index): close delivered PROD-00 items— marks SEC-28: Create SECURITY.md vulnerability disclosure policy #853, DOC-06: Create CONTRIBUTING.md at repository root #873, DOC-07: Configuration reference (appsettings.json schema) #874, PERF-09: Enable API response compression (gzip/brotli) #845, PERF-10: Add missing database indexes (AuditLog, LlmRequest, Card) #846, OPS-29: Docker container hardening (HEALTHCHECK, USER, limits) #866, FE-15: Add HTTP request retry with exponential backoff #854, FE-14: Implement Vue error boundary for crash prevention #852 as delivereddocs: wire SECURITY.md, CONTRIBUTING.md, CONFIGURATION_REFERENCE.md links— CLAUDE.md Key Docs + README.md Contributing/Security sections guard against rebase link-lossTest plan