Integrate reviewed product, dependency and CI PRs - #2815
Conversation
Bumps the npm-minor-patch group in /frontend/taskdeck-web with 10 updates: | Package | From | To | | --- | --- | --- | | [@material-symbols/font-200](https://github.com/marella/material-symbols/tree/HEAD/font/200) | `0.47.0` | `0.47.1` | | [vue-router](https://github.com/vuejs/router) | `5.3.0` | `5.3.1` | | [@storybook/vue3-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/vue3-vite) | `10.5.10` | `10.6.0` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.68.0` | `8.69.0` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.68.0` | `8.69.0` | | [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.20` | `2.11.21` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.12` | `20.14.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` | | [storybook](https://github.com/storybookjs/storybook/tree/HEAD/code/core) | `10.5.10` | `10.6.0` | Updates `@material-symbols/font-200` from 0.47.0 to 0.47.1 - [Release notes](https://github.com/marella/material-symbols/releases) - [Commits](https://github.com/marella/material-symbols/commits/v0.47.1/font/200) Updates `vue-router` from 5.3.0 to 5.3.1 - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v5.3.0...v5.3.1) Updates `@storybook/vue3-vite` from 10.5.10 to 10.6.0 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/frameworks/vue3-vite) Updates `@typescript-eslint/eslint-plugin` from 8.68.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.68.0 to 8.69.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/parser) Updates `baseline-browser-mapping` from 2.11.20 to 2.11.21 - [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases) - [Commits](web-platform-dx/baseline-browser-mapping@v2.11.20...v2.11.21) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `happy-dom` from 20.11.12 to 20.14.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.12...v20.14.0) Updates `postcss` from 8.5.26 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.26...8.5.28) Updates `storybook` from 10.5.10 to 10.6.0 - [Release notes](https://github.com/storybookjs/storybook/releases) - [Changelog](https://github.com/storybookjs/storybook/blob/next/CHANGELOG.md) - [Commits](https://github.com/storybookjs/storybook/commits/v10.6.0/code/core) --- updated-dependencies: - dependency-name: "@material-symbols/font-200" dependency-version: 0.47.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vue-router dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: "@storybook/vue3-vite" dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@typescript-eslint/parser" dependency-version: 8.69.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: baseline-browser-mapping dependency-version: 2.11.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: happy-dom dependency-version: 20.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: postcss dependency-version: 8.5.28 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: storybook dependency-version: 10.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…ordinator-integration
|
Final bounded backend fix independently re-reviewed by Terra: error-envelope and oversize-terminal regressions passed 2/2; no CRITICAL/HIGH findings. The exact code is preserved by cherry-pick 36da066. All four delegated source control candidates have now passed their refreshed ci-required.yml runs: #2769 34334852328, #2803 34334853279, #2791 34335018615, #2792 34334854411. The final combined head still requires its own hosted run; source green checks do not replace that proof. #2807 post-merge run34334605677 also passed. |
Chris0Jeky
changed the title
…focus', 'origin/issue-2090/palette-focus-return' and 'origin/issue-1307/ruled-batch-execute' into codex/product-pr-closeout
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c362e56b0f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (sendingMessage.value) return | ||
|
|
||
| const sessionId = selectedSession.value.id | ||
| try { | ||
| sendingMessage.value = true | ||
| const sessionId = selectedSession.value.id | ||
| await chatApi.sendMessage(sessionId, { | ||
| content, | ||
| requestProposal: requestProposal.value, | ||
| }) | ||
| const sentMessage = await chatApi.sendMessage(sessionId, { content }) |
There was a problem hiding this comment.
When a board bind and a message send overlap, this guard permits the send because it checks only sendingMessage, while the Link button likewise remains enabled during a send. The message request can therefore observe the session as unbound and return another board-needed outcome; if its refresh completes before the bind, the older full-session snapshot returned by bindBoard can then overwrite selectedSession and hide the completed turn until reload. Disable both operations while either request is active, or merge/refresh the binding result instead of replacing the transcript snapshot.
AGENTS.md reference: frontend/AGENTS.md:L5-L5
Useful? React with 👍 / 👎.
| const eligibleBoards = computed(() => availableBoards.value.filter((board) => ( | ||
| !board.isArchived && board.canWrite !== false | ||
| ))) |
There was a problem hiding this comment.
For users with more than 200 readable boards, availableBoards contains only the first page because boardsApi.getBoards() requests offset 0 with limit 200. If the writable board is older than that page—for example, the first 200 memberships are viewer-only—this derived list is empty and the recovery panel falsely states that no editable boards exist, with no way to select the actual writable board. Paginate the board lookup or provide server-side writable-board search before treating this as a successful empty state.
AGENTS.md reference: frontend/AGENTS.md:L5-L5
Useful? React with 👍 / 👎.
|
Final frozen head 03f55f2 includes the three parallel-lane arrivals #2816/#2817/#2818. Independent Terra integration review verifies source ancestry/blob parity and no CRITICAL/HIGH interaction. Combined focused frontend tests pass 226/226; Golden Principles/docs checks pass. Two final factual documentation updates follow that reviewed integration and change no code or authority. Sandbox P2 is triaged on #2818/#1307 against explicit ADR-0068 read grants; strict write policy remains unchanged. No additional incoming candidates will change this qualification head. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03f55f223d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| paginate(requestJson, runPath(NIGHTLY_WORKFLOW), 'workflow_runs', MAX_RUN_PAGES), | ||
| paginate(requestJson, runPath(QUALITY_WORKFLOW), 'workflow_runs', MAX_RUN_PAGES), |
There was a problem hiding this comment.
Once either workflow has more than 200 retained successful runs, these calls ask paginate to exhaust the collection with MAX_RUN_PAGES = 2; it therefore raises metadata-pagination-limit before selectQualifiedPair applies its intended 14-candidate bound. From that point every nightly observation falls back to an unavailable baseline and a full sweep even when the newest runs contain a valid pair. Limit the API query or stop pagination after enough recent candidates have been collected.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Source-confirmed MEDIUM, tracked on #2334 with a >200 retained-run fixture. The failure path conservatively selects full sweep and leaves unconditional deep jobs intact; it is an observation availability/efficiency defect, not lost qualification. No new repair round for this advisory.
| var clarificationRounds = ClarificationDetector.CountClarificationRounds(session.Messages.ToList()); | ||
| var hasPendingClarification = HasPendingClarification(session.Messages); | ||
| var isSkipRequest = hasPendingClarification && ClarificationDetector.IsSkipRequest(dto.Content); | ||
| var forceBestEffort = isSkipRequest || ClarificationDetector.ShouldForceBestEffort(session.Messages.ToList()); | ||
| var actionAttemptContent = BuildActionAttemptContent(session.Messages, dto.Content, forceBestEffort); |
There was a problem hiding this comment.
After a session is reloaded, GetByIdWithMessagesAsync populates Messages through an unordered EF Include, but this new block treats the collection tail as chronological in HasPendingClarification, CountClarificationRounds, and BuildActionAttemptContent. If dependent rows arrive out of insertion order, a user's answer to the one allowed clarification can be treated as a fresh turn or parsed without the original instruction, causing another clarification or the wrong proposal attempt. Establish a deterministic CreatedAt order before running this causal logic.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Source-confirmed MEDIUM causal-order fragility, tracked on #2004 with scrambled-load and timestamp-tie regression criteria. No fresh runtime reproduction or production failure-rate claim; proposal-first review remains intact. Retained outside the completed final terminal-path repair under the review ceiling.
|
Final base/CI revalidation after #2817 independently landed: head remains 03f55f2. Passing required run34339766712 checked out merge commit8111deccab9d784ce6cc7e282ca6ff8c381c493c. The current GitHub merge ref48438cb820212659f84cb6eb117ecb9a91c6dd29 combines current main64508d3e2 with the same head. Both commits and HEAD have identical tree3a1a2b7bdbc3e6f844a411abd52a1c5f694bd458; git diff --exit-code is clean. Fresh independent Terra base reconciliation confirms no changed source, dependency, workflow/configuration or test input: the palette source was already included. This explicitly revalidates passing CI against the regenerated candidate rather than claiming a rerun. All final comments are triaged; no C/H blocker remains. |
…e merges The row named the eight-PR continuation train because I followed the train. Sweeping every merge since 2026-09-08 for ci/policy.v1.json control paths instead finds three more that no delegation covers: #2832 416b5e9 2026-09-09T15:34:32Z 15 files, including .github/workflows/smart-ci-shadow.yml, both ci/schemas receipts and scripts/ci/smart-ci/lib/plan.mjs Refs #2508 #2834 afadf72 2026-09-09T16:53:40Z scripts/ci/dev-up.test.mjs Refs #2588 #2858 9f9b796 2026-09-10T14:35:25Z scripts/ci/dev-up.test.mjs and scripts/dev-up.ps1 #2858's own body says "Maintainer review remains required because regression coverage touches scripts/ci". #2832 and #2834 carry no such line. None is covered by the 2026-09-09 four-PR delegation, whose members were integrated as #2815 and are explicitly not in dispute. #2832 is the substantial one: shadow workflow, both receipt schemas, and the planner library. A decision packet that undercounts is a mis-framed packet, which is the error a review already caught in this row once. The count is now eleven PRs across three disclosure rows, with five more acknowledged in the 2026-09-06 q-2 ruling: eighteen merges outside the per-PR review, thirteen still awaiting a reply. That rate is the argument for settling (b) either way. Refs #2337, #2336.
Merging main surfaced two defects in the smoke guard. The pinned mutant range `boardCrudStore.ts:587:28-587:78` no longer holds the board-list deletion expression: main moved that seam to line 591. Stryker then instruments zero mutants, reports a score of NaN, logs "NaN is greater than or equal to break threshold 100" and exits 0, so the activation guard goes green while proving nothing. `thresholds.break` cannot catch an empty probe. Re-point the range at line 591 and add `scripts/check-mutation-smoke.mjs`, which reads the smoke run's JSON report and requires exactly four mutants, all Killed. Verified both ways: 4/4 killed exits 0; the stale 587 range now exits 1 with a message naming the moved seam. Drop the Vitest 4.1.x downgrade. Driving the probe through Stryker's `command` runner (`npx vitest --run <spec>`) instead of `@stryker-mutator/vitest-runner` kills 4/4 on the repository's Vitest 5.0.0 in ~13 s, so the smoke no longer needs a runner-compatible Vitest pin and main's Vitest 5 line (#2803/#2815) stays intact. Measured on this head: vitest-runner on Vitest 5.0.0 reports "Ran 0.00 tests per mutant" with all four mutants surviving, which reproduces the incompatibility this PR originally worked around by downgrading. frontend/taskdeck-web/package-lock.json is now byte-identical to main and package.json differs from main by the single added mutation:smoke script.
1 participant
Integrates thirteen reviewed candidates with all source commits preserved: #2790, #2797, #2810, #2811, #2812, #2814, #2769, #2803, #2791, #2792, #2816, #2817 and #2818. One final hosted run qualifies their combined tree against main 7ac99a7, avoiding repeated sibling-base invalidation.
The maintainer explicitly delegated final review and merge of the four dependency/CI candidates in-session on September 9, with their review afterward. The exact ruling is recorded in OUTSTANDING_TASKS.md; separate historical disclosures, settings and release decisions remain open.
The final chat repair preserves failed proposal receipts for thrown and returned errors through provider degradation, and emits exactly one completion for oversized non-terminal deltas. Both final regressions failed before correction and pass afterward; full ChatService filter 122/122 passes. Manual procedures now describe default proposal attempts.
Independent Terra source/fix, product-interaction, dependency-union and CI-interaction reviews are clear of CRITICAL/HIGH findings. Combined local checks pass: npm ci, typecheck, 19 branding/version-isolation/transport tests, 226 combined Review/palette/batch-Apply tests, 148 Smart CI tests, docs links (672 files), docs governance and diff checks. The four control source heads also passed their refreshed required CI. Final combined-head hosted CI remains required; earlier green runs do not replace it.
The three final parallel-lane additions preserve exact source blobs, have their source reviews recorded, and passed a fresh Terra interaction review. Their MEDIUM follow-ups remain tracked on #2215, #2090 and #1307. No release, private-data migration or live-provider acceptance is claimed. MEDIUM residuals remain explicitly tracked on the source issues. The three individual Vitest PRs will be closed as superseded only after this integration lands.
Refs #2795, #2235, #2004, #2214, #2775, #2257, #2241, #2334, #2335, #2337.