b5ebbfb748
feat: public access via reverse proxy + 'The Ledger' UI design pass
...
- compose publishes 8787 on all interfaces (NPM fronts it at
bountyboard.anypreta.com); APP_BASE_URL + TRUSTED_PROXY_CIDRS configured,
client-IP resolution through the proxy verified live
- design: self-hosted variable fonts (Fraunces display serif, Schibsted
Grotesk UI, Spline Sans Mono ledger numerals), paper-grain overlay,
hairline double rules, letterpress buttons, stamped badges, banknote
bounty chips, ledger tables, staggered page reveal (reduced-motion safe)
- §10 tokens, 2px radius, both themes, AA contrast preserved exactly;
no build step, CSP-clean (fonts/img self/data)
- login/register masthead; headless-chrome screenshots verified both themes
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 21:38:20 +02:00
c69c028028
feat: seed script, forgot-password, hover cards, shortcuts, OpenAPI docs, runbook (phase 12)
...
- scripts/seed.go: idempotent demo data per §11.11 (make seed)
- forgot/reset password: SMTP-gated, one-shot TTL tokens, uniform responses
against enumeration, sessions revoked on reset; login page link + pages
- profile hover cards on [data-user-card] elements (§11.13)
- keyboard shortcuts: g b/m/t/h navigation, / focuses search (§10)
- bulk archive endpoint (§11.9)
- hand-written OpenAPI 3.1 covering §6, served at /api/docs + yaml download
- make backup / make restore (mongodump archive via the mongo container)
- README: quick start, demo data, runbook, breaker/job operations, working
Caddy + nginx reverse-proxy samples (WS block, client_max_body_size),
documented later-stubs (§11.24)
- smoke.sh now exercises register → logout → login → me → board → pages
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 20:39:38 +02:00
7d3140334e
feat: messaging with conversations, rich text, attachments, typing, unread (phase 9)
...
- conversations: dm (unique pair, find-or-create), group (titled), project
(customer-bound); participant-only access
- messages: server-sanitized rich text, attachments referencing uploads
from the generic POST /api/v1/files endpoint (rate limited, MIME sniffed)
- unread counts via aggregation; mark-read pushes readBy receipts
- chat files served only to conversation participants (or uploader)
- @mentions in chat notify the mentioned participant
- typing indicator: client WS event relayed to other participants
- WS targeted delivery (SendTo) + 15s polling fallback
- two-pane messages UI: conversation list with unread badges, composer
(contenteditable + formatting buttons), drag & drop upload, inline image
previews with lightbox, new-conversation dialog with user search
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 20:15:56 +02:00
70a813edfa
feat: bounty board, task lifecycle, AI work performer flow, notifications (phase 8)
...
- whitelist HTML sanitizer (stdlib tokenizer) with XSS vector tests
- developer board: pool-scoped visibility, customer/search/minBounty/sort
filters, stale-task age badges, competing-claims visibility setting,
saved filters in profile extras
- claims: request/withdraw (developer), approve/decline (consultant) with
notifications to winners and losers; unassign/abandon back to board
- work tracking: start, sanitized comments with @mention notifications,
time logging, submit for review
- review queue + review with per-AC checklist stored on the timeline;
approve writes the immutable bountyAwards row (human assignees only)
- assign-to-AI: §5.2 job submission, HMAC-verified callback endpoint,
idempotent by jobId, artifacts downloaded into GridFS, failure path
keeps the task assigned with timeline + notification
- notifications API + bell with unread badge, dropdown, page, WS toasts
- pages: bounty board, my-tasks kanban, task detail (role-driven actions,
review dialog, AI dialog), review queue, developer pool
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 20:11:05 +02:00
f87b954f27
feat: atomization pipeline with job queue, atomizer client, WS hub, and board UI (phase 7)
...
- internal/extsvc: circuit breaker (§11.16) + retrying bearer JSON client
- atomizer client: §5.1 contract incl. defensive coefficient normalization
and extension coefficient range (0,2]
- persisted jobs collection: atomic claim, panic recovery, exponential
backoff (max 3), stale-running requeue, shutdown-safe bookkeeping
- subdivide (async 202, atomizing status, re-run replaces unpublished
children after confirm) and extend (sibling task, source budget)
- failure path reverts status and notifies the consultant on final attempt
- PATCH task editing with bounty recompute, budget cascade to descendants
- publish single + bulk; task detail endpoint role-scoped
- coder/websocket hub: multiplexed channels, origin check, 30s heartbeats;
client ws.js with reconnect + 15s polling fallback
- consultant atomization board: tree by root, coefficient sliders with live
per-parent sum indicator, bounty preview, modals, shimmer, atomizer-down
gating via /api/v1/service-health
- fix: tasks external-ref unique index is partial, not sparse (compound
sparse indexed every task through customerId and broke child inserts)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 19:17:09 +02:00
458ba6a7ee
feat: admin area with customers, users, settings, audit log, service status (phase 5)
...
- customer CRUD wizard backend: per-system credential shapes validated via
connector construction, AES-256-GCM at rest, write-only over the API
- ticketing connectors (jira/azure_devops/youtrack/demo) with test-connection
- user management: roles, disable (revokes sessions), force password reset,
delete; self-demotion/disable/delete guards
- admin-editable runtime settings ({_id:app}) incl. atomizer URL override
- audit log written on every privileged mutation + filterable list API
- service status panel: mongo/atomizer/work-performer health + latency with
late-bound breaker, sync and jobs status providers
- tabbed admin UI (customers wizard dialog, users table, settings, status, audit)
- compose: mongo nofile ulimit 64000 (1024 default crashed WiredTiger)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 18:57:10 +02:00
34bf5b5ac2
feat: base UI shell with themes, auth pages, profile, and role navigation (phase 4)
...
- embedded Go templates + vanilla ES-module JS + hand-written CSS, no build step
- exact §10 beige light / dark design tokens, square edges (radius 2px),
system font stack, visible focus rings
- theme toggle persisted to localStorage and the user profile
- login/register/change-password pages wired to the auth API
- profile page: avatar upload (image-sniffed, old file cleanup), bio,
contacts, arbitrary extra key/value fields, optimistic-concurrency 409
- role-based top navigation with placeholders for later-phase areas
- GET /files/{id} with scope-based access (session) or signed token (§5.1)
- security headers incl. CSP without unsafe-inline scripts
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-06-12 18:39:38 +02:00
etalon