26fd500d4d08 | Merge ra5sec/session-token-2026-10-29 into main (lane RA5-SEC): RA5-45 a minted session whose token does not fit the cookie is answered 502 by name, the token never reaches the page. RED f-commit on the branch, GREEN after it. Gate on the merged tree: lockcheck green, holger-ui-server tests green (default and metered+public-site), clippy -p holger-ui-server --all-targets --features metered,public-site -D warnings clean | 2026-10-29 |
2661b3e32363 | GREEN RA5-45: a minted session whose token does not fit the cookie is answered 502 by name (UNFIT_TOKEN) with the token dropped, never handed to the page | 2026-10-29 |
407146150e0c | RED RA5-45: a minted token that does not fit the cookie never reaches the page (it went out in the body, and no cookie was set) | 2026-10-29 |
83eb973b9b3d | Merge smallrows/postpub9-same-act into main (lane SMALL-ROWS): every_call_is_a_cli_command reads holger-cli's SAME_ACT rows (POSTPUB-9) | 2026-10-29 |
b71b39a55437 | Merge remote-tracking branch 'origin/main' into smallrows/postpub9-same-act | 2026-10-29 |
ce1a3932474b | GREEN every_call_is_a_cli_command reads holger-cli's SAME_ACT rows as holger's command_for does: the console's PutArtifact is artifacts put (POSTPUB-9) | 2026-10-29 |
66bef9435b5f | RED every_call_is_a_cli_command: holger-cli's SAME_ACT rows are not read, so the console's PutArtifact has no command (POSTPUB-9) | 2026-10-29 |
8f2ba551601a | Merge slsakey/release-signing into main (lane SLSA-KEY): holger.rs's llms.txt and llms-full.txt name the release key (id d24d3785…8249e) and link slsa/ in holger and gunnar. Gate (ci4, dwarf): holger-public-site 27/0 (release_signing 3/0), clippy -D warnings clean, no lock change | 2026-10-29 |
755c44b8ebf6 | holger-public-site: llms.txt and llms-full.txt name the release key (lane SLSA-KEY) | 2026-10-29 |
bce2eed21b60 | Merge badge-docs/2026-10-29 into main (lane BADGE-DOCS): SECURITY.md opens with the private report address (holger@holger.rs) and points to Holger's security policy. Docs only | 2026-10-29 |
a567f563cf3d | docs: SECURITY.md opens with how to report a vulnerability (holger@holger.rs) | 2026-10-29 |
dc9f229cfc6e | Merge ox-postpub/follow-2026-10-29 into main (lane OX-POSTPUB): root on nornir-xtask-support 0.1.6 (crates.io), browser-tests on estate-front 0.3.0 and monetize-proto 0.3.3. Gate on the merged tree (ci4, dwarf): lockcheck green (2 locks), browser-tests check --locked --tests clean, cargo test --workspace --locked 237/1: the one red is main's own (every_call_is_a_cli_command: holger-cli's table has no RepositoryService.PutArtifact) | 2026-10-29 |
809a064fa754 | locks: root nornir-xtask-support 0.1.6 from crates.io; browser-tests follows the siblings (estate-front 0.3.0, monetize-proto 0.3.3) (lane OX-POSTPUB) | 2026-10-29 |
fc5e46f56ab7 | Merge fix/ox-uimerge-ra5-2-browser-2026-10-28 into main (lane OX-UIMERGE): RA5-2 console half, the browser tests take nornir-identity 0.2.2 (every invite needs a fresh step-up at the core); the Invites pane asks for a touch in place and the mint then works (a_stale_touch_is_answered_in_place_on_the_invites_pane). No console code change was needed. Gate: lockcheck green, browser suite 20/0 --locked against holger main b892cf05 with 0.2.2 | 2026-10-28 |
f32d9c252f3f | RA5-2 (console half): browser-tests take nornir-identity 0.2.2, so the Invites pane step-up test runs against the core that needs a fresh step-up for every invite | 2026-10-28 |
aa4c4e762887 | Merge fix/ra5-gun-2026-10-28 into main (lane OX-UIMERGE for OX-RA5-GUN): RA5-11 holger half, a logout holger refused keeps the cookie and the page says holger words (RED 710a6aa, GREEN 71d4ec5); merge fix 924fc03: the RA5-11 test sends the page Origin, which main RA5-5 requires. Gate on the merged tree (oden, ci4): xtask ci lockcheck, test, public-site, buy-routes, wasm green; clippy -p holger-ui-server --all-targets green; browser suite 20/0 --locked; holger xtask there_is_one_identity_implementation 2/0 | 2026-10-28 |
924fc03c8e34 | merge fix: the RA5-11 logout test sends the page Origin (main RA5-5 refuses a POST without it) | 2026-10-28 |
477056a013b5 | Merge remote-tracking branch 'origin/fix/ra5-gun-2026-10-28' into ox-uimerge/merge-ra5-gun | 2026-10-28 |
0d4e40f96763 | Merge remote-tracking branch 'origin/main' into fix/ra5-gun-2026-10-28 | 2026-10-28 |
fad4a5f8a583 | Merge fix/ra5-hol-2026-10-28 into main (lane OX-RA5-HOL): RA5 Holger rows, test-first; gate on the merged tree: lockcheck green, the touched crates' tests green, clippy nothing in the lane's lines | 2026-10-28 |